jules-orchestrator-kit 0.36.0 → 0.38.0

package/README.md

@@ -104,7 +104,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **🔒 Zero Runtime Dependencies:** Built exclusively on Node.js 20+ built-ins (`node:fs`, `node:child_process`, `node:crypto`, `node:path`, `node:http`, `node:tty`, `node:test`). Zero third-party npm packages mean zero supply-chain CVE risk.
 
-* **🛡️ Fail-Closed Security Gatekeeper:** Unconditionally evaluates explicit Deny rules *before* Allow rules, matching against **canonicalised, case-folded paths** so `./`, `..`, mixed separators or a `.GitHub/` spelling cannot walk past a rule (the same repo is checked out on case-insensitive macOS and Windows filesystems). Redacts high-entropy secrets and PII from dry-runs and git diffs, blocks unsupported Node.js native module imports in Edge environments (Cloudflare Workers, Vercel Edge, Netlify Edge), and rejects PRs exceeding the 75 KB Diff Payload governor.
+* **🛡️ Fail-Closed Security Gatekeeper:** Unconditionally evaluates explicit Deny rules *before* Allow rules, matching against **canonicalised, case-folded paths** so `./`, `..`, mixed separators or a `.GitHub/` spelling cannot walk past a rule (the same repo is checked out on case-insensitive macOS and Windows filesystems). Redacts high-entropy secrets and PII from dry-runs and git diffs — **including credentials wrapped in base64**, so a key inside a Kubernetes `Secret` manifest is not invisible to a line-oriented scanner — blocks unsupported Node.js native module imports in Edge environments (Cloudflare Workers, Vercel Edge, Netlify Edge), and rejects PRs exceeding the 75 KB Diff Payload governor.
 
 * **🔄 Autonomous OODA Self-Healing:** Captures test stderr/stdout, normalizes failure fingerprints, and feeds structured error contexts back into repair iterations (up to 3 automatic attempts) before human escalation.
 
@@ -122,7 +122,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **🚀 Zero-Test Bootstrapping (`agentctl bootstrap`):** Synthesizes deterministic syntax-check and smoke-test verification oracles for untested legacy repositories so agents always operate against a falsifiable feedback loop.
 
-* **📈 Proven Scale & Reliability:** Empirically tested with **532 unit tests across 79 suites passing in < 10.0s**. An adversarial red-team suite (`test/adversarial-claims.test.mjs`) continuously attempts to falsify the safety guarantees documented above — including cross-platform probes for the case-insensitive filesystems on macOS and Windows — and a documentation-sync gate (`scripts/doc-sync-check.mjs`) blocks any release whose docs have drifted from the code.
+* **📈 Proven Scale & Reliability:** Empirically tested with **555 unit tests across 81 suites passing in < 10.0s**. An adversarial red-team suite (`test/adversarial-claims.test.mjs`) continuously attempts to falsify the safety guarantees documented above — every probe in it currently holds, with no open gaps — including cross-platform probes for the case-insensitive filesystems on macOS and Windows — and a documentation-sync gate (`scripts/doc-sync-check.mjs`) blocks any release whose docs have drifted from the code.
 
 <br/>
 

package/bin/agentctl.mjs

@@ -334,18 +334,41 @@ async function main() {
         // The count is local-only, so an operator who knows their real usage
         // must be able to correct it. Appending `budget_released` keeps the
         // hash chain intact — the ledger is corrected forwards, never edited.
+        // An unrecognised flag is refused rather than ignored. `reset` writes to
+        // the ledger, and a misremembered flag — `--root`, `--force` — silently
+        // dropping through to a full release is the kind of misfire that only
+        // becomes visible after the count is already gone.
+        const known = new Set(["--dry-run", "--yes", "-y", "--all"]);
+        const unknown = args.slice(2).filter((a) => !known.has(a));
+        if (unknown.length) {
+          console.error(`Unrecognised option${unknown.length > 1 ? "s" : ""} for \`budget reset\`: ${unknown.join(", ")}`);
+          console.error("Accepted: --dry-run, --yes/-y, --all. Nothing was released.");
+          process.exit(2);
+        }
         const dryRun = args.includes("--dry-run");
         const confirmed = args.includes("--yes") || args.includes("-y");
+        // Committed reservations reached the provider, so releasing them makes
+        // the local count understate real usage. That has to be deliberate.
+        const includeCommitted = args.includes("--all");
         if (!dryRun && !confirmed) {
           const open = listOpenReservations(root);
-          console.log(`Would release ${open.length} open reservation(s) from the last 24 hours.`);
+          const committed = open.filter((r) => r.committed).length;
+          const target = includeCommitted ? open.length : open.length - committed;
+          console.log(`Would release ${target} open reservation(s) from the last 24 hours.`);
+          if (committed > 0 && !includeCommitted) {
+            console.log(`Keeping ${committed} that reached Jules — those sessions really spent quota.`);
+            console.log("Add --all to release them too, if you know the count is still wrong.");
+          }
           console.log("This rewrites nothing — it appends `budget_released` entries.");
           console.log("Re-run with --yes to confirm, or --dry-run for detail.");
           process.exit(0);
         }
-        const res = releaseOpenReservations({ root, dryRun, reason: "operator-reconcile" });
+        const res = releaseOpenReservations({ root, dryRun, includeCommitted, reason: "operator-reconcile" });
         const verb = dryRun ? "Would release" : "Released";
-        console.log(`${verb} ${res.released} reservation(s) (${res.committed} committed, ${res.uncommitted} never closed).`);
+        console.log(`${verb} ${res.released} of ${res.open} open reservation(s) — ${res.uncommitted} never closed, ${res.committed} committed.`);
+        if (res.kept > 0) {
+          console.log(`Kept ${res.kept} committed reservation(s); re-run with --all to release those as well.`);
+        }
         if (!dryRun) {
           const after = budgetStatus(loadConfig(root), root);
           console.log(`Daily Budget : ${formatBudgetLine(after)}`);
@@ -363,14 +386,17 @@ async function main() {
       console.log(`  ${b.note}`);
       console.log(`  Window opened at ${b.windowStart} — the quota resets ${b.windowHours}h after each task,`);
       console.log("  not at midnight, so this count spans yesterday's ledger too.");
-      console.log(`  Open reservations in the window: ${listOpenReservations(root).length}`);
+      const openNow = listOpenReservations(root);
+      const committedNow = openNow.filter((r) => r.committed).length;
+      console.log(`  Open reservations in the window: ${openNow.length} (${committedNow} confirmed dispatched, ${openNow.length - committedNow} never closed)`);
       console.log("");
       console.log(`Worker Slots : ${slots.concurrency} concurrent`);
       console.log(`  ${slots.note}`);
       console.log("");
       console.log("The ledger counts this checkout only — sessions started from the Jules");
       console.log("web UI or another machine spend the same quota without appearing here.");
-      console.log("Use `agentctl budget reset --yes` to reconcile a count you know is wrong.");
+      console.log("Use `agentctl budget reset --yes` to clear the ones that never closed,");
+      console.log("or `--all` to also give back the ones that did reach Jules.");
       process.exit(0);
       break;
     }
@@ -1252,6 +1278,10 @@ async function main() {
 }
 
 main().catch((err) => {
+  if (err.name === "WizardCancelledError" || err.code === 130 || (err instanceof Error && err.message?.includes("cancelled by user"))) {
+    console.log(`\n🛑 ${err.message || "Operation cancelled by user."}`);
+    process.exit(130);
+  }
   console.error(`[FATAL ERROR] ${err.message}`);
   const exitCode = typeof err.code === "number" ? err.code : 1;
   process.exit(exitCode);

package/index.mjs

@@ -13,6 +13,7 @@ export {
   matchesGlob,
   checkScope,
   scanDiff,
+  hasEncodedSecret,
   checkEdgeRuntimeImports,
   checkCrossPackageImports,
 } from "./src/security.mjs";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.36.0",
-  "description": "Orchestration kit for running Google Jules autonomous agents.",
+  "version": "0.38.0",
+  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for Google Jules (jules) autonomous agents.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/FullThrottle83/jules-orchestrator-kit.git"
@@ -36,7 +36,7 @@
   ],
   "scripts": {
     "init": "node bin/init.js",
-    "test": "node --test test/*.test.mjs",
+    "test": "node scripts/run-tests.mjs",
     "jules:dispatch": "node scripts/jules-dispatch.mjs",
     "jules:queue": "node bin/agentctl.mjs queue",
     "jules:create": "node scripts/jules-create.mjs",

package/scripts/doc-sync-check.mjs

@@ -186,6 +186,33 @@ export function checkDocSync(root = process.cwd(), opts = {}) {
         ? `v${unreleased.join(", v")} marked (Unreleased) but <= shipped v${version}`
         : "no released version left marked (Unreleased)"
     );
+
+    // An unchecked item under "Shipped Milestones" is a claim the release
+    // contradicts. v0.37.0 shipped base64 decoding while the deferral note
+    // under v0.32.6 still read "still does not decode" — two statements about
+    // the same feature, thirty lines apart, disagreeing. Both survived every
+    // other check here, because nothing compared a milestone to its own
+    // section heading. Deferrals belong under a target milestone, not a
+    // shipped one; moving the item is the fix, ticking it off is the other.
+    const shippedStart = roadmap.search(/^##\s.*Shipped Milestones/m);
+    if (shippedStart === -1) {
+      add("ROADMAP shipped items resolved", false, "no `## … Shipped Milestones` heading found");
+    } else {
+      const rest = roadmap.slice(shippedStart);
+      // Search from index 1 so the section's own heading cannot terminate it.
+      const nextHeading = rest.slice(1).search(/^##\s/m);
+      const section = nextHeading === -1 ? rest : rest.slice(0, nextHeading + 1);
+      const openItems = [...section.matchAll(/^-\s\[ \]\s+(.+)$/gm)].map((m) =>
+        m[1].replace(/\*\*/g, "").split("—")[0].trim().slice(0, 60)
+      );
+      add(
+        "ROADMAP shipped items resolved",
+        openItems.length === 0,
+        openItems.length
+          ? `unchecked under Shipped Milestones: ${openItems.join("; ")}`
+          : "every item under Shipped Milestones is resolved"
+      );
+    }
   }
 
   // 3. CHANGELOG.md — a released version needs a matching entry (release.mjs

package/scripts/run-tests.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const root = process.cwd();
+const testDir = join(root, "test");
+const testFiles = readdirSync(testDir)
+  .filter((f) => f.endsWith(".test.mjs"))
+  .sort()
+  .map((f) => join("test", f));
+
+const res = spawnSync(process.execPath, ["--test", ...testFiles], {
+  cwd: root,
+  stdio: "inherit",
+  env: process.env,
+});
+
+process.exit(res.status ?? 1);

package/src/budget.mjs

@@ -276,32 +276,54 @@ export function listOpenReservations(root = resolveRoot(), opts = {}) {
  * forwards — never by editing or deleting the file, which would break the chain
  * and destroy the audit trail the ledger exists to provide.
  *
- * This is an operator override, not an inference. The kit cannot tell a
- * reservation that reached the provider from one whose process died first, so
- * only the operator knows whether the local count still reflects reality.
+ * This is an operator override, not an inference — but the two kinds of open
+ * reservation are not equally likely to be wrong, and by default only one of
+ * them is released.
+ *
+ * An **uncommitted** reservation was taken and never resolved: the process died
+ * between reserving the slot and learning what happened to it. That is the
+ * phantom this function exists to clear.
+ *
+ * A **committed** one carries proof that the dispatch reached the provider, so
+ * a real session exists and the quota really was spent. Releasing it makes the
+ * local count *understate* actual usage, which is the dangerous direction: the
+ * kit then dispatches confidently past the provider's real limit and gets
+ * refused. `includeCommitted` therefore has to be asked for.
+ *
+ * Legacy id-less reservations have no `budget_committed` entry that could ever
+ * name them, so they always read as uncommitted and are always released.
  *
  * @param {object} [opts]
  * @param {string} [opts.root]
  * @param {string} [opts.reason] - Recorded on every released entry.
  * @param {boolean} [opts.dryRun] - Report what would be released, write nothing.
- * @returns {{ released: number, committed: number, uncommitted: number, ids: string[], dryRun: boolean }}
+ * @param {boolean} [opts.includeCommitted] - Also release reservations that
+ *   demonstrably reached the provider. Off by default.
+ * @returns {{ released: number, kept: number, open: number, committed: number,
+ *   uncommitted: number, anonymous: number, ids: string[],
+ *   includeCommitted: boolean, dryRun: boolean }}
  */
 export function releaseOpenReservations(opts = {}) {
   const root = opts.root || resolveRoot();
   const openRecords = listOpenReservations(root);
   const committed = openRecords.filter((r) => r.committed).length;
+  const includeCommitted = Boolean(opts.includeCommitted);
+  const targets = includeCommitted ? openRecords : openRecords.filter((r) => !r.committed);
 
   const result = {
-    released: openRecords.length,
+    released: targets.length,
+    kept: openRecords.length - targets.length,
+    open: openRecords.length,
     committed,
     uncommitted: openRecords.length - committed,
-    anonymous: openRecords.filter((r) => !r.reservationId).length,
-    ids: openRecords.map((r) => r.reservationId).filter(Boolean),
+    anonymous: targets.filter((r) => !r.reservationId).length,
+    ids: targets.map((r) => r.reservationId).filter(Boolean),
+    includeCommitted,
     dryRun: Boolean(opts.dryRun),
   };
-  if (opts.dryRun || openRecords.length === 0) return result;
+  if (opts.dryRun || targets.length === 0) return result;
 
-  for (const rec of openRecords) {
+  for (const rec of targets) {
     const entry = { event: "budget_released", reason: opts.reason || "operator-reconcile" };
     if (rec.reservationId) {
       entry.reservationId = rec.reservationId;

package/src/git.mjs

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { normalizePath } from "./config.mjs";
@@ -49,20 +49,26 @@ export function runCmd(command, opts = {}) {
   }
 
   try {
-    const isWin = process.platform === "win32";
-    const execBin = useShell ? (isWin ? (process.env.ComSpec || "cmd.exe") : "/bin/sh") : binary;
-    const execArgs = useShell ? (isWin ? ["/d", "/s", "/c", shellCmd] : ["-c", shellCmd]) : args;
-
-    const stdout = execFileSync(execBin, execArgs, {
-      cwd,
-      encoding: "utf-8",
-      shell: false,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: opts.env || process.env,
-      timeout,
-      maxBuffer,
-    });
-    return { status: 0, stdout: stdout.trim(), stderr: "" };
+    const stdout = useShell
+      ? execSync(shellCmd, {
+          cwd,
+          encoding: "utf-8",
+          stdio: ["ignore", "pipe", "pipe"],
+          env: opts.env || process.env,
+          timeout,
+          maxBuffer,
+        })
+      : execFileSync(binary, args, {
+          cwd,
+          encoding: "utf-8",
+          shell: false,
+          stdio: ["ignore", "pipe", "pipe"],
+          env: opts.env || process.env,
+          timeout,
+          maxBuffer,
+        });
+
+    return { status: 0, stdout: String(stdout || "").trim(), stderr: "" };
   } catch (err) {
     const isTimeout = err.code === "ETIMEDOUT" || (err.signal === "SIGTERM" && err.killed);
     const isNobufs = err.code === "ENOBUFS" || (err.message && err.message.includes("maxBuffer"));

package/src/security.mjs

@@ -142,6 +142,19 @@ export function redactSecrets(text) {
     sanitized = sanitized.replace(pat, "[REDACTED_BY_SECURITY_GATE]");
   }
 
+  // A key the scanner can find inside a base64 blob must not survive redaction
+  // just because the literal bytes differ — otherwise scanDiff blocks the
+  // dispatch and the escalation payload leaks the very value it blocked on. The
+  // whole blob goes, not part of it: a partially-redacted encoding still
+  // decodes to the key.
+  const encoded = new Set();
+  decodeBase64Blobs(sanitized, (plain, blob) => {
+    if (hasHighConfidenceSecret(plain)) encoded.add(blob);
+  });
+  for (const blob of encoded) {
+    sanitized = sanitized.split(blob).join("[REDACTED_ENCODED_SECRET]");
+  }
+
   return sanitized;
 }
 
@@ -374,14 +387,118 @@ const STRING_CONCAT_JOIN = /(["'`])\s*\+\s*(["'`])/g;
  * Produces the variants of the added-line text that secret patterns are run
  * against: as-written, with invisible characters stripped, and with
  * source-level string concatenation collapsed.
+ *
+ * `normalized` is the last of those — every normalisation applied. It is
+ * returned separately for checks that are too expensive to run three times and
+ * gain nothing from the intermediate forms.
+ *
  * @param {string} addedLines
- * @returns {string[]}
+ * @returns {{ all: string[], normalized: string }}
  */
 function secretScanVariants(addedLines) {
   const stripped = addedLines.replace(INVISIBLE_CHARS, "");
   // Collapse `"AAA" +\n  "BBB"` into `"AAABBB"` before matching.
   const dejoined = stripped.replace(/\s*\n\s*/g, " ").replace(STRING_CONCAT_JOIN, "");
-  return [...new Set([addedLines, stripped, dejoined])];
+  return { all: [...new Set([addedLines, stripped, dejoined])], normalized: dejoined };
+}
+
+// Base64 is less an evasion technique than a file format. Every value in a
+// Kubernetes Secret manifest is base64 by specification, and whole `.env` files
+// get encoded into a single CI variable. A credential arriving that way is
+// ordinary rather than adversarial — and a line-oriented scanner walks straight
+// past it, which makes this the encoding most likely to carry a live key
+// through the gate.
+const BASE64_CANDIDATE = /[A-Za-z0-9+/]{24,}={0,2}/g;
+
+// Decoding is cheap per blob and ruinous per diff if left unbounded. A patch
+// that checks in a binary, a source map or a bundled font is otherwise enough
+// to turn one scan into a memory event, so both the number of candidates and
+// the total decoded size are capped. Exceeding a cap skips the remainder; it
+// does not fail the scan, because a large diff is not evidence of a leak.
+const BASE64_MAX_CANDIDATES = 64;
+const BASE64_MAX_DECODED_BYTES = 64 * 1024;
+
+/**
+ * Share of characters that are printable ASCII (plus tab/newline/return).
+ *
+ * `Buffer.from(str, "base64")` never throws — it discards what it cannot parse
+ * and returns whatever it managed to decode. So a hex digest or a random
+ * identifier of the right length "decodes" successfully into bytes that mean
+ * nothing. A wrapped credential, on the other hand, decodes to text: keys,
+ * PEM blocks and `.env` bodies are all ASCII. This ratio is what separates the
+ * two, and it removes nearly all of the noise before any pattern runs.
+ */
+function printableRatio(str) {
+  if (!str) return 0;
+  let printable = 0;
+  for (let i = 0; i < str.length; i++) {
+    const c = str.charCodeAt(i);
+    if (c === 9 || c === 10 || c === 13 || (c >= 32 && c <= 126)) printable++;
+  }
+  return printable / str.length;
+}
+
+/**
+ * Decode the base64-looking blobs in `text` that plausibly hold text.
+ *
+ * @param {string} text
+ * @param {(plain: string, blob: string) => void} [onDecoded] - Called per blob.
+ * @returns {string[]}
+ */
+function decodeBase64Blobs(text, onDecoded) {
+  if (!text) return [];
+  const decoded = [];
+  let candidates = 0;
+  let bytes = 0;
+
+  BASE64_CANDIDATE.lastIndex = 0;
+  let match;
+  while ((match = BASE64_CANDIDATE.exec(text)) !== null) {
+    if (candidates++ >= BASE64_MAX_CANDIDATES) break;
+    const blob = match[0];
+    // Valid base64 is a multiple of four characters including padding. This
+    // costs nothing and rejects three quarters of the alphanumeric runs — commit
+    // hashes, minified identifiers — that would otherwise be decoded for nothing.
+    if (blob.length % 4 !== 0) continue;
+    // Check the budget against what this blob *would* cost, not against what
+    // has already been spent — otherwise the first candidate decodes in full
+    // however large it is, and a single checked-in binary costs more than the
+    // cap was meant to allow. `continue`, not `break`: one oversized blob must
+    // not hide the smaller ones after it.
+    if (bytes + (blob.length * 3) / 4 > BASE64_MAX_DECODED_BYTES) continue;
+
+    let plain;
+    try {
+      plain = Buffer.from(blob, "base64").toString("utf-8");
+    } catch (_) {
+      continue;
+    }
+    bytes += plain.length;
+    if (printableRatio(plain) < 0.9) continue;
+
+    decoded.push(plain);
+    if (onDecoded) onDecoded(plain, blob);
+  }
+  BASE64_CANDIDATE.lastIndex = 0;
+  return decoded;
+}
+
+/**
+ * True when a base64-encoded value on an added line decodes to a structured
+ * credential.
+ *
+ * Deliberately runs the high-confidence patterns *only*. The low-confidence set
+ * is entropy- and keyword-driven, and decoded bytes are high-entropy by
+ * construction — pointing it at this output would flag close to every encoded
+ * blob in every repository. `AKIA[0-9A-Z]{16}` cannot match decoded noise;
+ * "looks secret-ish" always can. That asymmetry is the whole reason this check
+ * is safe to enable by default.
+ *
+ * @param {string} text
+ * @returns {boolean}
+ */
+export function hasEncodedSecret(text) {
+  return decodeBase64Blobs(text).some((plain) => hasHighConfidenceSecret(plain));
 }
 
 export function scanDiff(diffTextStr = "", options = {}) {
@@ -392,13 +509,23 @@ export function scanDiff(diffTextStr = "", options = {}) {
     .map((line) => line.slice(1))
     .join("\n");
 
-  const variants = secretScanVariants(addedLines);
+  const { all: variants, normalized } = secretScanVariants(addedLines);
   const hasHigh = variants.some((v) => hasHighConfidenceSecret(v));
-  const hasLow = !hasHigh && variants.some((v) => hasLowConfidenceSecret(v));
+  // Only worth decoding when nothing was found in the clear, and only against
+  // the fully-normalised text: decoding is the expensive step, and the
+  // intermediate variants differ from it in ways base64 blobs do not care about.
+  const hasEncoded = !hasHigh && hasEncodedSecret(normalized);
+  const hasLow = !hasHigh && !hasEncoded && variants.some((v) => hasLowConfidenceSecret(v));
   const findings = [];
 
   if (hasHigh) {
     findings.push({ severity: "CRITICAL", type: "HIGH_CONFIDENCE_SECRET", description: "High-confidence secret pattern detected in added diff lines" });
+  } else if (hasEncoded) {
+    // Same type as the cleartext case: every gate that blocks on
+    // HIGH_CONFIDENCE_SECRET should block on this too, and a new type would
+    // have silently passed through the ones not updated. The description
+    // carries the difference the operator needs.
+    findings.push({ severity: "CRITICAL", type: "HIGH_CONFIDENCE_SECRET", description: "High-confidence secret pattern detected inside a base64-encoded value on an added diff line" });
   } else if (hasLow) {
     findings.push({ severity: "HIGH", type: "LOW_CONFIDENCE_SECRET", description: "Low-confidence secret or authorization token detected in added diff lines" });
   }
@@ -419,7 +546,7 @@ export function scanDiff(diffTextStr = "", options = {}) {
   }
 
   return {
-    ok: !hasHigh && !hasLow && edgeRes.ok && crossPkgRes.ok,
+    ok: !hasHigh && !hasEncoded && !hasLow && edgeRes.ok && crossPkgRes.ok,
     findings,
   };
 }

package/src/state.mjs

@@ -13,6 +13,7 @@ import {
 import { join, basename } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { hostname } from "node:os";
+import { execFileSync } from "node:child_process";
 import { resolveRoot } from "./config.mjs";
 import { redactSecrets } from "./security.mjs";
 
@@ -478,11 +479,17 @@ export function getProcessStartTime(pid) {
       return parseProcStat(stat);
     } catch (_) {}
   }
+  if (process.platform === "darwin") {
+    try {
+      const out = execFileSync("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
+      return out.trim() || null;
+    } catch (_) {}
+  }
   return null;
 }
 
 /**
- * Checks if a PID is alive with PID-recycling start time validation on Linux.
+ * Checks if a PID is alive with PID-recycling start time validation on Linux and macOS.
  */
 export function isPidAlive(pid, expectedStartTime = null) {
   if (!pid || typeof pid !== "number") return false;
@@ -492,10 +499,10 @@ export function isPidAlive(pid, expectedStartTime = null) {
     if (err?.code !== "EPERM") return false;
   }
 
-  if (expectedStartTime !== null && expectedStartTime !== undefined && process.platform === "linux") {
+  if (expectedStartTime !== null && expectedStartTime !== undefined) {
     try {
       const actualStartTime = getProcessStartTime(pid);
-      if (!actualStartTime || String(actualStartTime) !== String(expectedStartTime)) {
+      if (actualStartTime && String(actualStartTime) !== String(expectedStartTime)) {
         return false;
       }
     } catch (_) {

package/src/tui.mjs

@@ -42,10 +42,11 @@ export function styleText(text, style) {
 }
 
 import { WizardCancelledError } from "./ux/terminal-session.mjs";
+import { createKeyDecoder } from "./ux/key-decoder.mjs";
 export { WizardCancelledError };
 
 /**
- * Read keypress in raw mode from TTY input stream.
+ * Read keypress in raw mode from TTY input stream without destroying stream on early return.
  * @param {import("node:stream").Readable} stream
  * @returns {AsyncGenerator<string, void, unknown>}
  */
@@ -54,20 +55,84 @@ async function* readKeypresses(stream = process.stdin) {
   if (stream.setRawMode) {
     stream.setRawMode(true);
   }
+
+  const decoder = createKeyDecoder();
+  const queue = [];
+  let waiting = null;
+  let error = null;
+
+  const onData = (chunk) => {
+    const events = decoder.push(chunk);
+    for (const ev of events) {
+      const str = ev.sequence;
+      if (waiting) {
+        const resolve = waiting;
+        waiting = null;
+        resolve({ value: str, done: false });
+      } else {
+        queue.push(str);
+      }
+    }
+  };
+
+  const onEnd = () => {
+    const flushed = decoder.flush();
+    for (const ev of flushed) {
+      queue.push(ev.sequence);
+    }
+    if (waiting) {
+      const resolve = waiting;
+      waiting = null;
+      if (queue.length > 0) {
+        resolve({ value: queue.shift(), done: false });
+      } else {
+        resolve({ done: true });
+      }
+    }
+  };
+
+  const onError = (err) => {
+    error = err;
+    if (waiting) {
+      const reject = waiting;
+      waiting = null;
+      reject(err);
+    }
+  };
+
+  stream.on("data", onData);
+  stream.on("end", onEnd);
+  stream.on("error", onError);
+
   stream.resume();
   stream.setEncoding("utf-8");
 
   try {
-    for await (const chunk of stream) {
-      const str = String(chunk);
-      if (str === "\u0003") {
+    while (true) {
+      if (error) throw error;
+      let nextVal;
+      if (queue.length > 0) {
+        nextVal = queue.shift();
+      } else {
+        const res = await new Promise((resolve) => {
+          waiting = resolve;
+        });
+        if (res.done) break;
+        nextVal = res.value;
+      }
+
+      if (nextVal === "\u0003") {
         // Ctrl+C SIGINT
         process.stdout.write(ANSI.showCursor + "\n");
         throw new WizardCancelledError("Wizard operation cancelled by user (SIGINT).");
       }
-      yield str;
+      yield nextVal;
     }
   } finally {
+    stream.off("data", onData);
+    stream.off("end", onEnd);
+    stream.off("error", onError);
+    stream.pause();
     if (stream.setRawMode) {
       stream.setRawMode(Boolean(wasRaw));
     }
@@ -135,11 +200,11 @@ export async function select(options, prompt, opts = {}) {
       }
 
       let moved = false;
-      if (key === "\u001b[A" || key === "k") {
+      if (key === "\u001b[A" || key === "\u001bOA" || key === "k") {
         // Up
         currentIdx = (currentIdx - 1 + options.length) % options.length;
         moved = true;
-      } else if (key === "\u001b[B" || key === "j") {
+      } else if (key === "\u001b[B" || key === "\u001bOB" || key === "j") {
         // Down
         currentIdx = (currentIdx + 1) % options.length;
         moved = true;
@@ -219,10 +284,10 @@ export async function multiSelect(options, prompt, opts = {}) {
       }
 
       let redraw = false;
-      if (key === "\u001b[A" || key === "k") {
+      if (key === "\u001b[A" || key === "\u001bOA" || key === "k") {
         currentIdx = (currentIdx - 1 + options.length) % options.length;
         redraw = true;
-      } else if (key === "\u001b[B" || key === "j") {
+      } else if (key === "\u001b[B" || key === "\u001bOB" || key === "j") {
         currentIdx = (currentIdx + 1) % options.length;
         redraw = true;
       } else if (key === " ") {
@@ -276,7 +341,20 @@ export async function input(prompt, opts = {}) {
     while (true) {
       const defaultHint = defaultValue ? ` ${ANSI.dim}(${defaultValue})${ANSI.reset}` : "";
       const query = `${ANSI.bold}${ANSI.cyan}?${ANSI.reset} ${ANSI.bold}${prompt}${defaultHint}: `;
-      const rawAns = await rl.question(query);
+      let rawAns;
+      try {
+        rawAns = await rl.question(query);
+      } catch (err) {
+        if (err.name === "AbortError" || err.code === "ABORT_ERR" || err.message?.includes("Ctrl+C")) {
+          stdout.write("\n");
+          throw new WizardCancelledError("Wizard operation cancelled by user (SIGINT).");
+        }
+        throw err;
+      }
+      if (rawAns.includes("\u0003") || rawAns.includes("\x03")) {
+        stdout.write("\n");
+        throw new WizardCancelledError("Wizard operation cancelled by user (SIGINT).");
+      }
       const ans = rawAns.trim() || defaultValue;
 
       const validRes = await validate(ans);

package/src/wizard-init.mjs

@@ -220,11 +220,20 @@ export function loadPresets(root = process.cwd()) {
 export async function runInitWizard(root = process.cwd(), options = {}) {
   const interactive = options.interactive !== false && isTTY(options.stdin || process.stdin);
 
-  if (!interactive && !options.allowDefaults && !options.tier) {
+  // Preserve existing config if present
+  let existingConfig = {};
+  const existingConfigPath = join(root, ".agent", "config.yml");
+  if (existsSync(existingConfigPath)) {
+    try {
+      existingConfig = parseYaml(readFileSync(existingConfigPath, "utf-8")) || {};
+    } catch (_) {}
+  }
+
+  if (!interactive && !options.allowDefaults && !options.tier && !existingConfig.tier) {
     throw new Error("Non-interactive init requires explicit options or allowDefaults: true");
   }
 
-  let selectedTier = options.tier || "pro";
+  let selectedTier = options.tier || existingConfig.tier || "pro";
   let testCmd = options.testCmd;
   let buildCmd = options.buildCmd;
   let selectedPresets = options.presets;
@@ -235,28 +244,35 @@ export async function runInitWizard(root = process.cwd(), options = {}) {
     await new Promise((resolve) => setTimeout(resolve, 300));
     sp.stop(`Detected Stack: ${oracle.stack}`);
 
+    const optionsList = tierOptions();
+    const defaultTierIdx = Math.max(0, optionsList.findIndex((t) => t.value === selectedTier));
+
     selectedTier = await select(
-      tierOptions(),
+      optionsList,
       "Which plan does your Jules account use? (limits are adjustable later)",
-      options
+      { ...options, defaultIdx: defaultTierIdx }
     );
 
     testCmd = await input("Verification Test Command", {
-      defaultValue: oracle.candidates.testCmd || "npm test",
+      defaultValue: testCmd || existingConfig.verify?.test || oracle.candidates.testCmd || "npm test",
       stdin: options.stdin,
       stdout: options.stdout,
     });
 
     buildCmd = await input("Verification Build Command", {
-      defaultValue: oracle.candidates.buildCmd || "",
+      defaultValue: buildCmd || existingConfig.verify?.build || oracle.candidates.buildCmd || "",
       stdin: options.stdin,
       stdout: options.stdout,
     });
 
+    const defaultPresetSet = new Set(
+      selectedPresets || existingConfig.presets || BUILTIN_PRESETS.map((p) => p.id)
+    );
+
     const presetOptions = BUILTIN_PRESETS.map((p) => ({
       label: p.title,
       value: p.id,
-      checked: true,
+      checked: defaultPresetSet.has(p.id),
       description: p.description,
     }));