github-issue-tower-defence-management 1.109.2 → 1.110.1

package/src/adapter/entry-points/handlers/tokenStatusWriter.ts

@@ -1,6 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import type { Issue } from '../../../domain/entities/Issue';
+import { IN_TMUX_STATUS_NAME } from '../../../domain/entities/WorkflowStatus';
 import {
   GenerateTokenStatusUseCase,
   TokenRateLimitSnapshot,
@@ -19,10 +20,13 @@ import { ProcTakeOwnershipSpawnRepository } from '../../repositories/ProcTakeOwn
 const SEVEN_DAY_SONNET_LIMIT_TYPE = 'seven_day_sonnet';
 const SEVEN_DAY_OPUS_LIMIT_TYPE = 'seven_day_opus';
 
+const IN_TMUX_PROJECTS_DIR_NAME = 'token-status-in-tmux';
+
 export type TokenStatusWriterParams = {
   dashboardDataDir: string | null | undefined;
   tokenListJsonPath: string | null | undefined;
   issues: Issue[];
+  pjcode?: string | null | undefined;
   now?: Date;
   readSnapshot?: (token: string) => RateLimitSnapshot | null;
   interactiveSessionRepository?: ClaudeInteractiveSessionRepository;
@@ -34,6 +38,12 @@ export type TokenStatusFile = {
   capturedAt: string;
 };
 
+type InTmuxByHumanProjectFile = {
+  pjcode: string;
+  urls: string[];
+  capturedAt: string;
+};
+
 const writeJsonAtomic = (filePath: string, data: unknown): void => {
   const dir = path.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true });
@@ -42,6 +52,64 @@ const writeJsonAtomic = (filePath: string, data: unknown): void => {
   fs.renameSync(tmpPath, filePath);
 };
 
+const inTmuxByHumanUrlsFromIssues = (issues: Issue[]): string[] => {
+  const urls = new Set<string>();
+  for (const issue of issues) {
+    if (issue.status === IN_TMUX_STATUS_NAME && issue.isClosed === false) {
+      urls.add(issue.url);
+    }
+  }
+  return [...urls];
+};
+
+const persistProjectInTmuxByHumanUrls = (
+  inTmuxProjectsDir: string,
+  pjcode: string,
+  urls: string[],
+  capturedAt: string,
+): void => {
+  const file: InTmuxByHumanProjectFile = { pjcode, urls, capturedAt };
+  writeJsonAtomic(path.join(inTmuxProjectsDir, `${pjcode}.json`), file);
+};
+
+const readMachineWideInTmuxByHumanUrls = (
+  inTmuxProjectsDir: string,
+): Set<string> => {
+  const urls = new Set<string>();
+  let fileNames: string[];
+  try {
+    fileNames = fs.readdirSync(inTmuxProjectsDir);
+  } catch {
+    return urls;
+  }
+  for (const fileName of fileNames) {
+    if (!fileName.endsWith('.json')) {
+      continue;
+    }
+    try {
+      const parsed: unknown = JSON.parse(
+        fs.readFileSync(path.join(inTmuxProjectsDir, fileName), 'utf8'),
+      );
+      if (
+        parsed === null ||
+        typeof parsed !== 'object' ||
+        !('urls' in parsed) ||
+        !Array.isArray(parsed.urls)
+      ) {
+        continue;
+      }
+      for (const url of parsed.urls) {
+        if (typeof url === 'string') {
+          urls.add(url);
+        }
+      }
+    } catch {
+      continue;
+    }
+  }
+  return urls;
+};
+
 export const toTokenRateLimitSnapshot = (
   snapshot: RateLimitSnapshot | null,
 ): TokenRateLimitSnapshot | null => {
@@ -73,7 +141,7 @@ export const toTokenRateLimitSnapshot = (
 };
 
 export const writeTokenStatus = (params: TokenStatusWriterParams): void => {
-  const { dashboardDataDir, tokenListJsonPath, issues } = params;
+  const { dashboardDataDir, tokenListJsonPath, issues, pjcode } = params;
   if (!dashboardDataDir || !tokenListJsonPath) {
     return;
   }
@@ -83,6 +151,23 @@ export const writeTokenStatus = (params: TokenStatusWriterParams): void => {
     return;
   }
 
+  const now = params.now ?? new Date();
+  const inTmuxProjectsDir = path.join(
+    dashboardDataDir,
+    IN_TMUX_PROJECTS_DIR_NAME,
+  );
+  if (pjcode) {
+    persistProjectInTmuxByHumanUrls(
+      inTmuxProjectsDir,
+      pjcode,
+      inTmuxByHumanUrlsFromIssues(issues),
+      now.toISOString(),
+    );
+  }
+  const machineWideInTmuxByHumanUrls = pjcode
+    ? readMachineWideInTmuxByHumanUrls(inTmuxProjectsDir)
+    : new Set(inTmuxByHumanUrlsFromIssues(issues));
+
   const readSnapshot = params.readSnapshot ?? readRateLimit;
   const interactiveSessionRepository =
     params.interactiveSessionRepository ??
@@ -112,17 +197,46 @@ export const writeTokenStatus = (params: TokenStatusWriterParams): void => {
     name: entry.name,
     token: entry.token,
     snapshot: null,
+    subscriptionDisabled: false,
+    unifiedRejected: false,
+  }));
+  const machineWideInTmuxByHumanIssues: Issue[] = [
+    ...machineWideInTmuxByHumanUrls,
+  ].map((url) => ({
+    nameWithOwner: '',
+    number: 0,
+    title: '',
+    state: 'OPEN',
+    status: IN_TMUX_STATUS_NAME,
+    story: null,
+    nextActionDate: null,
+    nextActionHour: null,
+    estimationMinutes: null,
+    dependedIssueUrls: [],
+    completionDate50PercentConfidence: null,
+    url,
+    assignees: [],
+    labels: [],
+    org: '',
+    repo: '',
+    body: '',
+    itemId: '',
+    isPr: false,
+    isInProgress: false,
+    isClosed: false,
+    createdAt: now,
+    author: '',
+    closingIssueReferenceUrls: [],
   }));
   const humResult = new InTmuxByHumanSessionTokenCountUseCase().run(
     candidates,
     interactiveSessionRepository.listInteractiveSessions(),
-    issues,
+    machineWideInTmuxByHumanIssues,
   );
   const humCountByToken = new Map<string, number>(
     humResult.counts.map((count) => [count.token, count.count]),
   );
 
-  const now = params.now ?? new Date();
   const tokens = new GenerateTokenStatusUseCase().run({
     tokens: tokenInputs,
     prepCountByToken,

package/src/adapter/proxy/RateLimitCache.test.ts

@@ -9,10 +9,28 @@ import {
   HEADERLESS_429_MAX_COOLDOWN_SECONDS,
   parseModelRateLimitsFromBody,
   parseModelRateLimitsFromHeaders,
+  PERMISSION_DISABLED_COOLDOWN_SECONDS,
   readRateLimit,
   writeModelRateLimit,
   writeRateLimit,
+  writeSubscriptionDisabled,
 } from './RateLimitCache';
+import { OauthTokenSelectUseCase } from '../../domain/usecases/OauthTokenSelectUseCase';
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  v !== null && typeof v === 'object' && !Array.isArray(v);
+
+const writeSubscriptionDisabledEpoch = (
+  token: string,
+  epochSeconds: number,
+): void => {
+  const filePath = cachePathForToken(token);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(
+    filePath,
+    JSON.stringify({ subscriptionDisabledEpoch: epochSeconds }),
+  );
+};
 
 describe('RateLimitCache', () => {
   let tempDir: string;
@@ -774,4 +792,138 @@ describe('RateLimitCache', () => {
       });
     });
   });
+
+  describe('writeSubscriptionDisabled', () => {
+    it('should persist subscriptionDisabledEpoch to the cache file', () => {
+      const token = 'sub-disabled-token';
+      writeSubscriptionDisabled(token);
+      const filePath = cachePathForToken(token);
+      const raw: unknown = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      const epoch = isRecord(raw) ? raw.subscriptionDisabledEpoch : undefined;
+      expect(typeof epoch).toBe('number');
+    });
+
+    it('should preserve existing cache fields when writing subscriptionDisabledEpoch', () => {
+      const token = 'sub-disabled-preserve-token';
+      writeRateLimit(token, {
+        'anthropic-ratelimit-unified-5h-status': 'allowed',
+        'anthropic-ratelimit-unified-5h-reset': '2000100',
+        'anthropic-ratelimit-unified-5h-utilization': '0.1',
+        'anthropic-ratelimit-unified-7d-status': 'allowed',
+        'anthropic-ratelimit-unified-7d-reset': '2000200',
+        'anthropic-ratelimit-unified-7d-utilization': '0.1',
+      });
+      writeSubscriptionDisabled(token);
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(true);
+      expect(snapshot?.fiveHourReset).toBe(2000100);
+    });
+  });
+
+  describe('readRateLimit subscriptionDisabled', () => {
+    it('returns subscriptionDisabled: true after writeSubscriptionDisabled is called', () => {
+      const token = 'sub-disabled-read-token';
+      writeSubscriptionDisabled(token);
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(true);
+    });
+
+    it('returns subscriptionDisabled: false when no subscriptionDisabledEpoch is in the cache', () => {
+      const token = 'sub-not-disabled-token';
+      writeRateLimit(token, {
+        'anthropic-ratelimit-unified-5h-status': 'allowed',
+        'anthropic-ratelimit-unified-5h-reset': '2000100',
+        'anthropic-ratelimit-unified-5h-utilization': '0.1',
+        'anthropic-ratelimit-unified-7d-status': 'allowed',
+        'anthropic-ratelimit-unified-7d-reset': '2000200',
+        'anthropic-ratelimit-unified-7d-utilization': '0.1',
+      });
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(false);
+    });
+
+    it('returns subscriptionDisabled: true while within the cooldown window', () => {
+      const token = 'sub-disabled-within-cooldown-token';
+      const nowEpochSeconds = Date.now() / 1000;
+      writeSubscriptionDisabledEpoch(
+        token,
+        nowEpochSeconds - (PERMISSION_DISABLED_COOLDOWN_SECONDS - 60),
+      );
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(true);
+    });
+
+    it('returns subscriptionDisabled: false once the cooldown window has elapsed', () => {
+      const token = 'sub-disabled-cooldown-elapsed-token';
+      const nowEpochSeconds = Date.now() / 1000;
+      writeSubscriptionDisabledEpoch(
+        token,
+        nowEpochSeconds - (PERMISSION_DISABLED_COOLDOWN_SECONDS + 60),
+      );
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(false);
+    });
+  });
+
+  describe('writeRateLimit preserves subscriptionDisabledEpoch across header writes', () => {
+    const headerBearingResponse: Record<string, string> = {
+      'anthropic-ratelimit-unified-status': 'allowed',
+      'anthropic-ratelimit-unified-5h-status': 'allowed',
+      'anthropic-ratelimit-unified-5h-reset': '2000100',
+      'anthropic-ratelimit-unified-5h-utilization': '0.1',
+      'anthropic-ratelimit-unified-7d-status': 'allowed',
+      'anthropic-ratelimit-unified-7d-reset': '2000200',
+      'anthropic-ratelimit-unified-7d-utilization': '0.1',
+    };
+
+    it('keeps subscriptionDisabled: true after a later header-bearing 200 response', () => {
+      const token = 'sub-disabled-then-200-token';
+      writeSubscriptionDisabled(token);
+      writeRateLimit(token, headerBearingResponse, 200);
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(true);
+      expect(snapshot?.fiveHourReset).toBe(2000100);
+    });
+
+    it('keeps subscriptionDisabled: true after a later header-bearing 429 response', () => {
+      const token = 'sub-disabled-then-429-token';
+      writeSubscriptionDisabled(token);
+      writeRateLimit(token, headerBearingResponse, 429);
+      const snapshot = readRateLimit(token);
+      expect(snapshot?.subscriptionDisabled).toBe(true);
+    });
+
+    it('still excludes the token from selection after a header-bearing response', () => {
+      const token = 'sub-disabled-then-200-selection-token';
+      writeSubscriptionDisabled(token);
+      writeRateLimit(token, headerBearingResponse, 200);
+      const snapshot = readRateLimit(token);
+      const useCase = new OauthTokenSelectUseCase();
+      const result = useCase.run(
+        [
+          {
+            name: 'disabled-token',
+            token,
+            snapshot:
+              snapshot === null
+                ? null
+                : {
+                    fiveHourUtilization: snapshot.fiveHourUtilization,
+                    fiveHourReset: snapshot.fiveHourReset,
+                    sevenDayUtilization: snapshot.sevenDayUtilization,
+                    sevenDayReset: snapshot.sevenDayReset,
+                  },
+            subscriptionDisabled: snapshot?.subscriptionDisabled ?? false,
+            unifiedRejected: snapshot?.unifiedRejected ?? false,
+          },
+        ],
+        Date.now() / 1000,
+      );
+      expect(result.selected).toBeNull();
+      expect(result.metrics[0]?.eligible).toBe(false);
+      expect(result.metrics[0]?.exclusionReason).toBe(
+        'organization has disabled Claude subscription access for Claude Code',
+      );
+    });
+  });
 });

package/src/adapter/proxy/RateLimitCache.ts

@@ -23,6 +23,7 @@ export interface RateLimitSnapshot {
   modelWeeklyLimits: Record<string, ModelWeeklyLimit>;
   lastUpdatedEpoch: number;
   blockedUntilEpoch: number;
+  subscriptionDisabled: boolean;
 }
 
 export const PROXY_PORT = 8787;
@@ -33,6 +34,8 @@ export const HEADERLESS_429_DEFAULT_COOLDOWN_SECONDS = 90;
 
 export const HEADERLESS_429_MAX_COOLDOWN_SECONDS = 600;
 
+export const PERMISSION_DISABLED_COOLDOWN_SECONDS = 3600;
+
 export const cacheDir = (): string => {
   const base = process.env.XDG_CACHE_HOME ?? path.join(os.homedir(), '.cache');
   return path.join(base, 'tdpm', 'ratelimit');
@@ -77,6 +80,16 @@ const readModelWeeklyLimits = (
   return result;
 };
 
+const readSubscriptionDisabledEpoch = (
+  payload: Record<string, unknown>,
+): { subscriptionDisabledEpoch: number } | Record<string, never> => {
+  const stored = payload.subscriptionDisabledEpoch;
+  if (typeof stored === 'number') {
+    return { subscriptionDisabledEpoch: stored };
+  }
+  return {};
+};
+
 const cooldownEndFromRetryAfter = (
   retryAfterSeconds: number | null,
   nowEpochSeconds: number,
@@ -138,6 +151,7 @@ export const writeRateLimit = (
   }
   const existing = readPayload(filePath);
   const payload = {
+    ...readSubscriptionDisabledEpoch(existing),
     ts: Date.now() / 1000,
     headers: rateLimitHeaders,
     modelWeeklyLimits: readModelWeeklyLimits(existing),
@@ -168,6 +182,23 @@ export const writeModelRateLimit = (
   fs.writeFileSync(filePath, JSON.stringify(payload));
 };
 
+export const writeSubscriptionDisabled = (
+  token: string,
+  baseDir: string = cacheDir(),
+): void => {
+  const dir = baseDir;
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  const filePath = path.join(dir, `${hashToken(token)}.json`);
+  const existing = readPayload(filePath);
+  const payload = {
+    ...existing,
+    subscriptionDisabledEpoch: Date.now() / 1000,
+  };
+  fs.writeFileSync(filePath, JSON.stringify(payload));
+};
+
 export const parseModelRateLimitsFromBody = (
   body: string,
 ): Record<string, ModelWeeklyLimit> => {
@@ -264,6 +295,16 @@ export const readRateLimit = (
     const storedBlockedUntil = parsed.blockedUntilEpoch;
     const blockedUntilEpoch =
       typeof storedBlockedUntil === 'number' ? storedBlockedUntil : 0;
+    const storedSubscriptionDisabledEpoch = parsed.subscriptionDisabledEpoch;
+    const subscriptionDisabledEpoch =
+      typeof storedSubscriptionDisabledEpoch === 'number'
+        ? storedSubscriptionDisabledEpoch
+        : 0;
+    const nowEpochSeconds = Date.now() / 1000;
+    const subscriptionDisabled =
+      subscriptionDisabledEpoch > 0 &&
+      nowEpochSeconds - subscriptionDisabledEpoch <
+        PERMISSION_DISABLED_COOLDOWN_SECONDS;
     return {
       fiveHourUtilization: num('anthropic-ratelimit-unified-5h-utilization'),
       fiveHourReset: num('anthropic-ratelimit-unified-5h-reset'),
@@ -285,6 +326,7 @@ export const readRateLimit = (
       },
       lastUpdatedEpoch,
       blockedUntilEpoch,
+      subscriptionDisabled,
     };
   } catch {
     return null;

package/src/adapter/proxy/proxyEntry.test.ts

@@ -331,4 +331,96 @@ describe('startProxy', () => {
     expect(response.body).toBe('Upstream error');
     expect(writeModelRateLimitSpy).not.toHaveBeenCalled();
   });
+
+  it('should call writeSubscriptionDisabled when the response body contains the subscription-disabled message', async () => {
+    const writeSubscriptionDisabledSpy = jest
+      .spyOn(RateLimitCache, 'writeSubscriptionDisabled')
+      .mockImplementation(() => undefined);
+
+    upstreamHandler = (_request, response) => {
+      response.writeHead(403, { 'content-type': 'application/json' });
+      response.end(
+        JSON.stringify({
+          error: {
+            message:
+              'Your organization has disabled Claude subscription access for Claude Code',
+          },
+        }),
+      );
+    };
+
+    await requestThroughProxy('POST', '/v1/messages', null);
+
+    expect(writeSubscriptionDisabledSpy).toHaveBeenCalledTimes(1);
+    expect(writeSubscriptionDisabledSpy).toHaveBeenCalledWith(TOKEN);
+    writeSubscriptionDisabledSpy.mockRestore();
+  });
+
+  it('should call writeSubscriptionDisabled when a 403 response body is a permission_error', async () => {
+    const writeSubscriptionDisabledSpy = jest
+      .spyOn(RateLimitCache, 'writeSubscriptionDisabled')
+      .mockImplementation(() => undefined);
+
+    upstreamHandler = (_request, response) => {
+      response.writeHead(403, { 'content-type': 'application/json' });
+      response.end(
+        JSON.stringify({
+          type: 'error',
+          error: {
+            type: 'permission_error',
+            message:
+              'OAuth authentication is currently not allowed for this organization',
+          },
+        }),
+      );
+    };
+
+    await requestThroughProxy('POST', '/v1/messages', null);
+
+    expect(writeSubscriptionDisabledSpy).toHaveBeenCalledTimes(1);
+    expect(writeSubscriptionDisabledSpy).toHaveBeenCalledWith(TOKEN);
+    writeSubscriptionDisabledSpy.mockRestore();
+  });
+
+  it('should not call writeSubscriptionDisabled when a permission_error body has a non-403 status', async () => {
+    const writeSubscriptionDisabledSpy = jest
+      .spyOn(RateLimitCache, 'writeSubscriptionDisabled')
+      .mockImplementation(() => undefined);
+
+    upstreamHandler = (_request, response) => {
+      response.writeHead(200, { 'content-type': 'application/json' });
+      response.end(
+        JSON.stringify({
+          type: 'error',
+          error: { type: 'permission_error', message: 'noise' },
+        }),
+      );
+    };
+
+    await requestThroughProxy('POST', '/v1/messages', null);
+
+    expect(writeSubscriptionDisabledSpy).not.toHaveBeenCalled();
+    writeSubscriptionDisabledSpy.mockRestore();
+  });
+
+  it('should not call writeSubscriptionDisabled when a 403 body is not a permission_error', async () => {
+    const writeSubscriptionDisabledSpy = jest
+      .spyOn(RateLimitCache, 'writeSubscriptionDisabled')
+      .mockImplementation(() => undefined);
+
+    upstreamHandler = (_request, response) => {
+      response.writeHead(403, { 'content-type': 'application/json' });
+      response.end(
+        JSON.stringify({
+          type: 'error',
+          error: { type: 'authentication_error', message: 'bad token' },
+        }),
+      );
+    };
+
+    await requestThroughProxy('POST', '/v1/messages', null);
+
+    expect(writeSubscriptionDisabledSpy).not.toHaveBeenCalled();
+    writeSubscriptionDisabledSpy.mockRestore();
+  });
 });

package/src/adapter/proxy/proxyEntry.ts

@@ -6,6 +6,7 @@ import {
   parseModelRateLimitsFromBody,
   writeModelRateLimit,
   writeRateLimit,
+  writeSubscriptionDisabled,
 } from './RateLimitCache';
 import { ClaudeMessageResponseRepository } from '../../domain/usecases/adapter-interfaces/ClaudeMessageResponseRepository';
 import { parseClaudeMessageResponse } from './ClaudeMessageResponseParser';
@@ -29,6 +30,22 @@ const extractToken = (
   return token.length > 0 ? token : null;
 };
 
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+
+const isPermissionError = (body: string): boolean => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return false;
+  }
+  if (!isRecord(parsed)) return false;
+  const error = parsed.error;
+  if (!isRecord(error)) return false;
+  return error.type === 'permission_error';
+};
+
 const startProxy = (
   port: number,
   claudeMessageResponseRepository: ClaudeMessageResponseRepository | null = null,
@@ -73,6 +90,21 @@ const startProxy = (
             } catch (error) {
               console.error('Failed to write model rate limit cache:', error);
             }
+            if (
+              body.includes(
+                'Your organization has disabled Claude subscription access for Claude Code',
+              ) ||
+              (upstreamResponse.statusCode === 403 && isPermissionError(body))
+            ) {
+              try {
+                writeSubscriptionDisabled(token);
+              } catch (error) {
+                console.error(
+                  'Failed to write subscription disabled cache:',
+                  error,
+                );
+              }
+            }
             if (claudeMessageResponseRepository !== null) {
               try {
                 const response = parseClaudeMessageResponse(

package/src/adapter/repositories/ConfigurableSilentSessionMessageComposer.test.ts

@@ -0,0 +1,77 @@
+import { ConfigurableSilentSessionMessageComposer } from './ConfigurableSilentSessionMessageComposer';
+import { SilentSessionMessageComposer } from '../../domain/usecases/adapter-interfaces/SilentSessionMessageComposer';
+
+type Mocked<T> = jest.Mocked<T> & jest.MockedObject<T>;
+
+const createFallback = (): Mocked<SilentSessionMessageComposer> => ({
+  composeMainStalledSection: jest.fn().mockReturnValue('FALLBACK_MAIN'),
+  composeSubAgentSection: jest.fn().mockReturnValue('FALLBACK_SUB'),
+});
+
+describe('ConfigurableSilentSessionMessageComposer', () => {
+  it('uses the fallback main section when no main template is configured', () => {
+    const fallback = createFallback();
+    const composer = new ConfigurableSilentSessionMessageComposer(
+      {
+        mainStalledMessage: null,
+        subAgentMessageHeader: null,
+        subAgentMessageFooter: null,
+      },
+      fallback,
+    );
+    expect(composer.composeMainStalledSection(600)).toBe('FALLBACK_MAIN');
+    expect(fallback.composeMainStalledSection).toHaveBeenCalledWith(600);
+  });
+
+  it('uses the configured main template when provided', () => {
+    const fallback = createFallback();
+    const composer = new ConfigurableSilentSessionMessageComposer(
+      {
+        mainStalledMessage: 'CUSTOM_MAIN',
+        subAgentMessageHeader: null,
+        subAgentMessageFooter: null,
+      },
+      fallback,
+    );
+    expect(composer.composeMainStalledSection(600)).toBe('CUSTOM_MAIN');
+    expect(fallback.composeMainStalledSection).not.toHaveBeenCalled();
+  });
+
+  it('uses the fallback sub-agent section when neither header nor footer is configured', () => {
+    const fallback = createFallback();
+    const composer = new ConfigurableSilentSessionMessageComposer(
+      {
+        mainStalledMessage: null,
+        subAgentMessageHeader: null,
+        subAgentMessageFooter: null,
+      },
+      fallback,
+    );
+    expect(
+      composer.composeSubAgentSection([
+        { label: 'task-a', silentSeconds: 360, runningSeconds: 1200 },
+      ]),
+    ).toBe('FALLBACK_SUB');
+  });
+
+  it('renders the configured sub-agent header, list, and footer', () => {
+    const fallback = createFallback();
+    const composer = new ConfigurableSilentSessionMessageComposer(
+      {
+        mainStalledMessage: null,
+        subAgentMessageHeader: 'HEADER',
+        subAgentMessageFooter: 'FOOTER',
+      },
+      fallback,
+    );
+    const section = composer.composeSubAgentSection([
+      { label: 'task-a', silentSeconds: 360, runningSeconds: 1200 },
+    ]);
+    expect(section).toContain('HEADER');
+    expect(section).toContain('task-a');
+    expect(section).toContain('silent for 6m');
+    expect(section).toContain('running for 20m');
+    expect(section).toContain('FOOTER');
+    expect(fallback.composeSubAgentSection).not.toHaveBeenCalled();
+  });
+});