@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/__tests__/stdout-errors.test.js

@@ -1,16 +0,0 @@
-import assert from 'node:assert/strict';
-import { PassThrough } from 'node:stream';
-import { test } from 'node:test';
-import { installStdoutErrorPolicy } from '../stdout-errors.js';
-test('stdout policy treats EPIPE as successful termination and rethrows other errors', async () => {
-    const stdout = new PassThrough();
-    const exits = [];
-    installStdoutErrorPolicy(stdout, ((code) => {
-        exits.push(code);
-        return undefined;
-    }));
-    stdout.emit('error', Object.assign(new Error('reader closed'), { code: 'EPIPE' }));
-    await new Promise((resolve) => setImmediate(resolve));
-    assert.deepEqual(exits, [0]);
-    assert.throws(() => stdout.emit('error', Object.assign(new Error('stdout failed'), { code: 'EIO' })), /stdout failed/);
-});

package/dist/core/__tests__/stop-guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/stop-guard.test.js

@@ -1,237 +0,0 @@
-// Run: node --import tsx/esm --test src/core/__tests__/stop-guard.test.ts
-//
-// The stop-guard keys "is this stop legitimate?" on the LIFECYCLE value, not on
-// parent/mode: a resident node is interactable and never forced to submit a
-// final, so it may go dormant regardless of whether it has a parent.
-import { test, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createNode, deliverAndSettleMessageWait, getNode, subscribe, setMessageWait, setStatus } from '../canvas/canvas.js';
-import { armCron, cancelCron, setCronState } from '../canvas/crons.js';
-import { closeDb, openDb, migrate } from '../canvas/db.js';
-import { hasLiveObligation } from '../../daemon/reconcilers/live-obligation.js';
-import { contextDir } from '../canvas/paths.js';
-import { bashJobPaths } from '../bash-jobs.js';
-import { evaluateStop } from '../runtime/stop-guard.js';
-import { writeOutputSchema } from '../runtime/structured-output.js';
-let home;
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: '/tmp/work',
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-const noSignals = { pushedFinal: false, requestedHumanReply: false };
-function arm(overrides) {
-    armCron({
-        name: overrides.cron_id,
-        created_by: null,
-        command: 'printf cron',
-        fire_at: new Date(Date.now() + 3_600_000).toISOString(),
-        recur: null,
-        tz: null,
-        expires_at: null,
-        anchor_node: null,
-        cancel_on_wake: false,
-        cwd: home,
-        env_json: null,
-        profile: null,
-        scope: 'profile',
-        run_timeout_s: 30,
-        overlap: 'skip',
-        on_output: 'always',
-        sink: '{}',
-        tier: 'normal',
-        ...overrides,
-    });
-}
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-stopguard-'));
-    process.env['CRTR_HOME'] = home;
-});
-beforeEach(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    migrate(openDb());
-});
-after(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-});
-test('a RESIDENT node is allowed to go dormant — even WITH a parent (keyed on lifecycle, not parent)', () => {
-    createNode(node('parent', { parent: null, lifecycle: 'resident' }));
-    // A resident sub-orchestrator with a parent and NOTHING live to await: under
-    // the old parent===null rule this would have stalled; now it goes dormant.
-    createNode(node('sub', { parent: 'parent', lifecycle: 'resident', mode: 'orchestrator' }));
-    const d = evaluateStop('sub', noSignals);
-    assert.deepEqual(d, { action: 'allow', reason: 'dormant' });
-});
-test('a resident ROOT (no parent) is allowed to go dormant', () => {
-    createNode(node('root', { parent: null, lifecycle: 'resident' }));
-    const d = evaluateStop('root', noSignals);
-    assert.deepEqual(d, { action: 'allow', reason: 'dormant' });
-});
-test('a TERMINAL node awaiting a live worker is "awaiting" (not stalled)', () => {
-    createNode(node('mgr', { parent: null, lifecycle: 'terminal', mode: 'orchestrator' }));
-    createNode(node('worker', { parent: 'mgr', lifecycle: 'terminal', status: 'active' }));
-    subscribe('mgr', 'worker', true); // active sub to a live publisher
-    const d = evaluateStop('mgr', noSignals);
-    assert.equal(d.action, 'allow');
-    assert.equal(d.reason, 'awaiting');
-});
-test('a TERMINAL node with nothing live to await and no final pushed is reprompted (stalled)', () => {
-    createNode(node('lonely', { parent: 'mgr', lifecycle: 'terminal' }));
-    const d = evaluateStop('lonely', noSignals);
-    assert.equal(d.action, 'reprompt');
-    assert.equal(d.reason, 'stalled');
-});
-test('a TERMINAL node awaiting a background bash job may dorm until its completion message', () => {
-    createNode(node('bashWait', { parent: 'mgr', lifecycle: 'terminal' }));
-    const paths = bashJobPaths(contextDir('bashWait'), `${Date.now()}-fixture`);
-    mkdirSync(paths.dir, { recursive: true });
-    writeFileSync(paths.cmdSh, 'long-running command');
-    writeFileSync(paths.jobLog, '');
-    writeFileSync(paths.jobBg, '');
-    assert.deepEqual(evaluateStop('bashWait', noSignals), { action: 'allow', reason: 'awaiting' });
-    writeFileSync(paths.jobExit, '0');
-    const completed = evaluateStop('bashWait', noSignals);
-    assert.equal(completed.action, 'reprompt');
-    assert.equal(completed.reason, 'stalled');
-});
-test('a pending node-sink cron wake releases terminal nodes and holds unattended nodes', () => {
-    createNode(node('target'));
-    const assertsWake = (id) => {
-        assert.deepEqual(evaluateStop('target', noSignals), { action: 'allow', reason: 'scheduled' }, id);
-        assert.equal(hasLiveObligation('target'), true, `${id} holds the unattended node`);
-    };
-    const assertsNoWake = (id) => {
-        assert.equal(evaluateStop('target', noSignals).action, 'reprompt', id);
-        assert.equal(hasLiveObligation('target'), false, `${id} does not hold the unattended node`);
-    };
-    arm({ cron_id: 'scheduled', anchor_node: 'target', sink: JSON.stringify({ node: 'target' }) });
-    assertsWake('an anchored scheduled always sink');
-    cancelCron('scheduled');
-    arm({ cron_id: 'running', anchor_node: 'target', sink: JSON.stringify({ node: 'target' }) });
-    openDb().prepare("UPDATE crons SET run_state = 'running' WHERE cron_id = ?").run('running');
-    setCronState('running', 'paused');
-    assertsWake('a paused in-flight sink');
-    cancelCron('running');
-    arm({ cron_id: 'unanchored-change', on_output: 'on-change', sink: JSON.stringify({ node: 'target' }) });
-    assertsWake('an unanchored on-change sink');
-    cancelCron('unanchored-change');
-    arm({ cron_id: 'other-target', sink: JSON.stringify({ node: 'other' }) });
-    assertsNoWake('a sink for another node');
-    cancelCron('other-target');
-    arm({ cron_id: 'silent', on_output: 'silent', sink: JSON.stringify({ node: 'target' }) });
-    assertsNoWake('a silent cron');
-    cancelCron('silent');
-    arm({ cron_id: 'on-failure', on_output: 'on-failure', sink: JSON.stringify({ node: 'target' }) });
-    assertsNoWake('an on-failure cron');
-    cancelCron('on-failure');
-    arm({ cron_id: 'expired', expires_at: new Date(Date.now() - 1_000).toISOString(), sink: JSON.stringify({ node: 'target' }) });
-    assertsNoWake('an expired idle cron');
-    cancelCron('expired');
-    arm({ cron_id: 'canceled', sink: JSON.stringify({ node: 'target' }) });
-    cancelCron('canceled');
-    assertsNoWake('a canceled cron');
-    arm({ cron_id: 'deadline', anchor_node: 'target', cancel_on_wake: true, on_output: 'on-failure' });
-    assertsWake('an active deadline');
-});
-test('only an explicit live controller wait permits dormancy; ancestry alone does not', () => {
-    createNode(node('parent', { lifecycle: 'terminal', status: 'active' }));
-    createNode(node('child', { parent: 'parent' }));
-    assert.equal(evaluateStop('child', noSignals).action, 'reprompt', 'a parent is not implicitly a wait');
-    setMessageWait('child', 'parent');
-    assert.deepEqual(evaluateStop('child', noSignals), { action: 'allow', reason: 'awaiting' });
-});
-test('a dead controller cannot suppress the stall guard', () => {
-    createNode(node('parent', { lifecycle: 'terminal', status: 'active' }));
-    createNode(node('child', { parent: 'parent', waiting_for: 'parent' }));
-    setStatus('parent', 'dead');
-    assert.equal(evaluateStop('child', noSignals).action, 'reprompt');
-});
-test('a delivery cannot clear a same-controller wait re-armed after its watermark', () => {
-    createNode(node('parent', { lifecycle: 'terminal', status: 'active' }));
-    createNode(node('child', { parent: 'parent' }));
-    setMessageWait('child', 'parent');
-    deliverAndSettleMessageWait('child', 'parent', () => {
-        setMessageWait('child', 'parent');
-    });
-    assert.equal(getNode('child')?.waiting_for, 'parent', 'the newer arm survives the older delivery');
-});
-test('delivery settlement joins an existing canvas transaction', () => {
-    createNode(node('parent', { lifecycle: 'terminal', status: 'active' }));
-    createNode(node('child', { parent: 'parent' }));
-    setMessageWait('child', 'parent');
-    const db = openDb();
-    db.exec('BEGIN IMMEDIATE');
-    try {
-        deliverAndSettleMessageWait('child', 'parent', () => undefined);
-        db.exec('COMMIT');
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* transaction was already closed */ }
-        throw err;
-    }
-    assert.equal(getNode('child')?.waiting_for ?? null, null, 'an outer lifecycle transaction can fan out a delivery');
-});
-test('a TERMINAL node whose only worker is dead is stalled (no LIVE subscription)', () => {
-    createNode(node('mgr', { parent: null, lifecycle: 'terminal' }));
-    createNode(node('worker', { parent: 'mgr', lifecycle: 'terminal' }));
-    subscribe('mgr', 'worker', true);
-    setStatus('worker', 'dead'); // publisher no longer live
-    const d = evaluateStop('mgr', noSignals);
-    assert.equal(d.action, 'reprompt');
-    assert.equal(d.reason, 'stalled');
-});
-test('pushedFinal → finished; requestedHumanReply → escalated (both short-circuit before lifecycle)', () => {
-    createNode(node('t', { parent: 'mgr', lifecycle: 'terminal' }));
-    assert.deepEqual(evaluateStop('t', { pushedFinal: true, requestedHumanReply: false }), { action: 'allow', reason: 'finished' });
-    assert.deepEqual(evaluateStop('t', { pushedFinal: false, requestedHumanReply: true }), { action: 'allow', reason: 'escalated' });
-});
-test('an active follow-up cycle with a canonical final is allowed without another final', () => {
-    createNode(node('followUp', {
-        parent: 'mgr',
-        lifecycle: 'terminal',
-        status: 'active',
-        final_report: '20260713T000000-final.md',
-        finalized_at: '2026-07-13T00:00:00.000Z',
-    }));
-    assert.deepEqual(evaluateStop('followUp', noSignals), { action: 'allow', reason: 'finished' });
-});
-test('pending one-off structured output still gates an active finalized follow-up', () => {
-    createNode(node('structuredFollowUp', {
-        parent: 'mgr',
-        lifecycle: 'terminal',
-        status: 'active',
-        final_report: '20260713T000000-final.md',
-        finalized_at: '2026-07-13T00:00:00.000Z',
-    }));
-    writeOutputSchema('structuredFollowUp', 'oneoff', { type: 'object' });
-    const decision = evaluateStop('structuredFollowUp', noSignals);
-    assert.equal(decision.action, 'reprompt');
-    assert.match(decision.action === 'reprompt' ? decision.message : '', /submit/);
-});
-test('already-terminal stored statuses are allowed without a stall reprompt', () => {
-    for (const [id, status] of [
-        ['doneNode', 'done'],
-        ['deadNode', 'dead'],
-        ['canceledNode', 'canceled'],
-    ]) {
-        createNode(node(id, { parent: 'mgr', lifecycle: 'terminal', status }));
-        assert.deepEqual(evaluateStop(id, noSignals), { action: 'allow', reason: 'finished' });
-    }
-});

package/dist/core/__tests__/stream-watchdog.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/stream-watchdog.test.js

@@ -1,154 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/stream-watchdog.test.ts
-//
-// Unit-level contract test for StreamWatchdog (see stream-watchdog.ts): a
-// single-timer dead-man's switch the broker pokes while a turn awaits the
-// provider (disarmed during tool execution) and clears at agent_end. This
-// locks the class's arm/clear/single-fire/token contract directly — no broker
-// or fake-engine harness needed (that integration surface is deliberately out
-// of scope; see
-// the roadmap's Fix 3 test-scope note).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { StreamWatchdog, KNOWN_STREAM_WAIT_UI, releaseKnownStreamWait, withKnownStreamWait } from '../runtime/stream-watchdog.js';
-const MS = 30;
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-test('poke() arms the watchdog, firing once after ms with no further poke', async () => {
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.poke(0);
-    assert.equal(calls, 0, 'must not fire before ms elapses');
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'must fire exactly once after ms with no further poke');
-});
-test('repeated pokes rearm the deadline from the LAST poke, not the first', async () => {
-    // A cancel-without-reschedule bug (clear the old timer but never arm a new
-    // one) would also "never fire while poked", so proving no-fire mid-stream is
-    // not enough. Prove the deadline actually REARMS: no fire around the original
-    // deadline, then exactly one fire measured from the FINAL poke.
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.poke(0);
-    // Re-poke well inside the window, several times, always resetting the clock.
-    // The last poke lands at ~t=2.5*MS, so the original t=MS deadline must pass
-    // with no fire.
-    for (let i = 0; i < 5; i++) {
-        await sleep(MS / 2);
-        wd.poke(0);
-    }
-    assert.equal(calls, 0, 'no fire around the original deadline — each poke rearmed it');
-    // From the final poke the timer must still be armed and fire exactly once.
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'exactly one fire, measured from the final poke — proves rearming');
-});
-test('clear() after poke prevents firing', async () => {
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.poke(0);
-    wd.clear();
-    await sleep(MS * 2);
-    assert.equal(calls, 0, 'a cleared watchdog must never fire');
-});
-test('fires exactly once even if left armed well past ms', async () => {
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.poke(0);
-    await sleep(MS * 5);
-    assert.equal(calls, 1, 'must fire only once, not repeatedly, past the deadline');
-});
-test('pause() disarms the timer AND makes poke() inert until resume()', async () => {
-    // A deliberate known-stream wait (a provider cooldown) relays no engine
-    // events, and any poke that IS relayed during it must not rearm the disarmed
-    // watchdog — otherwise the intentional silence would still trip a stall.
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.poke(0);
-    wd.pause();
-    await sleep(MS * 3);
-    assert.equal(calls, 0, 'pause() must cancel the pending fire');
-    wd.poke(0); // relayed mid-wait — must be inert while paused
-    await sleep(MS * 2);
-    assert.equal(calls, 0, 'poke() while paused must not rearm the watchdog');
-});
-test('resume() rearms after a pause and fires once on continued silence', async () => {
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.pause();
-    await sleep(MS * 2);
-    assert.equal(calls, 0, 'paused watchdog stays silent');
-    wd.resume(0);
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'resume() rearms; a still-silent stream fires exactly once');
-});
-test('reset() fully disarms AND unpauses so a later session is not stranded paused', async () => {
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.pause();
-    wd.reset();
-    // After reset the watchdog must behave like a fresh one: poke arms and fires.
-    wd.poke(0);
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'reset() clears the paused flag; poke arms normally afterward');
-});
-test('withKnownStreamWait holds the watchdog paused across the op, then rearms', async () => {
-    // The real broker seam: the provider extension reaches a broker-owned control
-    // (keyed by KNOWN_STREAM_WAIT_UI on the UI context) that pauses for the wait's
-    // duration and resumes after. During the wait the watchdog must not fire; once
-    // the wait releases and the stream is still silent, it fires exactly once.
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    const ui = {
-        [KNOWN_STREAM_WAIT_UI]: (_deadlineMs) => {
-            wd.pause();
-            return () => wd.resume(0);
-        },
-    };
-    wd.poke(0);
-    await withKnownStreamWait(ui, Date.now() + MS * 10, () => sleep(MS * 3));
-    assert.equal(calls, 0, 'no stall fires during the deliberate wait');
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'after release, the rearmed silent stream fires exactly once');
-});
-test('broker known-wait release resumes only a live provider stream and resets a finished or tool-bound turn', async () => {
-    let calls = 0;
-    const wd = new StreamWatchdog(() => calls++, MS);
-    wd.pause();
-    releaseKnownStreamWait(wd, 7, true, false);
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'a still-streaming tool-free turn resumes the watchdog');
-    wd.pause();
-    releaseKnownStreamWait(wd, 8, false, false);
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'a finished/rebound turn resets rather than arming a stale watchdog');
-    wd.pause();
-    releaseKnownStreamWait(wd, 9, true, true);
-    await sleep(MS * 2);
-    assert.equal(calls, 1, 'an active tool resets rather than watching legitimate tool silence');
-});
-test('withKnownStreamWait releases in finally when the waited operation throws', async () => {
-    let releases = 0;
-    const ui = {
-        [KNOWN_STREAM_WAIT_UI]: (_deadlineMs) => () => { releases++; },
-    };
-    await assert.rejects(withKnownStreamWait(ui, Date.now() + 1_000, async () => { throw new Error('wait failed'); }), /wait failed/);
-    assert.equal(releases, 1, 'the broker control releases exactly once on a rejected wait');
-});
-test('withKnownStreamWait runs op with a plain fallback when no broker control is present', async () => {
-    let ran = false;
-    await withKnownStreamWait(undefined, Date.now() + 1000, async () => {
-        ran = true;
-    });
-    assert.equal(ran, true, 'op must run even without a KNOWN_STREAM_WAIT_UI control');
-});
-test('onStall receives the token of the arm that fired (generation binding)', async () => {
-    // The broker stamps each poke with the current session generation and no-ops
-    // a stall whose token is stale. This pins that the token travels with the
-    // arm: a re-poke supersedes the prior token, so a fire after a rebind carries
-    // the NEW generation — and an old timer that somehow survived would deliver
-    // the OLD one, which the broker guard rejects.
-    const tokens = [];
-    const wd = new StreamWatchdog((token) => tokens.push(token), MS);
-    wd.poke(1);
-    wd.poke(2); // supersedes generation 1 before it can fire
-    await sleep(MS * 2);
-    assert.deepEqual(tokens, [2], 'exactly one fire, carrying the most-recent arm\'s token');
-});

package/dist/core/__tests__/subscription-pool-credential-guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/subscription-pool-credential-guard.test.js

@@ -1,95 +0,0 @@
-// Run with: npm test -- src/core/__tests__/subscription-pool-credential-guard.test.ts
-//
-// A stored credential may only leave the pool with its row (removal); a write that empties a
-// live account in place is refused. These pin the two ways such a write is attempted: a
-// token-less upsert under a recased label (labels resolve case-insensitively everywhere), and
-// an async writer whose provider returned an incomplete token set.
-import { before, test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
-const agentDir = mkdtempSync(join(tmpdir(), 'crtr-pool-guard-'));
-process.env['PI_CODING_AGENT_DIR'] = agentDir;
-// Imported dynamically so `PI_CODING_AGENT_DIR` is already set: the pool path is resolved per
-// access, but the import must not race the env write in any future refactor.
-let state;
-before(async () => {
-    initializeFreshScopedStore({ kind: 'provider', root: agentDir });
-    state = await import('../subscription-state.js');
-});
-async function seed() {
-    await state.writeSubscriptionPool('openai-codex', [
-        {
-            label: 'work',
-            refresh: 'refresh-live',
-            access: 'access-live',
-            expires: Date.now() + 60_000,
-            accountId: 'acct-1',
-            rateLimitedUntil: 0,
-            lastAttemptAt: 100,
-            lastRateLimitedAt: 50,
-        },
-    ]);
-}
-function stored() {
-    const pool = state.readSubscriptionPool('openai-codex');
-    assert.equal(pool.length, 1, 'the row itself must survive every refused write');
-    return pool[0];
-}
-test('a token-less upsert cannot empty a live row by recasing its label', async () => {
-    await seed();
-    await assert.rejects(() => state.upsertSubscription('openai-codex', {
-        label: 'Work',
-        rateLimitedUntil: 0,
-        lastAttemptAt: 200,
-        lastRateLimitedAt: 60,
-    }), /Refusing to persist incomplete OpenAI Codex subscription "Work"/);
-    assert.equal(stored().refresh, 'refresh-live');
-    assert.equal(stored().access, 'access-live');
-});
-test('a refresh that returns an incomplete token set leaves the stored credential intact', async () => {
-    await seed();
-    // Expired, so the exchange actually runs.
-    await state.writeSubscriptionPool('openai-codex', [{ ...stored(), expires: Date.now() - 1_000 }]);
-    await assert.rejects(() => state.refreshSubscriptionCredential('openai-codex', 'work', async () => ({
-        refresh: '',
-        access: 'access-rotated',
-        expires: Date.now() + 60_000,
-    })), /incomplete credential/);
-    assert.equal(stored().refresh, 'refresh-live', 'the previous credential must survive a refused refresh');
-    assert.equal(stored().access, 'access-live');
-});
-test('a managed login with an incomplete token pair is rejected without changing the pool', async () => {
-    await seed();
-    await assert.rejects(() => state.commitManagedLogin('openai-codex', 'fixture', {
-        refresh: '',
-        access: 'access-fixture',
-        expires: Date.now() + 60_000,
-        lastRateLimitedAt: 0,
-    }), /Refusing to persist incomplete OpenAI Codex subscription "fixture"/);
-    assert.equal(stored().refresh, 'refresh-live');
-    assert.equal(stored().access, 'access-live');
-});
-test('pi credential refresh marks an invalid account and continues with the next pool account', async () => {
-    const expired = Date.now() - 1_000;
-    await state.writeSubscriptionPool('anthropic', [
-        { label: 'personal', refresh: 'dead-refresh', access: 'dead-access', expires: expired, rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 },
-        { label: 'work', refresh: 'live-refresh', access: 'live-access', expires: expired, rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 },
-    ]);
-    const attempted = [];
-    const refreshed = await state.modifyElectedSubscription('anthropic', (pool) => pool.find((entry) => !entry.authFailure && entry.rateLimitedUntil <= Date.now()) ?? pool[0], async (entry) => {
-        attempted.push(entry.label);
-        if (entry.label === 'personal') {
-            throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-        }
-        return { refresh: 'rotated-refresh', access: 'rotated-access', expires: Date.now() + 60_000 };
-    });
-    assert.deepEqual(attempted, ['personal', 'work']);
-    assert.equal(refreshed?.label, 'work');
-    const pool = state.readSubscriptionPool('anthropic');
-    assert.equal(pool[0].authFailure, 'invalid_grant');
-    assert.ok(pool[0].rateLimitedUntil > Date.now());
-    assert.equal(pool[1].refresh, 'rotated-refresh');
-});

package/dist/core/__tests__/tmux-driver-boundary.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/tmux-driver-boundary.test.js

@@ -1,50 +0,0 @@
-// tmux-driver.ts owns the raw tmux process boundary — every direct
-// `spawnSync('tmux', ...)` elsewhere is a duplicated probe that should call
-// through tmux-driver.ts's exported primitives instead. This grep-enforces
-// that boundary with an explicit allowlist: the owner itself and three
-// pre-existing direct spawners with a genuinely distinct semantic (documented
-// per-entry below).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { readdirSync, readFileSync, statSync } from 'node:fs';
-import { join, resolve, relative } from 'node:path';
-const SRC_ROOT = resolve(process.cwd(), 'src');
-// Relative to src/, forward-slash form.
-const ALLOWLIST = new Set([
-    'core/runtime/tmux-driver.ts', // the owner
-    'clients/attach/session/mouse.ts', // mouse-mode detection — a distinct probe, not reachability
-    'core/clipboard-text.ts', // OSC-52 paste-buffer write — not a reachability probe
-    'core/termrender/display.ts', // pane-count probe — not a reachability probe
-]);
-function tsFilesUnder(dir) {
-    const out = [];
-    for (const entry of readdirSync(dir)) {
-        const path = join(dir, entry);
-        const stat = statSync(path);
-        if (stat.isDirectory()) {
-            if (entry === '__tests__')
-                continue;
-            out.push(...tsFilesUnder(path));
-        }
-        else if (entry.endsWith('.ts') && !entry.endsWith('.test.ts')) {
-            out.push(path);
-        }
-    }
-    return out;
-}
-test('every direct spawnSync("tmux", …) call site is inside the tmux-driver.ts allowlist', () => {
-    const offenders = [];
-    for (const file of tsFilesUnder(SRC_ROOT)) {
-        const relPath = relative(SRC_ROOT, file).split('\\').join('/');
-        if (ALLOWLIST.has(relPath))
-            continue;
-        const source = readFileSync(file, 'utf8');
-        const lines = source.split('\n');
-        lines.forEach((line, index) => {
-            if (/spawnSync\(\s*['"]tmux['"]/.test(line)) {
-                offenders.push(`${relPath}:${index + 1}`);
-            }
-        });
-    }
-    assert.deepEqual(offenders, [], `direct spawnSync('tmux', …) call(s) outside the tmux-driver.ts allowlist:\n${offenders.join('\n')}`);
-});

package/dist/core/__tests__/warm-claim-preference-snapshot.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/warm-claim-preference-snapshot.test.js

@@ -1,54 +0,0 @@
-// The warm-pool claim must leave a FROZEN preference snapshot behind.
-//
-// A spare boots with no claimant, so canvas-context-intro skips it and
-// canvas-doc-substrate's before_agent_start is the only other freezer — and Pi
-// emits that event on the typed-prompt path only. A claimed spare whose first
-// turn is a slash command (`sendMessage({ triggerTurn: true })`) therefore
-// reached the persona gate with no snapshot and died with "context preference
-// snapshot is missing". Claim time is where the snapshot is frozen.
-//
-// Run: node --import tsx/esm --test src/core/__tests__/warm-claim-preference-snapshot.test.ts
-import { test, before, beforeEach, after } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { closeDb, migrate, openDb } from '../canvas/db.js';
-import { resetScopeCache } from '../scope.js';
-import { closeScopedStores } from '../scoped-state/db.js';
-import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
-import { spawnNode } from '../runtime/nodes.js';
-import { deliverBearingsLive } from '../runtime/deliver-live.js';
-import { loadContextExposureState } from '../substrate/injected-store.js';
-let home;
-const previousHome = process.env['HOME'];
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-warm-snapshot-'));
-    process.env['HOME'] = home;
-    process.env['CRTR_HOME'] = join(home, 'canvas');
-});
-beforeEach(() => {
-    closeDb();
-    closeScopedStores();
-    rmSync(home, { recursive: true, force: true });
-    resetScopeCache();
-    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
-    migrate(openDb());
-});
-after(() => {
-    closeDb();
-    closeScopedStores();
-    rmSync(home, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-    if (previousHome === undefined)
-        delete process.env['HOME'];
-    else
-        process.env['HOME'] = previousHome;
-    resetScopeCache();
-});
-test('the claim path persists a frozen preference snapshot', async () => {
-    const meta = await spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
-    assert.equal(loadContextExposureState(meta.node_id).preferenceSnapshot, null, 'a spare mints with nothing frozen');
-    await deliverBearingsLive(meta.node_id);
-    assert.notEqual(loadContextExposureState(meta.node_id).preferenceSnapshot, null, 'claim freezes the snapshot the persona gate requires');
-});

package/dist/core/__tests__/worktree-landing.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/worktree-landing.test.js

@@ -1,11 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { parseStatusPorcelain, planLandIntoCheckout } from '../worktree-landing.js';
-test('parseStatusPorcelain separates tracked modifications, untracked files, and rename destinations', () => {
-    assert.deepEqual(parseStatusPorcelain(' M modified.txt\nM  staged.txt\nR  old-name.txt -> new-name.txt\n?? untracked.txt\n!! ignored.txt\n'), { tracked: ['modified.txt', 'staged.txt', 'new-name.txt'], untracked: ['untracked.txt'] });
-});
-test('planLandIntoCheckout selects direct landing, a tracked-change stash, or an untracked collision refusal', () => {
-    assert.deepEqual(planLandIntoCheckout({ tracked: ['local.txt'], untracked: ['scratch.txt'] }, ['incoming.txt']), { kind: 'direct' });
-    assert.deepEqual(planLandIntoCheckout({ tracked: ['local.txt'], untracked: ['scratch.txt'] }, ['local.txt']), { kind: 'stash', overlapping: ['local.txt'] });
-    assert.deepEqual(planLandIntoCheckout({ tracked: ['local.txt'], untracked: ['scratch.txt'] }, ['scratch.txt']), { kind: 'refuse', collisions: ['scratch.txt'] });
-});

package/dist/core/__tests__/yield-ensures-daemon.test.d.ts

@@ -1 +0,0 @@
-export {};