create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/owner-action-manifest-data.json

@@ -185,6 +185,13 @@
       "human",
       false
     ],
+    [
+      "DELETE",
+      "/api/sessions/:p1/image-drafts",
+      "respond",
+      "human",
+      false
+    ],
     [
       "DELETE",
       "/api/sessions/:p1/image-drafts/:p2",
@@ -3280,6 +3287,13 @@
       "human",
       false
     ],
+    [
+      "POST",
+      "/api/providers/:p1/login/code",
+      "admin",
+      "human",
+      false
+    ],
     [
       "POST",
       "/api/queues",

package/template/coding-task-manager/lib/painted-row-recorder.js

@@ -900,9 +900,17 @@ function createPaintedRowRecorder(options) {
   // The floor never exceeds top: after a move back down (or rows revealed above the stretch start) nothing below top is servable.
   // R-F2: `below` = how many rows the app holds BELOW its screen, measured at the screen BOTTOM (`bot`) so a pin change cannot move it.
   // `top` is the first content row, so it moves when the pin count changes; the screen's bottom edge does not.
+  // Clock-free tests (D-2/D-4, WP-6): `samples` (the same monotone count as `stats().samples`, +1 on EVERY observe at the top of
+  // observeSample -- a sample that changes nothing counts too) and `hold` ride this object, so they travel wherever the recorder's
+  // state travels (the frame's `painted` field, mirror-status). `hold` describes the samples the recorder has REJECTED and not
+  // committed -- the same fact as the `held` flag beside it (non-null exactly when `held` is true: the samples since the last
+  // adopted screen, cleared by an adoption and by the seal that opens the next stretch). `kind` is the last rejection's kind
+  // ('ambiguous' | 'inPlace'), `rows` how many samples are outstanding, `top` the index they would have been adopted at. A reader
+  // can then wait on "this write has been sampled" (and on the hold it produced) instead of sleeping a window.
   function state() {
     const f = docFloor();
-    return { epoch, top, pinned, floor: f, recorded: top - f, held: holds > 0, revision: revisionSeq, revisedFrom, breaks: breaks.map((b) => ({ at: b.at, reason: b.reason })), below: botMax === null ? 0 : Math.max(0, botMax - bot) }; // R-F2: rows below the screen bottom edge (0 at rest, after a seal or a jump)
+    const heldLast = holds > 0 && held.length ? held[held.length - 1] : null;
+    return { epoch, top, pinned, floor: f, recorded: top - f, held: holds > 0, hold: heldLast ? { kind: heldLast.kind || null, rows: held.length, top } : null, samples: stats.samples, revision: revisionSeq, revisedFrom, breaks: breaks.map((b) => ({ at: b.at, reason: b.reason })), below: botMax === null ? 0 : Math.max(0, botMax - bot) }; // R-F2: rows below the screen bottom edge (0 at rest, after a seal or a jump)
   }
 
   // The lowest index revised by an observe after revision `seq`; null when none. When the bounded event list no longer reaches back to

package/template/coding-task-manager/lib/prompt-submission-contract.js

@@ -22,12 +22,27 @@ const SUBMISSION_SOURCES = new Set([
   'skill',
   'unknown',
 ]);
+// WP-0 (queue-delivery-recovery): the closed vocabulary of recovery actions a
+// client may offer next to a status frame. It is additive to the historical
+// `retryable` boolean, which stays exactly as it was (including its legacy
+// `retryable: true` => `retry` meaning).
+const RECOVERY_ACTIONS = new Set(['retry', 'resend', 'review', 'none']);
 
 function normalizeSubmissionSource(source) {
   const clean = String(source || '').trim().toLowerCase();
   return SUBMISSION_SOURCES.has(clean) ? clean : 'unknown';
 }
 
+// Missing or unrecognized -> 'none' ("nothing for you to do"), except the
+// historical `retryable: true` verdict, which has always meant "resending the
+// same text can succeed once the condition clears" -> 'retry'. A value is never
+// invented from a code or a message string.
+function normalizeRecoveryAction(value, retryable) {
+  const clean = typeof value === 'string' ? value.trim().toLowerCase() : '';
+  if (RECOVERY_ACTIONS.has(clean)) return clean;
+  return retryable === true ? 'retry' : 'none';
+}
+
 function publicSubmissionStatus(remoteStatus, result = {}) {
   const knownStatus = Object.prototype.hasOwnProperty.call(TERMINAL_STATUS_MAP, String(remoteStatus || ''));
   const mapped = knownStatus ? TERMINAL_STATUS_MAP[String(remoteStatus || '')] : { status: 'needs_attention' };
@@ -37,12 +52,16 @@ function publicSubmissionStatus(remoteStatus, result = {}) {
     reason: String(result.reason || (knownStatus ? '' : 'unknown_status')),
     message: String(result.message || ''),
     source: String(result.source || ''),
-    // Whether re-sending the SAME text can succeed once the condition clears
+    // Whether retrying the SAME admitted request can succeed once the condition clears
     // (agent busy, another prompt in flight, session still restoring) versus
     // needing the user to act first (answer an approval, revive the session).
     // Carried here so EVERY status frame agrees — the direct WS reply and the
     // broadcast both reach the client and the later one overwrites the record.
     retryable: result.retryable === true,
+    // Additive recovery verdict, same reasoning as `retryable`: the direct reply,
+    // the broadcast, the persisted result and the stored projection all run
+    // through this one function so they cannot disagree.
+    recoveryAction: normalizeRecoveryAction(result.recoveryAction, result.retryable === true),
   };
 }
 
@@ -151,6 +170,7 @@ module.exports = {
   createSubmissionCounters,
   executeTerminalWriteSequence,
   isConfirmedSubmissionRecord,
+  normalizeRecoveryAction,
   normalizeSubmissionSource,
   publicSubmissionStatus,
   runtimeResultForSubmissionStatus,

package/template/coding-task-manager/lib/provider-login-broker.js

@@ -4,6 +4,8 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 
+const { createLoginCapture, isLoopbackUrl, loopbackPortOf } = require('./provider-login-capture');
+
 const {
   browserShimPath,
   loginTabSpec,
@@ -46,6 +48,45 @@ const DEFAULT_PROVIDERS = Object.freeze({
   },
 });
 
+// WP-1 (design §6, D-6): the ONE accepted shape of a returned sign-in code —
+// `<code>#<state>`, both halves drawn from the vendor's own URL-safe alphabet. The
+// code half is capped at 512 chars and the state half at 256 so a hostile body cannot
+// smuggle a multi-kilobyte line into the tab's stdin.
+const LOGIN_CODE_RE = /^([A-Za-z0-9._~-]{8,512})#([A-Za-z0-9._~-]{8,256})$/;
+// The whole input is bounded before anything else runs: the route reads at most 16 KiB,
+// and no legitimate paste (a bare code or a full callback URL with scopes) approaches this.
+const LOGIN_CODE_MAX_CHARS = 4096;
+
+// D-6 input normalisation, pure and exported for the unit table (AC-1a/AC-1b).
+//   Shape A  `<code>#<state>`                            -> { code, state }
+//   Shape B  an http(s) URL whose query has `code`/`state` -> { code, state }
+// A loopback callback URL is its OWN refusal: its code was issued for the automatic
+// `http://localhost:<port>/callback` redirect, while a pasted code is always exchanged
+// with the manual redirect — the CLI would answer "Invalid code" for a code the card
+// could have refused up front (§5 D-5).
+function normalizeLoginCode(raw) {
+  const text = String(raw == null ? '' : raw).trim();
+  if (!text || text.length > LOGIN_CODE_MAX_CHARS) return { error: 'code_format_invalid' };
+  const direct = LOGIN_CODE_RE.exec(text);
+  if (direct) return { code: direct[1], state: direct[2] };
+  let parsed = null;
+  try {
+    parsed = new URL(text);
+  } catch {
+    /* expected: the trimmed string is neither a `code#state` pair nor a URL */
+  }
+  if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {
+    return { error: 'code_format_invalid' };
+  }
+  const code = parsed.searchParams.get('code') || '';
+  const state = parsed.searchParams.get('state') || '';
+  if (!code || !state) return { error: 'code_format_invalid' };
+  if (isLoopbackUrl(text)) return { error: 'code_from_loopback_redirect' };
+  const split = LOGIN_CODE_RE.exec(`${code}#${state}`);
+  if (split) return { code: split[1], state: split[2] };
+  return { error: 'code_format_invalid' };
+}
+
 function _nowIso() {
   return new Date().toISOString();
 }
@@ -105,7 +146,13 @@ class ProviderLoginBroker {
     // cache invalidation (lib/coding-agent-auth.invalidate).
     this.resolveCli = options.resolveCli || null;
     this.invalidateAccount = options.invalidateAccount || null;
+    // WP-1 (D-4): the ONE PTY write primitive a returned sign-in code travels through —
+    // server.js wires `(session, data) => _writeLifecyclePty(session, data, 'provider-login-code')`.
+    // Null in a pure unit context, where submitCode then answers 503 rather than writing.
+    this.writeToLoginTab = options.writeToLoginTab || null;
     this.subscriptions = new Map();
+    // WP-0: one output capture subscriber per open flow, keyed by sessionId, disposed on exit.
+    this.captures = new Map();
   }
 
   // One probeAll for the whole state read (the lib caches per agent for CACHE_MS).
@@ -140,9 +187,12 @@ class ProviderLoginBroker {
   _provider(id) {
     const provider = DEFAULT_PROVIDERS[String(id || '').trim().toLowerCase()];
     if (!provider) return null;
+    // WP-0 test seam (D-10): CTM_PROVIDER_LOGIN_<ID>_CLI pins the exact CLI path the login
+    // shell `exec`s, so a fixture CLI never depends on the agent-cli-cache/PATH order.
+    const cliOverride = String(this.env[`CTM_PROVIDER_LOGIN_${provider.id.toUpperCase()}_CLI`] || '').trim();
     return {
       ...provider,
-      cli: this._resolveCli((provider.command || [])[0]),
+      cli: cliOverride || this._resolveCli((provider.command || [])[0]),
       credentialPath: this.env[`CTM_PROVIDER_LOGIN_${provider.id.toUpperCase()}_CREDENTIAL_PATH`] || provider.credentialPath,
     };
   }
@@ -198,19 +248,27 @@ class ProviderLoginBroker {
 
   _savedFlow(providerId, saved, browserUrl) {
     if (!saved.flow) {
-      return browserUrl ? {
+      // D-1: a loopback-only sink row (the CLI's automatic URL, which no remote browser can
+      // complete) must not fabricate an awaiting_user flow out of thin air.
+      const synthetic = browserUrl && !isLoopbackUrl(browserUrl.url) ? browserUrl : null;
+      return synthetic ? {
         id: `${providerId}-browser-url`,
         sessionId: '',
         status: 'awaiting_user',
-        verificationUrl: browserUrl.url,
+        verificationUrl: synthetic.url,
         userCode: '',
-        startedAt: browserUrl.at,
-        updatedAt: browserUrl.at,
+        state: '',
+        callbackPort: loopbackPortOf(synthetic.url),
+        codeEntry: '',
+        verificationUrlSource: '',
+        startedAt: synthetic.at,
+        updatedAt: synthetic.at,
         exitedAt: '',
         exitCode: null,
         signal: '',
         error: '',
         outputPreview: '',
+        codeSubmittedAt: '',
       } : null;
     }
     // The sink keeps the LAST URL per provider across flows, so a URL recorded before
@@ -218,12 +276,23 @@ class ProviderLoginBroker {
     // card would offer a dead "Open sign-in page" before the CLI printed anything.
     const startedAt = saved.flow.startedAt || '';
     const urlForThisFlow = browserUrl && (!startedAt || String(browserUrl.at || '') >= startedAt) ? browserUrl : null;
+    const sinkUrl = urlForThisFlow ? String(urlForThisFlow.url || '') : '';
+    // D-1: a loopback sink URL (own host or redirect_uri) never becomes the link — it is the
+    // port evidence the card explains the manual paste with. A non-loopback sink URL keeps
+    // today's back-fill behaviour for the case where the capture found nothing.
+    const loopbackSink = sinkUrl ? isLoopbackUrl(sinkUrl) : false;
     const flow = {
       id: saved.flow.id,
       sessionId: saved.flow.sessionId || '',
       status: saved.flow.status,
-      verificationUrl: saved.flow.verificationUrl || urlForThisFlow?.url || '',
+      verificationUrl: saved.flow.verificationUrl || (loopbackSink ? '' : sinkUrl),
       userCode: saved.flow.userCode || '',
+      state: saved.flow.state || '',
+      callbackPort: typeof saved.flow.callbackPort === 'number'
+        ? saved.flow.callbackPort
+        : (loopbackSink ? loopbackPortOf(sinkUrl) : null),
+      codeEntry: saved.flow.codeEntry || '',
+      verificationUrlSource: saved.flow.verificationUrlSource || '',
       startedAt,
       updatedAt: saved.flow.updatedAt || urlForThisFlow?.at || '',
       exitedAt: saved.flow.exitedAt || '',
@@ -231,10 +300,13 @@ class ProviderLoginBroker {
       signal: saved.flow.signal || '',
       error: saved.flow.error || '',
       outputPreview: _redact(saved.flow.outputPreview || '').slice(-1200),
+      // WP-1: WHEN the user handed the code back. A timestamp only — the code and its
+      // state are never persisted (§5 D-5).
+      codeSubmittedAt: saved.flow.codeSubmittedAt || '',
     };
-    // A URL in the sink is proof the CLI is waiting for the human — the tab tells
-    // the truth about the flow's status until its exit handler settles it.
-    if (flow.verificationUrl && OPEN_FLOW_STATUSES.includes(flow.status) && flow.status !== 'awaiting_user') {
+    // A captured link or a Codex code is proof the CLI is waiting for the human — the tab
+    // tells the truth about the flow's status until its exit handler settles it.
+    if ((flow.verificationUrl || flow.userCode) && OPEN_FLOW_STATUSES.includes(flow.status) && flow.status !== 'awaiting_user') {
       flow.status = 'awaiting_user';
     }
     return flow;
@@ -305,6 +377,11 @@ class ProviderLoginBroker {
       if (settled) return;
       settled = true;
       this.subscriptions.delete(sessionId);
+      const capture = this.captures.get(sessionId);
+      if (capture) {
+        if (typeof capture.dispose === 'function') capture.dispose();
+        this.captures.delete(sessionId);
+      }
       const next = this._readState();
       const current = next[provider.id]?.flow;
       // Superseded (a newer flow for this provider) or already final: nothing to say.
@@ -335,6 +412,50 @@ class ProviderLoginBroker {
     this._writeState(next);
   }
 
+  // WP-0 (D-2): the login tab's OWN output is where the CLI prints the link and the code.
+  // One subscriber per flow, seeded with the session's flushed tail (the CLI may have
+  // printed before createSession() resolved — §5 OQ-1), disposed by _watchLoginTab.settle.
+  _attachCapture(provider, session, flow) {
+    const host = session && (session.ptyProcess || session.pty);
+    if (!host || typeof host.onData !== 'function') return;
+    let subscription = null;
+    try {
+      const capture = createLoginCapture({
+        providerId: provider.id,
+        seed: String(session._textTail || ''),
+        onUpdate: (fields) => this._recordCaptured(provider, flow.sessionId, fields),
+      });
+      subscription = host.onData((data) => capture.feed(data));
+    } catch {
+      /* expected: a host that refuses a data subscriber — the flow still settles on exit */
+      return;
+    }
+    this.captures.set(flow.sessionId, subscription);
+  }
+
+  // Merges what the capture froze into the persisted flow. A flow that is gone, superseded
+  // or already final is left alone: capture is evidence, never a state resurrection.
+  _recordCaptured(provider, sessionId, fields) {
+    const state = this._readState();
+    const current = state[provider.id]?.flow;
+    if (!current || current.sessionId !== sessionId) return;
+    if (current.status === 'completed' || current.status === 'failed') return;
+    const next = { ...current };
+    if (fields.verificationUrl && !isLoopbackUrl(fields.verificationUrl)) {
+      next.verificationUrl = fields.verificationUrl;
+      next.verificationUrlSource = 'cli-print';
+    }
+    if (fields.state) next.state = fields.state;
+    if (fields.userCode) next.userCode = fields.userCode;
+    if (typeof fields.callbackPort === 'number') next.callbackPort = fields.callbackPort;
+    if (fields.codeEntry) next.codeEntry = fields.codeEntry;
+    if ((next.status === 'starting' || next.status === 'running') && (next.verificationUrl || next.userCode)) {
+      next.status = 'awaiting_user';
+    }
+    next.updatedAt = _nowIso();
+    this._writeFlow(provider, next);
+  }
+
   // POST /api/providers/:id/login — opens the provider's login tab.
   async start(id, opts = {}) {
     const provider = this._provider(id);
@@ -369,6 +490,10 @@ class ProviderLoginBroker {
       status: 'starting',
       verificationUrl: '',
       userCode: '',
+      state: '',
+      callbackPort: null,
+      codeEntry: '',
+      verificationUrlSource: '',
       startedAt,
       updatedAt: startedAt,
       exitedAt: '',
@@ -376,6 +501,7 @@ class ProviderLoginBroker {
       signal: '',
       error: '',
       outputPreview: '',
+      codeSubmittedAt: '',
     };
     this._writeFlow(provider, flow);
 
@@ -407,8 +533,64 @@ class ProviderLoginBroker {
     const running = { ...flow, status: 'running', updatedAt: _nowIso() };
     this._writeFlow(provider, running);
     this._watchLoginTab(provider, session, sessionId);
+    this._attachCapture(provider, session, running);
     return { ok: true, provider: provider.id, sessionId, flow: running };
   }
+
+  // POST /api/providers/:id/login/code — hands a code the user pasted on the card back to
+  // the flow's OWN login tab (§5 D-4/D-5). Every refusal is checked BEFORE the write, and the
+  // write itself happens EXACTLY ONCE, here: `<code>#<state>\r` through the injected
+  // `writeToLoginTab` (server.js binds it to `_writeLifecyclePty(session, data,
+  // 'provider-login-code')`, so the user-recency clocks stay untouched). No keystroke replay, no
+  // retry, no write to any other session, and the code/state never enter a response, a log line
+  // or the flow record.
+  async submitCode(id, { code } = {}) {
+    const provider = this._provider(id);
+    if (!provider) return { ok: false, status: 404, error: 'provider_not_found' };
+    const saved = this._readState()[provider.id] || {};
+    const flow = saved.flow || null;
+    if (!flow || !OPEN_FLOW_STATUSES.includes(flow.status)) {
+      return { ok: false, status: 409, error: 'provider_login_not_open', provider: provider.id };
+    }
+    const session = this.getSession(flow.sessionId);
+    if (!loginTabAlive(session)) {
+      return { ok: false, status: 409, error: 'login_tab_gone', provider: provider.id, sessionId: flow.sessionId };
+    }
+    // D-3: only a provider whose code travels browser -> card -> tab can accept one. Codex
+    // ('browser') and a not-yet-captured flow ('') are refused with their own answer.
+    if (flow.codeEntry !== 'paste') {
+      return {
+        ok: false,
+        status: 409,
+        error: 'code_entry_not_supported',
+        provider: provider.id,
+        codeEntry: flow.codeEntry || '',
+      };
+    }
+    const normalized = normalizeLoginCode(code);
+    if (normalized.error) return { ok: false, status: 400, error: normalized.error };
+    if (flow.state && normalized.state !== flow.state) {
+      return { ok: false, status: 400, error: 'code_state_mismatch' };
+    }
+    if (!this.writeToLoginTab) {
+      return { ok: false, status: 503, error: 'provider_login_unavailable', provider: provider.id };
+    }
+    const written = this.writeToLoginTab(session, `${normalized.code}#${normalized.state}\r`);
+    if (!written || written.posted === false) {
+      return { ok: false, status: 409, error: 'login_tab_gone', provider: provider.id, sessionId: flow.sessionId };
+    }
+    const next = { ...flow };
+    next.updatedAt = _nowIso();
+    next.codeSubmittedAt = next.updatedAt;
+    this._writeFlow(provider, next);
+    return {
+      ok: true,
+      status: 200,
+      provider: provider.id,
+      sessionId: flow.sessionId,
+      flow: this._savedFlow(provider.id, { flow: next }, null),
+    };
+  }
 }
 
 module.exports = {
@@ -416,5 +598,6 @@ module.exports = {
   DEFAULT_PROVIDERS,
   OPEN_FLOW_STATUSES,
   browserShimPath,
+  normalizeLoginCode,
   _deriveStatus,
 };

package/template/coding-task-manager/lib/provider-login-capture.js

@@ -0,0 +1,153 @@
+'use strict';
+
+// WP-0 (design docs/remote-agent-sign-in-from-hub-browser-2026-10-25.html §5 D-1/D-2/D-3,
+// §6, §9 S-1): what a provider sign-in CLI PRINTS on its own PTY is the truth for the
+// card's link and code. `claude auth login` prints its manual authorize URL (the automatic
+// one carries a loopback `redirect_uri` and is useless to a remote browser); `codex login
+// --device-auth` prints a device URL plus a one-time code and never calls a browser.
+//
+// Pure by contract: no fs, no timers, no process.env -- the rolling window is the only
+// state, so a URL split across PTY chunks still matches once both halves are in it.
+//
+// A loopback URL (`localhost` / `127.0.0.1` / `::1`, as the URL's own host or as its
+// `redirect_uri` host) is NEVER a verification URL (D-1); it contributes the callback port
+// only, which the card uses to explain why the automatic link cannot sign a remote user in.
+
+const { stripAnsi } = require('./login-tripwire');
+
+const CAPTURE_WINDOW_CHARS = 8192;
+const AUTHORIZE_URL_RE = /https:\/\/[^\s"'<>]+\/oauth\/authorize\?[^\s"'<>]+/g; // host-agnostic on purpose
+const DEVICE_URL_RE = /https:\/\/[^\s"'<>]+\/codex\/device\b[^\s"'<>]*/;
+// The code must be followed by whitespace (Codex prints a newline after it): a PTY chunk that
+// ends inside the code (`A12B-C`) must not yield its first group as a complete code.
+const DEVICE_CODE_LINE_RE = /Enter this one-time code[^\n]*\n\s*([A-Z0-9]{4,}(?:-[A-Z0-9]{4,})*)(?=\s)/;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+const CAPTURE_FIELDS = Object.freeze(['verificationUrl', 'state', 'userCode', 'callbackPort', 'codeEntry']);
+
+function _urlOf(value) {
+  try {
+    return new URL(String(value));
+  } catch {
+    /* expected: a relative or truncated string is not a URL */
+    return null;
+  }
+}
+
+// `new URL('[::1]')` keeps the brackets in hostname; the set carries both spellings, and the
+// comparison is case-insensitive (hostnames are).
+function _hostOf(parsed) {
+  return String(parsed.hostname || '').replace(/^\[|\]$/g, '').toLowerCase();
+}
+
+function _isLoopbackHost(parsed) {
+  return parsed ? LOOPBACK_HOSTS.has(_hostOf(parsed)) : false;
+}
+
+function isLoopbackUrl(value) {
+  const parsed = _urlOf(value);
+  if (!parsed) return false;
+  if (_isLoopbackHost(parsed)) return true;
+  const redirect = parsed.searchParams.get('redirect_uri');
+  return redirect ? _isLoopbackHost(_urlOf(redirect)) : false;
+}
+
+function loopbackPortOf(value) {
+  const parsed = _urlOf(value);
+  if (!parsed) return null;
+  const redirect = parsed.searchParams.get('redirect_uri');
+  const redirectParsed = redirect ? _urlOf(redirect) : null;
+  if (_isLoopbackHost(redirectParsed) && redirectParsed.port) return Number(redirectParsed.port);
+  if (_isLoopbackHost(parsed) && parsed.port) return Number(parsed.port);
+  return null;
+}
+
+function _stateParamOf(value) {
+  const parsed = _urlOf(value);
+  return parsed ? (parsed.searchParams.get('state') || '') : '';
+}
+
+// A match that runs to the very end of what we have may be truncated by the chunk boundary
+// (a PTY chunk is arbitrary bytes, and stripAnsi cannot know an OSC hyperlink finished).
+// feed() re-parses the window on every chunk, so waiting one chunk for the rest loses
+// nothing -- and it keeps a half-received URL from being frozen as the card's link.
+function _isCompleteMatch(match, source) {
+  return match.index + match[0].length < source.length;
+}
+
+// text is ALREADY stripped (use stripAnsi first). providerId only decides precedence when
+// both shapes appear: claude -> the authorize URL wins, codex -> the device URL wins.
+function parseLoginOutput(text, providerId) {
+  const source = String(text == null ? '' : text);
+  const provider = String(providerId == null ? '' : providerId).trim().toLowerCase();
+  const result = { verificationUrl: '', state: '', userCode: '', callbackPort: null, codeEntry: '' };
+
+  let authorizeUrl = '';
+  for (const match of source.matchAll(AUTHORIZE_URL_RE)) {
+    if (!_isCompleteMatch(match, source)) continue;
+    const url = match[0];
+    // The automatic URL the CLI hands to BROWSER is loopback-redirected: port evidence only (D-1).
+    if (isLoopbackUrl(url)) {
+      if (result.callbackPort === null) result.callbackPort = loopbackPortOf(url);
+      continue;
+    }
+    if (!authorizeUrl) authorizeUrl = url;
+  }
+
+  const deviceMatch = DEVICE_URL_RE.exec(source);
+  const deviceUrl = deviceMatch && _isCompleteMatch(deviceMatch, source) ? deviceMatch[0] : '';
+  const codeMatch = DEVICE_CODE_LINE_RE.exec(source);
+  const userCode = codeMatch ? codeMatch[1] : '';
+
+  const chosen = provider === 'codex' ? (deviceUrl || authorizeUrl) : (authorizeUrl || deviceUrl);
+  result.verificationUrl = chosen;
+  result.state = chosen ? _stateParamOf(chosen) : '';
+  result.codeEntry = !chosen ? '' : (chosen === authorizeUrl ? 'paste' : 'browser');
+  result.userCode = userCode;
+  return result;
+}
+
+/**
+ * createLoginCapture({ providerId, seed, onUpdate }) -> { feed(chunk), snapshot() }
+ * feed() appends to the rolling window and re-parses it; every field that changes
+ * from ''/null to a value is FROZEN (a later, different value never overwrites it) and the
+ * whole set of fields changed by this feed() is passed to onUpdate() exactly once.
+ * `seed` (the session's `_textTail`) is fed synchronously at creation, closing the
+ * attach-after-first-bytes race (§5 OQ-1).
+ *
+ * The window keeps RAW bytes and is stripped at parse time, not per chunk: a PTY chunk is
+ * arbitrary bytes, so an OSC-8 hyperlink (which the CLI wraps its URL in) can be split
+ * across two chunks -- stripping the halves separately would eat the `ESC ]` but leave
+ * `8;;` glued in front of the payload and the payload glued to the following text, and the
+ * card would get `…&state=<43>If`. Stripping the reassembled window removes the whole
+ * sequence, payload included (proved by the AC-0d chunk-split test).
+ */
+function createLoginCapture({ providerId, seed = '', onUpdate } = {}) {
+  let window = '';
+  const frozen = { verificationUrl: '', state: '', userCode: '', callbackPort: null, codeEntry: '' };
+  const notify = typeof onUpdate === 'function' ? onUpdate : null;
+
+  const feed = (chunk) => {
+    window = `${window}${String(chunk == null ? '' : chunk)}`.slice(-CAPTURE_WINDOW_CHARS);
+    const parsed = parseLoginOutput(stripAnsi(window), providerId);
+    const changed = {};
+    for (const field of CAPTURE_FIELDS) {
+      if (frozen[field] !== '' && frozen[field] !== null) continue; // frozen once set
+      const next = parsed[field];
+      if (next === '' || next === null || next === undefined) continue;
+      frozen[field] = next;
+      changed[field] = next;
+    }
+    if (notify && Object.keys(changed).length) notify(changed);
+  };
+
+  if (seed) feed(seed);
+  return { feed, snapshot: () => ({ ...frozen }) };
+}
+
+module.exports = {
+  CAPTURE_WINDOW_CHARS,
+  isLoopbackUrl,
+  loopbackPortOf,
+  parseLoginOutput,
+  createLoginCapture,
+};

package/template/coding-task-manager/lib/queue-draft-status-overlay.js

@@ -0,0 +1,36 @@
+'use strict';
+
+// R-1/R-2 (docs/clock-free-tests-followups-r5-2026-10-25.html §5, §6):
+// the queue-draft GET overlays the durable, in-memory queue-engine item status
+// onto the stored draft snapshot, so every reader (desktop, phone) sees the
+// same truth without the GET writing anything back (D-4). Pure: no requires,
+// no I/O, never mutates the draft it is handed.
+
+// Only durable statuses that mean "the engine owns this item's fate" overlay a
+// draft. A durable `pending` is deliberately excluded: the draft's
+// queued/pending/confirming vocabulary stays client-owned (R-2, D-5).
+const OVERLAY_STATUSES = new Set(['sending', 'sent', 'skipped', 'failed']);
+
+// Missing / non-numeric / non-positive timestamps count as 0 (R-2).
+function _draftStatusTimestamp(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+
+function overlayQueueDraftStatuses(draft, statusMap) {
+  if (!draft || typeof draft !== 'object' || !Array.isArray(draft.items)) return draft;
+  if (!statusMap || statusMap.size === 0) return { ...draft, items: draft.items.slice() };
+  const items = draft.items.map((item) => {
+    if (!item || typeof item !== 'object' || !item.id) return item;
+    const durable = statusMap.get(item.id);
+    if (!durable || !OVERLAY_STATUSES.has(durable.status)) return item;
+    const durableAt = _draftStatusTimestamp(durable.statusUpdatedAt);
+    const draftAt = _draftStatusTimestamp(item.statusUpdatedAt);
+    // Newest timestamp wins (A5), tie goes to the durable status (AC-1a).
+    if (durableAt < draftAt) return item;
+    return { ...item, status: durable.status, statusUpdatedAt: durable.statusUpdatedAt };
+  });
+  return { ...draft, items };
+}
+
+module.exports = { overlayQueueDraftStatuses, OVERLAY_STATUSES };

package/template/coding-task-manager/lib/raw-codex-history-window.js

@@ -23,6 +23,7 @@ const MAX_CURSOR_BYTES = 16 * 1024;
 // A request keeps consuming blocks until it holds maxRows rows or has read maxBytes; this bounds
 // the work when many consecutive blocks hold only hidden record kinds.
 const MAX_FILL_BLOCKS = 16;
+const MAX_EMPTY_RUN_BLOCKS = 256; // D-1: while no row is collected a fill keeps consuming up to 256 × BLOCK_BYTES = 8 MiB of hidden records before answering an empty page
 // leadPrompt: when no loaded unit before the page holds a prompt, scan this many EARLIER blocks (2 MiB) for one.
 const LEAD_SCAN_MAX_BLOCKS = 64;
 // Per-process LRU of scan answers. A page inside one long turn would otherwise re-scan the same blocks on every
@@ -323,7 +324,7 @@ function getRawCodexHistoryWindow(sources, options = {}, fileOps = transcriptSou
   // maxBytes budgets the source bytes CONSUMED (the logical blocks); readRawHistoryBlock also reads a
   // block of look-around each side to resolve record ownership, so counting raw reads would stop at ~3 blocks.
   const consumedBytes = () => segments.reduce((sum, one) => sum + (one.block.end - one.block.start), 0);
-  while (all.length < maxRows && !(all.length && consumedBytes() >= maxBytes) && segments.length < MAX_FILL_BLOCKS) {
+  while (all.length < maxRows && !(all.length && consumedBytes() >= maxBytes) && segments.length < (all.length ? MAX_FILL_BLOCKS : MAX_EMPTY_RUN_BLOCKS)) {
     const at = forward ? nextBlockOf(seg, all.at(-1)) : prevBlockOf(seg);
     if (!at) break;
     seg = loadBlock(at.x, at.b);
@@ -466,7 +467,8 @@ function getRawCodexHistoryWindow(sources, options = {}, fileOps = transcriptSou
   // A block with only non-display records must still advance rather than claim an edge.
   if (!items.length && all.length) return base('retryable-error', generation, 'response-budget-too-small');
   if (!items.length) {
-    // Every block consumed was hidden-only: hand back cursors just past the oldest/newest one read.
+    // Every block consumed (up to MAX_EMPTY_RUN_BLOCKS while no row was collected) was hidden-only: hand back
+    // cursors just past the oldest/newest one read, so the next request resumes after the hidden run it walked.
     const oldest = forward ? segments[0] : segments.at(-1); const newest = forward ? segments.at(-1) : segments[0];
     const older = prevBlockOf(oldest); const newer = nextBlockOf(newest, null);
     response.olderCursor = cursorAt(older && { ...older, u: Number.MAX_SAFE_INTEGER, f: Number.MAX_SAFE_INTEGER });
@@ -484,4 +486,4 @@ function getRawCodexHistoryWindow(sources, options = {}, fileOps = transcriptSou
   return response;
 }
 
-module.exports = { FAMILY, BLOCK_BYTES, encodeRawCodexHistoryCursor, decodeRawCodexHistoryCursor, isRawCodexHistoryCursor, getRawCodexHistoryWindow, historyRowKindOfRole };
+module.exports = { FAMILY, BLOCK_BYTES, MAX_EMPTY_RUN_BLOCKS, encodeRawCodexHistoryCursor, decodeRawCodexHistoryCursor, isRawCodexHistoryCursor, getRawCodexHistoryWindow, historyRowKindOfRole };

package/template/coding-task-manager/lib/read-pool-client.js

@@ -1105,8 +1105,11 @@ class CtmReadPoolClient {
       const timer = setTimeout(resolve, 500);
       timer.unref?.();
     });
-    const results = await Promise.all(this._workers.map(worker => worker.requestReadonlyRecycle(reason)));
-    return { requested: this._workers.length, recycled: results.filter(Boolean).length };
+    // Only a slot with an isolate can hold a read connection; a retired / never-started slot is
+    // already in a reader gap (sqlite.org/wal.html "reader gaps").
+    const live = this._workers.filter((worker) => worker.isLive);
+    const results = await Promise.all(live.map((worker) => worker.requestReadonlyRecycle(reason)));
+    return { requested: live.length, recycled: results.filter(Boolean).length, skippedNoIsolate: this._workers.length - live.length };
   }
 
   // `idleMs` (WP-4): when set, only workers idle (no completed op) at least this long