@open-mercato/cezar 0.1.5-pr506.357

package/package.json

@@ -0,0 +1,90 @@
+{
+  "name": "@open-mercato/cezar",
+  "version": "0.1.5-pr506.357",
+  "description": "Local cockpit for running and tracking AI agent tasks in your repo. Uses your logged-in `claude` CLI and `gh` — zero config, zero database.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "cezar": "dist/index.js",
+    "cez": "dist/index.js",
+    "cezar-cli": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "web/open-mercato.svg",
+    "web/dist",
+    "scripts",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc && npm run build:web && npm run check:pack",
+    "build:web": "vite build --config web/app/vite.config.ts",
+    "check:pack": "node scripts/check-pack.mjs",
+    "dev": "node scripts/dev.mjs",
+    "install-as-command": "node scripts/install-as-command.mjs --mode link",
+    "install-as-command:global": "node scripts/install-as-command.mjs --mode global",
+    "uninstall-as-command": "node scripts/install-as-command.mjs --mode uninstall",
+    "dev:server": "tsx src/index.ts",
+    "server-install": "tsx src/index.ts server-install",
+    "server-deploy": "tsx src/index.ts server-deploy",
+    "server-uninstall": "tsx src/index.ts server-uninstall",
+    "dev:web": "vite --config web/app/vite.config.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:unit": "node --import tsx --test test/unit/*.test.ts",
+    "test:package": "node --import tsx --test test/e2e/*.test.ts",
+    "test:e2e": "sh .ai/scripts/e2e.sh",
+    "typecheck": "npm run typecheck:server && npm run typecheck:web",
+    "typecheck:server": "tsc --noEmit -p tsconfig.test.json",
+    "typecheck:web": "tsc --noEmit -p web/app/tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.11.0",
+    "@hono/node-server": "^1.13.0",
+    "hono": "^4.6.0",
+    "yaml": "^2.5.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@tailwindcss/vite": "^4.3.2",
+    "@tanstack/react-query": "^5.101.2",
+    "@testing-library/react": "^16.3.2",
+    "@types/node": "^20.14.0",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.3",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "jsdom": "^29.1.1",
+    "lucide-react": "^1.24.0",
+    "radix-ui": "^1.6.2",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "react-router": "^7.18.1",
+    "shiki": "^4.3.1",
+    "streamdown": "^2.5.0",
+    "tailwind-merge": "^3.6.0",
+    "tailwindcss": "^4.3.2",
+    "tsx": "^4.19.0",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "^5.6.0",
+    "virtua": "^0.49.3",
+    "vite": "^8.1.4",
+    "vitest": "^4.1.10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/open-mercato/cezar"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/check-pack.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// Tarball bundle check (`npm run check:pack`, last leg of `npm run build`):
+// fail loudly when the published package would ship without the built UI —
+// phase R1 of the cockpit redesign once published a tarball with no cockpit
+// in it, and this pins that bug class before every publish (prepublishOnly →
+// build → check:pack).
+//
+// Asks npm itself what it would pack (`npm pack --dry-run --json`) and hands
+// the file list to the pure, unit-tested decision in src/pack-check.ts.
+// Imports from dist/, so it must run AFTER `tsc` — `npm run build` orders
+// tsc → build:web → check:pack, which also guarantees web/dist exists in a
+// fresh checkout by the time the check looks for it.
+
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { findPackGaps } from '../dist/pack-check.js';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// Under `npm run`, npm_execpath is npm's own cli.js — running it through
+// process.execPath works on every platform (no .cmd shim needed on Windows).
+const npmExecpath = process.env.npm_execpath;
+const packArgs = ['pack', '--dry-run', '--json'];
+const npmCli = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+const stdout = npmExecpath
+  ? execFileSync(process.execPath, [npmExecpath, ...packArgs], { cwd: repoRoot, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+  : execFileSync(npmCli, packArgs, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, shell: process.platform === 'win32' });
+
+/** @type {{ files?: { path: string }[] }[]} */
+const reports = JSON.parse(stdout);
+const files = (reports[0]?.files ?? []).map((f) => f.path);
+if (files.length === 0) {
+  console.error('check:pack: `npm pack --dry-run --json` reported no files — refusing to publish an empty package');
+  process.exit(1);
+}
+
+const gaps = findPackGaps(files);
+if (gaps.length > 0) {
+  console.error('check:pack: the npm tarball would ship a broken cockpit:');
+  for (const gap of gaps) console.error(`  - ${gap}`);
+  process.exit(1);
+}
+
+const uiFiles = files.filter((f) => f.startsWith('web/dist/')).length;
+console.log(`check:pack ok — ${files.length} files, ${uiFiles} under web/dist (shell + assets present)`);

package/scripts/dev.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// One-command dev (`npm run dev`): boots the cockpit server (API) and the Vite
+// dev server together, then lets Vite open the browser once it's serving —
+// same "run one thing, get a working cockpit in the browser" flow the pre-Vite
+// UI had, now with HMR.
+//
+// The API port is probed here and pinned into BOTH processes (server via -p,
+// Vite proxy via CEZ_API_PORT — see web/app/vite.config.ts). Without that, a
+// cockpit already sitting on 4321 (another repo, an older npm install) would
+// silently answer the proxy with stale endpoints — 404s all over the UI.
+
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:net';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const canListen = (port) =>
+  new Promise((done) => {
+    const probe = createServer();
+    probe.once('error', () => done(false));
+    probe.once('listening', () => probe.close(() => done(true)));
+    probe.listen(port, '127.0.0.1');
+  });
+
+let apiPort = 4321;
+while (!(await canListen(apiPort))) apiPort++;
+if (apiPort !== 4321) console.log(`dev: port 4321 is taken (another cockpit?) — using ${apiPort}`);
+
+// Under `npm run`, npm_execpath is npm's own cli.js — running it through
+// process.execPath works on every platform (no .cmd shim needed on Windows).
+const npmExecpath = process.env.npm_execpath;
+const npmCli = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+const run = (script, extraArgs) => {
+  const args = ['run', script, '--', ...extraArgs];
+  const env = { ...process.env, CEZ_API_PORT: String(apiPort) };
+  return npmExecpath
+    ? spawn(process.execPath, [npmExecpath, ...args], { cwd: repoRoot, stdio: 'inherit', env })
+    : spawn(npmCli, args, { cwd: repoRoot, stdio: 'inherit', env, shell: process.platform === 'win32' });
+};
+
+const server = run('dev:server', ['--port', String(apiPort), '--no-open']);
+
+// Give the API a moment to answer before Vite opens the browser, so the first
+// paint has live data instead of proxy errors. Best-effort: on timeout Vite
+// starts anyway and the proxy recovers on reload.
+const deadline = Date.now() + 15_000;
+while (Date.now() < deadline) {
+  if (server.exitCode !== null) break; // server died — the exit handler below reports it
+  try {
+    const res = await fetch(`http://127.0.0.1:${apiPort}/api/health`);
+    if (res.ok) break;
+  } catch {
+    // not listening yet
+  }
+  await new Promise((r) => setTimeout(r, 250));
+}
+
+const web = server.exitCode === null ? run('dev:web', ['--open']) : null;
+
+// Either process dying takes the whole dev session down — a half-running
+// cockpit (UI without API, or API without UI) just looks broken.
+const children = [server, web].filter(Boolean);
+let shuttingDown = false;
+const shutdown = (code) => {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  for (const child of children) if (child.exitCode === null) child.kill('SIGTERM');
+  process.exitCode = code;
+};
+for (const child of children) child.on('exit', (code) => shutdown(code ?? 0));
+process.on('SIGINT', () => shutdown(0));
+process.on('SIGTERM', () => shutdown(0));

package/scripts/install-as-command.mjs

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+// `npm run install-as-command` (+ `:global` and the `uninstall-as-command`
+// counterpart): build this checkout and put a global `cezar`/`cez`/`cezar-cli`
+// command on PATH pointing at THIS working tree — the local-dev equivalent of
+// `npx cezar-cli`, with no publish and no `npx` download. Spec 013.
+//
+//   --mode link       build → `npm link`             (live; `npm run build` refreshes it)
+//   --mode global     build → `npm install --global .` (self-contained snapshot)
+//   --mode uninstall                  `npm rm --global @open-mercato/cezar`
+//   --no-build        skip the build (relink an already-built dist)
+//
+// The install decisions live in the unit-tested src/install-as-command.ts
+// (compiled to dist by the build); this script owns spawning + exit codes.
+// npm is invoked through process.execPath + npm_execpath — same cross-platform
+// pattern as scripts/dev.mjs / scripts/check-pack.mjs (no .cmd shim assumptions).
+
+import { spawnSync, execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const argv = process.argv.slice(2);
+
+const modeIdx = argv.indexOf('--mode');
+const mode = modeIdx >= 0 ? argv[modeIdx + 1] : 'link';
+const noBuild = argv.includes('--no-build');
+if (!['link', 'global', 'uninstall'].includes(mode)) {
+  console.error(`install-as-command: unknown --mode "${mode}" (expected link | global | uninstall)`);
+  process.exit(1);
+}
+
+// npm invocation shim (identical to dev.mjs / check-pack.mjs).
+const npmExecpath = process.env.npm_execpath;
+const npmCli = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+function npm(args, { capture = false } = {}) {
+  const viaNode = Boolean(npmExecpath);
+  const file = viaNode ? process.execPath : npmCli;
+  const full = viaNode ? [npmExecpath, ...args] : args;
+  const shell = !viaNode && process.platform === 'win32';
+  if (capture) {
+    return execFileSync(file, full, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, shell });
+  }
+  const res = spawnSync(file, full, { cwd: repoRoot, stdio: 'inherit', shell });
+  return res.status ?? 1;
+}
+
+const distDir = path.join(repoRoot, 'dist');
+const build = mode !== 'uninstall' && !noBuild;
+
+if (mode !== 'uninstall' && noBuild && !existsSync(path.join(distDir, 'index.js'))) {
+  console.error('install-as-command: --no-build was set but dist/ is missing — run once without --no-build first.');
+  process.exit(1);
+}
+
+if (build) {
+  console.log('install-as-command: building (npm run build)…');
+  const code = npm(['run', 'build']);
+  if (code !== 0) {
+    console.error('install-as-command: build failed — nothing installed.');
+    process.exit(code);
+  }
+}
+
+// Load the tested planner from dist. Present after any build; for uninstall on a
+// never-built checkout it may be absent, so fall back to the known command.
+let planner = null;
+const plannerPath = path.join(distDir, 'install-as-command.js');
+if (existsSync(plannerPath)) {
+  planner = await import(pathToFileURL(plannerPath).href);
+}
+const PACKAGE_NAME = planner?.PACKAGE_NAME ?? '@open-mercato/cezar';
+const steps = planner
+  ? planner.planInstall({ mode, build }).steps
+  : [{ args: ['rm', '--global', PACKAGE_NAME], label: `remove global ${PACKAGE_NAME}` }];
+
+for (const step of steps) {
+  console.log(`install-as-command: npm ${step.args.join(' ')} (${step.label})`);
+  const code = npm(step.args);
+  if (code !== 0) {
+    if (mode === 'uninstall') {
+      // Idempotent: `npm rm -g` of an absent package is a no-op success.
+      console.log('install-as-command: nothing to uninstall (already absent).');
+      break;
+    }
+    console.error(`install-as-command: \`npm ${step.args.join(' ')}\` failed (see npm output above).`);
+    console.error(
+      '  If this is an EACCES on a root-owned global prefix, set a user-writable one\n' +
+        '  (e.g. `npm config set prefix ~/.npm-global`) and retry — do NOT use sudo.',
+    );
+    process.exit(code);
+  }
+}
+
+if (mode === 'uninstall') {
+  console.log('install-as-command: global cezar / cez / cezar-cli removed.');
+  process.exit(0);
+}
+
+// Verify the shims and print a PATH hint.
+let prefix = '';
+try {
+  prefix = npm(['prefix', '--global'], { capture: true }).trim();
+} catch {
+  // best-effort — the install already succeeded above
+}
+if (planner && prefix) {
+  const binDir = planner.globalBinDir(prefix, process.platform);
+  const present = planner.globalShimPaths(prefix, process.platform).filter((p) => existsSync(p));
+  const names = planner.BIN_NAMES.join(', ');
+  if (present.length === planner.BIN_NAMES.length) {
+    console.log(`\ninstall-as-command: installed ${names} → ${binDir}`);
+  } else {
+    console.log(`\ninstall-as-command: done, but only ${present.length}/${planner.BIN_NAMES.length} shims found in ${binDir}`);
+  }
+  console.log(`  Ensure this is on your PATH:\n    ${binDir}`);
+  console.log('  Then, from any repo:  cezar --help');
+} else {
+  console.log('\ninstall-as-command: done. Ensure your npm global bin dir is on PATH, then run `cezar --help`.');
+}

package/scripts/mock-claude.mjs

@@ -0,0 +1,310 @@
+#!/usr/bin/env node
+// Mock `claude` binary for CEZ_DRY_RUN=1 — emits a plausible stream-json
+// session so the engine / store / GUI can be exercised without tokens.
+// Mirrors the real CLI's contract in SESSION mode: keeps reading {type:user}
+// NDJSON lines from stdin, answers each with a scripted turn (assistant
+// events + a terminal `result`), and exits when stdin closes (EOF).
+
+import { createInterface } from 'node:readline';
+import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const emit = (obj) => process.stdout.write(`${JSON.stringify(obj)}\n`);
+
+// Testability hook: CEZ_MOCK_ARGS_FILE=<path> appends the argv this mock was
+// spawned with (one JSON array per line), so tests and dry-run proofs can
+// assert exactly what reached the CLI (e.g. `--append-system-prompt …`).
+if (process.env.CEZ_MOCK_ARGS_FILE) {
+  try {
+    appendFileSync(process.env.CEZ_MOCK_ARGS_FILE, `${JSON.stringify(process.argv.slice(2))}\n`);
+  } catch {
+    // best effort — never break the mock over the hook
+  }
+}
+
+emit({ type: 'system', subtype: 'init' });
+
+let turn = 0;
+
+// A tiny generated PNG (320x200) standing in for a browser screenshot.
+const MOCK_SCREENSHOT_B64 =
+  'iVBORw0KGgoAAAANSUhEUgAAAUAAAADICAIAAAAWZq/8AAACMklEQVR42u3csQnAIBRFUQdJY+b4tfvP4AhCLKyyghAMMRw4Ezz/bU0RBdhUMgEIGBAwIGAQMCBgQMCAgEHAgIABAYOAAQEDAgYEDAIGBAwsCLhfDdiUgEHAgIABAYOAAQEDAgYEDAIGBAwIGAT8vlEr/ImAQcACBgELGAQsYAQsYBCwgEHAAgYBe3IELGAQsIBBwAJGwAIGAQsYBCxgELCAEbCAQcACBgELGAQMAhYwCFjAIGABI2D/QgMCBgEDAgYEDAgYBAwIGBAwCBgQMCBgQMAgYEDAgIBBwCYAAQMCBgQMAgYEDAgYEDAIGBAwIGAQMCBgQMCAgEHAgIABAQMCBgEDAgYEDAIGBAwIGBAwCBgQMCBgQMAgYEDAgIBBwICAAQEDAgYBAwIGBAwCtgIIGBAwIGAQMCBgQMCAgEHAgIABAYOAeejMB/McjIAFLGABW0HAAhYwmhSwgAUsYAQsYAELGAELWMACRsACFrCAEbCABSxgBCxgAQtYwAhYwAIWMAIWsIAFjIAFLGABI2ABC1jACFjAAhYwAhawgAWMgAUsYAEjYAELWMACRsACFrCAEbCABSxgBCxgAQsYAQtYwAJGwAIWMCBgQMAgYEDAgIBBwICAAQEDAgYBAwIGBAwCBgQMCBgQMAgYEDAgYEDAIGBAwICAQcCAgAEBAwIGAQMCBgQMCBgEDAgYEDAIGBAwIGBAwCBgQMCAgAEBg4ABAQMCBgEDAgYEDAgYBAx8xQ1bxBr9kelHqgAAAABJRU5ErkJggg==';
+
+
+// Spec 007: behave like an agent that read the handoff/todos instructions —
+// append a progress line to CEZ_HANDOFF_FILE and a follow-up entry to
+// CEZ_TODOS_FILE, so the inbox loop is testable without tokens.
+function writeHandoffAndTodo() {
+  try {
+    const handoff = process.env.CEZ_HANDOFF_FILE;
+    if (handoff) {
+      const text = readFileSync(handoff, 'utf8');
+      const line = `- ${new Date().toISOString()} — mock: implemented the change (dry run)\n`;
+      const marker = '## Progress log\n';
+      const idx = text.indexOf(marker);
+      const next =
+        idx >= 0
+          ? text.slice(0, idx + marker.length) + '\n' + line + text.slice(idx + marker.length).replace(/^\n+/, '')
+          : text + line;
+      writeFileSync(handoff, next, 'utf8');
+    }
+  } catch {
+    // best effort — the mock still answers without a handoff file
+  }
+  try {
+    const todosFile = process.env.CEZ_TODOS_FILE;
+    if (todosFile) {
+      let items = [];
+      try {
+        items = JSON.parse(readFileSync(todosFile, 'utf8'));
+      } catch {
+        items = []; // missing or broken file — start fresh, append-only
+      }
+      if (!Array.isArray(items)) items = [];
+      items.push({
+        ts: new Date().toISOString(),
+        taskId: process.env.CEZ_TASK_ID,
+        summary: 'Follow up: verify the mock change',
+        suggestedPrompt: 'Verify the change from the previous task',
+      });
+      writeFileSync(todosFile, JSON.stringify(items, null, 2), 'utf8');
+    }
+  } catch {
+    // best effort
+  }
+}
+
+async function respond(userText, imageCount) {
+  turn += 1;
+  await sleep(250);
+  // `mock:done` anywhere in the message → the reply ends with the CEZ:DONE
+  // completion marker (#347), so the auto-close path is testable dry.
+  const doneMarker = userText.includes('mock:done') ? '\n\nCEZ:DONE' : '';
+  // `mock:monitoring` → the reply ends with CEZ:MONITORING, the "still working
+  // on downstream work" marker (#490), so the monitoring-status path is testable dry.
+  const monitoringMarker = userText.includes('mock:monitoring') ? '\n\nCEZ:MONITORING' : '';
+
+  // `mock:slow` → hold the turn for ~25 s so queue states are observable.
+  if (userText.includes('mock:slow')) await sleep(25_000);
+
+  // `mock:md` → answer with a markdown-rich reply (#346 QA: tables, nested
+  // lists, emphasis, fences, quotes) instead of the scripted turn.
+  if (userText.includes('mock:md')) {
+    const md = [
+      '## Markdown fixture',
+      'This paragraph is soft-wrapped\nacross two source lines.',
+      '',
+      '| Column | Align | Result |',
+      '|:-------|:-----:|-------:|',
+      '| left `code` | *center* | **42** |',
+      '| ~~old~~ new | mid | $1.50 |',
+      '',
+      '- top item with *emphasis*',
+      '  - nested child with `code`',
+      '    - [x] deep done task',
+      '  - [ ] nested todo',
+      '- second top',
+      '',
+      '> quoted intro',
+      '> - quoted list item',
+      '',
+      '```ts',
+      'const answer: number = 42;',
+      '```',
+      'Literal guards: snake_case_name, 2*3 and <script>alert(1)</script>.',
+    ].join('\n');
+    emit({
+      type: 'assistant',
+      message: { role: 'assistant', content: [{ type: 'text', text: md }], usage: { input_tokens: 100, output_tokens: 200 } },
+    });
+    await sleep(100);
+    emit({ type: 'result', subtype: 'success', result: md, usage: { input_tokens: 100, output_tokens: 200 }, total_cost_usd: 0.001 });
+    return;
+  }
+
+  // Task auto-naming spec: a naming call (marked `[cez-namer]`) answers a
+  // deterministic short title + a PR classification of the sample number so
+  // dry-run tests can assert the full apply pipeline.
+  if (userText.includes('[cez-namer]')) {
+    const numbered = /(?:^|\D)(\d{1,7})(?:\D|$)/.exec(userText);
+    const name = JSON.stringify({
+      title: 'implementing cr fixes',
+      ...(numbered ? { pr: Number(numbered[1]) } : {}),
+    });
+    emit({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'text', text: name }],
+        usage: { input_tokens: 200, output_tokens: 30 },
+      },
+    });
+    await sleep(50);
+    emit({
+      type: 'result',
+      subtype: 'success',
+      result: name,
+      usage: { input_tokens: 200, output_tokens: 30 },
+      total_cost_usd: 0.0002,
+    });
+    return;
+  }
+
+  // Spec 008: a planning call (marked `[cez-planner]` in the user prompt)
+  // gets a canned chain plan. The `code-review` skill is deliberately made up:
+  // the planner's sanitizer strips unknown skills, and the step survives on
+  // its prompt — which is exactly the path worth exercising in dry runs.
+  if (userText.includes('[cez-planner]')) {
+    const plan = JSON.stringify({
+      steps: [
+        { name: 'Implement', prompt: '{{task}}' },
+        { name: 'Verify', command: 'npm test' },
+        { name: 'Review', skill: 'code-review', prompt: 'Review the changes for {{task}}' },
+      ],
+      rationale: 'Implement, verify with tests, then review.',
+    });
+    emit({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'text', text: plan }],
+        usage: { input_tokens: 500, output_tokens: 120 },
+      },
+    });
+    await sleep(100);
+    emit({
+      type: 'result',
+      subtype: 'success',
+      result: plan,
+      usage: { input_tokens: 500, output_tokens: 120 },
+      total_cost_usd: 0.0011,
+    });
+    return;
+  }
+
+  if (turn === 1) {
+    // Leave a visible trace in the cwd (the task worktree under spec 006) so
+    // the Diff view has something real to show in dry runs. Exactly one line
+    // per spawned session: tests read this file back as a per-step trace, so
+    // a multi-line prompt must not become multiple lines here.
+    try {
+      const head = userText.replace(/\s+/g, ' ').trim().slice(0, 400);
+      appendFileSync('notes.md', `mock notes — ${new Date().toISOString()}: ${head}\n`);
+    } catch {
+      // read-only cwd — the mock still works, just without a diff
+    }
+    writeHandoffAndTodo();
+    emit({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'text', text: `Okay — looking into: ${userText.slice(0, 120)}` }],
+        usage: { input_tokens: 850, output_tokens: 40 },
+      },
+    });
+    await sleep(300);
+    emit({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'tool_use', id: `toolu_mock_${turn}`, name: 'Bash', input: { command: 'git status --short' } }],
+        usage: { input_tokens: 120, output_tokens: 55 },
+      },
+    });
+    await sleep(300);
+    emit({
+      type: 'user',
+      message: {
+        role: 'user',
+        content: [{ type: 'tool_result', tool_use_id: `toolu_mock_${turn}`, content: ' M src/example.ts' }],
+      },
+    });
+    await sleep(200);
+    // Agent screenshot in a tool result — exercises the image pipeline
+    // (persist to <id>-images/, serve via /api/runs/:id/images/, zoomable
+    // card + lightbox in the transcript).
+    emit({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'tool_use', id: `toolu_mock_shot_${turn}`, name: 'Screenshot', input: { name: 'repro-login-redirect.png' } }],
+        usage: { input_tokens: 80, output_tokens: 30 },
+      },
+    });
+    await sleep(200);
+    emit({
+      type: 'user',
+      message: {
+        role: 'user',
+        content: [
+          {
+            type: 'tool_result',
+            tool_use_id: `toolu_mock_shot_${turn}`,
+            content: [
+              { type: 'text', text: 'Repro captured: after reload the session toast appears and you are back on /login.' },
+              { type: 'image', source: { type: 'base64', media_type: 'image/png', data: MOCK_SCREENSHOT_B64 } },
+            ],
+          },
+        ],
+      },
+    });
+    await sleep(300);
+    emit({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'text', text: `Done with the first pass — opened a draft PR: https://github.com/open-mercato/demo/pull/123. Anything to adjust? (dry-run mock)${doneMarker}${monitoringMarker}` }],
+        usage: { input_tokens: 300, output_tokens: 90 },
+      },
+    });
+    await sleep(150);
+    emit({
+      type: 'result',
+      subtype: 'success',
+      result: 'Done with the first pass (dry run).',
+      usage: { input_tokens: 1270, output_tokens: 185 },
+      total_cost_usd: 0.0342,
+    });
+    return;
+  }
+
+  const imgNote = imageCount > 0 ? ` I can see ${imageCount} image(s) you attached.` : '';
+  emit({
+    type: 'assistant',
+    message: {
+      role: 'assistant',
+      content: [{ type: 'text', text: `Follow-up #${turn - 1} received: "${userText.slice(0, 100)}".${imgNote} Applied (dry run).${doneMarker}${monitoringMarker}` }],
+      usage: { input_tokens: 200, output_tokens: 60 },
+    },
+  });
+  await sleep(150);
+  emit({
+    type: 'result',
+    subtype: 'success',
+    result: `Follow-up #${turn - 1} handled (dry run).`,
+    usage: { input_tokens: 200, output_tokens: 60 },
+    total_cost_usd: 0.0051,
+  });
+}
+
+const rl = createInterface({ input: process.stdin });
+let queue = Promise.resolve();
+rl.on('line', (line) => {
+  const trimmed = line.trim();
+  if (!trimmed) return;
+  let userText = '(unparseable message)';
+  let imageCount = 0;
+  try {
+    const msg = JSON.parse(trimmed);
+    const blocks = msg?.message?.content ?? [];
+    userText = blocks.filter((b) => b.type === 'text').map((b) => b.text).join('\n') || '(no text)';
+    imageCount = blocks.filter((b) => b.type === 'image').length;
+  } catch {
+    // keep placeholders
+  }
+  queue = queue.then(() => respond(userText, imageCount));
+});
+rl.on('close', () => {
+  // EOF = session over; finish any in-flight turn then exit cleanly.
+  queue.then(() => process.exit(0));
+});