@north-light/crouter 0.3.173 → 0.3.174

package/dist/core/__tests__/{command-plugins.test.js → serial/command-plugins.test.js}

@@ -1,5 +1,5 @@
 // Contract-seam tests for the external command-plugin seam (Phase 1).
-// Run with: node --import tsx/esm --test src/core/__tests__/command-plugins.test.ts
+// Run with: npm run test:serial
 //
 // All tests run against an ISOLATED home (HOME → a fresh temp dir, no ambient
 // user plugins) and pass an explicit no-`.crouter` startDir, so discovery is
@@ -20,23 +20,28 @@
 //     on the next discovery call (per-invocation, no cache).
 //  6/7. Typed issues for path/exec-bit/schema/unknown-key violations and nested
 //     mount composition without executing the fixture binary.
-import { test, describe, before, after, beforeEach } from 'node:test';
+import { test, describe, before, after, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync, existsSync } from 'node:fs';
 import { readFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { discoverCommandContributions, effectiveCommandPlugins, validatePluginCommands, } from '../command-plugins/discovery.js';
-import { composeExternalSubtrees, adaptPluginContributions } from '../command-plugins/compose.js';
-import { resolveCommandRegistry } from '../command-manifests/registry.js';
-import { defineRoot } from '../command.js';
-import { renderRoot, renderBranch, renderLeafArgv } from '../help.js';
-import { renderResult } from '../render.js';
-import { CrtrError } from '../errors.js';
-import { resetScopeCache } from '../scope.js';
-import { listInstalledPluginsInRoot } from '../resolver.js';
+import { discoverCommandContributions, effectiveCommandPlugins, validatePluginCommands, } from '../../command-plugins/discovery.js';
+import { composeExternalSubtrees, adaptPluginContributions } from '../../command-plugins/compose.js';
+import { resolveCommandRegistry } from '../../command-manifests/registry.js';
+import { defineRoot } from '../../command.js';
+import { renderRoot, renderBranch, renderLeafArgv } from '../../help.js';
+import { renderResult } from '../../render.js';
+import { CrtrError } from '../../errors.js';
+import { resetScopeCache } from '../../scope.js';
+import { listInstalledPluginsInRoot } from '../../resolver.js';
+import { pluginShow } from '../../../commands/pkg/plugin-inspect.js';
+import { sysDoctorLeaf } from '../../../commands/sys/doctor.js';
+import { createApiServer } from '../../../daemon/api/server.js';
+import { apiSocketPath, crtrHome } from '../../canvas/paths.js';
+import { closeDb } from '../../canvas/db.js';
 // The set of reserved core names discovery must fail closed against. We don't
 // import the real SUBTREE_NAMES (build-root.ts pulls the whole tree); a small
 // explicit set is enough for the collision contract and keeps the test cheap.
@@ -364,11 +369,11 @@ describe('protocol integration', () => {
 // 4b. True end-to-end CLI invocation (argv → parseArgv → adapter → renderer)
 // ---------------------------------------------------------------------------
 describe('end-to-end CLI invocation', () => {
-    // dist/cli.js is up 4 from src/core/__tests__/. Requires a prior `npm run
-    // build` (the harness/CI builds before tests). Drives the WHOLE seam: the
+    // dist/cli.js is up 4 from src/core/__tests__/serial/. Requires a prior
+    // `npm run build` (the harness/CI builds before tests). Drives the WHOLE seam: the
     // declared positional `app-id` must arrive as `appId` in the request, and
     // the rendered + --json outputs come through the real dispatcher.
-    const cli = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'dist', 'cli.js');
+    const cli = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', 'dist', 'cli.js');
     const runCrtr = (args) => {
         installPlugin(userRoot, 'deploy-tools');
         resetScopeCache();
@@ -505,3 +510,88 @@ describe('typed validation issues', () => {
         assert.equal(v.contributions[0].node.name, 'app');
     });
 });
+// ---------------------------------------------------------------------------
+// Lifecycle surfaces — the validator's verdict must reach the caller WITHOUT
+// executing the plugin binary, and a cross-plugin top-level collision must not
+// read as a pass on any claimant.
+// ---------------------------------------------------------------------------
+describe('lifecycle surfaces report validation without executing the plugin', () => {
+    // Records the fact it ran. No validation surface may ever spawn it.
+    const SENTINEL_EXEC = `#!/usr/bin/env node
+const fs = require('fs');
+if (process.env.CMDPLUGIN_SENTINEL) fs.writeFileSync(process.env.CMDPLUGIN_SENTINEL, 'executed');
+process.stdout.write(JSON.stringify({ protocolVersion: 1, ok: true, result: { app_id: 'x', status: 'running' } }));
+`;
+    let sentinel;
+    let realCwd;
+    beforeEach(() => {
+        realCwd = process.cwd();
+        sentinel = join(emptyStart, 'EXECUTED');
+        process.env['CMDPLUGIN_SENTINEL'] = sentinel;
+        process.chdir(emptyStart); // no .crouter ancestor → project scope is empty
+        resetScopeCache();
+    });
+    afterEach(() => {
+        process.chdir(realCwd);
+        delete process.env['CMDPLUGIN_SENTINEL'];
+        resetScopeCache();
+    });
+    function assertNotExecuted() {
+        assert.equal(existsSync(sentinel), false, 'a validation surface must never spawn the plugin binary');
+    }
+    test('pkg plugin show passes the typed issue through and mounts nothing', async () => {
+        const broken = commandsJson();
+        broken['schemaVersion'] = 2;
+        installPlugin(userRoot, 'p', { manifest: broken, exec: SENTINEL_EXEC });
+        resetScopeCache();
+        const out = await pluginShow.run({ name: 'p' });
+        const commands = out['commands'];
+        const issue = commands.issues.find((i) => i.code === 'command_schema_version');
+        assert.ok(issue, `expected command_schema_version, got ${JSON.stringify(commands.issues.map((i) => i.code))}`);
+        assert.ok(typeof issue.received === 'string' && typeof issue.expected === 'string' && typeof issue.next === 'string');
+        assert.equal(commands.mounts.length, 0, 'a rejected manifest contributes no mounts');
+        assertNotExecuted();
+    });
+    test('a cross-plugin top-level collision drops the command and fails BOTH claimants on every surface', async () => {
+        // Two plugins, each valid in isolation, both claiming `app`.
+        installPlugin(userRoot, 'p-one', { exec: SENTINEL_EXEC });
+        installPlugin(userRoot, 'p-two', { exec: SENTINEL_EXEC });
+        resetScopeCache();
+        const snapshot = discoverCommandContributions(new Set(['sys']), emptyStart);
+        assert.equal(snapshot.contributions.length, 0, 'a collided top-level command must not be mounted by ANY claimant');
+        assert.deepEqual(snapshot.issues.filter((i) => i.code === 'command_collision').map((i) => i.plugin).sort(), ['p-one', 'p-two'], 'both claimants are flagged');
+        for (const name of ['p-one', 'p-two']) {
+            const out = await pluginShow.run({ name });
+            const commands = out['commands'];
+            assert.deepEqual(commands.mounts, [], `${name} must not list the collided command as an accepted mount`);
+            const issue = commands.issues.find((i) => i.code === 'command_collision');
+            assert.ok(issue, `${name} show must carry the command_collision issue`);
+            assert.deepEqual(issue.received.split(', ').sort(), ['p-one', 'p-two'], 'the issue names both claimants');
+        }
+        // `sys doctor` scans live nodes through the daemon API, so it needs a
+        // reachable daemon answering with an empty roster (no node is ever created
+        // here) rather than trying to autostart a subprocess.
+        mkdirSync(crtrHome(), { recursive: true });
+        const server = createApiServer();
+        try {
+            for (let i = 0; i < 200 && !existsSync(apiSocketPath()); i++)
+                await new Promise((r) => setTimeout(r, 25));
+            assert.equal(existsSync(apiSocketPath()), true, 'api socket never bound');
+            const out = await sysDoctorLeaf.run({ scope: 'user', fix: false, remote: false });
+            const checks = out['checks'];
+            for (const name of ['p-one', 'p-two']) {
+                assert.equal(checks.find((k) => k.name === `plugin:${name}:commands` && k.status === 'pass'), undefined, `${name} must not PASS while its command is dropped by a collision`);
+                const failCheck = checks.find((k) => k.name.startsWith(`plugin:${name}:commands`) && k.status === 'fail' && /command_collision/.test(k.message));
+                assert.ok(failCheck, `${name} must fail with command_collision, got ${JSON.stringify(checks.map((k) => k.name + ':' + k.status))}`);
+                assert.match(failCheck.message, /claimed by multiple plugins/);
+                assert.equal(failCheck.remediation?.kind, 'human_action', 'command remediation is never auto-applied');
+            }
+            assert.equal(out['ok'], false);
+        }
+        finally {
+            await server.close();
+            closeDb();
+        }
+        assertNotExecuted();
+    });
+});

package/dist/core/__tests__/{deferred-no-wake.test.js → serial/deferred-no-wake.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/deferred-no-wake.test.ts
+// Run with: npm run test:serial
 //
 // REGRESSION LOCK — gh issue #341. `--tier deferred` is documented as the ONE
 // tier that never wakes an idle node ("read on its next natural cycle"), but
@@ -44,21 +44,21 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { DatabaseSync } from 'node:sqlite';
-import { createNode, deleteNode, getNode, setStatus, withFreshTerminalGuard } from '../canvas/canvas.js';
-import { hasNoNaturalCycle } from '../runtime/revive-all.js';
-import { canvasDbPath, nodeDir, apiSocketPath } from '../canvas/paths.js';
-import { closeDb } from '../canvas/db.js';
-import { createApiServer } from '../../daemon/api/server.js';
-import { CrtrClient } from '../../api/index.js';
-import { registerNode } from '../../commands/node.js';
-import { pushFinal } from '../feed/feed.js';
-import { InputError } from '../io.js';
-import { headlessBrokerHost } from '../runtime/host.js';
-import { appendInbox, readInboxSince, readCursor } from '../feed/inbox.js';
-import { superviseTick } from '../../daemon/crtrd.js';
-import registerCanvasInboxWatcher from '../../pi-extensions/canvas-inbox-watcher.js';
-import { bindTestFleet } from './helpers/fleet.js';
-import { resetFleetForTests } from '../runtime/fleet.js';
+import { createNode, deleteNode, getNode, setStatus, withFreshTerminalGuard } from '../../canvas/canvas.js';
+import { hasNoNaturalCycle } from '../../runtime/revive-all.js';
+import { canvasDbPath, nodeDir, apiSocketPath } from '../../canvas/paths.js';
+import { closeDb } from '../../canvas/db.js';
+import { createApiServer } from '../../../daemon/api/server.js';
+import { CrtrClient } from '../../../api/index.js';
+import { registerNode } from '../../../commands/node.js';
+import { pushFinal } from '../../feed/feed.js';
+import { InputError } from '../../io.js';
+import { headlessBrokerHost } from '../../runtime/host.js';
+import { appendInbox, readInboxSince, readCursor } from '../../feed/inbox.js';
+import { superviseTick } from '../../../daemon/crtrd.js';
+import registerCanvasInboxWatcher from '../../../pi-extensions/canvas-inbox-watcher.js';
+import { bindTestFleet } from '../helpers/fleet.js';
+import { resetFleetForTests } from '../../runtime/fleet.js';
 let home;
 let server;
 const prevNodeId = process.env['CRTR_NODE_ID'];
@@ -439,13 +439,16 @@ function makeFakePi() {
         on(e, h) { handlers[e] = h; },
         sendUserMessage(content, options) { this.injected.push({ content, deliverAs: options?.deliverAs }); },
         sendMessage() { },
-        fire(e, ev, ctx) { handlers[e]?.(ev, ctx); },
+        async fire(e, ev, ctx) { await handlers[e]?.(ev, ctx); },
     };
 }
 const wait = (ms) => new Promise((r) => setTimeout(r, ms));
 test('the real inbox watcher holds a deferred entry alone, then delivers it TOGETHER with a later normal entry with no duplicate/loss, and the durable cursor settles past both (gh #341 review: genuine delivery, not just the daemon decision)', { timeout: 30_000 }, async () => {
     const id = 'watcherDeferredThenNormal';
-    createNode(node(id, { status: 'idle', intent: null }));
+    // The watcher may advance its cursor only for the current broker generation.
+    // This fake Pi runs in this test process, so its fabricated node must carry
+    // that process as the active broker just like a real launched node does.
+    createNode(node(id, { status: 'idle', intent: null, pi_pid: process.pid }));
     const TICK_MS = 20;
     const DEBOUNCE_MS = 25;
     const SETTLE_MS = TICK_MS * 2 + DEBOUNCE_MS + 30;
@@ -462,7 +465,7 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
         // session_start is the real lifecycle gate that arms the watcher's poll
         // interval and initial tick (see canvas-inbox-watcher.ts) — registration
         // alone only wires up handlers.
-        pi.fire('session_start', { type: 'session_start' }, undefined);
+        await pi.fire('session_start', { type: 'session_start' }, undefined);
         // No agent_start fired — the watcher treats the node as idle, same as the
         // idle-released daemon scenario above.
         await wait(TICK_MS + 60);
@@ -492,7 +495,7 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
         // durable cursor at agent_settled (never on the fire-and-forget send
         // itself) — settle the turn and prove the cursor lands past BOTH delivered
         // entries, not just the earlier (previously-held) one.
-        pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => false });
+        await pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => false });
         assert.equal(readCursor(id), normalEntry.entry_id, 'the durable cursor settles past BOTH delivered entries, at the final physical entry');
         assert.notEqual(readCursor(id), deferredEntry.entry_id, 'not a partial commit stuck at the earlier entry');
     }

package/dist/core/__tests__/{flagship-lifecycle.test.js → serial/flagship-lifecycle.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/flagship-lifecycle.test.ts
+// Run with: npm run test:serial
 //
 // HEADLESS RETARGET (foundation-spec §C.9 + §E). The flagship end-to-end
 // lifecycle scenario, driven entirely at the MODEL layer against FABRICATED
@@ -54,12 +54,12 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { createHeadlessHarness } from './helpers/harness.js';
-import { subscribe } from '../canvas/canvas.js';
-import { transition } from '../runtime/lifecycle.js';
-import { pushFinal } from '../feed/feed.js';
-import { evaluateStop, STALL_REPROMPT } from '../runtime/stop-guard.js';
-import { personaDrift, commitPersonaAck } from '../runtime/persona.js';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { subscribe } from '../../canvas/canvas.js';
+import { transition } from '../../runtime/lifecycle.js';
+import { pushFinal } from '../../feed/feed.js';
+import { evaluateStop, STALL_REPROMPT } from '../../runtime/stop-guard.js';
+import { personaDrift, commitPersonaAck } from '../../runtime/persona.js';
 // A pid reaped (dead) by the time spawnSync returns — a released broker's exited
 // process (the headless analog of a closed pane).
 function deadPid() {

package/dist/core/__tests__/{host-teardown-process-group.test.js → serial/host-teardown-process-group.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/host-teardown-process-group.test.ts
+// Run with: npm run test:serial
 //
 // Regression cover for crouton-labs/crouter#98: a canceled/wedged child node
 // ORPHANS its subprocess tree (bash → test runner → spawned app) because
@@ -65,11 +65,11 @@ import { spawn } from 'node:child_process';
 import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createHarness } from './helpers/harness.js';
-import { isPidAlive, capturePidIdentities, killProcessTreePids, captureTeardownSnapshot } from '../canvas/pid.js';
-import { recordPid } from '../canvas/canvas.js';
-import { openDb } from '../canvas/db.js';
-import { headlessBrokerHost } from '../runtime/host.js';
+import { createHarness } from '../helpers/harness.js';
+import { isPidAlive, capturePidIdentities, killProcessTreePids, captureTeardownSnapshot } from '../../canvas/pid.js';
+import { recordPid } from '../../canvas/canvas.js';
+import { openDb } from '../../canvas/db.js';
+import { headlessBrokerHost } from '../../runtime/host.js';
 let h;
 let root;
 let scratch;

package/dist/core/__tests__/{human-deliver-e2e.test.js → serial/human-deliver-e2e.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/human-deliver-e2e.test.ts
+// Run with: npm run test:serial
 //
 // Drive a terminal ticket through the public crtrd ticket route. Terminal
 // delivery is daemon-owned; no subprocess handler or delivery receipt exists.
@@ -7,17 +7,17 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, existsSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { ApiError, CrtrClient } from '../../api/index.js';
-import { createApiServer } from '../../daemon/api/server.js';
-import { apiSocketPath } from '../canvas/paths.js';
-import { validateDeck } from '../human/deck-schema.js';
-import { claimTicket, readTicketClaim } from '../human/claim.js';
-import { ticketDir } from '../human/root.js';
-import { submitDeck, submitReview } from '../human/tickets.js';
-import { spawnNode } from '../runtime/nodes.js';
-import { getNode, closeDb } from '../canvas/index.js';
-import { readInboxSince } from '../feed/inbox.js';
-import { resolveRef } from '../canvas/history.js';
+import { ApiError, CrtrClient } from '../../../api/index.js';
+import { createApiServer } from '../../../daemon/api/server.js';
+import { apiSocketPath } from '../../canvas/paths.js';
+import { validateDeck } from '../../human/deck-schema.js';
+import { claimTicket, readTicketClaim } from '../../human/claim.js';
+import { ticketDir } from '../../human/root.js';
+import { submitDeck, submitReview } from '../../human/tickets.js';
+import { spawnNode } from '../../runtime/nodes.js';
+import { getNode, closeDb } from '../../canvas/index.js';
+import { readInboxSince } from '../../feed/inbox.js';
+import { resolveRef } from '../../canvas/history.js';
 let home;
 let priorHome;
 let server;

package/dist/core/__tests__/{live-mutation.test.js → serial/live-mutation.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/live-mutation.test.ts
+// Run with: npm run test:serial
 //
 // HEADLESS RETARGET (foundation-spec §C.12 + §E). AXIS: LIVE MUTATION of the
 // 2×2 state vector (mode {base,orchestrator} × lifecycle {terminal,resident})
@@ -40,10 +40,10 @@
 //     base→orchestrator after promote, then clears on commit').
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { createHeadlessHarness } from './helpers/harness.js';
-import { subscribe } from '../canvas/canvas.js';
-import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
-import { evaluateStop } from '../runtime/stop-guard.js';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { subscribe } from '../../canvas/canvas.js';
+import { commitPersonaAck, personaDrift } from '../../runtime/persona.js';
+import { evaluateStop } from '../../runtime/stop-guard.js';
 /** Normalize the two persona axes off a NodeMeta for deepEqual. */
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };

package/dist/core/__tests__/{refresh-stall-recycle.test.js → serial/refresh-stall-recycle.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/refresh-stall-recycle.test.ts
+// Run with: npm run test:serial
 //
 // BUG-REGRESSION (broker-universal-host cut, design §H refresh-authority; U7
 // report mq8gq8we-4cadd8e6; stuck-refresh, parent mq7s5o93). A `node yield` /
@@ -21,9 +21,10 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { createHeadlessHarness } from './helpers/harness.js';
-import { recordPid } from '../canvas/canvas.js';
-import { yieldStallVerdict, YIELD_STALL_GRACE_MS, isPidAlive } from '../../daemon/crtrd.js';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { recordPid } from '../../canvas/canvas.js';
+import { isPidAlive } from '../../canvas/pid.js';
+import { yieldStallVerdict, YIELD_STALL_GRACE_MS } from '../../../daemon/reconcilers/broker-supervision.js';
 // ---------------------------------------------------------------------------
 // D4a — the pure refresh-stall truth table.
 // ---------------------------------------------------------------------------
@@ -31,18 +32,8 @@ test('D4a yieldStallVerdict: kill ONLY a live, not-busy, refresh engine past the
     const G = YIELD_STALL_GRACE_MS;
     // The one 'kill' case: engine alive, intent=refresh, turn over (not busy), past grace.
     assert.equal(yieldStallVerdict(true, 'refresh', false, G), 'kill', 'alive+refresh+!busy+>=grace → kill');
-    assert.equal(yieldStallVerdict(true, 'refresh', false, G + 60_000), 'kill', 'well past grace → kill');
-    // Within the grace → pending (the healthy stophook window).
-    assert.equal(yieldStallVerdict(true, 'refresh', false, null), 'pending', 'first observation → pending');
-    assert.equal(yieldStallVerdict(true, 'refresh', false, G - 1), 'pending', 'within grace → pending');
     // A working engine is NEVER killed, even past the grace.
     assert.equal(yieldStallVerdict(true, 'refresh', true, G + 60_000), 'leave', 'busy (mid-turn) → leave');
-    // Not a refresh → not our concern.
-    assert.equal(yieldStallVerdict(true, 'idle-release', false, G + 60_000), 'leave', 'intent≠refresh → leave');
-    assert.equal(yieldStallVerdict(true, null, false, G + 60_000), 'leave', 'no pending intent → leave');
-    // A dead/unknown engine is the exit-policy job's concern, not this live-fleet check.
-    assert.equal(yieldStallVerdict(false, 'refresh', false, G + 60_000), 'leave', 'dead engine → leave (exit policy owns it)');
-    assert.equal(yieldStallVerdict(null, 'refresh', false, G + 60_000), 'leave', 'unknown pid → leave');
 });
 // ---------------------------------------------------------------------------
 // D4b — daemon integration: a stuck refresh on a LIVE engine is force-recycled.

package/dist/core/__tests__/{revive.test.js → serial/revive.test.js}

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/revive.test.ts
+// Run with: npm run test:serial
 //
 // HEADLESS RETARGET (foundation-spec §C.13 + §E). Covers the session-picker fix
 // (resume by ABSOLUTE session-file path, cwd-immune) and the double-revive guard
@@ -30,24 +30,21 @@ import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { createNode, getNode, subscribe, updateNode } from '../canvas/canvas.js';
-import { armCron, hasPendingCancelOnWakeCron } from '../canvas/crons.js';
-import { readInboxSince } from '../feed/inbox.js';
-import { closeDb } from '../canvas/db.js';
-import { buildPiArgv, CANVAS_EXTENSIONS } from '../runtime/launch.js';
-import { CANVAS_CONTEXT_INTRO_PATH, CANVAS_INBOX_WATCHER_PATH, CANVAS_REVIEW_BOUNDARY_PATH, CANVAS_STOPHOOK_PATH, } from '../runtime/canvas-extensions.js';
-import { headlessBrokerHost } from '../runtime/host.js';
-import { resumeArgs, reviveNode } from '../runtime/revive.js';
-import { REVIVE_KICKOFF_SENTINEL, readGoal, writeGoal } from '../runtime/kickoff.js';
-import { seedRoadmap } from '../runtime/roadmap.js';
-import { InputError } from '../io.js';
-import { createHarness } from './helpers/harness.js';
-import { bindTestFleet } from './helpers/fleet.js';
-import { resetFleetForTests } from '../runtime/fleet.js';
-const EXTRA_EXTENSION_PATH = join(dirname(fileURLToPath(import.meta.url)), '..', 'fixtures', 'extra-extension.ts');
+import { createNode, getNode, subscribe, updateNode } from '../../canvas/canvas.js';
+import { armCron, hasPendingCancelOnWakeCron } from '../../canvas/crons.js';
+import { readInboxSince } from '../../feed/inbox.js';
+import { closeDb } from '../../canvas/db.js';
+import { buildPiArgv } from '../../runtime/launch.js';
+import { headlessBrokerHost } from '../../runtime/host.js';
+import { resumeArgs, reviveNode } from '../../runtime/revive.js';
+import { REVIVE_KICKOFF_SENTINEL, readGoal, writeGoal } from '../../runtime/kickoff.js';
+import { seedRoadmap } from '../../runtime/roadmap.js';
+import { InputError } from '../../io.js';
+import { createHarness } from '../helpers/harness.js';
+import { bindTestFleet } from '../helpers/fleet.js';
+import { resetFleetForTests } from '../../runtime/fleet.js';
 let home;
 function node(id, over = {}) {
     return {
@@ -163,88 +160,6 @@ test('buildPiArgv passes no --session on a fresh (no-resume) launch', () => {
     assert.ok(!argv.includes('--session'), 'a fresh launch never resumes');
     assert.ok(argv.includes('go'), 'the kickoff prompt is the last positional');
 });
-test('buildPiArgv restores mandatory canvas extensions when persisted launch metadata is empty', () => {
-    const m = node('n', {
-        launch: {
-            model: 'openai/sonnet',
-            tools: [],
-            extensions: [],
-            systemPrompt: 'historical replay',
-            env: {},
-        },
-    });
-    const { argv } = buildPiArgv(m, { prompt: 'go' });
-    const seen = new Map();
-    const extensions = [];
-    for (let i = 0; i < argv.length; i++) {
-        if (argv[i] === '-e') {
-            const next = argv[i + 1];
-            if (typeof next === 'string') {
-                seen.set(next, (seen.get(next) ?? 0) + 1);
-                extensions.push(next);
-            }
-        }
-    }
-    const required = new Set(CANVAS_EXTENSIONS);
-    const mandatory = [];
-    for (const ext of CANVAS_EXTENSIONS) {
-        mandatory.push(ext);
-        assert.equal(seen.get(ext), 1, `mandatory extension present exactly once: ${ext}`);
-    }
-    assert.deepEqual(extensions.slice(0, required.size), mandatory, 'mandatory extensions are loaded first and once');
-    assert.equal(extensions.indexOf(CANVAS_STOPHOOK_PATH), extensions.indexOf(CANVAS_REVIEW_BOUNDARY_PATH) + 1, 'review boundary runs immediately before the stophook commits a companion bind');
-    assert.ok(extensions.indexOf(CANVAS_CONTEXT_INTRO_PATH) > extensions.indexOf(CANVAS_REVIEW_BOUNDARY_PATH), 'review boundary still precedes fork bearings');
-});
-test('buildPiArgv replaces the previous mandatory prefix with the current canvas hooks', () => {
-    const historicalNames = [
-        'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
-        'canvas-goal-capture', 'canvas-passive-context', 'canvas-context-intro',
-        'canvas-doc-substrate', 'canvas-structured-output', 'canvas-bash-valve',
-    ];
-    const m = node('n', {
-        launch: {
-            model: 'openai/sonnet',
-            tools: [],
-            extensions: [
-                ...historicalNames.map((name) => `/old-generation/pi-extensions/${name}.js`),
-                EXTRA_EXTENSION_PATH,
-            ],
-            systemPrompt: 'historical extension order',
-            env: {},
-        },
-    });
-    const { argv } = buildPiArgv(m, { prompt: 'go' });
-    const extensions = argv.flatMap((arg, index) => arg === '-e' && typeof argv[index + 1] === 'string' ? [argv[index + 1]] : []);
-    assert.deepEqual(extensions, [...CANVAS_EXTENSIONS, EXTRA_EXTENSION_PATH]);
-    assert.equal(extensions.some((path) => path.startsWith('/old-generation/')), false);
-});
-test('buildPiArgv preserves user extensions while deduplicating mandatory hooks', () => {
-    const m = node('n', {
-        launch: {
-            model: 'openai/sonnet',
-            tools: [],
-            extensions: [EXTRA_EXTENSION_PATH, CANVAS_INBOX_WATCHER_PATH],
-            systemPrompt: 'user extras replay',
-            env: {},
-        },
-    });
-    const { argv } = buildPiArgv(m, { prompt: 'go' });
-    const extensions = [];
-    for (let i = 0; i < argv.length; i++) {
-        if (argv[i] === '-e') {
-            const next = argv[i + 1];
-            if (typeof next === 'string')
-                extensions.push(next);
-        }
-    }
-    const mandatoryCount = CANVAS_EXTENSIONS.length;
-    assert.equal(extensions.slice(0, mandatoryCount).length, CANVAS_EXTENSIONS.length, 'mandatory extensions are still the boot prefix');
-    for (let i = 0; i < CANVAS_EXTENSIONS.length; i++) {
-        assert.equal(extensions[i], CANVAS_EXTENSIONS[i], `mandatory extension ${i} remains in order`);
-    }
-    assert.equal(extensions.includes(EXTRA_EXTENSION_PATH), true, 'custom extension preserved');
-    assert.equal(extensions.filter((ext) => ext === CANVAS_INBOX_WATCHER_PATH).length, 1, 'mandatory inbox watcher is deduplicated against user list');
-});
 // ---------------------------------------------------------------------------
 // buildPiArgv — the resumed argv replays the persisted launch spec faithfully
 // (kind/mode/lifecycle come back as the node's *current* self).

package/dist/core/__tests__/{spawn-root.test.js → serial/spawn-root.test.js}

@@ -3,19 +3,20 @@
 // only — no subscription wires back to the spawner.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createServer } from 'node:net';
 import { spawn as spawnProcess } from 'node:child_process';
-import { createNode, getNode, getRow, subscribersOf } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
-import { nodeDir } from '../canvas/paths.js';
-import { spawnNode } from '../runtime/nodes.js';
-import { spawnChild, resolveSpawner } from '../runtime/spawn.js';
-import { headlessBrokerHost } from '../runtime/host.js';
-import { recordFault } from '../runtime/fault.js';
-import { ROOT_PROFILE_ID } from '../profiles/manifest.js';
+import { createNode, getNode, getRow, subscribersOf } from '../../canvas/canvas.js';
+import { closeDb } from '../../canvas/db.js';
+import { nodeDir } from '../../canvas/paths.js';
+import { spawnNode } from '../../runtime/nodes.js';
+import { readGoal } from '../../runtime/kickoff.js';
+import { spawnChild, resolveSpawner } from '../../runtime/spawn.js';
+import { headlessBrokerHost } from '../../runtime/host.js';
+import { recordFault } from '../../runtime/fault.js';
+import { ROOT_PROFILE_ID } from '../../profiles/manifest.js';
 let home;
 function spawner(id) {
     return {
@@ -175,12 +176,28 @@ test('spawnChild: a root from a shell gets the stable root profile id', async ()
         rmSync(localCwd, { recursive: true, force: true });
     }
 });
-test('startup markers name their actual boundaries', () => {
-    const cli = readFileSync(new URL('../runtime/broker-cli.ts', import.meta.url), 'utf8');
-    const broker = readFileSync(new URL('../runtime/broker.ts', import.meta.url), 'utf8');
-    assert.ok(cli.indexOf('const startupAt = process.hrtime.bigint()') < cli.indexOf("await import('./broker.js')"), 'CLI origin is captured before broker-module import');
-    assert.match(broker, /emitStartupMilestone\('broker\.startup\.agent_start'/, 'agent start is named honestly');
-    assert.doesNotMatch(broker, /provider_request_start/, 'the trace does not overclaim provider request timing');
+test('a no-kickoff root persists no goal and still comes up active', async () => {
+    // The `node new --root --no-kickoff` path: an empty prompt reaches
+    // buildPiArgv as `undefined`-equivalent, so the broker comes up idle and
+    // goal-less, ready for a real first prompt.
+    const originalLaunch = headlessBrokerHost.launch;
+    const localCwd = mkdtempSync(join(tmpdir(), 'crtr-no-kickoff-cwd-'));
+    let broker;
+    try {
+        headlessBrokerHost.launch = (nodeId, _inv, _opts) => {
+            broker = createServer();
+            broker.listen(join(nodeDir(nodeId), 'view.sock'));
+            return { pid: process.pid, exited: new Promise(() => { }) };
+        };
+        const result = await spawnChild({ kind: 'general', cwd: localCwd, root: true, readiness: 'await', prompt: '' });
+        assert.equal(readGoal(result.node.node_id), null, 'no goal file was written for an empty (no-kickoff) prompt');
+        assert.equal(getNode(result.node.node_id)?.status, 'active', 'the node still comes up active, ready for a real first prompt');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+        await new Promise((resolve) => broker?.close(() => resolve()) ?? resolve());
+        rmSync(localCwd, { recursive: true, force: true });
+    }
 });
 test('root readiness is explicit: direct creation awaits its listener; deferred births launch immediately', async () => {
     const originalLaunch = headlessBrokerHost.launch;