agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/adapters/agent-health.js

@@ -1,9 +1,33 @@
-import { spawn } from "node:child_process";
-import fs from "node:fs";
-import { claudeBinExists, cursorBinExists, resolveClaudeBin, cursorInvokeArgs, resolveCursorBin, } from "../cli-env.js";
-import { checkAgentDeckHealth, isAgentDeckMcpRegistered } from "./agent-deck.js";
+import { spawn, spawnSync } from "node:child_process";
+import { CODEX_AUTH_REMEDIATION, cursorAuthIssueFromOutput, runtimeAuthIssueFromOutput, } from "@agent-dealer/shared";
+import { claudeBinExists, cursorBinExists, resolveClaudeBin, cursorInvokeArgs, resolveCursorBin, resolveCodexBin, codexBinExists, } from "../cli-env.js";
+import { checkAgentDeckHealth, fetchDecks, isAgentDeckMcpRegistered } from "./agent-deck.js";
+import { runtimeAvailability } from "../repository/runtime-availability.js";
+const RUNTIME_LABEL = {
+    claude_code: "Claude",
+    cursor_local: "Cursor",
+    codex_local: "Codex",
+};
+function capHealthIssues(runtime) {
+    const avail = runtimeAvailability(runtime);
+    if (avail.available)
+        return [];
+    const until = new Date(avail.until).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+    return [
+        {
+            code: "usage_capped",
+            message: `${RUNTIME_LABEL[runtime]} capped until ${until}`,
+        },
+    ];
+}
 const RUNTIME_CACHE_MS = 60_000;
 const runtimeIssueCache = new Map();
+let githubIssueCache = null;
+/** Exported for tests — clears the shared github + runtime health caches. */
+export function clearAgentHealthCaches() {
+    runtimeIssueCache.clear();
+    githubIssueCache = null;
+}
 function runCommand(cmd, args, timeoutMs = 8000) {
     return new Promise((resolve) => {
         const child = spawn(cmd, args, {
@@ -31,50 +55,216 @@ function runCommand(cmd, args, timeoutMs = 8000) {
         });
     });
 }
-async function runtimeIssuesUncached(runtime) {
+/** Exported for direct testing — bypasses the 60s cache in runtimeIssues(). */
+export async function runtimeIssuesUncached(runtime) {
+    const issues = [];
     if (runtime === "claude_code") {
-        if (claudeBinExists())
-            return [];
-        const ver = await runCommand(resolveClaudeBin(), ["--version"]);
-        if (!ver.ok) {
-            return [{ code: "cli_missing", message: "Claude CLI not found — install Claude Code" }];
+        if (!claudeBinExists()) {
+            const ver = await runCommand(resolveClaudeBin(), ["--version"]);
+            if (!ver.ok) {
+                issues.push({ code: "cli_missing", message: "Claude CLI not found — install Claude Code" });
+                return issues;
+            }
         }
-        return [];
+        // NOT-133: Claude had no auth preflight at all, so a logged-out Claude agent was admitted
+        // exactly the way a logged-out Cursor one was. `claude auth status` is local, offline and
+        // free (it reads the credential store and prints JSON) — unlike `claude -p`, which bills.
+        // Its output is what gets classified, not its exit code: logged out it prints
+        // `"loggedIn": false` *and* exits 1, so only the positive signal in the body blocks. An
+        // older CLI without the subcommand prints an unknown-command error that matches nothing,
+        // and must not become a false block.
+        if (!claudeUsesThirdPartyProvider()) {
+            const auth = await runCommand(resolveClaudeBin(), ["auth", "status"]);
+            const authIssue = runtimeAuthIssueFromOutput("claude_code", auth.output);
+            if (authIssue)
+                issues.push(authIssue);
+        }
+        return issues;
+    }
+    if (runtime === "codex_local") {
+        if (!codexBinExists()) {
+            const ver = await runCommand(resolveCodexBin(), ["--version"]);
+            if (!ver.ok) {
+                issues.push({ code: "cli_missing", message: "Codex CLI not found — install Codex (`codex`)" });
+                return issues;
+            }
+        }
+        // `codex --version` succeeds without auth — use login status for auth health.
+        const login = await runCommand(resolveCodexBin(), ["login", "status"]);
+        // The classifier runs first: `codex login status` prints "Not logged in" and the
+        // exit-code heuristic below would read that as "logged in" on its own, because the
+        // substring "logged in" is inside it.
+        const authIssue = runtimeAuthIssueFromOutput("codex_local", login.output);
+        if (authIssue) {
+            issues.push(authIssue);
+            return issues;
+        }
+        const out = login.output.toLowerCase();
+        const loggedIn = login.ok &&
+            (out.includes("logged in") || out.includes("authenticated") || out.includes("api key"));
+        if (!loggedIn) {
+            issues.push({ code: "runtime_auth", message: CODEX_AUTH_REMEDIATION });
+        }
+        return issues;
     }
     const status = await runCommand(resolveCursorBin(), cursorInvokeArgs(["status"]));
-    if (!status.ok && !status.output.trim() && !cursorBinExists()) {
-        return [{ code: "cli_missing", message: "cursor-agent not found — run: curl https://cursor.com/install -fsS | bash" }];
+    // A failed *spawn* resolves with the error message as its output (`spawn cursor-agent
+    // ENOENT`), not with empty output — so an absent binary must be recognised here or it
+    // falls through to the unconfirmed-auth branch below and names the wrong remedy.
+    if (!status.ok && (/\bENOENT\b/.test(status.output) || (!status.output.trim() && !cursorBinExists()))) {
+        issues.push({ code: "cli_missing", message: "cursor-agent not found — run: curl https://cursor.com/install -fsS | bash" });
+        return issues;
+    }
+    const authIssue = cursorAuthIssueFromOutput(status.output);
+    if (authIssue) {
+        issues.push(authIssue);
+        return issues;
     }
+    // NOT-133: an unclassified *failure* of the probe itself (non-zero exit, timeout) used to
+    // be read as "healthy" and admitted the agent. Silence is not evidence of auth, so this
+    // fails closed: the agent stays unhealthy — and its issues stay queued — until the probe
+    // succeeds. That is a deliberate trade against the incident, where admitting on a guess
+    // cost 12 dead sessions and parked three issues on a human. Reported as runtime_auth so
+    // the existing agents-page CLI status renders it, with a message that says plainly the
+    // state is unconfirmed rather than asserting the agent is logged out.
+    if (!status.ok) {
+        const detail = status.output.trim().split("\n").slice(-1)[0] ?? "no output";
+        issues.push({
+            code: "runtime_auth",
+            message: `Could not confirm Cursor auth — \`cursor-agent status\` failed (${detail})`,
+        });
+    }
+    return issues;
+}
+/**
+ * Bedrock/Vertex installs authenticate through AWS/GCP credentials instead of a Claude
+ * login, so `claude auth status` is not the authority on whether they can run.
+ */
+function claudeUsesThirdPartyProvider() {
+    return (process.env.CLAUDE_CODE_USE_BEDROCK === "1" || process.env.CLAUDE_CODE_USE_VERTEX === "1");
+}
+/**
+ * Issue workflows always use `gh` after a developer session (draft PR + checks). A bad
+ * or missing GitHub CLI auth wastes a full agent run and lands as `adapter_failure` —
+ * surface it on every agent so Start / intake can refuse before that spend.
+ */
+export async function githubIssuesUncached() {
+    const status = await runCommand("gh", ["auth", "status"]);
     const out = status.output.toLowerCase();
-    if (out.includes("not logged in") || out.includes("login required") || out.includes("not authenticated")) {
-        return [{ code: "runtime_auth", message: "Run cursor-agent login" }];
+    if (out.includes("enoent") ||
+        out.includes("not found") ||
+        out.includes("no such file") ||
+        (out.includes("spawn") && out.includes("gh"))) {
+        return [{ code: "github_cli_missing", message: "gh CLI not found — install GitHub CLI (`gh`)" }];
+    }
+    if (!status.ok ||
+        out.includes("not logged in") ||
+        out.includes("failed to log in") ||
+        out.includes("token in keyring is invalid") ||
+        out.includes("re-authenticate") ||
+        out.includes("to re-authenticate")) {
+        return [
+            {
+                code: "github_auth",
+                message: "Run `gh auth login` — GitHub CLI auth required to open PRs",
+            },
+        ];
     }
     return [];
 }
+/**
+ * Unit/CI tests must not call the real `gh auth status` — runners usually have no
+ * usable token, and the startWorkflow preflight would refuse every kick. Set
+ * `AGENT_DEALER_SKIP_GITHUB_HEALTH=1` in `test:unit` / `test:ci`. Production and
+ * local `npm run dev` leave it unset so Start still refuses bad auth.
+ */
+function githubHealthSkippedForTests() {
+    return process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH === "1";
+}
+/** Synchronous for startWorkflow — issue kick must refuse before spending a developer round. */
+export function githubIssuesSync() {
+    if (githubHealthSkippedForTests())
+        return [];
+    if (githubIssueCache && Date.now() - githubIssueCache.at < RUNTIME_CACHE_MS) {
+        return githubIssueCache.issues;
+    }
+    const result = spawnSync("gh", ["auth", "status"], {
+        encoding: "utf8",
+        timeout: 8000,
+        env: process.env,
+    });
+    const output = `${result.stdout ?? ""}${result.stderr ?? ""}${result.error?.message ?? ""}`;
+    const out = output.toLowerCase();
+    let issues = [];
+    if (result.error ||
+        out.includes("enoent") ||
+        out.includes("not found") ||
+        out.includes("no such file")) {
+        issues = [{ code: "github_cli_missing", message: "gh CLI not found — install GitHub CLI (`gh`)" }];
+    }
+    else if (result.status !== 0 ||
+        out.includes("not logged in") ||
+        out.includes("failed to log in") ||
+        out.includes("token in keyring is invalid") ||
+        out.includes("re-authenticate") ||
+        out.includes("to re-authenticate")) {
+        issues = [
+            {
+                code: "github_auth",
+                message: "Run `gh auth login` — GitHub CLI auth required to open PRs",
+            },
+        ];
+    }
+    githubIssueCache = { at: Date.now(), issues };
+    return issues;
+}
+async function githubIssues() {
+    if (githubIssueCache && Date.now() - githubIssueCache.at < RUNTIME_CACHE_MS) {
+        return githubIssueCache.issues;
+    }
+    const issues = await githubIssuesUncached();
+    githubIssueCache = { at: Date.now(), issues };
+    return issues;
+}
 async function runtimeIssues(runtime) {
+    const capIssues = capHealthIssues(runtime);
     const cached = runtimeIssueCache.get(runtime);
     if (cached && Date.now() - cached.at < RUNTIME_CACHE_MS) {
-        return cached.issues;
+        return [...capIssues, ...cached.issues];
     }
     const issues = await runtimeIssuesUncached(runtime);
-    runtimeIssueCache.set(runtime, { at: Date.now(), issues });
-    return issues;
+    const nonCap = issues.filter((i) => i.code !== "usage_capped");
+    runtimeIssueCache.set(runtime, { at: Date.now(), issues: nonCap });
+    return [...capIssues, ...nonCap];
 }
-function agentSpecificIssues(agent, agentDeckOnline, mcpRegistered) {
+function agentSpecificIssues(agent, agentDeckOnline, mcpRegistered, deckAccessResult) {
     const issues = [];
-    if (!agent.workspaceRoot) {
-        issues.push({ code: "workspace_missing", message: "Set workspace on Agents page" });
-    }
-    else if (!fs.existsSync(agent.workspaceRoot)) {
+    if (!agent.deckId) {
         issues.push({
-            code: "workspace_missing",
-            message: `Workspace path not found: ${agent.workspaceRoot}`,
+            code: "deck_missing",
+            message: "Set an Agent Deck on the Agents page — workers never start without one",
         });
+        return issues;
     }
-    if (agent.deckId && !agentDeckOnline) {
+    if (!agentDeckOnline) {
         issues.push({ code: "deck_offline", message: "Agent Deck offline — deck MCP unavailable" });
     }
-    if (agent.deckId && agent.runtime === "claude_code" && agentDeckOnline && !mcpRegistered) {
+    // resolveDeckName silently returns null on this same failure elsewhere (route/index.ts) —
+    // surface it here so a bound deck that can no longer be read isn't just a quiet no-op. A
+    // *successful* metadata call that simply doesn't include this deck (deleted) is the same
+    // user-visible failure as the call itself failing.
+    if (agentDeckOnline && deckAccessResult) {
+        if (!deckAccessResult.ok) {
+            issues.push({ code: "deck_unauthorized", message: deckAccessResult.message });
+        }
+        else if (!deckAccessResult.decks.some((d) => d.id === agent.deckId)) {
+            issues.push({
+                code: "deck_unauthorized",
+                message: `Deck ${agent.deckName ?? agent.deckId} is not available from Agent Deck (deleted or unreachable)`,
+            });
+        }
+    }
+    if (agent.runtime === "claude_code" && agentDeckOnline && !mcpRegistered) {
         issues.push({
             code: "mcp_not_registered",
             message: "Run agent-deck setup --client claude --start (Claude MCP not registered)",
@@ -82,14 +272,16 @@ function agentSpecificIssues(agent, agentDeckOnline, mcpRegistered) {
     }
     return issues;
 }
-export async function healthForAgent(agent, agentDeckOnline, runtimeIssuesByRuntime, mcpRegistered) {
+export async function healthForAgent(agent, agentDeckOnline, runtimeIssuesByRuntime, mcpRegistered, deckAccessResult = null, githubIssuesList) {
     const runtime = runtimeIssuesByRuntime !== undefined
         ? (runtimeIssuesByRuntime.get(agent.runtime) ?? [])
         : await runtimeIssues(agent.runtime);
     const deckMcpOk = mcpRegistered ?? isAgentDeckMcpRegistered();
+    const github = githubIssuesList ?? (await githubIssues());
     const issues = [
         ...runtime,
-        ...agentSpecificIssues(agent, agentDeckOnline, deckMcpOk),
+        ...github,
+        ...agentSpecificIssues(agent, agentDeckOnline, deckMcpOk, deckAccessResult),
     ];
     return {
         ...agent,
@@ -100,10 +292,15 @@ export async function healthForAgent(agent, agentDeckOnline, runtimeIssuesByRunt
 export async function listAgentsWithHealth(agents) {
     const agentDeckOnline = await checkAgentDeckHealth();
     const mcpRegistered = isAgentDeckMcpRegistered();
+    const needsDeckAccess = agents.some((a) => a.deckId);
+    const deckAccessResult = agentDeckOnline && needsDeckAccess ? await fetchDecks() : null;
     const runtimes = [...new Set(agents.map((a) => a.runtime))];
     const runtimeIssuesByRuntime = new Map();
-    await Promise.all(runtimes.map(async (runtime) => {
-        runtimeIssuesByRuntime.set(runtime, await runtimeIssues(runtime));
-    }));
-    return Promise.all(agents.map((a) => healthForAgent(a, agentDeckOnline, runtimeIssuesByRuntime, mcpRegistered)));
+    const [, githubIssuesList] = await Promise.all([
+        Promise.all(runtimes.map(async (runtime) => {
+            runtimeIssuesByRuntime.set(runtime, await runtimeIssues(runtime));
+        })),
+        githubIssues(),
+    ]);
+    return Promise.all(agents.map((a) => healthForAgent(a, agentDeckOnline, runtimeIssuesByRuntime, mcpRegistered, deckAccessResult, githubIssuesList)));
 }

package/bundle/server/dist/adapters/agent-health.test.js

@@ -0,0 +1,237 @@
+// packages/server/src/adapters/agent-health.test.ts
+//
+// An agent bound to a deck that Agent Deck is reachable for (agentDeckOnline) but whose
+// launch deck-metadata call fails — or succeeds but simply no longer includes this deck
+// (deleted) — must surface a distinct issue. resolveDeckName silently swallows both of
+// the same failures to null elsewhere, so this is the one place an operator can see why
+// deck resolution is broken.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { fileURLToPath } from "node:url";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-agenthealth-"));
+const { migrate, getDb } = await import("../db/index.js");
+const { createAgent, getAgent } = await import("../repository/agents.js");
+const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, clearAgentHealthCaches } = await import("./agent-health.js");
+migrate();
+const FAILURE = { ok: false, code: "DECK_UNAVAILABLE", message: "Agent Deck API error: 502" };
+/** Tests inject an empty github list so host `gh auth` does not pollute assertions. */
+const NO_GITHUB = [];
+test("missing deckId: reports deck_missing", async () => {
+    const created = createAgent({
+        name: "no-deck",
+        runtime: "claude_code",
+        deckId: "00000000-0000-4000-a000-000000000099",
+    });
+    getDb().prepare("UPDATE agents SET deck_id = NULL WHERE id = ?").run(created.id);
+    const agent = getAgent(created.id);
+    const result = await healthForAgent(agent, true, new Map(), true, FAILURE, NO_GITHUB);
+    assert.equal(result.issues.some((i) => i.code === "deck_missing"), true);
+    assert.equal(result.healthy, false);
+});
+test("agent deck offline: reports deck_offline, not deck_unauthorized", async () => {
+    const agent = createAgent({
+        name: "offline",
+        runtime: "claude_code",
+        deckId: randomUUID(),
+    });
+    const result = await healthForAgent(agent, false, new Map(), true, FAILURE, NO_GITHUB);
+    assert.deepEqual(result.issues.map((i) => i.code).sort(), ["deck_offline"]);
+});
+test("agent deck online but metadata unavailable: reports deck_unauthorized with the Deck message", async () => {
+    const agent = createAgent({
+        name: "unavailable",
+        runtime: "claude_code",
+        deckId: randomUUID(),
+    });
+    const result = await healthForAgent(agent, true, new Map(), true, FAILURE, NO_GITHUB);
+    const issue = result.issues.find((i) => i.code === "deck_unauthorized");
+    assert.ok(issue, "expected a deck_unauthorized issue");
+    assert.equal(issue?.message, "Agent Deck API error: 502");
+});
+test("agent deck online, metadata call succeeds, but this deck isn't in the returned set: reports deck_unauthorized", async () => {
+    const deckId = randomUUID();
+    const agent = createAgent({ name: "stale-deck", runtime: "claude_code", deckId });
+    const deckAccessResult = { ok: true, decks: [{ id: randomUUID(), name: "some-other-deck" }] };
+    const result = await healthForAgent(agent, true, new Map(), true, deckAccessResult, NO_GITHUB);
+    const issue = result.issues.find((i) => i.code === "deck_unauthorized");
+    assert.ok(issue, "expected a deck_unauthorized issue for a deck missing from the launch set");
+});
+test("agent deck online and this deck is in the returned set: healthy on the deck axis", async () => {
+    const deckId = randomUUID();
+    const agent = createAgent({ name: "healthy", runtime: "claude_code", deckId });
+    const deckAccessResult = { ok: true, decks: [{ id: deckId, name: "healthy-deck" }] };
+    const result = await healthForAgent(agent, true, new Map(), true, deckAccessResult, NO_GITHUB);
+    assert.equal(result.issues.some((i) => i.code === "deck_unauthorized" || i.code === "deck_offline"), false);
+});
+test("agent deck online with no deck-access result computed (e.g. no agent needed it): no false positive", async () => {
+    const agent = createAgent({
+        name: "no-result",
+        runtime: "claude_code",
+        deckId: randomUUID(),
+    });
+    const result = await healthForAgent(agent, true, new Map(), true, null, NO_GITHUB);
+    assert.equal(result.issues.some((i) => i.code === "deck_unauthorized" || i.code === "deck_offline"), false);
+});
+test("codex_local with a missing CLI reports cli_missing exactly once, not twice", async () => {
+    const prevCodexCli = process.env.CODEX_CLI;
+    process.env.CODEX_CLI = "/nonexistent/path/codex-does-not-exist";
+    try {
+        const issues = await runtimeIssuesUncached("codex_local");
+        assert.deepEqual(issues.map((i) => i.code), ["cli_missing"]);
+    }
+    finally {
+        if (prevCodexCli === undefined)
+            delete process.env.CODEX_CLI;
+        else
+            process.env.CODEX_CLI = prevCodexCli;
+    }
+});
+test("cursor_local with a bound deck: no deck access issue (launch MCP is supported)", async () => {
+    const agent = createAgent({
+        name: "cursor-with-deck",
+        runtime: "cursor_local",
+        deckId: randomUUID(),
+    });
+    const result = await healthForAgent(agent, true, new Map(), true, null, NO_GITHUB);
+    assert.equal(result.issues.some((i) => i.code === "deck_unauthorized" || i.code === "deck_offline"), false);
+});
+test("github_auth issues mark the agent unhealthy so Start can refuse before a wasted run", async () => {
+    const agent = createAgent({
+        name: "needs-gh",
+        runtime: "claude_code",
+        deckId: "00000000-0000-4000-a000-000000000099",
+    });
+    const gh = [
+        { code: "github_auth", message: "Run `gh auth login` — GitHub CLI auth required to open PRs" },
+    ];
+    const result = await healthForAgent(agent, true, new Map(), true, null, gh);
+    assert.equal(result.healthy, false);
+    assert.equal(result.issues.some((i) => i.code === "github_auth"), true);
+});
+test("githubIssuesUncached reports github_auth when gh auth status fails with an invalid token", async () => {
+    clearAgentHealthCaches();
+    // Exercise the real parser path by stubbing via PATH... we instead unit-test the
+    // injected-list path above for healthForAgent. Here we assert the uncached helper
+    // returns a known shape when `gh` is present but auth is bad — skip if gh missing.
+    const { spawnSync } = await import("node:child_process");
+    const probe = spawnSync("gh", ["--version"], { encoding: "utf8" });
+    if (probe.error || probe.status !== 0) {
+        // No gh on this host — nothing to assert about auth status.
+        return;
+    }
+    const issues = await githubIssuesUncached();
+    for (const issue of issues) {
+        assert.ok(issue.code === "github_auth" || issue.code === "github_cli_missing");
+        assert.ok(issue.message.length > 0);
+    }
+});
+test("cursor_keychain status/stderr fixture maps to a blocking health issue via cursorAuthIssueFromOutput", async () => {
+    const { cursorAuthIssueFromOutput } = await import("@agent-dealer/shared");
+    const fixture = `Cursor couldn't save your login to the macOS keychain (errSecDuplicateItem, security exit code 45).
+The keychain item is stuck. Delete it and sign in again:
+  security delete-generic-password -s cursor-access-token -a cursor-user
+  agent login
+`;
+    const issue = cursorAuthIssueFromOutput(fixture);
+    assert.equal(issue?.code, "cursor_keychain");
+    assert.match(issue.message, /delete-generic-password/);
+    const agent = createAgent({
+        name: "cursor-keychain",
+        runtime: "cursor_local",
+        deckId: "00000000-0000-4000-a000-000000000099",
+    });
+    const result = await healthForAgent(agent, true, new Map([["cursor_local", [issue]]]), true, null, NO_GITHUB);
+    assert.equal(result.healthy, false);
+    assert.equal(result.issues.some((i) => i.code === "cursor_keychain"), true);
+});
+// ---------------------------------------------------------------------------
+// NOT-133: the admission preflight classifies each runtime's *captured* logged-out
+// output. Stubs replay the fixtures in packages/shared/src/fixtures/runtime-auth/.
+// ---------------------------------------------------------------------------
+const FIXTURES = path.join(path.dirname(fileURLToPath(import.meta.url)), "../../../shared/src/fixtures/runtime-auth");
+/** A CLI stub that prints a captured fixture verbatim and exits with the captured code. */
+function stubCli(name, fixture, exitCode) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-cli-stub-"));
+    const bin = path.join(dir, name);
+    fs.writeFileSync(bin, `#!/bin/sh\ncat ${JSON.stringify(path.join(FIXTURES, fixture))}\nexit ${exitCode}\n`);
+    fs.chmodSync(bin, 0o755);
+    return bin;
+}
+async function withEnv(key, value, fn) {
+    const prev = process.env[key];
+    process.env[key] = value;
+    clearAgentHealthCaches();
+    try {
+        return await fn();
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = prev;
+        clearAgentHealthCaches();
+    }
+}
+test("logged-out `cursor-agent status` capture blocks the cursor runtime (exit 0 — output is the only signal)", async () => {
+    const issues = await withEnv("CURSOR_CLI", stubCli("cursor-agent", "cursor-agent-status-logged-out.txt", 0), () => runtimeIssuesUncached("cursor_local"));
+    assert.deepEqual(issues.map((i) => i.code), ["runtime_auth"]);
+    assert.match(issues[0].message, /cursor-agent login/);
+    assert.match(issues[0].message, /CURSOR_API_KEY/);
+});
+test("logged-in `cursor-agent status` capture leaves the cursor runtime healthy", async () => {
+    const issues = await withEnv("CURSOR_CLI", stubCli("cursor-agent", "cursor-agent-status-logged-in.txt", 0), () => runtimeIssuesUncached("cursor_local"));
+    assert.deepEqual(issues, []);
+});
+test("a cursor status probe that fails without a classifiable reason blocks rather than admits", async () => {
+    // NOT-133: silence used to be read as health, so an agent that could not be checked was
+    // admitted anyway. Unknown auth must wait, not spend infra attempts on ~1s dead sessions.
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-cli-stub-"));
+    const bin = path.join(dir, "cursor-agent");
+    fs.writeFileSync(bin, "#!/bin/sh\necho 'panic: runtime broke' >&2\nexit 7\n");
+    fs.chmodSync(bin, 0o755);
+    const issues = await withEnv("CURSOR_CLI", bin, () => runtimeIssuesUncached("cursor_local"));
+    assert.deepEqual(issues.map((i) => i.code), ["runtime_auth"]);
+    assert.match(issues[0].message, /Could not confirm Cursor auth/);
+});
+test("logged-out `codex login status` capture blocks the codex runtime", async () => {
+    const issues = await withEnv("CODEX_CLI", stubCli("codex", "codex-login-status-logged-out.txt", 1), () => runtimeIssuesUncached("codex_local"));
+    assert.deepEqual(issues.map((i) => i.code), ["runtime_auth"]);
+    assert.match(issues[0].message, /codex login/);
+});
+test("logged-in `codex login status` capture leaves the codex runtime healthy", async () => {
+    const issues = await withEnv("CODEX_CLI", stubCli("codex", "codex-login-status-logged-in.txt", 0), () => runtimeIssuesUncached("codex_local"));
+    assert.deepEqual(issues, []);
+});
+test("a cursor probe that cannot spawn reports the missing CLI, not unconfirmed auth", async () => {
+    // A spawn failure resolves with `spawn <bin> ENOENT` as its *output*, so the
+    // empty-output test for a missing binary never fires and the operator would be told to
+    // check their login when the binary is what is absent.
+    const missing = path.join(os.tmpdir(), `dealer-absent-cursor-agent-${randomUUID()}`);
+    const issues = await withEnv("CURSOR_CLI", missing, () => runtimeIssuesUncached("cursor_local"));
+    assert.deepEqual(issues.map((i) => i.code), ["cli_missing"]);
+    assert.match(issues[0].message, /cursor\.com\/install/);
+});
+test("logged-out `claude auth status` capture blocks the claude runtime", async () => {
+    // Claude had no auth preflight at all before NOT-133 — a logged-out Claude agent was
+    // admitted exactly the way the logged-out Cursor ones were. Exit 1 with a JSON body: the
+    // classifier reads `"loggedIn": false`, never the status code.
+    const issues = await withEnv("CLAUDE_CLI", stubCli("claude", "claude-auth-status-logged-out.txt", 1), () => runtimeIssuesUncached("claude_code"));
+    assert.deepEqual(issues.map((i) => i.code), ["runtime_auth"]);
+    assert.match(issues[0].message, /claude auth login/);
+});
+test("logged-in `claude auth status` capture leaves the claude runtime healthy", async () => {
+    const issues = await withEnv("CLAUDE_CLI", stubCli("claude", "claude-auth-status-logged-in.txt", 0), () => runtimeIssuesUncached("claude_code"));
+    assert.deepEqual(issues, []);
+});
+test("an older claude CLI without `auth status` is not a false block", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-cli-stub-"));
+    const bin = path.join(dir, "claude");
+    fs.writeFileSync(bin, "#!/bin/sh\necho \"error: unknown command 'auth'\" >&2\nexit 1\n");
+    fs.chmodSync(bin, 0o755);
+    const issues = await withEnv("CLAUDE_CLI", bin, () => runtimeIssuesUncached("claude_code"));
+    assert.deepEqual(issues, []);
+});