agent-dealer 1.2.4 → 1.2.5

package/bundle/server/dist/capacity/claude-local-cache.test.js

@@ -1,8 +1,8 @@
 // packages/server/src/capacity/claude-local-cache.test.ts
 //
 // NOT-268: Claude capacity local-first ladder — local cache 5H/1W plus a
-// one-hour paid fallback. No test here performs a live provider request:
-// every probe spawn goes through an injected fake runner.
+// free `/usage` refresh after one hour stale. No test here performs a live
+// provider request: every probe spawn goes through an injected fake runner.
 import { test, before, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
 import fs from "node:fs";
@@ -42,17 +42,39 @@ function fullCacheFixture(fetchedAtMs) {
         },
     });
 }
-function probeStreamFixture(observedIso, costUsd = 0.0003) {
+// Mirrors a real `claude -p "/usage"` stream at 2.1.283: a local-command
+// result event carrying `usage_report.rate_limits.limits[]` (verified live
+// 2026-09-27 — see claude-local-cache.ts module header), followed by the
+// terminal `result` event. Real runs cost $0 (no model call); `costUsd`
+// defaults to 0 but stays overridable for the cost-plumbing assertions.
+function probeStreamFixture(observedIso, costUsd = 0) {
     return [
         JSON.stringify({
-            type: "rate_limit_event",
+            type: "assistant",
             timestamp: observedIso,
-            rate_limit_info: {
-                status: "allowed",
-                unifiedWindows: [
-                    { window: "five_hour", utilization: 0.2, resetsAt: FIVE_HOUR_RESET_SEC },
-                    { window: "seven_day", utilization: 0.4, resetsAt: SEVEN_DAY_RESET_SEC },
-                ],
+            local_command_run: { command: "usage", args: "" },
+            usage_report: {
+                session: { total_cost_usd: 0 },
+                rate_limits: {
+                    limits: [
+                        {
+                            kind: "session",
+                            group: "session",
+                            percent: 20,
+                            resets_at: new Date(FIVE_HOUR_RESET_SEC * 1000).toISOString(),
+                            severity: "normal",
+                            is_active: false,
+                        },
+                        {
+                            kind: "weekly_all",
+                            group: "weekly",
+                            percent: 40,
+                            resets_at: new Date(SEVEN_DAY_RESET_SEC * 1000).toISOString(),
+                            severity: "normal",
+                            is_active: true,
+                        },
+                    ],
+                },
             },
         }),
         JSON.stringify({
@@ -263,7 +285,7 @@ test("a 2-hour-old cache ingests with its true age and reads expired, never live
         assert.equal(w.unavailableReason, "expired");
     }
 });
-test("paid fallback defaults on; explicit off and unrecognized values never spawn", async () => {
+test("refresh defaults on; explicit off and unrecognized values never spawn", async () => {
     for (const value of [undefined, "", "paid-after-1h"]) {
         if (value === undefined)
             delete process.env[CLAUDE_CAPACITY_REFRESH_ENV];
@@ -277,11 +299,26 @@ test("paid fallback defaults on; explicit off and unrecognized values never spaw
         const outcome = await maybeProbeClaudeCapacity(NOW_MS, { runner: throwingRunner });
         assert.deepEqual(outcome, { probed: false, reason: "disabled" });
     }
-    process.env[CLAUDE_CAPACITY_REFRESH_ENV] = "paid-after-1h";
+    delete process.env[CLAUDE_CAPACITY_REFRESH_ENV];
     assert.equal(isClaudePaidFallbackEnabled(), true);
 });
-test("default-on fallback suppresses a fresh sample; stale data triggers exactly one", async () => {
-    delete process.env[CLAUDE_CAPACITY_REFRESH_ENV];
+test("extractClaudeUsageReportLimits reads the /usage local-command result", async () => {
+    const { extractClaudeUsageReportLimits } = await import("./claude-local-cache.js");
+    const observedIso = new Date(NOW_MS).toISOString();
+    const events = probeStreamFixture(observedIso).split("\n").map((l) => JSON.parse(l));
+    const readings = extractClaudeUsageReportLimits(events, NOW_MS);
+    assert.ok(readings);
+    assert.equal(readings.length, 2);
+    const fiveHour = readings.find((w) => w.criticalRole === "five_hour");
+    const weekly = readings.find((w) => w.criticalRole === "weekly");
+    assert.equal(fiveHour.usedPercent, 20);
+    assert.equal(weekly.usedPercent, 40);
+    assert.equal(fiveHour.observedAt, observedIso);
+    assert.equal(fiveHour.evidenceRef, "claude-probe:usage-command");
+    // No usage_report anywhere in the stream — nothing fabricated.
+    assert.equal(extractClaudeUsageReportLimits([{ type: "result" }], NOW_MS), null);
+});
+test("default-on refresh suppresses a fresh sample; stale data triggers exactly one", async () => {
     fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS - 10 * 60_000));
     assert.equal(ingestClaudeLocalCache(NOW_MS), 2);
     assert.ok((newestValidClaudeObservationMs(NOW_MS) ?? 0) > NOW_MS - 60 * 60_000);
@@ -304,8 +341,7 @@ test("default-on fallback suppresses a fresh sample; stale data triggers exactly
     assert.equal(outcomes.filter((o) => o.reason === "shared").length, 4);
     assert.ok(outcomes.every((o) => o.probed && o.ok));
 });
-test("probe argv pins the fixed prompt, cheapest model, no tools/MCP, one turn, ≤$0.01", async () => {
-    process.env[CLAUDE_CAPACITY_REFRESH_ENV] = "paid-after-1h";
+test("probe argv pins the fixed /usage command plus structural model-turn safeguards", async () => {
     fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS - 61 * 60_000));
     assert.equal(ingestClaudeLocalCache(NOW_MS), 2);
     let seenBin = "";
@@ -322,7 +358,7 @@ test("probe argv pins the fixed prompt, cheapest model, no tools/MCP, one turn,
     assert.equal(seenBin, "/fake/claude");
     assert.deepEqual(seenArgv, [
         "-p",
-        "Reply with exactly: ok",
+        "/usage",
         "--model",
         "haiku",
         "--max-turns",
@@ -337,13 +373,14 @@ test("probe argv pins the fixed prompt, cheapest model, no tools/MCP, one turn,
         "--max-budget-usd",
         "0.01",
     ]);
-    // Semantic pins behind the exact match: cheapest model, hard one-turn
-    // bound, tools fully off, MCP restricted to none passed, stream JSON,
-    // hard budget cap.
+    // Semantic pins behind the exact match: no MCP config passed, cheapest
+    // model + hard one-turn bound + no tools kept as structural safeguards
+    // (2026-09-27 review hardening) even though `/usage` never reaches the
+    // model on 2.1.283, plus the defensive budget cap.
+    assert.ok(!seenArgv.includes("--mcp-config"));
     assert.equal(seenArgv[seenArgv.indexOf("--model") + 1], "haiku");
     assert.equal(seenArgv[seenArgv.indexOf("--max-turns") + 1], "1");
     assert.equal(seenArgv[seenArgv.indexOf("--tools") + 1], "");
-    assert.ok(!seenArgv.includes("--mcp-config"));
     const budget = Number(seenArgv[seenArgv.indexOf("--max-budget-usd") + 1]);
     assert.ok(Number.isFinite(budget) && budget <= 0.01);
     assert.equal(seenArgv.filter((a) => a === "-p").length, 1);
@@ -357,7 +394,7 @@ test("probe success updates both 5H and 1W and records cost without prompt/outpu
     assert.equal(ingestClaudeLocalCache(NOW_MS), 2);
     const marker = "probe-stream-marker-must-never-reach-log";
     const runner = async () => ({
-        stdout: `${probeStreamFixture(new Date(NOW_MS).toISOString(), 0.0007)}\n${JSON.stringify({ type: "assistant", text: marker })}`,
+        stdout: `${probeStreamFixture(new Date(NOW_MS).toISOString())}\n${JSON.stringify({ type: "assistant", text: marker })}`,
         exitCode: 0,
         timedOut: false,
         spawnError: null,
@@ -365,28 +402,134 @@ test("probe success updates both 5H and 1W and records cost without prompt/outpu
     const result = await runClaudeCapacityProbe(NOW_MS, { runner });
     assert.equal(result.ok, true);
     assert.equal(result.failureKind, null);
-    assert.equal(result.costUsd, 0.0007);
+    assert.equal(result.costUsd, 0);
     assert.deepEqual(result.windowsUpdated, ["claude_unified_five_hour", "claude_unified_seven_day"]);
     const rows = listCapacitySnapshots("claude_code");
     assert.equal(rows.find((r) => r.providerBucket === "five_hour").remainingPercent, 80);
     assert.equal(rows.find((r) => r.providerBucket === "seven_day").remainingPercent, 60);
     assert.equal(rows.find((r) => r.providerBucket === "five_hour").observedAt, new Date(NOW_MS).toISOString());
     const logText = fs.readFileSync(probeDiagnosticLogPath(), "utf8");
-    assert.ok(logText.includes('"costUsd":0.0007'));
+    assert.ok(logText.includes('"costUsd":0'));
     assert.ok(!logText.includes("Reply with exactly"));
     assert.ok(!logText.includes(marker));
 });
-test("probe success via the cache side effect when the stream carries no windows", async () => {
+test("probe rejects and ingests nothing when the result reports nonzero cost", async () => {
+    // Reviewer-requested hardening (PR #165): any charge means /usage did not
+    // resolve locally as expected — reject the whole run rather than trusting
+    // windows a real (unexpected) model turn happened to produce.
+    process.env[CLAUDE_CAPACITY_REFRESH_ENV] = "paid-after-1h";
+    fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS - 61 * 60_000));
+    assert.equal(ingestClaudeLocalCache(NOW_MS), 2);
+    const runner = async () => ({
+        stdout: probeStreamFixture(new Date(NOW_MS).toISOString(), 0.0007),
+        exitCode: 0,
+        timedOut: false,
+        spawnError: null,
+    });
+    const result = await runClaudeCapacityProbe(NOW_MS, { runner });
+    assert.equal(result.ok, false);
+    assert.equal(result.failureKind, "unexpected_cost");
+    assert.equal(result.costUsd, 0.0007);
+    assert.deepEqual(result.windowsUpdated, []);
+    // Last-good rows from before the rejected run are untouched.
+    const rows = listCapacitySnapshots("claude_code");
+    assert.equal(rows.find((r) => r.providerBucket === "five_hour").remainingPercent, 83);
+});
+test("probe rejects and ingests nothing when cost cannot be verified as zero", async () => {
+    // Reviewer-requested hardening, round 2 (PR #165): a stream with the
+    // local-command marker and well-formed windows, but a `result` event that
+    // omits `total_cost_usd` (costUsd === null), must fail closed exactly like
+    // a confirmed positive charge — null is not evidence of zero cost.
+    process.env[CLAUDE_CAPACITY_REFRESH_ENV] = "paid-after-1h";
+    fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS - 61 * 60_000));
+    assert.equal(ingestClaudeLocalCache(NOW_MS), 2);
+    const runner = async () => ({
+        stdout: [
+            JSON.stringify({
+                type: "assistant",
+                timestamp: new Date(NOW_MS).toISOString(),
+                local_command_run: { command: "usage", args: "" },
+                usage_report: {
+                    rate_limits: {
+                        limits: [
+                            { kind: "session", percent: 20, resets_at: new Date(FIVE_HOUR_RESET_SEC * 1000).toISOString() },
+                            { kind: "weekly_all", percent: 40, resets_at: new Date(SEVEN_DAY_RESET_SEC * 1000).toISOString() },
+                        ],
+                    },
+                },
+            }),
+            // No `result` event at all — total_cost_usd is unknowable.
+        ].join("\n"),
+        exitCode: 0,
+        timedOut: false,
+        spawnError: null,
+    });
+    const result = await runClaudeCapacityProbe(NOW_MS, { runner });
+    assert.equal(result.ok, false);
+    assert.equal(result.failureKind, "unexpected_cost");
+    assert.equal(result.costUsd, null);
+    assert.deepEqual(result.windowsUpdated, []);
+    const rows = listCapacitySnapshots("claude_code");
+    assert.equal(rows.find((r) => r.providerBucket === "five_hour").remainingPercent, 83);
+});
+test("probe rejects and ingests nothing when the local-command marker is absent", async () => {
+    // Reviewer-requested hardening (PR #165): a stream that never shows
+    // `/usage` resolving locally must not be trusted, even if it happens to
+    // carry a well-formed usage_report (e.g. a different CLI build echoing it
+    // from a real turn) or a fresh cache-file side effect.
+    process.env[CLAUDE_CAPACITY_REFRESH_ENV] = "paid-after-1h";
+    fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS - 61 * 60_000));
+    assert.equal(ingestClaudeLocalCache(NOW_MS), 2);
+    const runner = async () => {
+        fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS + 5_000));
+        return {
+            stdout: [
+                JSON.stringify({
+                    type: "assistant",
+                    timestamp: new Date(NOW_MS).toISOString(),
+                    usage_report: {
+                        rate_limits: { limits: [{ kind: "session", percent: 20, resets_at: null }] },
+                    },
+                }),
+                JSON.stringify({ type: "result", is_error: false, total_cost_usd: 0 }),
+            ].join("\n"),
+            exitCode: 0,
+            timedOut: false,
+            spawnError: null,
+        };
+    };
+    const result = await runClaudeCapacityProbe(NOW_MS, { runner });
+    assert.equal(result.ok, false);
+    assert.equal(result.failureKind, "not_local_command");
+    assert.deepEqual(result.windowsUpdated, []);
+    const rows = listCapacitySnapshots("claude_code");
+    assert.equal(rows.find((r) => r.providerBucket === "five_hour").remainingPercent, 83);
+});
+test("probe success via the cache side effect when usage_report carries no windows", async () => {
     process.env[CLAUDE_CAPACITY_REFRESH_ENV] = "paid-after-1h";
     fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS - 61 * 60_000));
-    // The stream is empty but the probe run itself refreshes Claude's own
-    // cache file — the re-read must count as success.
+    // The local-command marker is present (so the run is trusted) and cost is
+    // $0, but usage_report carries no usable limits[] — the cache re-read
+    // (the probe run itself refreshes Claude's own cache file) still counts
+    // as corroborating success.
     const runner = async () => {
         // A real probe refreshes Claude's own cache file while it runs, so the
         // new `fetchedAtMs` is later than the pre-spawn `NOW_MS` stamp — the
         // post-spawn re-read must accept it, not reject it as future.
         fs.writeFileSync(cacheFile, fullCacheFixture(NOW_MS + 5_000));
-        return { stdout: "", exitCode: 0, timedOut: false, spawnError: null };
+        return {
+            stdout: [
+                JSON.stringify({
+                    type: "assistant",
+                    timestamp: new Date(NOW_MS).toISOString(),
+                    local_command_run: { command: "usage", args: "" },
+                }),
+                JSON.stringify({ type: "result", is_error: false, total_cost_usd: 0 }),
+            ].join("\n"),
+            exitCode: 0,
+            timedOut: false,
+            spawnError: null,
+        };
     };
     const result = await runClaudeCapacityProbe(NOW_MS, { runner });
     assert.equal(result.ok, true);
@@ -408,7 +551,9 @@ test("probe failure preserves last-good rows and enters bounded backoff", async
     const first = await maybeProbeClaudeCapacity(NOW_MS, { runner: failing });
     assert.equal(first.probed, true);
     assert.equal(first.ok, false);
-    assert.equal(first.failureKind, "nonzero_exit");
+    // Unparsable stdout ("not-json") means no local-command marker is found —
+    // that check runs before the nonzero-exit fallback.
+    assert.equal(first.failureKind, "not_local_command");
     // Last-good rows are untouched by the failed probe (0.17 used → 83 left).
     const rows = listCapacitySnapshots("claude_code");
     assert.equal(rows.find((r) => r.providerBucket === "five_hour").remainingPercent, 83);

package/bundle/server/dist/capacity/muse-host.js

@@ -87,13 +87,32 @@
 //   shell restriction) is unaffected.
 // This question was escalated twice on this ticket (product_scope_decision,
 // resolved both times); the decision above is final for NOT-270's scope.
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { MUSE_CLI_ENV, resolveMuseAuthFile, resolveMuseBin } from "../cli-env.js";
+import { getDataDir } from "../db/index.js";
+import { parseMuseVersion } from "../adapters/muse-capability.js";
 import { buildMuseDeveloperSettings } from "../runners/muse-code-settings.js";
 import { MSP_USAGE_CHANGED, MUSE_CLIENT_INFO, MUSE_SERVE_ARGV, assertMuseExecMethod, assertMuseReadOnlyMethod, hasMuseCredential, ingestMuseUsagePayload, museCapacityTimeoutMs, museClassifyRpcError, museEvidenceRef, museRefreshThrottleMs, museUuidv7, noteMuseCapacityFailure, parseMuseRpcLine, } from "./muse.js";
+function readResolvedMuseVersion() {
+    return new Promise((resolve) => {
+        execFile(resolveMuseBin(), ["--version"], { encoding: "utf8", timeout: 30_000, env: { ...process.env, ...MUSE_CLI_ENV } }, (err, stdout) => resolve(err ? null : parseMuseVersion(stdout)));
+    });
+}
+/**
+ * NOT-273: dedicated cwd for the coordinator-owned `muse serve` child.
+ * The spawn must never inherit the server process's ambient working
+ * directory (in a maintainer's `npm run dev` checkout that is the repo
+ * itself, where a stray `git add . && git commit` in the child would land
+ * real commits on the checkout). Created if missing.
+ */
+export function resolveMuseHostCwd() {
+    const dir = path.join(getDataDir(), "capacity", "muse-host-home");
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
 /**
  * NOT-270 serve lane: the owned host must run workers under the same
  * posture as the exec lane's per-attempt settings — no MCP servers, no
@@ -171,6 +190,14 @@ export class MuseCapacityHost {
     observedOnConnection = false;
     /** Increments on every spawn — tests use it to prove host reuse/restart. */
     connectionEpoch = 0;
+    /**
+     * NOT-277: the Muse version the live child runs — the on-disk binary's reported version, read
+     * immediately before the spawn and again after the handshake; null when unknown or when the
+     * binary changed across the spawn. A long-lived host keeps running the build it started on
+     * after an auto-update, so developer work only uses it when this is the capability-checked
+     * version (see `ensureStartedOnVersion`).
+     */
+    runningVersion = null;
     /**
      * Server-owned XDG home for the host (worker settings + auth link).
      * Built lazily on first spawn, reused across restarts, removed on
@@ -241,6 +268,7 @@ export class MuseCapacityHost {
         const child = this.child;
         this.child = null;
         this.dead = true;
+        this.runningVersion = null;
         for (const [, p] of this.pending) {
             try {
                 p.resolve({});
@@ -457,8 +485,28 @@ export class MuseCapacityHost {
             this.starting = null;
         }
     }
+    /**
+     * NOT-277: start (or reuse) the host, and report whether it runs `version`. A live host on any
+     * other (or an unknown) version is restarted onto the current on-disk binary when it is idle;
+     * while real turns are using it, it is left alone and this returns false (the caller runs its
+     * work on the exec lane instead). Never true for a host not known to run `version`.
+     */
+    async ensureStartedOnVersion(version) {
+        if (!(await this.ensureStarted()))
+            return false;
+        if (this.runningVersion === version)
+            return true;
+        if (this.hasInflightExecution() || this.inflightRead)
+            return false;
+        this.killChild();
+        if (!(await this.ensureStarted()))
+            return false;
+        return this.runningVersion === version;
+    }
     async start() {
         this.killChild();
+        const readVersion = this.opts.readVersion ?? (this.opts.command ? async () => null : readResolvedMuseVersion);
+        const versionBefore = await readVersion();
         const timeoutMs = this.opts.timeoutMs ?? museCapacityTimeoutMs();
         const mergedEnv = this.mergedEnv();
         if (!hasMuseCredential(mergedEnv, this.opts.authFilePath ?? resolveMuseAuthFile())) {
@@ -469,7 +517,12 @@ export class MuseCapacityHost {
         const args = this.opts.args ?? [...MUSE_SERVE_ARGV];
         let child;
         try {
-            child = spawn(command, args, {
+            // NOT-273: explicit cwd — never inherit the server process's ambient
+            // working directory (which in dev is the repo checkout itself).
+            const cwd = this.opts.cwd ?? resolveMuseHostCwd();
+            const spawnFn = this.opts.spawnImpl ?? spawn;
+            child = spawnFn(command, args, {
+                cwd,
                 stdio: ["pipe", "pipe", "pipe"],
                 env: { ...mergedEnv, ...MUSE_CLI_ENV },
             });
@@ -566,6 +619,11 @@ export class MuseCapacityHost {
             this.killChild();
             return false;
         }
+        // The spawned build is the on-disk one only if the binary did not change across the spawn.
+        const versionAfter = await readVersion();
+        if (this.isCurrentChild(child)) {
+            this.runningVersion = versionBefore !== null && versionBefore === versionAfter ? versionBefore : null;
+        }
         return true;
     }
     startFailure = null;

package/bundle/server/dist/capacity/muse-host.test.js

@@ -21,7 +21,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-host-"));
-import { getMuseCapacityHost, maybeRefreshMuseCapacityFromHost, MuseCapacityHost, prepareMuseServeHome, refreshMuseCapacityFromHost, resetMuseCapacityHostForTests, resetMuseCapacityRefreshState, shutdownMuseCapacityHost, } from "./muse-host.js";
+import { getMuseCapacityHost, maybeRefreshMuseCapacityFromHost, MuseCapacityHost, prepareMuseServeHome, refreshMuseCapacityFromHost, resetMuseCapacityHostForTests, resetMuseCapacityRefreshState, resolveMuseHostCwd, shutdownMuseCapacityHost, } from "./muse-host.js";
 import { ingestMuseUsagePayload, museRefreshThrottleMs, noteMuseCapacityFailure, } from "./muse.js";
 const { migrate } = await import("../db/index.js");
 const { clearAllCapacitySnapshots, listCapacitySnapshots } = await import("../repository/runtime-capacity.js");
@@ -342,6 +342,66 @@ test("a stale child's late close cannot kill its replacement", async () => {
         await host.shutdown();
     }
 });
+// NOT-277: developer work is only served on a host known to run the capability-checked build.
+function versionedHost(versions) {
+    let i = 0;
+    const readVersion = async () => versions[Math.min(i++, versions.length - 1)] ?? null;
+    return new MuseCapacityHost({ ...hostOpts("persistent-full"), readVersion });
+}
+test("the host records the version it was spawned on; a matching host is reused", async () => {
+    const host = versionedHost(["1.4.0-R4161.1"]);
+    try {
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4161.1"), true);
+        assert.equal(host.runningVersion, "1.4.0-R4161.1");
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4161.1"), true);
+        assert.equal(host.connectionEpoch, 1, "no restart when the host already runs the version");
+    }
+    finally {
+        await host.shutdown();
+    }
+});
+test("an idle host on an older build is restarted onto the confirmed version", async () => {
+    // Spawned on B (before + after the handshake), then the binary is C for the restart.
+    const host = versionedHost(["1.4.0-R4161.1", "1.4.0-R4161.1", "1.4.0-R4302.1"]);
+    try {
+        assert.ok(await host.ensureStarted());
+        assert.equal(host.runningVersion, "1.4.0-R4161.1");
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4302.1"), true);
+        assert.equal(host.connectionEpoch, 2, "restarted onto the checked build");
+        assert.equal(host.runningVersion, "1.4.0-R4302.1");
+    }
+    finally {
+        await host.shutdown();
+    }
+});
+test("a busy host on an older build is left alone and not used", async () => {
+    const host = versionedHost(["1.4.0-R4161.1", "1.4.0-R4161.1", "1.4.0-R4302.1"]);
+    try {
+        assert.ok(await host.ensureStarted());
+        // An admitted turn on the shared connection: never torn down under it.
+        const waiting = host.waitForHostNotification(() => false, 5_000);
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4302.1"), false);
+        assert.equal(host.connectionEpoch, 1);
+        assert.ok(host.isConnected());
+        await host.shutdown();
+        await waiting;
+    }
+    finally {
+        await host.shutdown();
+    }
+});
+test("a binary that changed across the spawn leaves the host's version unknown (never served)", async () => {
+    // Changes across the first spawn and again across the restart.
+    const host = versionedHost(["1.4.0-R4161.1", "1.4.0-R4302.1", "1.4.0-R4302.1", "1.5.0-R5000.1"]);
+    try {
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4302.1"), false);
+        assert.equal(host.connectionEpoch, 2);
+        assert.equal(host.runningVersion, null);
+    }
+    finally {
+        await host.shutdown();
+    }
+});
 test("clean shutdown releases the child process", async () => {
     const host = new MuseCapacityHost(hostOpts("persistent-full"));
     assert.equal((await host.readUsage()).status, "observed");
@@ -458,6 +518,70 @@ test("prepareMuseServeHome links the ambient login, or records API-key auth", as
     }
     fs.rmSync(ambientRoot, { recursive: true, force: true });
 });
+test("NOT-273: the serve child spawns with an explicit cwd under the managed data dir", async () => {
+    const { EventEmitter } = await import("node:events");
+    const { getDataDir } = await import("../db/index.js");
+    const seen = [];
+    const hangingChild = () => {
+        const events = new EventEmitter();
+        const fake = {
+            stdin: { write: () => true, on: () => ({}) },
+            stdout: { on: () => ({}) },
+            stderr: { on: () => ({}) },
+            on: events.on.bind(events),
+            // The handshake never answers, but a kill() must still settle the
+            // child like a real process would — otherwise shutdown()'s teardown
+            // has nothing but its 2s unref'd SIGKILL-escalation timer to resolve
+            // on, which races the test runner's own event-loop bookkeeping and
+            // can cancel the test outright (see the child-ticket playbook gotcha:
+            // never await an infinite fake handler).
+            kill: () => {
+                fake.exitCode = 0;
+                queueMicrotask(() => events.emit("close"));
+                return true;
+            },
+            exitCode: null,
+        };
+        return fake;
+    };
+    const host = new MuseCapacityHost({
+        command: process.execPath,
+        args: [FAKE],
+        env: { META_API_KEY: "test-fake-key" },
+        // Handshake never answers — start() still records the exact spawn options.
+        timeoutMs: 100,
+        spawnImpl: ((command, args, options) => {
+            seen.push({ command, args, options });
+            return hangingChild();
+        }),
+    });
+    // This test's fake spawn has no real child process, so nothing else keeps
+    // the event loop busy while the production code's handshake/kill timers
+    // (deliberately unref'd — a real server must never block on them) are
+    // pending. With zero other ref'd handles, some Node versions' test runner
+    // treats the loop as "drained" before those timers fire and cancels the
+    // test outright (cancelledByParent). A trivial ref'd keepalive avoids the
+    // race without touching the production unref'd-timer behavior being tested.
+    const keepalive = setInterval(() => { }, 10);
+    try {
+        // Missing (handshake timeout), not a spawn failure — the spawn happened.
+        assert.equal((await host.readUsage()).status, "missing");
+        assert.equal(seen.length, 1, "exactly one serve spawn");
+        const cwd = seen[0].options.cwd;
+        assert.equal(typeof cwd, "string", "spawn options include an explicit cwd");
+        const dir = cwd;
+        assert.ok(path.isAbsolute(dir), `cwd is absolute, got ${dir}`);
+        assert.notEqual(path.resolve(dir), path.resolve(process.cwd()), "cwd is not the ambient process cwd");
+        assert.ok(dir.startsWith(`${getDataDir()}${path.sep}`), `cwd lives under the managed data dir, got ${dir}`);
+        assert.equal(path.basename(dir), "muse-host-home");
+        assert.ok(fs.existsSync(dir), "the dedicated cwd is created if missing");
+        assert.equal(resolveMuseHostCwd(), dir, "default cwd is the dedicated data-dir home");
+    }
+    finally {
+        await host.shutdown();
+        clearInterval(keepalive);
+    }
+});
 test("no credential short-circuits to missing without spawning", async () => {
     const noAuthDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-host-noauth-"));
     const env = { ...process.env, FAKE_MSP_MODE: "persistent-full" };

package/bundle/server/dist/coordinator/admission.test.js

@@ -401,6 +401,91 @@ test("NOT-178: a Muse Code developer without credentials is refused at admission
         setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
     }
 });
+// NOT-277: a Muse Code auto-update is re-validated automatically. A version whose developer
+// shell/write check passes is admitted with no manual step; one that lost it is refused with the
+// versions and capability named; one whose check could not complete is refused, never assumed ok.
+test("NOT-277: a Muse Code update is admitted when capable, refused by name when not", async () => {
+    const { clearAgentHealthCaches, runtimeIssuesUncached } = await import("../adapters/agent-health.js");
+    const { setMuseCapabilityProbeForTests, settleMuseCapabilityCheckForTests } = await import("../adapters/muse-capability.js");
+    const OLD = "1.3.0-R3401.1";
+    const NEW = "1.4.0-R4161.1";
+    const BROKEN = "1.4.0-R4302.1";
+    const stubDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-stub-"));
+    const versionFile = path.join(stubDir, "version");
+    const stub = path.join(stubDir, "muse");
+    fs.writeFileSync(stub, `#!/bin/sh\ncat ${JSON.stringify(versionFile)}\n`);
+    fs.chmodSync(stub, 0o755);
+    // The real checker's async path runs `gh auth status` too; CI runners have no gh login,
+    // so a logged-in stub keeps the `ok: true` assertions about Muse alone.
+    const ghStub = path.join(stubDir, "gh");
+    fs.writeFileSync(ghStub, "#!/bin/sh\necho 'Logged in to github.com account dealer-test'\nexit 0\n");
+    fs.chmodSync(ghStub, 0o755);
+    const probed = [];
+    setMuseCapabilityProbeForTests(async (version) => {
+        probed.push(version);
+        if (version === BROKEN)
+            return { status: "missing", detail: "probe session completed without running its shell command" };
+        if (version === "9.9.9-R1")
+            throw new Error("probe session timed out");
+        return { status: "capable" };
+    });
+    const saved = {
+        MUSE_CLI: process.env.MUSE_CLI,
+        META_API_KEY: process.env.META_API_KEY,
+        SKIP: process.env.AGENT_DEALER_SKIP_AGENT_HEALTH,
+        PATH: process.env.PATH,
+    };
+    process.env.MUSE_CLI = stub;
+    process.env.PATH = `${stubDir}${path.delimiter}${process.env.PATH ?? ""}`;
+    process.env.META_API_KEY = "k";
+    delete process.env.AGENT_DEALER_SKIP_AGENT_HEALTH;
+    setAdmissionHealthCheckerForTests(null);
+    clearAgentHealthCaches();
+    /** Muse reports `version`; the next health read sees it and its one-time check settles. */
+    const museReports = async (version) => {
+        fs.writeFileSync(versionFile, `Muse Code ${version.split("-")[0]} (${version})\n`);
+        await runtimeIssuesUncached("muse_code");
+        await settleMuseCapabilityCheckForTests();
+    };
+    try {
+        const issue = readyIssue("muse-updated", { runtimes: { dev: "muse_code", rev: "codex_local" } });
+        const developerHealth = () => checkRoleAgentHealthy(issue, "developer", { deckOnline: true });
+        await museReports(OLD);
+        assert.deepEqual(await developerHealth(), { ok: true });
+        await museReports(NEW);
+        assert.deepEqual(await developerHealth(), { ok: true });
+        assert.deepEqual(probed, [OLD, NEW]);
+        await museReports(BROKEN);
+        enqueueIssue(issue.id);
+        assert.equal(await admitNext(), null);
+        assert.equal(getIssue(issue.id).status, "ready");
+        assert.equal(getActiveWorkflowInstance(issue.id), null);
+        const reason = getQueuedEntryForIssue(issue.id).waitReason;
+        assert.match(reason, /developer unhealthy/);
+        assert.match(reason, new RegExp(`Muse Code updated ${NEW} → ${BROKEN}: developer sessions no longer get shell/write access`));
+        await museReports("9.9.9-R1");
+        const unverified = await developerHealth();
+        assert.equal(unverified.ok, false);
+        assert.match(unverified.reason, new RegExp(`Could not verify Muse Code developer shell/write access after version change \\(${BROKEN} → 9\\.9\\.9-R1\\)`));
+        assert.deepEqual(probed, [OLD, NEW, BROKEN, "9.9.9-R1"]);
+    }
+    finally {
+        for (const [key, value] of Object.entries({
+            MUSE_CLI: saved.MUSE_CLI,
+            META_API_KEY: saved.META_API_KEY,
+            AGENT_DEALER_SKIP_AGENT_HEALTH: saved.SKIP,
+            PATH: saved.PATH,
+        })) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+        setMuseCapabilityProbeForTests(null);
+        clearAgentHealthCaches();
+        setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
+    }
+});
 // NOT-178: Muse Code is developer-only, so it is never a healthy reviewer — even with the
 // unit-test health skip on, and without probing the CLI.
 test("NOT-178: a Muse Code reviewer is refused regardless of CLI health", async () => {