@alisio/core 0.1.0-alpha.9 → 0.1.1

package/dist/application.js

@@ -1,9 +1,26 @@
+import { realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { AgentDefinitionService } from "./agents/service.js";
+import { CapabilityGrants } from "./analysis/capabilities.js";
+import { DatasetService } from "./analysis/data/datasets.js";
+import { AnalysisJanitor } from "./analysis/janitor.js";
+import { AnalysisJobs } from "./analysis/jobs.js";
+import { OciRuntime } from "./analysis/oci.js";
+import { AnalysisRerun } from "./analysis/rerun.js";
+import { AnalysisRuntimeManager } from "./analysis/runtime-manager.js";
+import { createArtifactPublisher } from "./artifacts/publisher.js";
+import { ArtifactStore } from "./artifacts/store.js";
+import { TaskJanitor } from "./background/janitor.js";
+import { subagentTasks } from "./background/mirror.js";
+import { BackgroundTasks } from "./background/service.js";
 import { configFile, configHome, loadConfigWithProvenance, overridesSavedProviderProfile, setConfigValue, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, stateHome, } from "./config.js";
 import { completeText } from "./core/compaction.js";
+import { DEFAULT_MAX_OUTPUT_TOKENS } from "./core/output-limit.js";
 import { ToolRegistry } from "./core/registry.js";
 import { AgentRunner } from "./core/runner.js";
+import { GoalService } from "./goal/service.js";
+import { GoalStore } from "./goal/store.js";
 import { HerdrBridge } from "./integrations/herdr.js";
 import { McpConnector } from "./mcp/connector.js";
 import { discoverPlugins, PluginHost } from "./plugins/host.js";
@@ -13,10 +30,21 @@ import { ProviderSettingsStore } from "./providers/settings.js";
 import { ProjectContext } from "./resources/context.js";
 import { expandSlashPrompt, loadPromptTemplates, promptSources } from "./resources/prompts.js";
 import { Skills, skillRoots } from "./resources/skills.js";
+import { PathAccess } from "./runtime/access.js";
+import { BlobStore } from "./runtime/blobs.js";
 import { isPathSpec } from "./runtime/modules.js";
 import { findWorkspace } from "./runtime/paths.js";
 import { SQLiteStore } from "./runtime/store.js";
 import { ChildSessions } from "./sessions/children.js";
+import { SideQuestions } from "./sessions/side-questions.js";
+import { registerGoalTools } from "./tools/goal.js";
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Cap per teardown stage of `app.close()`: exit must never wait longer than this on a hanging
+ * component (MCP server, provider, plugin). Stages run in parallel where independent and
+ * failures are swallowed, so teardown errors never replace the caller's result.
+ */
+const TEARDOWN_STAGE_TIMEOUT_MS = 2_500;
 /** A built-in runs unless its config sets `enabled: false` or it is disabled by id. */
 export function enabledBuiltins(available, config, disabled = []) {
     for (const id of [...Object.keys(config), ...disabled])
@@ -52,7 +80,28 @@ export async function createApplication(options = {}) {
     // a project value (see loadConfigWithProvenance), so a project cannot grant itself MCP consent.
     const mcpAllow = config.mcp.allow === true;
     let persistedMcpAllow = mcpAllow;
+    // Extra tool roots: config `additionalDirectories` (already canonicalized on load) plus per-run
+    // `--add-dir` (resolved against the current directory). Ignored entirely under --read-only, so
+    // the flag and the config key can never widen a locked session.
+    const addDirs = options.readOnly
+        ? []
+        : await Promise.all((options.addDirs ?? []).map((dir) => realpath(resolve(cwd, dir)).catch(() => resolve(cwd, dir))));
+    const pathAccess = new PathAccess({
+        workspace,
+        extraRoots: [...config.additionalDirectories, ...addDirs],
+        ...(options.approveExternalDirectory && !options.readOnly
+            ? { approve: options.approveExternalDirectory }
+            : {}),
+        readOnly: !!options.readOnly,
+    });
     const store = new SQLiteStore(options.db ?? join(stateHome(), "sessions.sqlite"));
+    // Content-addressed attachment bytes next to the session database (no I/O until `put`).
+    const blobs = new BlobStore({
+        root: options.db && options.db !== ":memory:"
+            ? join(dirname(options.db), "blobs")
+            : join(stateHome(), "blobs"),
+        db: store.db,
+    });
     const registry = new ToolRegistry(), skills = new Skills({ overrides: config.skillOverrides }), context = new ProjectContext(workspace, {
         globalDir: configHome(),
         cwd,
@@ -234,7 +283,150 @@ export async function createApplication(options = {}) {
         }, {
             config: config.websearch,
             resolveExtension: () => plugins.extensions.resolve("websearch"),
+        }, pathAccess);
+        // Python analysis and artifacts live next to the session database (like attachment blobs).
+        const stateRoot = options.db && options.db !== ":memory:" ? dirname(options.db) : stateHome();
+        const artifacts = new ArtifactStore({
+            root: stateRoot,
+            db: store.db,
+            limits: {
+                maxFiles: config.analysis.limits.maxFiles,
+                maxFileBytes: config.analysis.limits.maxFileBytes,
+                maxOutputBytes: config.analysis.limits.maxOutputBytes,
+            },
+        });
+        const capabilityGrants = new CapabilityGrants({
+            db: store.db,
+            rootOf: (id) => store.rootOf(id),
+        });
+        const analysisRuntime = options.analysisRuntime ??
+            new AnalysisRuntimeManager({
+                stateDir: stateRoot,
+                ...(options.python ? { python: options.python } : {}),
+            });
+        const analysisJobs = new AnalysisJobs({ root: stateRoot, db: store.db });
+        // Container mode (`analysis.runtime: "oci"`): read from the live config on every call.
+        let ociRuntime;
+        const oci = {
+            mode: () => config.analysis.runtime,
+            runtime: () => {
+                const key = JSON.stringify(config.analysis.oci);
+                if (ociRuntime?.key !== key)
+                    ociRuntime = {
+                        key,
+                        runtime: new OciRuntime({ ...config.analysis.oci }, options.analysisOci),
+                    };
+                return ociRuntime.runtime;
+            },
+        };
+        // Tabular datasets (one SQLite file each); XLSX needs the discovered Python.
+        const datasets = new DatasetService({
+            root: stateRoot,
+            db: store.db,
+            limits: config.analysis.data,
+            python: analysisRuntime,
         });
+        const analysisRerun = new AnalysisRerun({ jobs: analysisJobs, store: artifacts, datasets });
+        // Retention: a sweep at most every 24 h, launched in the background after the start.
+        const janitor = new AnalysisJanitor({
+            root: stateRoot,
+            db: store.db,
+            artifacts,
+            datasets,
+            blobs,
+            retention: () => config.analysis.retention,
+            ...(options.analysisSweepDelayMs !== undefined
+                ? { initialDelayMs: options.analysisSweepDelayMs }
+                : {}),
+        });
+        // Background tasks: a service over the shared database (state change = compare-and-set), logs
+        // under `<state>/tasks/`. Tasks of a dead owner process (a previous run) become `lost` now.
+        const tasks = new BackgroundTasks({
+            db: store.db,
+            stateRoot,
+            rootOf: (id) => store.rootOf(id),
+            limits: () => config.tasks,
+            readOnly: !!options.readOnly,
+            ...(options.tasks?.wake ? { wake: options.tasks.wake } : {}),
+            ...(options.tasks?.onChange ? { onChange: options.tasks.onChange } : {}),
+            ...(options.tasks?.timing ? { timing: options.tasks.timing } : {}),
+            ...(options.tasks?.maxPerProcess ? { maxPerProcess: options.tasks.maxPerProcess } : {}),
+            ...(options.tasks?.killGraceMs ? { killGraceMs: options.tasks.killGraceMs } : {}),
+            mirror: (root) => subagentTasks(plugins.panels, root),
+            onError: (error) => process.stderr.write(`Background task error: ${error instanceof Error ? error.message : String(error)}\n`),
+        });
+        tasks.recover();
+        const taskJanitor = new TaskJanitor({
+            store: tasks.store,
+            stateRoot,
+            retentionDays: () => config.tasks.retentionDays,
+            ...(options.tasks?.sweepDelayMs !== undefined
+                ? { initialDelayMs: options.tasks.sweepDelayMs }
+                : {}),
+        });
+        if (config.tasks.enabled) {
+            const { registerBackgroundTools } = await import("./tools/background.js");
+            registerBackgroundTools(registry, { tasks, rootOf: (id) => store.rootOf(id) });
+        }
+        // Session goals (`/goal`): one service over the shared database. A goal left `active` by a
+        // process that is gone pauses with reason `restart` now (never auto-resumed). The two goal
+        // tools are opt-in: a run only sees them while its session has an active goal.
+        const goals = new GoalService({
+            store: new GoalStore(store.db),
+            settings: () => config.goal,
+            ...(options.goals?.onChange ? { onChange: options.goals.onChange } : {}),
+            ...(options.goals?.onLog ? { onLog: options.goals.onLog } : {}),
+        });
+        if (options.goals?.recover !== false)
+            goals.recover();
+        registerGoalTools(registry, { goals });
+        // R4: nothing is registered with analysis disabled or under --read-only. Startup only looks
+        // for candidate interpreters with `stat`; no process is launched until the first call.
+        const analysisEnabled = config.analysis.enabled && !options.readOnly;
+        if (analysisEnabled) {
+            const [candidates, active] = await Promise.all([
+                analysisRuntime.candidates(),
+                analysisRuntime.activeRuntime(),
+            ]);
+            const { registerAnalysisTools } = await import("./tools/analysis.js");
+            registerAnalysisTools(registry, {
+                store: artifacts,
+                jobs: analysisJobs,
+                runtime: analysisRuntime,
+                datasets,
+                oci,
+                rerun: analysisRerun,
+                rootOf: (id) => store.rootOf(id),
+                // Read live: a changed `analysis.limits.*` setting applies to the next call.
+                limits: {
+                    get timeoutMs() {
+                        return config.analysis.limits.timeoutMs;
+                    },
+                    get maxLogBytes() {
+                        return config.analysis.limits.maxLogBytes;
+                    },
+                },
+                startup: { candidates: candidates.length > 0, extras: active?.extras ?? [] },
+            });
+            const { registerArtifactTools } = await import("./tools/artifacts.js");
+            registerArtifactTools(registry, { store: artifacts, rootOf: (id) => store.rootOf(id) });
+        }
+        // `exit_plan` (opt-in: only the plan agent's run sees it): the plan review hand-over.
+        const { registerExitPlan } = await import("./plan/exit-plan.js");
+        registerExitPlan(registry, { store, ui: plugins.ui, readOnly: !!options.readOnly });
+        // Data tools only read (effect `read`): they stay available under --read-only.
+        if (config.analysis.enabled) {
+            const { registerDataTools } = await import("./tools/data.js");
+            registerDataTools(registry, { datasets, rootOf: (id) => store.rootOf(id) });
+        }
+        const sessionWorkspace = (sessionId) => {
+            try {
+                return store.get(sessionId).workspace;
+            }
+            catch {
+                return workspace;
+            }
+        };
         const { registerPluginInstallTool } = await import("./plugins/install.js");
         registerPluginInstallTool(registry, { readOnly: !!options.readOnly });
         if ((options.allowMcp || mcpAllow) && !options.readOnly)
@@ -475,6 +667,7 @@ export async function createApplication(options = {}) {
         const runtimePolicy = {
             write: !!options.allowWrite && !options.readOnly,
             process: !!options.allowProcess && !options.readOnly,
+            ...(options.allowAnalysis && !options.readOnly ? { analysis: true } : {}),
             external: !options.readOnly &&
                 (!!options.allowExternal ||
                     !!options.allowMcp ||
@@ -483,6 +676,52 @@ export async function createApplication(options = {}) {
                     plugins.externalCount > 0 ||
                     registry.list().some((t) => t.name.startsWith("p_"))),
         };
+        /** Model and provider of a session, for the provenance of its artifacts. */
+        const provenanceOf = (sessionId) => {
+            try {
+                const session = store.get(sessionId);
+                return {
+                    ...(session.model ? { model: session.model } : {}),
+                    ...(session.provider ? { provider: session.provider } : {}),
+                };
+            }
+            catch {
+                return {};
+            }
+        };
+        /**
+         * The maximum output a model's catalog declares (`ModelInfo.maxOutputTokens`), for the budget
+         * of each request. Looks in the active provider's catalog first (loading it once, bounded, if
+         * the first request comes before it); then in the catalogs of the configured profiles that
+         * were already listed, taking the smallest declaration when several providers list the same
+         * model id so a derived budget never exceeds any of them. Unknown stays unknown.
+         */
+        const declaredOutputLimit = async (model) => {
+            if (!models.has(model)) {
+                const loading = ensureModels();
+                if (loading) {
+                    let timer;
+                    await Promise.race([
+                        loading.catch(() => undefined),
+                        new Promise((resolve) => {
+                            timer = setTimeout(resolve, 2_000);
+                        }),
+                    ]);
+                    if (timer)
+                        clearTimeout(timer);
+                }
+            }
+            const own = models.get(model)?.maxOutputTokens;
+            if (own !== undefined)
+                return own;
+            const declared = catalogCache
+                ? availableProviderModels(catalogCache.value)
+                    .filter((entry) => entry.model.id === model)
+                    .map((entry) => entry.model.maxOutputTokens)
+                    .filter((value) => typeof value === "number" && value > 0)
+                : [];
+            return declared.length ? Math.min(...declared) : undefined;
+        };
         const runner = new AgentRunner({
             provider,
             providerFor,
@@ -495,7 +734,43 @@ export async function createApplication(options = {}) {
             compaction: config.compaction,
             extensions: plugins,
             contextWindow,
+            modelOutputLimit: declaredOutputLimit,
+            fallbackMaxOutputTokens: DEFAULT_MAX_OUTPUT_TOKENS,
+            effortLevels: (model) => {
+                const known = models.get(model)?.effort;
+                if (!known)
+                    void ensureModels();
+                return known;
+            },
             ...(options.approve && !options.readOnly ? { approve: options.approve } : {}),
+            pathAccess,
+            ...(analysisEnabled
+                ? {
+                    capabilities: {
+                        granted: (capability, sessionId) => capabilityGrants.granted(capability, sessionId),
+                        record: (input) => {
+                            capabilityGrants.record({ ...input, workspace: sessionWorkspace(input.sessionId) });
+                        },
+                        source: options.approvalSource ?? "tui",
+                        get runtime() {
+                            return config.analysis.runtime;
+                        },
+                        // A rerun's approval shows the saved script (the input carries only its reference).
+                        preview: async (input, sessionId) => typeof input.rerunOf === "string"
+                            ? analysisRerun.script(input.rerunOf, store.rootOf(sessionId))
+                            : undefined,
+                    },
+                }
+                : {}),
+            artifacts: (call, announce) => createArtifactPublisher(artifacts, {
+                sessionId: call.sessionId,
+                rootSessionId: store.rootOf(call.sessionId),
+                workspace: sessionWorkspace(call.sessionId),
+                runId: call.runId,
+                callId: call.callId,
+                // Public provenance of what produced the artifact (no paths, no keys).
+                provenance: provenanceOf(call.sessionId),
+            }, announce),
             ...(config.websearch.provider === "native"
                 ? { nativeTools: [{ type: config.websearch.nativeToolType }] }
                 : {}),
@@ -508,6 +783,10 @@ export async function createApplication(options = {}) {
         // Child sessions (generic delegation service for plugins). Contexts are cached per workspace
         // so a child in a git worktree reads that worktree's AGENTS.md files.
         const contexts = new Map([[workspace, context]]);
+        // Startup reconciliation: runs left queued/running by a dead process become `interrupted`
+        // (runs of this process, e.g. another Application in a server, are kept). Child sessions are
+        // reconciled by `interruptStale()` in the ChildSessions constructor right below.
+        store.interruptRuns();
         plugins.setSessions(new ChildSessions({
             store,
             runner,
@@ -574,12 +853,43 @@ export async function createApplication(options = {}) {
                 }
             }
         }
+        // Retention runs in the background (unreferenced timer); never for in-memory test databases.
+        if (analysisEnabled && options.db !== ":memory:")
+            janitor.start();
+        // Retention is maintenance that deletes files: never under --read-only, never for `:memory:`.
+        if (options.db !== ":memory:" && !options.readOnly)
+            taskJanitor.start();
         return {
             workspace,
+            pathAccess,
             config,
             prompts,
             expandPrompt,
             store,
+            /** Uploaded attachment bytes; resolve a `BlobRef` with `blobs.attachment(ref)` before a run. */
+            blobs,
+            /** Published artifacts of every session (folders under `<state>/artifacts`). */
+            artifacts,
+            /** Persisted capability grants (`analysis.run`) and their audit rows. */
+            capabilityGrants,
+            /** Background tasks (`bg_*` tools, `/tasks` panels): admission, state, output, stop. */
+            tasks,
+            /** Session goals (`/goal`): state, user actions, the continuation controller. */
+            goals,
+            /** Python discovery and job folders of `python_run`; `enabled` is false under --read-only. */
+            analysis: {
+                enabled: analysisEnabled,
+                runtime: analysisRuntime,
+                jobs: analysisJobs,
+                /** Container runtime of the current configuration (status, pull); mode `managed` ignores it. */
+                oci,
+                rerun: analysisRerun,
+                janitor,
+            },
+            /** Keys a project layer set that only the user layer decides (ignored on load). */
+            configDiagnostics: configProvenance.ignored ?? [],
+            /** Tabular datasets of every session (ingestion, read-only queries, pages). */
+            datasets,
             registry,
             context,
             skills,
@@ -672,12 +982,15 @@ export async function createApplication(options = {}) {
             mcpStartupFailures() {
                 return [...mcpStartupFailures];
             },
-            /** Host-owned interactive consent boundary. Headless callers remain blocked unless flagged. */
+            /**
+             * Host-owned interactive consent boundary: the TUI and the web UI (`alisio serve`, after an
+             * explicit confirmation dialog) may grant. Headless callers remain blocked unless flagged.
+             */
             grantMcpRuntimePermission(request) {
                 if (!request.confirmed)
                     return mcpRuntimePermission;
-                if (request.source !== "interactive-tui")
-                    throw new Error("MCP runtime permission may only be granted by the interactive TUI");
+                if (request.source !== "interactive-tui" && request.source !== "interactive-web")
+                    throw new Error("MCP runtime permission may only be granted by an interactive UI");
                 if (options.readOnly)
                     throw new Error("MCP is unavailable under --read-only");
                 if (mcpRuntimePermission === "granted")
@@ -688,12 +1001,12 @@ export async function createApplication(options = {}) {
                 return mcpRuntimePermission;
             },
             /** Persist global consent atomically, then grant runtime permission for this process. */
-            async rememberGlobalMcpConsent() {
+            async rememberGlobalMcpConsent(source = "interactive-tui") {
                 if (options.readOnly)
                     throw new Error("MCP is unavailable under --read-only");
                 await setGlobalMcpAllow({ allow: true });
                 persistedMcpAllow = true;
-                this.grantMcpRuntimePermission({ source: "interactive-tui", confirmed: true });
+                this.grantMcpRuntimePermission({ source, confirmed: true });
             },
             /**
              * Clear the persisted global consent atomically and drop the runtime permission (disconnecting
@@ -736,6 +1049,8 @@ export async function createApplication(options = {}) {
              * (next instructions load), `websearch.provider` mutates the shared config object the search
              * chain reads per call, `pluginHooks.timeoutMs` lands in the plugin host (next hook call),
              * and `tui.*` is persisted for the host to apply. Nothing in this set requires a restart.
+             * `agents.*` (active agent id and reasoning effort) is persisted for the TUI to consume:
+             * the next `/agents`/`/effort` selection and the next prompt already read the live config.
              * `mcp.allow` is deliberately not routed here: it flows through
              * `rememberGlobalMcpConsent`/`revokeGlobalMcpConsent` instead.
              * Throws under `--read-only`. Returns the written config file.
@@ -767,6 +1082,9 @@ export async function createApplication(options = {}) {
                     case "limits.maxTurns":
                     case "limits.maxOutputTokens":
                     case "limits.maxContextChars":
+                    case "limits.firstTokenTimeoutMs":
+                    case "limits.firstTokenRetries":
+                    case "limits.truncationRecoveries":
                     case "limits.timeoutMs": {
                         const patch = limitLeaf(key.slice("limits.".length));
                         config.limits = { ...config.limits, ...patch };
@@ -780,9 +1098,74 @@ export async function createApplication(options = {}) {
                     case "tui.paddingX":
                         config.tui = { ...config.tui, paddingX: Number(value) };
                         break;
+                    case "tui.contentPaddingX":
+                        config.tui = { ...config.tui, contentPaddingX: Number(value) };
+                        break;
                     case "tui.skillSlashCommands":
                         config.tui = { ...config.tui, skillSlashCommands: value === true };
                         break;
+                    case "agents.active":
+                        config.agents = { ...config.agents, active: String(value) };
+                        break;
+                    case "agents.effort":
+                        // Clearing (undefined) drops the leaf from the live config and the JSON file.
+                        config.agents =
+                            value === undefined
+                                ? { active: config.agents.active }
+                                : { ...config.agents, effort: String(value) };
+                        break;
+                    case "analysis.enabled":
+                        // Tools are registered when the application starts: the change applies to the next
+                        // application (a restart; the web recycles the workspace application).
+                        config.analysis = { ...config.analysis, enabled: value === true };
+                        break;
+                    case "analysis.limits.timeoutMs":
+                        // Read live by python_run on its next call.
+                        config.analysis = {
+                            ...config.analysis,
+                            limits: { ...config.analysis.limits, timeoutMs: Number(value) },
+                        };
+                        break;
+                    case "analysis.retention.jobsDays":
+                    case "analysis.retention.intermediateDays":
+                    case "analysis.retention.artifactsDays": {
+                        // Read by the next sweep.
+                        const leaf = key.slice("analysis.retention.".length);
+                        config.analysis = {
+                            ...config.analysis,
+                            retention: { ...config.analysis.retention, [leaf]: Number(value) },
+                        };
+                        break;
+                    }
+                    case "goal.enabled":
+                    case "goal.maxTurns":
+                    case "goal.maxMinutes":
+                    case "goal.repeatedReplyLimit":
+                    case "goal.noToolTurnsLimit":
+                    case "goal.blockedRepeats": {
+                        // Read live: the next continuation (or the next `/goal`) uses the new value. The caps
+                        // of a goal already running were snapshotted when it was created.
+                        const leaf = key.slice("goal.".length);
+                        config.goal = {
+                            ...config.goal,
+                            [leaf]: leaf === "enabled" ? value === true : Number(value),
+                        };
+                        break;
+                    }
+                    case "tasks.enabled":
+                        // Tools are registered when the application starts: the change applies to the next
+                        // application (a restart; the web recycles the workspace application).
+                        config.tasks = { ...config.tasks, enabled: value === true };
+                        break;
+                    case "tasks.maxPerSession":
+                    case "tasks.maxRunMs":
+                    case "tasks.maxOutputBytes":
+                    case "tasks.retentionDays": {
+                        // Read live: the next task (or the next sweep) uses the new value.
+                        const leaf = key.slice("tasks.".length);
+                        config.tasks = { ...config.tasks, [leaf]: Number(value) };
+                        break;
+                    }
                     case "websearch.provider":
                         // Mutated in place (same object identity) so the tool chain's per-call
                         // `websearchCtx.config` sees the new provider on the very next search call.
@@ -802,6 +1185,40 @@ export async function createApplication(options = {}) {
                 return providerInfo;
             },
             runner,
+            /** `/btw` side questions: tool-less answers about a session outside its conversation. */
+            sideQuestions: new SideQuestions({ runner, state: store }),
+            /**
+             * User agent files (`<workspace>/.agents/agents`, `~/.agents/agents`). Every write asks the
+             * subagents plugin (the runtime agent registry) to rediscover through its `/agents reload`
+             * verb and reports whether the saved file is loaded; without the plugin nothing reloads.
+             */
+            agentDefinitions: new AgentDefinitionService({
+                workspace,
+                home: homedir(),
+                registry: {
+                    async reload() {
+                        const handler = plugins.commands.get("agents");
+                        if (!handler)
+                            return false;
+                        await handler("reload");
+                        return Array.isArray(plugins.pluginState("subagents", "definitions"));
+                    },
+                    loadedPaths() {
+                        let state;
+                        try {
+                            state = plugins.pluginState("subagents", "definitions");
+                        }
+                        catch {
+                            return undefined;
+                        }
+                        if (!Array.isArray(state))
+                            return undefined;
+                        return state
+                            .map((entry) => entry?.path)
+                            .filter((path) => typeof path === "string");
+                    },
+                },
+            }),
             herdr,
             contextWindow,
             /** Effective context budget + compaction point shared by the runner and the TUI bar. */
@@ -900,24 +1317,34 @@ export async function createApplication(options = {}) {
                 });
             },
             async close() {
+                // Exit latency is user-facing: tear down herdr + MCP in parallel, then provider +
+                // plugins (store last). Every stage is raced against a cap so a single hanging
+                // component cannot stall /exit; teardown errors are swallowed for callers.
+                const capped = (work) => Promise.race([work.catch(() => { }), delay(TEARDOWN_STAGE_TIMEOUT_MS)]);
                 try {
-                    await herdr.close();
-                    await mcp.close();
+                    janitor.stop();
+                    taskJanitor.stop();
+                    datasets?.close();
+                    // Tasks first in the same stage: they end with Alisio (process groups killed).
+                    await capped(Promise.allSettled([herdr.close(), mcp.close(), tasks.close()]));
                 }
                 finally {
                     try {
-                        await provider.dispose();
-                        await Promise.allSettled([
-                            ...new Set([
+                        await capped((async () => {
+                            const runtimes = new Set([
                                 ...(await Promise.allSettled(targetProviders.values()))
                                     .filter((x) => x.status === "fulfilled")
                                     .map((x) => x.value),
                                 ...retainedProviders,
-                            ]),
-                        ]
-                            .filter((runtime) => runtime !== provider.currentProvider)
-                            .map((runtime) => Promise.resolve(runtime.dispose?.())));
-                        await plugins.close();
+                            ]);
+                            await Promise.allSettled([
+                                provider.dispose(),
+                                ...[...runtimes]
+                                    .filter((runtime) => runtime !== provider.currentProvider)
+                                    .map((runtime) => Promise.resolve(runtime.dispose?.())),
+                                plugins.close(),
+                            ]);
+                        })());
                     }
                     finally {
                         store.close();
@@ -927,9 +1354,10 @@ export async function createApplication(options = {}) {
         };
     }
     catch (e) {
-        await herdr.close();
-        await mcp.close();
-        await plugins.close();
+        await Promise.race([
+            Promise.allSettled([herdr.close(), mcp.close(), plugins.close()]),
+            delay(TEARDOWN_STAGE_TIMEOUT_MS),
+        ]);
         store.close();
         throw e;
     }

package/dist/artifacts/kinds.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Artifact type registry: the kind, the served MIME type and whether a rich client may preview a
+ * published file. The type comes from the extension AND the leading bytes; when they disagree the
+ * most restrictive type wins (`file`, download only). The served `Content-Type` always comes from
+ * here, never from the script that wrote the file.
+ */
+import type { ArtifactKind } from "@alisio/sdk";
+export interface ArtifactType {
+    kind: ArtifactKind;
+    mimeType: string;
+}
+export declare const DOWNLOAD_ONLY: ArtifactType;
+/** Lower-case extension without the dot (`""` when none). */
+export declare const extensionOf: (fileName: string) => string;
+/** Text: no NUL byte in the sampled head and the sample decodes as UTF-8. */
+export declare function looksLikeText(head: Uint8Array): boolean;
+/**
+ * The type of a file from its name and its first bytes (at least 4 KiB is a good sample). An
+ * unknown extension, or bytes that contradict the extension, yield `file` (download only).
+ * An empty file keeps the type of its extension.
+ */
+export declare function classifyArtifact(fileName: string, head: Uint8Array): ArtifactType;
+/** Whether a rich client may preview a file of this name, type and size. */
+export declare function isPreviewable(fileName: string, type: ArtifactType, bytes: number): boolean;
+/** English labels of each kind (the web localizes its own; text surfaces use these). */
+export declare const KIND_LABELS: Record<ArtifactKind, string>;
+/** The type the sandboxed viewer serves for one file (`application/octet-stream` when unknown). */
+export declare const viewerContentType: (fileName: string) => string;
+/**
+ * The registry type of one file inside an artifact (for the authenticated `files/*` route):
+ * the extension and the leading bytes decide, exactly like a published file.
+ */
+export declare function fileType(fileName: string, head: Uint8Array): ArtifactType & {
+    inline: boolean;
+};