@north-light/crouter 0.3.154

package/dist/commands/__tests__/canvas-config.test.js

@@ -0,0 +1,107 @@
+// canvas-config.test.ts — `canvas config list`/`show` (`../canvas-config.ts`)
+// mask every target's token presence/fingerprint from a SINGLE preloaded
+// `SecretsStore`, never re-reading/reparsing `secrets.json` once per target
+// (Minor 1, Phase 3 review 3).
+//
+// Proving "reads secrets.json once, not per target" can't be done by spying —
+// this is a real ESM module (`node:test`'s `mock.method` cannot redefine a
+// non-configurable ESM export; confirmed empirically, not assumed). Instead
+// `secrets.json` is a real named pipe (FIFO) with exactly ONE writer that
+// delivers its payload once and then closes: a SECOND `readFileSync` on that
+// path blocks forever waiting for a writer that will never come. So `list`
+// across N>1 targets only resolves within the timeout if it reads the file
+// exactly once — the old per-target-read code would hang on the second
+// target's read and this test would time out.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync, spawn } from 'node:child_process';
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { canvasConfigBranch } from '../canvas-config.js';
+import { updateConfig } from '../../core/config.js';
+import { readSecrets } from '../../core/secrets.js';
+import { InputError } from '../../core/io.js';
+function leaf(name) {
+    const found = (canvasConfigBranch.children ?? []).find((c) => c.name === name);
+    if (found === undefined || found.kind !== 'leaf')
+        throw new Error(`no leaf '${name}' under canvas config`);
+    return found;
+}
+let home;
+let realHome;
+before(() => {
+    realHome = process.env['HOME'];
+    home = mkdtempSync(join(tmpdir(), 'crtr-canvas-config-'));
+    process.env['HOME'] = home;
+});
+after(() => {
+    rmSync(home, { recursive: true, force: true });
+    if (realHome !== undefined)
+        process.env['HOME'] = realHome;
+    else
+        delete process.env['HOME'];
+});
+test('list masks N targets from ONE secrets.json read — a per-target re-read would hang on the exhausted FIFO', async () => {
+    // Three registered targets, each with a stored token — a per-target
+    // re-read regression would need 3 successful reads of secrets.json.
+    updateConfig('user', (cfg) => {
+        cfg.remoteCanvas.targets['alpha'] = { previewEndpoint: 'https://a.example', relayTokenRef: 'alpha' };
+        cfg.remoteCanvas.targets['beta'] = { previewEndpoint: 'https://b.example', relayTokenRef: 'beta' };
+        cfg.remoteCanvas.targets['gamma'] = { previewEndpoint: 'https://c.example', relayTokenRef: 'gamma' };
+    });
+    const crouterDir = join(home, '.crouter');
+    mkdirSync(crouterDir, { recursive: true });
+    const secretsPath = join(crouterDir, 'secrets.json');
+    execFileSync('mkfifo', [secretsPath]);
+    const payload = JSON.stringify({ relayTokens: { alpha: 'tok-a', beta: 'tok-b', gamma: 'tok-c' } });
+    // A single writer: opens the FIFO, writes the payload once, and exits —
+    // there is no second writer, so a second reader blocks forever.
+    const writer = spawn('sh', ['-c', `printf '%s' '${payload}' > '${secretsPath}'`], { stdio: 'ignore' });
+    try {
+        const result = await Promise.race([
+            leaf('list').run({}),
+            new Promise((_resolve, reject) => setTimeout(() => reject(new Error('list did not resolve — a second secrets.json read is blocking on the exhausted FIFO (per-target re-read regression)')), 2000)),
+        ]);
+        const targets = result['targets'];
+        assert.equal(targets.length, 3);
+        const byName = Object.fromEntries(targets.map((t) => [t['name'], t]));
+        assert.equal(byName['alpha']?.['tokenStored'], true);
+        assert.equal(byName['beta']?.['tokenStored'], true);
+        assert.equal(byName['gamma']?.['tokenStored'], true);
+        assert.notEqual(byName['alpha']?.['fingerprint'], byName['beta']?.['fingerprint']);
+    }
+    finally {
+        writer.kill();
+        // Replace the FIFO with a plain file so later tests in this process (or a
+        // stray writer) don't wedge on it.
+        rmSync(secretsPath, { force: true });
+        writeFileSync(secretsPath, payload);
+    }
+});
+// --- Phase 3 review Major 2: `add --relay-token` must be stdin-only ---
+test('add rejects a literal (non-"-") --relay-token value with a generic error that never echoes the received secret', async () => {
+    const secret = 'some-literal-secret-value';
+    await assert.rejects(() => leaf('add').run({ name: 'literal-reject-test', preview: 'https://example.test', relayToken: secret, cp: undefined }), (err) => {
+        assert.ok(err instanceof InputError, `expected InputError, got ${err}`);
+        const serialized = JSON.stringify({ message: err.message, payload: err.payload });
+        assert.ok(!serialized.includes(secret), 'the thrown error must never interpolate the received relay-token value');
+        return true;
+    });
+});
+test('add with --relay-token - reads the raw token from stdin and stores it', async () => {
+    const realStdin = process.stdin;
+    const fakeStdin = Readable.from([Buffer.from('piped-stdin-token\n')]);
+    fakeStdin.isTTY = false;
+    Object.defineProperty(process, 'stdin', { value: fakeStdin, configurable: true });
+    try {
+        const result = await leaf('add').run({ name: 'stdin-add-test', preview: 'https://example.test', relayToken: '-', cp: undefined });
+        assert.equal(result['tokenStored'], true);
+        const secrets = readSecrets('user');
+        assert.equal(secrets.relayTokens['stdin-add-test'], 'piped-stdin-token');
+    }
+    finally {
+        Object.defineProperty(process, 'stdin', { value: realStdin, configurable: true });
+    }
+});

package/dist/commands/__tests__/human.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/human.test.js

@@ -0,0 +1,344 @@
+// Tests for the human subtree argv-model migration.
+// Run with: node --import tsx/esm --test 'src/commands/__tests__/human.test.ts'
+//
+// These tests exercise the leaf param schemas via parseArgv (framework) and
+// spot-check the leaf definitions directly — no subprocess spawning, no tmux.
+import { test, describe, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { Readable } from 'node:stream';
+import { parseArgv } from '../../core/command.js';
+import { renderLeafArgv } from '../../core/help.js';
+import { humanAsk, sourceStamp } from '../human/prompts.js';
+import { coerceSingleSelectAgainst } from '../human/queue.js';
+// ---------------------------------------------------------------------------
+// Helper: write a temp JSON file and return its path.
+// ---------------------------------------------------------------------------
+function tmpJson(obj) {
+    const dir = join(tmpdir(), `crtr-human-test-${randomBytes(4).toString('hex')}`);
+    mkdirSync(dir, { recursive: true });
+    const p = join(dir, 'deck.json');
+    writeFileSync(p, JSON.stringify(obj));
+    return p;
+}
+async function withPipedStdin(body, fn) {
+    const original = process.stdin;
+    const stdin = Readable.from([Buffer.from(body)]);
+    Object.defineProperty(stdin, 'isTTY', { value: false, configurable: true });
+    Object.defineProperty(process, 'stdin', { value: stdin, configurable: true });
+    try {
+        return await fn();
+    }
+    finally {
+        Object.defineProperty(process, 'stdin', { value: original, configurable: true });
+    }
+}
+// ---------------------------------------------------------------------------
+// human review — positional file (path) + required --subtitle + optional --output
+// ---------------------------------------------------------------------------
+describe('human review: params', () => {
+    const params = [
+        { kind: 'positional', name: 'file', type: 'path', required: true, constraint: 'Existing .md file.' },
+        { kind: 'flag', name: 'subtitle', type: 'string', required: true, constraint: 'Review request.' },
+        { kind: 'flag', name: 'output', type: 'path', required: false, constraint: 'Where to write feedback.' },
+    ];
+    test('parses file + required subtitle', async () => {
+        const result = await parseArgv(params, ['/tmp/plan.md', '--subtitle', 'Review this plan so implementation can begin safely.']);
+        assert.equal(result['file'], '/tmp/plan.md');
+        assert.equal(result['subtitle'], 'Review this plan so implementation can begin safely.');
+    });
+    test('parses file + subtitle + --output', async () => {
+        const result = await parseArgv(params, ['/tmp/plan.md', '--subtitle', 'Review this plan so implementation can begin safely.', '--output', '/tmp/fb.json']);
+        assert.equal(result['file'], '/tmp/plan.md');
+        assert.equal(result['output'], '/tmp/fb.json');
+    });
+    // Validation is complete, never first-failure: one invocation yields ONE
+    // error naming every missing required parameter, and its Next: mandates the
+    // schema read rather than patching the first field.
+    test('missing file AND missing subtitle throw ONE missing_parameter naming both', async () => {
+        await assert.rejects(() => parseArgv(params, [], { leafPath: ['human', 'review'] }), (err) => {
+            assert.match(err.message, /required parameters are missing: positional FILE, --subtitle/);
+            assert.equal(err.details?.field, 'file, subtitle');
+            assert.match(err.details?.next ?? '', /Run `crtr human review -h` and read the full schema before re-issuing/);
+            return true;
+        });
+    });
+});
+// ---------------------------------------------------------------------------
+// human notify — positional title + required --subtitle + optional --body
+// ---------------------------------------------------------------------------
+describe('human notify: params', () => {
+    const params = [
+        { kind: 'positional', name: 'title', type: 'string', required: true, constraint: 'Headline.' },
+        { kind: 'flag', name: 'subtitle', type: 'string', required: true, constraint: 'Status and stakes.' },
+        { kind: 'flag', name: 'body', type: 'string', required: false, constraint: 'Markdown body.' },
+    ];
+    test('parses positional title + required subtitle', async () => {
+        const result = await parseArgv(params, ['Build done', '--subtitle', 'The build passed, so the change is ready to review.']);
+        assert.equal(result['title'], 'Build done');
+        assert.equal(result['subtitle'], 'The build passed, so the change is ready to review.');
+    });
+    test('parses title + subtitle + --body', async () => {
+        const result = await parseArgv(params, ['Done', '--subtitle', 'All tests passed, so deployment can proceed.', '--body', 'All tests pass.']);
+        assert.equal(result['title'], 'Done');
+        assert.equal(result['body'], 'All tests pass.');
+    });
+});
+// ---------------------------------------------------------------------------
+// human show — positional path + --watch bool + --window enum
+// ---------------------------------------------------------------------------
+describe('human show: params', () => {
+    const params = [
+        { kind: 'positional', name: 'path', type: 'path', required: true, constraint: 'File to render.' },
+        { kind: 'flag', name: 'watch', type: 'bool', required: false, constraint: 'Presence = true.' },
+        { kind: 'flag', name: 'window', type: 'enum', choices: ['auto', 'split', 'new'], required: false, default: 'auto', constraint: 'Placement.' },
+    ];
+    test('parses positional path', async () => {
+        const result = await parseArgv(params, ['/tmp/doc.md']);
+        assert.equal(result['path'], '/tmp/doc.md');
+    });
+    test('--watch absent → false (presence-only bool default)', async () => {
+        const result = await parseArgv(params, ['/tmp/doc.md']);
+        assert.equal(result['watch'], false);
+    });
+    test('--watch present → true', async () => {
+        const result = await parseArgv(params, ['/tmp/doc.md', '--watch']);
+        assert.equal(result['watch'], true);
+    });
+    test('--watch=true is rejected (bool takes no value)', async () => {
+        await assert.rejects(() => parseArgv(params, ['/tmp/doc.md', '--watch=true']), (err) => { assert.match(err.message, /takes no value/); return true; });
+    });
+    test('--window default is auto', async () => {
+        const result = await parseArgv(params, ['/tmp/doc.md']);
+        assert.equal(result['window'], 'auto');
+    });
+    test('--window accepts valid enum value', async () => {
+        const result = await parseArgv(params, ['/tmp/doc.md', '--window', 'split']);
+        assert.equal(result['window'], 'split');
+    });
+    test('--window rejects invalid value', async () => {
+        await assert.rejects(() => parseArgv(params, ['/tmp/doc.md', '--window', 'float']), (err) => { assert.match(err.message, /must be one of/); return true; });
+    });
+});
+// ---------------------------------------------------------------------------
+// human ask — --context-file (context-file kind, key=deckFile)
+//
+// NOTE: The argv parser hardcodes the CLI token as `--context-file` regardless
+// of the param's `name` field. The `name` field ("deckFile") becomes the key
+// in the input record. So the correct invocation is:
+//   crtr human ask --context-file deck.json
+// not --deck-file. Tests use --context-file accordingly.
+// ---------------------------------------------------------------------------
+describe('human ask: params', () => {
+    const params = [
+        { kind: 'context-file', name: 'deckFile', required: true, constraint: 'Humanloop deck JSON.' },
+    ];
+    test('--context-file parses JSON file and yields input.deckFile', async () => {
+        const deck = { interactions: [{ id: 'q', title: 'Go?', subtitle: 'Approve going ahead so the work can continue.', options: [{ id: 'yes', label: 'Yes' }] }] };
+        const path = tmpJson(deck);
+        const result = await parseArgv(params, ['--context-file', path]);
+        assert.deepEqual(result['deckFile'], deck);
+    });
+    test('--context-file missing → missing_parameter', async () => {
+        await assert.rejects(() => parseArgv(params, []), (err) => { assert.match(err.message, /required parameter is missing/); return true; });
+    });
+    test('--context-file with nonexistent file → invalid_type', async () => {
+        await assert.rejects(() => parseArgv(params, ['--context-file', '/no/such/deck.json']), (err) => { assert.match(err.message, /cannot read file/); return true; });
+    });
+    test('--context-file with non-JSON file → invalid_type', async () => {
+        const dir = join(tmpdir(), `crtr-human-test-${randomBytes(4).toString('hex')}`);
+        mkdirSync(dir, { recursive: true });
+        const p = join(dir, 'bad.json');
+        writeFileSync(p, 'not json at all');
+        await assert.rejects(() => parseArgv(params, ['--context-file', p]), (err) => { assert.match(err.message, /not valid JSON/); return true; });
+    });
+});
+// ---------------------------------------------------------------------------
+// human ask — stdin question + strict --context-file deck
+// ---------------------------------------------------------------------------
+describe('human ask: stdin question + strict deck', () => {
+    test('help requires an explicit title with the literal stdin body', () => {
+        const out = renderLeafArgv(humanAsk.help);
+        assert.match(out, /^  --title TITLE\s+string, optional\. Required with stdin:/m);
+        assert.match(out, /^  --subtitle SUBTITLE\s+string, optional\. Required with stdin:/m);
+        assert.match(out, /^  stdin\s+optional\. Simple open-text ask body\./m);
+        assert.match(out, /single-quoted heredoc/);
+        assert.match(out, /--context-file PATH/);
+        assert.doesNotMatch(out, /crtr human ask "<question>"/);
+    });
+    test('reads an explicit title and literal question bytes', async () => {
+        const question = 'Literal `backticks`, $dollars, $(command), ; semicolon, * glob\nsecond line\n';
+        const result = await withPipedStdin(question, () => parseArgv(humanAsk.help.params ?? [], ['--title', 'Release decision', '--subtitle', 'Choose whether to release now so the launch can proceed.']));
+        assert.equal(result['title'], 'Release decision');
+        assert.equal(result['subtitle'], 'Choose whether to release now so the launch can proceed.');
+        assert.equal(result['question'], question);
+    });
+    test('required stdin errors prescribe stdin rather than a positional payload', async () => {
+        const params = [{ kind: 'stdin', name: 'body', required: true, constraint: 'Markdown.' }];
+        await assert.rejects(() => withPipedStdin('', () => parseArgv(params, [])), (err) => {
+            assert.match(err.message, /required parameter is missing: stdin/);
+            assert.equal(err.details?.field, 'body');
+            assert.match(err.details?.next ?? '', /read the full schema before re-issuing/);
+            assert.doesNotMatch(err.details?.next ?? '', /positional argument/);
+            return true;
+        });
+    });
+    test('retains positional input compatibility without advertising it to agents', async () => {
+        const result = await parseArgv(humanAsk.help.params ?? [], ['Should we ship today?']);
+        assert.equal(result['question'], 'Should we ship today?');
+    });
+    // Regression: a caller passing BOTH a positional AND piped stdin (e.g.
+    // `crtr node new --kind x "title" < prompt.md`, or `crtr human ask -
+    // <<EOF`) used to have the positional silently win, with the entire piped
+    // body dropped on the floor. `-` must always mean "read stdin", and any
+    // OTHER positional alongside genuinely piped, non-empty stdin must error
+    // loudly rather than silently pick one.
+    test('`-` positional reads stdin instead of taking the literal value', async () => {
+        const body = 'Should we ship today?\nmulti-line brief\n';
+        const result = await withPipedStdin(body, () => parseArgv(humanAsk.help.params ?? [], ['-']));
+        assert.equal(result['question'], body);
+    });
+    test('positional + piped non-empty stdin → loud bad_invocation naming both sources', async () => {
+        await assert.rejects(() => withPipedStdin('piped body', () => parseArgv(humanAsk.help.params ?? [], ['Should we ship today?'])), (err) => {
+            assert.equal(err.code, 'bad_invocation');
+            assert.match(err.message, /positional/);
+            assert.match(err.message, /stdin/);
+            assert.match(err.message, /Should we ship today\?/);
+            assert.equal(err.details?.field, 'question');
+            assert.match(err.details?.next ?? '', /exactly one/);
+            return true;
+        });
+    });
+    test('positional with empty piped stdin (no TTY, no bytes) still uses the positional', async () => {
+        const result = await withPipedStdin('', () => parseArgv(humanAsk.help.params ?? [], ['Should we ship today?']));
+        assert.equal(result['question'], 'Should we ship today?');
+    });
+    test('parses --context-file into input.deck while keeping the strict deck path', async () => {
+        const deck = {
+            title: 'Choose a path',
+            interactions: [
+                { id: 'q', title: 'Pick one', subtitle: 'Choose the path that best supports the release.', options: [{ id: 'yes', label: 'Yes' }] },
+            ],
+        };
+        const path = tmpJson(deck);
+        const result = await withPipedStdin('', () => parseArgv(humanAsk.help.params ?? [], ['--context-file', path]));
+        assert.deepEqual(result['deck'], deck);
+    });
+});
+// ---------------------------------------------------------------------------
+// human cancel — positional job_id + optional --reason
+// ---------------------------------------------------------------------------
+describe('human cancel: params', () => {
+    const params = [
+        { kind: 'positional', name: 'job_id', type: 'string', required: true, constraint: 'Interaction node id.' },
+        { kind: 'flag', name: 'reason', type: 'string', required: false, constraint: 'Why it was retracted.' },
+    ];
+    test('parses positional job_id', async () => {
+        const result = await parseArgv(params, ['abc-1234']);
+        assert.equal(result['job_id'], 'abc-1234');
+    });
+    test('parses job_id + --reason', async () => {
+        const result = await parseArgv(params, ['abc-1234', '--reason', 'answered myself']);
+        assert.equal(result['job_id'], 'abc-1234');
+        assert.equal(result['reason'], 'answered myself');
+    });
+    test('missing job_id throws missing_parameter', async () => {
+        await assert.rejects(() => parseArgv(params, []), (err) => { assert.match(err.message, /required parameter is missing/); return true; });
+    });
+});
+// ---------------------------------------------------------------------------
+// sourceStamp — an optional presentation label, nothing more.
+//
+// Ticket identity and attribution come from the bridge node directory and its
+// parent relation, never from deck data — so the stamp carries at most
+// `{sessionName}`, resolved from CRTR_NODE_ID through crtrd. Without a node id,
+// or when crtrd cannot resolve one, the stamp is empty. `human cancel` is not
+// unit-testable in-process for the same reason: it delegates node lookup +
+// cancellation to crtrd, so exercising it needs a live daemon.
+// ---------------------------------------------------------------------------
+describe('sourceStamp: asking-node attribution', () => {
+    beforeEach(() => {
+        delete process.env['CRTR_NODE_ID'];
+    });
+    afterEach(() => {
+        delete process.env['CRTR_NODE_ID'];
+    });
+    test('bare shell (no CRTR_NODE_ID) → empty stamp', async () => {
+        assert.deepEqual(await sourceStamp(), {});
+    });
+    test('CRTR_NODE_ID crtrd cannot resolve → empty stamp, never a raw node id', async () => {
+        process.env['CRTR_NODE_ID'] = 'ghost-node';
+        assert.deepEqual(await sourceStamp(), {});
+    });
+});
+// ---------------------------------------------------------------------------
+// human list — --limit int + --cursor string
+// ---------------------------------------------------------------------------
+describe('human list: params', () => {
+    const params = [
+        { kind: 'flag', name: 'limit', type: 'int', required: false, default: 20, constraint: 'Default 20.' },
+        { kind: 'flag', name: 'cursor', type: 'string', required: false, constraint: 'Pagination token.' },
+    ];
+    test('defaults: limit=20, cursor=undefined', async () => {
+        const result = await parseArgv(params, []);
+        assert.equal(result['limit'], 20);
+        assert.equal(result['cursor'], undefined);
+    });
+    test('--limit parses integer', async () => {
+        const result = await parseArgv(params, ['--limit', '5']);
+        assert.equal(result['limit'], 5);
+    });
+    test('--limit rejects non-integer', async () => {
+        await assert.rejects(() => parseArgv(params, ['--limit', 'abc']), (err) => { assert.match(err.message, /must be an integer/); return true; });
+    });
+    test('--cursor passes through as string', async () => {
+        const result = await parseArgv(params, ['--cursor', 'tok_abc123']);
+        assert.equal(result['cursor'], 'tok_abc123');
+    });
+});
+// ---------------------------------------------------------------------------
+// human resolve — web-array → humanloop single-select coercion.
+//
+// Regression: the web always posts `selectedOptionIds` (an array) for every
+// option pick, but humanloop's strict validator rejects an array on a
+// non-multiSelect interaction ("invalid multi-select response"). Every
+// single-select deck resolved from the web — notify acks, yes/no approvals,
+// radio decisions — failed until this coercion. Multi-select and freetext must
+// pass through untouched.
+// ---------------------------------------------------------------------------
+describe('coerceSingleSelectAgainst: web array → humanloop shape', () => {
+    const deck = {
+        interactions: [
+            { id: 'notify', title: 'n', subtitle: 'Acknowledge this notice so the work can continue.', options: [{ id: 'ok', label: 'OK' }], kind: 'notify' },
+            { id: 'pick', title: 'p', subtitle: 'Choose every applicable option so the plan can continue.', options: [{ id: 'a', label: 'A' }, { id: 'b', label: 'B' }], multiSelect: true },
+            { id: 'ask', title: 'a', subtitle: 'Provide guidance so the work can continue.', options: [], allowFreetext: true },
+        ],
+    };
+    test('single-select 1-element array folds to selectedOptionId', () => {
+        const [r] = coerceSingleSelectAgainst([{ id: 'notify', selectedOptionIds: ['ok'] }], deck);
+        assert.equal(r.selectedOptionId, 'ok');
+        assert.equal(r.selectedOptionIds, undefined);
+    });
+    test('multi-select array passes through untouched', () => {
+        const [r] = coerceSingleSelectAgainst([{ id: 'pick', selectedOptionIds: ['a', 'b'] }], deck);
+        assert.deepEqual(r.selectedOptionIds, ['a', 'b']);
+        assert.equal(r.selectedOptionId, undefined);
+    });
+    test('single-select multi-element array is left for humanloop to reject', () => {
+        const [r] = coerceSingleSelectAgainst([{ id: 'notify', selectedOptionIds: ['ok', 'x'] }], deck);
+        assert.deepEqual(r.selectedOptionIds, ['ok', 'x']);
+        assert.equal(r.selectedOptionId, undefined);
+    });
+    test('freetext response passes through untouched', () => {
+        const [r] = coerceSingleSelectAgainst([{ id: 'ask', freetext: 'hello' }], deck);
+        assert.equal(r.freetext, 'hello');
+        assert.equal(r.selectedOptionId, undefined);
+    });
+    test('already-singular response is preserved', () => {
+        const [r] = coerceSingleSelectAgainst([{ id: 'notify', selectedOptionId: 'ok' }], deck);
+        assert.equal(r.selectedOptionId, 'ok');
+    });
+});

package/dist/commands/__tests__/node-no-kickoff-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/node-no-kickoff-flag.test.js

@@ -0,0 +1,73 @@
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { registerNode } from '../node.js';
+import { parseArgv } from '../../core/command.js';
+import { InputError } from '../../core/io.js';
+// `node new` is now a pure crtrd API client: the real end-to-end idle spawn
+// (broker + session up, zero model turns, follow_up notes IDLE) is exercised
+// against a REAL daemon in the B-1 parity harness and the daemon full tier
+// (src/daemon/api/__tests__/full/api-server.test.ts drives client.createNode +
+// real brokers). What stays worth testing here is the pure CLI-side flag matrix:
+// every mutually-exclusive --no-kickoff guard fires BEFORE any client call, so
+// these run with no daemon.
+const owner = 'no-kickoff-flag-owner';
+let home;
+let previousHome;
+let previousNodeId;
+function nodeNew() {
+    const command = registerNode().children.find((child) => child.name === 'new');
+    assert.ok(command?.kind === 'leaf', 'node new leaf is registered');
+    return command;
+}
+before(() => {
+    previousHome = process.env.CRTR_HOME;
+    previousNodeId = process.env.CRTR_NODE_ID;
+    home = mkdtempSync('/tmp/crtr-nk-flag-');
+    process.env.CRTR_HOME = home;
+    process.env.CRTR_NODE_ID = owner;
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.CRTR_HOME;
+    else
+        process.env.CRTR_HOME = previousHome;
+    if (previousNodeId === undefined)
+        delete process.env.CRTR_NODE_ID;
+    else
+        process.env.CRTR_NODE_ID = previousNodeId;
+    rmSync(home, { recursive: true, force: true });
+});
+test('argv parsing accepts an empty/absent stdin prompt (required relaxed to allow --no-kickoff)', async () => {
+    const leaf = nodeNew();
+    // readStdinRaw() short-circuits to '' only when stdin looks like an
+    // interactive TTY (no pipe) — force that so this exercises "no prompt was
+    // piped" without blocking on the test runner's own (never-closing) stdin.
+    const previousTty = Object.getOwnPropertyDescriptor(process.stdin, 'isTTY');
+    Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true, writable: true });
+    let result;
+    try {
+        result = await parseArgv(leaf.help.params ?? [], ['--root', '--no-kickoff']);
+    }
+    finally {
+        if (previousTty === undefined)
+            Reflect.deleteProperty(process.stdin, 'isTTY');
+        else
+            Object.defineProperty(process.stdin, 'isTTY', previousTty);
+    }
+    assert.equal(result['prompt'], '', 'no stdin was piped, so the resolved prompt is empty');
+    assert.equal(result['noKickoff'], true);
+    assert.equal(result['root'], true);
+});
+test('--no-kickoff without --root is rejected', async () => {
+    await assert.rejects(() => nodeNew().run({ noKickoff: true }), (error) => error instanceof InputError && error.code === 'no_kickoff_requires_root');
+});
+test('--no-kickoff with a prompt is rejected (mutually exclusive)', async () => {
+    await assert.rejects(() => nodeNew().run({ noKickoff: true, root: true, prompt: 'hello' }), (error) => error instanceof InputError && error.code === 'no_kickoff_with_prompt');
+});
+test('--no-kickoff combined with orchestrator mode is rejected', async () => {
+    await assert.rejects(() => nodeNew().run({ noKickoff: true, root: true, mode: 'orchestrator' }), (error) => error instanceof InputError && error.code === 'no_kickoff_orchestrator_unsupported');
+});
+test('no prompt and no --no-kickoff is still rejected (pre-existing requirement preserved)', async () => {
+    await assert.rejects(() => nodeNew().run({ root: true }), (error) => error instanceof InputError && error.code === 'empty_prompt');
+});

package/dist/commands/__tests__/node-worktree-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/node-worktree-flag.test.js

@@ -0,0 +1,49 @@
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { registerNode } from '../node.js';
+import { parseArgv } from '../../core/command.js';
+import { CrtrError } from '../../core/errors.js';
+import { InputError } from '../../core/io.js';
+// `node new` is now a pure crtrd API client: the CLI forwards --worktree's base
+// into the createNode request (`worktree: <base>`), and the SERVER's buildRecipe
+// + spawnChild own forwarding it to worktree creation. That server-side forwarding is exercised end-to-end in
+// the daemon full tier (src/daemon/api/__tests__/full/worktree-parity.test.ts).
+// What stays worth testing HERE is the pure CLI-side validation that fires
+// BEFORE any client call, so these run with no daemon.
+const owner = 'worktree-flag-owner';
+let home;
+let previousHome;
+let previousNodeId;
+function nodeNew() {
+    const command = registerNode().children.find((child) => child.name === 'new');
+    assert.ok(command?.kind === 'leaf', 'node new leaf is registered');
+    return command;
+}
+before(() => {
+    previousHome = process.env.CRTR_HOME;
+    previousNodeId = process.env.CRTR_NODE_ID;
+    home = mkdtempSync(join(tmpdir(), 'crtr-node-worktree-flag-'));
+    process.env.CRTR_HOME = home;
+    process.env.CRTR_NODE_ID = owner;
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.CRTR_HOME;
+    else
+        process.env.CRTR_HOME = previousHome;
+    if (previousNodeId === undefined)
+        delete process.env.CRTR_NODE_ID;
+    else
+        process.env.CRTR_NODE_ID = previousNodeId;
+    rmSync(home, { recursive: true, force: true });
+});
+test('bare --worktree is rejected by argv parsing before node new can spawn', async () => {
+    const leaf = nodeNew();
+    await assert.rejects(() => parseArgv(leaf.help.params ?? [], ['prompt', '--worktree']), (error) => error instanceof CrtrError && error.code === 'missing_parameter');
+});
+test('--worktree= is rejected by node new before spawn', async () => {
+    await assert.rejects(() => nodeNew().run({ prompt: 'prompt', worktree: '' }), (error) => error instanceof InputError && error.code === 'worktree_base_required');
+});

package/dist/commands/__tests__/revive-now-gate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/revive-now-gate.test.js

@@ -0,0 +1,60 @@
+// Regression for issue #115: `crtr node lifecycle revive --now` rejected exactly the
+// provider-fault nodes the canvas dashboard flags as ⚠ "needs you"
+// (status-glyph.ts `faultDispositionText`), because the old gate required
+// `retry.disposition === 'auto'` — the one disposition "needs you" NEVER is.
+// Run with: node --import tsx/esm --test 'src/commands/__tests__/revive-now-gate.test.ts'
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { isNowEligibleFault } from '../node-lifecycle-revive.js';
+import { faultNeedsYou } from '../../core/canvas/status-glyph.js';
+function fault(over) {
+    return {
+        link: 'pi→provider',
+        op: 'generation turn',
+        kind: 'overloaded',
+        retry: { disposition: 'auto', by: 'daemon' },
+        message: 'boom',
+        since: new Date().toISOString(),
+        operation_id: '33333333333333333333333333333333',
+        ...over,
+    };
+}
+test('null fault is never --now eligible', () => {
+    assert.equal(isNowEligibleFault(null), false);
+});
+test('daemon-owned auto retry is eligible (kick it early)', () => {
+    assert.equal(isNowEligibleFault(fault({ retry: { disposition: 'auto', by: 'daemon' } })), true);
+});
+test('client-owned auto retry (redialing) is refused — already being handled', () => {
+    assert.equal(isNowEligibleFault(fault({ retry: { disposition: 'auto', by: 'client' } })), false);
+});
+// The bug: exhausted-retry / immediate-fatal pi→provider faults render "needs
+// you" on the dashboard (faultNeedsYou === true) but the old gate rejected
+// them outright — no sanctioned recovery verb existed for exactly the nodes
+// the dashboard told the user to attend to.
+test('fatal pi→provider fault ("needs you") is now eligible', () => {
+    const f = fault({ retry: { disposition: 'fatal' } });
+    assert.equal(faultNeedsYou(f), true);
+    assert.equal(isNowEligibleFault(f), true);
+});
+test('manual pi→provider fault ("needs you") is eligible', () => {
+    const f = fault({ retry: { disposition: 'manual' } });
+    assert.equal(faultNeedsYou(f), true);
+    assert.equal(isNowEligibleFault(f), true);
+});
+test('a non-pi→provider fault (e.g. a daemon→node wedge) is refused — --now cannot clear it', () => {
+    const f = fault({ link: 'daemon→node', kind: 'wedged', retry: { disposition: 'manual' } });
+    assert.equal(isNowEligibleFault(f), false);
+});
+test('faultNeedsYou matches the gate for every disposition (no drift between dashboard and --now)', () => {
+    for (const disposition of ['auto', 'manual', 'fatal']) {
+        const f = fault({ retry: { disposition, by: 'daemon' } });
+        if (disposition === 'auto') {
+            assert.equal(faultNeedsYou(f), false);
+        }
+        else {
+            assert.equal(faultNeedsYou(f), true);
+            assert.equal(isNowEligibleFault(f), true);
+        }
+    }
+});