create-harness-vibe-coding 0.8.19 → 0.9.3

package/src/wf-ui-server/__tests__/workflow-team-flow.test.mjs

@@ -0,0 +1,278 @@
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { autoConnectAgent, findAgents, loadWorkflowGraphMap, writeWorkflowGraphMap } from '../a2a-store.mjs';
+import { executeNodeAction } from '../workflow-node-runtime.mjs';
+import { createEventNode, getEventNode } from '../workflow-event-node-store.mjs';
+import { listBridgeMessages } from '../bridge-store.mjs';
+import { persistSession } from '../terminal-store.mjs';
+import { createRoleProfile } from '../workflow-node-types/role-profile-store.mjs';
+import { registerPtyProcess, unregisterPtyProcess } from '../ws-terminal.mjs';
+import { isTimerSchedulerActive, stopTimerScheduler, syncTimerScheduler } from '../timer-wakeup-scheduler.mjs';
+
+// F19/D17 (T3 full-flow): one in-process integration test driving the whole
+// agent-team cooperation chain WITHOUT real PTY sessions — test-registry agent
+// sessions, role profiles, find -> auto-connect -> structured request ->
+// aggregated replies -> timer wakeup with goalNodeId -> goal check/complete.
+// Same infrastructure as the other wf-ui-server __tests__ (no HTTP server; the
+// backend functions are invoked in-process, PTY input is captured via
+// registerPtyProcess).
+
+function seedRoot() {
+  const root = makeHarnessTempRoot('wf-team-flow-');
+  fs.mkdirSync(path.join(root, 'Harness', 'tasks'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'Harness', 'a2a'), { recursive: true });
+  return root;
+}
+
+function seedActiveTask(root, taskId = 'task-team-flow') {
+  fs.mkdirSync(path.join(root, 'Harness', 'tasks', taskId), { recursive: true });
+  fs.writeFileSync(path.join(root, 'Harness', 'PROGRESS.md'), `# PROGRESS.md\n\n## Active Task\n\n- ${taskId}\n`, 'utf8');
+  fs.writeFileSync(path.join(root, 'Harness', 'tasks', taskId, 'STATE.json'), JSON.stringify({
+    schemaVersion: 1,
+    taskId,
+    status: 'active',
+    title: 'Team flow goal',
+    nextAction: 'Route agents',
+    acceptance: [],
+    planItems: [],
+    phase: 'implement',
+  }));
+  return `goal-${taskId}`;
+}
+
+function seedAgent(root, { nodeId, sessionId, roleTitle, displayName, agentKind = 'subagent', role, runtime = 'claude', capabilities = [] }) {
+  persistSession(root, {
+    sessionId,
+    graphNodeId: nodeId,
+    runtime,
+    agentKind,
+    role: role || roleTitle || 'Subagent',
+    roleTitle,
+    displayName: displayName || roleTitle || '',
+    status: 'running',
+    attachMode: true,
+    taskId: null,
+    capabilities,
+  });
+  writeWorkflowGraphMap(root, {
+    ...loadWorkflowGraphMap(root),
+    version: loadWorkflowGraphMap(root).version + 1,
+    nodes: [
+      ...(loadWorkflowGraphMap(root).nodes || []).filter(node => (node.nodeId || node.id) !== nodeId),
+      { nodeId, sessionId, kind: 'terminal-session', runtime, agentKind, role: role || roleTitle || 'Agent', label: displayName || roleTitle || 'Agent', status: 'running' },
+    ],
+  });
+  if (roleTitle) {
+    createRoleProfile({ nodeId, roleTitle, displayName: displayName || roleTitle, agentKind, runtime, capabilities }, root);
+  }
+  return nodeId;
+}
+
+function dockLink(a, b) {
+  const pair = [a, b].sort();
+  return {
+    id: `dock:${pair[0]}::${pair[1]}`,
+    nodeIds: pair,
+    anchorId: pair[0],
+    draggedId: pair[1],
+    side: 'top',
+    edges: [],
+    connections: [
+      { source: a, target: b, relation: 'wf-bridge', direction: 'source-to-target', sourceHandle: 'dock', targetHandle: 'dock' },
+    ],
+  };
+}
+
+function wakeupEntries(root, timerNodeId, sessionId) {
+  return listBridgeMessages(root, { fromSessionId: `wakeup-${timerNodeId}`, toSessionId: sessionId }).entries;
+}
+
+// F17/D14 writes PTY input char-by-char (12ms gaps, single \r at the end), so
+// a registered test PTY receives many small writes instead of one string.
+// Aggregate a session's write log and wait until it settles (no new write for
+// `settleMs` after at least one full typing duration has elapsed).
+async function collectTypedInput(writes, { settleMs = 120, timeoutMs = 6000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let lastCount = -1;
+  let lastChange = Date.now();
+  while (Date.now() < deadline) {
+    if (writes.length !== lastCount) {
+      lastCount = writes.length;
+      lastChange = Date.now();
+    } else if (writes.length > 0 && Date.now() - lastChange >= settleMs) {
+      break;
+    }
+    await new Promise(resolve => setTimeout(resolve, 40));
+  }
+  // The trailing \r lands ~800ms after the last body char (enter delay);
+  // tolerate callers asserting before it arrives by allowing a suffix-less
+  // match, and keep polling out of the returned string.
+  return writes.join('');
+}
+
+// Wait until the session's aggregated input ends with the submit \r (the
+// enter rides a delayed timer after the char-by-char body).
+async function awaitSubmitEnter(writes, { timeoutMs = 4000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (writes.length > 0 && writes[writes.length - 1] === '\r') return writes.join('');
+    await new Promise(resolve => setTimeout(resolve, 40));
+  }
+  return writes.join('');
+}
+
+function waitForWakeups(root, timerNodeId, sessionId, count, { timeout = 6000, step = 50 } = {}) {
+  return new Promise((resolve, reject) => {
+    const deadline = Date.now() + timeout;
+    const poll = () => {
+      const entries = wakeupEntries(root, timerNodeId, sessionId);
+      if (entries.length >= count) return resolve(entries);
+      if (Date.now() >= deadline) return reject(new Error(`waitForWakeups timed out; got ${entries.length}/${count}`));
+      setTimeout(poll, step);
+    };
+    poll();
+  });
+}
+
+after(() => {
+  stopTimerScheduler();
+});
+
+describe('T3/AC-024 full cooperation flow (F19/D17)', () => {
+  it('create -> find -> auto-connect -> structured request -> aggregated replies -> wakeup with goalNodeId -> goal complete', async () => {
+    const root = seedRoot();
+    const writes = { ceo: [], fe: [], qa: [] };
+    try {
+      // (1) Main + sub agent sessions with role profiles (test registry).
+      seedAgent(root, { nodeId: 'agent-ceo', sessionId: 'session-ceo', roleTitle: 'ceo', displayName: 'CEO', agentKind: 'main', capabilities: ['terminal-control'] });
+      seedAgent(root, { nodeId: 'agent-fe', sessionId: 'session-fe', roleTitle: 'implementer', displayName: 'Frontend Expert', capabilities: ['ui-control-plane'] });
+      seedAgent(root, { nodeId: 'agent-qa', sessionId: 'session-qa', roleTitle: 'reviewer', displayName: 'QA Reviewer', capabilities: ['playwright'] });
+      registerPtyProcess('session-ceo', { write: data => writes.ceo.push(String(data)) });
+      registerPtyProcess('session-fe', { write: data => writes.fe.push(String(data)) });
+      registerPtyProcess('session-qa', { write: data => writes.qa.push(String(data)) });
+
+      // (2) findAgents by role -> exactly one match.
+      const found = await findAgents(root, { role: 'implementer' });
+      assert.equal(found.count, 1, 'role=implementer must match exactly one agent');
+      assert.equal(found.matches[0].nodeId, 'agent-fe');
+      assert.equal(found.matches[0].connected, false, 'fresh agent starts unconnected');
+
+      // (3) auto-connect -> delegation edge exists (bidirectional).
+      const auto = autoConnectAgent(root, 'agent-ceo', 'agent-fe');
+      assert.equal(auto.ok, true);
+      const graphAfterConnect = loadWorkflowGraphMap(root);
+      const edgeExists = (graphAfterConnect.edges || []).some(edge =>
+        (edge.from === 'agent-ceo' && edge.to === 'agent-fe') || (edge.from === 'agent-fe' && edge.to === 'agent-ceo'));
+      assert.equal(edgeExists, true, 'auto-connect must create the delegation edge');
+      autoConnectAgent(root, 'agent-ceo', 'agent-qa');
+
+      // (4) structured request -> target message queue has the envelope AND the
+      // PTY input is composed with the [harness-request ...] prefix.
+      const sent = await executeNodeAction(root, 'agent-ceo', 'agent.sendMessage', {
+        to: 'agent-fe',
+        text: 'REVIEW_UI_FLOW',
+        requestId: 'req-t3-0001',
+        toRole: 'implementer',
+        contextRefs: [{ nodeId: 'markdown-ctx-1', relation: 'shared-context' }],
+      });
+      assert.equal(sent.ok, true);
+      assert.equal(sent.result.requestId, 'req-t3-0001');
+      const feInput = await awaitSubmitEnter(writes.fe, { timeoutMs: 4000 })
+        || await collectTypedInput(writes.fe);
+      assert.match(feInput, /^\[harness-request req-t3-0001 to-role=implementer contextRefs=markdown-ctx-1\] REVIEW_UI_FLOW\r$/);
+      const queued = listBridgeMessages(root, { fromSessionId: 'session-ceo', toSessionId: 'session-fe' }).entries;
+      assert.equal(queued.length, 1);
+      assert.equal(queued[0].requestId, 'req-t3-0001');
+      assert.equal(queued[0].deliveryMode, 'direct');
+      assert.equal(queued[0].data.replace(/\r$/, ''), 'REVIEW_UI_FLOW');
+
+      // (5) replies echo the requestId; readMessages aggregates by requestId.
+      const replyFe = await executeNodeAction(root, 'agent-fe', 'agent.sendMessage', {
+        to: 'agent-ceo',
+        text: 'EVIDENCE_FE',
+        requestId: 'req-t3-0001',
+      });
+      assert.equal(replyFe.ok, true);
+      const replyQa = await executeNodeAction(root, 'agent-qa', 'agent.sendMessage', {
+        to: 'agent-ceo',
+        text: 'EVIDENCE_QA',
+        requestId: 'req-t3-0001',
+      });
+      assert.equal(replyQa.ok, true);
+      const aggregated = await executeNodeAction(root, 'agent-ceo', 'agent.readMessages', { requestId: 'req-t3-0001' });
+      assert.equal(aggregated.ok, true);
+      assert.equal(aggregated.result.entries.length, 3, 'request + 2 replies must aggregate under the requestId');
+      const texts = aggregated.result.entries.map(entry => entry.data.replace(/\r$/, '')).sort();
+      assert.deepEqual(texts, ['EVIDENCE_FE', 'EVIDENCE_QA', 'REVIEW_UI_FLOW']);
+
+      // (6) timer with maxIterations=1 + group goal -> scheduler tick dispatches
+      // a wakeup whose envelope carries the goalNodeId.
+      const goalNodeId = seedActiveTask(root, 'task-team-flow');
+      const timer = await createEventNode(root, {
+        type: 'timer',
+        title: 'T3 Wakeup Timer',
+        enabled: true,
+        schedule: { mode: 'interval', intervalSeconds: 1 },
+        heartbeat: { base: { enabled: true, intervalSeconds: 1, nextDueAt: new Date(Date.now() - 2000).toISOString() } },
+        loop: { enabled: true, maxIterations: 1 },
+      });
+      const timerNodeId = timer.node.nodeId;
+      writeWorkflowGraphMap(root, {
+        ...loadWorkflowGraphMap(root),
+        version: loadWorkflowGraphMap(root).version + 1,
+        edges: [
+          ...(loadWorkflowGraphMap(root).edges || []),
+          { id: `agent-ceo->${goalNodeId}`, from: 'agent-ceo', to: goalNodeId, relation: 'goal', direction: 'bidirectional' },
+        ],
+        capsuleDockLinks: [
+          dockLink(goalNodeId, timerNodeId),
+          dockLink(timerNodeId, 'agent-ceo'),
+        ],
+      });
+
+      syncTimerScheduler(root, { intervalMs: 20 });
+      assert.equal(isTimerSchedulerActive(), true);
+      const wakeups = await waitForWakeups(root, timerNodeId, 'session-ceo', 1);
+      const envelope = JSON.parse(wakeups[0].data);
+      assert.equal(envelope.type, 'wakeup');
+      assert.equal(envelope.timerNodeId, timerNodeId);
+      assert.equal(envelope.goalNodeId, goalNodeId, 'wakeup must reference the group Goal node');
+      const timerAfter = getEventNode(root, timerNodeId);
+      assert.equal(timerAfter.state.loop.enabled, false, 'maxIterations=1 must complete the loop after one fire');
+      stopTimerScheduler();
+
+      // (7) goal.add -> goal.check all -> goal.complete -> proposed-complete.
+      const added = await executeNodeAction(root, goalNodeId, 'goal.add', {
+        planItems: [{ text: 'Review UI flow' }, { text: 'Fix findings' }],
+      });
+      assert.equal(added.ok, true);
+      const planItemIds = added.result.state.planItems.map(item => item.id);
+      assert.equal(planItemIds.length, 2);
+      assert.ok(planItemIds.every(id => /^P-\d{3}$/.test(id)));
+
+      const checked = await executeNodeAction(root, goalNodeId, 'goal.check', {
+        planItemIds,
+        actorNodeId: 'agent-ceo',
+      });
+      assert.equal(checked.ok, true);
+      assert.ok(checked.result.state.planItems.every(item => item.status === 'done'));
+
+      const completed = await executeNodeAction(root, goalNodeId, 'goal.complete', {
+        actorNodeId: 'agent-ceo',
+        evidenceRefs: ['wf-team-flow'],
+      });
+      assert.equal(completed.ok, true);
+      assert.equal(completed.result.state.status, 'proposed-complete');
+      assert.equal(completed.result.state.confirmation.state, 'proposed');
+    } finally {
+      stopTimerScheduler();
+      unregisterPtyProcess('session-ceo');
+      unregisterPtyProcess('session-fe');
+      unregisterPtyProcess('session-qa');
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/src/wf-ui-server/__tests__/workflow-terminal-control-live.test.mjs

@@ -0,0 +1,294 @@
+// workflow-terminal-control-live.test.mjs
+//
+// AC-CTRL-005 real-terminal probe (OPT-IN).
+//
+// These tests spawn a REAL codex process through the backend control plane and
+// assert that an injected prompt triggers a real AI turn. Each run spends a
+// real codex API call and can take minutes, so the whole suite is SKIPPED by
+// default.
+//
+// Enable with:
+//   HARNESS_LIVE_TERMINAL_PROBE=1 node --test src/wf-ui-server/__tests__/workflow-terminal-control-live.test.mjs
+//
+//   L1 - Enter-free trigger (AC-CTRL-002/005): spawn codex with initialPrompt
+//        as argv; the codex TUI auto-submits it — zero keyboard injection.
+//   L2 - single-\r submit (AC-CTRL-001/005): spawn codex without a prompt,
+//        wait for the prompt marker (›/❯), send input with submit:true (body +
+//        exactly one \r) and assert a real AI turn starts.
+//
+// Evidence rule: assertions match terminal-store STDOUT entries ONLY. The
+// control plane records injected input as stdin entries, which must never
+// satisfy an assertion (previous false positive: L2 matched the text the test
+// itself sent). Output growth is likewise not evidence — TUI boot repaints
+// were a previous false positive for L1. The expected token must also NOT be
+// a substring of the prompt: the codex TUI repaints the typed/argv prompt
+// into STDOUT (input-line render + queued-input banner), so substring tokens
+// like the old probe-ok / probe-ok2 matched the echo before any AI turn.
+// The current tokens (42 / 22) are arithmetic answers that can only come from
+// a real AI reply. Sessions are kept alive for a fixed observation window
+// after the trigger (a real AI turn takes ~30-90s) and only early-exit when
+// the expected reply text renders in STDOUT.
+//
+// Evidence: the full terminal transcript is written to
+// `Harness/.temp/live-terminal-probe-<timestamp>/` and the path is printed.
+//
+// Note: the deterministic byte-sequence / gating matrix lives in
+// workflow-terminal-control.test.mjs; this file only adds real-process proof.
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { startServer, stopServer } from '../server.mjs';
+import { SessionRegistry } from '../session-registry.mjs';
+
+const LIVE = process.env.HARNESS_LIVE_TERMINAL_PROBE === '1';
+
+// The marker the codex TUI prints when it is ready for input (› or ❯).
+const PROMPT_MARKER_RE = /[›❯]/;
+
+// Observation windows. A real codex AI turn takes ~30-90s, so the probe never
+// stops on mere output growth; it keeps the session alive a fixed window after
+// the trigger (spawn for L1, input write for L2) and only early-exits when the
+// expected reply text actually renders in STDOUT.
+const BOOT_WAIT_MS = 45000;        // max wait for TUI boot / prompt marker
+const OBSERVE_WINDOW_MS = 100000;  // fixed observation window after trigger
+// Per-test timeouts bound the whole suite: worst case L1 + L2 ≈ 5 min.
+const L1_TIMEOUT_MS = 150000;
+const L2_TIMEOUT_MS = 150000;
+
+function jsonRequest(baseUrl, route, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(route, baseUrl);
+    const payload = body ? JSON.stringify(body) : null;
+    const req = http.request({
+      hostname: url.hostname,
+      port: url.port,
+      path: `${url.pathname}${url.search}`,
+      method,
+      headers: payload ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) } : {},
+    }, (res) => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(data) }); }
+        catch { resolve({ status: res.statusCode, body: data }); }
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+describe('Live terminal probe (AC-CTRL-005)', { skip: !LIVE }, () => {
+  let root;
+  let server;
+  let baseUrl;
+  let registry;
+  const spawnedSessions = [];
+
+  before(async () => {
+    root = makeHarnessTempRoot('live-terminal-probe-');
+    registry = new SessionRegistry();
+    const started = await startServer({
+      projectRoot: root,
+      host: '127.0.0.1',
+      port: 0,
+      sessionRegistry: registry,
+      eventsWs: false,
+    });
+    server = started.server;
+    baseUrl = `http://127.0.0.1:${started.port}`;
+    console.log(`[live-probe] backend on ${baseUrl}, evidence root ${root}`);
+  });
+
+  after(async () => {
+    for (const sessionId of spawnedSessions) {
+      try {
+        await jsonRequest(baseUrl, `/api/sessions/${sessionId}/stop`, { method: 'POST', body: {} });
+      } catch { /* already gone */ }
+    }
+    if (server) {
+      await stopServer(server);
+      server = null;
+    }
+    // Hard-exit fallback: the backend server / PTY handles must not keep the
+    // runner alive forever (observed hang: process killed at 600s). unref()
+    // keeps this timer from blocking a natural exit, and the runner's exit
+    // code is preserved so a failed probe still fails the run.
+    const exitTimer = setTimeout(() => process.exit(process.exitCode || 0), 5000);
+    exitTimer.unref();
+    // The temp root is intentionally kept: it holds the probe transcripts.
+  });
+
+  // ── helpers ──
+
+  // ANSI control-sequence stripper — same pattern as the production
+  // codex-update-prompt.mjs stripTerminalControls (CSI `\x1b[...[@-~]`, OSC
+  // `\x1b]...\x07`/`\x1b]...\x1b\`, and \r→\n), kept local so the probe stays
+  // self-contained. Raw PTY bytes otherwise carry escape sequences whose
+  // parameters can satisfy a substring match (e.g. "42" inside the cursor
+  // position `\x1b[20;42H`, "22" inside the SGR `\x1b[22m`), which is a
+  // false-positive source for the reply-token match.
+  const ANSI_PATTERN = /\x1b(?:\][^\x07]*(?:\x07|\x1b\\)|\[[0-?]*[ -/]*[@-~])/g;
+  function stripAnsi(value) {
+    return String(value || '')
+      .replace(ANSI_PATTERN, '')
+      .replace(/\r/g, '\n');
+  }
+
+  async function createCodexSession(extra = {}) {
+    const res = await jsonRequest(baseUrl, '/api/sessions', {
+      method: 'POST',
+      body: {
+        runtime: 'codex',
+        agentKind: 'main',
+        role: 'Main Agent',
+        objective: 'Live terminal probe',
+        attachGraphNode: true,
+        ...extra,
+      },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    spawnedSessions.push(res.body.sessionId);
+    if (res.body.status === 'blocked') {
+      return { running: false, reason: res.body.blockedReason || res.body.blockedHint || 'blocked' };
+    }
+    return { running: true, sessionId: res.body.sessionId };
+  }
+
+  async function readOutput(sessionId) {
+    const res = await jsonRequest(baseUrl, `/api/terminals/${sessionId}/range?tail=4000`);
+    return res.body && Array.isArray(res.body.entries) ? res.body : { entries: [] };
+  }
+
+  // Real rendered evidence: STDOUT entries only. Terminal-store entries carry
+  // a `stream` field; the test's own injected text is recorded as `stdin` and
+  // never counts as a reply (L2 false positive: matched its own input echo).
+  // ANSI escapes are stripped BEFORE matching — raw bytes contain sequences
+  // (cursor positioning, SGR) whose parameters hold the expected token.
+  function stdoutText(range) {
+    return stripAnsi(
+      (range.entries || [])
+        .filter(entry => String(entry.stream || 'stdout') === 'stdout')
+        .map(entry => String(entry.data || ''))
+        .join(''),
+    );
+  }
+
+  // Full transcript text (stdout + stdin) for the evidence file.
+  function fullText(range) {
+    return (range.entries || []).map(entry => String(entry.data || '')).join('');
+  }
+
+  // Observe a fixed window starting at fromMs. Early-exit ONLY when the
+  // expected reply text renders in STDOUT; output growth is never evidence.
+  // Returns null when the window elapses without the reply.
+  // The match runs on ANSI-stripped text and additionally requires the token
+  // NOT to be part of a longer digit run: `(^|\D)<token>(\D|$)`.
+  async function waitForReplyText(sessionId, { expectText, fromMs, windowMs }) {
+    const deadline = fromMs + windowMs;
+    const expectedRe = new RegExp(`(^|\\D)${expectText}(\\D|$)`);
+    let last = null;
+    while (Date.now() < deadline) {
+      last = await readOutput(sessionId);
+      if (expectedRe.test(stdoutText(last))) {
+        return { evidence: `expected-text:${expectText}`, range: last };
+      }
+      await new Promise(resolve => setTimeout(resolve, 2000));
+    }
+    return null;
+  }
+
+  async function saveTranscript(sessionId, range) {
+    const dir = path.join(root, 'transcripts');
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `${sessionId}.txt`);
+    const entries = range.entries || [];
+    const stdoutCount = entries.filter(entry => String(entry.stream || 'stdout') === 'stdout').length;
+    const stdinCount = entries.length - stdoutCount;
+    fs.writeFileSync(
+      file,
+      `session: ${sessionId}\nentries: ${entries.length} (stdout: ${stdoutCount}, stdin: ${stdinCount})\n\n${fullText(range)}`,
+      'utf8',
+    );
+    console.log(`[live-probe] transcript: ${file}`);
+    return file;
+  }
+
+  // ── L1: Enter-free trigger (AC-CTRL-002/005) ──
+  it('L1 - argv initialPrompt auto-submits in a real codex TUI (Enter-free)', async (t) => {
+    const spawnTime = Date.now();
+    const session = await createCodexSession({
+      initialPrompt: 'What is 21 times 2? Reply with the number only, nothing else.',
+    });
+    if (!session.running) {
+      t.skip(`codex not launchable: ${session.reason}`);
+      return;
+    }
+    // Wait for the TUI to boot (any STDOUT output), then observe a fixed
+    // window after spawn: the AI reply renders the number 42 in STDOUT.
+    // No output-growth shortcut — boot repaints are not AI-turn evidence.
+    const bootDeadline = spawnTime + BOOT_WAIT_MS;
+    let booted = null;
+    while (Date.now() < bootDeadline) {
+      booted = await readOutput(session.sessionId);
+      if (stdoutText(booted).length > 0) break;
+      await new Promise(resolve => setTimeout(resolve, 2000));
+    }
+    if (!booted || stdoutText(booted).length === 0) {
+      t.skip('codex TUI produced no output (spawn may be blocked)');
+      return;
+    }
+    const evidence = await waitForReplyText(session.sessionId, {
+      expectText: '42',
+      fromMs: spawnTime,
+      windowMs: OBSERVE_WINDOW_MS,
+    });
+    await saveTranscript(session.sessionId, evidence ? evidence.range : await readOutput(session.sessionId));
+    assert.ok(evidence, `no AI reply rendered in STDOUT within ${OBSERVE_WINDOW_MS}ms of spawn (evidence=${evidence?.evidence || 'none'})`);
+    console.log(`[live-probe] L1 evidence: ${evidence.evidence}`);
+  }, { timeout: L1_TIMEOUT_MS });
+
+  // ── L2: single-\r submit (AC-CTRL-001/005) ──
+  it('L2 - submit:true (single \\r) triggers a real AI turn in a real codex TUI', async (t) => {
+    const session = await createCodexSession({});
+    if (!session.running) {
+      t.skip(`codex not launchable: ${session.reason}`);
+      return;
+    }
+    // Wait for the TUI prompt marker so the ready gate has something to see.
+    const markerDeadline = Date.now() + BOOT_WAIT_MS;
+    let markerSeen = false;
+    while (Date.now() < markerDeadline) {
+      const booted = await readOutput(session.sessionId);
+      if (PROMPT_MARKER_RE.test(stdoutText(booted))) {
+        markerSeen = true;
+        break;
+      }
+      await new Promise(resolve => setTimeout(resolve, 2000));
+    }
+    if (!markerSeen) {
+      t.skip('codex TUI prompt marker never appeared');
+      return;
+    }
+    const sent = await jsonRequest(baseUrl, `/api/sessions/${session.sessionId}/input`, {
+      method: 'POST',
+      body: { data: 'What is 17 plus 5? Reply with the number only, nothing else.', submit: true },
+    });
+    assert.equal(sent.status, 200, JSON.stringify(sent.body));
+    // Fixed observation window starting at the input write. Only a STDOUT
+    // render of the number 22 counts; the stdin record of the injected text
+    // does not (see stdoutText).
+    const evidence = await waitForReplyText(session.sessionId, {
+      expectText: '22',
+      fromMs: Date.now(),
+      windowMs: OBSERVE_WINDOW_MS,
+    });
+    await saveTranscript(session.sessionId, evidence ? evidence.range : await readOutput(session.sessionId));
+    assert.ok(evidence, `no AI reply rendered in STDOUT within ${OBSERVE_WINDOW_MS}ms of submit (evidence=${evidence?.evidence || 'none'})`);
+    console.log(`[live-probe] L2 evidence: ${evidence.evidence}`);
+  }, { timeout: L2_TIMEOUT_MS });
+});