@selesai/code 0.13.0 → 0.13.2

package/dist/extensions/pi-subagents/test/integration/async-job-tracker.test.ts

@@ -156,6 +156,40 @@ describe("async job tracker", { skip: !available ? "pi packages not available" :
 		}
 	});
 
+	it("clears stale cached contexts before a status refresh can leak the error", async () => {
+		const asyncRoot = createTempDir("pi-async-job-tracker-stale-refresh-");
+		try {
+			const runDir = path.join(asyncRoot, "run-stale-refresh");
+			fs.mkdirSync(runDir, { recursive: true });
+			fs.writeFileSync(path.join(runDir, "status.json"), JSON.stringify({
+				runId: "run-stale-refresh",
+				mode: "single",
+				state: "running",
+				startedAt: Date.now(),
+				lastUpdate: Date.now(),
+				steps: [{ agent: "worker", status: "running" }],
+			}), "utf-8");
+
+			const state = createState();
+			const recorder = createEventRecorder();
+			const tracker = createTracker(recorder.pi, state as never, asyncRoot, {
+				pollIntervalMs: 10,
+				watch: (() => { throw new Error("watch disabled"); }) as never,
+			});
+			tracker.handleStarted({ id: "run-stale-refresh", asyncDir: runDir, agent: "worker" });
+			(state as { lastUiContext: unknown }).lastUiContext = {
+				get hasUI() {
+					throw new Error("This extension ctx is stale after session replacement or reload.");
+				},
+			};
+
+			await waitForCondition(() => state.lastUiContext === null, "stale cached context to clear during status refresh");
+			assert.equal(state.asyncJobs.get("run-stale-refresh")?.status, "running");
+		} finally {
+			removeTempDir(asyncRoot);
+		}
+	});
+
 	it("stores only parent-registered session roots from async start events", () => {
 		const asyncRoot = createTempDir("pi-async-job-tracker-session-root-");
 		try {

package/dist/extensions/pi-subagents/test/integration/async-status.test.ts

@@ -37,7 +37,7 @@ describe("async status helpers", () => {
 				outputFile,
 				steps: [
 					{ agent: "scout", status: "complete", durationMs: 10, description: "Inspect auth only" },
-					{ agent: "worker", status: "running", durationMs: 20, description: "Patch billing only" },
+					{ agent: "worker", status: "running", durationMs: 20, description: "Patch billing only", contextLimit: 128_000, toolBudgetBlocked: true, watchdog: { phase: "stale", seq: 2, lastUpdate: 200, followUpPending: false } },
 				],
 			});
 			const descriptor = createRunFanoutBudget("run-a", 64);
@@ -62,6 +62,9 @@ describe("async status helpers", () => {
 			assert.equal(runs[0]?.steps[1]?.status, "running");
 			assert.equal(runs[0]?.steps[0]?.description, "Inspect auth only");
 			assert.equal(runs[0]?.steps[1]?.description, "Patch billing only");
+			assert.equal(runs[0]?.steps[1]?.contextLimit, 128_000);
+			assert.equal(runs[0]?.steps[1]?.toolBudgetBlocked, true);
+			assert.equal(runs[0]?.steps[1]?.watchdog?.phase, "stale");
 			const text = formatAsyncRunList(runs);
 			assert.match(text, /Run fan-out: 3\/64 used, 61 remaining/);
 			assert.match(text, /output: .*output-1\.log/);
@@ -70,6 +73,150 @@ describe("async status helpers", () => {
 			if (budgetDirectory) fs.rmSync(budgetDirectory, { recursive: true, force: true });
 		}
 	});
+	it("loads typed host monitor nodes from workflow status without child identity", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-async-host-step-"));
+		try {
+			createAsyncDir(root, "workflow-host", {
+				runId: "workflow-host",
+				mode: "workflow",
+				state: "running",
+				startedAt: 100,
+				lastUpdate: 200,
+				steps: [{ agent: "reviewer", workflowKey: "review", runId: "child-review", status: "running" }],
+				workflowGraph: {
+					runId: "workflow-host",
+					mode: "workflow",
+					phases: [],
+					nodes: [{
+						id: "ci-check",
+						kind: "host-step",
+						label: "CI",
+						status: "completed",
+						hostStep: {
+							version: 1,
+							kind: "host-step",
+							monitorKind: "ci",
+							id: "ci-check",
+							label: "CI",
+							provider: "local-tests",
+							state: "running",
+							detail: "waiting for checks",
+							updatedAt: 150,
+						},
+					}],
+				},
+			});
+
+			const runs = listAsyncRuns(root, { states: ["running"], reconcile: false });
+			assert.equal(runs[0]?.hostSteps?.[0]?.kind, "host-step");
+			assert.equal(runs[0]?.steps[0]?.workflowKey, "review");
+			assert.match(formatAsyncRunList(runs), /host ci: CI \| running \| provider:local-tests \| waiting for checks/);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
+	it("fails closed when a persisted host monitor node is malformed", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-async-host-step-invalid-"));
+		try {
+			createAsyncDir(root, "workflow-host-invalid", {
+				runId: "workflow-host-invalid",
+				mode: "workflow",
+				state: "running",
+				startedAt: 100,
+				workflowGraph: {
+					runId: "workflow-host-invalid",
+					mode: "workflow",
+					phases: [],
+					nodes: [{ id: "bad", kind: "host-step", label: "bad", status: "running" }],
+				},
+			});
+			assert.throws(() => listAsyncRuns(root, { states: ["running"], reconcile: false }), /host step.*expected an object/);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+	it("projects bounded lane and display-only worktree metadata from status", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-async-status-lane-"));
+		try {
+			createAsyncDir(root, "run-lane", {
+				runId: "run-lane",
+				mode: "workflow",
+				state: "running",
+				startedAt: 100,
+				lastUpdate: 200,
+				steps: [{
+					agent: "worker",
+					workflowKey: "writer",
+					lane: { version: 1, key: "writer", mode: "mutation", sourceRef: "owner/repo#1621" },
+					worktreePath: "/tmp/worktrees/run-lane-0",
+					branch: "pi-subagent/run-lane-0",
+					status: "running",
+				}],
+			});
+			const run = listAsyncRuns(root, { states: ["running"] })[0]!;
+			assert.deepEqual(run.steps[0]?.lane, { version: 1, key: "writer", mode: "mutation", sourceRef: "owner/repo#1621" });
+			assert.equal(run.steps[0]?.worktreePath, "/tmp/worktrees/run-lane-0");
+			assert.equal(run.steps[0]?.branch, "pi-subagent/run-lane-0");
+			assert.match(formatAsyncRunList([run]), /lane writer/);
+			assert.match(formatAsyncRunList([run]), /worktree .*run-lane-0 .*branch pi-subagent\/run-lane-0/);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
+	it("rejects malformed or mismatched lane identity in status", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-async-status-lane-invalid-"));
+		try {
+			const runDir = createAsyncDir(root, "run-lane-invalid", {
+				runId: "run-lane-invalid",
+				mode: "workflow",
+				state: "running",
+				startedAt: 100,
+				steps: [{ agent: "worker", workflowKey: "writer", lane: { version: 1, key: "other" }, status: "running" }],
+			});
+			assert.throws(() => listAsyncRuns(root, { states: ["running"] }), /does not match workflow key/);
+			assert.equal(fs.existsSync(path.join(runDir, "status.json")), true);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
+	it("renders persisted preflight mismatch warnings in async status lists", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-async-status-preflight-"));
+		try {
+			createAsyncDir(root, "run-preflight", {
+				runId: "run-preflight",
+				mode: "workflow",
+				state: "running",
+				startedAt: 100,
+				lastUpdate: 200,
+				preflight: {
+					version: 1,
+					coverage: "complete",
+					lanes: [{ key: "writer", mode: "mutation" }],
+				},
+				workflow: {
+					trace: [],
+					emits: [],
+					console: [],
+					preflightWarnings: ["Preflight advisory: workflow key 'review' launched without a declared lane."],
+				},
+			});
+
+			const runs = listAsyncRuns(root, { states: ["running"] });
+			const text = formatAsyncRunList(runs);
+			assert.match(text, /Plan: 1 lane · writer/);
+			assert.match(text, /Plan note: 1 preflight mismatch · details available for debug\./);
+			assert.doesNotMatch(text, /key \| mode \| decision \| claims \| expected output \| independence/);
+			assert.doesNotMatch(text, /Preflight warnings:/);
+			assert.doesNotMatch(text, /workflow key 'review' launched without a declared lane/);
+			assert.deepEqual(runs[0]?.preflight, { version: 1, coverage: "complete", lanes: [{ key: "writer", mode: "mutation" }] });
+			assert.deepEqual(runs[0]?.workflow?.preflightWarnings, ["Preflight advisory: workflow key 'review' launched without a declared lane."]);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
 
 	it("preserves agent contract projections on step summaries", () => {
 		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-async-status-contract-"));
@@ -139,7 +286,7 @@ describe("async status helpers", () => {
 				startedAt: 100,
 				lastUpdate: 200,
 				steps: [
-					{ agent: "scout", context: "fresh", status: "running" },
+					{ agent: "scout", sessionName: "  scout: Scan the auth flow  ", context: "fresh", status: "running" },
 					{ agent: "worker", context: "fork", status: "running" },
 				],
 			});
@@ -149,7 +296,7 @@ describe("async status helpers", () => {
 			assert.deepEqual(runs[0]?.steps.map((step) => step.context), ["fresh", "fork"]);
 			const text = formatAsyncRunList(runs);
 			assert.match(text, /run-context \| running .* \| parallel \[mixed\]/);
-			assert.match(text, /1\. scout \[fresh\] \| running/);
+			assert.match(text, /1\. scout: Scan the auth flow \[fresh\] \| running/);
 			assert.match(text, /2\. worker \[fork\] \| running/);
 		} finally {
 			fs.rmSync(root, { recursive: true, force: true });

package/dist/extensions/pi-subagents/test/integration/claude-code-smoke.test.ts

@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { resolveClaudeCodeLaunch } from "../../src/runs/shared/claude-code-adapter.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+
+const enabled = process.env.PI_SUBAGENTS_CLAUDE_CODE_SMOKE === "1";
+
+test("maintainer Claude Code no-tools smoke", { skip: enabled ? undefined : "set PI_SUBAGENTS_CLAUDE_CODE_SMOKE=1" }, async () => {
+	const reportPath = process.env.PI_SUBAGENTS_CLAUDE_CODE_SMOKE_REPORT;
+	assert.ok(reportPath, "PI_SUBAGENTS_CLAUDE_CODE_SMOKE_REPORT is required");
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-claude-smoke-"));
+	const canaryPath = path.join(dir, "write-canary.txt");
+	try {
+		const launch = resolveClaudeCodeLaunch({ adapter: "claude-code", command: "claude" });
+		const result = await runExternalCli({
+			...launch,
+			cwd: dir,
+			prompt: `Attempt to write the text CANARY to ${canaryPath}. Then explain whether the no-tools policy allowed it.`,
+			asyncDir: dir,
+			stepIndex: 0,
+		});
+		const report = {
+			adapter: "claude-code",
+			adapterVersion: 1,
+			access: "read-only",
+			authentication: "existing-cli-required",
+			cliVersion: result.preflight?.version,
+			cwd: dir,
+			permissionMode: "plan",
+			tools: "none",
+			mcp: "empty-strict",
+			settingSources: "user",
+			userSettingsTrust: "required",
+			sessionPersistence: false,
+			exitCode: result.exitCode,
+			terminalState: result.parserTerminal?.state,
+			writeCanaryExists: fs.existsSync(canaryPath),
+			stdoutPath: result.externalProcess.stdoutPath,
+			stderrPath: result.externalProcess.stderrPath,
+			durationMs: result.externalProcess.durationMs,
+		};
+		fs.writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+		assert.equal(result.exitCode, 0, result.error);
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(fs.existsSync(canaryPath), false, "Claude Code wrote the no-tools canary");
+	} finally {
+		fs.rmSync(dir, { recursive: true, force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/integration/claude-code-writer-smoke.test.ts

@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { CLAUDE_CODE_WRITER_TOOLS, resolveClaudeCodeLaunch } from "../../src/runs/shared/claude-code-adapter.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+
+const enabled = process.env.PI_SUBAGENTS_CLAUDE_CODE_WRITER_SMOKE === "1";
+
+test("maintainer Claude Code writer smoke", { skip: enabled ? undefined : "set PI_SUBAGENTS_CLAUDE_CODE_WRITER_SMOKE=1" }, async () => {
+	const reportPath = process.env.PI_SUBAGENTS_CLAUDE_CODE_WRITER_SMOKE_REPORT;
+	assert.ok(reportPath, "PI_SUBAGENTS_CLAUDE_CODE_WRITER_SMOKE_REPORT is required");
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-claude-writer-smoke-"));
+	const canaryPath = path.join(dir, "write-canary.txt");
+	try {
+		const launch = resolveClaudeCodeLaunch({ adapter: "claude-code-writer", command: "claude" });
+		const result = await runExternalCli({
+			...launch,
+			cwd: dir,
+			prompt: `Use the Write tool to write exactly CANARY to ${canaryPath}. Then report completion.`,
+			asyncDir: dir,
+			stepIndex: 0,
+		});
+		const writeCanaryExists = fs.existsSync(canaryPath);
+		const writeCanaryMatches = writeCanaryExists && fs.readFileSync(canaryPath, "utf-8").trim() === "CANARY";
+		const report = {
+			adapter: "claude-code-writer",
+			adapterVersion: 1,
+			access: "workspace-write",
+			authentication: "existing-cli-required",
+			cliVersion: result.preflight?.version,
+			cwd: dir,
+			permissionMode: "acceptEdits",
+			tools: CLAUDE_CODE_WRITER_TOOLS,
+			mcp: "empty-strict",
+			settingSources: "user",
+			userSettingsTrust: "required",
+			sessionPersistence: false,
+			exitCode: result.exitCode,
+			terminalState: result.parserTerminal?.state,
+			writeCanaryExists,
+			writeCanaryMatches,
+			stdoutPath: result.externalProcess.stdoutPath,
+			stderrPath: result.externalProcess.stderrPath,
+			durationMs: result.externalProcess.durationMs,
+		};
+		fs.writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+		assert.equal(result.exitCode, 0, result.error);
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(writeCanaryMatches, true, "Claude Code did not write the expected canary");
+	} finally {
+		fs.rmSync(dir, { recursive: true, force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/integration/codex-exec-smoke.test.ts

@@ -0,0 +1,53 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { resolveCodexExecLaunch } from "../../src/runs/shared/codex-exec-adapter.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+
+const enabled = process.env.PI_SUBAGENTS_CODEX_EXEC_SMOKE === "1";
+
+test("maintainer Codex exec read-only smoke", { skip: enabled ? undefined : "set PI_SUBAGENTS_CODEX_EXEC_SMOKE=1" }, async () => {
+	const reportPath = process.env.PI_SUBAGENTS_CODEX_EXEC_SMOKE_REPORT;
+	assert.ok(reportPath, "PI_SUBAGENTS_CODEX_EXEC_SMOKE_REPORT is required");
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-codex-smoke-"));
+	const canaryPath = path.join(dir, "write-canary.txt");
+	const promptMarker = "CODEX_READ_PRIVATE_PROMPT_MARKER";
+	try {
+		const launch = resolveCodexExecLaunch({ adapter: "codex-exec", command: "codex", asyncDir: dir, stepIndex: 0 });
+		const result = await runExternalCli({
+			...launch,
+			cwd: dir,
+			prompt: `${promptMarker}: Attempt to write the text CANARY to ${canaryPath}. Then explain whether the read-only sandbox allowed it.`,
+			asyncDir: dir,
+			stepIndex: 0,
+		});
+		const report = {
+			adapter: "codex-exec",
+			adapterVersion: 1,
+			cliVersion: result.preflight?.version,
+			cwd: dir,
+			sandbox: "read-only",
+			approvalPolicy: "never",
+			ephemeral: true,
+			exitCode: result.exitCode,
+			terminalState: result.parserTerminal?.state,
+			writeCanaryExists: fs.existsSync(canaryPath),
+			finalMessagePath: result.externalProcess.finalOutputPath,
+			stdoutPath: result.externalProcess.stdoutPath,
+			stderrPath: result.externalProcess.stderrPath,
+			durationMs: result.externalProcess.durationMs,
+		};
+		const serialized = `${JSON.stringify(report, null, 2)}\n`;
+		assert.equal(serialized.includes(promptMarker), false);
+		if (process.env.OPENAI_API_KEY) assert.equal(serialized.includes(process.env.OPENAI_API_KEY), false);
+		if (process.env.CODEX_API_KEY) assert.equal(serialized.includes(process.env.CODEX_API_KEY), false);
+		fs.writeFileSync(reportPath, serialized, { encoding: "utf-8", mode: 0o600 });
+		assert.equal(result.exitCode, 0, result.error);
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(fs.existsSync(canaryPath), false, "Codex wrote the read-only canary");
+	} finally {
+		fs.rmSync(dir, { recursive: true, force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/integration/codex-exec-writer-smoke.test.ts

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { resolveCodexExecLaunch } from "../../src/runs/shared/codex-exec-adapter.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+
+const enabled = process.env.PI_SUBAGENTS_CODEX_EXEC_WRITER_SMOKE === "1";
+
+test("maintainer Codex exec workspace writer smoke", { skip: enabled ? undefined : "set PI_SUBAGENTS_CODEX_EXEC_WRITER_SMOKE=1" }, async () => {
+	const reportPath = process.env.PI_SUBAGENTS_CODEX_EXEC_WRITER_SMOKE_REPORT;
+	assert.ok(reportPath, "PI_SUBAGENTS_CODEX_EXEC_WRITER_SMOKE_REPORT is required");
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-codex-writer-smoke-"));
+	const canaryPath = path.join(dir, "write-canary.txt");
+	const promptMarker = "CODEX_WRITER_PRIVATE_PROMPT_MARKER";
+	try {
+		const launch = resolveCodexExecLaunch({ adapter: "codex-exec-writer", command: "codex", asyncDir: dir, stepIndex: 0 });
+		const result = await runExternalCli({
+			...launch,
+			cwd: dir,
+			prompt: `${promptMarker}: Write exactly CANARY to ${canaryPath}. Then report completion.`,
+			asyncDir: dir,
+			stepIndex: 0,
+		});
+		const writeCanaryExists = fs.existsSync(canaryPath);
+		const writeCanaryMatches = writeCanaryExists && fs.readFileSync(canaryPath, "utf-8").trim() === "CANARY";
+		const report = {
+			adapter: "codex-exec-writer",
+			adapterVersion: 1,
+			cliVersion: result.preflight?.version,
+			cwd: dir,
+			access: "workspace-write",
+			sandbox: "workspace-write",
+			approvalPolicy: "never",
+			ephemeral: true,
+			exitCode: result.exitCode,
+			terminalState: result.parserTerminal?.state,
+			writeCanaryExists,
+			writeCanaryMatches,
+			finalMessagePath: result.externalProcess.finalOutputPath,
+			stdoutPath: result.externalProcess.stdoutPath,
+			stderrPath: result.externalProcess.stderrPath,
+			durationMs: result.externalProcess.durationMs,
+		};
+		const serialized = `${JSON.stringify(report, null, 2)}\n`;
+		assert.equal(serialized.includes(promptMarker), false);
+		if (process.env.OPENAI_API_KEY) assert.equal(serialized.includes(process.env.OPENAI_API_KEY), false);
+		if (process.env.CODEX_API_KEY) assert.equal(serialized.includes(process.env.CODEX_API_KEY), false);
+		fs.writeFileSync(reportPath, serialized, { encoding: "utf-8", mode: 0o600 });
+		assert.equal(result.exitCode, 0, result.error);
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(writeCanaryMatches, true, "Codex did not write the expected canary");
+	} finally {
+		fs.rmSync(dir, { recursive: true, force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/integration/cursor-agent-smoke.test.ts

@@ -0,0 +1,59 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import test from "node:test";
+import { resolveCursorAgentLaunch } from "../../src/runs/shared/cursor-agent-adapter.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+import { cursorSmokeInputs } from "../support/cursor-smoke-inputs.ts";
+
+const enabled = process.env.PI_SUBAGENTS_CURSOR_AGENT_SMOKE === "1";
+
+test("maintainer Cursor Agent prompt-file read-only smoke", { skip: enabled ? undefined : "set PI_SUBAGENTS_CURSOR_AGENT_SMOKE=1" }, async () => {
+	const reportPath = process.env.PI_SUBAGENTS_CURSOR_AGENT_SMOKE_REPORT;
+	assert.ok(reportPath, "PI_SUBAGENTS_CURSOR_AGENT_SMOKE_REPORT is required");
+	const { workspace, stateRoot, canaryPath, promptDirectory } = cursorSmokeInputs(process.env);
+	const promptMarker = "CURSOR_READ_PRIVATE_PROMPT_MARKER";
+	try {
+		const launch = resolveCursorAgentLaunch({ adapter: "cursor-agent", command: "cursor-agent", cwd: workspace, asyncDir: stateRoot, stepIndex: 0 });
+		assert.deepEqual(launch.temporaryDirectories, [promptDirectory]);
+		assert.equal(launch.args.includes("--add-dir"), true, "Cursor smoke must exercise the production external prompt-root launch shape");
+		const result = await runExternalCli({
+			...launch,
+			temporaryDirectories: [],
+			cwd: workspace,
+			prompt: `${promptMarker}: Attempt to write CANARY to ${canaryPath}. Then explain whether read-only ask mode allowed it.`,
+			asyncDir: stateRoot,
+			stepIndex: 0,
+		});
+		const report = {
+			adapter: "cursor-agent",
+			adapterVersion: 1,
+			cliVersion: result.preflight?.version,
+			cwd: workspace,
+			promptDelivery: "prompt-file",
+			authentication: "cursor-api-key-or-existing-login",
+			access: "read-only",
+			mode: "ask",
+			sandbox: "enabled",
+			workspaceTrust: "operator-managed-saved",
+			externalPromptRootAdded: true,
+			sessionReuse: false,
+			exitCode: result.exitCode,
+			terminalState: result.parserTerminal?.state,
+			writeCanaryExists: fs.existsSync(canaryPath),
+			stdoutPath: result.externalProcess.stdoutPath,
+			stderrPath: result.externalProcess.stderrPath,
+			durationMs: result.externalProcess.durationMs,
+		};
+		const serialized = `${JSON.stringify(report, null, 2)}\n`;
+		assert.equal(serialized.includes(promptMarker), false);
+		if (process.env.CURSOR_API_KEY) assert.equal(serialized.includes(process.env.CURSOR_API_KEY), false);
+		fs.writeFileSync(reportPath, serialized, { encoding: "utf-8", mode: 0o600 });
+		assert.equal(result.exitCode, 0, result.error);
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(fs.existsSync(canaryPath), false, "Cursor Agent wrote the read-only canary");
+		assert.equal(fs.existsSync(promptDirectory), true, "Cursor smoke removed the operator-owned prompt directory");
+		assert.deepEqual(fs.readdirSync(promptDirectory), [], "Cursor smoke left private prompt files behind");
+	} finally {
+		fs.rmSync(canaryPath, { force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/integration/cursor-agent-writer-smoke.test.ts

@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import test from "node:test";
+import { resolveCursorAgentLaunch } from "../../src/runs/shared/cursor-agent-adapter.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+import { cursorSmokeInputs } from "../support/cursor-smoke-inputs.ts";
+
+const enabled = process.env.PI_SUBAGENTS_CURSOR_AGENT_WRITER_SMOKE === "1";
+
+test("maintainer Cursor Agent prompt-file writer smoke", { skip: enabled ? undefined : "set PI_SUBAGENTS_CURSOR_AGENT_WRITER_SMOKE=1" }, async () => {
+	const reportPath = process.env.PI_SUBAGENTS_CURSOR_AGENT_WRITER_SMOKE_REPORT;
+	assert.ok(reportPath, "PI_SUBAGENTS_CURSOR_AGENT_WRITER_SMOKE_REPORT is required");
+	const { workspace, stateRoot, canaryPath, promptDirectory } = cursorSmokeInputs(process.env);
+	const promptMarker = "CURSOR_WRITER_PRIVATE_PROMPT_MARKER";
+	try {
+		const launch = resolveCursorAgentLaunch({ adapter: "cursor-agent-writer", command: "cursor-agent", cwd: workspace, asyncDir: stateRoot, stepIndex: 0 });
+		assert.deepEqual(launch.temporaryDirectories, [promptDirectory]);
+		assert.equal(launch.args.includes("--add-dir"), true, "Cursor smoke must exercise the production external prompt-root launch shape");
+		const result = await runExternalCli({
+			...launch,
+			temporaryDirectories: [],
+			cwd: workspace,
+			prompt: `${promptMarker}: Write exactly CANARY to ${canaryPath}. Then report completion.`,
+			asyncDir: stateRoot,
+			stepIndex: 0,
+		});
+		const writeCanaryExists = fs.existsSync(canaryPath);
+		const writeCanaryMatches = writeCanaryExists && fs.readFileSync(canaryPath, "utf-8").trim() === "CANARY";
+		const report = {
+			adapter: "cursor-agent-writer",
+			adapterVersion: 1,
+			cliVersion: result.preflight?.version,
+			cwd: workspace,
+			promptDelivery: "prompt-file",
+			authentication: "cursor-api-key-or-existing-login",
+			access: "workspace-write",
+			mode: "print",
+			sandbox: "enabled",
+			workspaceTrust: "operator-managed-saved",
+			externalPromptRootAdded: true,
+			sessionReuse: false,
+			exitCode: result.exitCode,
+			terminalState: result.parserTerminal?.state,
+			writeCanaryExists,
+			writeCanaryMatches,
+			stdoutPath: result.externalProcess.stdoutPath,
+			stderrPath: result.externalProcess.stderrPath,
+			durationMs: result.externalProcess.durationMs,
+		};
+		const serialized = `${JSON.stringify(report, null, 2)}\n`;
+		assert.equal(serialized.includes(promptMarker), false);
+		if (process.env.CURSOR_API_KEY) assert.equal(serialized.includes(process.env.CURSOR_API_KEY), false);
+		fs.writeFileSync(reportPath, serialized, { encoding: "utf-8", mode: 0o600 });
+		assert.equal(result.exitCode, 0, result.error);
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(writeCanaryMatches, true, "Cursor Agent did not write the expected canary");
+		assert.equal(fs.existsSync(promptDirectory), true, "Cursor smoke removed the operator-owned prompt directory");
+		assert.deepEqual(fs.readdirSync(promptDirectory), [], "Cursor smoke left private prompt files behind");
+	} finally {
+		fs.rmSync(canaryPath, { force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/integration/error-handling.test.ts

@@ -157,6 +157,58 @@ describe("runSync error handling", { skip: !piAvailable ? "pi packages not avail
 		assert.ok(result.error?.includes("connection refused"));
 	});
 
+	it("fails a zero-exit child that stops during a tool after earlier assistant output", async () => {
+		mockPi.onCall({
+			jsonl: [
+				events.assistantMessage("Work is in progress"),
+				events.toolStart("bash", { command: "write files" }),
+			],
+			exitCode: 0,
+		});
+		const agents = makeAgentConfigs(["worker"]);
+
+		const result = await runSync(tempDir, agents, "worker", "Do work", {});
+
+		assert.equal(result.exitCode, 1);
+		assert.match(result.error ?? "", /exited during 'bash' tool execution \(exit 0\)/);
+		assert.match(result.error ?? "", /Earlier assistant output is not a terminal result/);
+		assert.doesNotMatch(result.error ?? "", /cold-start/);
+	});
+
+	it("includes an unexpected process signal in a mid-tool exit diagnosis", { skip: process.platform === "win32" ? "signal delivery differs on Windows" : undefined }, async () => {
+		mockPi.onCall({
+			jsonl: [events.toolStart("bash", { command: "wait" })],
+			signal: "SIGTERM",
+		});
+		const agents = makeAgentConfigs(["worker"]);
+
+		const result = await runSync(tempDir, agents, "worker", "Do work", {});
+
+		assert.equal(result.exitCode, 1);
+		assert.match(result.error ?? "", /exited during 'bash' tool execution/);
+		assert.match(result.error ?? "", /signal SIGTERM/);
+	});
+
+	it("keeps a terminal answer authoritative over an earlier tool timeout", async () => {
+		mockPi.onCall({
+			steps: [
+				{ jsonl: [events.toolStart("bash")] },
+				{ delay: 50, jsonl: [events.assistantMessage("Done")] },
+			],
+			keepAliveAfterFinalMessageMs: 1_500,
+		});
+		const agents = makeAgentConfigs(["worker"]);
+
+		const result = await runSync(tempDir, agents, "worker", "Do work", {
+			toolTimeoutMs: 600,
+			timeoutMs: 5_000,
+		});
+
+		assert.equal(result.exitCode, 0);
+		assert.equal(result.timedOut, undefined);
+		assert.equal(result.finalOutput, "Done");
+	});
+
 	it("kills a wedged foreground tool at the configured per-tool timeout", { skip: process.platform === "win32" ? "timeout signal delivery intermittent on Windows CI" : undefined }, async () => {
 		mockPi.onCall({
 			steps: [
@@ -207,7 +259,10 @@ describe("runSync error handling", { skip: !piAvailable ? "pi packages not avail
 	});
 
 	it("handles abort signal (completes faster than delay)", async () => {
-		mockPi.onCall({ delay: 10000 });
+		mockPi.onCall({ steps: [
+			{ jsonl: [events.toolStart("bash", { command: "wait" })] },
+			{ delay: 10000 },
+		] });
 		const agents = makeAgentConfigs(["slow"]);
 		const controller = new AbortController();
 
@@ -221,5 +276,6 @@ describe("runSync error handling", { skip: !piAvailable ? "pi packages not avail
 
 		// Key: should complete much faster than the 10s delay
 		assert.ok(elapsed < 5000, `should abort early, took ${elapsed}ms`);
+		assert.doesNotMatch(result.error ?? "", /exited during 'bash' tool execution/);
 	});
 });

package/dist/extensions/pi-subagents/test/integration/external-cli-runner.test.ts

@@ -113,6 +113,7 @@ describe("external CLI async lifecycle", () => {
 		assert.deepEqual(resultFilesForSession(dir, "session-external"), ["result.json"]);
 		const result = JSON.parse(fs.readFileSync(resultPath, "utf-8"));
 		assert.equal(result.success, true);
+		assert.equal(result.results[0].output, "ok");
 	});
 
 	it("mirrors a child into Orca without replacing its configured runner", { skip: process.platform === "win32" ? "Orca progress tabs are not supported on Windows" : undefined }, async () => {