@north-light/crouter 0.3.157 → 0.3.159

package/dist/core/__tests__/full/broker-dialogs.test.js

@@ -3,31 +3,35 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
 // (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
 //
-// Broker dialog handling — the T8 attach gates G5/G5b/G6 cover retained answers,
-// controller handoff, and attended-dialog timeout behavior.
+// Broker dialog handling under MULTI-WRITER attachments — the T8 attach gates
+// G5/G5b/G6 cover fan-out + first-response settlement, mid-dialog attach replay,
+// and attended-dialog timeout behavior.
 //
 // 3-PART HEADER (headless):
-//  (1) CONTRACT — a controller receives a blocking dialog as
-//      extension_ui_request, and extension_ui_response unblocks the engine with
-//      the controller's answer rather than the default (G5). A dialog raised under
-//      one controller remains pending through its detach and reaches the next
-//      controller through welcome.pending_dialog (G5b). An attended dialog that is
-//      not answered resolves on the short per-dialog timeout with the default answer
-//      and a correlated extension_ui_dismiss (G6).
+//  (1) CONTRACT — every client whose `hello` claimed the writable role is fanned a
+//      blocking dialog as extension_ui_request; the FIRST extension_ui_response
+//      settles it with that answer (not the default), every fanned client receives
+//      the correlated extension_ui_dismiss, and a later peer response for the same
+//      id is a silent no-op (G5). A dialog stays pending through a peer's detach and
+//      is handed to any writable client attaching mid-dialog via
+//      welcome.pending_dialog; observers never receive an answerable dialog (G5b).
+//      An attended dialog nobody answers resolves on the short per-dialog timeout
+//      with the default answer and a correlated dismiss to EVERY writable peer (G6).
 //  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the dialog round-trip is an async
-//      promise inside makeBrokerUiContext, forwarded and answered over view.sock to
+//      promise inside makeBrokerUiContext, fanned out and answered over view.sock to
 //      the production ViewSocketClient. The real broker process provides the
 //      uiContext and timeout machinery without a tmux pane, window, or pi-session
 //      read.
 //  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the fake engine raises real
-//      confirm() dialogs through the broker, and the tests assert on controller
-//      frames plus the value and latency recorded in fake-pi.dialog.jsonl.
+//      confirm() dialogs through the broker, and the tests assert on the frames of
+//      several concurrently attached clients plus the value and latency recorded in
+//      fake-pi.dialog.jsonl.
 //
 // One shared broker is booted in before() and reused across all three gates. Because
 // fake-pi.dialog.jsonl is append-only across the shared broker, each gate snapshots
-// the count before it drives (`base`) and asserts on its newly appended entry. Gates
-// whose first attach must hold control use attachUntil(controller) to settle a prior
-// gate's controller-detach handoff.
+// the count before it drives (`base`) and asserts on its newly appended entry. Role
+// is fixed by `hello` and never reassigned, so every writable attach is a plain
+// attach — there is no control handoff to wait out.
 import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { createHeadlessHarness } from '../helpers/harness.js';
@@ -36,9 +40,29 @@ import { createAttachKit } from '../helpers/broker-clients.js';
 let h;
 let id; // ONE shared broker, reused across G5/G5b/G6 (1 real boot, not 3)
 const kit = createAttachKit(() => h);
-const { attachUntil } = kit;
-// Admit a controller, waiting out any prior gate's controller-detach handoff.
-const ctrl = (cid) => attachUntil(id, 'controller', cid, (a) => a.welcome.role === 'controller', `${cid} admitted controller`);
+const { attach, attachUntil } = kit;
+// Attach a writable client. Every `hello` claiming `controller` is admitted
+// writable — attaching a peer never demotes an already-attached one.
+const writer = async (cid) => {
+    const a = await attach(id, 'controller', cid);
+    assert.equal(a.welcome.role, 'controller', `${cid}: admitted writable, not demoted by an existing peer`);
+    return a;
+};
+const observer = async (cid) => {
+    const a = await attach(id, 'observer', cid);
+    assert.equal(a.welcome.role, 'observer', `${cid}: an observer hello stays read-only`);
+    return a;
+};
+// The broker handles one client's frames in order, so an `ack` for a get_commands
+// sent AFTER some other frame proves that earlier frame was already processed.
+// Used to make "a late peer answer changed nothing" a deterministic assertion
+// instead of a sleep.
+const barrier = async (c, label) => {
+    c.send({ type: 'get_commands' });
+    await c.waitFrame((f) => f.type === 'ack' && f.for === 'get_commands', label);
+};
+const isRequest = (f) => f.type === 'extension_ui_request';
+const dismissFor = (reqId) => (f) => f.type === 'extension_ui_dismiss' && f.id === reqId;
 // dialog.jsonl is append-only across the shared broker — snapshot the count, then
 // wait for AT LEAST `want` new entries and return the full (cumulative) array.
 const dialogCount = () => h.dialogResults(id).length;
@@ -57,65 +81,100 @@ afterEach(() => {
 });
 const brokerPid = () => h.node(id).pi_pid;
 // ---------------------------------------------------------------------------
-// G5 — dialog forward + answer. Guards: a blocking dialog reaches the controller
-// as extension_ui_request and the controller's extension_ui_response unblocks the
-// engine with ITS answer (not the default). Failure mode: a dialog the controller
-// can't see/answer (silent deadlock).
+// G5 — fan-out + first-response settlement. Guards: ONE blocking dialog reaches
+// EVERY writable client (never a single owner), the first answer unblocks the
+// engine with ITS value (not the default), every fanned client gets the correlated
+// extension_ui_dismiss, and a peer answering afterwards is a no-op. Failure modes:
+// a dialog only one viewer can see (the others sit blind), peers left holding an
+// overlay nothing can answer, or a late peer answer re-settling a dead dialog.
 // ---------------------------------------------------------------------------
-test('G5 — controller receives an extension_ui_request, answers it, and the engine proceeds with that answer', async () => {
+test('G5 — one dialog fans out to both writable clients, the first response settles it, both are dismissed, and a late peer response is a no-op', async () => {
     const base = dialogCount();
-    const c = await ctrl('g5-ctrl');
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 20_000 }); // generous: the controller answers first
-    const req = await c.waitFrame((f) => f.type === 'extension_ui_request', 'G5 dialog forwarded to controller');
-    assert.equal(req.method, 'confirm', 'G5: the forwarded dialog is the confirm() the engine raised');
-    const reqId = req.id;
-    c.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    const results = await awaitDialogs(base + 1, 'G5 dialog resolved by the controller');
-    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the controller answer (true), not the default (false)');
+    const a = await writer('g5-A');
+    const b = await writer('g5-B');
+    const obs = await observer('g5-obs'); // must never be fanned an answerable dialog
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 20_000 }); // generous: a writable client answers first
+    const reqA = await a.waitFrame(isRequest, 'G5 dialog fanned out to writable A');
+    const reqB = await b.waitFrame(isRequest, 'G5 dialog fanned out to writable B');
+    const reqId = reqA.id;
+    assert.equal(reqB.id, reqId, 'G5: both writable clients were fanned the SAME dialog id, not two dialogs');
+    assert.equal(reqA.method, 'confirm', 'G5: the fanned dialog is the confirm() the engine raised');
+    // A answers first — the engine must proceed with A's true, not the false default.
+    a.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
+    await a.waitFrame(dismissFor(reqId), 'G5 answerer A receives the correlated dismiss');
+    await b.waitFrame(dismissFor(reqId), 'G5 peer B receives the correlated dismiss for the dialog it never answered');
+    const results = await awaitDialogs(base + 1, 'G5 dialog settled by the first response');
+    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the first answer (true), not the default (false)');
+    // The observer was attached the whole time: it saw the broadcast dismiss but was
+    // never handed the answerable request.
+    await obs.waitFrame(dismissFor(reqId), 'G5 observer sees the broadcast dismiss (ordering barrier)');
+    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5: an observer is never fanned an answerable dialog');
+    assert.equal(obs.welcome.pending_dialog, null, 'G5: an observer welcome never carries a pending dialog');
+    // B answers the already-settled dialog. The broker deleted the entry on the first
+    // response, so this finds nothing and is a silent no-op: no second engine
+    // resolution, and the recorded answer stays A's.
+    b.send({ type: 'extension_ui_response', id: reqId, confirmed: false });
+    await barrier(b, 'G5 broker processed B late response (ordered ack)');
+    const settled = h.dialogResults(id);
+    assert.equal(settled.length, base + 1, 'G5: the late peer response resolved nothing — no second dialog entry');
+    assert.equal(settled[base].resolved, true, "G5: the late peer response did not overwrite the first answerer's value");
+    assert.equal(isPidAlive(brokerPid()), true, 'G5: the late no-op response did not fault the broker');
 });
 // ---------------------------------------------------------------------------
-// G5 (mid-dialog attach) — Guards: a dialog raised under a prior controller stays
-// pending across that controller's detach (M2) and is delivered to whoever takes
-// control next via welcome.pending_dialog. Failure mode: a pending dialog lost on
-// controller handoff.
+// G5b (mid-dialog attach) — Guards: a pending dialog survives a writable peer's
+// detach (M2) and is handed to a writable client that attaches MID-dialog via
+// welcome.pending_dialog, which makes it a full peer in the race to answer. An
+// observer attaching mid-dialog gets nothing answerable. Failure modes: a pending
+// dialog lost when the raising viewer detaches, a late-joining writable viewer
+// blind to an in-flight dialog, or an observer handed one it cannot answer.
 // ---------------------------------------------------------------------------
-test('G5 — a controller attaching MID-dialog receives the pending dialog via welcome.pending_dialog', async () => {
+test('G5b — a writable client attaching MID-dialog receives the pending dialog; an observer does not', async () => {
     const base = dialogCount();
-    const a = await ctrl('g5b-A');
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // stays pending long enough for the handoff
-    const reqA = await a.waitFrame((f) => f.type === 'extension_ui_request', 'G5b dialog forwarded to controller A');
+    const a = await writer('g5b-A');
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // stays pending long enough for the late attach
+    const reqA = await a.waitFrame(isRequest, 'G5b dialog fanned out to writable A');
     const reqId = reqA.id;
     a.send({ type: 'bye' });
-    a.close(); // M2: detach frees control but does NOT cancel the pending dialog
-    // Controller B takes control (retry covers the close→controllerId=null beat) and
-    // its welcome carries the still-pending dialog.
-    const b = await attachUntil(id, 'controller', 'g5b-B', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5b controller B takes control with the pending dialog');
-    assert.equal(b.welcome.pending_dialog.id, reqId, 'G5b: welcome.pending_dialog is the same dialog raised under A');
+    a.close(); // M2: a writable peer detaching does NOT cancel the pending dialog
+    // An observer attaching mid-dialog is never handed it.
+    const obs = await observer('g5b-obs');
+    assert.equal(obs.welcome.pending_dialog, null, 'G5b: an observer attaching mid-dialog gets no pending dialog');
+    // A writable client attaching mid-dialog IS handed it (retry covers the beat
+    // between the raise and this attach) and can settle it.
+    const b = await attachUntil(id, 'controller', 'g5b-B', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5b writable B attaches mid-dialog and is handed the pending dialog');
+    assert.equal(b.welcome.pending_dialog.id, reqId, 'G5b: welcome.pending_dialog is the same dialog raised while A was attached');
     assert.equal(b.welcome.pending_dialog.method, 'confirm', 'G5b: the pending dialog is the confirm()');
     b.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    const results = await awaitDialogs(base + 1, 'G5b dialog resolved by controller B');
-    assert.equal(results[base].resolved, true, 'G5b: controller B answered the handed-off dialog and the engine proceeded');
+    const results = await awaitDialogs(base + 1, 'G5b dialog settled by the mid-dialog joiner');
+    assert.equal(results[base].resolved, true, 'G5b: the mid-dialog joiner answered and the engine proceeded');
+    await obs.waitFrame(dismissFor(reqId), 'G5b dismiss broadcast follows the settlement (ordering barrier)');
+    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5b: the observer was never fanned the dialog it saw dismissed');
 });
 // ---------------------------------------------------------------------------
-// G6 — anti-deadlock. An ATTENDED dialog the controller never answers resolves on
-// a SHORT per-dialog broker timeout. Guards: the engine never hangs on a dialog
-// with no answerer. Failure mode: a forever-blocked turn.
+// G6 — anti-deadlock. An ATTENDED dialog NO writable client answers resolves on a
+// SHORT per-dialog broker timeout, and every fanned peer is dismissed by id.
+// Guards: the engine never hangs on a dialog whose viewers all stay silent.
+// Failure mode: a forever-blocked turn, or overlays left up on every viewer.
 // ---------------------------------------------------------------------------
-test('G6 — an unanswered attended dialog resolves on the broker timeout', async () => {
+test('G6 — an attended dialog no writable client answers resolves on the broker timeout and dismisses every peer', async () => {
     const pid = brokerPid();
     const base = dialogCount();
-    // A controller attached but silent → the broker resolves on the SHORT explicit
-    // per-dialog timeout (800ms), never the 120s default. On timeout the broker also
-    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so the
-    // controller's overlay (which has no independent timer) is torn down by id.
-    const c = await ctrl('g6-ctrl');
+    // Two writable clients attached but silent → the broker resolves on the SHORT
+    // explicit per-dialog timeout (800ms), never the 120s default. On timeout it
+    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so
+    // EVERY peer's overlay (none has an independent timer) is torn down by id.
+    const a = await writer('g6-A');
+    const b = await writer('g6-B');
     h.fakeCmd(id, { cmd: 'dialog', timeout: 800 });
-    const req = await c.waitFrame((f) => f.type === 'extension_ui_request', 'G6b dialog forwarded to controller'); // received, deliberately NOT answered
-    const reqId = req.id;
-    const dismiss = await c.waitFrame((f) => f.type === 'extension_ui_dismiss' && f.id === reqId, 'G6b broker emits a correlated extension_ui_dismiss on timeout');
-    assert.equal(dismiss.id, reqId, 'G6b: the dismiss frame carries the timed-out dialog id, not another');
-    const results = await awaitDialogs(base + 1, 'G6b attended dialog resolved on timeout');
-    assert.equal(results[base].resolved, false, 'G6b: an unanswered attended dialog resolves to the default (deny)');
-    assert.ok(results[base].ms >= 600 && results[base].ms < 5000, `G6b: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${results[base].ms}ms`);
+    const reqA = await a.waitFrame(isRequest, 'G6 dialog fanned out to writable A'); // received, deliberately NOT answered
+    const reqB = await b.waitFrame(isRequest, 'G6 dialog fanned out to writable B'); // received, deliberately NOT answered
+    const reqId = reqA.id;
+    assert.equal(reqB.id, reqId, 'G6: both silent peers hold the SAME dialog id');
+    const dismissA = await a.waitFrame(dismissFor(reqId), 'G6 broker emits a correlated dismiss to A on timeout');
+    await b.waitFrame(dismissFor(reqId), 'G6 broker emits the same correlated dismiss to peer B');
+    assert.equal(dismissA.id, reqId, 'G6: the dismiss frame carries the timed-out dialog id, not another');
+    const results = await awaitDialogs(base + 1, 'G6 attended dialog resolved on timeout');
+    assert.equal(results[base].resolved, false, 'G6: a dialog no writable client answered resolves to the default (deny)');
+    assert.ok(results[base].ms >= 600 && results[base].ms < 5000, `G6: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${results[base].ms}ms`);
     assert.equal(isPidAlive(pid), true, 'G6: the engine made forward progress (still alive)');
 });

package/dist/core/__tests__/helpers/broker-clients.js

@@ -91,8 +91,8 @@ export function createAttachKit(getH) {
         return { client, frames, welcome, send: (f) => client.send(f), waitFrame, close: () => client.close() };
     }
     // Attach (as `role`) and retry until the welcome satisfies `pred` — used where the
-    // observable lands a beat after a prior action (G3 snapshot accrual, G5b control
-    // handoff after a controller detaches). Deterministic: it polls an observable.
+    // observable lands a beat after a prior action, such as snapshot accrual or
+    // persisted presence after a socket closes. Deterministic: it polls an observable.
     async function attachUntil(id, role, clientId, pred, label) {
         for (let attempt = 0;; attempt++) {
             const a = await attach(id, role, `${clientId}-${attempt}`);

package/dist/core/__tests__/session-model.test.js

@@ -16,7 +16,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { applySnapshot, initialSessionState, reduce, } from '../session-model/session-state.js';
-const CLIENT = 'viewer-1';
 const engine = (patch = {}) => ({
     model: undefined,
     thinkingLevel: 'off',
@@ -35,7 +34,6 @@ const engine = (patch = {}) => ({
 const welcome = (over = {}, state = engine(), display) => ({
     type: 'welcome',
     role: 'controller',
-    controller_id: CLIENT,
     agentDir: '/home/u/.pi/agent',
     snapshot: {
         messages: [],
@@ -45,7 +43,7 @@ const welcome = (over = {}, state = engine(), display) => ({
     },
     ...over,
 });
-const fold = (from, frames) => frames.reduce((s, f) => reduce(s, f, CLIENT), from);
+const fold = (from, frames) => frames.reduce((s, f) => reduce(s, f), from);
 test('applySnapshot(welcome) equals folding the edges that produced the same broker state', () => {
     // The live path: a viewer attached from t=0 watches these edges go by.
     const edges = [
@@ -75,42 +73,42 @@ test('applySnapshot(welcome) equals folding the edges that produced the same bro
     assert.deepEqual(late, live, 'the two ways to learn a session must agree');
 });
 test('agent_settled clears isStreaming (the frozen-Working… fix, now shared by both viewers)', () => {
-    const s0 = reduce(initialSessionState(), welcome(), CLIENT);
-    const streaming = reduce(s0, { type: 'agent_start' }, CLIENT);
+    const s0 = reduce(initialSessionState(), welcome());
+    const streaming = reduce(s0, { type: 'agent_start' });
     assert.equal(streaming.engine?.isStreaming, true);
     // agent_settled ALONE — no agent_end — must settle it. A dormant orchestrator
     // between wakes showed a frozen spinner when this was missed.
-    const settled = reduce(streaming, { type: 'agent_settled' }, CLIENT);
+    const settled = reduce(streaming, { type: 'agent_settled' });
     assert.equal(settled.engine?.isStreaming, false);
 });
 test('a notify is never a dialog, and never disturbs one that is pending', () => {
-    const s0 = reduce(initialSessionState(), welcome(), CLIENT);
-    const asked = reduce(s0, { type: 'extension_ui_request', id: 'ask-1', method: 'input', title: 'Paste the code' }, CLIENT);
+    const s0 = reduce(initialSessionState(), welcome());
+    const asked = reduce(s0, { type: 'extension_ui_request', id: 'ask-1', method: 'input', title: 'Paste the code' });
     assert.equal(asked.dialog?.id, 'ask-1');
-    const notified = reduce(asked, { type: 'extension_ui_request', id: 'n-1', method: 'notify', message: 'background progress' }, CLIENT);
+    const notified = reduce(asked, { type: 'extension_ui_request', id: 'n-1', method: 'notify', message: 'background progress' });
     assert.equal(notified, asked, 'a notify carries no session state — same reference, dialog untouched');
     // A display paint is equally inert with respect to the pending dialog.
-    const painted = reduce(asked, { type: 'extension_ui_request', id: 's-1', method: 'setStatus', statusKey: 'k', statusText: 'v' }, CLIENT);
+    const painted = reduce(asked, { type: 'extension_ui_request', id: 's-1', method: 'setStatus', statusKey: 'k', statusText: 'v' });
     assert.equal(painted.dialog?.id, 'ask-1', 'a chrome paint must not clear a pending dialog');
     // And only the MATCHING correlated dismiss clears it.
-    assert.equal(reduce(asked, { type: 'extension_ui_dismiss', id: 'other' }, CLIENT), asked);
-    assert.equal(reduce(asked, { type: 'extension_ui_dismiss', id: 'ask-1' }, CLIENT).dialog, null);
+    assert.equal(reduce(asked, { type: 'extension_ui_dismiss', id: 'other' }), asked);
+    assert.equal(reduce(asked, { type: 'extension_ui_dismiss', id: 'ask-1' }).dialog, null);
 });
 test('frames that carry no session state return the SAME state reference', () => {
-    const s0 = reduce(initialSessionState(), welcome(), CLIENT);
+    const s0 = reduce(initialSessionState(), welcome());
     const inert = [
-        { type: 'error', code: 'not_controller', message: 'read-only' },
+        { type: 'error', code: 'read_only', message: 'read-only' },
         { type: 'ack', for: 'get_commands', ok: true, detail: '[]' },
         { type: 'bash_start', command: 'ls' },
         { type: 'bash_output', chunk: 'a\n' },
         { type: 'bash_end', exitCode: 0, cancelled: false, truncated: false },
     ];
     for (const f of inert) {
-        assert.equal(reduce(s0, f, CLIENT), s0, `${f.type} must not allocate a new state`);
+        assert.equal(reduce(s0, f), s0, `${f.type} must not allocate a new state`);
     }
     // Slice identity is what viewers repaint off: an engine-only change must leave
     // the display slice untouched by reference.
-    const started = reduce(s0, { type: 'agent_start' }, CLIENT);
+    const started = reduce(s0, { type: 'agent_start' });
     assert.notEqual(started, s0);
     assert.equal(started.display, s0.display, 'an engine change must not dirty the display slice');
 });
@@ -125,16 +123,7 @@ test('a welcome is a COMPLETE catch-up: a re-welcome drops a dead broker s level
     assert.equal(s0.engine?.pendingMessageCount, 1);
     // A fresh broker (post-revive) welcomes with its OWN levels and an empty queue,
     // and emits no queue_update to overwrite the panel — so the welcome must.
-    const s1 = reduce(s0, welcome(), CLIENT);
+    const s1 = reduce(s0, welcome());
     assert.deepEqual(s1.display.statuses, {}, 'a dead broker s status keys must not survive');
     assert.deepEqual(s1.queued, [], 'a dead broker s queued rows must not survive');
 });
-test('role follows the broker: control_changed re-derives it from our own client id', () => {
-    const s0 = reduce(initialSessionState(), welcome({ role: 'controller', controller_id: CLIENT }), CLIENT);
-    assert.equal(s0.role, 'controller');
-    const demoted = reduce(s0, { type: 'control_changed', controller_id: 'someone-else' }, CLIENT);
-    assert.equal(demoted.role, 'observer');
-    assert.equal(demoted.controllerId, 'someone-else');
-    const back = reduce(demoted, { type: 'control_changed', controller_id: CLIENT }, CLIENT);
-    assert.equal(back.role, 'controller');
-});

package/dist/core/bash-jobs.d.ts

@@ -5,9 +5,20 @@ export interface BashJobPaths {
     jobLog: string;
     jobExit: string;
     jobBg: string;
+    /** Process-group id of the job's detached supervisor, written at spawn. It is
+     * what makes a job stoppable from outside the agent that started it (the
+     * Inspector's cancel) — without it on disk, only the agent's own handoff
+     * notice knows the group to signal. */
+    jobPgid: string;
 }
 export declare function bashJobsDir(contextDir: string): string;
 export declare function bashJobPaths(contextDir: string, jobId: string): BashJobPaths;
+/** The job's supervisor process group, or undefined for a job started before
+ * pgid was persisted (or a partially-written dir). */
+export declare function readJobPgid(contextDir: string, jobId: string): number | undefined;
+/** Last `count` lines of a job log, cheaply: read at most the trailing 64 KiB
+ * rather than the whole file, which for a long-running job can be enormous. */
+export declare function tailJobLog(logPath: string, count: number): string[];
 /** Mint a fresh job id — `${Date.now()}-${hex}`. The sole minting site; the
  * valve calls this instead of building the literal inline so the epoch-ms
  * prefix is a real contract shared with its parser (jobStartedAtMs), not an

package/dist/core/bash-jobs.js

@@ -3,7 +3,7 @@
 // the prefix menu requests backgrounding by creating job.bg. Keeping that signal
 // on disk means the command can outlive its pi process and still report its exit.
 import { randomBytes } from 'node:crypto';
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 export function bashJobsDir(contextDir) {
     return join(contextDir, 'jobs');
@@ -17,8 +17,48 @@ export function bashJobPaths(contextDir, jobId) {
         jobLog: join(dir, 'job.log'),
         jobExit: join(dir, 'job.exit'),
         jobBg: join(dir, 'job.bg'),
+        jobPgid: join(dir, 'job.pgid'),
     };
 }
+/** The job's supervisor process group, or undefined for a job started before
+ * pgid was persisted (or a partially-written dir). */
+export function readJobPgid(contextDir, jobId) {
+    try {
+        const n = Number(readFileSync(bashJobPaths(contextDir, jobId).jobPgid, 'utf8').trim());
+        return Number.isInteger(n) && n > 1 ? n : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Last `count` lines of a job log, cheaply: read at most the trailing 64 KiB
+ * rather than the whole file, which for a long-running job can be enormous. */
+export function tailJobLog(logPath, count) {
+    if (count <= 0)
+        return [];
+    const WINDOW = 64 * 1024;
+    let fd;
+    try {
+        const size = statSync(logPath).size;
+        const start = Math.max(0, size - WINDOW);
+        const buf = Buffer.alloc(Math.min(size, WINDOW));
+        fd = openSync(logPath, 'r');
+        readSync(fd, buf, 0, buf.length, start);
+        const text = buf.toString('utf8');
+        // A partial first line (we cut mid-line) is dropped, not shown truncated.
+        const lines = (start > 0 ? text.slice(text.indexOf('\n') + 1) : text).split('\n');
+        if (lines[lines.length - 1] === '')
+            lines.pop();
+        return lines.slice(-count);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
 /** Mint a fresh job id — `${Date.now()}-${hex}`. The sole minting site; the
  * valve calls this instead of building the literal inline so the epoch-ms
  * prefix is a real contract shared with its parser (jobStartedAtMs), not an

package/dist/core/feed/inbox.d.ts

@@ -75,9 +75,9 @@ export declare function clipBody(body: string): {
  *
  * Format (per sender group):
  *   From <sender> — <N> update(s):
- *     [<kind>] <label> at <absolute report path>:
- *
- *   <short report body>
+ *     [<kind>]
+ *       <short report body>
+ *       (report: <absolute report path>)
  *
  * Large reports remain canonical pointers and add one shared dereference hint.
  */

package/dist/core/feed/inbox.js

@@ -330,15 +330,19 @@ function inlineReport(e) {
 /**
  * Render one entry's digest line(s).
  *
- * Short pushed reports are inlined with their absolute report path. Larger
- * reports stay canonical history pointers. Direct messages retain their bounded
+ * A short pushed report is inlined as its own body, followed by a pointer to
+ * the durable artifact. The label is NOT repeated above it: a report's label is
+ * just its first line (feed.ts `firstLine`), so printing both reads as a
+ * truncated preview stacked on the full text it previews. Larger reports stay
+ * canonical history pointers. Direct messages retain their bounded
  * inline-body/spill behavior.
  */
 function renderEntry(e) {
     const report = inlineReport(e);
     if (report !== null) {
+        const indented = report.body.trimEnd().split('\n').map((l) => `    ${l}`).join('\n');
         return {
-            text: `  [${e.kind}] ${e.label} at ${report.path}:\n\n${report.body}`,
+            text: `  [${e.kind}]\n${indented}\n    (report: ${report.path})`,
             hasCanonicalRef: false,
         };
     }
@@ -364,9 +368,9 @@ function renderEntry(e) {
  *
  * Format (per sender group):
  *   From <sender> — <N> update(s):
- *     [<kind>] <label> at <absolute report path>:
- *
- *   <short report body>
+ *     [<kind>]
+ *       <short report body>
+ *       (report: <absolute report path>)
  *
  * Large reports remain canonical pointers and add one shared dereference hint.
  */

package/dist/core/inspector/core.d.ts

@@ -1,6 +1,14 @@
 import type { CronDTO } from '../../api/dto/crons.js';
 import type { SourceError, ViewCore } from '../view/contract.js';
-import { scheduledItems, type InspectorSection } from './model.js';
+import { scheduledItems, type BashJobRow, type InspectorSection } from './model.js';
+/** What a `y` confirmation will act on. Both sections arm cancellation the same
+ *  way, so the pending action carries its own kind rather than the view guessing
+ *  from whichever section happens to be open when the key lands. */
+export type PendingAction = {
+    kind: 'cron' | 'job';
+    id: string;
+    label: string;
+};
 export interface InspectorState {
     target: string;
     section: InspectorSection;
@@ -14,10 +22,17 @@ export interface InspectorState {
         error: SourceError | null;
         fetchedAt: number;
     };
+    jobs: {
+        data: BashJobRow[] | null;
+        error: SourceError | null;
+        fetchedAt: number;
+    };
     selectedCronId: string | null;
+    selectedJobId: string | null;
     expanded: boolean;
-    pendingCancel: string | null;
+    pendingCancel: PendingAction | null;
     scroll: Record<InspectorSection, number>;
 }
 export declare const inspectorCore: ViewCore<InspectorState>;
+export declare function selectedJob(state: InspectorState): BashJobRow | undefined;
 export { scheduledItems };