@selesai/code 0.13.38 → 0.13.40

package/dist/extensions/pi-subagents/test/unit/result-takeover.test.ts

@@ -0,0 +1,332 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, it } from "node:test";
+import { createResultDeliveryOwnership, type ResultTakeoverDeps } from "../../src/runs/background/result-delivery-ownership.ts";
+import { ensureOwnerRecord, ownerFileStem, ownerRecordPath, readOwnerRecord, type OwnerRecord } from "../../src/shared/owner-record.ts";
+import { processLiveness, processStartKey } from "../../src/shared/process-identity.ts";
+
+const roots: string[] = [];
+afterEach(() => {
+	for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+});
+function tempDir(): string {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-takeover-test-"));
+	roots.push(dir);
+	return dir;
+}
+
+const HOST = "host-a";
+const SESSION = "session-1";
+
+function writeRecord(ownersDir: string, id: string, overrides: Partial<OwnerRecord> = {}): OwnerRecord {
+	const record: OwnerRecord = { version: 1, completionOwnerId: id, pid: 4242, hostname: HOST, createdAt: 1_000, ...overrides };
+	fs.mkdirSync(ownersDir, { recursive: true });
+	fs.writeFileSync(ownerRecordPath(ownersDir, id)!, JSON.stringify(record));
+	return record;
+}
+
+type Liveness = "alive" | "dead" | "unknown";
+
+/** pid -> liveness table so each fake owner can live or die independently. */
+function fakes(ownersDir: string, table: Record<number, Liveness>, overrides: Partial<ResultTakeoverDeps> = {}): ResultTakeoverDeps {
+	return {
+		ownersDir,
+		hostname: () => HOST,
+		processLiveness: (pid) => table[pid] ?? "unknown",
+		processStartKey: () => undefined,
+		...overrides,
+	};
+}
+
+function ownershipFor(ownerId: string, ownersDir: string, table: Record<number, Liveness>, sessionId: string | null = SESSION, overrides: Partial<ResultTakeoverDeps> = {}) {
+	const state = { currentSessionId: sessionId, completionOwnerId: ownerId };
+	return { state, ownership: createResultDeliveryOwnership(state, fakes(ownersDir, table, overrides)) };
+}
+
+function claimFiles(ownersDir: string): string[] {
+	try {
+		return fs.readdirSync(path.join(ownersDir, "claims")).sort();
+	} catch {
+		return [];
+	}
+}
+
+describe("cross-process result takeover", () => {
+	it("takes over a dead same-host owner's result for the current session, exactly once", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		const { ownership } = ownershipFor("me", dir, { 100: "dead" }, SESSION, { now: () => 5_000 });
+		assert.equal(ownership.owns(SESSION, "dead-owner", "run-1"), true);
+		assert.equal(ownership.owns(SESSION, "dead-owner", "run-1"), true, "idempotent for the same claimant");
+		assert.deepEqual(claimFiles(dir), ["run-1.json"]);
+		assert.deepEqual(JSON.parse(fs.readFileSync(path.join(dir, "claims", "run-1.json"), "utf-8")), { claimedBy: "me", previousOwner: "dead-owner", claimedAt: 5_000 });
+	});
+
+	it("never takes over from a live owner", () => {
+		const dir = tempDir();
+		writeRecord(dir, "live-owner", { pid: 100 });
+		const { ownership } = ownershipFor("me", dir, { 100: "alive" });
+		assert.equal(ownership.owns(SESSION, "live-owner", "run-1"), false);
+		assert.equal(ownership.canTakeOver(SESSION, "live-owner", "run-1"), false);
+		assert.deepEqual(claimFiles(dir), []);
+	});
+
+	it("does not take over without an owner record", () => {
+		const dir = tempDir();
+		fs.mkdirSync(dir, { recursive: true });
+		const { ownership } = ownershipFor("me", dir, { 100: "dead" });
+		assert.equal(ownership.owns(SESSION, "no-record", "run-1"), false);
+		fs.writeFileSync(ownerRecordPath(dir, "garbage")!, "{not json");
+		assert.equal(ownership.owns(SESSION, "garbage", "run-1"), false);
+		writeRecord(dir, "wrong-id", { pid: 100 });
+		fs.renameSync(ownerRecordPath(dir, "wrong-id")!, ownerRecordPath(dir, "impostor")!);
+		assert.equal(ownership.owns(SESSION, "impostor", "run-1"), false, "a record must describe the id it is filed under");
+		assert.deepEqual(claimFiles(dir), []);
+	});
+
+	it("does not take over when liveness is unknown", () => {
+		const dir = tempDir();
+		writeRecord(dir, "mystery", { pid: 100 });
+		const { ownership } = ownershipFor("me", dir, { 100: "unknown" });
+		assert.equal(ownership.owns(SESSION, "mystery", "run-1"), false);
+		assert.deepEqual(claimFiles(dir), []);
+	});
+
+	it("does not take over from another host", () => {
+		const dir = tempDir();
+		writeRecord(dir, "elsewhere", { pid: 100, hostname: "host-b" });
+		const { ownership } = ownershipFor("me", dir, { 100: "dead" });
+		assert.equal(ownership.owns(SESSION, "elsewhere", "run-1"), false);
+		assert.deepEqual(claimFiles(dir), []);
+	});
+
+	it("treats a reused pid (different start key) as a dead owner, but only with comparable evidence", () => {
+		const dir = tempDir();
+		const cases: Array<{ name: string; recorded?: string; current?: string; takeable: boolean }> = [
+			{ name: "reused", recorded: "ps:Mon Oct  4 10:00:00 2026", current: "ps:Mon Oct  4 12:30:00 2026", takeable: true },
+			{ name: "same-process", recorded: "ps:Mon Oct  4 10:00:00 2026", current: "ps:Mon Oct  4 10:00:00 2026", takeable: false },
+			{ name: "no-recorded-key", current: "ps:Mon Oct  4 12:30:00 2026", takeable: false },
+			{ name: "no-current-key", recorded: "ps:Mon Oct  4 10:00:00 2026", takeable: false },
+			{ name: "scheme-changed", recorded: "linux:12345", current: "ps:Mon Oct  4 12:30:00 2026", takeable: false },
+		];
+		for (const entry of cases) {
+			writeRecord(dir, entry.name, { pid: 100, ...(entry.recorded ? { startKey: entry.recorded } : {}) });
+			const { ownership } = ownershipFor("me", dir, { 100: "alive" }, SESSION, { processStartKey: () => entry.current });
+			assert.equal(ownership.owns(SESSION, entry.name, `run-${entry.name}`), entry.takeable, entry.name);
+		}
+	});
+
+	it("never takes another session's result, even from a dead owner", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		const { state, ownership } = ownershipFor("me", dir, { 100: "dead" });
+		assert.equal(ownership.owns("other-session", "dead-owner", "run-1"), false);
+		assert.equal(ownership.canTakeOver("other-session", "dead-owner", "run-1"), false);
+		assert.deepEqual(claimFiles(dir), []);
+		// An already-claimed predecessor session is part of this process's scope, exactly as for in-process ownership.
+		state.currentSessionId = "old";
+		assert.equal(ownership.claimPredecessor("old", "old"), true);
+		state.currentSessionId = "new";
+		assert.equal(ownership.owns("old", "dead-owner", "run-old"), true);
+		assert.equal(ownership.owns("new", "dead-owner", "run-new"), true);
+		assert.equal(ownership.owns("other-session", "dead-owner", "run-2"), false);
+	});
+
+	it("requires a run key and a non-empty foreign owner id; the in-process rule is unchanged", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		const { ownership } = ownershipFor("me", dir, { 100: "dead" });
+		assert.equal(ownership.owns(SESSION, "dead-owner"), false);
+		assert.equal(ownership.owns(SESSION, undefined, "run-1"), false);
+		assert.equal(ownership.owns(SESSION, "", "run-1"), false);
+		assert.equal(ownership.owns(SESSION, "me", "run-1"), true);
+		assert.equal(ownership.owns("other-session", "me", "run-1"), false);
+		assert.deepEqual(claimFiles(dir), []);
+	});
+
+	it("lets exactly one of two racing processes win a result", () => {
+		for (const order of [["a", "b"], ["b", "a"]] as const) {
+			const dir = tempDir();
+			writeRecord(dir, "dead-owner", { pid: 100 });
+			const table: Record<number, Liveness> = { 100: "dead", 201: "alive", 202: "alive" };
+			writeRecord(dir, "proc-a", { pid: 201 });
+			writeRecord(dir, "proc-b", { pid: 202 });
+			const a = ownershipFor("proc-a", dir, table);
+			const b = ownershipFor("proc-b", dir, table);
+			const by = { a: a.ownership, b: b.ownership };
+			const results = order.map((name) => by[name].owns(SESSION, "dead-owner", "run-1"));
+			assert.deepEqual(results, [true, false], `first caller (${order[0]}) wins`);
+			assert.equal(by[order[0]].owns(SESSION, "dead-owner", "run-1"), true);
+			assert.equal(by[order[1]].owns(SESSION, "dead-owner", "run-1"), false);
+			assert.equal(by[order[1]].canTakeOver(SESSION, "dead-owner", "run-1"), false);
+			assert.deepEqual(claimFiles(dir), ["run-1.json"]);
+		}
+	});
+
+	it("re-claims a result whose claimer died, race-safely and with a bounded chain", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		writeRecord(dir, "claimer-1", { pid: 201 });
+		writeRecord(dir, "claimer-2", { pid: 202 });
+		writeRecord(dir, "claimer-3", { pid: 203 });
+		const table: Record<number, Liveness> = { 100: "dead", 201: "alive", 202: "alive", 203: "alive", 301: "alive", 302: "alive" };
+		writeRecord(dir, "taker-a", { pid: 301 });
+		writeRecord(dir, "taker-b", { pid: 302 });
+
+		const first = ownershipFor("claimer-1", dir, table);
+		assert.equal(first.ownership.owns(SESSION, "dead-owner", "run-1"), true);
+		// While the first claimer lives nobody else may take the result.
+		assert.equal(ownershipFor("taker-a", dir, table).ownership.owns(SESSION, "dead-owner", "run-1"), false);
+
+		table[201] = "dead";
+		const a = ownershipFor("taker-a", dir, table, SESSION, { livenessTtlMs: 0 });
+		const b = ownershipFor("taker-b", dir, table, SESSION, { livenessTtlMs: 0 });
+		assert.equal(a.ownership.canTakeOver(SESSION, "dead-owner", "run-1"), true, "peek never claims");
+		assert.deepEqual(claimFiles(dir), ["run-1.json"]);
+		assert.equal(a.ownership.owns(SESSION, "dead-owner", "run-1"), true);
+		assert.equal(b.ownership.owns(SESSION, "dead-owner", "run-1"), false, "the second re-claimer loses");
+		assert.deepEqual(claimFiles(dir), ["run-1%g2.json", "run-1.json"].sort());
+		assert.equal(JSON.parse(fs.readFileSync(path.join(dir, "claims", "run-1%g2.json"), "utf-8")).claimedBy, "taker-a");
+
+		// A claimer whose record is gone cannot be proven dead.
+		fs.rmSync(ownerRecordPath(dir, "taker-a")!);
+		assert.equal(ownershipFor("claimer-2", dir, table, SESSION, { livenessTtlMs: 0 }).ownership.owns(SESSION, "dead-owner", "run-1"), false);
+	});
+
+	it("gives up once the claim chain is exhausted", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		const table: Record<number, Liveness> = { 100: "dead" };
+		const claimers = ["c1", "c2", "c3", "c4"];
+		claimers.forEach((id, index) => {
+			writeRecord(dir, id, { pid: 200 + index });
+			table[200 + index] = "alive";
+		});
+		for (const id of claimers) {
+			assert.equal(ownershipFor(id, dir, table, SESSION, { livenessTtlMs: 0 }).ownership.owns(SESSION, "dead-owner", "run-1"), true, id);
+			table[200 + claimers.indexOf(id)] = "dead";
+		}
+		writeRecord(dir, "late", { pid: 300 });
+		table[300] = "alive";
+		assert.equal(ownershipFor("late", dir, table, SESSION, { livenessTtlMs: 0 }).ownership.owns(SESSION, "dead-owner", "run-1"), false);
+	});
+
+	it("fails safe on an unreadable claim marker", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		fs.mkdirSync(path.join(dir, "claims"), { recursive: true });
+		fs.writeFileSync(path.join(dir, "claims", "run-1.json"), "{half");
+		const { ownership } = ownershipFor("me", dir, { 100: "dead" });
+		assert.equal(ownership.owns(SESSION, "dead-owner", "run-1"), false);
+		assert.equal(ownership.canTakeOver(SESSION, "dead-owner", "run-1"), false);
+	});
+
+	it("keeps run keys from escaping the claims directory", () => {
+		const dir = tempDir();
+		writeRecord(dir, "dead-owner", { pid: 100 });
+		const { ownership } = ownershipFor("me", dir, { 100: "dead" });
+		assert.equal(ownership.owns(SESSION, "dead-owner", "../../escape"), true);
+		assert.deepEqual(claimFiles(dir), [`${encodeURIComponent("../../escape")}.json`]);
+		assert.equal(fs.existsSync(path.join(dir, "..", "escape.json")), false);
+		assert.equal(ownerFileStem("../x/y"), "..%2Fx%2Fy");
+	});
+
+	it("probes each owner at most once per TTL window", () => {
+		const dir = tempDir();
+		writeRecord(dir, "live-owner", { pid: 100 });
+		let probes = 0;
+		let clock = 10_000;
+		const { ownership } = ownershipFor("me", dir, {}, SESSION, {
+			now: () => clock,
+			processLiveness: () => { probes += 1; return "alive"; },
+		});
+		for (let index = 0; index < 50; index += 1) ownership.owns(SESSION, "live-owner", `run-${index}`);
+		assert.equal(probes, 1);
+		clock += 1_999;
+		ownership.owns(SESSION, "live-owner", "run-x");
+		assert.equal(probes, 1);
+		clock += 2;
+		ownership.owns(SESSION, "live-owner", "run-y");
+		assert.equal(probes, 2);
+	});
+
+	it("garbage-collects only provably dead, week-old owner records and stale claims", () => {
+		const dir = tempDir();
+		const week = 8 * 24 * 60 * 60 * 1000;
+		const old = new Date(Date.now() - week);
+		const table: Record<number, Liveness> = { 1: "dead", 2: "alive", 3: "dead", 4: "unknown" };
+		writeRecord(dir, "old-dead", { pid: 1 });
+		writeRecord(dir, "old-alive", { pid: 2 });
+		writeRecord(dir, "young-dead", { pid: 3 });
+		writeRecord(dir, "old-unknown", { pid: 4 });
+		writeRecord(dir, "me", { pid: 5 });
+		table[5] = "dead";
+		for (const id of ["old-dead", "old-alive", "old-unknown", "me"]) fs.utimesSync(ownerRecordPath(dir, id)!, old, old);
+		fs.mkdirSync(path.join(dir, "claims"));
+		fs.writeFileSync(path.join(dir, "claims", "gone.json"), JSON.stringify({ claimedBy: "young-dead", previousOwner: "x", claimedAt: 1 }));
+		fs.utimesSync(path.join(dir, "claims", "gone.json"), old, old);
+		fs.writeFileSync(path.join(dir, "claims", "kept.json"), JSON.stringify({ claimedBy: "old-alive", previousOwner: "x", claimedAt: 1 }));
+		fs.utimesSync(path.join(dir, "claims", "kept.json"), old, old);
+		fs.writeFileSync(path.join(dir, "claims", "stale.json.1.abc.tmp"), "x");
+		fs.utimesSync(path.join(dir, "claims", "stale.json.1.abc.tmp"), old, old);
+		writeRecord(dir, "dead-owner", { pid: 9 });
+		table[9] = "dead";
+		const { ownership } = ownershipFor("me", dir, table);
+		ownership.owns(SESSION, "dead-owner", "run-1");
+		const left = fs.readdirSync(dir).sort();
+		assert.deepEqual(left, ["claims", "dead-owner.json", "me.json", "old-alive.json", "old-unknown.json", "young-dead.json"].sort());
+		assert.deepEqual(claimFiles(dir), ["kept.json", "run-1.json"]);
+	});
+
+	it("takes over from a real exited process, identified by its real pid", () => {
+		const dir = tempDir();
+		const child = spawnSync(process.execPath, ["-e", "process.stdout.write(String(process.pid))"], { encoding: "utf-8" });
+		const pid = Number(child.stdout);
+		assert.ok(Number.isSafeInteger(pid) && pid > 0);
+		writeRecord(dir, "exited", { pid, hostname: os.hostname() });
+		writeRecord(dir, "running", { pid: process.pid, hostname: os.hostname() });
+		const state = { currentSessionId: SESSION as string | null, completionOwnerId: "me" };
+		const ownership = createResultDeliveryOwnership(state, { ownersDir: dir });
+		assert.equal(ownership.owns(SESSION, "exited", "run-1"), true);
+		assert.equal(ownership.owns(SESSION, "running", "run-2"), false, "this very process is alive");
+	});
+});
+
+describe("owner record", () => {
+	it("is written once per process, shared across reloads, and survives shutdown", () => {
+		const dir = tempDir();
+		const ids = { completionOwnerId: "owner-xyz", pid: 777, hostname: HOST, startKey: () => "ps:start" };
+		assert.equal(ensureOwnerRecord({ ownersDir: dir, ...ids, now: () => 111 }), true);
+		const file = ownerRecordPath(dir, "owner-xyz")!;
+		const first = fs.readFileSync(file, "utf-8");
+		assert.deepEqual(JSON.parse(first), { version: 1, completionOwnerId: "owner-xyz", pid: 777, startKey: "ps:start", hostname: HOST, createdAt: 111 });
+		// Simulated extension reload: same owner id, later clock.
+		let startKeyCalls = 0;
+		assert.equal(ensureOwnerRecord({ ownersDir: dir, ...ids, startKey: () => { startKeyCalls += 1; return "x"; }, now: () => 999 }), false);
+		assert.equal(fs.readFileSync(file, "utf-8"), first);
+		assert.equal(startKeyCalls, 0, "a reload must not spawn ps again");
+		assert.deepEqual(fs.readdirSync(dir), ["owner-xyz.json"], "no temp files left behind");
+		if (process.platform !== "win32") assert.equal(fs.statSync(file).mode & 0o077, 0, "record is private to the user");
+		// Not removed by anything this process does on shutdown: detached runners outlive it and need the record.
+		assert.deepEqual(readOwnerRecord(dir, "owner-xyz")?.pid, 777);
+	});
+
+	it("replaces a record left by a different process that reused the owner id slot", () => {
+		const dir = tempDir();
+		ensureOwnerRecord({ ownersDir: dir, completionOwnerId: "o", pid: 1, hostname: HOST, startKey: () => undefined, now: () => 1 });
+		assert.equal(ensureOwnerRecord({ ownersDir: dir, completionOwnerId: "o", pid: 2, hostname: HOST, startKey: () => undefined, now: () => 2 }), true);
+		assert.equal(readOwnerRecord(dir, "o")?.pid, 2);
+		assert.equal("startKey" in (readOwnerRecord(dir, "o") ?? {}), false);
+	});
+
+	it("resolves this process's real liveness and start key", () => {
+		assert.equal(processLiveness(process.pid), "alive");
+		assert.equal(processLiveness(0), "unknown");
+		assert.equal(processLiveness(-5), "unknown");
+		const key = processStartKey(process.pid);
+		assert.equal(processStartKey(process.pid), key, "own key is cached");
+	});
+});

package/dist/extensions/tokenin-onboarding.ts

@@ -791,9 +791,141 @@ export function formatTokenInUsage(usage: TokenInUsage): string {
 	].join("\n");
 }
 
+export interface TokenInBalanceBucket {
+	kind: string;
+	planId?: string;
+	amountUsd: number;
+	usedUsd: number;
+	remainingUsd: number;
+	state: "active" | "upcoming" | "expired";
+	expiresAt?: string;
+}
+
+export interface TokenInBalance {
+	availableUsd: number;
+	fixedAvailableUsd: number;
+	paygAvailableUsd: number;
+	debtUsd: number;
+	asOf?: string;
+	buckets: TokenInBalanceBucket[];
+}
+
+const finiteNumber = (value: unknown): number | undefined => {
+	const n = typeof value === "number" ? value : Number.NaN;
+	return Number.isFinite(n) ? n : undefined;
+};
+
+/** Parse a /tokenin/account/me/balance payload. Exported for tests. */
+export function parseTokenInBalance(payload: unknown): TokenInBalance | undefined {
+	if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
+	const obj = payload as Record<string, unknown>;
+	const availableUsd = finiteNumber(obj.available_usd);
+	if (availableUsd === undefined || !Array.isArray(obj.buckets)) return undefined;
+	const buckets: TokenInBalanceBucket[] = [];
+	for (const raw of obj.buckets) {
+		if (!raw || typeof raw !== "object") continue;
+		const b = raw as Record<string, unknown>;
+		const state = b.state;
+		if (state !== "active" && state !== "upcoming" && state !== "expired") continue;
+		const bucket: TokenInBalanceBucket = {
+			kind: typeof b.kind === "string" ? b.kind : "unknown",
+			amountUsd: finiteNumber(b.amount_usd) ?? 0,
+			usedUsd: finiteNumber(b.used_usd) ?? 0,
+			remainingUsd: finiteNumber(b.remaining_usd) ?? 0,
+			state,
+		};
+		if (typeof b.plan_id === "string") bucket.planId = b.plan_id;
+		if (typeof b.expires_at === "string") bucket.expiresAt = b.expires_at;
+		buckets.push(bucket);
+	}
+	const balance: TokenInBalance = {
+		availableUsd,
+		fixedAvailableUsd: finiteNumber(obj.fixed_available_usd) ?? 0,
+		paygAvailableUsd: finiteNumber(obj.payg_available_usd) ?? 0,
+		debtUsd: finiteNumber(obj.debt_usd) ?? 0,
+		buckets,
+	};
+	if (typeof obj.as_of === "string") balance.asOf = obj.as_of;
+	return balance;
+}
+
+function formatTimeUntil(iso: string): string | undefined {
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return undefined;
+	const ms = d.getTime() - Date.now();
+	if (ms <= 0) return undefined;
+	const days = Math.floor(ms / 86_400_000);
+	const hours = Math.floor((ms % 86_400_000) / 3_600_000);
+	return days > 0 ? `${days}d ${hours}h` : `${Math.max(1, Math.ceil(ms / 3_600_000))}h`;
+}
+
+/** Format an account balance as a boxed display. Exported for tests. */
+export function formatTokenInBalance(balance: TokenInBalance): string {
+	const money = (v: number) => `$${v.toFixed(2)}`;
+	const active = balance.buckets.filter((b) => b.state === "active");
+	const total = active.reduce((sum, b) => sum + b.amountUsd, 0);
+	const used = active.reduce((sum, b) => sum + b.usedUsd, 0);
+	const pct = total > 0 ? Math.min(100, (used / total) * 100) : 0;
+	const barWidth = 40;
+	const filled = total > 0 ? Math.min(barWidth, Math.round((pct / 100) * barWidth)) : 0;
+	const bar = "█".repeat(filled) + "░".repeat(barWidth - filled);
+	const pctText = total > 0 ? `${pct.toFixed(1)}%` : "—";
+
+	const summary = `Available ${money(balance.availableUsd)}`;
+	let split = `Plan ${money(balance.fixedAvailableUsd)} · PAYG ${money(balance.paygAvailableUsd)}`;
+	if (balance.debtUsd > 0) split += ` · Debt ${money(balance.debtUsd)}`;
+	const usedLine = total > 0 ? `Used ${money(used)} of ${money(total)} active credit` : "No active credit";
+
+	const expiries = active
+		.map((b) => b.expiresAt)
+		.filter((v): v is string => typeof v === "string")
+		.sort((a, b) => new Date(a).getTime() - new Date(b).getTime());
+	const until = expiries.length > 0 ? formatTimeUntil(expiries[0]) : undefined;
+	const footer = until ? `Plan credit expires in ${until}` : "";
+
+	const W = 50;
+	const inner = W - 4;
+	const pad = (s: string) => s + " ".repeat(Math.max(0, inner - s.length));
+	const title = "╭─ Token-In balance ";
+	const top = `${title}${"─".repeat(W - title.length - 1)}╮`;
+	const bottom = `╰${"─".repeat(W - 2)}╯`;
+	const lines = [top, `│ ${pad(summary)} │`, `│ ${pad(split)} │`, `│ ${pad(usedLine)} │`, `│ ${bar} ${pctText.padStart(5)} │`];
+	if (footer) lines.push(`│ ${pad(footer)} │`);
+	lines.push(bottom);
+	return lines.join("\n");
+}
+
+function tokenInProxyRoot(baseUrl: string): string {
+	return baseUrl.replace(/\/v1\/?$/, "");
+}
+
+/**
+ * Query the self-scoped account balance with the user's own key. Returns undefined when
+ * the gateway has no account balance for this key (404: older gateway, accounts disabled,
+ * or a legacy key) or answers with something that is not a balance, so callers can fall
+ * back to /key/info. Other errors throw. Exported for tests.
+ */
+export async function fetchTokenInBalance(apiKey: string, baseUrl: string): Promise<TokenInBalance | undefined> {
+	const response = await fetch(`${tokenInProxyRoot(baseUrl)}/tokenin/account/me/balance`, {
+		headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+		signal: AbortSignal.timeout(5_000),
+	});
+	if (response.status === 404) return undefined;
+	if (!response.ok) {
+		throw new Error(`Token-In usage endpoint returned HTTP ${response.status}`);
+	}
+	let payload: unknown;
+	try {
+		payload = await response.json();
+	} catch {
+		return undefined;
+	}
+	return parseTokenInBalance(payload);
+}
+
 /** Query LiteLLM /key/info at the proxy root with the account key. Exported for tests. */
 export async function fetchTokenInUsage(apiKey: string, baseUrl: string): Promise<TokenInUsage> {
-	const root = baseUrl.replace(/\/v1\/?$/, "");
+	const root = tokenInProxyRoot(baseUrl);
 	const response = await fetch(`${root}/key/info`, {
 		headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
 		signal: AbortSignal.timeout(5_000),
@@ -906,6 +1038,11 @@ async function handleTokenInUsage(ctx: ExtensionCommandContext): Promise<void> {
 	const account = auth.accounts.find((a) => a.id === activeId);
 	const baseUrl = account?.baseUrl ?? getTokenInBaseUrl(readModelsJson()) ?? TOKEN_IN_DEFAULT_BASE_URL;
 	try {
+		const balance = await fetchTokenInBalance(apiKey, baseUrl);
+		if (balance) {
+			ctx.ui.notify(formatTokenInBalance(balance), "info");
+			return;
+		}
 		const usage = await fetchTokenInUsage(apiKey, baseUrl);
 		ctx.ui.notify(formatTokenInUsage(usage), "info");
 	} catch (err) {
@@ -965,8 +1102,10 @@ async function runOnboarding(pi: ExtensionAPI, ctx: ExtensionContext): Promise<v
 		return;
 	}
 
-	// No UI? Defer to a later session.
-	if (!ctx.hasUI) {
+	// No UI, or a headless RPC host? Defer to a later session. In RPC mode a startup
+	// confirm blocks the whole command loop (activation is awaited before stdin is served),
+	// and an unattended host may never answer it; onboarding stays available via /tokenin add.
+	if (!ctx.hasUI || ctx.mode === "rpc") {
 		return;
 	}
 

package/dist/index.d.ts

@@ -26,7 +26,7 @@ export { type EditDiffResult, generateDiffString, generateUnifiedPatch } from ".
 export { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateLine, truncateTail, type WriteOperations, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
 export { hasTrustRequiringProjectResources, type ProjectTrustDecision, ProjectTrustStore, type ProjectTrustStoreEntry, type ProjectTrustUpdate, } from "./core/trust-manager.ts";
 export { type MainOptions, main } from "./main.ts";
-export { InteractiveMode, type InteractiveModeOptions, type ModelInfo, type PrintModeOptions, RpcClient, type RpcClientOptions, type RpcCommand, type RpcEventListener, type RpcExtensionUIRequest, type RpcExtensionUIResponse, type RpcResponse, type RpcSessionState, runPrintMode, runRpcMode, } from "./modes/index.ts";
+export { InteractiveMode, type InteractiveModeOptions, type ModelInfo, type PrintModeOptions, RpcClient, type RpcClientOptions, type RpcCommand, type RpcEvent, type SubagentRpcCommand, type SubagentRpcEvent, type SubagentRpcResponse, type SubagentRpcSnapshot, type SubagentRpcNode, type SubagentRpcFleet, type SubagentRpcTokens, type SubagentRpcLifecycle, type RpcObservationScope, type ReleaseCommand, type ReleaseResponse, type ReleaseResult, type ReleaseReadinessCommand, type ReleaseReadinessResponse, type ReleaseReadiness, type StopAllBackgroundCommand, type StopAllBackgroundResponse, type StopAllBackgroundResult, type StopAllBackgroundItem, type IntercomRpcCommand, type IntercomRpcResponse, type IntercomRpcEvent, type IntercomRpcStatus, type IntercomRpcDelivery, type IntercomRpcMessageOptions, type IntercomRpcDataMap, type RpcEventListener, type RpcExtensionUIRequest, type RpcExtensionUIResponse, type RpcResponse, type RpcSessionState, runPrintMode, runRpcMode, } from "./modes/index.ts";
 export { ArminComponent, AssistantMessageComponent, BashExecutionComponent, BorderedLoader, BranchSummaryMessageComponent, CompactionSummaryMessageComponent, CustomEditor, type CustomEditorOptions, CustomMessageComponent, DynamicBorder, ExtensionEditorComponent, ExtensionInputComponent, ExtensionSelectorComponent, FooterComponent, keyHint, keyText, LoginDialogComponent, ModelSelectorComponent, OAuthSelectorComponent, type RenderDiffOptions, rawKeyHint, renderDiff, SessionSelectorComponent, type SettingsCallbacks, type SettingsConfig, SettingsSelectorComponent, ShowImagesSelectorComponent, SkillInvocationMessageComponent, ThemeSelectorComponent, ThinkingSelectorComponent, ToolExecutionComponent, type ToolExecutionOptions, TreeSelectorComponent, truncateToVisualLines, UserMessageComponent, UserMessageSelectorComponent, type VisualTruncateResult, } from "./modes/interactive/components/index.ts";
 export { getLanguageFromPath, getMarkdownTheme, getSelectListTheme, getSettingsListTheme, highlightCode, initTheme, Theme, type ThemeColor, } from "./modes/interactive/theme/theme.ts";
 export { copyToClipboard } from "./utils/clipboard.ts";
@@ -35,3 +35,8 @@ export { convertToPng } from "./utils/image-convert.ts";
 export { formatDimensionNote, type ResizedImage, resizeImage } from "./utils/image-resize.ts";
 export { detectSupportedImageMimeTypeFromFile } from "./utils/mime.ts";
 export { getShellConfig } from "./utils/shell.ts";
+export { INTERCOM_RPC_REQUEST_EVENT, INTERCOM_RPC_RESULT_EVENT, INTERCOM_RPC_EVENT, INTERCOM_RPC_ASK_TIMEOUT_MS, intercomRpcTimeout, type IntercomRpcRequest, type IntercomRpcResult, } from "./core/intercom-rpc.ts";
+export { SUBAGENT_OBSERVE_EVENT, SUBAGENT_RPC_MAX_BYTES, type SubagentObserveRequest, type SubagentObservationSource, type SubagentRpcProjection } from "./core/subagent-rpc.ts";
+export type { IntercomRpcEventData } from "./core/intercom-rpc.ts";
+export { RELEASE_READINESS_EVENT, answerReleaseReadiness, isReleaseBlocker, type ReleaseBlocker, type ReleaseBlockerSource, type ReleaseReadinessRequest } from "./core/release-rpc.ts";
+export { STOP_ALL_BACKGROUND_EVENT, STOP_ALL_BACKGROUND_TIMEOUT_MS, answerStopAllBackground, isStopAllBackgroundItem, stopAllContributorError, type StopAllBackgroundRequest } from "./core/release-rpc.ts";

package/dist/index.js

@@ -46,3 +46,10 @@ export { formatDimensionNote, resizeImage } from "./utils/image-resize.js";
 export { detectSupportedImageMimeTypeFromFile } from "./utils/mime.js";
 // Shell utilities
 export { getShellConfig } from "./utils/shell.js";
+// Dedicated Intercom host/extension bridge (not a generic RPC event bus).
+export { INTERCOM_RPC_REQUEST_EVENT, INTERCOM_RPC_RESULT_EVENT, INTERCOM_RPC_EVENT, INTERCOM_RPC_ASK_TIMEOUT_MS, intercomRpcTimeout, } from "./core/intercom-rpc.js";
+export { SUBAGENT_OBSERVE_EVENT, SUBAGENT_RPC_MAX_BYTES } from "./core/subagent-rpc.js";
+// Release-readiness broadcast: extensions contribute blockers; the RPC host aggregates them.
+export { RELEASE_READINESS_EVENT, answerReleaseReadiness, isReleaseBlocker } from "./core/release-rpc.js";
+// Kill switch (`stop_all_background`): extensions register a stop handler next to their readiness contributor.
+export { STOP_ALL_BACKGROUND_EVENT, STOP_ALL_BACKGROUND_TIMEOUT_MS, answerStopAllBackground, isStopAllBackgroundItem, stopAllContributorError } from "./core/release-rpc.js";

package/dist/main.d.ts

@@ -7,5 +7,11 @@
 import type { InlineExtension } from "./core/extensions/types.ts";
 export interface MainOptions {
     extensionFactories?: InlineExtension[];
+    /**
+     * Built-in extensions arrive compiled in through `extensionFactories` (native
+     * binary), so the on-disk bundled extensions dir is shipped only for its
+     * assets and must not be loaded a second time.
+     */
+    builtinExtensionsCompiled?: boolean;
 }
 export declare function main(args: string[], options?: MainOptions): Promise<void>;

package/dist/main.js

@@ -545,7 +545,7 @@ export async function main(args, options) {
     const resolvedPromptTemplatePaths = resolveCliPaths(cwd, parsed.promptTemplates);
     const resolvedThemePaths = resolveCliPaths(cwd, parsed.themes);
     // Bundled Selesai resources ship in dist and load through the same hooks as CLI paths.
-    const bundledExtensionPaths = [getBundledExtensionsDir()];
+    const bundledExtensionPaths = options?.builtinExtensionsCompiled ? [] : [getBundledExtensionsDir()];
     const bundledThemePaths = [getBundledThemesDir()];
     const bundledSkillPaths = [getBundledSkillsDir()];
     const createRuntime = async ({ cwd, agentDir, sessionManager, sessionStartEvent, projectTrustContext, }) => {

package/dist/modes/index.d.ts

@@ -5,4 +5,4 @@ export { InteractiveMode, type InteractiveModeOptions } from "./interactive/inte
 export { type PrintModeOptions, runPrintMode } from "./print-mode.ts";
 export { type ModelInfo, RpcClient, type RpcClientOptions, type RpcEventListener } from "./rpc/rpc-client.ts";
 export { runRpcMode } from "./rpc/rpc-mode.ts";
-export type { RpcCommand, RpcExtensionUIRequest, RpcExtensionUIResponse, RpcResponse, RpcSessionState, PrototypePhase, QuicktypePhase, WorkflowState, } from "./rpc/rpc-types.ts";
+export type { RpcCommand, RpcEvent, SubagentRpcCommand, SubagentRpcEvent, SubagentRpcResponse, SubagentRpcSnapshot, SubagentRpcNode, SubagentRpcFleet, SubagentRpcTokens, SubagentRpcLifecycle, RpcObservationScope, ReleaseCommand, ReleaseResponse, ReleaseResult, ReleaseReadinessCommand, ReleaseReadinessResponse, ReleaseReadiness, StopAllBackgroundCommand, StopAllBackgroundResponse, StopAllBackgroundResult, StopAllBackgroundItem, IntercomRpcCommand, IntercomRpcResponse, IntercomRpcEvent, IntercomRpcStatus, IntercomRpcDelivery, IntercomRpcMessageOptions, IntercomRpcDataMap, RpcExtensionUIRequest, RpcExtensionUIResponse, RpcResponse, RpcSessionState, PrototypePhase, QuicktypePhase, WorkflowState, } from "./rpc/rpc-types.ts";

package/dist/modes/rpc/intercom-bridge.d.ts

@@ -0,0 +1,14 @@
+import type { EventBus } from "../../core/event-bus.ts";
+import { type IntercomRpcCommand, type IntercomRpcEvent } from "../../core/intercom-rpc.ts";
+import type { RpcResponse } from "./rpc-types.ts";
+/** One listener pair per bound session; replacement rejects pending calls and ignores stale results. */
+export declare class RpcIntercomBridge {
+    private disposed;
+    private readonly unsubscribe;
+    private readonly pending;
+    private readonly scope;
+    private readonly bus;
+    constructor(bus: EventBus | undefined, output: (event: IntercomRpcEvent) => void, sessionId: string, epoch?: string);
+    request(command: IntercomRpcCommand): Promise<RpcResponse>;
+    dispose(): void;
+}

package/dist/modes/rpc/intercom-bridge.js

@@ -0,0 +1,75 @@
+import { randomUUID } from "node:crypto";
+import { INTERCOM_RPC_EVENT, INTERCOM_RPC_REQUEST_EVENT, INTERCOM_RPC_RESULT_EVENT, intercomRpcTimeout, isIntercomRpcEvent, } from "../../core/intercom-rpc.js";
+/** One listener pair per bound session; replacement rejects pending calls and ignores stale results. */
+export class RpcIntercomBridge {
+    disposed = false;
+    unsubscribe = [];
+    pending = new Map();
+    scope;
+    bus;
+    constructor(bus, output, sessionId, epoch = randomUUID()) {
+        this.scope = { version: 1, sessionId, epoch };
+        this.bus = bus;
+        if (!bus)
+            return;
+        this.unsubscribe.push(bus.on(INTERCOM_RPC_EVENT, (event) => {
+            const envelope = event;
+            if (!this.disposed && envelope?.sessionId === sessionId && isIntercomRpcEvent(envelope.event))
+                output({ ...envelope.event, scope: this.scope });
+        }));
+        this.unsubscribe.push(bus.on(INTERCOM_RPC_RESULT_EVENT, (result) => {
+            if (this.disposed)
+                return;
+            const value = result;
+            if (!value || typeof value.requestId !== "string" || typeof value.success !== "boolean")
+                return;
+            this.pending.get(value.requestId)?.finish(value);
+        }));
+    }
+    request(command) {
+        const failure = (error) => ({ id: command.id, type: "response", command: command.type, success: false, error });
+        if (this.disposed)
+            return Promise.resolve(failure("Intercom session ended"));
+        if (!this.bus)
+            return Promise.resolve(failure("Intercom extension unavailable"));
+        let timeoutMs;
+        try {
+            timeoutMs = intercomRpcTimeout(command);
+        }
+        catch (error) {
+            return Promise.resolve(failure(error.message));
+        }
+        const requestId = randomUUID();
+        return new Promise((resolve) => {
+            const controller = new AbortController();
+            const timer = setTimeout(() => {
+                this.pending.get(requestId)?.finish({ requestId, success: false, error: "Intercom request timed out; timeout is not cancellation of delivered messages" });
+                controller.abort();
+            }, timeoutMs + 1000);
+            this.pending.set(requestId, {
+                controller,
+                finish: (result) => {
+                    clearTimeout(timer);
+                    this.pending.delete(requestId);
+                    resolve(result.success
+                        ? { id: command.id, type: "response", command: command.type, success: true, data: command.type === "intercom_status" ? { ...result.data, scope: this.scope } : result.data }
+                        : failure(result.error));
+                },
+            });
+            let accepted = false;
+            const request = { requestId, command, signal: controller.signal, accept: () => { accepted = true; } };
+            this.bus.emit(INTERCOM_RPC_REQUEST_EVENT, request);
+            if (!accepted)
+                this.pending.get(requestId)?.finish({ requestId, success: false, error: "Intercom extension unavailable" });
+        });
+    }
+    dispose() {
+        this.disposed = true;
+        for (const unsubscribe of this.unsubscribe)
+            unsubscribe();
+        for (const [requestId, pending] of [...this.pending]) {
+            pending.finish({ requestId, success: false, error: "Intercom session ended" });
+            pending.controller.abort();
+        }
+    }
+}