agent-dealer 1.2.6 → 1.2.8

package/bundle/server/dist/coordinator/merge-conflict-sync.test.js

@@ -0,0 +1,121 @@
+// NOT-310: conflict-failure classifier + the conflict-repair episode bound.
+import { test, before, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not310-"));
+process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH = "1";
+process.env.AGENT_DEALER_SKIP_AGENT_HEALTH = "1";
+const { migrate, getDb } = await import("../db/index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue } = await import("../repository/issues.js");
+const { startWorkflow } = await import("./commands.js");
+const { appendWorkflowEvent, getActiveWorkflowInstance } = await import("../repository/workflow-events.js");
+const { conflictRepairSpent, isMergeConflictFailure } = await import("./merge-conflict-sync.js");
+before(() => {
+    migrate();
+});
+beforeEach(() => {
+    getDb().exec(`
+    DELETE FROM work_items;
+    DELETE FROM human_actions;
+    DELETE FROM workflow_events;
+    DELETE FROM findings;
+    DELETE FROM review_publications;
+    DELETE FROM worker_sessions;
+    DELETE FROM artifacts;
+    DELETE FROM usage_events;
+    DELETE FROM workflow_instances;
+    DELETE FROM issues;
+  `);
+});
+test("isMergeConflictFailure classifies gh conflict text, not infra failures", () => {
+    assert.equal(isMergeConflictFailure("Pull request #42 is not mergeable: the merge commit cannot be cleanly created"), true);
+    assert.equal(isMergeConflictFailure("merge conflict: CONFLICTING"), true);
+    assert.equal(isMergeConflictFailure("CONFLICTING"), true);
+    // Deliberately broad: a policy "not mergeable" still enters the sync, which
+    // then escalates directly once the branch proves up to date (integration:
+    // "up-to-date branch that stays not mergeable").
+    assert.equal(isMergeConflictFailure("Pull request #42 is not mergeable: base branch policy prohibits the merge"), true);
+    assert.equal(isMergeConflictFailure("required status checks failed"), false);
+    assert.equal(isMergeConflictFailure("gh timed out after 20000ms"), false);
+    assert.equal(isMergeConflictFailure("protected branch"), false);
+    assert.equal(isMergeConflictFailure("Managed clone missing for github.com/a/b (/x)"), false);
+    assert.equal(isMergeConflictFailure("gh not on PATH — install GitHub CLI (`gh`) and ensure the daemon can see it"), false);
+    assert.equal(isMergeConflictFailure("invalid merge cwd (/x) — path does not exist (portable issue.repo must not be used as cwd)"), false);
+});
+function newIssueWithWorkflow() {
+    const repo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not310bound-repo-"));
+    const issueId = createIssue({
+        title: "Bound me",
+        description: "d",
+        acceptanceCriteria: "It works",
+        repo,
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        autoMerge: true,
+    }).id;
+    startWorkflow(issueId);
+    return { issueId, instanceId: getActiveWorkflowInstance(issueId).id };
+}
+function emitRepairQueued(issueId, instanceId, files) {
+    appendWorkflowEvent({
+        issueId,
+        workflowInstanceId: instanceId,
+        workerSessionId: null,
+        type: "auto_merge.conflict_repair_queued",
+        actorType: "system",
+        stage: "repairing",
+        round: 2,
+        payload: { baseBranch: "main", branch: "issue-1", files, round: 2, workItemId: "w" },
+    });
+}
+function emitResolved(issueId, instanceId) {
+    appendWorkflowEvent({
+        issueId,
+        workflowInstanceId: instanceId,
+        workerSessionId: null,
+        type: "human_action.resolved",
+        actorType: "human",
+        stage: "needs_human",
+        round: 2,
+        payload: { actionType: "policy_escalation", choice: "retry_merge" },
+    });
+}
+test("conflictRepairSpent is false with no repair event", () => {
+    const { issueId, instanceId } = newIssueWithWorkflow();
+    assert.deepEqual(conflictRepairSpent(issueId, instanceId), { spent: false, files: [] });
+});
+test("conflictRepairSpent is true after a repair round queued, carrying its files", () => {
+    const { issueId, instanceId } = newIssueWithWorkflow();
+    emitRepairQueued(issueId, instanceId, ["shared.txt"]);
+    assert.deepEqual(conflictRepairSpent(issueId, instanceId), { spent: true, files: ["shared.txt"] });
+});
+test("conflictRepairSpent resets on a later human resolution (fresh episode)", () => {
+    const { issueId, instanceId } = newIssueWithWorkflow();
+    emitRepairQueued(issueId, instanceId, ["shared.txt"]);
+    emitResolved(issueId, instanceId);
+    assert.deepEqual(conflictRepairSpent(issueId, instanceId), { spent: false, files: [] });
+});
+test("conflictRepairSpent stays spent when the repair queued after the last resolution", () => {
+    const { issueId, instanceId } = newIssueWithWorkflow();
+    emitResolved(issueId, instanceId);
+    emitRepairQueued(issueId, instanceId, []);
+    assert.deepEqual(conflictRepairSpent(issueId, instanceId), { spent: true, files: [] });
+});
+test("conflictRepairSpent ignores other issues/instances and malformed file lists", () => {
+    const { issueId, instanceId } = newIssueWithWorkflow();
+    const other = newIssueWithWorkflow();
+    emitRepairQueued(other.issueId, other.instanceId, ["other.txt"]);
+    assert.deepEqual(conflictRepairSpent(issueId, instanceId), { spent: false, files: [] });
+    assert.deepEqual(conflictRepairSpent(issueId, other.instanceId), { spent: false, files: [] });
+    emitRepairQueued(issueId, instanceId, "not-a-list");
+    const spent = conflictRepairSpent(issueId, instanceId);
+    assert.equal(spent.spent, true);
+    assert.deepEqual(spent.files, []);
+});

package/bundle/server/dist/coordinator/muse-developer.integration.test.js

@@ -203,7 +203,7 @@ function recorded() {
     return JSON.parse(fs.readFileSync(RECORD, "utf8"));
 }
 /** The captured settings file: exactly one required agent-deck server, accepted by the guard. */
-function expectDeckSettings(rec, deckId = TEST_DECK_ID) {
+function expectDeckSettings(rec, issueId, deckId = TEST_DECK_ID) {
     const settings = JSON.parse(rec.settings);
     assert.deepEqual(Object.keys(settings).sort(), ["mcpServers", "run", "runtime_capabilities", "schema_version"]);
     assert.deepEqual(Object.keys(settings.mcpServers), ["agent-deck"]);
@@ -211,15 +211,20 @@ function expectDeckSettings(rec, deckId = TEST_DECK_ID) {
     assert.equal(server.type, "streamable-http");
     assert.equal(server.url, expectedMcpUrl());
     assert.equal(server.mode, "required");
+    // NOT-305: every worker session carries an opaque Deck correlation UUID, passed here
+    // as the exact x-agent-deck-correlation-id observability header.
+    const dev = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+    assert.ok(dev.deckCorrelationId, "the developer session persists a Deck correlation ID");
     // cwdReal was resolved by the fixture at spawn time: the coordinator removes the
     // worktree after the turn, so resolving rec.cwd here would race cleanup.
     assert.deepEqual(server.headers, {
         "x-agent-deck-deck-id": deckId,
         "x-agent-deck-workspace": rec.cwdReal,
+        "x-agent-deck-correlation-id": dev.deckCorrelationId,
     });
     assert.equal("enabled_tools" in server, false, "developers are unfiltered: no allowlist claim");
     assert.equal("disabled_tools" in server, false, "developers are unfiltered: no denylist claim");
-    assertMuseSettings(settings, { url: expectedMcpUrl(), deckId, workspace: rec.cwdReal }, "developer");
+    assertMuseSettings(settings, { url: expectedMcpUrl(), deckId, workspace: rec.cwdReal, correlationId: dev.deckCorrelationId }, "developer");
     return settings;
 }
 test("fake-Muse developer session goes admission → verified branch → draft PR, with a frozen muse_code snapshot", async () => {
@@ -272,7 +277,7 @@ test("the turn runs the isolated exec lane (never serve) with the required agent
     assert.ok(!rec.xdgConfigHome.startsWith(rec.cwd), "config is not under the worktree");
     assert.equal(fs.existsSync(rec.xdgConfigHome), false, "per-attempt config removed after success");
     assert.equal(fs.existsSync(rec.xdgDataHome), false, "per-attempt data removed after success");
-    expectDeckSettings(rec);
+    expectDeckSettings(rec, issueId);
     // Exact environment: ambient secrets and sentinels never reached the child.
     assert.deepEqual(rec.envLeak, {
         META_API_KEY: false,
@@ -308,7 +313,7 @@ test("saved-login auth is symlinked, never copied, and carries no stdin key", as
     assert.equal(rec.stdinBytes, 0, "no key on stdin for saved-login auth");
     assert.equal(fs.existsSync(rec.xdgConfigHome), false, "per-attempt config (and link) removed");
     assert.equal(fs.readFileSync(operatorAuth, "utf8"), '{"token":"operator-owned"}', "operator credentials untouched");
-    expectDeckSettings(rec);
+    expectDeckSettings(rec, issueId);
 });
 test("usage events record muse_code, the confirmed model, duration and tokens; cost stays null", async () => {
     const issueId = makeMuseIssue();

package/bundle/server/dist/coordinator/muse-spawn.js

@@ -24,6 +24,7 @@ import { getWorkerMcpConfigDir } from "../paths.js";
 import { prepareMuseAttempt, } from "../runners/muse-config.js";
 import { parseMuseRun, } from "../runners/muse-code-jsonl.js";
 import { spawnCli } from "../runners/spawn-cli.js";
+import { museIdleTimeoutMs } from "./session-timeouts.js";
 /**
  * Step cap when the profile sets no `maxTurns`. High on purpose (the PoC's value): the developer
  * wall-clock timeout is the real limit, the cap only stops a runaway loop.
@@ -32,38 +33,94 @@ export const DEFAULT_MUSE_MAX_MODEL_STEPS = 300;
 /** Muse cannot disable these; any call in a session's tool activity fails it as `muse_cron_used`. */
 const CRON_TOOL_RE = /^cron_(create|list|delete)$/;
 const STDERR_MARKER = "\n--- stderr ---\n";
+export function museStallMetadata(summary) {
+    return {
+        lastActivityAt: summary.lastActivityAt,
+        toolCallCount: summary.toolCallCount,
+        lastToolName: summary.lastToolName,
+        firstOutputMs: summary.firstOutputMs,
+        idleTimedOut: summary.idleTimedOut,
+    };
+}
 /** `sessions/YYYY/MM/DD/<session-id>/session.jsonl` under the attempt's data dir, if present. */
 function readSessionLog(dataDir, museSessionId) {
-    const root = path.join(dataDir, "muse", "sessions");
-    const visit = (dir, depth) => {
-        let entries;
-        try {
-            entries = fs.readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return undefined;
-        }
-        for (const e of entries) {
-            if (!e.isDirectory())
-                continue;
-            const child = path.join(dir, e.name);
-            if (e.name === museSessionId) {
-                try {
-                    return fs.readFileSync(path.join(child, "session.jsonl"), "utf8");
-                }
-                catch {
-                    return undefined;
-                }
+    const found = findSessionLogPath(path.join(dataDir, "muse", "sessions"), museSessionId, 0);
+    if (!found)
+        return undefined;
+    try {
+        return fs.readFileSync(found, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * NOT-307: mtime (epoch ms) of the live `session.jsonl` for one attempt's session id,
+ * or null when it cannot be found or statted. The idle watchdog polls this as its
+ * second progress source: Muse appends model-stream rows to the session log as work
+ * proceeds, so growth here counts as progress even across a long stdout silence
+ * (e.g. a big tool call whose output arrives only at the end). The found path is
+ * resolved on every call — the file appears only after the child starts — and any
+ * filesystem error reads as "unknown", never as progress and never as a throw.
+ */
+export function sessionLogActivityMs(dataDir, museSessionId) {
+    try {
+        const found = findSessionLogPath(path.join(dataDir, "muse", "sessions"), museSessionId, 0);
+        if (!found)
+            return null;
+        return fs.statSync(found).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function findSessionLogPath(dir, museSessionId, depth) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return null;
+    }
+    for (const e of entries) {
+        if (!e.isDirectory())
+            continue;
+        const child = path.join(dir, e.name);
+        if (e.name === museSessionId) {
+            const candidate = path.join(child, "session.jsonl");
+            try {
+                if (fs.statSync(candidate).isFile())
+                    return candidate;
             }
-            if (depth < 4) {
-                const found = visit(child, depth + 1);
-                if (found !== undefined)
-                    return found;
+            catch {
+                return null;
             }
+            return null;
         }
-        return undefined;
-    };
-    return visit(root, 0);
+        if (depth < 4) {
+            const found = findSessionLogPath(child, museSessionId, depth + 1);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
+/**
+ * NOT-307: whole minutes of silence ending now, for the idle-kill reason text.
+ * Prefers the measured last-activity time; falls back to the configured bound when
+ * no activity was ever observed (a child silent since spawn is killed after exactly
+ * the bound). Null when the watchdog is disabled — there is no idle kill to explain.
+ */
+export function museIdleMinutes(opts) {
+    const now = opts.nowMs ?? Date.now();
+    if (opts.lastActivityAt) {
+        const at = Date.parse(opts.lastActivityAt);
+        if (Number.isFinite(at))
+            return Math.max(1, Math.round((now - at) / 60_000));
+    }
+    if (opts.idleTimeoutMs !== undefined)
+        return Math.max(1, Math.round(opts.idleTimeoutMs / 60_000));
+    return null;
 }
 /**
  * NOT-278: the attempt's credential. A saved login is linked, never read or copied; otherwise
@@ -90,6 +147,15 @@ function splitSpawnLog(raw) {
         ? { stdout: raw, stderr: "" }
         : { stdout: raw.slice(0, idx), stderr: raw.slice(idx + STDERR_MARKER.length) };
 }
+/**
+ * NOT-307: writes the normalized session log every reader knows — one JSON event
+ * per line (each carrying its ISO `ts`; `tool_call` events their `durationMs`
+ * when a matching result was timed), plus the stderr trailer when non-blank.
+ * Extracted pure so tests assert the exact bytes on disk.
+ */
+export function writeMuseNormalizedLog(logPath, events, stderr) {
+    fs.writeFileSync(logPath, `${events.map((e) => JSON.stringify(e)).join("\n")}\n${stderr.trim() ? `${STDERR_MARKER}${stderr}` : ""}`);
+}
 /**
  * NOT-270: reuse real Dealer Muse work as the observation opportunity. After
  * a genuine Muse session ends, kick one bounded, best-effort refresh
@@ -148,7 +214,8 @@ export async function runMuseDeveloperSession(input) {
         role: "developer",
         worktreePath: input.cwd,
         baseDir: getWorkerMcpConfigDir(),
-        agentDeck: { url: mcpUrl, deckId, workspace: input.cwd },
+        // NOT-305: opaque per-session correlation UUID — observability metadata, not authority.
+        agentDeck: { url: mcpUrl, deckId, workspace: input.cwd, correlationId: input.deckCorrelationId ?? null },
         credential: resolveMuseCredential(),
         sessionId: input.sessionId,
         prompt: input.prompt,
@@ -157,6 +224,13 @@ export async function runMuseDeveloperSession(input) {
     const { logPath } = input;
     let spawned;
     let sessionLog;
+    // NOT-307: Dealer-observed arrival epoch ms parallel to the transcript's lines —
+    // the stream's own `recorded_at` is batch-stamped, so per-event `ts` is stamped
+    // here instead. Only the Muse lane collects these; other runtimes pass nothing.
+    const lineTs = [];
+    // NOT-307: silence bound for this session. Undefined disables the watchdog
+    // (`MUSE_IDLE_TIMEOUT_MS=0`); only the Muse lane opts in.
+    const idleTimeoutMs = museIdleTimeoutMs();
     try {
         // The exact launch about to happen — a tampered settings file or a differing
         // cwd/argv/env/stdin fails here, before any process exists.
@@ -169,6 +243,13 @@ export async function runMuseDeveloperSession(input) {
             stdin: attempt.stdin,
             signal: input.signal,
             onSpawn: input.onSpawn,
+            idleTimeoutMs,
+            // The session log appears only after the child starts; a missing file reads as
+            // unknown and never postpones the kill on its own — stdout bytes still count.
+            progressSource: () => sessionLogActivityMs(attempt.env.XDG_DATA_HOME, input.sessionId),
+            onStdoutLine: (_line, atMs) => {
+                lineTs.push(atMs);
+            },
         });
         sessionLog = readSessionLog(attempt.env.XDG_DATA_HOME, input.sessionId);
     }
@@ -183,6 +264,10 @@ export async function runMuseDeveloperSession(input) {
         exitCode: spawned.timedOut ? null : spawned.exitCode,
         sessionLog,
         expectedModel: model,
+        lineTs,
+        // Log-write time: every normalized event below carries a `ts`, stream-derived
+        // where the arrival was observed, this fallback everywhere else.
+        now: new Date().toISOString(),
     });
     const cronCalls = run.tools.map((t) => t.name).filter((n) => n !== null && CRON_TOOL_RE.test(n));
     const summary = {
@@ -193,6 +278,11 @@ export async function runMuseDeveloperSession(input) {
         cronCalls,
         runCount: run.runCount,
         rawLogPath: null,
+        firstOutputMs: spawned.firstOutputMs,
+        lastActivityAt: spawned.lastActivityAt,
+        idleTimedOut: spawned.idleTimedOut,
+        toolCallCount: run.tools.length,
+        lastToolName: run.tools.length > 0 ? (run.tools[run.tools.length - 1].name ?? null) : null,
     };
     // The raw envelopes stay as evidence; the log path every reader knows becomes the normalized stream.
     const rawLogPath = `${logPath.replace(/\.ndjson$/, "")}.muse-raw.jsonl`;
@@ -204,7 +294,7 @@ export async function runMuseDeveloperSession(input) {
         // evidence copy is best-effort; the normalized log below still carries the outcome
     }
     const events = run.events.map((e) => e.type === "result" ? { ...e, muse: { ...summary, usage: run.usage } } : e);
-    fs.writeFileSync(logPath, `${events.map((e) => JSON.stringify(e)).join("\n")}\n${stderr.trim() ? `${STDERR_MARKER}${stderr}` : ""}`);
+    writeMuseNormalizedLog(logPath, events, stderr);
     // The real session above is the observation opportunity: kick the
     // best-effort capacity refresh (no synthetic turn, never throws, never
     // blocks this result).
@@ -215,6 +305,9 @@ export async function runMuseDeveloperSession(input) {
         transcript: run.finalText ?? "",
         logPath,
         timedOut: spawned.timedOut,
+        // NOT-307: an idle kill reads as a timeout downstream (same salvage, same
+        // infra-retry budget) with the idle flag distinguishing the cause.
+        idleTimedOut: spawned.idleTimedOut,
         muse: summary,
     };
 }

package/bundle/server/dist/coordinator/muse-spawn.test.js

@@ -0,0 +1,210 @@
+// NOT-307: Muse idle-wiring units — env parsing, session-log progress source,
+// arrival-stamped normalized events, and the five-field stall metadata object.
+// The full `runMuseDeveloperSession` needs a Muse binary + credentials, so these
+// test the pure pieces it wires together (plus the parser contract it relies on).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { parseMuseRun } from "../runners/muse-code-jsonl.js";
+import { museIdleTimeoutMs, DEFAULT_MUSE_IDLE_TIMEOUT_MS } from "./session-timeouts.js";
+import { museIdleMinutes, museStallMetadata, sessionLogActivityMs, writeMuseNormalizedLog, } from "./muse-spawn.js";
+const MODEL = "muse-spark-1.3-contributor";
+// ── MUSE_IDLE_TIMEOUT_MS parsing ─────────────────────────────────────────────
+function withIdleEnv(raw, fn) {
+    const prev = process.env.MUSE_IDLE_TIMEOUT_MS;
+    try {
+        if (raw === undefined)
+            delete process.env.MUSE_IDLE_TIMEOUT_MS;
+        else
+            process.env.MUSE_IDLE_TIMEOUT_MS = raw;
+        fn();
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env.MUSE_IDLE_TIMEOUT_MS;
+        else
+            process.env.MUSE_IDLE_TIMEOUT_MS = prev;
+    }
+}
+test("museIdleTimeoutMs defaults to 30 minutes when unset or blank", () => {
+    withIdleEnv(undefined, () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+    withIdleEnv("", () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+    withIdleEnv("   ", () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+    assert.equal(DEFAULT_MUSE_IDLE_TIMEOUT_MS, 30 * 60_000);
+});
+test("museIdleTimeoutMs accepts an explicit bound", () => {
+    withIdleEnv("600000", () => assert.equal(museIdleTimeoutMs(), 600_000));
+});
+test("MUSE_IDLE_TIMEOUT_MS=0 disables the watchdog", () => {
+    withIdleEnv("0", () => assert.equal(museIdleTimeoutMs(), undefined));
+});
+test("non-numeric or negative MUSE_IDLE_TIMEOUT_MS falls back to the default", () => {
+    withIdleEnv("soon", () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+    withIdleEnv("NaN", () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+    withIdleEnv("-1", () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+    withIdleEnv("Infinity", () => assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS));
+});
+test("invalid MUSE_IDLE_TIMEOUT_MS logs a warning naming the value", () => {
+    const prev = process.env.MUSE_IDLE_TIMEOUT_MS;
+    const warnings = [];
+    const orig = console.warn;
+    console.warn = (...args) => {
+        warnings.push(args);
+    };
+    try {
+        process.env.MUSE_IDLE_TIMEOUT_MS = "soon";
+        assert.equal(museIdleTimeoutMs(), DEFAULT_MUSE_IDLE_TIMEOUT_MS);
+    }
+    finally {
+        console.warn = orig;
+        if (prev === undefined)
+            delete process.env.MUSE_IDLE_TIMEOUT_MS;
+        else
+            process.env.MUSE_IDLE_TIMEOUT_MS = prev;
+    }
+    assert.equal(warnings.length, 1, `expected one warning, got ${warnings.length}`);
+    assert.match(String(warnings[0][0]), /MUSE_IDLE_TIMEOUT_MS/);
+});
+// ── session-log progress source ──────────────────────────────────────────────
+function writeSessionLog(dataDir, sessionId) {
+    const dir = path.join(dataDir, "muse", "sessions", "2026", "10", "01", sessionId);
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, "session.jsonl");
+    fs.writeFileSync(file, "{}\n");
+    return file;
+}
+test("sessionLogActivityMs returns the session.jsonl mtime once it exists", () => {
+    const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-progress-"));
+    const sid = "11111111-1111-4111-8111-111111111111";
+    assert.equal(sessionLogActivityMs(dataDir, sid), null, "absent before the child starts");
+    const file = writeSessionLog(dataDir, sid);
+    const got = sessionLogActivityMs(dataDir, sid);
+    assert.ok(typeof got === "number", `expected mtime, got ${got}`);
+    assert.ok(Math.abs(got - fs.statSync(file).mtimeMs) < 1, "reads the live mtime");
+});
+test("sessionLogActivityMs is null for a missing tree and never throws", () => {
+    const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-progress-"));
+    assert.equal(sessionLogActivityMs(dataDir, "no-such-session"), null);
+    assert.equal(sessionLogActivityMs(path.join(dataDir, "missing"), "x"), null);
+});
+// ── idle minutes ─────────────────────────────────────────────────────────────
+test("museIdleMinutes measures silence from last activity, else the bound", () => {
+    const last = new Date(Date.now() - 20 * 60_000).toISOString();
+    assert.equal(museIdleMinutes({ lastActivityAt: last, idleTimeoutMs: 1_200_000 }), 20);
+    assert.equal(museIdleMinutes({ lastActivityAt: null, idleTimeoutMs: 1_200_000 }), 20, "silent since spawn was killed after exactly the bound");
+    assert.equal(museIdleMinutes({ lastActivityAt: null, idleTimeoutMs: undefined }), null, "disabled watchdog has no idle kill to explain");
+});
+// ── stall metadata object ────────────────────────────────────────────────────
+test("museStallMetadata carries exactly the five worker_sessions fields", () => {
+    assert.deepEqual(museStallMetadata({
+        lastActivityAt: "2026-10-01T19:00:00.000Z",
+        toolCallCount: 24,
+        lastToolName: "npm_test",
+        firstOutputMs: 1234,
+        idleTimedOut: true,
+    }), {
+        lastActivityAt: "2026-10-01T19:00:00.000Z",
+        toolCallCount: 24,
+        lastToolName: "npm_test",
+        firstOutputMs: 1234,
+        idleTimedOut: true,
+    });
+});
+// ── arrival-stamped normalized events ────────────────────────────────────────
+function env(payloadType, payload) {
+    return JSON.stringify({ payload_type: payloadType, payload, stream: { kind: "session", id: "s1" } });
+}
+function timedStdout() {
+    return [
+        env("run.model.configured", { run_stream: { kind: "run", id: "r1" } }),
+        env("task.lifecycle.side_effect_intent", {
+            run_stream: { kind: "run", id: "r1" },
+            event: { operation: "tool:read_file", idempotency_key: "tool:c1", task_id: "t1" },
+        }),
+        env("tool.result", { call_id: "c1", correlation_facts: { tool_name: "read_file", outcome: "success" } }),
+        env("task.lifecycle.side_effect_intent", {
+            run_stream: { kind: "run", id: "r1" },
+            event: { operation: "tool:npm_test", idempotency_key: "tool:c2", task_id: "t2" },
+        }),
+        env("run.terminal.completed", { run_stream: { kind: "run", id: "r1" }, text: "done", reason: "" }),
+    ].join("\n");
+}
+const baseInput = {
+    stdout: timedStdout(),
+    stderr: "",
+    exitCode: 0,
+    expectedModel: MODEL,
+};
+test("arrival times stamp every event; tool_call carries durationMs for the completed call", () => {
+    const t0 = Date.UTC(2026, 9, 1, 19, 0, 0);
+    // lineTs is parallel to stdout lines: intent c1 at +1s, result at +61s, intent c2 at +62s.
+    const lineTs = [t0, t0 + 1_000, t0 + 61_000, t0 + 62_000, t0 + 63_000];
+    const r = parseMuseRun({ ...baseInput, lineTs, now: new Date(t0 + 64_000).toISOString() });
+    const tools = r.events.filter((e) => e.type === "tool_call");
+    assert.equal(tools.length, 2);
+    assert.equal(tools[0].name, "read_file");
+    assert.equal(tools[0].ts, new Date(t0 + 1_000).toISOString());
+    assert.equal(tools[0].durationMs, 60_000, "result arrival minus intent arrival");
+    assert.equal(tools[1].name, "npm_test");
+    assert.equal(tools[1].ts, new Date(t0 + 62_000).toISOString());
+    assert.equal("durationMs" in tools[1], false, "a bare intent (no result) carries no duration");
+    for (const e of r.events) {
+        assert.ok(typeof e.ts === "string" && Number.isFinite(Date.parse(e.ts)), `every event has ts: ${JSON.stringify(e).slice(0, 120)}`);
+    }
+});
+test("without arrival times or now the parser output stays byte-stable (no ts)", () => {
+    const r = parseMuseRun({ ...baseInput });
+    const tools = r.events.filter((e) => e.type === "tool_call");
+    assert.deepEqual(tools.map((t) => ({ type: t.type, name: t.name })), [
+        { type: "tool_call", name: "read_file" },
+        { type: "tool_call", name: "npm_test" },
+    ]);
+    for (const e of r.events)
+        assert.equal("ts" in e, false);
+});
+test("now alone stamps every event when the stream gave no usable time", () => {
+    const now = "2026-10-01T19:05:00.000Z";
+    const r = parseMuseRun({ ...baseInput, now });
+    assert.ok(r.events.length > 0);
+    for (const e of r.events)
+        assert.equal(e.ts, now);
+    const tools = r.events.filter((e) => e.type === "tool_call");
+    for (const t of tools)
+        assert.equal("durationMs" in t, false);
+});
+test("the written ndjson carries ts on every event and durationMs on completed tool calls", () => {
+    const t0 = Date.UTC(2026, 9, 1, 19, 0, 0);
+    const lineTs = [t0, t0 + 1_000, t0 + 61_000, t0 + 62_000, t0 + 63_000];
+    const r = parseMuseRun({ ...baseInput, lineTs, now: new Date(t0 + 64_000).toISOString() });
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-ndjson-"));
+    const logPath = path.join(dir, "session.ndjson");
+    // What runMuseDeveloperSession writes: the result event embeds the session summary.
+    const summary = {
+        firstOutputMs: 900,
+        lastActivityAt: new Date(t0 + 63_000).toISOString(),
+        idleTimedOut: false,
+        toolCallCount: r.tools.length,
+        lastToolName: "npm_test",
+    };
+    const events = r.events.map((e) => e.type === "result" ? { ...e, muse: { ...summary } } : e);
+    writeMuseNormalizedLog(logPath, events, "");
+    const lines = fs.readFileSync(logPath, "utf8").trim().split("\n");
+    assert.equal(lines.length, events.length);
+    const read = lines.map((l) => JSON.parse(l));
+    for (const e of read) {
+        assert.ok(typeof e.ts === "string" && Number.isFinite(Date.parse(e.ts)), "ts on every written event");
+    }
+    const tools = read.filter((e) => e.type === "tool_call");
+    assert.equal(tools.length, 2);
+    assert.equal(tools[0].durationMs, 60_000);
+    assert.equal("durationMs" in tools[1], false);
+    const result = read.find((e) => e.type === "result");
+    const muse = result.muse;
+    assert.equal(muse.firstOutputMs, 900);
+    assert.equal(muse.toolCallCount, 2);
+    assert.equal(muse.lastToolName, "npm_test");
+    assert.equal(muse.idleTimedOut, false);
+    assert.equal(muse.lastActivityAt, new Date(t0 + 63_000).toISOString());
+});