agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/runners/prompts.test.js

@@ -7,19 +7,10 @@ process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-pr
 process.env.MAX_CONCURRENT_RUNS = "0";
 const { migrate } = await import("../db/index.js");
 const { BUILTIN_AGENT_CLAUDE_ID } = await import("@agent-dealer/shared");
-const { updateAgent } = await import("../repository/agents.js");
 const { addArtifact, createRun } = await import("../repository/runs.js");
-const { buildExecutionPrompt, buildPlanPrompt, buildPlanEditedReplanPrompt, buildPlanFeedbackPrompt, buildPlanRevisePrompt, buildQaPrompt } = await import("./prompts.js");
-const QUESTIONS = [
-    {
-        id: "q1",
-        question: "Which storage backend?",
-        options: [{ label: "SQLite" }, { label: "Postgres" }],
-    },
-];
+const { buildReflectPrompt } = await import("./prompts.js");
 before(() => {
     migrate();
-    updateAgent(BUILTIN_AGENT_CLAUDE_ID, { workspaceRoot: process.env.AGENT_DEALER_HOME });
 });
 function makeRun() {
     return createRun({
@@ -27,159 +18,37 @@ function makeRun() {
         taskCategory: "other",
         status: "plan_pending",
         agentId: BUILTIN_AGENT_CLAUDE_ID,
+        repo: "acme/app"
     });
 }
-test("plan prompt includes the triage contract", () => {
-    const prompt = buildPlanPrompt(makeRun());
-    assert.match(prompt, /"verdict"/);
-    assert.match(prompt, /needs_review/);
-    assert.match(prompt, /at most 3 questions/i);
+test("reflect prompt restates the task and the read-only patch contract", () => {
+    const prompt = buildReflectPrompt(makeRun(), { trigger: "approve" });
+    assert.match(prompt, /Prompt test task/);
+    assert.match(prompt, /do NOT call update_playbook or propose_playbook_patch/);
+    assert.match(prompt, /"rationale"/);
+    assert.match(prompt, /Human approved this run without retry feedback/);
 });
-test("communication plan prompt favors trivial triage and defers send details to send gate", () => {
-    const run = createRun({
-        title: "Send a test message to Yusuke",
-        description: "Say hello from agent-dealer",
-        taskCategory: "communication",
-        status: "plan_pending",
-        agentId: BUILTIN_AGENT_CLAUDE_ID,
-    });
-    const prompt = buildPlanPrompt(run);
-    assert.match(prompt, /Outbound send gate/);
-    assert.match(prompt, /send gate reviews the exact payload/i);
-    assert.match(prompt, /Do not ask plan questions about recipient/i);
-    assert.doesNotMatch(prompt, /When in doubt, use "needs_review"/);
-    assert.match(prompt, /brief bullet plan/i);
-    assert.doesNotMatch(prompt, /step-by-step plan with risks/);
-});
-test("other category plan prompt keeps conservative when-in-doubt rule", () => {
-    const prompt = buildPlanPrompt(makeRun());
-    assert.match(prompt, /When in doubt, use "needs_review"/);
-    assert.match(prompt, /step-by-step plan with risks/);
-});
-test("execution prompt renders human answers as Q→A pairs", () => {
-    const run = makeRun();
-    addArtifact(run.id, "draft_plan", { markdown: "# Plan" }, "agent");
-    addArtifact(run.id, "plan_triage", { verdict: "needs_review", rationale: "r", questions: QUESTIONS, parseFallback: false, consumed: false }, "agent");
-    addArtifact(run.id, "approved_plan", { markdown: "# Plan" }, "human");
-    addArtifact(run.id, "plan_answers", {
-        answers: [{ questionId: "q1", selectedLabel: "SQLite" }],
-        outcome: "approved",
-        answeredAt: new Date().toISOString(),
-    }, "human");
-    const prompt = buildExecutionPrompt(run);
-    assert.match(prompt, /## Human answers to plan questions/);
-    assert.match(prompt, /Which storage backend\?.*SQLite/s);
-});
-test("execution prompt omits answers section when none exist", () => {
-    const run = makeRun();
-    addArtifact(run.id, "approved_plan", { markdown: "# Plan" }, "human");
-    assert.doesNotMatch(buildExecutionPrompt(run), /Human answers to plan questions/);
-});
-test("feedback replan prompt includes human comments and contract", () => {
-    const run = makeRun();
-    const prompt = buildPlanFeedbackPrompt(run, "Add integration tests and skip the migration step.");
-    assert.match(prompt, /Add integration tests/);
-    assert.match(prompt, /"verdict"/);
-});
-test("edited replan prompt includes human-edited markdown", () => {
-    const run = makeRun();
-    const prompt = buildPlanEditedReplanPrompt(run, "# Revised plan\n\n1. Ship feature");
-    assert.match(prompt, /Revised plan/);
-    assert.match(prompt, /Ship feature/);
-});
-test("revise prompt pairs each answer with its question and re-states the contract", () => {
-    const run = makeRun();
-    const prompt = buildPlanRevisePrompt(run, QUESTIONS, [{ questionId: "q1", freeText: "Use flat files instead" }]);
-    assert.match(prompt, /Which storage backend\?/);
-    assert.match(prompt, /Use flat files instead/);
-    assert.match(prompt, /"verdict"/);
-});
-test("delegated plan answers surface the unanswered questions to the executor", () => {
-    const run = makeRun();
-    addArtifact(run.id, "draft_plan", { markdown: "# Plan" }, "agent");
-    addArtifact(run.id, "plan_triage", {
-        verdict: "needs_review", rationale: "r", questions: QUESTIONS, parseFallback: false, consumed: true,
-    }, "agent");
-    addArtifact(run.id, "approved_plan", { markdown: "# Plan" }, "human");
-    addArtifact(run.id, "plan_answers", { answers: [], outcome: "delegated", answeredAt: new Date().toISOString() }, "human");
-    const prompt = buildExecutionPrompt(run);
-    assert.match(prompt, /## Unanswered plan questions/);
-    assert.match(prompt, /Which storage backend\?/);
-    assert.match(prompt, /SQLite/);
-    assert.match(prompt, /best judgment/i);
-    assert.doesNotMatch(prompt, /## Human answers to plan questions/);
-});
-test("execution prompt renders answered review Q&A from the lineage parent", () => {
-    const parent = makeRun();
-    addArtifact(parent.id, "approved_plan", { markdown: "# Plan" }, "human");
-    addArtifact(parent.id, "result_qa", {
-        exchangeId: "x1",
-        question: "Did you run the tests?",
-        answer: "Yes, all 12 pass.",
-        status: "answered",
-        sessionResumed: true,
-        askedAt: "2026-07-08T00:00:00.000Z",
-        answeredAt: "2026-07-08T00:01:00.000Z",
-    }, "agent");
-    addArtifact(parent.id, "result_qa", {
-        exchangeId: "x2",
-        question: "Pending one",
-        status: "pending",
-        sessionResumed: true,
-        askedAt: "2026-07-08T00:02:00.000Z",
-    }, "human");
-    const retry = createRun({
-        title: "Prompt test task",
-        taskCategory: "other",
-        status: "plan_approved",
-        agentId: BUILTIN_AGENT_CLAUDE_ID,
-    }, { lineageId: parent.lineageId ?? parent.id });
-    addArtifact(retry.id, "approved_plan", { markdown: "# Plan" }, "human");
-    addArtifact(retry.id, "feedback", { markdown: "Tighten the summary" }, "human");
-    const prompt = buildExecutionPrompt(retry);
-    assert.match(prompt, /## Review Q&A/);
-    assert.match(prompt, /Did you run the tests\?/);
-    assert.match(prompt, /Yes, all 12 pass\./);
-    assert.doesNotMatch(prompt, /Pending one/);
-});
-test("execution prompt omits the Q&A section when there are no answered exchanges", () => {
-    const run = makeRun();
-    addArtifact(run.id, "approved_plan", { markdown: "# Plan" }, "human");
-    assert.doesNotMatch(buildExecutionPrompt(run), /## Review Q&A/);
-});
-test("grounded qa prompt asks the question without re-stating artifacts", () => {
-    const run = makeRun();
-    addArtifact(run.id, "approved_plan", { markdown: "# Plan\n1. Use SQLite" }, "human");
-    const prompt = buildQaPrompt(run, "Why SQLite?", { grounded: true });
-    assert.match(prompt, /Why SQLite\?/);
-    assert.match(prompt, /Do NOT modify anything/i);
-    assert.doesNotMatch(prompt, /## Approved plan/);
-});
-test("ungrounded qa prompt rebuilds context from artifacts", () => {
+test("reflect prompt carries the plan and execution artifacts when they exist", () => {
     const run = makeRun();
     addArtifact(run.id, "approved_plan", { markdown: "# Plan\n1. Use SQLite" }, "human");
     addArtifact(run.id, "execution_result", { phase: "execute", exitCode: 0, resultText: "Wrote the doc", isError: false }, "agent");
-    addArtifact(run.id, "document", { path: "/tmp/x.md", title: "x", markdown: "# Deliverable body" }, "agent");
-    const prompt = buildQaPrompt(run, "Why SQLite?", { grounded: false });
+    const prompt = buildReflectPrompt(run, { trigger: "approve" });
     assert.match(prompt, /## Approved plan/);
+    assert.match(prompt, /Use SQLite/);
     assert.match(prompt, /## Execution outcome/);
-    assert.match(prompt, /## Deliverable/);
-    assert.match(prompt, /# Deliverable body/);
-    assert.match(prompt, /Why SQLite\?/);
+    assert.match(prompt, /Wrote the doc/);
 });
-test("qa prompt never asks for a json block or an outbound draft", () => {
+test("retry reflect prompt prefers the explicit feedback over the stored artifact", () => {
     const run = makeRun();
-    const prompt = buildQaPrompt(run, "What did you check?", { grounded: true });
-    assert.doesNotMatch(prompt, /Outbound actions/);
-    assert.doesNotMatch(prompt, /"verdict"/);
+    addArtifact(run.id, "feedback", { markdown: "Stored feedback" }, "human");
+    const prompt = buildReflectPrompt(run, { trigger: "retry", feedback: "Tighten the summary" });
+    assert.match(prompt, /## Human feedback \(highest signal\)/);
+    assert.match(prompt, /Tighten the summary/);
+    assert.doesNotMatch(prompt, /Stored feedback/);
 });
-test("execution prompt includes outbound draft contract", () => {
+test("retry reflect prompt falls back to the run's own human feedback artifact", () => {
     const run = makeRun();
-    addArtifact(run.id, "approved_plan", { markdown: "# Plan" }, "human");
-    const prompt = buildExecutionPrompt(run);
-    assert.match(prompt, /Outbound actions/);
-    assert.match(prompt, /call_service_tool IS available/);
-    assert.doesNotMatch(prompt, /call_service_tool is blocked/);
-    assert.match(prompt, /service_tool_call/);
-    assert.match(prompt, /"actionType"/);
+    addArtifact(run.id, "feedback", { markdown: "Stored feedback" }, "human");
+    const prompt = buildReflectPrompt(run, { trigger: "retry" });
+    assert.match(prompt, /Stored feedback/);
 });

package/bundle/server/dist/runners/qa.js

@@ -1,6 +1,8 @@
 import { runClaude, runCursor } from "./claude.js";
+import { runCodex } from "./codex.js";
 import { buildQaPrompt } from "./prompts.js";
 import { extractResultIsError, extractResultText, extractUsage, parseNdjson } from "./stream-json.js";
+import { normalizeCodexEvents, parseCodexJsonl } from "./codex-jsonl.js";
 /** One read-only Q&A turn against a finished run. Resumes the execute session when we still have it. */
 export async function runQa(run, question, resumeSessionId) {
     let result;
@@ -19,13 +21,27 @@ export async function runQa(run, question, resumeSessionId) {
             });
         }
     }
+    else if (runtime === "codex_local") {
+        const prompt = buildQaPrompt(run, question, { grounded: Boolean(resumeSessionId) });
+        result = await runCodex(run, "qa", executeModel ?? undefined, {
+            promptOverride: prompt,
+            ...(resumeSessionId ? { resumeSessionId } : {}),
+        });
+        if (result.exitCode !== 0 && resumeSessionId) {
+            result = await runCodex(run, "qa", executeModel ?? undefined, {
+                promptOverride: buildQaPrompt(run, question, { grounded: false }),
+            });
+        }
+    }
     else {
         result = await runClaude(run, "qa", executeModel, {
             promptOverride: buildQaPrompt(run, question, { grounded: Boolean(resumeSessionId) }),
             ...(resumeSessionId ? { resumeSessionId } : {}),
         });
     }
-    const events = parseNdjson(result.transcript);
+    const events = runtime === "codex_local"
+        ? normalizeCodexEvents(parseCodexJsonl(result.transcript))
+        : parseNdjson(result.transcript);
     const usage = extractUsage(events, "qa", runtime);
     const answer = extractResultText(events)?.trim() ?? "";
     const failed = result.exitCode !== 0 || extractResultIsError(events) || !answer;

package/bundle/server/dist/runners/reflect.js

@@ -1,7 +1,7 @@
-import { PlaybookPatchContent, ReflectProposalSchema } from "@agent-dealer/shared";
-import { addArtifact, getLatestArtifact } from "../repository/runs.js";
+import { ReflectProposalSchema } from "@agent-dealer/shared";
+import { addArtifact } from "../repository/runs.js";
 import { agentDeckPatchesUrl, checkAgentDeckHealth, fetchPlaybook, proposePlaybookPatch, } from "../adapters/agent-deck.js";
-import { runClaude } from "./claude.js";
+import { runClaudeReflect } from "./claude.js";
 import { buildReflectPrompt } from "./prompts.js";
 import { extractResultText, parseNdjson } from "./stream-json.js";
 function parseReflectProposal(text) {
@@ -35,7 +35,7 @@ export async function runReflect(run, opts) {
             return;
         }
         const playbook = await fetchPlaybook(run.playbookId);
-        const result = await runClaude(run, "reflect", undefined, { promptOverride: buildReflectPrompt(run, opts) });
+        const result = await runClaudeReflect(run, { promptOverride: buildReflectPrompt(run, opts) });
         const events = parseNdjson(result.transcript);
         const resultText = extractResultText(events) ?? result.transcript;
         const proposal = parseReflectProposal(resultText);
@@ -76,15 +76,3 @@ export async function runReflect(run, opts) {
         addArtifact(run.id, "reflect_status", { status: "failed", trigger: opts.trigger, error: String(err) }, "system");
     }
 }
-export function latestProposedPatch(runId) {
-    const art = getLatestArtifact(runId, "playbook_patch");
-    if (!art?.contentJson)
-        return null;
-    try {
-        const parsed = PlaybookPatchContent.parse(JSON.parse(art.contentJson));
-        return parsed.status === "proposed" ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}

package/bundle/server/dist/runners/spawn-cli.js

@@ -0,0 +1,197 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { getTemporalLogsDir } from "../paths.js";
+import { acquireSpawnSlot, killRunProcess, registerChild, releaseSpawnSlot, unregisterChild, } from "./process-registry.js";
+export { getActiveLogPath, killRunProcess } from "./process-registry.js";
+export function timeoutMsForMode(mode) {
+    const envKey = mode === "plan"
+        ? "PLAN_TIMEOUT_MS"
+        : mode === "execute"
+            ? "EXECUTE_TIMEOUT_MS"
+            : mode === "reflect"
+                ? "REFLECT_TIMEOUT_MS"
+                : "QA_TIMEOUT_MS";
+    const defaults = {
+        plan: 15 * 60_000,
+        execute: 60 * 60_000,
+        reflect: 10 * 60_000,
+        qa: 5 * 60_000,
+    };
+    const raw = process.env[envKey];
+    if (raw !== undefined && raw !== "")
+        return Number(raw);
+    return defaults[mode];
+}
+/**
+ * Grace period between the SIGTERM an abort sends and the SIGKILL that follows it. The
+ * agent CLIs spawn their own children (login shells, test runners), and they reap those
+ * themselves on SIGTERM the way they do on Ctrl-C — so terminating politely first is what
+ * actually cleans up the whole tree. SIGKILL is only the backstop for a CLI that ignores
+ * the first signal.
+ */
+function abortKillGraceMs() {
+    return Number(process.env.SPAWN_ABORT_KILL_GRACE_MS ?? 5_000);
+}
+export async function spawnCli(runId, cmd, args, cwd, opts) {
+    await acquireSpawnSlot();
+    try {
+        return await new Promise((resolve, reject) => {
+            const stdoutChunks = [];
+            const stderrChunks = [];
+            let timedOut = false;
+            let settled = false;
+            let killEscalation;
+            const logStream = fs.createWriteStream(opts.logPath, { flags: "w" });
+            // A WriteStream's 'error' event has no default handler — left unguarded, any
+            // stream error (a write after end, ENOSPC, a permissions problem) is an uncaught
+            // exception that crashes this entire process, taking down every other in-flight
+            // issue's coordinator work along with it. Best-effort: the transcript this
+            // function resolves with is already buffered in memory regardless of whether the
+            // log file write succeeds.
+            logStream.on("error", (err) => {
+                console.error(`[spawn-cli] log stream error for ${opts.logPath}`, err);
+            });
+            const child = spawn(cmd, args, {
+                cwd,
+                // Extra vars (e.g. codex's bearer-token env var for its per-attempt CODEX_HOME
+                // MCP config, agent-deck-bind.ts) are added on top of, never in place of, the
+                // process env the CLI itself needs to run.
+                env: { ...process.env, ...opts.env },
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            registerChild(runId, child, opts.logPath);
+            // Best-effort bookkeeping: a throwing callback must never take down the spawn.
+            if (child.pid !== undefined) {
+                try {
+                    opts.onSpawn?.(child.pid);
+                }
+                catch (err) {
+                    console.error(`[spawn-cli] onSpawn for ${runId}`, err);
+                }
+            }
+            const onAbort = () => {
+                if (settled)
+                    return;
+                try {
+                    child.kill("SIGTERM");
+                }
+                catch {
+                    // Already exited between the abort firing and this kill — nothing to signal.
+                }
+                killEscalation = setTimeout(() => {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch {
+                        // Same race as above; the 'close' handler still settles the promise.
+                    }
+                }, abortKillGraceMs());
+                killEscalation.unref?.();
+            };
+            // Not cleared on settle alone — `cleanupAbort` also drops the listener, so a
+            // long-lived signal (one AbortController per work item, reused across the
+            // handler's later stages) never retains this closure after the child is gone.
+            const cleanupAbort = () => {
+                if (killEscalation)
+                    clearTimeout(killEscalation);
+                opts.signal?.removeEventListener("abort", onAbort);
+            };
+            if (opts.signal) {
+                if (opts.signal.aborted)
+                    onAbort();
+                else
+                    opts.signal.addEventListener("abort", onAbort, { once: true });
+            }
+            const finish = (exitCode) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                cleanupAbort();
+                unregisterChild(runId);
+                // Write any stderr BEFORE ending the stream — writing after end() throws
+                // ERR_STREAM_WRITE_AFTER_END (this crashed the whole process on any real CLI
+                // invocation that produced stderr output; every fixture-based test's fake spawn
+                // never wrote stderr, so this path went unexercised until a real session hit it).
+                const stderr = stderrChunks.join("");
+                // write()/end() only queue the I/O — resolving immediately (PR #27 review) races
+                // the actual flush, so a caller reading opts.logPath right after this promise
+                // settles can see a file missing the stderr trailer (or, on a slow disk, even
+                // the tail of stdout). Wait for the stream to actually finish (or, if the
+                // underlying write itself errors, the 'error' handler above already logged it —
+                // finalize anyway rather than hang forever on a transcript that's already fully
+                // buffered in memory regardless of the file write's outcome).
+                let finalized = false;
+                let finalizeTimer;
+                const finalize = () => {
+                    if (finalized)
+                        return;
+                    finalized = true;
+                    if (finalizeTimer)
+                        clearTimeout(finalizeTimer);
+                    resolve({
+                        exitCode,
+                        transcript: stdoutChunks.join(""),
+                        timedOut,
+                    });
+                };
+                if (logStream.destroyed || logStream.errored) {
+                    // The stream already failed (e.g. ENOENT on open, or a write error during
+                    // stdout streaming — before this function ever attached the listeners below)
+                    // — end() on an already-destroyed stream emits neither 'finish' nor a fresh
+                    // 'error', so waiting for either would hang this promise forever and leak the
+                    // spawn slot (PR #27 review, round 2). The transcript is already fully
+                    // buffered in memory regardless of the file write's outcome.
+                    finalize();
+                }
+                else {
+                    logStream.once("finish", finalize);
+                    logStream.once("error", finalize);
+                    // Belt-and-suspenders: 'finish'/'error' are expected to fire quickly once
+                    // end() is called, but a stream wedged on some other, unanticipated failure
+                    // mode must still never pin this work item's spawn slot indefinitely.
+                    finalizeTimer = setTimeout(finalize, 2000);
+                    finalizeTimer.unref?.();
+                    if (stderr.trim()) {
+                        logStream.end(`\n--- stderr ---\n${stderr}`);
+                    }
+                    else {
+                        logStream.end();
+                    }
+                }
+            };
+            const timer = setTimeout(() => {
+                timedOut = true;
+                killRunProcess(runId);
+                setTimeout(() => finish(124), 500);
+            }, opts.timeoutMs);
+            child.stdout?.on("data", (buf) => {
+                const chunk = buf.toString();
+                stdoutChunks.push(chunk);
+                logStream.write(buf);
+            });
+            child.stderr?.on("data", (buf) => {
+                stderrChunks.push(buf.toString());
+            });
+            child.on("error", (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                cleanupAbort();
+                unregisterChild(runId);
+                logStream.end();
+                reject(err);
+            });
+            child.on("close", (code) => finish(code ?? 1));
+        });
+    }
+    finally {
+        releaseSpawnSlot();
+    }
+}
+export function logPathFor(run, mode) {
+    const logDir = getTemporalLogsDir();
+    return path.join(logDir, `${run.id}-${mode}-${Date.now()}.ndjson`);
+}

package/bundle/server/dist/runners/spawn-cli.test.js

@@ -0,0 +1,130 @@
+// Regression test for a crash discovered live on the very first real (non-fixture) dev
+// session: `finish()` called `logStream.end()` and then, if the child produced any
+// stderr, `logStream.write(...)` on the now-ended stream -- ERR_STREAM_WRITE_AFTER_END,
+// an unhandled stream 'error' event, which crashes the entire coordinator process (every
+// fixture-based test's fake spawn never wrote real stderr, so this path was never
+// exercised until a real CLI invocation hit it).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnCli } from "./spawn-cli.js";
+test("spawnCli does not crash when the child process writes to stderr", async () => {
+    const logPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-spawn-cli-")), "out.ndjson");
+    const result = await spawnCli("test-run-stderr", "sh", ["-c", "echo out-line; echo err-line 1>&2"], process.cwd(), { logPath, timeoutMs: 5000 });
+    assert.equal(result.exitCode, 0);
+    assert.equal(result.timedOut, false);
+    assert.match(result.transcript, /out-line/);
+    // The stderr section was actually appended to the log file, not lost -- proves the
+    // write happened before end(), not just that it failed to throw.
+    const logged = fs.readFileSync(logPath, "utf8");
+    assert.match(logged, /out-line/);
+    assert.match(logged, /--- stderr ---/);
+    assert.match(logged, /err-line/);
+});
+test("spawnCli does not crash when the child writes only stdout (no stderr)", async () => {
+    const logPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-spawn-cli-")), "out.ndjson");
+    const result = await spawnCli("test-run-nostderr", "sh", ["-c", "echo out-only"], process.cwd(), {
+        logPath,
+        timeoutMs: 5000,
+    });
+    assert.equal(result.exitCode, 0);
+    assert.match(result.transcript, /out-only/);
+    const logged = fs.readFileSync(logPath, "utf8");
+    assert.doesNotMatch(logged, /--- stderr ---/);
+});
+// PR #27 review, round 2: waiting for finish()/error on the write stream only helps if
+// those listeners are attached before the stream already failed. A stream that errors
+// (and self-destroys) BEFORE the child closes -- e.g. ENOENT opening the log file --
+// never emits either event again once end() is called, so a naive wait-then-resolve
+// would hang forever, leaking the spawn slot. Set a short per-test timeout so a
+// regression fails fast instead of hanging the whole suite.
+test("spawnCli still resolves (does not hang) when the log stream already errored before the child closed", { timeout: 5000 }, async () => {
+    // A path whose parent directory doesn't exist -- fs.createWriteStream fails with
+    // ENOENT almost immediately, well before this "sleep" child exits.
+    const logPath = path.join(os.tmpdir(), `dealer-spawn-cli-missing-${Date.now()}`, "nested", "out.ndjson");
+    const result = await spawnCli("test-run-stream-error", "sh", ["-c", "sleep 0.2; echo done"], process.cwd(), {
+        logPath,
+        timeoutMs: 5000,
+    });
+    assert.equal(result.exitCode, 0);
+    assert.match(result.transcript, /done/, "the in-memory transcript is unaffected by the log file write failing");
+});
+// NOT-126: an attempt that loses its lease aborts, but the abort used to stop at the
+// handler -- the spawned CLI kept running, kept editing the worktree, and the successor
+// attempt was then handed that same worktree, so two live agents shared one tree. These
+// use `process.execPath` rather than `sh -c '... sleep 30'` deliberately: a shell's
+// orphaned grandchild inherits the stdout pipe and holds it open, so 'close' would not
+// fire promptly and the test would pass for the wrong reason.
+const nodeChild = (body) => ({ cmd: process.execPath, args: ["-e", body] });
+async function waitForStart(logPath, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            if (fs.readFileSync(logPath, "utf8").includes("started"))
+                return;
+        }
+        catch {
+            // The log file is created asynchronously by the write stream -- keep polling.
+        }
+        await new Promise((r) => setTimeout(r, 25));
+    }
+    throw new Error("child never reported that it had started");
+}
+test("spawnCli terminates the child when the attempt is aborted", { timeout: 15_000 }, async () => {
+    const logPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-spawn-cli-")), "out.ndjson");
+    const { cmd, args } = nodeChild("console.log('started'); setInterval(() => {}, 1000);");
+    const controller = new AbortController();
+    const startedAt = Date.now();
+    // timeoutMs is deliberately far longer than the test timeout: if the abort does not
+    // kill the child, nothing else will, and this test fails by timing out.
+    const promise = spawnCli("test-run-abort", cmd, args, process.cwd(), {
+        logPath,
+        timeoutMs: 600_000,
+        signal: controller.signal,
+    });
+    await waitForStart(logPath);
+    controller.abort();
+    const result = await promise;
+    assert.ok(Date.now() - startedAt < 15_000, "resolved on the abort, not on the 10-minute timeout");
+    assert.equal(result.timedOut, false, "an abort is a lost lease, not a wall-clock timeout");
+    assert.match(result.transcript, /started/, "output produced before the abort is still returned");
+});
+test("spawnCli escalates to SIGKILL when the child ignores SIGTERM", { timeout: 15_000 }, async () => {
+    const previous = process.env.SPAWN_ABORT_KILL_GRACE_MS;
+    process.env.SPAWN_ABORT_KILL_GRACE_MS = "250";
+    try {
+        const logPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-spawn-cli-")), "out.ndjson");
+        const { cmd, args } = nodeChild("process.on('SIGTERM', () => {}); console.log('started'); setInterval(() => {}, 1000);");
+        const controller = new AbortController();
+        const promise = spawnCli("test-run-abort-sigkill", cmd, args, process.cwd(), {
+            logPath,
+            timeoutMs: 600_000,
+            signal: controller.signal,
+        });
+        await waitForStart(logPath);
+        controller.abort();
+        // Only the SIGKILL backstop can end this child -- it swallows SIGTERM outright.
+        const result = await promise;
+        assert.equal(result.timedOut, false);
+    }
+    finally {
+        if (previous === undefined)
+            delete process.env.SPAWN_ABORT_KILL_GRACE_MS;
+        else
+            process.env.SPAWN_ABORT_KILL_GRACE_MS = previous;
+    }
+});
+test("spawnCli runs normally when an un-aborted signal is supplied", { timeout: 10_000 }, async () => {
+    const logPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-spawn-cli-")), "out.ndjson");
+    const controller = new AbortController();
+    const result = await spawnCli("test-run-abort-unused", "sh", ["-c", "echo untouched"], process.cwd(), {
+        logPath,
+        timeoutMs: 5000,
+        signal: controller.signal,
+    });
+    assert.equal(result.exitCode, 0);
+    assert.equal(result.timedOut, false);
+    assert.match(result.transcript, /untouched/);
+});