@north-light/crouter 0.3.173 → 0.3.175

package/dist/core/__tests__/full/broker-attach-limits.test.js

@@ -1,147 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-attach-limits.test.ts
-//
-// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
-// (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
-//
-// T8 — the `crtr surface attach` acceptance gate for G4/G7/G8: multi-writer
-// admission, decoder overflow isolation, and backpressure shedding.
-//
-// 3-PART HEADER (headless):
-//  (1) CONTRACT — every client that hellos as `controller` is welcomed writable,
-//      simultaneously and independently; each writable client may submit, and
-//      every connected client (both writers plus a read-only observer) receives
-//      the merged stream of both submissions, while a client that hellos as
-//      `observer` is rejected with error{read_only} when it tries to drive (G4).
-//      An oversized client line is capped and dropped with frame_overflow while
-//      the broker and other clients continue operating (G7). A stalled
-//      non-reading viewer is shed at the 32 MiB backpressure HWM while the
-//      broker and fast viewers remain unaffected (G8).
-//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — role admission, decoder limits,
-//      and the backpressure HWM are broker-process and view.sock contracts. They
-//      are exercised over a pure Unix socket using the production ViewSocketClient
-//      and raw node:net peers, with a real broker process and no tmux pane or
-//      window.
-//  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the real socket responses
-//      provide the G4 welcome roles, per-writer relay frames and the read-only
-//      rejection, the G7 frame-overflow drop and broker survival, and the G8
-//      HWM-shed log line and broker survival.
-//
-// One shared broker is booted in before() and reused across all three gates. There
-// is no writer slot to hand off, so every gate simply attaches at the role it
-// wants.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { createHeadlessHarness } from '../helpers/harness.js';
-import { isPidAlive } from '../../canvas/pid.js';
-import { createAttachKit, delay, tok, frameHas, brokerLogText, } from '../helpers/broker-clients.js';
-let h;
-let id; // ONE shared broker, reused across G4/G7/G8 (1 real boot, not 3)
-const kit = createAttachKit(() => h);
-const { attach, connectRaw } = kit;
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brklim' });
-    const root = h.spawnRoot('broker-attach-limits suite root');
-    id = await h.spawnHeadlessChild(root, 'headless worker — attach-limits gates');
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-const brokerPid = () => h.node(id).pi_pid;
-// ---------------------------------------------------------------------------
-// G4 — multi-writer admission + read-only gating. Guards: two simultaneous
-// `controller` hellos are BOTH welcomed writable, each one's own submission
-// reaches the engine, and every connected client sees BOTH turns; an explicit
-// observer that tries to drive is rejected with error{read_only}.
-// Failure mode: a singleton writer slot demoting the second client, a writer
-// whose prompt is silently dropped, fan-out that misses a viewer, or a
-// read-only client that can drive the engine.
-// ---------------------------------------------------------------------------
-test('G4 — two simultaneous clients are both welcomed controller, each submits, and both see both turns; an observer drive → error{read_only}', async () => {
-    const [w1, w2] = await Promise.all([
-        attach(id, 'controller', 'g4-writer-1'),
-        attach(id, 'controller', 'g4-writer-2'),
-    ]);
-    assert.equal(w1.welcome.role, 'controller', 'first client is welcomed writable');
-    assert.equal(w2.welcome.role, 'controller', 'second SIMULTANEOUS client is ALSO welcomed writable (no singleton slot)');
-    const observer = await attach(id, 'observer', 'g4-observer');
-    assert.equal(observer.welcome.role, 'observer', 'an explicit observer hello stays read-only');
-    // A read-only client may not drive the engine — the role is per-client and
-    // fixed by its own hello, so this rejection is independent of who else is
-    // attached.
-    observer.send({ type: 'prompt', text: 'a read-only client must not drive' });
-    const err = await observer.waitFrame((f) => f.type === 'error', 'G4 observer prompt rejected');
-    assert.equal(err.code, 'read_only', 'G4: observer prompt → error{read_only}');
-    // Each writer submits its OWN token. Submissions are sequenced (a prompt sent
-    // mid-stream routes as a steer and produces no second turn), so each turn is
-    // driven to its terminal agent_end before the next writer submits.
-    const tokenA = tok('G4-WRITER-1');
-    w1.send({ type: 'prompt', text: tokenA });
-    await w1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 writer 1 saw its own turn');
-    const tokenB = tok('G4-WRITER-2');
-    w2.send({ type: 'prompt', text: tokenB });
-    await w2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 writer 2 saw its own turn');
-    // The merged stream: EVERY connected client — both writers and the read-only
-    // observer — receives BOTH writers' turns.
-    await w2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 writer 2 ALSO received writer 1 turn');
-    await w1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 writer 1 ALSO received writer 2 turn');
-    await observer.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 observer received writer 1 turn');
-    await observer.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 observer received writer 2 turn');
-});
-// ---------------------------------------------------------------------------
-// G7 — decoder overflow (guards C5 OOM). A client line over BROKER_READ_CAPS is
-// cap-and-dropped; the broker survives and other clients are unaffected. Failure
-// mode: an unbounded decoder buffer growing the broker to OOM.
-// ---------------------------------------------------------------------------
-test('G7 — an oversized client line is dropped (frame_overflow), the broker survives, other clients unaffected', { timeout: 30_000 }, async () => {
-    const pid = brokerPid();
-    const boots = h.bootCount(id);
-    const survivor = await attach(id, 'observer', 'g7-survivor');
-    // 26 MiB with NO newline > BROKER_READ_CAPS.maxLineBytes (24 MiB) → the bounded
-    // FrameDecoder throws FrameOverflowError; the broker drops the peer.
-    const bad = await connectRaw(id, { read: true });
-    bad.writeRaw(Buffer.alloc(26 * 1024 * 1024, 0x78));
-    await bad.waitClosed('G7 oversized peer dropped by the broker');
-    await h.waitFor(() => /frame overflow/.test(brokerLogText(h, id)) || null, { label: 'G7 broker logged the frame-overflow drop' });
-    // The broker survives and the other client is unaffected: a fresh turn relays.
-    const token = tok('G7-AFTER');
-    h.fakeCmd(id, { cmd: 'stream', text: token });
-    await survivor.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G7 survivor still receives live frames');
-    assert.equal(isPidAlive(pid), true, 'G7: the broker survived the overflow');
-    assert.equal(brokerPid(), pid, 'G7: broker pid unchanged');
-    assert.equal(h.bootCount(id), boots, 'G7: no reboot');
-});
-// ---------------------------------------------------------------------------
-// G8 — backpressure leak (guards M1). A stalled (non-reading) viewer is shed at
-// the HWM (32 MiB byte cap) while the broker + other viewers are unaffected.
-// Failure mode: an indefinitely-growing per-viewer queue (broker OOM) or a slow
-// viewer back-pressuring the shared engine.
-// ---------------------------------------------------------------------------
-test('G8 — a stalled viewer is dropped at the backpressure HWM; the broker + fast viewers are unaffected', { timeout: 30_000 }, async () => {
-    const pid = brokerPid();
-    const fast = await attach(id, 'observer', 'g8-fast'); // reads normally
-    // A helloed viewer that NEVER reads (paused socket). It must be in the broadcast
-    // set before the flood; hello, then a short beat for the broker to process it.
-    const stalled = await connectRaw(id, { read: false });
-    stalled.send({ type: 'hello', role: 'observer', client_id: 'g8-stalled' });
-    await delay(400);
-    // A fast event stream: ~60 MiB across 240 message_update frames. The stalled
-    // viewer's per-viewer backlog crosses the 32 MiB byte cap → dropped; the fast
-    // viewer drains between frames (per-update yield) and survives.
-    //
-    // The DROP SIGNAL is the broker's own log line, NOT the stalled socket's 'close':
-    // a PAUSED node socket does not surface the peer FIN/close until it is resumed,
-    // so the broker-side `backpressure high-water mark exceeded` line is the
-    // deterministic, race-free proof that the slow viewer was shed at the HWM.
-    const token = tok('G8-FLOOD');
-    h.fakeCmd(id, { cmd: 'stream', text: token, updates: 240, padBytes: 256 * 1024, tool: false });
-    await h.waitFor(() => /backpressure high-water mark exceeded/.test(brokerLogText(h, id)) || null, { label: 'G8 broker shed the stalled viewer at the HWM', timeoutMs: 30_000 });
-    // The fast viewer drained the WHOLE stream (agent_end is the terminal frame) —
-    // proving only the stalled viewer was shed, while the fast one was unaffected.
-    await fast.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G8 fast viewer received the whole stream', 30_000);
-    assert.equal(isPidAlive(pid), true, 'G8: the broker survived the slow-viewer flood');
-    assert.equal(brokerPid(), pid, 'G8: broker pid unchanged (the engine was not back-pressured into a restart)');
-});

package/dist/core/__tests__/full/broker-deliver-ack.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/full/broker-deliver-ack.test.js

@@ -1,73 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-deliver-ack.test.ts
-//
-// Regression for the interactive `deliver` ack (broker.ts `case 'deliver'`):
-// the ack must report the ENGINE CALL's real outcome, not the fact that a call
-// was routed. A `session.prompt()` that REJECTS outright — the shape a broker
-// whose model resolved but whose provider has no installed credential produces
-// ("No API key found for anthropic") — used to still ack ok:true, so crtrd
-// returned `delivered:true, delivered_via:engine` for a message the engine had
-// refused, and the one-shot client closed before the error frame arrived: the
-// message vanished with no trace. Now the deliver ack races acceptance (the
-// engine's own agent_start) against rejection, acks ok:false on rejection, and
-// records `broker.prompt.deliver_failed` in the node's job/log.jsonl.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHeadlessHarness } from '../helpers/harness.js';
-import { createAttachKit, brokerLogText } from '../helpers/broker-clients.js';
-import { REJECT_PROMPT_CALL } from '../fixtures/fake-engine.js';
-let h;
-const kit = createAttachKit(() => h);
-// Fired lifecycle hooks land one line each in fake-pi.events.jsonl.
-function eventCount(id, name) {
-    try {
-        return readFileSync(join(h.home, 'nodes', id, 'fake-pi.events.jsonl'), 'utf8')
-            .split('\n')
-            .filter((l) => {
-            try {
-                return JSON.parse(l).event === name;
-            }
-            catch {
-                return false;
-            }
-        }).length;
-    }
-    catch {
-        return 0;
-    }
-}
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-deliver-ack' });
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-test('a deliver whose prompt rejects acks ok:false and records deliver_failed; a succeeding deliver still acks ok:true via prompt', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('deliver ack parent');
-    const child = await h.spawnHeadlessChild(parent, 'deliver ack child');
-    // Let the kickoff turn fully settle so both delivers route as `prompt`
-    // (idle), never `steer` — the steer route legitimately acks at routing time.
-    await h.waitFor(() => (eventCount(child, 'agent_end') >= 1 ? true : null), {
-        label: 'kickoff turn settled',
-    });
-    const ctrl = await kit.attach(child, 'controller', 'deliver-ack-test');
-    // FAILURE: the engine refuses the call itself. Before the fix this acked
-    // ok:true and the rejection left no trace in the node's log.
-    ctrl.send({ type: 'deliver', id: 'd-fail', text: `do a thing ${REJECT_PROMPT_CALL}` });
-    const failAck = await ctrl.waitFrame((f) => f.type === 'ack' && f.for === 'deliver' && f.id === 'd-fail', 'rejected deliver ack');
-    assert.equal(failAck.type === 'ack' && failAck.ok, false, 'a rejected prompt must not ack delivered:true');
-    assert.match((failAck.type === 'ack' ? failAck.detail : undefined) ?? '', /No API key found/, 'the ack detail carries the engine rejection');
-    await h.waitFor(() => (brokerLogText(h, child).includes('broker.prompt.deliver_failed') ? true : null), { label: 'broker.prompt.deliver_failed recorded in job/log.jsonl' });
-    // POSITIVE CONTROL: an ordinary deliver still acks ok:true from acceptance
-    // (the engine's agent_start), detail naming the prompt route.
-    ctrl.send({ type: 'deliver', id: 'd-ok', text: 'an ordinary interactive message' });
-    const okAck = await ctrl.waitFrame((f) => f.type === 'ack' && f.for === 'deliver' && f.id === 'd-ok', 'accepted deliver ack');
-    assert.equal(okAck.type === 'ack' && okAck.ok, true, 'an accepted prompt acks delivered:true');
-    assert.equal(okAck.type === 'ack' ? okAck.detail : undefined, 'prompt');
-    ctrl.close();
-});

package/dist/core/__tests__/full/broker-dialogs.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/full/broker-dialogs.test.js

@@ -1,180 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-dialogs.test.ts
-//
-// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
-// (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
-//
-// Broker dialog handling under MULTI-WRITER attachments — the T8 attach gates
-// G5/G5b/G6 cover fan-out + first-response settlement, mid-dialog attach replay,
-// and attended-dialog timeout behavior.
-//
-// 3-PART HEADER (headless):
-//  (1) CONTRACT — every client whose `hello` claimed the writable role is fanned a
-//      blocking dialog as extension_ui_request; the FIRST extension_ui_response
-//      settles it with that answer (not the default), every fanned client receives
-//      the correlated extension_ui_dismiss, and a later peer response for the same
-//      id is a silent no-op (G5). A dialog stays pending through a peer's detach and
-//      is handed to any writable client attaching mid-dialog via
-//      welcome.pending_dialog; observers never receive an answerable dialog (G5b).
-//      An attended dialog nobody answers resolves on the short per-dialog timeout
-//      with the default answer and a correlated dismiss to EVERY writable peer (G6).
-//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the dialog round-trip is an async
-//      promise inside makeBrokerUiContext, fanned out and answered over view.sock to
-//      the production ViewSocketClient. The real broker process provides the
-//      uiContext and timeout machinery without a tmux pane, window, or pi-session
-//      read.
-//  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the fake engine raises real
-//      confirm() dialogs through the broker, and the tests assert on the frames of
-//      several concurrently attached clients plus the value and latency recorded in
-//      fake-pi.dialog.jsonl.
-//
-// One shared broker is booted in before() and reused across all three gates. Because
-// fake-pi.dialog.jsonl is append-only across the shared broker, each gate snapshots
-// the count before it drives (`base`) and asserts on its newly appended entry. Role
-// is fixed by `hello` and never reassigned, so every writable attach is a plain
-// attach — there is no control handoff to wait out.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { createHeadlessHarness } from '../helpers/harness.js';
-import { isPidAlive } from '../../canvas/pid.js';
-import { createAttachKit } from '../helpers/broker-clients.js';
-let h;
-let id; // ONE shared broker, reused across G5/G5b/G6 (1 real boot, not 3)
-const kit = createAttachKit(() => h);
-const { attach, attachUntil } = kit;
-// Attach a writable client. Every `hello` claiming `controller` is admitted
-// writable — attaching a peer never demotes an already-attached one.
-const writer = async (cid) => {
-    const a = await attach(id, 'controller', cid);
-    assert.equal(a.welcome.role, 'controller', `${cid}: admitted writable, not demoted by an existing peer`);
-    return a;
-};
-const observer = async (cid) => {
-    const a = await attach(id, 'observer', cid);
-    assert.equal(a.welcome.role, 'observer', `${cid}: an observer hello stays read-only`);
-    return a;
-};
-// The broker handles one client's frames in order, so an `ack` for a get_commands
-// sent AFTER some other frame proves that earlier frame was already processed.
-// Used to make "a late peer answer changed nothing" a deterministic assertion
-// instead of a sleep.
-const barrier = async (c, label) => {
-    c.send({ type: 'get_commands' });
-    await c.waitFrame((f) => f.type === 'ack' && f.for === 'get_commands', label);
-};
-const isRequest = (f) => f.type === 'extension_ui_request';
-const dismissFor = (reqId) => (f) => f.type === 'extension_ui_dismiss' && f.id === reqId;
-// dialog.jsonl is append-only across the shared broker — snapshot the count, then
-// wait for AT LEAST `want` new entries and return the full (cumulative) array.
-const dialogCount = () => h.dialogResults(id).length;
-const awaitDialogs = (atLeast, label) => h.waitFor(() => (h.dialogResults(id).length >= atLeast ? h.dialogResults(id) : null), { label, timeoutMs: 15_000 });
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkdlg' });
-    const root = h.spawnRoot('broker-dialogs suite root');
-    id = await h.spawnHeadlessChild(root, 'headless worker — dialog gates');
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-const brokerPid = () => h.node(id).pi_pid;
-// ---------------------------------------------------------------------------
-// G5 — fan-out + first-response settlement. Guards: ONE blocking dialog reaches
-// EVERY writable client (never a single owner), the first answer unblocks the
-// engine with ITS value (not the default), every fanned client gets the correlated
-// extension_ui_dismiss, and a peer answering afterwards is a no-op. Failure modes:
-// a dialog only one viewer can see (the others sit blind), peers left holding an
-// overlay nothing can answer, or a late peer answer re-settling a dead dialog.
-// ---------------------------------------------------------------------------
-test('G5 — one dialog fans out to both writable clients, the first response settles it, both are dismissed, and a late peer response is a no-op', async () => {
-    const base = dialogCount();
-    const a = await writer('g5-A');
-    const b = await writer('g5-B');
-    const obs = await observer('g5-obs'); // must never be fanned an answerable dialog
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 20_000 }); // generous: a writable client answers first
-    const reqA = await a.waitFrame(isRequest, 'G5 dialog fanned out to writable A');
-    const reqB = await b.waitFrame(isRequest, 'G5 dialog fanned out to writable B');
-    const reqId = reqA.id;
-    assert.equal(reqB.id, reqId, 'G5: both writable clients were fanned the SAME dialog id, not two dialogs');
-    assert.equal(reqA.method, 'confirm', 'G5: the fanned dialog is the confirm() the engine raised');
-    // A answers first — the engine must proceed with A's true, not the false default.
-    a.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    await a.waitFrame(dismissFor(reqId), 'G5 answerer A receives the correlated dismiss');
-    await b.waitFrame(dismissFor(reqId), 'G5 peer B receives the correlated dismiss for the dialog it never answered');
-    const results = await awaitDialogs(base + 1, 'G5 dialog settled by the first response');
-    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the first answer (true), not the default (false)');
-    // The observer was attached the whole time: it saw the broadcast dismiss but was
-    // never handed the answerable request.
-    await obs.waitFrame(dismissFor(reqId), 'G5 observer sees the broadcast dismiss (ordering barrier)');
-    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5: an observer is never fanned an answerable dialog');
-    assert.equal(obs.welcome.pending_dialog, null, 'G5: an observer welcome never carries a pending dialog');
-    // B answers the already-settled dialog. The broker deleted the entry on the first
-    // response, so this finds nothing and is a silent no-op: no second engine
-    // resolution, and the recorded answer stays A's.
-    b.send({ type: 'extension_ui_response', id: reqId, confirmed: false });
-    await barrier(b, 'G5 broker processed B late response (ordered ack)');
-    const settled = h.dialogResults(id);
-    assert.equal(settled.length, base + 1, 'G5: the late peer response resolved nothing — no second dialog entry');
-    assert.equal(settled[base].resolved, true, "G5: the late peer response did not overwrite the first answerer's value");
-    assert.equal(isPidAlive(brokerPid()), true, 'G5: the late no-op response did not fault the broker');
-});
-// ---------------------------------------------------------------------------
-// G5b (mid-dialog attach) — Guards: a pending dialog survives a writable peer's
-// detach (M2) and is handed to a writable client that attaches MID-dialog via
-// welcome.pending_dialog, which makes it a full peer in the race to answer. An
-// observer attaching mid-dialog gets nothing answerable. Failure modes: a pending
-// dialog lost when the raising viewer detaches, a late-joining writable viewer
-// blind to an in-flight dialog, or an observer handed one it cannot answer.
-// ---------------------------------------------------------------------------
-test('G5b — a writable client attaching MID-dialog receives the pending dialog; an observer does not', async () => {
-    const base = dialogCount();
-    const a = await writer('g5b-A');
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // stays pending long enough for the late attach
-    const reqA = await a.waitFrame(isRequest, 'G5b dialog fanned out to writable A');
-    const reqId = reqA.id;
-    a.send({ type: 'bye' });
-    a.close(); // M2: a writable peer detaching does NOT cancel the pending dialog
-    // An observer attaching mid-dialog is never handed it.
-    const obs = await observer('g5b-obs');
-    assert.equal(obs.welcome.pending_dialog, null, 'G5b: an observer attaching mid-dialog gets no pending dialog');
-    // A writable client attaching mid-dialog IS handed it (retry covers the beat
-    // between the raise and this attach) and can settle it.
-    const b = await attachUntil(id, 'controller', 'g5b-B', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5b writable B attaches mid-dialog and is handed the pending dialog');
-    assert.equal(b.welcome.pending_dialog.id, reqId, 'G5b: welcome.pending_dialog is the same dialog raised while A was attached');
-    assert.equal(b.welcome.pending_dialog.method, 'confirm', 'G5b: the pending dialog is the confirm()');
-    b.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    const results = await awaitDialogs(base + 1, 'G5b dialog settled by the mid-dialog joiner');
-    assert.equal(results[base].resolved, true, 'G5b: the mid-dialog joiner answered and the engine proceeded');
-    await obs.waitFrame(dismissFor(reqId), 'G5b dismiss broadcast follows the settlement (ordering barrier)');
-    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5b: the observer was never fanned the dialog it saw dismissed');
-});
-// ---------------------------------------------------------------------------
-// G6 — anti-deadlock. An ATTENDED dialog NO writable client answers resolves on a
-// SHORT per-dialog broker timeout, and every fanned peer is dismissed by id.
-// Guards: the engine never hangs on a dialog whose viewers all stay silent.
-// Failure mode: a forever-blocked turn, or overlays left up on every viewer.
-// ---------------------------------------------------------------------------
-test('G6 — an attended dialog no writable client answers resolves on the broker timeout and dismisses every peer', async () => {
-    const pid = brokerPid();
-    const base = dialogCount();
-    // Two writable clients attached but silent → the broker resolves on the SHORT
-    // explicit per-dialog timeout (800ms), never the 120s default. On timeout it
-    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so
-    // EVERY peer's overlay (none has an independent timer) is torn down by id.
-    const a = await writer('g6-A');
-    const b = await writer('g6-B');
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 800 });
-    const reqA = await a.waitFrame(isRequest, 'G6 dialog fanned out to writable A'); // received, deliberately NOT answered
-    const reqB = await b.waitFrame(isRequest, 'G6 dialog fanned out to writable B'); // received, deliberately NOT answered
-    const reqId = reqA.id;
-    assert.equal(reqB.id, reqId, 'G6: both silent peers hold the SAME dialog id');
-    const dismissA = await a.waitFrame(dismissFor(reqId), 'G6 broker emits a correlated dismiss to A on timeout');
-    await b.waitFrame(dismissFor(reqId), 'G6 broker emits the same correlated dismiss to peer B');
-    assert.equal(dismissA.id, reqId, 'G6: the dismiss frame carries the timed-out dialog id, not another');
-    const results = await awaitDialogs(base + 1, 'G6 attended dialog resolved on timeout');
-    assert.equal(results[base].resolved, false, 'G6: a dialog no writable client answered resolves to the default (deny)');
-    assert.ok(results[base].ms >= 600 && results[base].ms < 5000, `G6: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${results[base].ms}ms`);
-    assert.equal(isPidAlive(pid), true, 'G6: the engine made forward progress (still alive)');
-});

package/dist/core/__tests__/full/broker-display-snapshot.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/full/broker-display-snapshot.test.js

@@ -1,75 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-display-snapshot.test.ts
-//
-// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
-// (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
-//
-// 3-PART HEADER (headless):
-//  (1) CONTRACT — catch-up is ONE atomic frame. `ctx.ui.setStatus/setWidget/
-//      setTitle` are LEVELS with no pi getter, so the broker is their only holder;
-//      it ships that held state as `welcome.snapshot.display` and sends NO
-//      `display_*` frames after the welcome. A late joiner therefore renders
-//      complete chrome on its FIRST paint.
-//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the retention lives in the real
-//      broker process (displayStatuses/displayWidgets/displayTitle, painted through
-//      the real makeBrokerUiContext relay) and the catch-up shape is a wire fact on
-//      view.sock. No tmux pane, window, or pi-session read is involved.
-//  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the fake engine paints through
-//      the broker's REAL uiContext with NO viewer attached (so nothing is observed
-//      live and only retention can carry it), then a viewer attaches and we assert
-//      on its welcome payload and on the ABSENCE of any post-welcome display frame.
-//
-// This is the regression guard for the pre-2026-07-24 shape, where `sendWelcome`
-// re-emitted N synthetic `display_*` edge frames after the snapshot: catch-up was
-// non-atomic, the viewer had to clear-and-rebuild (painting blank chrome in the
-// gap), and `applySnapshot(welcome) === fold(reduce, events)` was false by
-// construction. Deleting the replay without adding `snapshot.display` would drop
-// the chrome entirely; adding `snapshot.display` without deleting the replay would
-// leave catch-up non-atomic. Both halves fail this test.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { createHeadlessHarness } from '../helpers/harness.js';
-import { createAttachKit, delay } from '../helpers/broker-clients.js';
-let h;
-let id;
-const kit = createAttachKit(() => h);
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkdisp' });
-    const root = h.spawnRoot('broker-display-snapshot suite root');
-    id = await h.spawnHeadlessChild(root, 'headless worker — display catch-up');
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-/** The three display METHODS of pi's uniform `extension_ui_request` envelope. */
-const DISPLAY_METHODS = new Set(['setStatus', 'setWidget', 'setTitle']);
-const isDisplayFrame = (f) => f.type === 'extension_ui_request' && f.method !== undefined && DISPLAY_METHODS.has(f.method);
-test('retained extension display state rides IN welcome.snapshot.display — and no display edge follows', async () => {
-    // Paint with ZERO viewers attached: the only path from here to a viewer is the
-    // broker's retained last-value, so nothing about this test can pass by luck of
-    // having observed the live edge.
-    h.fakeCmd(id, { cmd: 'display', text: 'crtr-brief', reason: 'painted while detached' });
-    const a = await kit.attachUntil(id, 'observer', 'disp-late-joiner', (at) => at.welcome.snapshot.display?.statuses['crtr-brief'] !== undefined, 'welcome.snapshot.display carries the retained status');
-    const display = a.welcome.snapshot.display;
-    assert.equal(display.statuses['crtr-brief'], 'painted while detached', 'setStatus level survived in the snapshot');
-    assert.deepEqual(display.widgets['crtr-brief'], { lines: ['painted while detached'], placement: 'aboveEditor' }, 'setWidget level survived in the snapshot, placement included');
-    assert.equal(display.title, 'painted while detached', 'setTitle level survived in the snapshot');
-    // Atomicity: the welcome is COMPLETE. Give the broker a generous beat to emit a
-    // replay it must not emit, then assert nothing display-shaped arrived at all.
-    await delay(500);
-    assert.deepEqual(a.frames.filter((f) => isDisplayFrame(f)).map((f) => f.method), [], 'catch-up is the welcome alone — no synthetic display edges replayed after it');
-    // A LIVE paint still arrives as an edge frame: the snapshot replaces the replay,
-    // not the ongoing relay.
-    h.fakeCmd(id, { cmd: 'display', text: 'crtr-live', reason: 'painted while attached' });
-    const live = (await a.waitFrame((f) => f.type === 'extension_ui_request' && f.statusKey === 'crtr-live', 'a live setStatus still relays as an extension_ui_request edge'));
-    assert.equal(live.method, 'setStatus');
-    assert.equal(live.statusText, 'painted while attached');
-    // And a viewer attaching AFTER that sees the union of both keys in one frame.
-    const b = await kit.attachUntil(id, 'observer', 'disp-second-joiner', (at) => at.welcome.snapshot.display?.statuses['crtr-live'] !== undefined, 'the second welcome carries both retained keys');
-    const bDisplay = b.welcome.snapshot.display;
-    assert.equal(bDisplay.statuses['crtr-brief'], 'painted while detached');
-    assert.equal(bDisplay.statuses['crtr-live'], 'painted while attached');
-});

package/dist/core/__tests__/full/broker-dormant-wake.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/full/broker-dormant-wake.test.js

@@ -1,130 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-dormant-wake.test.ts
-//
-// Full-tier model-less broker coverage: a real model-less boot receives auth and
-// re-drives launch through the broker's login path.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { join } from 'node:path';
-import { readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { createHarness } from '../helpers/harness.js';
-import { createAttachKit } from '../helpers/broker-clients.js';
-let h;
-const kit = createAttachKit(() => h);
-const { attachUntil } = kit;
-before(async () => {
-    h = await createHarness({ headless: true, sessionPrefix: 'crtr-brkdorm' });
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-// The zero-auth test seam: while <CRTR_HOME>/fake-pi.no-auth exists, the fake
-// engine's modelRegistry reports a GENUINE zero-auth boot (nothing registered,
-// nothing authenticated). HOME-global (not per-node-dir) is deliberate — the
-// test arms it BEFORE spawning (race-free vs the broker's boot-time registry
-// read), and DELETING it mid-test flips auth ON, which a reload_auth
-// modelRegistry.refresh() re-reads live. See fake-engine.ts createAgentSessionServices.
-const noAuthSentinel = () => join(h.home, 'fake-pi.no-auth');
-// The node's recorded model (fake-pi.model.json, written by the fake's
-// recordModel) — `null` for a model-less boot. A disk read, so it survives the
-// broker exiting after its kickoff turn idle-releases.
-function model(id) {
-    return JSON.parse(readFileSync(join(h.home, 'nodes', id, 'fake-pi.model.json'), 'utf8'));
-}
-// Every fired lifecycle event lands in fake-pi.events.jsonl. A kickoff turn is a
-// session.prompt → emitTurn, which fires one 'agent_start'; counting them proves
-// whether the deferred kickoff ran. Also a disk read (survives broker exit).
-function agentStartCount(id) {
-    try {
-        return readFileSync(join(h.home, 'nodes', id, 'fake-pi.events.jsonl'), 'utf8')
-            .split('\n')
-            .filter((l) => {
-            try {
-                return JSON.parse(l).event === 'agent_start';
-            }
-            catch {
-                return false;
-            }
-        }).length;
-    }
-    catch {
-        return 0;
-    }
-}
-// ===========================================================================
-// REAL-BOOT (tsx source broker, fake engine). Tier-3 model-less launch + the
-// reload_auth re-drive that resolves a model once auth arrives. These lock the
-// two broker.ts launch-model fixes:
-//   0b (unknown-stub detection) — the real SDK gives a model-less session an
-//      unknown-stub model (never `undefined`); sessionHasNoModel() must treat it
-//      as no-model so the kickoff DEFERS instead of prompting a keyless engine.
-//   0a (self-healing model-less registry) — the construction-time mask that
-//      suppresses the SDK's own findInitialModel MUST reveal() the instant
-//      construction returns, or list_models/cycle_model stay broken forever for
-//      a model-less-booted node even after a /login resolves a model.
-// ===========================================================================
-// login/reload re-drive. Two proofs, ordered to dodge the kickoff-shutdown race:
-//   (0a self-heal, list_models) — the construction-time mask reveal()s the SAME
-//     retained proxy the instant construction returns, so getAvailable() passes
-//     through LIVE. We prove it by flipping auth ON and querying list_models
-//     BEFORE any reload_auth: the broker is still model-less-idle (no turn has
-//     run, so it hasn't idle-released) and definitely alive. With the persistent
-//     mask (reveal() removed) getAvailable()→[] forever, so availableIds stays []
-//     even after the flip — the ONLY assertion here that discriminates the bug.
-//   (re-drive) — reload_auth then re-runs the SAME launch policy against the
-//     now-authenticated registry: a model resolves and the deferred kickoff
-//     fires. Those are disk reads (fake-pi.model.json / .events.jsonl), so they
-//     hold even after the kickoff turn ends and the broker idle-releases — no
-//     dependence on the socket surviving.
-//
-// MODEL CHOICE — the child is pinned to `fake/fake-model`, a NON-managed provider
-// and this is deliberate. The
-// zero-auth sentinel gates the fake registry's find/getAll/getAvailable AND its
-// hasConfiguredAuth, so removing it is a genuine, LIVE auth-on flip for a
-// non-managed model: resolveLaunchModel authenticates a non-managed candidate off
-// hasConfiguredAuth(), which the sentinel controls. A MANAGED pin (anthropic)
-// instead authenticates off subscription-pool OCCUPANCY (readSubscriptionPool),
-// which the fake registry cannot express and which the test process cannot seed —
-// the pool file is `homedir()/.pi/agent/...` frozen at import, and the test
-// process keeps the REAL HOME while the broker runs under the harness's tmpHome,
-// so a seed would land in the wrong file (and pollute real user state). The
-// re-drive mechanism under test (reload_auth re-runs resolveLaunchModel → adopts
-// the model → fires the deferred kickoff) is provider-agnostic; the managed
-// subscription-pool auth path is out of this test's scope (covered by
-// broker-launch-candidates / broker-sdk-wiring). fake/fake-model is a faithful
-// analog: a node pinned to model X boots before X's auth exists, then X's auth
-// arrives and the re-drive resolves X.
-test('login re-drive → list_models self-heals (0a) and reload_auth resolves a model + fires the deferred kickoff', async () => {
-    writeFileSync(noAuthSentinel(), '1');
-    try {
-        const parent = h.spawnRoot('login re-drive parent');
-        const child = await h.spawnHeadlessChild(parent, 'login re-drive', { model: 'fake/fake-model' });
-        assert.equal(model(child), null, 'boots model-less under zero-auth');
-        assert.equal(agentStartCount(child), 0, 'kickoff deferred at boot');
-        const c = await attachUntil(child, 'controller', 'redrive-ctrl', (a) => a.welcome.role === 'controller', 'redrive controller admitted');
-        // A read-op reply is a correlated `data` frame the client swallows into
-        // request()'s by-id resolver (NEVER a generic 'frame'), so we MUST use
-        // client.request(), not send()+waitFrame.
-        // Baseline: under zero-auth the registry reports nothing available.
-        const lm0 = await c.client.request({ type: 'list_models' });
-        assert.ok(lm0.kind === 'list_models' && lm0.availableIds.length === 0, 'zero-auth: no models available');
-        // FLIP AUTH ON, then re-query while the broker is still alive (no turn has run
-        // yet). getAvailable() flows through the revealed construction proxy →
-        // NON-empty. With the mask never revealed it would still be [].
-        rmSync(noAuthSentinel(), { force: true });
-        const lm1 = await c.client.request({ type: 'list_models' });
-        assert.ok(lm1.kind === 'list_models' && lm1.availableIds.length > 0, 'auth on: list_models reports an available model (0a self-heal — the construction mask revealed)');
-        // reload_auth re-drives the launch policy → resolves a model and fires the
-        // deferred kickoff. Disk reads, so they survive the broker idle-releasing
-        // once that kickoff turn ends.
-        c.send({ type: 'reload_auth' });
-        await h.waitFor(() => model(child) !== null, { label: 're-drive selected a model' });
-        await h.waitFor(() => agentStartCount(child) >= 1, { label: 'deferred kickoff fired after re-drive' });
-    }
-    finally {
-        rmSync(noAuthSentinel(), { force: true });
-    }
-});

package/dist/core/__tests__/full/broker-model-changed-broadcast.test.d.ts

@@ -1 +0,0 @@
-export {};