@zerwiz/ymir 0.1.3 → 0.1.5

package/.agents/tests/fm-opencode-primary-live-e2e.test.sh

@@ -0,0 +1,357 @@
+#!/usr/bin/env bash
+# Opt-in credentialed OpenCode continuity regression on an isolated project and
+# FM_HOME. Existing OpenCode credentials stay in their managed store.
+set -u
+
+if [ "${FM_OPENCODE_LIVE_E2E:-0}" != 1 ]; then
+  echo "skip: set FM_OPENCODE_LIVE_E2E=1 to run the interactive OpenCode continuity regression"
+  exit 0
+fi
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+unset NO_MISTAKES_GATE
+
+fail() {
+  printf 'not ok - %s\n' "$1" >&2
+  exit 1
+}
+
+command -v opencode >/dev/null 2>&1 || fail "opencode not found"
+command -v tmux >/dev/null 2>&1 || fail "tmux not found"
+command -v sqlite3 >/dev/null 2>&1 || fail "sqlite3 not found"
+
+TMUX=$(command -v tmux)
+SOCKET="fm-opencode-live-e2e-$$"
+SESSION=opencode-live-e2e
+LAB="$ROOT/.opencode-live-e2e.$$"
+PROJECT="$LAB/project"
+HOME_DIR="$LAB/fmhome"
+OPENCODE_VERSION=$(opencode --version)
+AHOY_PROJECT="$LAB/ahoy-project"
+# shellcheck source=/dev/null
+. "$ROOT/bin/fm-operational-input.sh"
+# shellcheck disable=SC2016 # Backticks are literal prompt markup.
+LEGACY_START='Run `bin/fm-session-start.sh` now, exactly once, before executing any other instructions.'
+fm_operational_input_encode session-start "$LEGACY_START" CURRENT_START \
+  || fail "could not construct the current session-start fixture"
+MARKER_NEAR_MISS=$'\xE2\x81\xA3Captain note: this invisible separator is intentional.'
+# shellcheck disable=SC2016 # Backticks are literal prompt markup.
+START_NEAR_MISS='Captain quote: Run `bin/fm-session-start.sh` now, exactly once, before executing any other instructions.'
+fm_operational_input_encode watcher "CURRENT_AHOY_WATCHER_BODY" CURRENT_WATCHER \
+  || fail "could not construct current Ahoy watcher fixture"
+QUOTED_CURRENT="Captain quote: $CURRENT_WATCHER"
+ASCII_ONLY='FIRSTMATE_OP: v1 watcher: captain-authored text'
+
+capture() {
+  "$TMUX" -L "$SOCKET" capture-pane -p -t "$SESSION" -S -800 2>/dev/null || true
+}
+
+wait_for_text() {
+  local expected=$1 attempts=${2:-180} i=0
+  while [ "$i" -lt "$attempts" ]; do
+    capture | grep -Fq "$expected" && return 0
+    sleep 0.5
+    i=$((i + 1))
+  done
+  capture >&2
+  return 1
+}
+
+wait_for_absent() {
+  local unexpected=$1 attempts=${2:-60} i=0
+  while [ "$i" -lt "$attempts" ]; do
+    capture | grep -Fq "$unexpected" || return 0
+    sleep 0.5
+    i=$((i + 1))
+  done
+  capture >&2
+  return 1
+}
+
+dismiss_update_offer() {
+  capture | grep -Fq "Update Available" || return 0
+  # Choose Skip explicitly. Escape merely hides the offer until the next idle
+  # event, which can obstruct the watcher follow-up under test.
+  "$TMUX" -L "$SOCKET" send-keys -t "$SESSION" Left Enter
+  wait_for_absent "Update Available" 60
+}
+
+wait_for_handled() {
+  local i=0
+  while [ "$i" -lt 240 ]; do
+    dismiss_update_offer || return 1
+    [ -f "$HOME_DIR/state/opencode-model-handled" ] && return 0
+    sleep 0.5
+    i=$((i + 1))
+  done
+  capture >&2
+  return 1
+}
+
+lab_pid_is_safe() {
+  local pid=$1 command
+  command=$(ps -p "$pid" -o command= 2>/dev/null || true)
+  case "$command" in
+    *"$LAB"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+cleanup() {
+  local watcher_pid arm_pid
+  watcher_pid=$(cat "$HOME_DIR/state/.watch.lock/pid" 2>/dev/null || true)
+  arm_pid=$(ps -p "$watcher_pid" -o ppid= 2>/dev/null | tr -d ' ' || true)
+  "$TMUX" -L "$SOCKET" kill-server 2>/dev/null || true
+  sleep 0.1
+  if [ -n "$watcher_pid" ] && lab_pid_is_safe "$watcher_pid"; then
+    kill -TERM "$watcher_pid" 2>/dev/null || true
+  fi
+  if [ -n "$arm_pid" ] && lab_pid_is_safe "$arm_pid"; then
+    kill -TERM "$arm_pid" 2>/dev/null || true
+  fi
+  rm -rf "$LAB"
+}
+trap cleanup EXIT
+
+run_ahoy_case() {
+  local label=$1 preceding=$2 expected=$3 db="$LAB/opencode-$1.db"
+  local assistant_text first_out second_out session_id status=0
+  first_out=$(
+    cd "$AHOY_PROJECT" &&
+      OPENCODE_DB="$db" OPENCODE_DISABLE_AUTOUPDATE=1 OPENCODE_DISABLE_LSP_DOWNLOAD=1 \
+        OPENCODE_CONFIG_CONTENT='{"permission":{"*":"allow"}}' \
+        opencode run --pure --format json "$preceding"
+  ) || status=$?
+  [ "$status" -eq 0 ] || fail "OpenCode Ahoy $label setup exited $status: $first_out"
+  session_id=$(printf '%s\n' "$first_out" | jq -r 'select(.sessionID != null) | .sessionID' | head -1)
+  [ -n "$session_id" ] || fail "OpenCode Ahoy $label setup did not return a session id: $first_out"
+
+  status=0
+  second_out=$(
+    cd "$AHOY_PROJECT" &&
+      OPENCODE_DB="$db" OPENCODE_DISABLE_AUTOUPDATE=1 OPENCODE_DISABLE_LSP_DOWNLOAD=1 \
+        OPENCODE_CONFIG_CONTENT='{"permission":{"*":"allow"}}' \
+        opencode run --pure --format json --session "$session_id" "/ahoy"
+  ) || status=$?
+  [ "$status" -eq 0 ] || fail "OpenCode Ahoy $label case exited $status: $second_out"
+  assistant_text=$(printf '%s\n' "$second_out" | jq -r 'select(.type == "text") | .part.text' | tail -1)
+  case "$expected" in
+    bearings)
+      printf '%s\n' "$assistant_text" | grep -Fq "AHOY_BEARINGS_BRANCH" \
+        || fail "OpenCode Ahoy $label case did not take Bearings: $second_out"
+      ;;
+    boundary)
+      printf '%s\n' "$assistant_text" | grep -Fq "AHOY_BEARINGS_BRANCH" \
+        && fail "OpenCode Ahoy $label near miss was treated as operational: $second_out"
+      ;;
+  esac
+}
+
+run_ahoy_transcript_regressions() {
+  mkdir -p \
+    "$AHOY_PROJECT/.opencode/plugins" \
+    "$AHOY_PROJECT/.agents/skills/ahoy" \
+    "$AHOY_PROJECT/.agents/skills/bearings" \
+    "$AHOY_PROJECT/bin"
+  git init -q "$AHOY_PROJECT"
+  cp "$ROOT/.opencode/plugins/fm-primary-sessionstart-nudge.js" \
+    "$ROOT/.opencode/plugins/package.json" \
+    "$AHOY_PROJECT/.opencode/plugins/"
+  cp \
+    "$ROOT/bin/fm-sessionstart-nudge.sh" \
+    "$ROOT/bin/fm-primary-scope-lib.sh" \
+    "$ROOT/bin/fm-gate-refuse-lib.sh" \
+    "$ROOT/bin/fm-operational-input.sh" \
+    "$AHOY_PROJECT/bin/"
+  cp "$ROOT/.agents/skills/ahoy/SKILL.md" "$AHOY_PROJECT/.agents/skills/ahoy/SKILL.md"
+  chmod +x "$AHOY_PROJECT/bin/fm-sessionstart-nudge.sh"
+  # shellcheck disable=SC2016 # Variables expand in the generated script, not this test shell.
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -u' \
+    'file="${FM_HOME:?}/state/session-start-count"' \
+    'count=0' \
+    '[ ! -f "$file" ] || count=$(sed -n "1p" "$file")' \
+    'count=$((count + 1))' \
+    'printf "%s\n" "$count" > "$file"' \
+    'printf "SESSION_START_DONE count=%s\n" "$count"' \
+    > "$AHOY_PROJECT/bin/fm-session-start.sh"
+  chmod +x "$AHOY_PROJECT/bin/fm-session-start.sh"
+  # shellcheck disable=SC2016 # Backticks are literal prompt markup.
+  printf '%s\n' \
+    '---' \
+    'name: bearings' \
+    'description: Test-only Bearings branch sentinel.' \
+    '---' \
+    '' \
+    '# bearings' \
+    '' \
+    'Respond exactly `AHOY_BEARINGS_BRANCH`.' \
+    > "$AHOY_PROJECT/.agents/skills/bearings/SKILL.md"
+  # shellcheck disable=SC2016 # Backticks are literal prompt markup.
+  printf '%s\n' \
+    '# Native OpenCode Ahoy regression fixture' \
+    '' \
+    'Run `bin/fm-session-start.sh` exactly once at session start.' \
+    > "$AHOY_PROJECT/AGENTS.md"
+
+  run_ahoy_case marker-near-miss "$MARKER_NEAR_MISS" boundary
+  run_ahoy_case startup-near-miss "$START_NEAR_MISS" boundary
+  run_ahoy_case quoted-current "$QUOTED_CURRENT" boundary
+  run_ahoy_case ascii-only "$ASCII_ONLY" boundary
+}
+
+wait_for_db_count() {
+  local db=$1 query=$2 expected=$3 attempts=${4:-180} i=0 actual
+  while [ "$i" -lt "$attempts" ]; do
+    actual=
+    if [ -f "$db" ]; then
+      actual=$(sqlite3 "$db" "$query" 2>/dev/null || true)
+    fi
+    [ "$actual" = "$expected" ] && return 0
+    sleep 0.5
+    i=$((i + 1))
+  done
+  return 1
+}
+
+run_native_ahoy_regressions() {
+  local first_home="$LAB/opencode-ahoy-first-home"
+  local later_home="$LAB/opencode-ahoy-later-home"
+  local first_db="$LAB/opencode-ahoy-first.db"
+  local later_db="$LAB/opencode-ahoy-later.db"
+  local native_session=opencode-ahoy-native
+  local session_id startup_text assistant_text session_count status
+
+  mkdir -p \
+    "$first_home/state" "$first_home/config" \
+    "$later_home/state" "$later_home/config"
+
+  status=0
+  (
+    cd "$AHOY_PROJECT" &&
+      OPENCODE_DB="$first_db" FM_HOME="$first_home" \
+        OPENCODE_DISABLE_AUTOUPDATE=1 OPENCODE_DISABLE_LSP_DOWNLOAD=1 \
+        OPENCODE_CONFIG_CONTENT='{"permission":{"*":"allow"}}' \
+        opencode run --format json --auto "/ahoy"
+  ) >/dev/null || status=$?
+  [ "$status" -eq 0 ] || fail "OpenCode native first-message Ahoy exited $status"
+  session_id=$(sqlite3 "$first_db" 'select id from session order by time_created desc limit 1;')
+  startup_text=$(sqlite3 -json "$first_db" \
+    "select json_extract(p.data,'$.text') text from message m join part p on p.message_id=m.id where json_extract(m.data,'$.role')='user' and json_extract(p.data,'$.text') like '%FIRSTMATE_OP:%' order by m.time_created limit 1;" \
+    | jq -r '.[0].text')
+  [ "$startup_text" = "$CURRENT_START" ] \
+    || fail "OpenCode native first-message session stored an unexpected typed startup input: $startup_text"
+  assistant_text=$(sqlite3 -json "$first_db" \
+    "select json_extract(p.data,'$.text') text from message m join part p on p.message_id=m.id where json_extract(m.data,'$.role')='assistant' and json_extract(p.data,'$.type')='text' order by m.time_created desc limit 1;" \
+    | jq -r '.[0].text')
+  printf '%s\n' "$assistant_text" | grep -Fq "AHOY_BEARINGS_BRANCH" \
+    || fail "OpenCode native first-message Ahoy did not take Bearings: $assistant_text"
+  [ "$(sed -n '1p' "$first_home/state/session-start-count")" = 1 ] \
+    || fail "OpenCode native first-message Ahoy did not preserve one session-start execution"
+  session_count=$(sqlite3 "$first_db" 'select count(*) from session;')
+  [ "$session_count" = 1 ] || fail "OpenCode native first-message Ahoy left the original session"
+
+  "$TMUX" -L "$SOCKET" new-session -d -s "$native_session" -c "$AHOY_PROJECT" \
+    "env OPENCODE_DB='$later_db' FM_HOME='$later_home' OPENCODE_DISABLE_AUTOUPDATE=1 OPENCODE_DISABLE_LSP_DOWNLOAD=1 OPENCODE_CONFIG_CONTENT='{\"permission\":{\"*\":\"allow\"}}' opencode --auto"
+  i=0
+  while [ "$i" -lt 120 ]; do
+    "$TMUX" -L "$SOCKET" capture-pane -p -t "$native_session" 2>/dev/null | grep -Fq "$OPENCODE_VERSION" && break
+    sleep 0.5
+    i=$((i + 1))
+  done
+  [ "$i" -lt 120 ] || fail "OpenCode native later-message session did not reach its TUI"
+  "$TMUX" -L "$SOCKET" send-keys -t "$native_session" -l "Respond exactly PRIOR_BOUNDARY_ACK."
+  "$TMUX" -L "$SOCKET" send-keys -t "$native_session" Enter
+  wait_for_db_count "$later_db" \
+    "select count(*) from message m join part p on p.message_id=m.id where json_extract(m.data,'$.role')='assistant' and json_extract(p.data,'$.type')='text' and json_extract(p.data,'$.text') like '%PRIOR_BOUNDARY_ACK%';" \
+    1 || fail "OpenCode native later-message setup did not preserve the genuine captain boundary"
+  session_id=$(sqlite3 "$later_db" 'select id from session order by time_created desc limit 1;')
+  [ "$(sed -n '1p' "$later_home/state/session-start-count")" = 1 ] \
+    || fail "OpenCode native later-message setup did not run session start exactly once"
+  "$TMUX" -L "$SOCKET" kill-server
+
+  status=0
+  (
+    cd "$AHOY_PROJECT" &&
+      OPENCODE_DB="$later_db" FM_HOME="$later_home" \
+        OPENCODE_DISABLE_AUTOUPDATE=1 OPENCODE_DISABLE_LSP_DOWNLOAD=1 \
+        OPENCODE_CONFIG_CONTENT='{"permission":{"*":"allow"}}' \
+        opencode run --format json --auto --session "$session_id" "/ahoy"
+  ) >/dev/null || status=$?
+  [ "$status" -eq 0 ] || fail "OpenCode native later-message Ahoy exited $status"
+  assistant_text=$(sqlite3 -json "$later_db" \
+    "select json_extract(p.data,'$.text') text from message m join part p on p.message_id=m.id where m.session_id='$session_id' and json_extract(m.data,'$.role')='assistant' and json_extract(p.data,'$.type')='text' order by m.time_created desc limit 1;" \
+    | jq -r '.[0].text')
+  printf '%s\n' "$assistant_text" | grep -Fq "AHOY_BEARINGS_BRANCH" \
+    && fail "OpenCode native later-message Ahoy gathered Bearings: $assistant_text"
+  [ "$(sed -n '1p' "$later_home/state/session-start-count")" = 1 ] \
+    || fail "OpenCode native later-message Ahoy reran session start"
+  session_count=$(sqlite3 "$later_db" 'select count(*) from session;')
+  [ "$session_count" = 1 ] || fail "OpenCode native later-message Ahoy left the original session"
+}
+
+mkdir -p "$LAB"
+run_ahoy_transcript_regressions
+run_native_ahoy_regressions
+git clone -q "$ROOT" "$PROJECT"
+mkdir -p "$PROJECT/.opencode/plugins/lib"
+cp "$ROOT/.opencode/plugins/fm-primary-watch-arm.js" "$PROJECT/.opencode/plugins/fm-primary-watch-arm.js"
+cp "$ROOT/.opencode/plugins/lib/fm-operational-input.js" "$PROJECT/.opencode/plugins/lib/fm-operational-input.js"
+cp "$ROOT/bin/fm-watch-arm.sh" "$PROJECT/bin/fm-watch-arm.sh"
+cp "$ROOT/bin/fm-operational-input.sh" "$PROJECT/bin/fm-operational-input.sh"
+chmod +x "$PROJECT/bin/fm-operational-input.sh"
+mkdir -p "$HOME_DIR/state" "$HOME_DIR/config"
+printf 'project=fixture\n' > "$HOME_DIR/state/opencode-e2e.meta"
+
+# shellcheck disable=SC2016 # The model, not this test shell, expands FM_HOME.
+PROMPT='Use the terminal to run `printf ready > "$FM_HOME/state/opencode-model-initial"`, then respond briefly. If a later watcher wake arrives, run bin/fm-wake-drain.sh, then run `printf handled > "$FM_HOME/state/opencode-model-handled"`. Never run or request any watcher arm command.'
+"$TMUX" -L "$SOCKET" new-session -d -s "$SESSION" -c "$PROJECT" \
+  "env OPENCODE_CONFIG_CONTENT='{\"permission\":{\"*\":\"allow\"}}' FM_HOME='$HOME_DIR' FM_ROOT_OVERRIDE='$PROJECT' FM_POLL=1 FM_SIGNAL_GRACE=0 FM_HEARTBEAT=600 bash -lc 'printf \"%s\\n\" \"\$\$\" > \"\$FM_HOME/state/.lock\"; opencode --auto; rc=\$?; printf \"OPENCODE_EXIT=%s\\n\" \"\$rc\"; sleep 300'"
+
+# Send the initial prompt through the ready composer so this exercises the same
+# persistent TUI path as a primary session.
+wait_for_text "$OPENCODE_VERSION" 120 || fail "OpenCode did not reach its TUI"
+dismiss_update_offer || fail "OpenCode update offer did not dismiss"
+sleep 1
+"$TMUX" -L "$SOCKET" send-keys -t "$SESSION" -l "$PROMPT"
+"$TMUX" -L "$SOCKET" send-keys -t "$SESSION" Enter
+i=0
+while [ "$i" -lt 240 ]; do
+  dismiss_update_offer || fail "OpenCode update offer obstructed the initial turn"
+  [ -f "$HOME_DIR/state/opencode-model-initial" ] && break
+  sleep 0.5
+  i=$((i + 1))
+done
+[ -f "$HOME_DIR/state/opencode-model-initial" ] || fail "OpenCode credentialed initial turn did not complete"
+
+i=0
+while [ "$i" -lt 120 ]; do
+  watcher_pid=$(cat "$HOME_DIR/state/.watch.lock/pid" 2>/dev/null || true)
+  [ -n "$watcher_pid" ] && kill -0 "$watcher_pid" 2>/dev/null && break
+  sleep 0.5
+  i=$((i + 1))
+done
+if [ -z "${watcher_pid:-}" ] || ! kill -0 "$watcher_pid" 2>/dev/null; then
+  fail "OpenCode idle event did not start the initial watcher"
+fi
+
+printf 'done: opencode live e2e watcher fire\n' > "$HOME_DIR/state/opencode-e2e.status"
+i=0
+while [ "$i" -lt 240 ]; do
+  grep -Eq 'reason=actionable-signal.*successor=started:[0-9]+' "$HOME_DIR/state/.watch-cycle-exits.log" 2>/dev/null && break
+  sleep 0.5
+  i=$((i + 1))
+done
+grep -Eq 'reason=actionable-signal.*successor=started:[0-9]+' "$HOME_DIR/state/.watch-cycle-exits.log" 2>/dev/null \
+  || fail "OpenCode plugin did not start and ledger-link a successor after the actionable close"
+wait_for_handled || fail "OpenCode did not drain and settle after plugin-owned re-arm"
+
+pane=$(capture)
+guard_count=$(printf '%s\n' "$pane" | grep -Fc "TURN WOULD END BLIND - supervision is off." || true)
+[ "$guard_count" -eq 0 ] || fail "OpenCode successor was not protecting the next idle event (guard count $guard_count)"
+if printf '%s\n' "$pane" | grep -Fq '$ bin/fm-watch-arm.sh'; then
+  fail "OpenCode model attempted to re-arm instead of leaving continuity to the plugin"
+fi
+
+printf 'ok - OpenCode %s live E2E covered native Ahoy first/later messages, near misses, and watcher continuity\n' "$OPENCODE_VERSION"

package/.agents/tests/fm-operational-input.test.sh

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+# Canonical current and isolated legacy operational-input protocol matrices.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+OWNER="$ROOT/bin/fm-operational-input.sh"
+# shellcheck source=/dev/null
+. "$OWNER"
+
+cleanup() {
+  fm_test_cleanup
+}
+trap cleanup EXIT
+
+classify_cli() {
+  printf '%s' "$1" | "$OWNER" classify 2>/dev/null
+}
+
+kind_cli() {
+  printf '%s' "$1" | "$OWNER" kind 2>/dev/null
+}
+
+test_current_generic_matrix() {
+  local kind body encoded parsed stripped prefix_hex
+  prefix_hex=$(printf '%s' "$FM_OPERATIONAL_PREFIX" | od -An -tx1 | tr -d ' \n')
+  [ "$prefix_hex" = e281a346495253544d4154455f4f503a20 ] \
+    || fail "current operational prefix lost the landed U+2063 FIRSTMATE_OP bytes: $prefix_hex"
+
+  for kind in session-start watcher turn-end-guard away-supervisor launch-brief branch-outcome; do
+    body="CURRENT_BODY_FOR_${kind}"
+    fm_operational_input_encode "$kind" "$body" encoded \
+      || fail "could not encode current $kind fixture"
+    fm_operational_input_kind "$encoded" parsed \
+      || fail "could not parse current $kind fixture"
+    [ "$parsed" = "$kind" ] \
+      || fail "current $kind fixture became $parsed"
+    [ "$(kind_cli "$encoded")" = "$kind" ] \
+      || fail "cross-language CLI lost current $kind"
+    [ "$(classify_cli "$encoded")" = "$kind" ] \
+      || fail "classifier lost current $kind"
+    fm_operational_input_body "$encoded" stripped \
+      || fail "could not recover current $kind body"
+    [ "$stripped" = "$body" ] \
+      || fail "current $kind body changed during encode/parse"
+  done
+  pass "operational input: every current generic envelope retains its exact structured kind"
+}
+
+test_current_from_firstmate_carrier() {
+  local encoded parsed separator
+  separator=$(printf '\342\201\243')
+  fm_message_mark_from_firstmate "corr=0123456789abcdef inspect the report" encoded
+  [ "${encoded#"[fm-from-firstmate]$separator"}" != "$encoded" ] \
+    || fail "from-firstmate lost its live-charter-compatible leading carrier"
+  fm_operational_input_kind "$encoded" parsed \
+    || fail "from-firstmate current carrier did not parse"
+  [ "$parsed" = from-firstmate ] \
+    || fail "from-firstmate current carrier became $parsed"
+  [ "$(classify_cli "$encoded")" = from-firstmate ] \
+    || fail "cross-language classifier lost from-firstmate"
+  pass "operational input: the established from-firstmate carrier remains structurally typed and byte-compatible"
+}
+
+test_landed_untyped_prefix_is_explicitly_legacy() {
+  local untyped parsed
+  untyped="${FM_OPERATIONAL_PREFIX}body whose historical subtype is unknowable"
+  fm_legacy_operational_input_kind "$untyped" parsed \
+    || fail "landed untyped FIRSTMATE_OP input was not retained"
+  [ "$parsed" = legacy-operational ] \
+    || fail "landed untyped FIRSTMATE_OP input falsely became $parsed"
+  ! fm_operational_input_kind "$untyped" parsed \
+    || fail "untyped FIRSTMATE_OP input passed the current typed parser"
+  [ "$(classify_cli "$untyped")" = legacy-operational ] \
+    || fail "CLI did not expose the untyped prefix as legacy-operational"
+  pass "operational input: untyped landed FIRSTMATE_OP transcripts are explicit legacy-operational input"
+}
+
+test_isolated_legacy_matrix() {
+  local watcher turnend away parsed
+  watcher="${FM_LEGACY_WATCHER_PREFIX}signal: legacy${FM_LEGACY_WATCHER_SUFFIX}"
+  turnend="${FM_LEGACY_TURNEND_PREFIX}watcher: FAILED - legacy"
+  away="${FM_LEGACY_AWAY_PREFIX}1 event(s)): done: legacy"
+
+  for fixture in \
+    "session-start|$FM_LEGACY_SESSIONSTART" \
+    "watcher|$watcher" \
+    "turn-end-guard|$turnend" \
+    "away-supervisor|$away"
+  do
+    expected=${fixture%%|*}
+    message=${fixture#*|}
+    ! fm_operational_input_kind "$message" parsed \
+      || fail "legacy $expected fixture leaked into the current parser"
+    fm_legacy_operational_input_kind "$message" parsed \
+      || fail "legacy $expected fixture was not recognized"
+    [ "$parsed" = "$expected" ] \
+      || fail "legacy $expected fixture became $parsed"
+  done
+  pass "operational input: historical prose compatibility is isolated from current parsing"
+}
+
+test_genuine_near_misses_remain_unclassified() {
+  local marker fixture parsed
+  marker=$FM_OPERATIONAL_MARK
+  while IFS= read -r fixture || [ -n "$fixture" ]; do
+    [ -n "$fixture" ] || continue
+    ! fm_operational_input_classify "$fixture" parsed \
+      || fail "genuine near miss was classified as $parsed: $fixture"
+    [ -z "$(classify_cli "$fixture" || true)" ] \
+      || fail "CLI classified a genuine near miss: $fixture"
+  done <<EOF
+Captain quote: ${FM_OPERATIONAL_PREFIX}v1 watcher
+FIRSTMATE_OP: v1 watcher
+$marker arbitrary captain text
+Captain quote: $FM_LEGACY_SESSIONSTART
+${FM_LEGACY_SESSIONSTART} Please explain this sentence.
+FIRSTMATE WATCHER WAKE: can you explain this phrase?
+TURN WOULD END BLIND - can you make this warning friendlier?
+Supervisor escalate (1 event(s)): is this wording clear?
+[fm-from-firstmate] inspect this visible label
+EOF
+  pass "operational input: quoted, ASCII-only, arbitrary-U+2063, altered-legacy, and label-only near misses stay genuine"
+}
+
+test_cross_language_adapter_uses_the_owner() {
+  local encoded parsed
+  encoded=$(FM_TEST_ROOT="$ROOT" HELPER="$ROOT/.opencode/plugins/lib/fm-operational-input.js" \
+    node --input-type=module <<'JS'
+import { pathToFileURL } from "node:url";
+const { encodeFirstmateOperationalInput } = await import(pathToFileURL(process.env.HELPER).href);
+process.stdout.write(await encodeFirstmateOperationalInput(process.env.FM_TEST_ROOT, "watcher", "CROSS_LANGUAGE_BODY"));
+JS
+  ) || fail "OpenCode cross-language adapter could not invoke the canonical owner"
+  fm_operational_input_kind "$encoded" parsed \
+    || fail "OpenCode cross-language adapter returned an invalid current envelope"
+  [ "$parsed" = watcher ] \
+    || fail "OpenCode cross-language adapter changed watcher to $parsed"
+  pass "operational input: the OpenCode adapter constructs through the canonical owner"
+}
+
+test_invalid_current_encodings_are_rejected() {
+  local output
+  output=$(printf 'body' | "$OWNER" encode legacy-operational 2>/dev/null) \
+    && fail "legacy-operational was accepted as a current producer kind"
+  [ -z "$output" ] || fail "invalid current kind printed protocol data"
+  output=$(printf '' | "$OWNER" encode watcher 2>/dev/null) \
+    && fail "empty current operational body was accepted"
+  [ -z "$output" ] || fail "empty current body printed protocol data"
+  pass "operational input: current construction rejects legacy kinds and empty bodies"
+}
+
+test_current_generic_matrix
+test_current_from_firstmate_carrier
+test_landed_untyped_prefix_is_explicitly_legacy
+test_isolated_legacy_matrix
+test_genuine_near_misses_remain_unclassified
+test_cross_language_adapter_uses_the_owner
+test_invalid_current_encodings_are_rejected

package/.agents/tests/fm-peek-remote.test.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# fm-peek remote-secondmate capture routing.
+#
+# A remote secondmate's pane lives on its own host. The old path resolved the
+# meta's "remote:<id>" window through the local backend adapters and handed it
+# to tmux, which failed with "can't find session: remote" - a healthy remote
+# mate misreported as an unreadable endpoint. These tests drive the real
+# fm-peek + fm-on executables with a stubbed ssh transport (FM_SSH_BIN seam)
+# and a poisoned local tmux, pinning:
+#   1. A remote selector routes the capture over the remote transport and
+#      prints the remote pane tail; the local adapters are never consulted.
+#   2. An unreachable host fails loudly naming the host, without claiming the
+#      mate is dead.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+PEEK="$ROOT/bin/fm-peek.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-peek-remote)
+
+# fake-ssh prints the canned remote capture; the poisoned tmux records any
+# local read attempt so the "never consulted" property is a real assertion.
+make_stubs() {  # <dir> -> echoes fakebin dir
+  local dir=$1 fb="$1/fakebin"
+  mkdir -p "$fb"
+  cat > "$fb/fake-ssh" <<'SH'
+#!/usr/bin/env bash
+cat > /dev/null
+[ -z "${FM_FAKE_REMOTE_CAPTURE:-}" ] || printf '%s\n' "$FM_FAKE_REMOTE_CAPTURE"
+exit "${FM_FAKE_SSH_RC:-0}"
+SH
+  chmod +x "$fb/fake-ssh"
+  cat > "$fb/tmux" <<'SH'
+#!/usr/bin/env bash
+printf 'tmux\n' >> "${FM_FAKE_TMUX_TOUCHED:?}"
+exit 1
+SH
+  chmod +x "$fb/tmux"
+  printf '%s\n' "$fb"
+}
+
+setup_remote_home() {  # <name> -> echoes home dir with remote meta + registry
+  local home="$TMP_ROOT/$1-$RANDOM"
+  mkdir -p "$home/state" "$home/data"
+  fm_write_meta "$home/state/rsm.meta" \
+    "window=remote:rsm" \
+    "endpoint_task_id=rsm" \
+    "harness=claude" \
+    "kind=secondmate" \
+    "mode=secondmate" \
+    "remote_host=remote-mac" \
+    "remote_root=/remote/root" \
+    "remote_backend=herdr" \
+    "remote_herdr_session=fm-remote" \
+    "remote_target=fm-remote:w1:p1"
+  cat > "$home/data/secondmates.md" <<EOF
+- rsm - remote test domain (host: remote-mac; root: /remote/root; home: /remote/home; scope: remote testing; projects: alpha; added 2026-08-02)
+EOF
+  printf '%s\n' "$home"
+}
+
+test_remote_peek_reads_remote_pane() {
+  local dir fb home touched rc out
+  dir="$TMP_ROOT/peek-ok"; mkdir -p "$dir"
+  fb=$(make_stubs "$dir")
+  home=$(setup_remote_home peek-ok)
+  touched="$dir/tmux-touched"; : > "$touched"
+
+  out=$(env PATH="$fb:$PATH" \
+    FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+    FM_SSH_BIN="$fb/fake-ssh" FM_FAKE_SSH_RC=0 \
+    FM_FAKE_REMOTE_CAPTURE='● the remote mate is mid-refactor' \
+    FM_FAKE_TMUX_TOUCHED="$touched" \
+    "$PEEK" rsm 20 2>"$dir/err"); rc=$?
+  expect_code 0 "$rc" "a healthy remote peek should succeed"
+  assert_contains "$out" "the remote mate is mid-refactor" \
+    "the remote pane tail should be printed"
+  assert_not_contains "$out" "can't find session" \
+    "a remote peek must not fall into a local session lookup"
+  [ ! -s "$touched" ] || fail "the local tmux adapter was consulted for a remote target"
+  pass "fm-peek remote: the capture routes over the remote transport, local adapters untouched"
+}
+
+test_remote_peek_unreachable_fails_loudly_without_death_claim() {
+  local dir fb home touched rc err
+  dir="$TMP_ROOT/peek-down"; mkdir -p "$dir"
+  fb=$(make_stubs "$dir")
+  home=$(setup_remote_home peek-down)
+  touched="$dir/tmux-touched"; : > "$touched"
+
+  env PATH="$fb:$PATH" \
+    FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+    FM_SSH_BIN="$fb/fake-ssh" FM_FAKE_SSH_RC=255 \
+    FM_FAKE_TMUX_TOUCHED="$touched" \
+    "$PEEK" rsm >"$dir/out" 2>"$dir/err"; rc=$?
+  err=$(cat "$dir/err")
+  [ "$rc" -ne 0 ] || fail "an unreachable remote peek must exit nonzero"
+  assert_contains "$err" "remote pane of rsm on remote-mac" \
+    "the failure must name the remote mate and host"
+  assert_contains "$err" "not thereby dead" \
+    "an unreadable remote pane must not be presented as a dead mate"
+  pass "fm-peek remote: an unreachable host fails loudly without a false death claim"
+}
+
+test_remote_peek_reads_remote_pane
+test_remote_peek_unreachable_fails_loudly_without_death_claim
+
+echo "all fm-peek-remote tests passed"