carthagent 1.0.7 → 1.1.0-preview.12

package/tools/native-manual.mjs

@@ -0,0 +1,338 @@
+#!/usr/bin/env node
+import { readFile, cp, mkdir, writeFile } from 'node:fs/promises';
+import { spawn, execFileSync } from 'node:child_process';
+import { once } from 'node:events';
+import { resolve, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { nativeFixture, streamText } from './native-fixture.mjs';
+import { preflightNativeTestRuntimeArtifact } from './native-runtime-identity.mjs';
+import { readManualRuntimeManifest } from './manual-runtime-manifest.mjs';
+import { provisionDefaultNativeTheme } from '../plugins/carthagent/src/ui/theme-provision.mjs';
+
+const root = resolve(import.meta.dirname, '..');
+
+export async function runManualKit(
+  directory,
+  project = 'tiny',
+  { live = false, smoke = false, args = [], stop = false, runtimeManifest, manifestSha256 } = {},
+) {
+  if (!['tiny', 'product', 'scale'].includes(project))
+    throw Error('Project must be tiny, product, or scale');
+  const kit = resolve(directory);
+  const record = JSON.parse(
+    await readFile(join(kit, 'manual-kit.json'), 'utf8'),
+  );
+  const { manifest, manifestPath, manifestSha256: actualDigest } = await readManualRuntimeManifest({ runtimeManifest, manifestSha256 });
+  const releaseVersion = manifest.releaseVersion;
+  const target = `${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`;
+  if (
+    record.version !== 1 ||
+    record.target !== target ||
+    record.runtime !== `runtimes/${releaseVersion}/${target}`
+  )
+    throw Error(
+      'Kit platform/layout does not match this machine; prepare a new native kit',
+    );
+  if (actualDigest !== record.manifestSha256)
+    throw Error('Kit manifest does not match this source checkout');
+  const ownedRoot = join(kit, record.runtime);
+  const { identity } = await preflightNativeTestRuntimeArtifact({
+    ownedRoot,
+    expectedManifestPath: manifestPath,
+    env: {},
+  });
+  if (identity.binarySha256 !== record.binarySha256)
+    throw Error('Kit runtime identity changed');
+  const safeEnv = Object.fromEntries(
+    [
+      'PATH',
+      'SystemRoot',
+      'WINDIR',
+      'COMSPEC',
+      'PATHEXT',
+      'LANG',
+      'LC_ALL',
+      'TERM',
+      'COLORTERM',
+    ]
+      .filter((key) => process.env[key])
+      .map((key) => [key, process.env[key]]),
+  );
+  if (live) {
+    if (smoke)
+      throw Error('Live mode never runs automatically; use offline --smoke');
+    const profile = join(kit, 'profiles', 'live');
+    if (stop) {
+      const { stopService } = await import('../lib/opencode/service.mjs');
+      return await stopService({ root: profile });
+    }
+    const home = join(profile, 'home');
+    await mkdir(home, { recursive: true, mode: 0o700 });
+    const env = {
+      ...safeEnv,
+      HOME: home,
+      USERPROFILE: home,
+      APPDATA: join(home, 'AppData', 'Roaming'),
+      LOCALAPPDATA: join(home, 'AppData', 'Local'),
+      XDG_CONFIG_HOME: join(profile, 'config'),
+      XDG_DATA_HOME: join(profile, 'data'),
+      XDG_STATE_HOME: join(profile, 'state'),
+      XDG_CACHE_HOME: join(profile, 'cache'),
+      CTG_NATIVE: '1',
+      CTG_NODE_EXECUTABLE: process.execPath,
+      CTG_OWNED_OPENCODE_RUNTIME: ownedRoot,
+      CTG_OPENCODE_HOME: profile,
+      CARTHAGENT_CONFIG: join(profile, 'carthagent-config.json'),
+      CARTHAGENT_CODING_AGENT_DIR: join(profile, 'agent'),
+    };
+    for (const key of [
+      'OPENAI_API_KEY',
+      'ANTHROPIC_API_KEY',
+      'OPENROUTER_API_KEY',
+      'GEMINI_API_KEY',
+    ])
+      if (process.env[key]) env[key] = process.env[key];
+    console.log(
+      'LIVE mode: prompts/source may leave this machine and provider use may incur charges. Profile:',
+      profile,
+    );
+    const child = spawn(
+      process.execPath,
+      [join(root, 'bin/ctg.mjs'), ...args],
+      { cwd: join(kit, 'projects', project), env, stdio: 'inherit' },
+    );
+    const [code, signal] = await once(child, 'exit');
+    if (signal) throw Error(`Native CLI exited with ${signal}`);
+    if (code !== 0) throw Error(`Native CLI exited with status ${code}`);
+    return;
+  }
+  if (stop || args.length)
+    throw Error('Extra CLI arguments and --stop require --live');
+  const runtimeKeys = [
+    'CTG_OWNED_OPENCODE_RUNTIME',
+    'CTG_TEST_RUNTIME_RELEASE_MANIFEST',
+    'CTG_OPENCODE_BIN',
+    'CTG_TEST_RUNTIME_SHA256',
+  ];
+  const previousEnvironment = Object.fromEntries(
+    runtimeKeys.map((key) => [key, process.env[key]]),
+  );
+  process.env.CTG_OWNED_OPENCODE_RUNTIME = ownedRoot;
+  process.env.CTG_TEST_RUNTIME_RELEASE_MANIFEST = manifestPath;
+  delete process.env.CTG_OPENCODE_BIN;
+  delete process.env.CTG_TEST_RUNTIME_SHA256;
+  let host;
+  let child;
+  try {
+    host = await nativeFixture({
+      verifyInventory: true,
+      env: { CTG_NODE_EXECUTABLE: process.execPath },
+      respond(body, res) {
+        const messages = body.messages ?? [];
+        const latest = [...messages]
+          .reverse()
+          .find((message) => message.role === 'user');
+        const text =
+          typeof latest?.content === 'string'
+            ? latest.content
+            : JSON.stringify(latest?.content ?? '');
+        if (text.includes('CTG_MANUAL_INSPECT')) {
+          const recent = messages.slice(
+            messages.findLastIndex((message) => message.role === 'user'),
+          );
+          const calls = recent.flatMap((message) => message.tool_calls ?? []);
+          const shell = calls.find((call) => call.id === 'manual-inspection');
+          const output =
+            shell &&
+            recent.find(
+              (message) =>
+                message.role === 'tool' && message.tool_call_id === shell.id,
+            );
+          if (output)
+            return streamText(
+              res,
+              `CTG_MANUAL_INSPECTION_COMPLETE\n${String(output.content).slice(-4000)}`,
+            );
+          const planned = calls.some((call) => call.id === 'manual-plan');
+          const name = planned ? 'shell' : 'execute';
+          if (!(body.tools ?? []).some((tool) => tool.function?.name === name))
+            return streamText(
+              res,
+              `CTG_MANUAL_POLICY_REJECTED: ${name} is not admitted. ${recent
+                .filter((message) => message.role === 'tool')
+                .map((message) => String(message.content))
+                .join('\n')}`,
+            );
+          const input = planned
+            ? {
+                command: `node --input-type=module -e "import {spawnSync} from 'node:child_process';const r=spawnSync(process.execPath,['--test','--test-reporter=tap','test/*.test.mjs'],{encoding:'utf8',maxBuffer:16000000});console.log(r.status===0?(r.stdout??'').split(String.fromCharCode(10)).filter(s=>s.startsWith('# ')).slice(-8).join(String.fromCharCode(10)):(r.stdout??'').slice(-12000));process.stderr.write(r.stderr??'');console.log('CTG_MANUAL_BASELINE_EXIT='+r.status);process.exit(r.status??1)"`,
+                workdir: host.cwd,
+              }
+            : {
+                code: `return await tools.carthagent["delivery_plan"](${JSON.stringify({ goal: 'Observe the generated project baseline without modifying source', assumptions: ['This is a scripted offline inspection, not implementation or independent review.'], artifacts: ['test', 'TASK.md', 'package.json'], outputs: ['Baseline test results'], steps: [{ id: 'inspect', title: 'Run the existing baseline', checks: ['baseline'] }], acceptance: [{ requirement: 'Existing baseline tests pass', checks: ['baseline'] }], checks: [{ id: 'baseline', kind: 'test', argv: [process.execPath, '--test', 'test/*.test.mjs'], timeoutSeconds: 30 }] })})`,
+              };
+          res.writeHead(200, { 'content-type': 'text/event-stream' });
+          const call = {
+            index: 0,
+            id: planned ? 'manual-inspection' : 'manual-plan',
+            type: 'function',
+            function: { name, arguments: JSON.stringify(input) },
+          };
+          res.end(
+            `data: ${JSON.stringify({ id: 'manual', object: 'chat.completion.chunk', created: 1, model: 'fixture', choices: [{ index: 0, delta: { role: 'assistant', tool_calls: [call] }, finish_reason: 'tool_calls' }] })}\n\ndata: [DONE]\n\n`,
+          );
+          return;
+        }
+        streamText(
+          res,
+          `CTG_MANUAL_REPLY\nLocal fixture response; this is not a reasoning model.\n${text.slice(-600)}\nUnicode payload: café Ελληνικά 日本語 🧪\nType CTG_MANUAL_INSPECT to run this project's baseline through a real native shell tool.`,
+        );
+      },
+    });
+    await cp(join(kit, 'projects', project), host.cwd, {
+      recursive: true,
+      filter: (source) =>
+        !source
+          .split(/[\\/]/)
+          .some((part) =>
+            ['.git', '.harness', 'node_modules', '.env'].includes(part),
+          ),
+    });
+    execFileSync('git', ['init', '-b', 'main'], {
+      cwd: host.cwd,
+      env: safeEnv,
+      stdio: 'pipe',
+    });
+    const session = await host.client.session.create(
+      {
+        location: host.location,
+        model: host.model,
+        title: `Manual ${project} fixture`,
+        metadata: {
+          'ctg.raw': true,
+          'carthagent.options': { guide: false, strict: false, review: 'no' },
+        },
+      },
+      host.request(),
+    );
+    await host.active();
+    await provisionDefaultNativeTheme(join(host.temp, 'config/opencode'));
+    const env = {
+      ...safeEnv,
+      HOME: join(host.temp, 'home'),
+      USERPROFILE: join(host.temp, 'home'),
+      XDG_CONFIG_HOME: join(host.temp, 'config'),
+      XDG_DATA_HOME: join(host.temp, 'data'),
+      XDG_STATE_HOME: join(host.temp, 'state'),
+      XDG_CACHE_HOME: join(host.temp, 'cache'),
+      OPENCODE_CONFIG_DIR: join(host.temp, 'config/opencode'),
+      OPENCODE_CONFIG_PROJECT_DISABLE: 'true',
+      OPENCODE_PASSWORD: host.password,
+      CTG_NODE_EXECUTABLE: process.execPath,
+    };
+    if (smoke) {
+      await host.client.session.prompt(
+        { sessionID: session.id, text: 'CTG_MANUAL_INSPECT' },
+        host.request(),
+      );
+      const outcome = await host.outcome(session.id);
+      if (outcome !== 'succeeded')
+        throw Error(`Native inspection ended with ${outcome}`);
+      const messages = await host.client.session.context(
+        { sessionID: session.id },
+        host.request(),
+      );
+      const rendered = JSON.stringify(messages);
+      if (
+        !rendered.includes('CTG_MANUAL_INSPECTION_COMPLETE') ||
+        !rendered.includes('CTG_MANUAL_BASELINE_EXIT=0')
+      )
+        throw Error(
+          'Native project inspection did not finish with a successful correlated baseline tool result',
+        );
+      const report = {
+        project,
+        binarySha256: record.binarySha256,
+        scope:
+          'Scripted offline provider; actual native plugin, shell and generated-project baseline',
+        outcome,
+        providerRequests: host.requests.length,
+        completed: true,
+      };
+      await mkdir(join(kit, 'reports'), { recursive: true });
+      await writeFile(
+        join(kit, 'reports', `${project}-native-smoke.json`),
+        JSON.stringify(report, null, 2) + '\n',
+      );
+      console.log(JSON.stringify(report, null, 2));
+      return report;
+    }
+    console.log(
+      `OFFLINE UI: disposable ${project} copy; no provider keys forwarded. This is not an OS sandbox.\nProfile disappears on exit. Do not use this mode to judge model quality.\nUse CTG_MANUAL_INSPECT, /help, /clear, /autocompact off, /workflow.\nProject: ${host.cwd}`,
+    );
+    child = spawn(
+      identity.binary,
+      ['--server', host.baseUrl, '--session', session.id],
+      { cwd: host.cwd, env, stdio: 'inherit' },
+    );
+    const [code, signal] = await once(child, 'exit');
+    if (signal) throw Error(`Native TUI exited with ${signal}`);
+    if (code !== 0) throw Error(`Native TUI exited with status ${code}`);
+  } catch (error) {
+    if (host)
+      console.error(
+        'Offline fixture diagnostics:',
+        JSON.stringify({
+          providerErrors: host.providerErrors.map((error) => error.message),
+          requests: host.requests.length,
+          tools: host.requests
+            .at(-1)
+            ?.tools?.map((tool) => tool.function?.name),
+          lastToolResults: host.requests
+            .at(-1)
+            ?.messages?.filter((message) => message.role === 'tool')
+            .map((message) => String(message.content).slice(-2500)),
+        }),
+      );
+    throw error;
+  } finally {
+    if (child && child.exitCode === null && child.signalCode === null)
+      child.kill('SIGTERM');
+    try {
+      await host?.close();
+    } finally {
+      for (const key of runtimeKeys) {
+        if (previousEnvironment[key] === undefined) delete process.env[key];
+        else process.env[key] = previousEnvironment[key];
+      }
+    }
+  }
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+  const [directory, project = 'tiny', ...options] = process.argv.slice(2);
+  if (!directory)
+    throw Error(
+      'Usage: node tools/native-manual.mjs <kit> [tiny|product|scale] [--smoke | --live [-- <ctg arguments>]]',
+    );
+  const delimiter = options.indexOf('--');
+  const flags = delimiter < 0 ? options : options.slice(0, delimiter);
+  const manifestOptions = {};
+  for (let i = 0; i < flags.length; i++) {
+    if (['--live', '--smoke', '--stop'].includes(flags[i])) continue;
+    const flag = flags[i];
+    if (!['--manifest', '--manifest-sha256'].includes(flag) || !flags[i + 1] || flags[i + 1].startsWith('--'))
+      throw Error('Unknown or incomplete manual runner option');
+    manifestOptions[flag === '--manifest' ? 'runtimeManifest' : 'manifestSha256'] = flags[++i];
+  }
+  await runManualKit(directory, project, {
+    ...manifestOptions,
+    live: flags.includes('--live'),
+    smoke: flags.includes('--smoke'),
+    stop: flags.includes('--stop'),
+    args: delimiter < 0 ? [] : options.slice(delimiter + 1),
+  });
+}

package/tools/native-model-picker-acceptance.py

@@ -0,0 +1,306 @@
+#!/usr/bin/env python3
+"""Focused native model-picker cancel proof using a local two-model provider."""
+import argparse
+import fcntl
+import hashlib
+import importlib.machinery
+import importlib.util
+import json
+import os
+from pathlib import Path
+import pty
+import re
+import select
+import signal
+import struct
+import subprocess
+import termios
+import tempfile
+import time
+from datetime import datetime, timezone
+
+
+def sha256_file(path):
+    digest = hashlib.sha256()
+    with open(path, 'rb') as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b''):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def option_style_bytes(transcript, option):
+    pattern = re.compile(rb'(?:\x1b\[[0-9;]*m)*' + re.escape(option.encode('ascii')))
+    matches = list(pattern.finditer(transcript))
+    return matches[-1].group(0)[:-len(option)].decode('ascii', errors='replace') if matches else None
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--binary', default=os.environ.get('CTG_OPENCODE_BIN'))
+    parser.add_argument('--expected-version', required=True,
+                        help='exact --version output expected for the trusted supplied executable')
+    parser.add_argument('--expected-sha256', required=True,
+                        help='independently sourced expected SHA-256; binary is hashed before execution')
+    parser.add_argument('--timeout', type=int, default=60)
+    parser.add_argument('--artifact')
+    args = parser.parse_args()
+    if not args.binary:
+        parser.error('pass --binary or set CTG_OPENCODE_BIN')
+    binary = os.path.realpath(os.path.abspath(args.binary))
+    if not os.path.isfile(binary):
+        parser.error(f'binary not found: {binary}')
+    if not re.fullmatch(r'[0-9a-f]{64}', args.expected_sha256):
+        parser.error('--expected-sha256 must be 64 lowercase hexadecimal characters')
+    actual_sha256 = sha256_file(binary)
+    if actual_sha256 != args.expected_sha256:
+        parser.error(f'binary SHA-256 mismatch before execution: expected {args.expected_sha256}, got {actual_sha256}')
+    version = subprocess.run([binary, '--version'], text=True, capture_output=True, timeout=20)
+    version_output = (version.stdout + version.stderr).strip()
+    if version.returncode or version_output != args.expected_version:
+        parser.error(f'expected exact version {args.expected_version!r}, got {version_output!r}')
+
+    harness_path = Path(__file__).with_name('native-terminal-semantics.py')
+    loader = importlib.machinery.SourceFileLoader('native_terminal_semantics', str(harness_path))
+    spec = importlib.util.spec_from_loader(loader.name, loader)
+    harness = importlib.util.module_from_spec(spec)
+    loader.exec_module(harness)
+    provider = harness.Provider
+    screen_type = harness.Screen
+    provider.received.clear()
+    provider.reply = 'MODEL_PICKER_FIXTURE_REPLY'
+
+    source_root = Path(__file__).resolve().parents[1]
+    source_commit = subprocess.run(['git', '-C', str(source_root), 'rev-parse', 'HEAD'],
+                                   text=True, capture_output=True).stdout.strip()
+    dirty = subprocess.run(['git', '-C', str(source_root), 'status', '--porcelain',
+                             '--untracked-files=no'], text=True, capture_output=True).stdout.strip()
+    result = {
+        'startedAtUtc': datetime.now(timezone.utc).isoformat(),
+        'case': 'native-model-picker-navigation-escape-unchanged-model',
+        'binary': binary,
+        'expectedBinaryVersion': args.expected_version,
+        'binaryVersion': version_output,
+        'expectedBinarySha256': args.expected_sha256,
+        'binarySha256': actual_sha256,
+        'sourceCommit': source_commit,
+        'workingTreeDirty': bool(dirty),
+        'probeSha256': sha256_file(__file__),
+        'supportingHarnessSha256': sha256_file(harness_path),
+        'provider': 'loopback offline fixture',
+        'configuredModel': 'ctgfixture/fixture',
+        'alternateModel': 'ctgfixture/alternate',
+        'binaryPreflight': 'sha256 verified against required external expected value before --version or TUI launch',
+        'physicalOSClipboardVerified': False,
+        'checks': {},
+    }
+
+    server = __import__('socketserver').ThreadingTCPServer(('127.0.0.1', 0), provider)
+    import threading
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    master = slave = child = None
+    try:
+        with tempfile.TemporaryDirectory(prefix='ctg-model-picker-', ignore_cleanup_errors=True) as temp:
+            root = os.path.abspath(temp)
+            project = os.path.join(root, 'project')
+            config_dir = os.path.join(root, 'config', 'opencode')
+            for folder in (project, config_dir, os.path.join(root, 'home'),
+                           os.path.join(root, 'data'), os.path.join(root, 'state'),
+                           os.path.join(root, 'cache')):
+                os.makedirs(folder, exist_ok=True)
+            config = {
+                'update': 'disable',
+                'model': 'ctgfixture/fixture',
+                'providers': {'ctgfixture': {
+                    'name': 'CTG Picker Fixture',
+                    'package': '@opencode/ai/providers/openai-compatible',
+                    'settings': {'baseURL': f'http://127.0.0.1:{server.server_address[1]}/v1'},
+                    'models': {
+                        'fixture': {'name': 'CTG Picker A', 'limit': {'context': 32000, 'output': 1024}},
+                        'alternate': {'name': 'CTG Picker B', 'limit': {'context': 32000, 'output': 1024}},
+                    },
+                }},
+            }
+            config_path = os.path.join(config_dir, 'opencode.json')
+            Path(config_path).write_text(json.dumps(config), encoding='utf8')
+            env = {key: os.environ[key] for key in ('PATH', 'LANG', 'LC_ALL') if key in os.environ}
+            env.update({
+                'HOME': os.path.join(root, 'home'), 'TERM': 'xterm-256color',
+                'COLORTERM': 'truecolor', 'XDG_CONFIG_HOME': os.path.join(root, 'config'),
+                'XDG_DATA_HOME': os.path.join(root, 'data'), 'XDG_STATE_HOME': os.path.join(root, 'state'),
+                'XDG_CACHE_HOME': os.path.join(root, 'cache'), 'OPENCODE_DB': os.path.join(root, 'db.sqlite'),
+                'OPENCODE_CONFIG_DIR': config_dir, 'OPENCODE_CONFIG': config_path,
+                'OPENCODE_CONFIG_PROJECT_DISABLE': 'true',
+            })
+            master, slave = pty.openpty()
+            fcntl.ioctl(slave, termios.TIOCSWINSZ, struct.pack('HHHH', 32, 100, 0, 0))
+            child = subprocess.Popen([binary, '--standalone'], cwd=project, env=env,
+                                     stdin=slave, stdout=slave, stderr=slave, start_new_session=True)
+            os.close(slave)
+            slave = None
+            screen = screen_type(rows=32, columns=100)
+            transcript = bytearray()
+
+            def pump(duration=.15):
+                deadline = time.monotonic() + duration
+                while time.monotonic() < deadline:
+                    if child.poll() is not None:
+                        raise RuntimeError(f'host exited early ({child.returncode}): {screen.visible()[-1000:]}')
+                    if not select.select([master], [], [], .03)[0]:
+                        continue
+                    chunk = os.read(master, 65536)
+                    transcript.extend(chunk)
+                    screen.feed(chunk)
+                    if b'\x1b[6n' in chunk:
+                        os.write(master, b'\x1b[1;1R')
+                    if b'\x1b[c' in chunk:
+                        os.write(master, b'\x1b[?1;2c')
+
+            def until(predicate, label, timeout=10):
+                deadline = time.monotonic() + timeout
+                while time.monotonic() < deadline:
+                    pump(.1)
+                    if predicate():
+                        return
+                raise TimeoutError(f'timeout waiting for {label}: screen={screen.visible()[-1200:]!r} '
+                                   f'transcript={bytes(transcript[-3000:])!r}')
+
+            until(lambda: 'ask anything' in screen.visible().lower() or
+                  'what is the tech' in screen.visible().lower(), 'home composer', timeout=args.timeout)
+            # Open a native session first so the footer/model state is explicit.
+            os.write(master, b'\r')
+            until(lambda: 'Build · CTG Picker A' in screen.visible(), 'active session with configured model A')
+            # Native runtime binding: Ctrl+X leader then m => model.list.
+            configured_model_id = 'fixture'
+            if 'Build · CTG Picker A' not in screen.visible():
+                raise AssertionError('configured model A is not visible in active session metadata before picker')
+            os.write(master, b'\x18')
+            pump(.12)
+            os.write(master, b'm')
+            until(lambda: 'select model' in screen.visible().lower(), 'native model picker')
+            requests_before_cancel = len(provider.received)
+
+            # Filter to the two controlled choices, prove keyboard highlight moved
+            # from A to B via ANSI inverse rendition at the model row, then Escape.
+            os.write(master, b'CTG Picker')
+            until(lambda: 'CTG Picker A' in screen.visible() and 'CTG Picker B' in screen.visible(),
+                  'both filtered model choices')
+            picker_before = screen.visible()
+            if '● CTG Picker A' not in picker_before:
+                raise AssertionError(f'current model A not visibly selected before navigation: {picker_before[-1200:]}')
+            raw_before_navigation = bytes(transcript)
+            style_a_before = option_style_bytes(raw_before_navigation, 'CTG Picker A')
+            if not style_a_before:
+                raise AssertionError('could not capture the currently selected A option style before navigation')
+            os.write(master, b'\x1b[B')
+            pump(.25)
+            picker_after_down = screen.visible()
+            if 'CTG Picker B' not in picker_after_down or 'Select model' not in picker_after_down:
+                raise AssertionError(f'model picker did not remain with alternate option after ArrowDown: {picker_after_down[-1200:]}')
+            style_a = option_style_bytes(bytes(transcript), 'CTG Picker A')
+            style_b = option_style_bytes(bytes(transcript), 'CTG Picker B')
+            if (not style_a or not style_b or style_b != style_a_before or
+                    style_a == style_a_before or style_a == style_b):
+                raise AssertionError('ArrowDown did not move the prior selected styling from A to B: '
+                                     f'before selected A={style_a_before!r}; after A={style_a!r}, B={style_b!r}')
+            # In this dialog Escape first clears the active model-search filter;
+            # a second Escape closes the picker without submitting the highlight.
+            os.write(master, b'\x1b')
+            pump(.35)
+            if 'Select model' in screen.visible() and 'CTG Picker' not in screen.visible():
+                raise AssertionError('unexpected intermediate model-search reset state')
+            os.write(master, b'\x1b')
+            until(lambda: 'select model' not in screen.visible().lower(), 'model picker Escape dismissal')
+            after_cancel = screen.visible()
+            requests_after_cancel = len(provider.received)
+            if 'ask anything' not in after_cancel.lower() and '┃' not in after_cancel:
+                raise AssertionError(f'composer not restored after model picker Escape: {after_cancel[-1000:]}')
+            if requests_after_cancel != requests_before_cancel:
+                raise AssertionError('provider request occurred during model-picker navigation/cancel')
+
+            rendered_model_label_after_cancel = 'Build · CTG Picker A CTG Picker Fixture' in after_cancel
+            if not rendered_model_label_after_cancel:
+                raise AssertionError(f'rendered active-session model label no longer shows A after cancel: {after_cancel[-1200:]}')
+
+            # Enter the session, then submit a new unique prompt from the session
+            # composer so model selection is evidenced by a real provider request.
+            os.write(master, b'MODEL-A-AFTER-CANCEL')
+            until(lambda: 'MODEL-A-AFTER-CANCEL' in screen.visible(), 'post-cancel prompt staged')
+            os.write(master, b'\r')
+            until(lambda: len(provider.received) > requests_before_cancel,
+                  'post-cancel fixture request', timeout=20)
+            after_models = [body.get('model') for body in provider.received[requests_before_cancel:]]
+            after_messages = provider.received[-1].get('messages', [])
+            exact_prompt = any(message.get('role') == 'user' and
+                               'MODEL-A-AFTER-CANCEL' in str(message.get('content', ''))
+                               for message in after_messages)
+            if not exact_prompt and not any('MODEL-A-AFTER-CANCEL' in str(message) for message in after_messages):
+                pump(.8)
+                if len(provider.received) == requests_before_cancel:
+                    os.write(master, b'\r')
+                    until(lambda: len(provider.received) > requests_before_cancel,
+                          'second enter post-cancel fixture request')
+                after_models = [body.get('model') for body in provider.received[requests_before_cancel:]]
+                after_messages = provider.received[-1].get('messages', [])
+                exact_prompt = any(message.get('role') == 'user' and
+                                   'MODEL-A-AFTER-CANCEL' in str(message.get('content', ''))
+                                   for message in after_messages)
+            if not exact_prompt:
+                raise AssertionError('post-cancel request did not contain the unique exact prompt')
+            if not after_models or any(model != 'fixture' for model in after_models):
+                raise AssertionError(f'configured model changed after cancellation: {after_models!r}')
+
+            result['checks']['modelPickerNavigationEscapeUnchangedModel'] = {
+                'status': 'PASS',
+                'modelPickerObserved': True,
+                'modelOptionsVisible': ['CTG Picker A', 'CTG Picker B'],
+                'currentModelBeforeNavigationVisible': 'CTG Picker A' in picker_before,
+                'navigationKeySent': 'ArrowDown',
+                'alternateOptionVisibleAfterNavigation': 'CTG Picker B' in picker_after_down,
+                'selectedOptionStyleAfterNavigation': style_b,
+                'otherOptionStyleAfterNavigation': style_a,
+                'escapeDismissedPicker': True,
+                'composerRestored': True,
+                'providerRequestsDuringCancel': requests_after_cancel - requests_before_cancel,
+                'renderedActiveSessionModelLabelStillShowsA': rendered_model_label_after_cancel,
+                'configuredModelIdBeforePicker': configured_model_id,
+                'postCancelProviderModels': after_models,
+                'postCancelUniquePromptAccepted': exact_prompt,
+                'provider': 'loopback offline fixture',
+            }
+            result['status'] = 'PASS_BOUNDED'
+            result['checks']['physicalOSClipboardVerified'] = {'status': 'NOT_TESTED'}
+            pump(.3)
+    except Exception as error:
+        result['status'] = 'INCOMPLETE'
+        result['checks'].setdefault('modelPickerNavigationEscapeUnchangedModel', {
+            'status': 'FAIL', 'error': f'{type(error).__name__}: {error}'})
+    finally:
+        if child is not None and child.poll() is None:
+            os.write(master, b'\x15/quit\r')
+            try:
+                child.wait(timeout=3)
+            except subprocess.TimeoutExpired:
+                os.killpg(child.pid, signal.SIGTERM)
+                try:
+                    child.wait(timeout=2)
+                except subprocess.TimeoutExpired:
+                    os.killpg(child.pid, signal.SIGKILL)
+                    child.wait()
+        if slave is not None:
+            os.close(slave)
+        if master is not None:
+            os.close(master)
+        server.shutdown()
+        server.server_close()
+
+    rendered = json.dumps(result, ensure_ascii=False, indent=2) + '\n'
+    print(rendered, end='')
+    if args.artifact:
+        artifact = Path(args.artifact).resolve()
+        artifact.parent.mkdir(parents=True, exist_ok=True)
+        artifact.write_text(rendered, encoding='utf8')
+    return 0 if result['status'] == 'PASS_BOUNDED' else 2
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())