agent-dealer 1.2.15 → 1.2.16

package/bundle/server/dist/adapters/agent-health.js

@@ -104,6 +104,14 @@ let runCommandImpl = defaultRunCommand;
 export function setRunCommandForTests(fn) {
     runCommandImpl = fn ?? defaultRunCommand;
 }
+let runtimeIssuesUncachedForTests = null;
+/**
+ * Replace the live auth probe in coordinator tests. Pass `null` to restore the real probe.
+ * Cleared by {@link clearAgentHealthCaches}.
+ */
+export function setRuntimeIssuesUncachedForTests(fn) {
+    runtimeIssuesUncachedForTests = fn;
+}
 function runCommand(cmd, args, timeoutMs = DEFAULT_PROBE_TIMEOUT_MS, env) {
     return runCommandImpl(cmd, args, timeoutMs, env);
 }
@@ -122,6 +130,7 @@ export function clearAgentHealthCaches() {
     githubIssueCache = null;
     cursorSoftFailStreak = 0;
     cursorLastHealthyAt = null;
+    runtimeIssuesUncachedForTests = null;
     resetMuseCapabilityStateForTests();
 }
 function isSoftCursorProbeIssue(issue) {
@@ -256,6 +265,9 @@ async function museRuntimeIssues() {
 }
 /** Exported for direct testing — bypasses the 60s cache in runtimeIssues(). */
 export async function runtimeIssuesUncached(runtime) {
+    if (runtimeIssuesUncachedForTests) {
+        return await runtimeIssuesUncachedForTests(runtime);
+    }
     const issues = [];
     if (runtime === "claude_code") {
         if (!claudeBinExists()) {
@@ -542,6 +554,15 @@ export async function healthForAgent(agent, agentDeckOnline, runtimeIssuesByRunt
     };
 }
 export async function listAgentsWithHealth(agents) {
+    // NOT-369: ensure the one-time AC sleep-timer notice is computed for the health surface
+    // (informational only — never attached as an AgentHealthIssue / never blocks admission).
+    try {
+        const { ensureSleepTimerCheckedAtStartup } = await import("../power/sleep-timer.js");
+        ensureSleepTimerCheckedAtStartup();
+    }
+    catch {
+        // Best-effort: health listing must not fail over power checks.
+    }
     const agentDeckOnline = await checkAgentDeckHealth();
     const mcpRegistration = checkAgentDeckMcpRegistration();
     const needsDeckAccess = agents.some((a) => a.deckId);

package/bundle/server/dist/coordinator/auto-merge.js

@@ -32,6 +32,7 @@ import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS } from "./hu
 import { isMergeConflictFailure, runMergeConflictSync } from "./merge-conflict-sync.js";
 import { triggerLinearPostMerge } from "./linear-merge-verify.js";
 import { startBaseAdvancedScan } from "./base-advanced-scan.js";
+import { runHeldWork } from "../power/host-awake-lifecycle.js";
 import { OPERATOR_VERIFICATION_RESPONSE_OPTIONS, formatOperatorCriteria, getOperatorCriteriaForIssue, hasOperatorVerificationForHead, operatorVerificationRequestId, } from "./operator-criteria.js";
 const run = promisify(execFile);
 /** Bound each `gh` shell-out so a hang cannot freeze the coordinator process. */
@@ -173,6 +174,11 @@ export function isAutoMergeInFlight(issueId) {
 export function clearFinalizeInflightForTests() {
     finalizeInflight.clear();
 }
+/** Test seam: replace finalizeAutoMergeOnce inside the host-awake hold (lifecycle tests). */
+let finalizeOnceForTests = null;
+export function setFinalizeAutoMergeOnceForTests(fn) {
+    finalizeOnceForTests = fn;
+}
 /**
  * Completes an auto-merge parked in `final_review` / system ownership after reviewer
  * approve. Success → done + reflect; failure → needs_human + policy_escalation.
@@ -183,7 +189,8 @@ export function finalizeAutoMerge(issueId) {
     const existing = finalizeInflight.get(issueId);
     if (existing)
         return existing;
-    const promise = finalizeAutoMergeOnce(issueId).finally(() => {
+    // NOT-369: hold idle-sleep for the merge/publish step; release when it settles.
+    const promise = runHeldWork(() => (finalizeOnceForTests ?? finalizeAutoMergeOnce)(issueId)).finally(() => {
         if (finalizeInflight.get(issueId) === promise) {
             finalizeInflight.delete(issueId);
         }

package/bundle/server/dist/coordinator/commands.js

@@ -7,7 +7,7 @@
 // duplicate delivery is a no-op. The effect *work* itself runs elsewhere, through a leased
 // worker whose structured result comes back into applyCompletion.
 import fs from "node:fs";
-import { canTransitionIssue, ExecutionContractError, tryCompileContract } from "@agent-dealer/shared";
+import { canTransitionIssue, ExecutionContractError, isCursorKeychainStuckOutput, runtimeAuthClassificationForLog, tryCompileContract, } from "@agent-dealer/shared";
 import { getDb } from "../db/index.js";
 import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, incrementIssueCiAttempts, resetIssueInfraAttempts, resetIssueCiAttempts, grantReviewRetry, transitionIssue, updateIssue, } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, getWorkflowInstance, listWorkflowEventsForIssue, startWorkflowInstance, WorkflowAlreadyActiveError, } from "../repository/workflow-events.js";
@@ -17,7 +17,7 @@ import { ensureIssueRepoCheckout } from "../adapters/managed-repo.js";
 import { reconcileFinding, resolveFindingsAbsentFromRound } from "../repository/findings.js";
 import { normalizeReviewerResult } from "./reviewer-result.js";
 import { getAgent } from "../repository/agents.js";
-import { githubIssuesSync, invalidateMuseHealthCache } from "../adapters/agent-health.js";
+import { githubIssuesSync, invalidateMuseHealthCache, runtimeIssuesUncached } from "../adapters/agent-health.js";
 import { recordMuseCapabilityOverride } from "../adapters/muse-capability.js";
 import { createIssueArtifact, latestIssueArtifact } from "../repository/artifacts.js";
 import { listSourceAttachments } from "../repository/source-attachments.js";
@@ -26,11 +26,12 @@ import { completeSession, getActiveWorkerSessionForIssue, getWorkerSession, list
 import { killRunProcess } from "../runners/spawn-cli.js";
 import { buildProfileSnapshot, serializeProfileSnapshot } from "./profile-snapshot.js";
 import { workerSessionPayload } from "./session-progress.js";
-import { reasonForWorkerFailedEvent } from "./failure-reason.js";
-import { recordCausesForWorkerFailedEvent } from "./failure-cause.js";
+import { reasonForWorkerFailedEvent, readSpawnLogFailureText } from "./failure-reason.js";
+import { classifyAttemptFailure, recordCausesForWorkerFailedEvent } from "./failure-cause.js";
 import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
 import { MERGE_CONFLICT_FILES_EVIDENCE_KEY, MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
+import { AUTH_TRANSIENT_RETRY_PAYLOAD_KEY, RUNTIME_AUTH_PARK_EVIDENCE_KEY, authProbeConfirmsFailure, defaultRemediationForRuntime, gateRuntimeAuthParkResume, parseRuntimeAuthParkEvidence, remediationFromProbe, } from "./runtime-auth-park.js";
 import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
 import { triggerLinearPostMerge } from "./linear-merge-verify.js";
 import { conflictRepairSpent, queueConflictRepairRound } from "./merge-conflict-sync.js";
@@ -482,6 +483,25 @@ export async function applyCompletion(workItemId, leaseToken, outcome) {
     if (outcome.kind === "base_conflict") {
         return applyBaseConflictCompletion(workItemId, leaseToken, outcome);
     }
+    // NOT-368: classify + live-probe outside the write txn (network/CLI must never hold
+    // the SQLite lock). Developer and reviewer session deaths both participate — medium /
+    // unattributed keep today's infra-retry path inside the role's route function.
+    let authFailure;
+    const authKind = getWorkItem(workItemId)?.kind;
+    if ((outcome.kind === "session_failed" || outcome.kind === "timed_out") &&
+        (authKind === "developer" || authKind === "reviewer")) {
+        try {
+            authFailure = await prepareAuthFailureRouting(workItemId, {
+                kind: outcome.kind,
+                reason: "reason" in outcome ? outcome.reason : undefined,
+                logPath: "logPath" in outcome ? outcome.logPath : undefined,
+            });
+        }
+        catch (err) {
+            console.error("[coordinator] prepareAuthFailureRouting", workItemId, err);
+            authFailure = undefined;
+        }
+    }
     const routed = getDb().transaction(() => {
         const before = getWorkItem(workItemId);
         if (!before)
@@ -499,7 +519,7 @@ export async function applyCompletion(workItemId, leaseToken, outcome) {
         const item = finishWorkItem(workItemId, leaseToken, { status: "done", result: outcome });
         if (!item)
             return { applied: false, reason: "lease_lost" };
-        return routeAppliedOutcome(issue, instance, item, outcome);
+        return routeAppliedOutcome(issue, instance, item, outcome, authFailure);
     })();
     if (routed.applied && routed.pendingAutoMerge) {
         // Await async `gh` merge outside the routing txn — never block the event loop with spawnSync.
@@ -507,6 +527,74 @@ export async function applyCompletion(workItemId, leaseToken, outcome) {
     }
     return routed;
 }
+/**
+ * NOT-368: when a developer or reviewer session_failed / timed_out with a high-confidence
+ * attributed auth cause, run the runtime's live auth probe and gather consecutive-park /
+ * transient-retry state for the role's route function.
+ */
+async function prepareAuthFailureRouting(workItemId, outcome) {
+    const item = getWorkItem(workItemId);
+    if (!item || (item.kind !== "developer" && item.kind !== "reviewer"))
+        return undefined;
+    const session = item.workerSessionId ? getWorkerSession(item.workerSessionId) : null;
+    const logPath = session?.logPath ?? outcome.logPath ?? null;
+    const runtimeHint = (session?.runtime ?? null);
+    const causes = classifyAttemptFailure({
+        outcomeKind: outcome.kind,
+        outcomeReason: outcome.reason ?? null,
+        logPath,
+        runtime: runtimeHint,
+    });
+    const primary = causes.find((c) => c.primary) ?? causes[0];
+    if (!primary || primary.code !== "authentication_configuration")
+        return undefined;
+    // Medium / unattributed ("Not logged in" with no vendor) keep the generic infra retry.
+    if (primary.confidence !== "high")
+        return undefined;
+    const haystack = `${readSpawnLogFailureText(logPath)}\n${outcome.reason ?? ""}`;
+    const classified = isCursorKeychainStuckOutput(haystack)
+        ? { runtime: "cursor_local", issue: { code: "cursor_keychain", message: defaultRemediationForRuntime("cursor_local", true) } }
+        : runtimeAuthClassificationForLog(haystack, runtimeHint);
+    const runtime = classified?.runtime ?? runtimeHint;
+    if (!runtime)
+        return undefined;
+    const remediation = classified?.issue.message?.trim() ||
+        defaultRemediationForRuntime(runtime, classified?.issue.code === "cursor_keychain");
+    const probeIssues = await runtimeIssuesUncached(runtime);
+    const probeStillFailing = authProbeConfirmsFailure(probeIssues);
+    const probeRemediation = remediationFromProbe(probeIssues, remediation);
+    return {
+        confidence: "high",
+        runtime,
+        remediation: probeStillFailing ? probeRemediation : remediation,
+        rawCause: primary.rawReason,
+        probeStillFailing,
+        consecutiveAuthParks: countConsecutiveAuthParks(item.issueId),
+        authTransientRetrySpent: issueSpentAuthTransientRetry(item.issueId),
+    };
+}
+/** Count trailing auth-park human actions on the issue (newest streak). */
+function countConsecutiveAuthParks(issueId) {
+    const actions = listHumanActionsForIssue(issueId);
+    let n = 0;
+    for (let i = actions.length - 1; i >= 0; i--) {
+        if (parseRuntimeAuthParkEvidence(actions[i].evidenceJson) == null)
+            break;
+        n++;
+    }
+    return n;
+}
+/** True when any prior developer/reviewer work item on this issue spent the transient auth retry. */
+function issueSpentAuthTransientRetry(issueId) {
+    for (const w of listWorkItemsForIssue(issueId)) {
+        if (w.kind !== "developer" && w.kind !== "reviewer")
+            continue;
+        const payload = parseWorkItemPayload(w.payloadJson);
+        if (payload[AUTH_TRANSIENT_RETRY_PAYLOAD_KEY] === true)
+            return true;
+    }
+    return false;
+}
 function parseWorkItemPayload(json) {
     if (!json)
         return {};
@@ -906,10 +994,10 @@ export function routeCapEscalation(issue, instance, item, cap) {
         instanceCompleted: false,
     };
 }
-export function routeAppliedOutcome(issue, instance, item, outcome) {
+export function routeAppliedOutcome(issue, instance, item, outcome, authFailure) {
     return item.kind === "developer"
-        ? applyDeveloper(issue, instance, item, outcome)
-        : applyReviewer(issue, instance, item, outcome);
+        ? applyDeveloper(issue, instance, item, outcome, authFailure)
+        : applyReviewer(issue, instance, item, outcome, authFailure);
 }
 function eventEmitter(issue, instance, workerSessionId, stage, round) {
     let causation = null;
@@ -955,7 +1043,7 @@ function applyProjectionTransition(issue, projection, patch) {
         ...patch,
     });
 }
-function applyDeveloper(issue, instance, item, outcome) {
+function applyDeveloper(issue, instance, item, outcome, authFailure) {
     const route = routeDeveloperOutcome(outcome, {
         currentRound: issue.currentRound,
         maxReviewRounds: issue.maxReviewRounds,
@@ -963,6 +1051,7 @@ function applyDeveloper(issue, instance, item, outcome) {
         maxInfraAttempts: issue.maxInfraAttempts,
         ciAttempts: issue.ciAttempts,
         maxCiAttempts: issue.maxCiAttempts,
+        ...(authFailure ? { authFailure } : {}),
     });
     const { projection, effect, advance } = projectDeveloperRoute(route, issue.status, issue.currentRound);
     const ev = eventEmitter(issue, instance, item.workerSessionId, projection.issueStatus, issue.currentRound);
@@ -1051,13 +1140,14 @@ function applyDeveloper(issue, instance, item, outcome) {
     const issueNow = getIssue(issue.id);
     return applyEffect(issue, instance, effect, route, issueNow, ev, item.id);
 }
-function applyReviewer(issue, instance, item, outcome) {
+function applyReviewer(issue, instance, item, outcome, authFailure) {
     let route = routeReviewerOutcome(outcome, {
         currentRound: issue.currentRound,
         maxReviewRounds: issue.maxReviewRounds,
         infraAttempts: issue.infraAttempts,
         maxInfraAttempts: issue.maxInfraAttempts,
         autoMerge: issue.autoMerge,
+        ...(authFailure ? { authFailure } : {}),
     }, issue.headSha);
     // NOT-184: a repair loop that keeps finding new blocking issues on the same file is not
     // converging — hand it to a human instead of queuing another developer round.
@@ -1240,6 +1330,8 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
                 ...(effect.retryReason ? { retryReason: effect.retryReason } : {}),
                 ...(effect.publishOnly ? { publishOnly: true } : {}),
                 ...(effect.branch ? { branch: effect.branch } : {}),
+                // NOT-368: persist that this infra retry spent the one transient auth retry.
+                ...(effect.authTransientRetry ? { [AUTH_TRANSIENT_RETRY_PAYLOAD_KEY]: true } : {}),
                 profileSnapshot: queuedProfileSnapshot(issue, kind),
             },
             idempotencyKey,
@@ -1261,6 +1353,10 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
         const pushDivergence = actionType === "policy_escalation" && !resumeAsReviewer
             ? (effect.pushDivergence ?? null)
             : null;
+        // NOT-368: confirmed runtime login park — resolve re-probes before re-queueing.
+        // Reviewer-origin parks keep resumeAsReviewer (re-queue reviewer) AND auth-park
+        // evidence (so resolve still re-probes); the two are not mutually exclusive.
+        const runtimeAuthPark = actionType === "policy_escalation" ? (effect.runtimeAuthPark ?? null) : null;
         // NOT-280: an unchanged worktree blocker (same fingerprint) lands on the action it
         // already raised — still open, or reopened when a Resume changed nothing — instead of
         // opening an identical one on every Resume.
@@ -1284,9 +1380,11 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
                 ? { review: reviewerOutcome.result, ...(nonConvergence ? { nonConvergence } : {}) }
                 : pushDivergence
                     ? { [PUSH_DIVERGENCE_EVIDENCE_KEY]: pushDivergence }
-                    : blockerFingerprint
-                        ? { [WORKTREE_BLOCKER_EVIDENCE_KEY]: { fingerprint: blockerFingerprint } }
-                        : undefined,
+                    : runtimeAuthPark
+                        ? { [RUNTIME_AUTH_PARK_EVIDENCE_KEY]: runtimeAuthPark }
+                        : blockerFingerprint
+                            ? { [WORKTREE_BLOCKER_EVIDENCE_KEY]: { fingerprint: blockerFingerprint } }
+                            : undefined,
             // issueNow.headSha, not issue.headSha: a stale outcome that itself exhausted the
             // infra budget already patched the newly observed head onto the issue above — the
             // pre-transition issue param would still carry the stale SHA a "resume" must not reuse.
@@ -2051,6 +2149,48 @@ export async function resolveHumanActionAndAdvanceAsync(actionId, resolvedBy, ch
             resumeLiveHeadSha = null;
         }
     }
+    // NOT-368: re-probe before resolving a runtime-auth park. A still-failing probe keeps
+    // the action open (no spawn); only a passing probe proceeds to resume on the salvaged
+    // branch without charging a round or infra attempt.
+    if (choice === "resume") {
+        const authParkAction = getHumanAction(actionId);
+        const authParkEvidence = authParkAction
+            ? parseRuntimeAuthParkEvidence(authParkAction.evidenceJson)
+            : null;
+        if (authParkAction?.status === "open" && authParkEvidence) {
+            let probeIssues = [];
+            try {
+                probeIssues = await runtimeIssuesUncached(authParkEvidence.runtime);
+            }
+            catch (err) {
+                console.error("[coordinator] auth-park resolve probe", actionId, err);
+                probeIssues = [
+                    {
+                        code: "runtime_auth",
+                        message: authParkEvidence.remediation,
+                    },
+                ];
+            }
+            const gate = gateRuntimeAuthParkResume({
+                evidence: authParkEvidence,
+                probeStillFailing: authProbeConfirmsFailure(probeIssues),
+                probeRemediation: remediationFromProbe(probeIssues, authParkEvidence.remediation),
+            });
+            if (!gate.proceed) {
+                // Refresh the open action's reason so the operator sees the remediation again.
+                try {
+                    updateOpenHumanAction(actionId, {
+                        reason: gate.message,
+                        question: questionFor("policy_escalation", gate.message, false),
+                    });
+                }
+                catch {
+                    // Best-effort — the 409 below is what keeps the action open.
+                }
+                return { ok: false, code: 409, error: gate.message };
+            }
+        }
+    }
     // NOT-196: the `gh` PR-state read runs here, outside any DB transaction — the sync
     // core below only consumes the pre-read state. Only close choices on issues with a
     // PR number pay for the call; anything unreadable resolves to "unknown" (or

package/bundle/server/dist/coordinator/human-resolution.js

@@ -1,3 +1,7 @@
+// NOT-368: auth-park evidence + resolve-time re-probe gate live in runtime-auth-park.ts;
+// re-exported here so the park/resume contract stays discoverable next to NOT-93's
+// deck_interaction_required resume (same roundKind: infra, no review-round spend).
+export { AUTH_TRANSIENT_RETRY_PAYLOAD_KEY, MAX_CONSECUTIVE_AUTH_PARKS, RUNTIME_AUTH_PARK_EVIDENCE_KEY, authProbeConfirmsFailure, gateRuntimeAuthParkResume, isRuntimeAuthParkAction, parseRuntimeAuthParkEvidence, remediationFromProbe, } from "./runtime-auth-park.js";
 /**
  * NOT-194: the stored response options for a merge-failure policy_escalation. Shared by
  * auto-merge.ts (which raises it) and commands.ts's responseOptionsFor merge-failure

package/bundle/server/dist/coordinator/human-resolution.test.js

@@ -1,6 +1,65 @@
-import { test } from "node:test";
+import { test, before, beforeEach } from "node:test";
 import assert from "node:assert/strict";
-import { resolveHumanActionOutcome, parseHumanResolution } from "./human-resolution.js";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveHumanActionOutcome, parseHumanResolution, gateRuntimeAuthParkResume, authProbeConfirmsFailure, remediationFromProbe, RUNTIME_AUTH_PARK_EVIDENCE_KEY, parseRuntimeAuthParkEvidence, } from "./human-resolution.js";
+import { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID, CURSOR_AUTH_REMEDIATION, CURSOR_KEYCHAIN_REMEDIATION, MUSE_AUTH_REMEDIATION, } from "@agent-dealer/shared";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-human-res-"));
+const { migrate, getDb } = await import("../db/index.js");
+const { createIssue, getIssue, transitionIssue } = await import("../repository/issues.js");
+const { listHumanActionsForIssue, getHumanAction } = await import("../repository/human-actions.js");
+const { claimWorkItem, listWorkItemsForIssue, getWorkItem } = await import("../repository/work-items.js");
+const { setRuntimeIssuesUncachedForTests } = await import("../adapters/agent-health.js");
+const { stubManagedCloneForTests } = await import("../adapters/managed-repo.js");
+const { startWorkflow, applyCompletion, resolveHumanActionAndAdvanceAsync, } = await import("./commands.js");
+const FIXTURE_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../../../shared/src/fixtures/runtime-auth");
+const MUSE_AUTH_LOG = fs.readFileSync(path.join(FIXTURE_DIR, "muse-exec-missing-credentials.txt"), "utf8");
+/** NOT-114 keychain has no capture file — same reconstruction as runtime-auth-health / routing tests. */
+const CURSOR_KEYCHAIN_STDERR = `Cursor couldn't save your login to the macOS keychain (errSecDuplicateItem, security exit code 45).
+The keychain item is stuck. Delete it and sign in again:
+  security delete-generic-password -s cursor-access-token -a cursor-user
+  agent login
+`;
+before(() => migrate());
+beforeEach(() => {
+    getDb().exec("DELETE FROM work_items");
+    setRuntimeIssuesUncachedForTests(null);
+    stubManagedCloneForTests("acme/app");
+});
+function newIssue(opts = {}) {
+    return createIssue({
+        title: "Auth park me",
+        description: "d",
+        acceptanceCriteria: "It works",
+        repo: "acme/app",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: 3,
+        maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        source: "manual",
+    }).id;
+}
+function claim(issueId) {
+    const item = claimWorkItem(`test-${issueId}`, { leaseMs: 60_000 });
+    assert.ok(item && item.issueId === issueId, "expected to lease this issue's work item");
+    return item;
+}
+async function complete(issueId, outcome) {
+    const item = claim(issueId);
+    return { item, result: await applyCompletion(item.id, item.leaseToken, outcome) };
+}
+function openAuthPark(issueId) {
+    return listHumanActionsForIssue(issueId).find((a) => a.status === "open" && parseRuntimeAuthParkEvidence(a.evidenceJson) != null);
+}
+function stubProbeFailing(remediation = MUSE_AUTH_REMEDIATION) {
+    setRuntimeIssuesUncachedForTests(async () => [{ code: "runtime_auth", message: remediation }]);
+}
+function stubProbePassing() {
+    setRuntimeIssuesUncachedForTests(async () => []);
+}
 // Reviewer finding #8: an unrecognized choice must be rejected, not silently treated as "close".
 test("parseHumanResolution rejects a choice not in that action type's allowed set", () => {
     assert.equal(parseHumanResolution("final_review", "bogus"), null);
@@ -115,3 +174,234 @@ test("operator_verification repair queues another repair round; verified/waive n
     assert.equal(result.roundKind, "review");
     assert.throws(() => resolveHumanActionOutcome({ actionType: "operator_verification", choice: "verified", note: "ok" }), /Unrecognized operator_verification choice/);
 });
+// --- NOT-368: resolve-time auth-park re-probe ---
+const AUTH_PARK_EVIDENCE = {
+    runtime: "muse_code",
+    remediation: MUSE_AUTH_REMEDIATION,
+    rawCause: "missing meta credentials: run muse login or set META_API_KEY",
+    consecutivePark: 1,
+};
+test("NOT-368: authProbeConfirmsFailure is true for runtime_auth and cursor_keychain only", () => {
+    assert.equal(authProbeConfirmsFailure([{ code: "runtime_auth", message: MUSE_AUTH_REMEDIATION }]), true);
+    assert.equal(authProbeConfirmsFailure([{ code: "cursor_keychain", message: "keychain stuck" }]), true);
+    assert.equal(authProbeConfirmsFailure([{ code: "cli_missing", message: "install muse" }]), false);
+    assert.equal(authProbeConfirmsFailure([]), false);
+});
+test("NOT-368: remediationFromProbe keeps keychain text when probe only reports runtime_auth", () => {
+    assert.equal(remediationFromProbe([{ code: "runtime_auth", message: CURSOR_AUTH_REMEDIATION }], CURSOR_KEYCHAIN_REMEDIATION), CURSOR_KEYCHAIN_REMEDIATION);
+    assert.equal(remediationFromProbe([{ code: "cursor_keychain", message: CURSOR_KEYCHAIN_REMEDIATION }], "stale fallback"), CURSOR_KEYCHAIN_REMEDIATION);
+    assert.equal(remediationFromProbe([{ code: "runtime_auth", message: "probe says login" }], MUSE_AUTH_REMEDIATION), "probe says login");
+    assert.equal(remediationFromProbe([], CURSOR_KEYCHAIN_REMEDIATION), CURSOR_KEYCHAIN_REMEDIATION);
+});
+test("NOT-368: gate helper — still-failing probe refuses resume", () => {
+    const gate = gateRuntimeAuthParkResume({
+        evidence: AUTH_PARK_EVIDENCE,
+        probeStillFailing: true,
+        probeRemediation: MUSE_AUTH_REMEDIATION,
+    });
+    assert.equal(gate.proceed, false);
+    if (!gate.proceed) {
+        assert.match(gate.message, /still not authenticated/i);
+        assert.match(gate.remediation, /muse login|META_API_KEY/i);
+    }
+});
+test("NOT-368: gate helper — passing probe allows resume (infra roundKind, no charge)", () => {
+    const gate = gateRuntimeAuthParkResume({
+        evidence: AUTH_PARK_EVIDENCE,
+        probeStillFailing: false,
+    });
+    assert.deepStrictEqual(gate, { proceed: true });
+    const resume = resolveHumanActionOutcome({ actionType: "policy_escalation", choice: "resume" });
+    assert.equal(resume.issueStatus, "developing");
+    assert.equal(resume.startNewRound, true);
+    assert.equal(resume.roundKind, "infra");
+    assert.equal(RUNTIME_AUTH_PARK_EVIDENCE_KEY, "runtimeAuthPark");
+});
+// --- NOT-368: coordinator-level apply + resolve (probe stubbed) ---
+test("NOT-368: confirmed auth park persists remediation, does not charge infraAttempts", async () => {
+    stubProbeFailing();
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    transitionIssue(issueId, "developing", { branch: "issue-auth-salvage" });
+    const infraBefore = getIssue(issueId).infraAttempts;
+    const { result } = await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    assert.equal(result.applied, true);
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(getIssue(issueId).infraAttempts, infraBefore, "park must not charge infra");
+    const action = openAuthPark(issueId);
+    assert.ok(action, "expected open auth-park human action");
+    assert.match(action.reason, /muse login|META_API_KEY/i);
+    const evidence = parseRuntimeAuthParkEvidence(action.evidenceJson);
+    assert.ok(evidence);
+    assert.equal(evidence.runtime, "muse_code");
+    assert.match(evidence.remediation, /muse login|META_API_KEY/i);
+    assert.equal(listWorkItemsForIssue(issueId).filter((w) => w.status === "pending").length, 0);
+});
+test("NOT-368: keychain classification + runtime_auth probe keeps keychain remediation (park + resolve)", async () => {
+    // Live status often confirms failure as ordinary runtime_auth; that must not replace
+    // the classifier's keychain deletion instructions (park or Resume rewrite).
+    setRuntimeIssuesUncachedForTests(async () => [
+        { code: "runtime_auth", message: CURSOR_AUTH_REMEDIATION },
+    ]);
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    const infraBefore = getIssue(issueId).infraAttempts;
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: CURSOR_KEYCHAIN_STDERR.trim().slice(0, 400),
+    });
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(getIssue(issueId).infraAttempts, infraBefore);
+    const action = openAuthPark(issueId);
+    assert.ok(action, "expected open auth-park human action");
+    assert.match(action.reason, /delete-generic-password|errSecDuplicateItem/i);
+    assert.doesNotMatch(action.reason, /CURSOR_API_KEY/);
+    const evidence = parseRuntimeAuthParkEvidence(action.evidenceJson);
+    assert.ok(evidence);
+    assert.equal(evidence.runtime, "cursor_local");
+    assert.equal(evidence.remediation, CURSOR_KEYCHAIN_REMEDIATION);
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "resume");
+    assert.equal(resolved.ok, false);
+    assert.equal(resolved.code, 409);
+    assert.match(resolved.error, /delete-generic-password|errSecDuplicateItem/i);
+    assert.doesNotMatch(resolved.error, /CURSOR_API_KEY/);
+    assert.match(getHumanAction(action.id).reason, /delete-generic-password|errSecDuplicateItem/i);
+    assert.equal(getHumanAction(action.id).status, "open");
+});
+test("NOT-368: resolve with still-failing probe keeps action open and spawns nothing", async () => {
+    stubProbeFailing();
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    const action = openAuthPark(issueId);
+    const pendingBefore = listWorkItemsForIssue(issueId).filter((w) => w.status === "pending").length;
+    const infraBefore = getIssue(issueId).infraAttempts;
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "resume");
+    assert.equal(resolved.ok, false);
+    assert.equal(resolved.code, 409);
+    assert.match(resolved.error, /still not authenticated/i);
+    assert.equal(getHumanAction(action.id).status, "open");
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(getIssue(issueId).infraAttempts, infraBefore);
+    assert.equal(listWorkItemsForIssue(issueId).filter((w) => w.status === "pending").length, pendingBefore);
+});
+test("NOT-368: resolve with passing probe re-queues developer on salvaged branch with no infra charge", async () => {
+    stubProbeFailing();
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    const salvageBranch = "issue-auth-salvage-resume";
+    transitionIssue(issueId, "developing", { branch: salvageBranch });
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    const action = openAuthPark(issueId);
+    const roundBefore = getIssue(issueId).currentRound;
+    const infraAtPark = getIssue(issueId).infraAttempts;
+    stubProbePassing();
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "resume");
+    assert.equal(resolved.ok, true);
+    assert.equal(getHumanAction(action.id).status, "resolved");
+    assert.equal(getIssue(issueId).status, "developing");
+    assert.equal(getIssue(issueId).branch, salvageBranch);
+    assert.equal(getIssue(issueId).currentRound, roundBefore, "resume must not spend a review round");
+    // Infra resume resets the counter (NOT-93) — it must not land above the park-time value
+    // via a charge, and typically returns to 0.
+    assert.ok(getIssue(issueId).infraAttempts <= infraAtPark);
+    const pending = listWorkItemsForIssue(issueId).filter((w) => w.status === "pending" && w.kind === "developer");
+    assert.equal(pending.length, 1);
+    assert.equal(getWorkItem(pending[0].id).kind, "developer");
+});
+test("NOT-368: probe-passing auth failure charges infra by exactly 1; second parks even when probe passes", async () => {
+    stubProbePassing();
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    assert.equal(getIssue(issueId).infraAttempts, 0);
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    assert.equal(getIssue(issueId).infraAttempts, 1, "transient auth retry charges exactly +1");
+    assert.equal(getIssue(issueId).status, "developing");
+    const retry = listWorkItemsForIssue(issueId).find((w) => w.status === "pending" && w.kind === "developer");
+    assert.ok(retry);
+    const payload = JSON.parse(retry.payloadJson);
+    assert.equal(payload.authTransientRetry, true);
+    // Second high-confidence auth failure parks even though the probe still passes.
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(getIssue(issueId).infraAttempts, 1, "park after transient retry must not charge again");
+    assert.ok(openAuthPark(issueId));
+});
+test("NOT-368: four consecutive confirmed auth parks escalate on the 4th (persisted streak)", async () => {
+    const issueId = newIssue({ maxInfraAttempts: 5 });
+    startWorkflow(issueId);
+    for (let park = 1; park <= 3; park++) {
+        stubProbeFailing();
+        await complete(issueId, {
+            kind: "session_failed",
+            reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+        });
+        const action = openAuthPark(issueId);
+        assert.ok(action, `expected auth park #${park}`);
+        const evidence = parseRuntimeAuthParkEvidence(action.evidenceJson);
+        assert.equal(evidence.consecutivePark, park);
+        assert.equal(getIssue(issueId).infraAttempts, 0);
+        stubProbePassing();
+        const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "resume");
+        assert.equal(resolved.ok, true, `resume after park #${park}`);
+    }
+    stubProbeFailing();
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(getIssue(issueId).infraAttempts, 0);
+    const fourth = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+    assert.ok(fourth);
+    assert.match(fourth.reason, /Repeated .* login failures/i);
+    assert.equal(parseRuntimeAuthParkEvidence(fourth.evidenceJson), null, "4th outcome is a distinct escalation, not another auth park");
+});
+test("NOT-368: reviewer session_failed with confirmed auth parks (resumeAsReviewer + evidence)", async () => {
+    stubProbeFailing();
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await complete(issueId, {
+        kind: "clean_handoff",
+        branch: "issue-reviewer-auth",
+        headSha: "abc123",
+        baseSha: "base1",
+        prNumber: 42,
+        prUrl: "https://gh/pr/42",
+    });
+    assert.equal(getIssue(issueId).status, "reviewing");
+    const infraBefore = getIssue(issueId).infraAttempts;
+    await complete(issueId, {
+        kind: "session_failed",
+        reason: MUSE_AUTH_LOG.trim().slice(0, 300),
+    });
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(getIssue(issueId).infraAttempts, infraBefore);
+    const action = openAuthPark(issueId);
+    assert.ok(action, "reviewer auth failure must park with runtimeAuthPark evidence");
+    assert.match(action.reason, /muse login|META_API_KEY/i);
+    const preview = JSON.parse(action.continuationPreviewJson);
+    assert.equal(preview.resumeRole, "reviewer");
+    assert.equal(preview.resumeHeadSha, "abc123");
+    stubProbePassing();
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "resume");
+    assert.equal(resolved.ok, true);
+    assert.equal(getIssue(issueId).status, "reviewing");
+    const pending = listWorkItemsForIssue(issueId).filter((w) => w.status === "pending" && w.kind === "reviewer");
+    assert.equal(pending.length, 1);
+});