@north-light/crouter 0.3.154

package/dist/core/__tests__/pid-identity-match.test.js

@@ -0,0 +1,145 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/pid-identity-match.test.ts
+//
+// Regression cover for the uncapped-revive-loop bug on Blaxel unikraft guests
+// (crouter-cloud "frozen on reconnecting", 2026-07-11): process identity is
+// `lstart#ticks`, but `lstart` is derived from the wall-clock boot epoch
+// (`/proc/stat` btime + starttime jiffies) and btime is UNSTABLE in the guest
+// (clock correction / suspend-resume). A SINGLE live broker was observed with
+// identical pid+ticks but `lstart` drifting +81s between two probes. The old
+// `identitiesMatch` compared the `lstart` base FIRST and returned false on any
+// base mismatch — so it read that still-live broker as reused/dead every
+// cycle, wedging the daemon into an uncapped revive loop that rebound the
+// node's view.sock and dropped the browser chat WS forever.
+//
+// The fix: when BOTH identities carry `#ticks`, ticks decide it ALONE (they
+// are per-boot unique, strictly finer than lstart, and — unlike lstart — do
+// not move when the wall clock does). The base is consulted only when a side
+// lacks ticks (macOS / no procfs).
+//
+// Follow-up (cross-boot false match): ticks-alone is only safe WITHIN one
+// boot — jiffies-since-boot reset and can repeat across boots. So the identity
+// base is now BOOT-SCOPED on Linux-with-procfs: it is the kernel `boot_id`
+// UUID (`<bootId>#<ticks>`), and a new-format match requires base AND ticks.
+// A legacy `lstart#ticks` row (recorded before this) still migrates cleanly:
+// when a base is NOT a boot_id UUID on either side, ticks decide alone.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { identitiesMatch, composeIdentity, makeBootIdCache } from '../canvas/pid.js';
+test('equal ticks with DIFFERENT lstart bases compare EQUAL (the btime-drift bug)', () => {
+    // Same live process, same jiffies-since-boot; only the wall-clock-anchored
+    // lstart drifted because btime shifted. Must NOT read as reuse.
+    const a = 'Sat Jul 11 17:50:24 2026#53459';
+    const b = 'Sat Jul 11 17:51:45 2026#53459';
+    assert.equal(identitiesMatch(a, b), true, 'equal ticks must win over a drifting lstart base');
+});
+test('different ticks compare UNEQUAL even when lstart bases are identical (same-second reuse)', () => {
+    const a = 'Sat Jul 11 17:50:24 2026#53459';
+    const b = 'Sat Jul 11 17:50:24 2026#60536';
+    assert.equal(identitiesMatch(a, b), false, 'different ticks are proof of a reused pid');
+});
+test('identities WITHOUT ticks fall back to comparing the lstart base', () => {
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026'), true, 'no ticks, equal base → match');
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026'), false, 'no ticks, different base → reuse');
+});
+test('one side lacking ticks fails open to a base compare (transient /proc miss)', () => {
+    // A transient `/proc` read failure can record the SAME live process plain on
+    // one capture and with ticks on another. Bases agree → fail-open to match.
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026#53459'), true, 'coarse-vs-fine with matching base → match');
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026#53459'), false, 'coarse-vs-fine with different base → reuse');
+});
+// --- boot-scoped (new-format) identities ---
+const BOOT_A = '4b0c1d2e-3f40-4152-8637-a1b2c3d4e5f6';
+const BOOT_B = '9e8d7c6b-5a40-4938-9271-fedcba098765';
+test('new-format: equal boot_id + equal ticks → match', () => {
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#53459`), true, 'same boot, same process');
+});
+test('new-format: equal ticks + DIFFERENT boot_id → NO match (cross-boot collision)', () => {
+    // Ticks reset per boot and can repeat; a different boot_id with the same
+    // ticks is a DIFFERENT process on a DIFFERENT boot. This is the exact false
+    // match the boot-scoped base closes.
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_B}#53459`), false, 'equal ticks must NOT win across boots');
+});
+test('new-format: same boot_id + DIFFERENT ticks → NO match (in-boot reuse)', () => {
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#60536`), false, 'reused pid within one boot');
+});
+test('migration: legacy lstart#ticks vs new bootId#ticks with equal ticks → match', () => {
+    // An in-place upgrade compares an already-recorded `lstart#ticks` row
+    // against a freshly-read `bootId#ticks`. A blanket base-mismatch verdict
+    // would false-kill the live broker; the legacy base (not a UUID) routes to
+    // ticks-alone so the live broker survives the upgrade.
+    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#53459', `${BOOT_A}#53459`), true, 'legacy → new migration');
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, 'Sat Jul 11 17:51:45 2026#53459'), true, 'order-independent');
+    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#60536', `${BOOT_A}#53459`), false, 'legacy migration still discriminates on ticks');
+});
+// --- composeIdentity composition (guards against a regression that emits the
+//     old wall-clock `lstart#ticks` on a boot_id-capable host) ---
+test('composeIdentity: procfs + boot_id host emits <bootId>#<ticks> with the base equal to the kernel boot_id', () => {
+    // The exact production-guest shape. The `deps` seam injects the boot_id and
+    // ticks so the composition is provable off-Linux (real /proc reads return
+    // null there). If composeIdentity regressed to emitting lstart#ticks, the
+    // base here would be the lstart string, not BOOT_A — this asserts it is not.
+    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: BOOT_A, ticks: '53459' });
+    assert.equal(id, `${BOOT_A}#53459`, 'base must be the kernel boot_id, not the wall-clock lstart');
+    assert.equal(splitBase(id), BOOT_A);
+});
+test('composeIdentity: procfs but NO readable boot_id falls back to <lstart>#<ticks>', () => {
+    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: null, ticks: '53459' });
+    assert.equal(id, 'Sat Jul 11 17:51:45 2026#53459', 'no boot_id → prior lstart#ticks behavior');
+});
+test('composeIdentity: no procfs ticks emits the bare <lstart> (coarse, unchanged)', () => {
+    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: BOOT_A, ticks: null });
+    assert.equal(id, 'Sat Jul 11 17:51:45 2026', 'no ticks → bare lstart regardless of boot_id');
+});
+function splitBase(identity) {
+    const i = identity.indexOf('#');
+    return i === -1 ? identity : identity.slice(0, i);
+}
+// --- boot_id cache: a TRANSIENT read failure must be retried, never cached as
+//     permanent absence (would permanently downgrade a boot_id host to legacy
+//     lstart#ticks identities). This exercises the exact memoize used by
+//     bootIdBase. ---
+test('makeBootIdCache: a null read is negative-cached, RETRIED only after the window, then a success is cached forever', () => {
+    let calls = 0;
+    const reads = [null, BOOT_A, BOOT_B];
+    let clock = 1_000;
+    const cache = makeBootIdCache(() => {
+        const v = calls < reads.length ? reads[calls] : BOOT_B;
+        calls += 1;
+        return v;
+    }, () => clock, 100);
+    assert.equal(cache(), null, 'first read failed → null (not cached)');
+    assert.equal(calls, 1);
+    assert.equal(cache(), null, 'within the negative window → NOT re-read');
+    assert.equal(calls, 1, 'the throwing read is rate-limited, not repeated every call');
+    clock += 100; // advance past the negative-cache deadline
+    assert.equal(cache(), BOOT_A, 'after the window the failure is retried → succeeds');
+    assert.equal(calls, 2);
+    clock += 10_000;
+    assert.equal(cache(), BOOT_A, 'success is now cached → reader NOT called again');
+    assert.equal(calls, 2, 'no further reads after a successful one');
+});
+test('makeBootIdCache: a permanent no-boot_id host reads null only once per negative window (bounded, not per-call)', () => {
+    let calls = 0;
+    let clock = 1_000;
+    const cache = makeBootIdCache(() => {
+        calls += 1;
+        return null;
+    }, () => clock, 100);
+    assert.equal(cache(), null);
+    assert.equal(cache(), null);
+    assert.equal(cache(), null);
+    assert.equal(calls, 1, 'repeated calls within one window do a SINGLE read — no synchronous read storm');
+    clock += 100;
+    assert.equal(cache(), null);
+    assert.equal(calls, 2, 'one read per window — still retryable for a transient miss, but bounded');
+});
+test('malformed/empty ticks suffix is treated as ABSENT (base compare applies)', () => {
+    // A garbage suffix must never be trusted as a fine discriminator; it falls
+    // back to the base compare.
+    assert.equal(identitiesMatch('A#', 'B#'), false, 'empty suffix → absent ticks → bases differ');
+    assert.equal(identitiesMatch('A#', 'A#'), true, 'empty suffix → absent ticks → bases agree');
+    assert.equal(identitiesMatch('A#bad', 'B#bad'), false, 'non-numeric suffix → absent ticks → bases differ');
+    assert.equal(identitiesMatch('A#bad', 'A#other'), true, 'non-numeric suffix → absent ticks → bases agree');
+    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_A}#12#34`), true, 'multiple-# suffix is non-numeric → absent ticks → boot_id bases agree');
+    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_B}#12#34`), false, 'multiple-# suffix → absent ticks → boot_id bases differ');
+});

package/dist/core/__tests__/pid-zombie.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/pid-zombie.test.js

@@ -0,0 +1,42 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/pid-zombie.test.ts
+//
+// Regression cover for the zombie-broker revive bug: `kill(pid, 0)` reports a
+// ZOMBIE process (exited, awaiting reap by its parent) as perfectly alive —
+// its pid is still occupied in the process table. A broker's spawning process
+// that never gets to process its SIGCHLD (the real-world trigger: `bootRoot`'s
+// foreground attach session used to block its OWN event loop for the whole
+// session via a synchronous `spawnSync`, so it could never reap its detached
+// broker child in real time — see the async-spawn fix in runtime/spawn.ts)
+// leaves that broker a zombie indefinitely. The daemon's revive guard reads
+// liveness through `isPidAlive(pi_pid)` alone (`revive.ts`), so misreading a
+// zombie as alive wedges the relaunch forever. `isPidAlive` must classify a
+// genuine zombie as dead.
+//
+// Fabricates a REAL zombie: spawn a child with no exit listener, then starve
+// THIS process's own event loop with a synchronous busy-wait spanning the
+// child's exit — mirroring exactly how a blocking spawnSync parks the parent's
+// loop past a child's death, before any assertion ever runs.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { isPidAlive } from '../canvas/pid.js';
+test('isPidAlive reads a genuine zombie process as dead, not alive', () => {
+    const child = spawn('/bin/sh', ['-c', 'exit 0'], { detached: true, stdio: 'ignore' });
+    const pid = child.pid;
+    assert.ok(pid != null, 'child must have a pid');
+    child.unref(); // no exit listener attached — nothing reaps it while the loop is starved below
+    // Busy-wait SYNCHRONOUSLY (no `await`/timer — starving the event loop, not
+    // just delaying it) long enough for the child to exit and the kernel to
+    // mark it a zombie, before this process's SIGCHLD handling ever gets a turn.
+    const deadline = Date.now() + 400;
+    while (Date.now() < deadline) { /* starve the loop */ }
+    assert.equal(isPidAlive(pid), false, 'a zombie pid must read as dead, not alive');
+    // Best-effort cleanup: signaling an already-zombied pid is a harmless no-op
+    // (it's already dead) — the zombie self-clears once this test process exits
+    // and the orphan is reparented to init, same as every other fixture in this
+    // suite; nothing here relies on that timing for the assertion above.
+    try {
+        process.kill(pid, 'SIGKILL');
+    }
+    catch { /* already gone */ }
+});

package/dist/core/__tests__/preview-registry-sync.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/preview-registry-sync.test.js

@@ -0,0 +1,65 @@
+// Drift guard for the attach-viewer's bundle-safe preview registry.
+// Run with: node --import tsx/esm --test src/core/__tests__/preview-registry-sync.test.ts
+//
+// src/core/preview-registry.ts is a hand-maintained, zero-import mirror of
+// every leaf's `help.preview.suppressOutput` — it has to be hand-maintained
+// (not computed) because the attach viewer can never import the live command
+// tree (build-root.ts pulls in every subtree, including the web client's
+// Tailwind native binary — see command-preview-implementation.md). This test
+// is the only thing that keeps the mirror honest: it walks the real,
+// buildRoot()-assembled tree (safe here — this is a test, not the attach
+// bundle) and asserts the set of leaves declaring `suppressOutput: true`
+// matches the registry exactly.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildRoot } from '../../build-root.js';
+import { SUPPRESS_OUTPUT_LEAVES } from '../preview-registry.js';
+import { resetScopeCache } from '../scope.js';
+// buildRoot() composes external command-plugin branches from the effective
+// enabled plugins (user scope + project ancestors). Pin HOME + profile to an
+// isolated no-plugin home so ambient machine state can't inject an external
+// leaf and make this drift guard nondeterministic.
+let home;
+let realHome;
+let realProfile;
+before(() => {
+    realHome = process.env['HOME'];
+    realProfile = process.env['CRTR_PROFILE_ID'];
+    home = mkdtempSync(join(tmpdir(), 'crtr-preview-registry-'));
+    process.env['HOME'] = home;
+    delete process.env['CRTR_PROFILE_ID'];
+    resetScopeCache();
+});
+after(() => {
+    if (realHome !== undefined)
+        process.env['HOME'] = realHome;
+    else
+        delete process.env['HOME'];
+    if (realProfile !== undefined)
+        process.env['CRTR_PROFILE_ID'] = realProfile;
+    rmSync(home, { recursive: true, force: true });
+    resetScopeCache();
+});
+test('preview-registry.ts matches every leaf declaring help.preview.suppressOutput', async () => {
+    const root = await buildRoot();
+    const declared = new Set();
+    const walk = (branch) => {
+        for (const child of branch.children) {
+            if (child.kind === 'branch') {
+                walk(child);
+            }
+            else {
+                const leaf = child;
+                if (leaf.help.preview?.suppressOutput === true)
+                    declared.add(leaf.help.name);
+            }
+        }
+    };
+    for (const subtree of root.subtrees)
+        walk(subtree);
+    assert.deepEqual([...declared].sort(), [...SUPPRESS_OUTPUT_LEAVES].sort(), 'src/core/preview-registry.ts is out of sync with the leaves that declare ' +
+        'help.preview.suppressOutput — update SUPPRESS_OUTPUT_LEAVES to match.');
+});

package/dist/core/__tests__/prune-to-limit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/prune-to-limit.test.js

@@ -0,0 +1,126 @@
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, getRow, recordPid, pruneToLimit, } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { nodeDir } from '../canvas/paths.js';
+let home;
+// A timestamp `secondsAgo` before now — created order doubles as recency order
+// here (no telemetry.json is written, so recencyMs falls back to created epoch).
+const at = (secondsAgo) => new Date(Date.now() - secondsAgo * 1000).toISOString();
+function node(id, over = {}) {
+    return {
+        node_id: id,
+        name: id,
+        created: at(0),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'dead',
+        ...over,
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-prune-limit-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+    delete process.env['CRTR_NODE_ID'];
+});
+test('keeps all live nodes even when liveCount exceeds the cap', () => {
+    // 5 live (active/idle with a running pi) + 2 old terminal; cap of 3.
+    // target = max(3, 5) = 5, so NO live node is ever deleted; the 2 terminal
+    // fall beyond rank 5 and are pruned.
+    for (let i = 0; i < 5; i++) {
+        createNode(node(`live-${i}`, { status: 'active', created: at(i) }));
+        recordPid(`live-${i}`, process.pid); // process.pid is alive → isPidAlive true
+    }
+    createNode(node('old-a', { status: 'dead', created: at(100) }));
+    createNode(node('old-b', { status: 'done', created: at(101) }));
+    const result = pruneToLimit({ maxNodes: 3 });
+    assert.equal(result.dryRun, false);
+    assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['old-a', 'old-b']);
+    for (let i = 0; i < 5; i++) {
+        assert.ok(getRow(`live-${i}`) !== null, `live-${i} must survive past the cap`);
+    }
+});
+test('deletes the oldest terminal nodes beyond max(cap, liveCount)', () => {
+    // 1 live + 5 terminal of descending recency; cap of 3 → target = max(3,1) = 3.
+    // Ranked by recency DESC: live-0, term-0, term-1 (top 3, kept), then
+    // term-2, term-3, term-4 (rank >= 3, pruned).
+    createNode(node('live-0', { status: 'idle', created: at(0) }));
+    recordPid('live-0', process.pid);
+    for (let i = 0; i < 5; i++) {
+        createNode(node(`term-${i}`, { status: 'dead', created: at(10 + i) }));
+    }
+    const result = pruneToLimit({ maxNodes: 3 });
+    assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['term-2', 'term-3', 'term-4']);
+    // The kept set: the live node + the two newest terminal.
+    for (const id of ['live-0', 'term-0', 'term-1']) {
+        assert.ok(getRow(id) !== null, `${id} must survive`);
+        assert.ok(existsSync(nodeDir(id)), `${id} dir must survive`);
+    }
+    // The pruned set: rows AND dirs gone.
+    for (const id of ['term-2', 'term-3', 'term-4']) {
+        assert.equal(getRow(id), null, `${id} row should be pruned`);
+        assert.ok(!existsSync(nodeDir(id)), `${id} dir should be removed`);
+    }
+});
+test('a non-terminal node with a dead pid is never a prune candidate (issue #114)', () => {
+    // An active row whose broker crashed: status stays 'active' but pi_pid is
+    // NULL (never recorded), so isPidAlive would be false. It must still be
+    // protected — crash-recovery, not the count-based pruner, owns this row —
+    // even though it's the oldest node and cap is exceeded by newer terminal rows.
+    createNode(node('crashed-active', { status: 'active', created: at(100) }));
+    for (let i = 0; i < 5; i++) {
+        createNode(node(`term-${i}`, { status: 'dead', created: at(i) }));
+    }
+    const result = pruneToLimit({ maxNodes: 3 });
+    assert.ok(!result.pruned.some((p) => p.node_id === 'crashed-active'), 'a crashed-but-active node must not be selected for pruning');
+    assert.ok(getRow('crashed-active') !== null, 'crashed-active row must survive');
+    assert.ok(existsSync(nodeDir('crashed-active')), 'crashed-active dir must survive');
+});
+test('count pruning retains an open managed worktree node beyond the cap', () => {
+    createNode(node('open-worktree', {
+        created: at(100),
+        managed_worktree: {
+            state: 'open',
+            path: join(home, 'worktrees', 'open-worktree'),
+            branch: 'crtr/open-worktree',
+            repo_root: '/tmp/repo',
+            base_ref: 'main',
+            base_sha: 'base',
+            created: at(100),
+        },
+    }));
+    for (let i = 0; i < 3; i++) {
+        createNode(node(`term-${i}`, { created: at(i) }));
+    }
+    const result = pruneToLimit({ maxNodes: 1 });
+    assert.ok(!result.pruned.some((p) => p.node_id === 'open-worktree'));
+    assert.ok(getRow('open-worktree') !== null, 'node remains to own its managed worktree');
+    assert.ok(existsSync(nodeDir('open-worktree')), 'node dir remains');
+});
+test('--dry-run reports candidates but deletes nothing', () => {
+    for (let i = 0; i < 5; i++) {
+        createNode(node(`term-${i}`, { status: 'dead', created: at(i) }));
+    }
+    const result = pruneToLimit({ maxNodes: 3, dryRun: true });
+    assert.equal(result.dryRun, true);
+    assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['term-3', 'term-4']);
+    // Nothing deleted — all rows + dirs intact.
+    for (let i = 0; i < 5; i++) {
+        assert.ok(getRow(`term-${i}`) !== null, `term-${i} must survive a dry run`);
+        assert.ok(existsSync(nodeDir(`term-${i}`)), `term-${i} dir must survive a dry run`);
+    }
+});

package/dist/core/__tests__/prune.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/prune.test.js

@@ -0,0 +1,135 @@
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, getRow, subscribe, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, } from '../canvas/canvas.js';
+import { closeDb, openDb } from '../canvas/db.js';
+import { nodeDir } from '../canvas/paths.js';
+let home;
+const DAY = 86_400_000;
+const old = () => new Date(Date.now() - 30 * DAY).toISOString();
+const now = () => new Date().toISOString();
+function node(id, over = {}) {
+    return {
+        node_id: id,
+        name: id,
+        created: now(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...over,
+    };
+}
+function totalEdges() {
+    return openDb().prepare('SELECT COUNT(*) AS n FROM edges').get().n;
+}
+/** The standard fixture: three prunable terminal nodes (old), three survivors
+ *  (two old-but-live, one recent-but-dead), and edges that touch a pruned node
+ *  so cascade is observable. */
+function seedFixture() {
+    createNode(node('old-dead', { status: 'dead', created: old() }));
+    createNode(node('old-done', { status: 'done', created: old() }));
+    createNode(node('old-canceled', { status: 'canceled', created: old() }));
+    createNode(node('old-active', { status: 'active', created: old() }));
+    createNode(node('old-idle', { status: 'idle', created: old() }));
+    createNode(node('recent-dead', { status: 'dead', created: now() }));
+    // A survivor subscribes to a pruned node (cascade on to_id) …
+    subscribe('old-active', 'old-dead', true);
+    // … and a pruned node's audit edge to another pruned node (cascade on both).
+    recordSpawn('old-done', 'old-dead');
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-prune-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('prune removes terminal nodes past the TTL and keeps live + recent ones', () => {
+    seedFixture();
+    assert.equal(totalEdges(), 2);
+    const result = pruneNodes({ ttlDays: 14 });
+    // The three old terminal nodes are pruned; nothing else.
+    assert.equal(result.dryRun, false);
+    assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['old-canceled', 'old-dead', 'old-done']);
+    // Pruned rows are gone …
+    for (const id of ['old-dead', 'old-done', 'old-canceled']) {
+        assert.equal(getRow(id), null, `${id} row should be pruned`);
+    }
+    // … and the survivors remain (live-but-old + recent-but-dead).
+    for (const id of ['old-active', 'old-idle', 'recent-dead']) {
+        assert.ok(getRow(id) !== null, `${id} should survive`);
+    }
+});
+test('pruning cascade-deletes the pruned nodes\u2019 edges', () => {
+    seedFixture();
+    assert.equal(totalEdges(), 2);
+    pruneNodes({ ttlDays: 14 });
+    // Both edges touched a pruned node (old-dead) → both cascade away.
+    assert.equal(totalEdges(), 0);
+    // The surviving subscriber's edge to the pruned publisher is gone.
+    assert.deepEqual(subscriptionsOf('old-active'), []);
+    assert.deepEqual(subscribersOf('old-dead'), []);
+});
+test('pruning removes each pruned node\u2019s on-disk dir, leaves survivors\u2019 dirs', () => {
+    seedFixture();
+    assert.ok(existsSync(nodeDir('old-dead')));
+    assert.ok(existsSync(nodeDir('old-active')));
+    pruneNodes({ ttlDays: 14 });
+    assert.ok(!existsSync(nodeDir('old-dead')), 'pruned dir should be removed');
+    assert.ok(!existsSync(nodeDir('old-done')));
+    assert.ok(!existsSync(nodeDir('old-canceled')));
+    assert.ok(existsSync(nodeDir('old-active')), 'survivor dir should remain');
+    assert.ok(existsSync(nodeDir('recent-dead')));
+});
+test('--dry-run reports candidates but deletes nothing', () => {
+    seedFixture();
+    const before = totalEdges();
+    const result = pruneNodes({ ttlDays: 14, dryRun: true });
+    // Candidates are reported …
+    assert.equal(result.dryRun, true);
+    assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['old-canceled', 'old-dead', 'old-done']);
+    // … but NOTHING is deleted: rows, edges, and dirs all intact.
+    for (const id of ['old-dead', 'old-done', 'old-canceled']) {
+        assert.ok(getRow(id) !== null, `${id} must survive a dry run`);
+        assert.ok(existsSync(nodeDir(id)), `${id} dir must survive a dry run`);
+    }
+    assert.equal(totalEdges(), before);
+});
+test('prune and the daemon operate on disjoint status sets', () => {
+    // active|idle (the daemon's domain) are NEVER pruned, even when ancient.
+    createNode(node('ancient-active', { status: 'active', created: old() }));
+    createNode(node('ancient-idle', { status: 'idle', created: old() }));
+    const result = pruneNodes({ ttlDays: 14 });
+    assert.equal(result.pruned.length, 0);
+    assert.ok(getRow('ancient-active') !== null);
+    assert.ok(getRow('ancient-idle') !== null);
+});
+test('prune retains an old terminal node with an open managed worktree', () => {
+    createNode(node('old-worktree', {
+        status: 'canceled',
+        created: old(),
+        managed_worktree: {
+            state: 'open',
+            path: join(home, 'worktrees', 'old-worktree'),
+            branch: 'crtr/old-worktree',
+            repo_root: '/tmp/repo',
+            base_ref: 'main',
+            base_sha: 'base',
+            created: old(),
+        },
+    }));
+    const result = pruneNodes({ ttlDays: 14 });
+    assert.deepEqual(result.pruned, []);
+    assert.ok(getRow('old-worktree') !== null, 'node remains to own its managed worktree');
+    assert.ok(existsSync(nodeDir('old-worktree')), 'node dir remains');
+});

package/dist/core/__tests__/push-final-guard.test.d.ts

@@ -0,0 +1 @@
+export {};