@north-light/crouter 0.3.154

package/dist/daemon/api/__tests__/full/b10-attach-modelauth.test.js

@@ -0,0 +1,220 @@
+// Run with: node --import tsx/esm --test src/daemon/api/__tests__/full/b10-attach-modelauth.test.ts
+//
+// B-10 acceptance gate (spec §7.2 surface-attach hybrid + §7.6 model-auth
+// install). Proves spec acceptance **B2** for the two client swaps this batch
+// landed:
+//
+//   1. `surface attach` → client.ensureAttach(id,{resume,revive}) (POST
+//      /nodes/{id}/attach): the SERVER revives a DORMANT node (the ONE sanctioned
+//      reviveNode launcher), returns socket_path === viewSocketPath(id); the local
+//      viewer then connects the byte relay directly over that view.sock. B2 shape:
+//      attach revives, snapshot streams, DETACH LEAVES THE BROKER RUNNING (the
+//      reap-on-detach path was removed this batch).
+//   2. `sys setup` model-auth → client.installCredential(provider,req) (PUT
+//      /model-auth/{provider}): collection stays client-side; the route persists
+//      the credential to auth.json, which crtrd's mtime watcher fans as
+//      `reload_auth` to live brokers. B2 shape: auth.json write (assert content) +
+//      the reload FAN (assert the reloadAuthLive RPC acks against a live broker) +
+//      old-path vs API-path STRUCTURAL PARITY (byte-identical auth.json).
+//
+// FULL TIER (real-boot-bound): lives in `__tests__/full/` for the 30s-per-test /
+// CI-only tier, exactly like api-server.test.ts (the A-11 sibling). tmux-free
+// (createHeadlessHarness) but boots REAL broker processes with the fake engine
+// (zero LLM cost). Reuses A-11's approach: createApiServer() in-process binds the
+// unix socket; handlers call the SAME in-process reviveNode/credential-store internals.
+//
+// HONEST PROXY (documented, narrower than A-11's A6b): the mtime→reload poll lives
+// in crtrd's runDaemon(), NOT createApiServer(). So the FAN's *trigger* (mtime
+// detection) is crtrd-internal and out of B-10's scope; this test drives the fan's
+// *action* directly — reloadAuthLive(liveBrokerId) is the exact RPC crtrd's watcher
+// invokes — and asserts it acks against a live broker AFTER the handler's write.
+// That is strictly stronger than A6b's file-write-only proxy for the fan half.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { setAuthCredential } from '../../../../core/auth-file.js';
+import { createHeadlessHarness } from '../../../../core/__tests__/helpers/harness.js';
+import { createAttachKit } from '../../../../core/__tests__/helpers/broker-clients.js';
+import { CrtrClient } from '../../../../api/index.js';
+import { createApiServer } from '../../server.js';
+import { apiSocketPath, viewSocketPath } from '../../../../core/canvas/paths.js';
+import { isPidAlive } from '../../../../core/canvas/pid.js';
+import { setIntent } from '../../../../core/canvas/index.js';
+import { reloadAuthLive } from '../../../../core/runtime/auth-reload.js';
+let h;
+let server;
+let client;
+let sockPath;
+const kit = createAttachKit(() => h);
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-b10' });
+    server = createApiServer(); // binds <h.home>/crtrd.sock (CRTR_HOME set by harness)
+    sockPath = apiSocketPath();
+    await h.waitFor(() => existsSync(sockPath), { label: 'api socket bound', timeoutMs: 10_000 });
+    client = new CrtrClient({ socketPath: sockPath, autostart: false });
+});
+after(async () => {
+    kit.closeAll();
+    await server?.close();
+    await h?.dispose();
+});
+// ---------------------------------------------------------------------------
+// B2 (attach hybrid) — ensureAttach revives a DORMANT node server-side; the
+// direct view.sock snapshot streams; DETACH LEAVES THE BROKER RUNNING.
+// ---------------------------------------------------------------------------
+test('B2-attach: ensureAttach revives a dormant node, snapshot streams, detach leaves the broker running', async () => {
+    const root = h.spawnRoot('b10 attach root'); // in-process resident (alive pid)
+    const id = (await client.createNode({ kind: 'developer', parent: root, prompt: 'b10 attach worker' })).node_id;
+    await h.awaitBoot(id); // real fake broker: session written, pid recorded, view.sock bound
+    // --- drive the node DORMANT — a valid session remains on disk so revive can
+    //     resume. `intent: 'idle-release'` first, because the fleet's exit policy
+    //     (classifyDeadNode row 4) is what decides whether a dead broker is
+    //     dormant or gets RESPAWNED: without the intent, killing the pid classifies
+    //     as `respawn-resume` and the fleet relaunches the node behind our back, so
+    //     the attach below would correctly find it live and revive nothing. This is
+    //     the same shape production reaches when a parked broker idle-releases. ---
+    setIntent(id, 'idle-release');
+    const firstPid = h.node(id)?.pi_pid;
+    assert.ok(firstPid != null && isPidAlive(firstPid), 'node booted with a live broker pid');
+    process.kill(firstPid, 'SIGKILL');
+    await h.waitFor(() => !isPidAlive(h.node(id)?.pi_pid ?? firstPid), {
+        label: 'broker crashed → pid gone',
+        timeoutMs: 15_000,
+    });
+    // DORMANT means the FLEET has forgotten it, not merely that the pid is gone:
+    // reviveNode's double-launch guard reads the fleet entry, so attaching in the
+    // window between the kill and the child-exit delivery is correctly a no-op.
+    await h.awaitFleetExit(id);
+    // --- ensureAttach (the exact call viewer.ts makes) revives it SERVER-SIDE ---
+    const res = await client.ensureAttach(id, { resume: true, revive: true });
+    assert.equal(res.node_id, id, 'ensureAttach echoes the node id');
+    assert.equal(res.revived, true, 'server launched a fresh broker (revived=true) for the dormant node');
+    assert.equal(res.socket_path, viewSocketPath(id), 'socket_path === viewSocketPath(id) — the identity viewer.ts relies on to connect the local relay');
+    const newPid = h.node(id)?.pi_pid;
+    assert.ok(newPid != null && isPidAlive(newPid), 'the revived broker records a live pid');
+    assert.notEqual(newPid, firstPid, 'a genuinely fresh engine started (new pid), not the crashed one');
+    assert.ok(existsSync(res.socket_path), 'the revived broker bound its view.sock at socket_path');
+    // --- snapshot streams: the local viewer connects the byte relay directly over
+    //     socket_path and receives a welcome snapshot (this is the direct view.sock
+    //     hop viewer.ts keeps local). ---
+    const attached = await kit.attach(id, 'observer', 'b10-attach-observer');
+    assert.ok(attached.welcome.snapshot != null, 'welcome frame carries a reconstructed snapshot (snapshot streams)');
+    // --- DETACH LEAVES THE BROKER RUNNING (reap-on-detach removed this batch) ---
+    attached.close();
+    // Give any (now-absent) reap path a beat to have fired, then assert the broker
+    // is unmistakably still alive.
+    await new Promise((r) => setTimeout(r, 300));
+    const afterDetachPid = h.node(id)?.pi_pid;
+    assert.equal(afterDetachPid, newPid, 'the broker pid is unchanged after detach');
+    assert.ok(isPidAlive(afterDetachPid), 'detach left the broker RUNNING (no reap-on-detach)');
+    assert.notEqual(h.node(id)?.status, 'done', 'detach did not finalize the node');
+});
+// ---------------------------------------------------------------------------
+// B2 (model-auth) — installCredential writes auth.json (content asserted), the
+// reload FAN acks against a live broker, and the API path is byte-identical to
+// the old direct-write path.
+// ---------------------------------------------------------------------------
+test('B2-modelauth: installCredential writes auth.json, the reload fan acks a live broker, API path == old path', async () => {
+    // Sandbox pi's credential store so the write lands in a throwaway dir, never the
+    // developer's real ~/.pi/agent/auth.json. authPath() honors PI_CODING_AGENT_DIR.
+    const savedPiDir = process.env['PI_CODING_AGENT_DIR'];
+    const apiDir = mkdtempSync(join(tmpdir(), 'crtr-b10-api-'));
+    process.env['PI_CODING_AGENT_DIR'] = apiDir;
+    let liveId;
+    try {
+        // A live broker to receive the fan.
+        const root = h.spawnRoot('b10 modelauth root');
+        liveId = (await client.createNode({ kind: 'developer', parent: root, prompt: 'b10 fan target' })).node_id;
+        await h.awaitBoot(liveId);
+        // --- installCredential (the exact call setup.ts makes) writes auth.json ---
+        const res = await client.installCredential('anthropic', { kind: 'api_key', api_key: 'sk-b10-test-key' });
+        assert.equal(res.installed, true, 'credential reports installed');
+        assert.equal(res.managed, false, 'api_key install is not a managed-pool account');
+        const authFile = join(apiDir, 'auth.json');
+        assert.ok(existsSync(authFile), 'auth.json written to the sandboxed PI_CODING_AGENT_DIR');
+        const apiContents = readFileSync(authFile, 'utf8');
+        assert.ok(apiContents.includes('sk-b10-test-key'), 'auth.json carries the installed credential material');
+        assert.ok(apiContents.includes('anthropic'), 'auth.json is keyed by the provider');
+        // --- the reload FAN acks against the live broker (the RPC crtrd's mtime
+        //     watcher invokes after this write; the mtime poll itself is crtrd-internal
+        //     and out of B-10's scope — see the honest-proxy note in the header). ---
+        await assert.doesNotReject(reloadAuthLive(liveId), 'reloadAuthLive resolves — the live broker acked the reload_auth fan after the auth.json write');
+        // --- STRUCTURAL PARITY: the old path (setup.ts wrote directly via
+        //     a direct credential write to authPath()). Write
+        //     that same credential into a second sandbox and assert byte-identical
+        //     auth.json — the API swap changed the CALLER, not the on-disk structure. ---
+        const oldDir = mkdtempSync(join(tmpdir(), 'crtr-b10-old-'));
+        try {
+            await setAuthCredential('anthropic', { type: 'api_key', key: 'sk-b10-test-key' }, join(oldDir, 'auth.json'));
+            const oldContents = readFileSync(join(oldDir, 'auth.json'), 'utf8');
+            assert.equal(apiContents, oldContents, 'API-path auth.json is byte-identical to the old direct-write path (structural parity)');
+        }
+        finally {
+            rmSync(oldDir, { recursive: true, force: true });
+        }
+    }
+    finally {
+        if (savedPiDir === undefined)
+            delete process.env['PI_CODING_AGENT_DIR'];
+        else
+            process.env['PI_CODING_AGENT_DIR'] = savedPiDir;
+        rmSync(apiDir, { recursive: true, force: true });
+    }
+});
+// ---------------------------------------------------------------------------
+// B2 (model-auth, oauth) — non-managed OAuth install must PRESERVE
+// provider-specific extra credential fields (e.g. github-copilot's
+// `enterpriseUrl`, load-bearing for enterprise routing/refresh). OLD
+// `AuthStorage.login` spread the FULL credential object; the API swap forwards
+// non-standard keys through `extra` and the handler re-spreads them. Regression
+// guard for review M1 (a dropped enterpriseUrl breaks GitHub-Enterprise Copilot).
+// Parity here is STRUCTURAL (parsed deep-equal), not byte-identical: the
+// extra-then-tokens spread order legitimately differs from OLD's credential key
+// order, but the stored credential is the same object.
+// ---------------------------------------------------------------------------
+test('B2-modelauth-oauth: installCredential(oauth) preserves extra fields (enterpriseUrl) — structural parity with OLD login spread', async () => {
+    const savedPiDir = process.env['PI_CODING_AGENT_DIR'];
+    const apiDir = mkdtempSync(join(tmpdir(), 'crtr-b10-oauth-api-'));
+    process.env['PI_CODING_AGENT_DIR'] = apiDir;
+    try {
+        const expiresMs = 1_900_000_000_000; // fixed epoch-ms → deterministic ISO round-trip
+        const res = await client.installCredential('github-copilot', {
+            kind: 'oauth',
+            access_token: 'gho-access-xyz',
+            refresh_token: 'ghr-refresh-xyz',
+            expires_at: new Date(expiresMs).toISOString(),
+            extra: { enterpriseUrl: 'https://ghe.example.com', availableModelIds: ['gpt-4o'] },
+        });
+        assert.equal(res.installed, true, 'oauth credential installed');
+        const apiContents = readFileSync(join(apiDir, 'auth.json'), 'utf8');
+        assert.ok(apiContents.includes('enterpriseUrl'), 'enterpriseUrl key survived the swap (M1 regression guard)');
+        assert.ok(apiContents.includes('ghe.example.com'), 'the enterprise domain value is preserved');
+        // OLD path: the login persist wrote { type:'oauth', ...credentials } —
+        // spreading the FULL credential (tokens + enterpriseUrl + availableModelIds).
+        const oldDir = mkdtempSync(join(tmpdir(), 'crtr-b10-oauth-old-'));
+        try {
+            await setAuthCredential('github-copilot', {
+                type: 'oauth',
+                access: 'gho-access-xyz',
+                refresh: 'ghr-refresh-xyz',
+                expires: expiresMs,
+                enterpriseUrl: 'https://ghe.example.com',
+                availableModelIds: ['gpt-4o'],
+            }, join(oldDir, 'auth.json'));
+            const oldContents = readFileSync(join(oldDir, 'auth.json'), 'utf8');
+            assert.deepEqual(JSON.parse(apiContents), JSON.parse(oldContents), 'oauth API-path auth.json is structurally identical to the OLD full-spread login path (no field dropped)');
+        }
+        finally {
+            rmSync(oldDir, { recursive: true, force: true });
+        }
+    }
+    finally {
+        if (savedPiDir === undefined)
+            delete process.env['PI_CODING_AGENT_DIR'];
+        else
+            process.env['PI_CODING_AGENT_DIR'] = savedPiDir;
+        rmSync(apiDir, { recursive: true, force: true });
+    }
+});

package/dist/daemon/api/__tests__/full/push-parity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/api/__tests__/full/push-parity.test.js

@@ -0,0 +1,199 @@
+// Run with: node --import tsx/esm --test src/daemon/api/__tests__/full/push-parity.test.ts
+//
+// B-5 acceptance (plan §Stage B, B1 for push) — the re-plumbed `crtr push`
+// verb (src/commands/push.ts) is now a PURE crtrd API client: every tier goes
+// through `POST /nodes/{id}/reports` and the report write, the per-subscriber
+// inbox fan, and (final only) the lifecycle transition all happen SERVER-side
+// inside feed `push()` (spec §7.4). This proves that end-to-end by driving the
+// ACTUAL `push.ts` leaf (not `client.pushReport` directly) against a
+// CRTR_HOME-isolated in-process crtrd, with a real parent+child pair.
+//
+// FULL TIER (real-boot-bound): lives in `__tests__/full/` for the 30s-per-test
+// / CI-only tier (scripts/test-runner.mjs, `file.includes('/__tests__/full/')`),
+// same harness as api-server.test.ts (A-11). tmux-free (createHeadlessHarness)
+// but boots REAL broker processes with the fake engine — no LLM cost.
+//
+// The push leaf resolves its client through `cliClient()` →
+// `CrtrClient.forLocalSocket` → `apiSocketPath()` == `<CRTR_HOME>/crtrd.sock`,
+// the SAME socket `createApiServer()` binds here. So `pushLeaf(tier).run()` in
+// this process, with `CRTR_NODE_ID` set to the child, connects to the
+// in-process server exactly as a real `crtr push` CLI process would. The leaf
+// reaches ZERO canvas state-store code (proven separately by the emitted
+// dist import-graph, reported in this node's B-5 final); this test proves the
+// runtime behavior on the far side of that boundary.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHeadlessHarness } from '../../../../core/__tests__/helpers/harness.js';
+import { createApiServer } from '../../server.js';
+import { apiSocketPath } from '../../../../core/canvas/paths.js';
+import { CrtrClient } from '../../../../api/index.js';
+import { registerPush } from '../../../../commands/push.js';
+import { createNode, getNode } from '../../../../core/canvas/canvas.js';
+import { createManagedWorktree } from '../../../../core/worktree.js';
+import { gitSync } from '../../../../core/git.js';
+import { InputError } from '../../../../core/io.js';
+// A terminal fabricated node (no broker needed) that OWNS a managed worktree —
+// the row the server's push-final worktree guard reads. Terminal + no
+// subscriber self-completes (the resident no_final_recipient guard is skipped).
+function worktreeNode(id, cwd, wt) {
+    return { node_id: id, name: id, created: new Date().toISOString(), cwd, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active', managed_worktree: wt };
+}
+function git(args, cwd) {
+    const r = gitSync(args, cwd);
+    if (r.status !== 0)
+        throw new Error(`git ${args.join(' ')} failed in ${cwd}: ${r.stderr || r.stdout}`);
+}
+/** A fresh git repo with one commit on `main` — the base a managed worktree
+ *  branches off. Returns the repo dir (caller removes it). */
+function initRepo() {
+    const repo = mkdtempSync(join(tmpdir(), 'crtr-pushparity-repo-'));
+    git(['init', '-b', 'main'], repo);
+    git(['config', 'user.email', 'test@example.com'], repo);
+    git(['config', 'user.name', 'Test'], repo);
+    writeFileSync(join(repo, 'README.md'), 'hello\n');
+    git(['add', '.'], repo);
+    git(['commit', '-m', 'init'], repo);
+    return repo;
+}
+let h;
+let server;
+let client;
+let sockPath;
+const savedNoAutostart = process.env['CRTR_NO_DAEMON_AUTOSTART'];
+const savedNodeId = process.env['CRTR_NODE_ID'];
+// The push leaf under test — resolved fresh from the real command tree, exactly
+// as the CLI dispatcher would resolve it. Its `.run()` is the code path a real
+// `crtr push <tier>` process executes.
+function pushLeaf(tier) {
+    const leaf = registerPush().children.find((c) => c.name === tier);
+    assert.ok(leaf !== undefined && leaf.kind === 'leaf', `push ${tier} leaf resolves`);
+    return leaf;
+}
+// Drive the leaf as the given caller node — sets CRTR_NODE_ID (client-side
+// identity resolution stays in the CLI process, per the B-5 scope) around the
+// run, restoring it after.
+async function runPushAs(caller, tier, body) {
+    const prev = process.env['CRTR_NODE_ID'];
+    process.env['CRTR_NODE_ID'] = caller;
+    try {
+        return (await pushLeaf(tier).run({ body }));
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env['CRTR_NODE_ID'];
+        else
+            process.env['CRTR_NODE_ID'] = prev;
+    }
+}
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-pushparity' });
+    server = createApiServer(); // binds <h.home>/crtrd.sock (CRTR_HOME set by harness)
+    sockPath = apiSocketPath();
+    await h.waitFor(() => existsSync(sockPath), { label: 'api socket bound', timeoutMs: 10_000 });
+    // The socket is already bound in-process; forbid autostart so the leaf's
+    // cliClient() never tries to spawn a real detached crtrd — it connects to the
+    // bound in-process server deterministically.
+    process.env['CRTR_NO_DAEMON_AUTOSTART'] = '1';
+    client = new CrtrClient({ socketPath: sockPath, autostart: false });
+});
+after(async () => {
+    await server?.close();
+    await h?.dispose();
+    if (savedNoAutostart === undefined)
+        delete process.env['CRTR_NO_DAEMON_AUTOSTART'];
+    else
+        process.env['CRTR_NO_DAEMON_AUTOSTART'] = savedNoAutostart;
+    if (savedNodeId === undefined)
+        delete process.env['CRTR_NODE_ID'];
+    else
+        process.env['CRTR_NODE_ID'] = savedNodeId;
+});
+// ---------------------------------------------------------------------------
+// B1 (push) — structural parity of report_path / notified / transitioned on
+// update + final, driven through the real push.ts leaf. A parent spawns a
+// child (so the parent subscribes to the child); the child pushes.
+// ---------------------------------------------------------------------------
+test('B1: `crtr push update` from a child writes a report, notifies the subscribed parent, and does NOT transition — leaf output has the exact { report_path, notified } shape with no transitioned field', async () => {
+    const parent = h.spawnRoot('push-parity update parent'); // resident, subscribes to its child
+    const child = (await client.createNode({ kind: 'developer', parent, prompt: 'update worker' })).node_id;
+    await h.awaitBoot(child);
+    assert.equal(h.node(child)?.status, 'active', 'the child is live/active before the update push');
+    const out = await runPushAs(child, 'update', 'update from the child');
+    // report_path: an absolute path to a report file the server actually wrote.
+    assert.equal(typeof out['report_path'], 'string', 'report_path is a string');
+    assert.ok(existsSync(out['report_path']), `report file written at ${String(out['report_path'])}`);
+    // notified: the subscribed parent received an inbox pointer.
+    assert.ok(Array.isArray(out['notified']), 'notified is an array');
+    assert.ok(out['notified'].includes(parent), `update notifies the subscribed parent (notified=${JSON.stringify(out['notified'])})`);
+    // transitioned: ABSENT for a non-final tier — an update never flips lifecycle.
+    assert.equal('transitioned' in out, false, 'update carries no transitioned field');
+    assert.equal(h.node(child)?.status, 'active', 'the child stays active after an update (no transition)');
+});
+test('B1: `crtr push final` from a child writes a report, notifies the subscribed parent, AND transitions the child row active→done — leaf output carries transitioned={from,to} and the row is genuinely done', async () => {
+    const parent = h.spawnRoot('push-parity final parent');
+    const child = (await client.createNode({ kind: 'developer', parent, prompt: 'final worker' })).node_id;
+    await h.awaitBoot(child);
+    assert.equal(h.node(child)?.status, 'active', 'the child is live/active before the final push');
+    const out = await runPushAs(child, 'final', 'final result from the child');
+    // Same report_path + notified parity as update.
+    assert.equal(typeof out['report_path'], 'string', 'report_path is a string');
+    assert.ok(existsSync(out['report_path']), `final report file written at ${String(out['report_path'])}`);
+    assert.ok(Array.isArray(out['notified']), 'notified is an array');
+    assert.ok(out['notified'].includes(parent), `final MUST notify the subscribed parent (notified=${JSON.stringify(out['notified'])})`);
+    // final MUST transition the row — asserted BOTH on the leaf output AND on the
+    // authoritative canvas row (the server applied it, not the CLI).
+    assert.deepEqual(out['transitioned'], { from: 'active', to: 'done' }, 'final leaf output reports the server-side active→done transition');
+    assert.equal(h.node(child)?.status, 'done', 'the child row is genuinely done after final — the transition happened server-side');
+    assert.ok(h.node(child)?.final_report, 'the canonical final_report is recorded on the row');
+    // A normal node (no managed worktree) carries NO worktree_auto_dropped field
+    // — the re-homed guard only engages for a managed-worktree owner.
+    assert.equal('worktree_auto_dropped' in out, false, 'a normal node final is unaffected by the worktree guard');
+});
+// ---------------------------------------------------------------------------
+// Re-homed worktree guard/auto-drop (ambiguity-2 follow-up): the pre-B-5 CLI
+// `push final` worktree behavior now lives SERVER-side in handlers/reports.ts,
+// exercised end-to-end through the real push.ts leaf.
+// ---------------------------------------------------------------------------
+test('re-homed guard: `crtr push final` on a node with a managed worktree holding REAL unlanded commits blocks with the parity open_managed_worktree InputError (round-tripped from the server), and does NOT finalize', async () => {
+    const repo = initRepo();
+    try {
+        const id = 'wt-real-work-final';
+        const wt = createManagedWorktree(repo, id);
+        // A real unlanded commit in the worktree — auto-drop must refuse, guard fires.
+        writeFileSync(join(wt.path, 'feature.txt'), 'real unlanded work\n');
+        git(['add', '.'], wt.path);
+        git(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
+        createNode(worktreeNode(id, wt.path, wt));
+        await assert.rejects(() => runPushAs(id, 'final', 'trying to finish without landing'), (e) => e instanceof InputError &&
+            e.payload.error === 'open_managed_worktree' &&
+            typeof e.payload.next === 'string' &&
+            e.payload.next.includes('node worktree close'), 'the server guard round-trips as the parity open_managed_worktree InputError with its next-hint');
+        assert.equal(getNode(id)?.managed_worktree?.state, 'open', 'a real unlanded commit is never auto-dropped');
+        assert.equal(getNode(id)?.final_report ?? null, null, 'the node did not finalize while blocked');
+        assert.equal(getNode(id)?.status, 'active', 'the row stays active — the guard fired before the transition');
+    }
+    finally {
+        rmSync(repo, { recursive: true, force: true });
+    }
+});
+test('re-homed auto-drop: `crtr push final` on a node with a CLEAN, zero-commit managed worktree auto-drops it server-side, surfaces worktree_auto_dropped(+path) on the leaf output, and finalizes normally', async () => {
+    const repo = initRepo();
+    try {
+        const id = 'wt-clean-empty-final';
+        const wt = createManagedWorktree(repo, id); // branch == base tip, clean => nothing to land
+        createNode(worktreeNode(id, wt.path, wt));
+        const out = await runPushAs(id, 'final', 'read-only review, nothing to land');
+        assert.equal(out['worktree_auto_dropped'], true, 'the leaf surfaces the server-side auto-drop');
+        assert.equal(out['worktree_auto_dropped_path'], wt.path, 'the dropped checkout path round-trips onto the leaf output');
+        assert.equal(getNode(id)?.managed_worktree?.state, 'closed', 'the clean worktree row is marked closed by the drop');
+        assert.deepEqual(out['transitioned'], { from: 'active', to: 'done' }, 'the final still transitions the row after the auto-drop');
+        assert.equal(getNode(id)?.status, 'done', 'the node finalized normally after the auto-drop');
+        assert.ok(getNode(id)?.final_report, 'the canonical final_report is recorded');
+    }
+    finally {
+        rmSync(repo, { recursive: true, force: true });
+    }
+});

package/dist/daemon/api/__tests__/full/worktree-parity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/api/__tests__/full/worktree-parity.test.js

@@ -0,0 +1,160 @@
+// Run with: node --import tsx/esm --test src/daemon/api/__tests__/full/worktree-parity.test.ts
+//
+// B-4 acceptance (plan §Stage B, B-4) — the re-plumbed `crtr node worktree
+// close` verb (src/commands/node-worktree.ts) is now a PURE crtrd API client:
+// it goes through `POST /nodes/{id}/worktree/close`, and the land + close (a
+// canvas WRITE interleaved with a git land transaction) happens SERVER-side in
+// handlers/worktree.ts calling `closeManagedWorktree` UNCHANGED — crtrd is the
+// repo host (same principle as spawnChild's creation git). This proves that
+// end-to-end by driving the ACTUAL `node worktree close` leaf (not
+// client.closeWorktree directly) against a CRTR_HOME-isolated in-process crtrd,
+// with a real managed git worktree.
+//
+// FULL TIER (real-boot-bound): same harness + tier as push-parity.test.ts.
+// tmux-free (createHeadlessHarness); no LLM cost.
+//
+// Two parity bars:
+//   1. STRUCTURAL — the happy-path close returns the exact snake_case field set
+//      the pre-API leaf did (node_id/branch/worktree_path/landed_sha/
+//      worktree_removed/branch_deleted), with the land genuinely applied to the
+//      canvas row + git base branch server-side.
+//   2. ERROR — the SPECIFIC WorktreeError code + its `next` remediation
+//      round-trip verbatim through the server → ApiError → the custom CLI
+//      mapper, instead of collapsing to a generic status bucket. This is the
+//      whole reason node-worktree.ts uses a bespoke mapper, not the generic
+//      rethrowAsCliError, so it is the load-bearing regression to lock.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHeadlessHarness } from '../../../../core/__tests__/helpers/harness.js';
+import { createApiServer } from '../../server.js';
+import { apiSocketPath } from '../../../../core/canvas/paths.js';
+import { CrtrClient } from '../../../../api/index.js';
+import { registerNode } from '../../../../commands/node.js';
+import { createNode } from '../../../../core/canvas/canvas.js';
+import { createManagedWorktree } from '../../../../core/worktree.js';
+import { gitSync } from '../../../../core/git.js';
+import { InputError } from '../../../../core/io.js';
+// A terminal fabricated node that OWNS a managed worktree — the row the server
+// reads to resolve + land the close. Terminal + no subscriber keeps it inert.
+function worktreeNode(id, cwd, wt) {
+    return { node_id: id, name: id, created: new Date().toISOString(), cwd, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active', managed_worktree: wt };
+}
+function git(args, cwd) {
+    const r = gitSync(args, cwd);
+    if (r.status !== 0)
+        throw new Error(`git ${args.join(' ')} failed in ${cwd}: ${r.stderr || r.stdout}`);
+}
+/** A fresh git repo with one commit on `main` — the base a managed worktree
+ *  branches off. Returns the repo dir (caller removes it). */
+function initRepo() {
+    const repo = mkdtempSync(join(tmpdir(), 'crtr-wtparity-repo-'));
+    git(['init', '-b', 'main'], repo);
+    git(['config', 'user.email', 'test@example.com'], repo);
+    git(['config', 'user.name', 'Test'], repo);
+    writeFileSync(join(repo, 'README.md'), 'hello\n');
+    git(['add', '.'], repo);
+    git(['commit', '-m', 'init'], repo);
+    return repo;
+}
+let h;
+let server;
+let client;
+let sockPath;
+const savedNoAutostart = process.env['CRTR_NO_DAEMON_AUTOSTART'];
+const savedNodeId = process.env['CRTR_NODE_ID'];
+// The close leaf under test — resolved fresh from the real command tree exactly
+// as the CLI dispatcher would (`node worktree close`). Its `.run()` is the code
+// path a real `crtr node worktree close` process executes.
+function closeLeaf() {
+    const worktree = registerNode().children.find((c) => c.name === 'worktree');
+    assert.ok(worktree !== undefined && worktree.kind === 'branch', 'node worktree branch resolves');
+    const close = worktree.children.find((c) => c.name === 'close');
+    assert.ok(close !== undefined && close.kind === 'leaf', 'node worktree close leaf resolves');
+    return close;
+}
+// Drive the leaf as the given caller node — the leaf reads CRTR_NODE_ID for its
+// identity, exactly as a real CLI process would.
+async function runCloseAs(caller) {
+    const prev = process.env['CRTR_NODE_ID'];
+    process.env['CRTR_NODE_ID'] = caller;
+    try {
+        return (await closeLeaf().run({}));
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env['CRTR_NODE_ID'];
+        else
+            process.env['CRTR_NODE_ID'] = prev;
+    }
+}
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-wtparity' });
+    server = createApiServer(); // binds <h.home>/crtrd.sock (CRTR_HOME set by harness)
+    sockPath = apiSocketPath();
+    await h.waitFor(() => existsSync(sockPath), { label: 'api socket bound', timeoutMs: 10_000 });
+    // The socket is bound in-process; forbid autostart so the leaf's cliClient()
+    // connects to the bound in-process server rather than spawning a real crtrd.
+    process.env['CRTR_NO_DAEMON_AUTOSTART'] = '1';
+    client = new CrtrClient({ socketPath: sockPath, autostart: false });
+});
+after(async () => {
+    await server?.close();
+    await h?.dispose();
+    if (savedNoAutostart === undefined)
+        delete process.env['CRTR_NO_DAEMON_AUTOSTART'];
+    else
+        process.env['CRTR_NO_DAEMON_AUTOSTART'] = savedNoAutostart;
+    if (savedNodeId === undefined)
+        delete process.env['CRTR_NODE_ID'];
+    else
+        process.env['CRTR_NODE_ID'] = savedNodeId;
+});
+// ---------------------------------------------------------------------------
+// STRUCTURAL parity — the happy-path close, driven through the real leaf,
+// returns the exact snake_case field set and genuinely lands server-side.
+// ---------------------------------------------------------------------------
+test('B-4: `crtr node worktree close` on a node with a landable managed worktree returns the exact { node_id, branch, worktree_path, landed_sha, worktree_removed, branch_deleted } shape and lands server-side', async () => {
+    const repo = initRepo();
+    try {
+        const id = 'wt-close-landable';
+        const wt = createManagedWorktree(repo, id, 'main');
+        // A real commit ahead of base so the land fast-forwards to a NEW sha.
+        writeFileSync(join(wt.path, 'feature.txt'), 'landable work\n');
+        git(['add', '.'], wt.path);
+        git(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
+        createNode(worktreeNode(id, wt.path, wt));
+        const out = await runCloseAs(id);
+        // Structural field set (parity with the pre-API leaf output).
+        assert.equal(out['node_id'], id, 'node_id echoes the caller');
+        assert.equal(out['branch'], wt.branch, 'branch is the worktree branch that landed');
+        assert.equal(out['worktree_path'], wt.path, 'worktree_path is the managed checkout');
+        assert.equal(typeof out['landed_sha'], 'string', 'landed_sha is a sha string');
+        assert.ok(out['landed_sha'].length >= 7, 'landed_sha is a real object name');
+        assert.equal(typeof out['worktree_removed'], 'boolean', 'worktree_removed is a boolean');
+        assert.equal(typeof out['branch_deleted'], 'boolean', 'branch_deleted is a boolean');
+        // The land genuinely applied SERVER-side: main's tip == landed_sha.
+        const mainTip = gitSync(['rev-parse', 'refs/heads/main'], repo).stdout.trim();
+        assert.equal(mainTip, out['landed_sha'], 'the local base branch was fast-forwarded onto the landed sha server-side');
+    }
+    finally {
+        rmSync(repo, { recursive: true, force: true });
+    }
+});
+// ---------------------------------------------------------------------------
+// ERROR parity — the SPECIFIC WorktreeError code + its `next` round-trip
+// verbatim through the custom CLI mapper (NOT collapsed to a status bucket).
+// ---------------------------------------------------------------------------
+test('B-4 error parity: `crtr node worktree close` on a node with NO managed worktree round-trips the specific `no_managed_worktree` code + its exact next-hint (not a generic status bucket)', async () => {
+    const id = 'wt-close-none';
+    createNode({ node_id: id, name: id, created: new Date().toISOString(), cwd: process.cwd(), kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+    await assert.rejects(() => runCloseAs(id), (e) => e instanceof InputError &&
+        e.payload.error === 'no_managed_worktree' &&
+        typeof e.payload.next === 'string' &&
+        e.payload.next.includes('Nothing to close'), 'the specific WorktreeError code + next survive the server → ApiError → custom CLI mapper');
+});
+test('B-4 error parity: `crtr node worktree close` for an UNKNOWN node round-trips the specific `unknown_node` code (a 404 that is NOT flattened to not_found)', async () => {
+    await assert.rejects(() => runCloseAs('no-such-node-xyz'), (e) => e instanceof InputError && e.payload.error === 'unknown_node', 'unknown_node keeps its specific code even though it maps to a 404 status');
+});

package/dist/daemon/api/__tests__/inbox.test.d.ts

@@ -0,0 +1 @@
+export {};