arisa 5.2.7 → 5.2.19

package/src/transport/telegram/task-dispatcher.js

@@ -38,6 +38,14 @@ function failureDestination(task) {
 }
 
 function buildFailureNotice({ task, result, error }) {
+  if (result?.authBlockedNew === true) {
+    return [
+      "⚠️ Arisa automation paused for authentication",
+      `Tool: ${result.authBlock?.toolName || task.payload?.toolName || "unknown"}`,
+      `Reason: ${safeErrorSummary(error)}`,
+      `Next authentication check: ${result.runAt}`
+    ].join("\n");
+  }
   const uncertain = result?.status === "outcome_uncertain" || result?.lastOutcome === "outcome_uncertain";
   const recurring = result?.terminalFailure === true && result?.status === "pending";
   const lines = [
@@ -64,16 +72,62 @@ export function createTelegramTaskDispatcher({
   const agentTimeoutMs = boundedTimeout(taskTimeouts.agentTimeoutMs, 15 * 60_000);
   const eventTimeoutMs = boundedTimeout(taskTimeouts.eventTimeoutMs, 5 * 60_000);
 
+  const runBackgroundTool = (toolName, chatId, args, label) => agentManager.runTurn({
+    priority: "background",
+    label
+  }, () => agentManager.runTool({ name: toolName, request: { args }, chatId }));
+
+  function throwToolFailure(result, toolName, fallbackResolution) {
+    const error = new Error(result?.error || `${toolName} failed`);
+    if (result?.status === "blocked_auth" || fallbackResolution) {
+      error.retryable = false;
+      error.authBlocked = true;
+      error.authResolution = {
+        ...(result?.resolution || fallbackResolution || {}),
+        toolName
+      };
+    } else if (result?.status === "needs_config") {
+      error.retryable = false;
+    } else if (result?.status === "outcome_uncertain") {
+      error.retryable = false;
+      error.outcomeUncertain = true;
+    }
+    throw error;
+  }
+
   async function dispatchAgentTask(task, chatId) {
     if (!task.payload.prompt) throw new NonRetryableTaskError("agent_task missing prompt");
+    if (task.authBlock?.toolName) {
+      const probe = await runBackgroundTool(
+        task.authBlock.toolName,
+        chatId,
+        task.authBlock.probeArgs || {},
+        `authentication probe ${task.authBlock.toolName}`
+      );
+      if (probe?.ok === false) throwToolFailure(probe, task.authBlock.toolName, task.authBlock);
+      logger?.log("tasks", `authentication restored for ${task.authBlock.toolName} (task ${task.id})`);
+    }
+
     logger?.log("tasks", `running task ${task.id} for chat ${chatId}`);
+    const agentTaskExecution = { blockedAuth: null };
     await enqueueAsyncPrompt({
       chatId,
       prompt: await buildAsyncTaskPrompt({ task, artifactStore, toolRegistry, resourceNotes, logger }),
       label: `scheduled task ${task.id}`,
       route: task.route,
-      timeoutMs: agentTimeoutMs
+      timeoutMs: agentTimeoutMs,
+      priority: task.source?.toolName === "whatsapp-web" ? "interactive" : "background",
+      agentTaskExecution
     });
+    if (agentTaskExecution.blockedAuth) {
+      const blocked = agentTaskExecution.blockedAuth;
+      throwToolFailure({
+        ok: false,
+        status: "blocked_auth",
+        error: blocked.error,
+        resolution: blocked.resolution
+      }, blocked.toolName);
+    }
   }
 
   async function dispatchAgentEvent(task, chatId) {
@@ -92,7 +146,8 @@ export function createTelegramTaskDispatcher({
       prompt: await buildAsyncEventPrompt(task, resourceNotes),
       label: `agent event ${task.id}`,
       route: task.route,
-      timeoutMs: eventTimeoutMs
+      timeoutMs: eventTimeoutMs,
+      priority: task.source?.toolName === "process-retrospective" ? "background" : "interactive"
     });
   }
 
@@ -100,20 +155,17 @@ export function createTelegramTaskDispatcher({
     const toolName = task.payload?.toolName;
     if (!toolName) throw new NonRetryableTaskError("poll_tool missing toolName");
     logger?.log("tasks", `polling tool ${toolName} (task ${task.id}) for chat ${chatId}`);
-    const result = await agentManager.runTool({
-      name: toolName,
-      request: { args: task.payload.args || {} },
-      chatId
-    });
-    if (result?.ok === false) {
-      const error = new Error(result.error || `poll_tool ${toolName} failed`);
-      if (result.status === "needs_config") error.retryable = false;
-      if (result.status === "outcome_uncertain") {
-        error.retryable = false;
-        error.outcomeUncertain = true;
-      }
-      throw error;
+
+    const runTool = (args) => runBackgroundTool(toolName, chatId, args, `poll tool ${toolName}`);
+
+    if (task.authBlock) {
+      const probe = await runTool(task.authBlock.probeArgs || {});
+      if (probe?.ok === false) throwToolFailure(probe, toolName, task.authBlock);
+      logger?.log("tasks", `authentication restored for ${toolName} (task ${task.id})`);
     }
+
+    const result = await runTool(task.payload.args || {});
+    if (result?.ok === false) throwToolFailure(result, toolName);
   }
 
   async function dispatchTask(task) {

package/src/transport/telegram/telegram-auth-controller.js

@@ -50,7 +50,7 @@ export function createTelegramAuthController({
     if (!detected) return false;
 
     try {
-      await api.sendMessage(chatId, buildPiAuthTelegramMessage({ config, chatId, issue: detected }));
+      await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, issue: detected }));
       markPromptErrorNotified(error);
       return true;
     } catch (notifyError) {
@@ -66,11 +66,11 @@ export function createTelegramAuthController({
       agentManager.clearSessionCache(chatId);
       issue = null;
       logger?.log("telegram", `Pi auth renewal completed for chat ${chatId}`);
-      await api.sendMessage(chatId, buildPiAuthTelegramMessage({ config, chatId, verified: true }));
+      await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, verified: true }));
     } catch (error) {
       const detected = rememberValidationFailure(error);
       logger?.error("telegram", `Pi auth renewal failed for chat ${chatId}: ${getErrorMessage(error)}`);
-      await api.sendMessage(chatId, buildPiAuthTelegramMessage({ config, chatId, issue: detected })).catch((notifyError) => {
+      await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, issue: detected })).catch((notifyError) => {
         logger?.error("telegram", `auth renewal failure notice failed for chat ${chatId}: ${getErrorMessage(notifyError)}`);
       });
     } finally {
@@ -140,17 +140,17 @@ export function createTelegramAuthController({
     const authorization = await authorize(ctx);
     if (!authorization.ok) return;
 
-    const status = getPiAuthStatus(config, ctx.chat.id);
+    const status = await getPiAuthStatus(config, ctx.chat.id);
     if (status.hasApiKey || !status.supportsOAuth) {
       await withTyping(ctx, async () => {
         try {
           await agentManager.validateAgent();
           agentManager.clearSessionCache(ctx.chat.id);
           issue = null;
-          await ctx.reply(buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, verified: true }));
+          await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, verified: true }));
         } catch (error) {
           const detected = rememberValidationFailure(error);
-          await ctx.reply(buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
+          await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
         }
       });
       return;
@@ -163,7 +163,7 @@ export function createTelegramAuthController({
         : "Pi login is already in progress. Paste the redirect URL or code here when you have it.");
     } catch (error) {
       const detected = rememberValidationFailure(error);
-      await ctx.reply(buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
+      await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
     }
   }
 

package/src/transport/telegram/telegram-prompt-controller.js

@@ -157,8 +157,14 @@ export function createTelegramPromptController({
       });
     };
 
-    if (ctx) return withTyping(ctx, work);
-    return work();
+    return agentManager.runTurn({
+      priority: executionReceipt?.priority || "interactive",
+      label: executionReceipt?.label || `interactive prompt for ${sessionId}`,
+      queueTtlMs: executionReceipt?.queueTtlMs
+    }, () => {
+      executionReceipt?.start?.();
+      return ctx ? withTyping(ctx, work) : work();
+    });
   }
 
   function processChatPromptQueue({ chatId, prompt, label, ctx = null, beforeInitialPrompt, initialReceipt = null }) {
@@ -193,10 +199,17 @@ export function createTelegramPromptController({
     busyMessageMode = "queue",
     waitForExecution = false,
     onExecutionStart = null,
-    coalesceQueued = false
+    coalesceQueued = false,
+    turnPriority = "interactive",
+    turnQueueTtlMs = undefined
   }) {
     const chatState = getChatState(chatId);
-    const receipt = waitForExecution ? createPromptExecutionReceipt(onExecutionStart) : null;
+    const receipt = waitForExecution ? createPromptExecutionReceipt(onExecutionStart, {
+      priority: turnPriority,
+      label,
+      queueTtlMs: turnQueueTtlMs,
+      deferStart: true
+    }) : null;
 
     if (chatState.processing) {
       const incomingRoute = ctx ? contextRoute(ctx) : null;

package/src/transport/telegram/telegram-session-bridge.js

@@ -113,7 +113,8 @@ export function createTelegramSessionBridgeController({
           chatId: route.transportChatId,
           threadId: route.topicThreadId
         }
-      } : null
+      } : null,
+      getAgentTaskExecution: () => route.agentTaskExecution || null
     };
   }
 

package/test/agent-turn-coordinator.test.js

@@ -0,0 +1,48 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { AgentTurnCoordinator } from "../src/core/agent/agent-turn-coordinator.js";
+
+test("interactive turns run before queued background turns without overlapping", async () => {
+  const coordinator = new AgentTurnCoordinator();
+  const releaseActive = await coordinator.acquire({ priority: "background", label: "active background" });
+  let backgroundStarted = false;
+  const background = coordinator.acquire({ priority: "background", label: "queued background" }).then((release) => {
+    backgroundStarted = true;
+    return release;
+  });
+  const interactive = coordinator.acquire({ priority: "interactive", label: "interactive" });
+
+  releaseActive();
+  const releaseInteractive = await interactive;
+  assert.equal(backgroundStarted, false);
+  assert.equal(coordinator.diagnostic().active.priority, "interactive");
+  releaseInteractive();
+  const releaseBackground = await background;
+  assert.equal(backgroundStarted, true);
+  releaseBackground();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(coordinator.diagnostic().active, null);
+  assert.equal(coordinator.diagnostic().completed, 3);
+});
+
+test("background turns expire safely before execution when their queue TTL elapses", async (t) => {
+  t.mock.timers.enable({ apis: ["setTimeout"] });
+  const coordinator = new AgentTurnCoordinator();
+  const releaseActive = await coordinator.acquire({ priority: "interactive", label: "active" });
+  const expired = assert.rejects(
+    coordinator.acquire({ priority: "background", label: "stale batch", queueTtlMs: 10 }),
+    (error) => error.code === "AGENT_TURN_QUEUE_EXPIRED" && error.retryable === true && error.outcomeUncertain === false
+  );
+  t.mock.timers.tick(10);
+  await expired;
+  assert.equal(coordinator.diagnostic().expired, 1);
+  releaseActive();
+});
+
+test("run releases exclusive admission after failures", async () => {
+  const coordinator = new AgentTurnCoordinator();
+  await assert.rejects(coordinator.run({ priority: "background" }, async () => { throw new Error("failed"); }), /failed/);
+  const result = await coordinator.run({ priority: "interactive" }, async () => "ok");
+  assert.equal(result, "ok");
+  assert.equal(coordinator.diagnostic().completed, 2);
+});

package/test/auth-flow.test.js

@@ -42,7 +42,7 @@ test("ignores unrelated Pi errors", () => {
   assert.equal(getPiAuthIssue(new Error("")), null);
 });
 
-test("reports the active chat model after authentication", () => {
+test("reports the active chat model after authentication", async () => {
   const config = {
     pi: {
       provider: "openai-codex",
@@ -60,7 +60,7 @@ test("reports the active chat model after authentication", () => {
     }
   };
 
-  const message = buildPiAuthTelegramMessage({ config, chatId: 123, verified: true });
+  const message = await buildPiAuthTelegramMessage({ config, chatId: 123, verified: true });
 
   assert.match(message, /^Pi authentication is working for openai-codex\/gpt-5\.6\./);
   assert.doesNotMatch(message, /gpt-5\.5/);

package/test/capabilities-security.test.js

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { createArisaCapabilities } from "../src/runtime/arisa-capabilities.js";
+import { createCapabilityService } from "../src/core/capabilities/capability-service.js";
 
 function createFakeArtifactStore() {
   const stores = new Map();
@@ -294,6 +295,41 @@ test("normalizes tool run args and rejects arrays", async () => {
   );
 });
 
+test("records blocked authentication and stops later tools inside an agent task", async () => {
+  const execution = { blockedAuth: null };
+  const resolution = { retryAfterSeconds: 3600, probeArgs: { action: "status" } };
+  let executions = 0;
+  const service = createCapabilityService({
+    artifactStore: createFakeArtifactStore(),
+    toolRegistry: { async load() {} },
+    toolExecutor: {
+      async runTool() {
+        executions += 1;
+        return { ok: false, status: "blocked_auth", error: "authentication expired", resolution };
+      }
+    }
+  });
+  const run = (name) => service.execute({
+    method: "tools.run",
+    actorToolName: "run_tool",
+    chatId: "chat-1",
+    params: { name, args: {} },
+    context: { agentTaskExecution: execution }
+  });
+
+  await run("creator-scout");
+  assert.deepEqual(execution.blockedAuth, {
+    toolName: "creator-scout",
+    error: "authentication expired",
+    resolution
+  });
+
+  const skipped = await run("campaign-draft-runner");
+  assert.equal(skipped.status, "blocked_prerequisite");
+  assert.equal(skipped.resolution.prerequisiteStatus, "blocked_auth");
+  assert.equal(executions, 1);
+});
+
 test("rejects missing artifact input before running a tool", async () => {
   const calls = [];
   const capabilities = createCapabilities({

package/test/context-and-task-bounds.test.js

@@ -395,6 +395,7 @@ test("selectScheduledTasks bounds history while keeping active tasks", () => {
     status: "done"
   }));
   tasks[0] = { id: "pending-1", status: "pending" };
+  tasks[1] = { id: "blocked-1", status: "blocked_auth" };
 
   const result = selectScheduledTasks(tasks);
 
@@ -402,7 +403,7 @@ test("selectScheduledTasks bounds history while keeping active tasks", () => {
   assert.equal(result.returned, 50);
   assert.equal(result.limit, 50);
   assert.equal(result.truncated, true);
-  assert.equal(result.tasks[0].id, "pending-1");
+  assert.deepEqual(result.tasks.slice(0, 2).map((task) => task.id), ["blocked-1", "pending-1"]);
 });
 
 test("selectScheduledTasks honors an explicit status and limit", () => {

package/test/daemon-runtime.test.js

@@ -244,7 +244,7 @@ test("supervisor ignores invalid chat directories and recovers valid daemons", a
   }
 });
 
-test("does not restart registrations whose scope no longer matches the tool manifest", async () => {
+test("removes stopped registrations whose scope no longer matches the tool manifest", async () => {
   const runtime = runtimeFor({ type: "global" }, { autoStart: true });
   const registry = new ToolRegistry();
   registry.tools.set("fake-daemon", {
@@ -267,11 +267,9 @@ test("does not restart registrations whose scope no longer matches the tool mani
   const results = await supervisor.repair();
   const result = results.find((item) => item.record.toolName === "fake-daemon" && item.record.instanceId === "global");
 
-  assert.equal(result.outcome, "stale-registration");
+  assert.equal(result.outcome, "obsolete-removed");
   assert.match(result.reason, /global scope does not match manifest chat scope/);
   assert.equal(isProcessAlive(await runtime.getPid()), false);
-
-  await unregisterManagedDaemon({ toolName: "fake-daemon", scope: { type: "global" } });
   assert.deepEqual(await readJson(runtime.paths.metaFile, null), null);
 });
 

package/test/doctor.test.js

@@ -121,6 +121,25 @@ test("lists each checked daemon with its scope and state", async () => {
   assert.ok(formatted.split("\n").every((line) => [...line].length <= 35));
 });
 
+test("reports automatic obsolete daemon cleanup and unverifiable leftovers", async () => {
+  const { report } = await run({
+    repairs: [
+      {
+        record: { toolName: "removed", instanceId: "global", scope: { type: "global" } },
+        outcome: "obsolete-removed",
+        reason: "tool is no longer installed"
+      },
+      {
+        record: { toolName: "unknown-pid", instanceId: "global", scope: { type: "global" } },
+        outcome: "obsolete-unverified"
+      }
+    ]
+  });
+
+  assert.match(report.repairs.join("\n"), /Removed obsolete daemon removed/);
+  assert.match(report.attention.join("\n"), /unknown-pid.*could not be verified/);
+});
+
 test("reports missing tool dependencies as attention items", async () => {
   const report = await runDoctor({
     agentManager: { getRuntimeDiagnostic: async () => runtime() },

package/test/memory-pressure.test.js

@@ -28,9 +28,14 @@ test("classifies each configured memory pressure boundary", () => {
     swapTotalBytes: 0,
     swapUsedPercent: 0
   }, policy), /worker RSS/);
+  assert.equal(memoryPressureReason({
+    workerRssBytes: 400 * 1024 * 1024,
+    swapTotalBytes: 0,
+    swapUsedPercent: 0
+  }, policy, { ignoreWorkerRss: true }), "");
   assert.match(memoryPressureReason({
-    workerRssBytes: 100 * 1024 * 1024,
+    workerRssBytes: 400 * 1024 * 1024,
     swapTotalBytes: 100,
     swapUsedPercent: 96
-  }, policy), /swap use/);
+  }, policy, { ignoreWorkerRss: true }), /swap use/);
 });

package/test/model-selection.test.js

@@ -355,17 +355,18 @@ test("maps supported model speeds to provider service tiers", () => {
 
 test("applies Pi speed to every provider request and updates it in place", async () => {
   const calls = [];
+  const model = { provider: "openai-codex", api: "openai-codex-responses", id: "gpt-5.6-sol" };
   const controller = createModelSpeedController((model, context, options) => {
     calls.push({ model, context, options });
     return "stream";
   }, 1);
 
-  assert.equal(controller.streamFn("model", "context", {
+  assert.equal(controller.streamFn(model, "context", {
     signal: "signal",
     onPayload: (payload) => ({ ...payload, preserved: true })
   }), "stream");
   controller.setSpeed(1.5);
-  controller.streamFn("model", "context", { signal: "signal" });
+  controller.streamFn(model, "context", { signal: "signal" });
 
   assert.equal(calls[0].options.serviceTier, "default");
   assert.equal(calls[1].options.serviceTier, "priority");

package/test/obsolete-daemon-reaper.test.js

@@ -0,0 +1,61 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { reapObsoleteDaemon } from "../src/runtime/obsolete-daemon-reaper.js";
+
+const record = {
+  toolName: "removed-tool",
+  instanceId: "global",
+  entryPath: "/tools/removed-tool/index.js",
+  scope: { type: "global" }
+};
+
+test("purges an obsolete daemon with no live process", async () => {
+  const purged = [];
+  const result = await reapObsoleteDaemon({
+    record,
+    diagnostic: { pid: null },
+    reason: "tool is no longer installed",
+    purgeDaemon: async (identity) => purged.push(identity)
+  });
+
+  assert.equal(result.outcome, "obsolete-removed");
+  assert.deepEqual(purged, [{ toolName: "removed-tool", scope: { type: "global" } }]);
+});
+
+test("terminates only a verified obsolete daemon process before purging", async () => {
+  const stopped = [];
+  const purged = [];
+  const result = await reapObsoleteDaemon({
+    record,
+    diagnostic: { pid: 321 },
+    reason: "tool is no longer installed",
+    timeoutMs: 100,
+    stopTimeoutMs: 50,
+    inspectProcesses: async () => [{ pid: 321, command: `${process.execPath} ${record.entryPath} daemon` }],
+    stopProcess: async (pid, options) => stopped.push([pid, options]),
+    purgeDaemon: async (identity) => purged.push(identity)
+  });
+
+  assert.equal(result.outcome, "obsolete-removed");
+  assert.deepEqual(stopped, [[321, { forceAfterMs: 50 }]]);
+  assert.equal(purged.length, 1);
+});
+
+test("leaves an unverifiable live PID untouched", async () => {
+  let stopped = false;
+  let purged = false;
+  const result = await reapObsoleteDaemon({
+    record,
+    diagnostic: { pid: 321 },
+    reason: "registered entry does not match the installed tool",
+    timeoutMs: 100,
+    stopTimeoutMs: 50,
+    inspectProcesses: async () => [{ pid: 321, command: "node /some/other/process.js daemon" }],
+    stopProcess: async () => { stopped = true; },
+    purgeDaemon: async () => { purged = true; }
+  });
+
+  assert.equal(result.outcome, "obsolete-unverified");
+  assert.equal(stopped, false);
+  assert.equal(purged, false);
+});

package/test/official-tool-dependencies.test.js

@@ -10,9 +10,14 @@ test("official orchestrators declare their hard tool dependencies", async () =>
   assert.deepEqual((await manifest("magnific-mcp")).toolDependencies, { "mcp-client": "^0.2.0" });
   assert.deepEqual((await manifest("campaign-draft-runner")).toolDependencies, {
     "pr-campaign": "^0.1.0",
-    "gmail-workspace": "^0.1.0"
+    "gmail-workspace": "^0.1.0",
+    "lightpanda-browser": "^0.10.0"
+  });
+  assert.deepEqual((await manifest("browser-session-bridge")).toolDependencies, { "lightpanda-browser": "^0.11.5" });
+  assert.deepEqual((await manifest("x-campaign-runner")).toolDependencies, {
+    "x-dm": "^0.4.0",
+    "lightpanda-browser": "^0.11.0"
   });
-  assert.deepEqual((await manifest("x-campaign-runner")).toolDependencies, { "x-dm": "^0.4.0" });
   assert.deepEqual((await manifest("x-dm")).toolDependencies, { "browser-session-bridge": "^0.1.0" });
   assert.deepEqual((await manifest("x-session-reader")).toolDependencies, { "browser-session-bridge": "^0.1.0" });
   assert.deepEqual((await manifest("official-tool-sync")).toolDependencies, { trash: "^1.0.0" });

package/test/official-tool-installer.test.js

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
 import { cp, mkdir, mkdtemp, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -88,9 +89,21 @@ test("every bundled official tool lock matches the catalog source", async () =>
     );
     const manifest = JSON.parse(await readFile(path.join(source, "tool.manifest.json"), "utf8"));
     assert.equal(manifest.version ?? null, entry.version ?? null, `${name} version`);
+    assert.deepEqual(manifest.toolDependencies || {}, entry.toolDependencies || {}, `${name} tool dependencies`);
   }
 });
 
+test("the bundled lock commit contains the exact catalog snapshot", async () => {
+  const lock = JSON.parse(await readFile(new URL("../src/official-tools.lock.json", import.meta.url), "utf8"));
+  const repositoryRoot = fileURLToPath(new URL("../../", import.meta.url));
+  execFileSync("git", ["cat-file", "-e", `${lock.commit}^{commit}`], { cwd: repositoryRoot });
+  const changedTools = execFileSync("git", ["diff", "--name-only", lock.commit, "--", "tools"], {
+    cwd: repositoryRoot,
+    encoding: "utf8"
+  }).trim();
+  assert.equal(changedTools, "", `Bundled lock commit does not match catalog source:\n${changedTools}`);
+});
+
 test("rejects symbolic links before deployment", async (t) => {
   const { source, files } = await fixture(t);
   await symlink(path.join(source, "index.js"), path.join(source, "link.js"));

package/test/pi-auth-login.test.js

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { createPiOAuthLogin } from "../src/core/agent/pi-auth-login.js";
+import { createPiRuntime, hasProviderAuth, supportsProviderOAuth } from "../src/core/agent/pi-runtime.js";
+import { piAuthFile } from "../src/platform/paths.js";
+
+test("creates the async Pi runtime with Arisa credential storage and awaits runtime API keys", async (t) => {
+  const calls = [];
+  const runtime = {
+    async setRuntimeApiKey(provider, apiKey) {
+      await Promise.resolve();
+      calls.push([provider, apiKey]);
+    },
+    getProviderAuthStatus: () => ({ configured: true, source: "stored" }),
+    getProvider: () => ({ auth: { oauth: {} } })
+  };
+  t.mock.method(ModelRuntime, "create", async (options) => {
+    assert.equal(options.authPath, piAuthFile);
+    return runtime;
+  });
+  assert.equal(await createPiRuntime({ provider: "openai", apiKey: "test-key" }), runtime);
+  assert.deepEqual(calls, [["openai", "test-key"]]);
+  assert.equal(hasProviderAuth("openai", runtime), true);
+  assert.equal(supportsProviderOAuth("openai", runtime), true);
+});
+
+test("adapts Pi OAuth notifications, selections and manual codes in order", async (t) => {
+  const events = [];
+  let controller;
+  const credential = { type: "oauth", access: "test-access" };
+  t.mock.method(ModelRuntime, "create", async () => ({
+    getProvider: () => ({ auth: { oauth: {} } }),
+    async login(provider, type, interaction) {
+      assert.equal(provider, "openai-codex");
+      assert.equal(type, "oauth");
+      interaction.notify({ type: "auth_url", url: "https://example.com/login" });
+      interaction.notify({ type: "device_code", userCode: "ABCD", verificationUri: "https://example.com/device" });
+      interaction.notify({ type: "progress", message: "waiting" });
+      assert.equal(await interaction.prompt({ type: "select", options: [{ id: "device", label: "Device" }] }), "device");
+      assert.deepEqual(events, ["auth", "device", "waiting", "select"]);
+      assert.equal(await interaction.prompt({ type: "text", message: "Value" }), "answer");
+      const code = interaction.prompt({ type: "manual_code" });
+      await new Promise((resolve) => setImmediate(resolve));
+      assert.equal(controller.manualInputRequested, true);
+      assert.equal(controller.submitManualCode(" callback-code "), true);
+      assert.equal(await code, "callback-code");
+      return credential;
+    }
+  }));
+  controller = createPiOAuthLogin({
+    provider: "openai-codex",
+    onAuth: async () => { await Promise.resolve(); events.push("auth"); },
+    onDeviceCode: async () => { events.push("device"); },
+    onProgress: (message) => events.push(message),
+    onSelect: ({ options }) => { events.push("select"); return options[0].id; },
+    onPrompt: () => "answer"
+  });
+  assert.equal(await controller.promise, credential);
+  assert.equal(controller.manualInputRequested, false);
+  assert.equal(controller.submitManualCode("again"), false);
+});
+
+test("OAuth rejects unsupported providers and surfaces notification failures", async (t) => {
+  t.mock.method(ModelRuntime, "create", async () => ({ getProvider: () => ({ auth: {} }) }));
+  await assert.rejects(createPiOAuthLogin({ provider: "unsupported" }).promise, /No internal OAuth login flow/);
+  ModelRuntime.create.mock.restore();
+  t.mock.method(ModelRuntime, "create", async () => ({
+    getProvider: () => ({ auth: { oauth: {} } }),
+    async login(_provider, _type, interaction) {
+      interaction.notify({ type: "auth_url", url: "https://example.com/login" });
+      await interaction.prompt({ type: "manual_code" });
+    }
+  }));
+  const login = createPiOAuthLogin({ provider: "openai-codex", onAuth: async () => { throw new Error("delivery failed"); } });
+  await assert.rejects(login.promise, /delivery failed/);
+  assert.equal(login.manualInputRequested, false);
+});

package/test/pi-capability-tools.test.js

@@ -5,6 +5,7 @@ import { createPiCapabilityTools } from "../src/core/agent/pi-capability-tools.j
 function createHarness() {
   const calls = [];
   let taskContext = { transportChatId: "chat-1", messageThreadId: 10 };
+  const agentTaskExecution = { blockedAuth: null };
   const capabilityService = {
     async execute(request) {
       calls.push(request);
@@ -15,6 +16,7 @@ function createHarness() {
   };
   const telegram = {
     getTaskContext: () => taskContext,
+    getAgentTaskExecution: () => agentTaskExecution,
     sendMedia: async () => {}
   };
   const tools = createPiCapabilityTools({
@@ -62,4 +64,5 @@ test("Pi tool execution resolves the current Telegram task context per call", as
 
   assert.equal(harness.calls[0].context.taskContext.messageThreadId, 10);
   assert.equal(harness.calls[1].context.taskContext.messageThreadId, 20);
+  assert.equal(harness.calls[0].context.agentTaskExecution, harness.calls[1].context.agentTaskExecution);
 });