@north-light/crouter 0.3.302 → 0.3.304

package/dist/commands/__tests__/seam/daemon-status.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/seam/daemon-status.test.js

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import { spawn, spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+test('daemon status reports its failed probe without telling the operator to stop a live process', () => {
+    const home = mkdtempSync(join(tmpdir(), 'crtr-daemon-status-'));
+    const pidfile = join(home, 'crtrd.pid');
+    const owner = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1_000)'], { stdio: 'ignore' });
+    try {
+        assert.ok(owner.pid !== undefined, 'fixture process has a pid');
+        writeFileSync(pidfile, String(owner.pid));
+        const result = spawnSync(process.execPath, [join(process.cwd(), 'dist', 'cli.js'), '--json', 'sys', 'daemon', 'status'], {
+            encoding: 'utf8',
+            env: { ...process.env, CRTR_HOME: home, CRTR_PIDFILE: pidfile, CRTR_NO_DAEMON_AUTOSTART: '1' },
+            timeout: 10_000,
+        });
+        assert.equal(result.status, 0, result.stderr);
+        const output = JSON.parse(result.stdout);
+        assert.deepEqual({ running: output.running, serving: output.serving }, { running: true, serving: false });
+        assert.match(output.probe_error ?? '', /ENOENT|ECONNREFUSED/);
+        assert.equal(output.next, undefined, 'a single failed health probe is not a reason to tell the operator to stop the owner');
+    }
+    finally {
+        owner.kill('SIGKILL');
+        rmSync(home, { recursive: true, force: true });
+    }
+});

package/dist/commands/api-client.d.ts

@@ -38,9 +38,9 @@ export declare function readColdStartDiagnostic(): string | undefined;
  *  default: on a cold socket the injected `onColdSocket` hook fires
  *  `ensureDaemon()` (spawns crtrd detached via the branded host), then the
  *  client polls `/healthz` to a bounded deadline and retries once (the poll
- *  lives inside `CrtrClient`, A-2). If crtrd never becomes reachable — or
- *  autostart is disabled — the client throws `daemon_unavailable` (spec §7.1,
- *  §8). This is the ONLY CLI reference to `ensureDaemon`.
+ *  lives inside `CrtrClient`, A-2). If crtrd never becomes reachable, the
+ *  client surfaces the final observed transport failure. This is the ONLY CLI
+ *  reference to `ensureDaemon`.
  *
  *  `onColdSocket` is fire-and-forget — `ensureDaemon()` spawns crtrd and
  *  returns immediately, so the client's OWN `/healthz` poll is the only

package/dist/commands/api-client.js

@@ -104,9 +104,9 @@ export function readColdStartDiagnostic() {
  *  default: on a cold socket the injected `onColdSocket` hook fires
  *  `ensureDaemon()` (spawns crtrd detached via the branded host), then the
  *  client polls `/healthz` to a bounded deadline and retries once (the poll
- *  lives inside `CrtrClient`, A-2). If crtrd never becomes reachable — or
- *  autostart is disabled — the client throws `daemon_unavailable` (spec §7.1,
- *  §8). This is the ONLY CLI reference to `ensureDaemon`.
+ *  lives inside `CrtrClient`, A-2). If crtrd never becomes reachable, the
+ *  client surfaces the final observed transport failure. This is the ONLY CLI
+ *  reference to `ensureDaemon`.
  *
  *  `onColdSocket` is fire-and-forget — `ensureDaemon()` spawns crtrd and
  *  returns immediately, so the client's OWN `/healthz` poll is the only

package/dist/commands/memory/read.js

@@ -22,7 +22,8 @@ async function fetchSubject(nodeId) {
     if (nodeId === undefined)
         return null;
     try {
-        return await CrtrClient.forLocalSocket({ autostart: false }).nodeSubject(nodeId);
+        // This optional gate lookup must not hold a memory read while a daemon is unavailable: an absent subject simply skips gated docs.
+        return await CrtrClient.forLocalSocket({ autostart: false, coldStartPollWindowMs: 0 }).nodeSubject(nodeId);
     }
     catch {
         return null;

package/dist/commands/node/bash.js

@@ -117,7 +117,7 @@ const nodeBashKill = defineLeaf({
     tier: 'hidden',
     help: {
         name: 'node bash kill',
-        summary: 'terminate a background bash job’s process group and tell the owning node it was canceled',
+        summary: 'best-effort stop a background bash job and tell the owning node it was canceled',
         params: [
             { kind: 'positional', name: 'job', required: true, constraint: 'Job id, as reported by node bash list.' },
             { kind: 'flag', name: 'node', type: 'string', required: false, constraint: 'Node owning the job. Defaults to the node in --pane, else the caller (CRTR_NODE_ID).' },
@@ -125,11 +125,11 @@ const nodeBashKill = defineLeaf({
         ],
         output: [
             { name: 'node_id', type: 'string', required: true, constraint: 'The owning node.' },
-            { name: 'signaled', type: 'boolean', required: true, constraint: 'True when the process group was still alive and received SIGTERM.' },
+            { name: 'signaled', type: 'boolean', required: true, constraint: 'True when at least one observed supervisor-tree process received SIGTERM.' },
         ],
         outputKind: 'object',
         effects: [
-            'Sends SIGTERM (then SIGKILL) to the job’s whole process group, stopping the command and anything it forked.',
+            'Snapshots the supervisor’s observable process tree, sends SIGTERM then SIGKILL to those processes, and cannot stop a descendant that detached and reparented before the snapshot.',
             'Records the job’s exit so it stops showing as live, and sends the owning node an urgent inbox message saying the job was stopped — which steers that node mid-turn.',
         ],
     },
@@ -159,8 +159,8 @@ const nodeBashKill = defineLeaf({
         if (stopped.kind === 'not-stoppable') {
             throw new InputError({
                 error: 'not_stoppable',
-                message: `job ${jobId} recorded no process group`,
-                next: `It started before crtr persisted one. Stop it by hand, then it will disappear from the list. Log: ${paths.jobLog}`,
+                message: `job ${jobId} recorded no trusted process identity`,
+                next: `It started before crtr persisted its supervisor identity. Stop it by hand, then it will disappear from the list. Log: ${paths.jobLog}`,
             });
         }
         await cliClient().sendMessage(node.node_id, {
@@ -169,7 +169,7 @@ const nodeBashKill = defineLeaf({
         });
         return { node_id: node.node_id, signaled: stopped.signaled };
     },
-    render: (result) => `Canceled a background bash job for ${result['node_id']}${result['signaled'] === true ? '' : ' (its process group was already gone)'}.`,
+    render: (result) => `Canceled a background bash job for ${result['node_id']}${result['signaled'] === true ? '' : ' (no observed job process was still running)'}.`,
 });
 const nodeBashExtend = defineLeaf({
     name: 'extend',

package/dist/commands/node/message.js

@@ -38,7 +38,7 @@ async function resolveMsgTarget(input, hasBody) {
 }
 function messageOutput() {
     return [
-        { name: 'revived', type: 'boolean', required: false, constraint: 'True when the target was revived.' },
+        { name: 'revived', type: 'boolean', required: false, constraint: 'True when this request synchronously revived the target; ordinary durable delivery to an active or idle dormant target queues lifecycle revival instead.' },
         { name: 'guidance', type: 'string', required: true, constraint: 'Immediate action confirmation.' },
     ];
 }
@@ -67,7 +67,7 @@ function messageRequestParams() {
         { kind: 'stdin', name: 'body', required: false, constraint: 'Visible message body. The schema alone is a complete request.', positionalStdinConflict: missingMessageTargetForBody },
         { kind: 'flag', name: 'to', type: 'string', required: false, constraint: 'Target an existing node by id. Exactly one of --to or --self is required.' },
         { kind: 'flag', name: 'self', type: 'bool', required: false, constraint: 'Target the calling node. Exactly one of --to or --self is required.' },
-        { kind: 'flag', name: 'tier', type: 'enum', choices: ['critical', 'urgent', 'normal'], required: false, default: 'normal', constraint: 'Delivery urgency. Every accepted tier may revive a dormant target, because the request must be answered; deferred is rejected for that reason.' },
+        { kind: 'flag', name: 'tier', type: 'enum', choices: ['critical', 'urgent', 'normal'], required: false, default: 'normal', constraint: 'Delivery urgency. Every accepted tier queues lifecycle revival for an active or idle dormant target because the request must be answered; deferred is rejected for that reason.' },
         { kind: 'flag', name: 'output-schema', type: 'string', required: true, constraint: `JSON Schema the result must satisfy. ${OUTPUT_SCHEMA_TRANSPORT} The target answers with \`crtr push result\` (or declines with \`crtr push result --decline "<reason>" --code <token>\`), then keeps working. ${OUTPUT_SCHEMA_CONSTRAINTS}` },
         { kind: 'flag', name: 'situational-context', type: 'string', required: false, constraint: 'Non-empty hidden ambient context delivered beside the message, or alone.' },
         { kind: 'flag', name: 'reopen', type: 'bool', required: false, hidden: true, constraint: 'Clear a finalized target latch before delivery or fresh revive.' },
@@ -125,7 +125,7 @@ const nodeMessageSend = defineLeaf({
         params: messageSendParams(),
         output: messageOutput(),
         outputKind: 'object',
-        effects: ['Appends one inbox entry. Critical, urgent, and normal delivery may revive a dormant target; deferred waits for its next natural cycle.', '--reopen commits the target resident and clears any finalization latch before delivery, allowing it to take a new mandate; it is valid for live, parked, and finalized targets. Without it, a finalized target rejects delivery before an inbox entry is appended or a revive is attempted.'],
+        effects: ['Appends one inbox entry. Critical, urgent, and normal delivery queues lifecycle revival for an active or idle dormant target; deferred waits for its next natural cycle.', '--reopen commits the target resident and clears any finalization latch before delivery, allowing it to take a new mandate; it is valid for live, parked, and finalized targets. Without it, a finalized target rejects delivery before an inbox entry is appended or a revive is attempted.'],
     },
     run: (input) => runMessageEngine(input),
     render: (r) => String(r['guidance']),

package/dist/commands/sys/daemon.js

@@ -8,7 +8,7 @@
 // This subtree starts, checks, and stops the daemon process.
 import { defineLeaf, defineBranch } from '../../core/command.js';
 import { InputError } from '../../core/io.js';
-import { isDaemonServing, spawnDaemon, stopDaemonProcess, sweepStrayDaemons } from '../../daemon/manage.js';
+import { probeDaemonServing, spawnDaemon, stopDaemonProcess, sweepStrayDaemons } from '../../daemon/manage.js';
 import { isDaemonRunning, readPidfile, isPidAlive } from '../../daemon/pidfile.js';
 import { cliClient } from '../api-client.js';
 // daemon start
@@ -26,7 +26,7 @@ const daemonStart = defineLeaf({
             { name: 'existing_pid', type: 'number', required: false, constraint: 'PID of the already-running daemon (when started=false).' },
             { name: 'running', type: 'boolean', required: false, constraint: 'True only when a live pidfile owner does not serve its Unix API socket.' },
             { name: 'serving', type: 'boolean', required: false, constraint: 'False only when a live pidfile owner does not answer /healthz.' },
-            { name: 'next', type: 'string', required: false, constraint: 'Recovery instruction when running=true and serving=false.' },
+            { name: 'probe_error', type: 'string', required: false, constraint: 'The final /healthz probe failure when a live owner missed readiness.' },
         ],
         outputKind: 'object',
         effects: [
@@ -50,9 +50,9 @@ const daemonStatus = defineLeaf({
         params: [],
         output: [
             { name: 'running', type: 'boolean', required: true, constraint: 'True when the daemon pidfile owner is alive.' },
-            { name: 'serving', type: 'boolean', required: false, constraint: 'True when the live daemon answers /healthz; false when it does not.' },
+            { name: 'serving', type: 'boolean', required: false, constraint: 'True when the live daemon answers /healthz; false when one probe does not.' },
             { name: 'pid', type: 'number', required: false, constraint: 'PID of the running daemon.' },
-            { name: 'next', type: 'string', required: false, constraint: 'Recovery instruction when running=true and serving=false.' },
+            { name: 'probe_error', type: 'string', required: false, constraint: 'The failed /healthz observation when the live owner did not answer.' },
         ],
         outputKind: 'object',
         effects: ['Read-only: reads the pidfile, probes the pid, and requests /healthz without autostart.'],
@@ -62,15 +62,13 @@ const daemonStatus = defineLeaf({
         const running = pid !== null && isPidAlive(pid);
         if (!running)
             return { running: false };
-        const serving = await isDaemonServing();
-        return serving
-            ? { running: true, serving: true, pid }
-            : {
-                running: true,
-                serving: false,
-                pid,
-                next: 'Run `crtr sys daemon stop` to release the non-serving daemon before starting it again.',
-            };
+        try {
+            await probeDaemonServing();
+            return { running: true, serving: true, pid };
+        }
+        catch (error) {
+            return { running: true, serving: false, pid, probe_error: error.message };
+        }
     },
 });
 // daemon restart

package/dist/core/__tests__/bash-guard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/bash-guard.test.js

@@ -0,0 +1,190 @@
+// Run with: node --conditions=crtr-src --import tsx/esm --test src/core/__tests__/bash-guard.test.ts
+//
+// BUG REGRESSION: a node ran
+//   cd star-theory-2 && HOME="$(mktemp -d …)" godot …; rm -rf "$HOME" …
+// The `HOME=` prefix applied only to `godot`, so the trailing `rm -rf "$HOME"`
+// expanded to the real home directory and deleted for ~108s before another node
+// killed it. The guard refuses that command text before bash ever sees it.
+import assert from 'node:assert/strict';
+import { homedir, userInfo } from 'node:os';
+import { test } from 'node:test';
+import { bashCommandRefusal } from '../bash-guard.js';
+const HOME = homedir();
+const CWD = `${HOME}/Code/cli/crouter`;
+function refusal(command, cwd = CWD) {
+    return bashCommandRefusal(command, cwd);
+}
+function assertRefused(command, expectedTarget, cwd = CWD) {
+    const message = refusal(command, cwd);
+    assert.notEqual(message, null, `expected refusal for: ${command}`);
+    assert.ok(message.includes(expectedTarget), `refusal for ${command} should name ${expectedTarget}, got: ${message}`);
+}
+function assertAllowed(command, cwd = CWD) {
+    assert.equal(refusal(command, cwd), null, `expected to allow: ${command}`);
+}
+// The incident
+test('the incident command is refused and names the segment and resolved target', () => {
+    const command = 'cd star-theory-2 && HOME="$(mktemp -d /tmp/st2-legend-proof.XXXXXX)" godot --headless --path . ' +
+        '--script "$CRTR_CONTEXT_DIR/legend_proof.gd"; status=$?; rm -rf "$HOME" 2>/dev/null || true; exit $status';
+    const message = refusal(command);
+    assert.notEqual(message, null);
+    assert.ok(message.includes('rm -rf "$HOME"'), `should quote the offending segment: ${message}`);
+    assert.ok(message.includes(HOME), `should name the resolved target: ${message}`);
+});
+// Home, however it is spelled
+test('every textual spelling of the home directory is refused', () => {
+    for (const target of ['~', '~/', '"$HOME"', '$HOME', '${HOME}', '"${HOME}/"', HOME, `${HOME}/`, '~/*', '"$HOME"/*']) {
+        assertRefused(`rm -rf ${target}`, HOME);
+    }
+});
+// System roots
+test('system roots are refused', () => {
+    for (const target of ['/', '/Users', '/home', '/private', '/var', '/etc', '/tmp', '/usr', '/opt', '/System', '/Library', '/Applications', '/private/var']) {
+        assertRefused(`rm -rf ${target}`, target);
+    }
+});
+test('the canvas home is refused', () => {
+    assertRefused('rm -rf ~/.crouter', `${HOME}/.crouter`);
+});
+// Ancestors of the working directory
+test('a strict ancestor of the working directory is refused', () => {
+    assertRefused(`rm -rf ${HOME}/Code/cli`, `${HOME}/Code/cli`);
+    assertRefused('rm -rf ..', `${HOME}/Code/cli`);
+});
+test('a relative target is read against every directory the line could be in', () => {
+    assertRefused('cd packages && rm -rf ../..', `${HOME}/Code/cli`);
+    // The guard cannot know a `cd` succeeded: after a failed one bash stays put,
+    // so `..` really is the ancestor and the refusal must still fire.
+    assertRefused('cd definitely-does-not-exist; rm -rf ..', `${HOME}/Code/cli`);
+    // Nowhere knowable to resolve from, so nothing relative is refused.
+    assertAllowed('cd "$SOMEWHERE" && rm -rf ..');
+    assertRefused('cd "$SOMEWHERE" && rm -rf ~', HOME);
+});
+test('the working directory itself still removes — a node may delete its own merged worktree', () => {
+    const worktree = `${HOME}/.crouter/canvas/worktrees/node-1`;
+    assertAllowed('rm -rf .', worktree);
+    assertAllowed(`rm -rf ${worktree}`, worktree);
+});
+// Recursive flag spellings
+test('every recursive flag spelling is refused', () => {
+    for (const flags of ['-rf', '-fr', '-r', '-R', '-Rf', '-rvf', '--recursive -f', '-f --recursive', '-f -r', '-r --', '-rf --']) {
+        assertRefused(`rm ${flags} ~`, HOME);
+    }
+});
+test('a non-recursive rm is not this guard\u2019s business', () => {
+    assertAllowed('rm ~');
+    assertAllowed('rm -f ~/.zshrc');
+});
+// Prefixes that hide the verb
+test('a command prefix does not hide the rm', () => {
+    for (const prefix of ['sudo', 'sudo -E', 'command', 'nice -n 10', 'nohup', 'time', 'env', 'doas']) {
+        assertRefused(`${prefix} rm -rf ~`, HOME);
+    }
+});
+test('a leading VAR=value assignment does not hide the rm', () => {
+    assertRefused('FOO=bar rm -rf ~', HOME);
+});
+// The distinction the incident turned on: an `export` changes $HOME for the
+// rest of the line, a `HOME=… cmd` PREFIX changes it for that one command.
+test('a reassigned HOME is honoured for the rest of the line', () => {
+    assertAllowed('export HOME=/tmp/st2home_5e && rm -rf "$HOME"');
+    assertAllowed('export HOME=/tmp/st2home_5e\nfind "$HOME" -name settings.cfg -delete');
+    assertAllowed('cd star-theory-2 && export HOME=/tmp/x && rm -rf "$HOME" && mkdir -p "$HOME"');
+    assertAllowed('HOME=/tmp/x\nrm -rf ~');
+    // Reassigned to something the guard cannot read: unknowable, so allowed.
+    assertAllowed('export HOME="$(mktemp -d)"; rm -rf "$HOME"');
+});
+test('a HOME= prefix on one command does not carry to the next', () => {
+    assertRefused('HOME=/tmp/x godot --headless; rm -rf "$HOME"', HOME);
+});
+test('a HOME= prefix does apply to its own command', () => {
+    assertAllowed('HOME=/tmp/x rm -rf "$HOME"');
+});
+test('a backgrounded assignment runs in a subshell and does not carry', () => {
+    assertRefused('HOME=/tmp/x & rm -rf "$HOME"', HOME);
+    assertRefused('export HOME=/tmp/x & rm -rf "$HOME"', HOME);
+    assertAllowed('export HOME=/tmp/x && rm -rf "$HOME"');
+});
+test('an assignment to a builtin that exports it persists', () => {
+    assertAllowed('HOME=/tmp/x export HOME; rm -rf "$HOME"');
+});
+test('$USER and $LOGNAME expand — a per-user path spelled that way still resolves', () => {
+    // Anchored on the working directory rather than the home path, whose per-user
+    // segment is not the username on every platform this runs on.
+    const user = userInfo().username;
+    const parent = `/srv/people/${user}`;
+    assertRefused('rm -rf /srv/people/$USER', parent, `${parent}/project`);
+    assertRefused('rm -rf "/srv/people/${LOGNAME}"', parent, `${parent}/project`);
+});
+test('a redirection is not a target', () => {
+    assertAllowed('rm -rf ./dist 2>/dev/null');
+    assertAllowed('rm -rf ./dist > /dev/null 2>&1');
+    assertRefused('rm -rf ~ 2>/dev/null', HOME);
+});
+// Segment separators
+test('the rm is found in any shell segment', () => {
+    for (const command of ['ls && rm -rf ~', 'ls; rm -rf ~', 'ls || rm -rf ~', 'ls | rm -rf ~', 'ls &\nrm -rf ~']) {
+        assertRefused(command, HOME);
+    }
+});
+// Must still run
+test('ordinary removals still run', () => {
+    assertAllowed('rm -rf "$d"');
+    assertAllowed('rm -rf node_modules');
+    assertAllowed('rm -rf /tmp/foo.XXXX');
+    assertAllowed('rm -rf "$CRTR_CONTEXT_DIR/jobs/x"');
+    assertAllowed('rm -rf ~/Code/cli/crouter/dist');
+    assertAllowed('rm -rf ./dist .dist-build-*');
+    assertAllowed('rm -rf "$HOME/.cache/crouter/termrender"');
+    assertAllowed('rm -rf ~/.crouter/canvas/scratch/old');
+    assertAllowed('rm -rf /tmp/crtr-build.1234');
+});
+test('a quoted mention of a dangerous command is data, not a command', () => {
+    assertAllowed('echo "rm -rf ~"');
+    assertAllowed("git commit -m 'never rm -rf $HOME'");
+});
+test('a heredoc body is data, not a command', () => {
+    assertAllowed('cat > note.md <<\'EOF\'\nrm -rf ~\nEOF');
+});
+// Other operations that can destroy a home or system tree
+test('moving a protected path away is refused', () => {
+    assertRefused('mv ~ /tmp/old-home', HOME);
+    assertRefused('mv /etc /tmp/etc', '/etc');
+});
+test('a recursive permission or ownership change on a protected path is refused', () => {
+    assertRefused('chmod -R 777 /', '/');
+    assertRefused('sudo chown -R root ~', HOME);
+    assertRefused('chgrp -R staff /usr', '/usr');
+    assertAllowed('chmod -R 755 ./scripts');
+    assertAllowed('chmod 600 ~/.ssh/config');
+});
+test('a find that deletes or executes over a protected path is refused', () => {
+    assertRefused('find ~ -name "*.log" -delete', HOME);
+    assertRefused('find / -name core -exec rm -f {} \\;', '/');
+    assertAllowed('find ~ -name "*.log"');
+    assertAllowed('find . -name "*.log" -delete');
+});
+test('find’s leading global options do not hide its start path', () => {
+    assertRefused('find -H ~ -delete', HOME);
+    assertRefused('find -- ~ -delete', HOME);
+    assertRefused('find -L -x /etc -delete', '/etc');
+    assertRefused('find -f ~ -delete', HOME);
+    assertAllowed('find -H ./logs -delete');
+});
+test('writing a raw disk or reformatting one is refused', () => {
+    assertRefused('dd if=/dev/zero of=/dev/disk0 bs=1m', '/dev/disk0');
+    assertRefused('dd if=/dev/zero of=/dev/rdisk3 bs=1m', '/dev/rdisk3');
+    assertRefused('sudo mkfs.ext4 /dev/sda1', 'mkfs.ext4');
+    assertRefused('diskutil eraseDisk JHFS+ Blank /dev/disk2', 'diskutil eraseDisk');
+    assertAllowed('dd if=/dev/zero of=./blob bs=1m count=1');
+    // A character device is ordinary output, not a disk.
+    assertAllowed('dd if=/dev/zero of=/dev/null bs=1m count=1');
+    assertAllowed('dd if=./blob of=/dev/stdout');
+});
+// The long-sleep refusal moved here with the rest of the bash refusals.
+test('a long leading sleep is still refused, a short one still runs', () => {
+    assert.notEqual(refusal('sleep 300'), null);
+    assert.notEqual(refusal('sleep 5m'), null);
+    assert.equal(refusal('sleep 5'), null);
+    assert.equal(refusal('sleep "$n"'), null);
+});

package/dist/core/__tests__/broker-stream-watchdog-floor.test.js

@@ -23,8 +23,6 @@ function projectionFor(session, generation) {
         notifyTurnAccepted: () => undefined,
         emitStartupMilestone: () => undefined,
         formatModelSpec: () => null,
-        refreshIntent: async () => false,
-        onRefreshIntentError: () => undefined,
     });
 }
 test('agent_start arms the provider watchdog before another engine event arrives', (t) => {

package/dist/core/__tests__/daemon-boot.test.js

@@ -294,7 +294,7 @@ test('verifyDaemonStartup throws after its tiny startup window expires', async (
         sleepMs: (ms) => {
             now += ms;
         },
-    }), /did not become ready within 25ms/);
+    }), /has no live pidfile owner/);
 });
 // REGRESSION (bug #102): the verifier polls with a real async sleep, NOT a
 // synchronous Atomics.wait, so the event loop stays free to dispatch the spawned

package/dist/core/__tests__/fixtures/fake-engine.d.ts

@@ -148,6 +148,7 @@ declare class FakeSession {
     /** Compiled-seam graceful-teardown vehicle: a real active turn that only settles
      * after abort(), so the broker's bounded abort wait is observable. */
     private heldTurn;
+    private retryAbort;
     private readonly listeners;
     /** Idle watcher sends received while bindExtensions is still running. They
      * start naturally as soon as broker.ts subscribes, without a retry loop that
@@ -195,6 +196,9 @@ declare class FakeSession {
     };
     get isStreaming(): boolean;
     getSessionStats(): Record<string, unknown>;
+    getContextUsage(): {
+        tokens: number;
+    } | undefined;
     private syncTreeSnapshot;
     /** Reads the crashed process's last `fake-pi.tree.json` (if any) and rebuilds
      *  this process's tree from it. Best-effort: a first boot (no snapshot yet)
@@ -238,6 +242,7 @@ declare class FakeSession {
         deliverAs?: string;
     }): Promise<void>;
     abort(): Promise<void>;
+    abortRetry(): void;
     /** In-place tree rewind (broker `navigate_tree`). Mirrors the real SDK's
      *  contract: the session file is unchanged, the live history is truncated,
      *  and the navigated-to user message's text comes back as `editorText`. The
@@ -274,6 +279,7 @@ interface FakeModel {
     provider: string;
     id: string;
     api?: string;
+    contextWindow?: number;
 }
 /** The fake `ModelRuntime` — the runtime-method subset broker.ts's
  *  `registryOf` facade (and its model-less construction mask) actually reads. */

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -298,6 +298,7 @@ class FakeSession {
     /** Compiled-seam graceful-teardown vehicle: a real active turn that only settles
      * after abort(), so the broker's bounded abort wait is observable. */
     heldTurn;
+    retryAbort;
     // The broker's fan-out subscribers (broker.ts `session.subscribe(...)`) and the
     // accumulating message history the catch-up snapshot serializes (G3).
     listeners = new Set();
@@ -458,6 +459,15 @@ class FakeSession {
     getSessionStats() {
         return { messages: 0, tokens: 0 };
     }
+    getContextUsage() {
+        try {
+            const tokens = Number(readFileSync(join(this.dir, 'fake-pi.context-tokens'), 'utf8'));
+            return Number.isFinite(tokens) ? { tokens } : undefined;
+        }
+        catch {
+            return { tokens: 1000 };
+        }
+    }
     syncTreeSnapshot() {
         try {
             writeFileSync(join(this.dir, 'fake-pi.tree.json'), JSON.stringify({
@@ -571,6 +581,9 @@ class FakeSession {
         this.bashAbort?.abort();
         return this.bashRun ?? Promise.resolve();
     }
+    abortRetry() {
+        this.retryAbort?.();
+    }
     /** In-place tree rewind (broker `navigate_tree`). Mirrors the real SDK's
      *  contract: the session file is unchanged, the live history is truncated,
      *  and the navigated-to user message's text comes back as `editorText`. The
@@ -938,7 +951,7 @@ class FakeSession {
                 getBranch: () => this.tree.getBranch(),
                 getEntries: () => this.tree.getEntries(),
             },
-            getContextUsage: () => ({ tokens: 1000 }),
+            getContextUsage: () => this.getContextUsage(),
             // Wired to the broker's shutdownHandler: the stophook calls ctx.shutdown()
             // in exactly its done / idle-release / refresh branches → disposeAndExit.
             shutdown: () => {
@@ -1068,8 +1081,9 @@ class FakeSession {
                 this.emit({ type: 'agent_settled' });
                 break;
             case 'stop': {
-                // Match pi's lifecycle: the stophook sees agent_end while the run is
-                // active, then the subscriber receives agent_settled after it clears.
+                // Match pi's lifecycle: message_end reaches broker fallback policy
+                // before the stophook sees agent_end while the run is active; the
+                // subscriber receives agent_settled after it clears.
                 this.streaming = true;
                 const stopMessages = [
                     {
@@ -1097,6 +1111,7 @@ class FakeSession {
                         content: [{ type: 'text', text: cmd.text ?? '' }],
                     },
                 ];
+                this.emit({ type: 'message_end', message: stopMessages[0] });
                 await this.fire('agent_end', { messages: stopMessages }, ctx);
                 // Every attempt reaches the broker subscriber while streaming; only the
                 // following settled event may publish its fault or arm a retry timer.
@@ -1174,16 +1189,29 @@ class FakeSession {
                 writeFileSync(join(this.dir, 'fake-pi.overflow.json'), JSON.stringify({ outcome: cmd.outcome ?? 'uncompacted' }));
                 break;
             }
-            case 'auto_retry':
-                // Drive the exact broker subscription event that pi emits before its
-                // retry timer, so provider fallback policy runs in the live broker.
+            case 'auto_retry': {
+                // Pi emits agent_end for the failed attempt, then auto_retry_start, and
+                // only then creates the AbortController for its delay. The capacity
+                // fallback must defer abortRetry one microtask to cancel this retry.
+                const retryMessages = [{
+                        role: 'assistant', stopReason: 'error', errorMessage: cmd.errorMessage ?? 'rate limit exceeded', content: [],
+                    }];
+                this.streaming = true;
+                await this.fire('agent_end', { messages: retryMessages }, ctx);
+                this.emit({ type: 'agent_end', messages: retryMessages, willRetry: true });
                 this.emit({ type: 'auto_retry_start', errorMessage: cmd.errorMessage ?? 'rate limit exceeded' });
-                // The broker begins its fallback async; the next check phase follows
-                // its resolved registry/setModel microtasks and is a deterministic
-                // receipt for a rejected target (which intentionally never changes model).
+                let aborted = false;
+                this.retryAbort = () => { aborted = true; };
                 await new Promise((resolve) => setImmediate(resolve));
-                writeFileSync(join(this.dir, 'fake-pi.auto-retry.json'), JSON.stringify({ at: Date.now() }));
+                this.retryAbort = undefined;
+                if (aborted)
+                    this.emit({ type: 'auto_retry_end', success: false, finalError: 'Retry cancelled' });
+                this.streaming = false;
+                await this.fire('agent_settled', { type: 'agent_settled' }, ctx);
+                this.emit({ type: 'agent_settled' });
+                writeFileSync(join(this.dir, 'fake-pi.auto-retry.json'), JSON.stringify({ at: Date.now(), aborted }));
                 break;
+            }
             case 'display':
                 // Paint through the broker's REAL uiContext exactly as an extension does.
                 // These are LEVELS with no pi getter, so the broker is their only holder
@@ -1221,6 +1249,18 @@ class FakeSession {
         }
     }
 }
+function fakeModel(provider, id) {
+    try {
+        const capacities = JSON.parse(readFileSync(join(nodeDirFromEnv(), 'fake-pi.model-capacities.json'), 'utf8'));
+        const contextWindow = capacities[`${provider}/${id}`];
+        return typeof contextWindow === 'number' && Number.isFinite(contextWindow)
+            ? { provider, id, contextWindow }
+            : { provider, id };
+    }
+    catch {
+        return { provider, id };
+    }
+}
 /** The real pi SDK's model-less sentinel (Agent.DEFAULT_MODEL). The fake mirrors
  *  it so `session.model` is NEVER literally `undefined` after a model-less boot,
  *  matching prod — see the FakeSession constructor. */
@@ -1292,7 +1332,7 @@ export async function createAgentSessionServices(options) {
             // A minimal model stub for any spec — the set_model regression test drives
             // the broker's findModelSpec → session.setModel path through it. Nothing is
             // findable during a zero-auth window.
-            getModel: (provider, id) => (zeroAuth() ? undefined : { provider, id }),
+            getModel: (provider, id) => (zeroAuth() ? undefined : fakeModel(provider, id)),
             // Always-authenticated single fake model — the M-9 no-boot-model branch
             // (broker.ts) picks `available[0]` and must never see an empty list here —
             // EXCEPT during a zero-auth window, when nothing is available/registered.

package/dist/core/__tests__/helpers/harness.d.ts

@@ -101,6 +101,8 @@ export interface Harness {
     inbox(nodeId: string): InboxEntry[];
     injected(nodeId: string): Injected[];
     fakeCmd(nodeId: string, cmd: Record<string, unknown>): void;
+    /** Stop only this harness's API server to exercise a broker daemon-read failure. */
+    stopApiServer(): Promise<void>;
     dialogResults(nodeId: string): {
         resolved: unknown;
         ms: number;

package/dist/core/__tests__/helpers/harness.js

@@ -637,6 +637,15 @@ export async function createHarness(opts = {}) {
         fakeCmd(nodeId, cmd) {
             sendCmd(nodeId, cmd);
         },
+        async stopApiServer() {
+            try {
+                apiServerProc.kill('SIGTERM');
+            }
+            catch {
+                /* already gone */
+            }
+            await waitFor(() => apiServerProc.exitCode === null ? null : true, { label: 'harness API server exit' });
+        },
         dialogResults(nodeId) {
             return readLines(join(nodeDir(nodeId), 'fake-pi.dialog.jsonl'))
                 .map((l) => {