@amalgm/shell 0.1.162 → 0.1.164-main.34182640231

package/PURPOSE.md

@@ -1,23 +1,137 @@
 # @amalgm/shell — Purpose
 
-The boot shell is the runtime rebuilt from lego bricks. It owns nothing but
-composition: process boot, host adapters, and the wiring that hands each
-published `@amalgm/*` SDK its dependencies. Every law lives in a brick; the
-shell only assembles.
+Amalgm Shell gives a user one dependable machine runtime assembled from the
+published `@amalgm/*` SDKs. An enabled installation should remain available
+while its host can execute, recover without opening a UI, contain a failing
+workload, and leave the machine's resources available for useful work. Shell
+owns composition, process boot, and native host effects; Core and the product
+SDKs own the decisions those effects execute.
+
+## Operating axioms
+
+These are the required operating contract, not a statement that every current
+installation satisfies it. The [operating contract](docs/operating-contract.md)
+defines the terms and examinations; the [September 2026 audit](docs/operating-audit-2026-09-05.md)
+records implementation gaps and historical evidence.
+The [release environments plan](docs/release-environments-plan.md) records the
+agreed CI/CD and update evolution; its target behavior is not yet delivered.
+
+- **O1 — Lifetime follows installation intent.** One installation owner keeps
+  the enabled runtime available independently of its launching UI or terminal
+  whenever the host can execute and the required machine state is accessible.
+- **O2 — Failure stays with its owner.** A failed workload degrades its own
+  capability and declared dependants without restarting its parent or unrelated
+  capabilities.
+- **O3 — Recovery has an end.** Automatic process recovery reaches sustained
+  health or a durable parked state within a finite attempt budget that parent
+  restarts and elapsed backoff cannot replenish.
+- **O4 — Health observation stays available.** Local control and liveness
+  perform bounded work independently of product readiness, cloud connectivity,
+  and workload size.
+- **O5 — Each decision has one repository owner.** Core owns portable kernel
+  policy, each product owns its domain policy, and Shell supplies composition
+  and machine effects through their public contracts.
+- **O6 — Resource use follows necessary work.** Every host resource has one
+  lifecycle owner and a declared bound, and idle operation performs no work
+  except explicitly budgeted health, lease, and reconciliation duties.
+
+The detailed axioms below remain binding. Their mechanisms must serve these
+operating rules; a parity-preserved behavior that violates one is a documented
+gap to resolve at its owning SDK, not a reason to perpetuate the violation.
 
 ## Axioms
 
-1. **The shell composes; it never implements.** If the shell needs a behavior,
-   that behavior belongs in a brick (or in `@amalgm/core` if it is kernel law).
-   The shell may only wire adapters, pass configuration, and mount routes.
+A materialized row proves local observation, not completed official delivery.
+An independent later observation starts from a settled basis only after earlier
+mutations are accepted, their matching Inbox records resolve, and Apply releases
+their intents; finite observation flushes do not promise global delivery silence.
+Apply retry reads revisit only the requested entities through indexed lookups
+and the same current eligibility rule used by paged discovery; page position
+cannot prevent a due entity from being reconsidered.
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+
+Shell owns both the internal `@amalgm/shell` package and the public `amalgm`
+distribution. One tested build supplies both archives; only package identity,
+version and the root lock identity differ. Each final archive passes the same
+native examinations before either becomes a managed public candidate. Public
+metadata records the exact internal archive it was derived from; no wrapper,
+copied Engine implementation or second dependency graph supplies runtime behavior.
+
+Consumer assembly reads dependencies from each declared package manifest and
+selects only registry candidates from the same managed branch. It changes exact
+pins and their locks in one reproducible composition change; the consumer's
+complete checks gate merging that exact tree against its unchanged base. Reconciliation keeps one
+pending change per branch, preserves human edits, and never republishes an
+unchanged consumer merely because a notification or check was repeated.
+
+1. **The shell implements host effects; SDKs own domain decisions.** Shell
+   assembles published capabilities, implements their native effect ports,
+   passes configuration, and mounts routes. A portable product decision belongs
+   in its product SDK; a portable kernel decision belongs in `@amalgm/core`.
+   A missing SDK port is repaired in that owner before Shell consumes it.
+   Each SDK remains usable without Shell. Live and Chat preserve their
+   Core-free dependency boundaries; Shell injects their host capabilities.
+   One installed runtime and command do not require one operating-system
+   process: isolation may change the host topology without changing SDK law.
 
    Agent-task execution is one example: Agents resolves the current immutable
    revision, Chat owns its new durable conversation and turn, Automations owns
    the queued step and retry key, and Shell only connects those capabilities
    to the selected machine's model, auth, Toolbox, and workspace bindings.
 
-2. **Bricks arrive through the registry.** Every `@amalgm/*` dependency is a
-   published npm version — never a `file:` link, never a copied source tree.
+The environment controller gives each signed-in user and validated binding one
+OS service outside every UI bundle. It holds an OS-released lease, publishes an
+authenticated control endpoint and supervises one child runtime over IPC. A
+missing heartbeat or a remembered PID never transfers ownership. A child exits
+when its controller disconnects; an intentional stop drains that child before
+releasing ownership. Service adapters derive their names from the same binding
+and never operate another environment's process.
+Every control mutation carries the expected user, binding and owner generation;
+the receiving controller verifies that identity before performing the mutation.
+Authenticating a response after an effect cannot authorize that effect.
+Layer 1 keeps one usable runtime available while the OS session can execute.
+Core supplies its retry allowance, backoff and health timings; Shell records
+each launch in a durable SQLite journal before spawning. Neither elapsed time,
+controller replacement nor repeated service starts grants another attempt.
+Only sustained ready IPC health or an explicit `service retry` resets the
+allowance. Exhaustion parks the child while its controller retains ownership,
+status and stop/retry control; intentional shutdown never launches a replacement.
+Native registration belongs to the current OS account even when the installation
+uses another data home. Windows Task Scheduler owns a hidden action in that
+account's logged-in session; the action owns controller exit recovery using
+Core's restart policy. Scheduler launch retries alone cannot recover a program
+that started successfully and then exited.
+Native service descriptions preserve literal arguments, environment values and
+working directories through the owning OS parser. Each directive uses its own
+grammar; unrepresentable input is refused before replacing a service description.
+Native Watch opens the OS-resolved physical directory; portable or short-name
+aliases cannot become a second path grammar inside a kernel handle.
+Persistent SQLite handles use the OS namespace for the selected file, including
+Windows extended paths; a host API's legacy path limit cannot select another file.
+An active installation from before the ownership protocol must exit once before
+its saved account can move to this controller; a remembered PID is neither a
+stop capability nor permission to start a second writer beside it.
+
+Every UI enters one finite setup operation. It serializes installation setup,
+selects the server-approved account, and either proves adoption without changing
+the runtime or acquires that account's runtime lease before enrollment. The OS
+service takes over only after the enrolling foreground owner has drained.
+The operating system selects the credential backend; choosing a data home never
+changes it. Examinations inject their credential store explicitly.
+
+2. **Managed bricks arrive through the registry.** Every production/preview
+   `@amalgm/*` dependency is an exact published npm version. Explicit local
+   development profiles may select local built SDKs; an absent local component
+   never silently falls back to a managed package or hosted service.
    Upgrading the runtime means bumping a version, not merging code. Registry
    proof runs under the supported Node executable that launched the gate;
    ambient package-manager shims are not runtime evidence.
@@ -29,16 +143,43 @@ shell only assembles.
    remain in the Engine, but they never run as a fallback beside a released
    Shell service.
 
-4. **One host, injected once.** Filesystem, sqlite, clock, network — the shell
-   builds each host adapter a single time at boot and threads it down. No brick
-   reaches for `process` or the disk on its own.
+4. **Each shared host capability has one scoped owner.** Shell constructs
+   shared adapters once for their installation scope and injects them instead
+   of letting consumers rediscover them. Product-owned resources stay behind
+   their SDK's public API: Apps, for example, owns its app processes and store,
+   and Shell never opens a second lifecycle owner for them. Portable SDK
+   decisions receive effects explicitly and never discover ambient process
+   state or disk on their own.
 
-5. **Bricks never update themselves; the shell updates.** Every `@amalgm/*`
+5. **Bricks never update themselves; the shell updates.** Every direct `@amalgm/*`
    dependency is pinned to an exact version — no ranges. Publishing a brick
    changes nothing on any user machine until the shell bumps its pin and ships
-   a new release through the existing npm dist-tag rail (one runtime label, one
-   tag). One version number, one atomic update, one combination that was
+   a new release through its lane's signed runtime authority. Registry tags
+   locate published artifacts; fresh TUF metadata selects installed adoption.
+   One version number, one atomic update, one combination that was
    actually tested together — never a per-brick drift of versions in the wild.
+   The shrinkwrap fixes the transitive graph as well; direct pins do not
+   imply that every consumer resolves the same Core version. Release proof
+   checks those actual resolutions and their public contracts, and upgrades
+   affected consumers deliberately instead of forcing an untested override.
+
+The installed runtime follows the [update axioms](src/updates/README.md).
+Each public managed package declares its controller, process and state-format
+contracts. The native bootstrap stays outside immutable packages and executes
+Core-authored launch intents; a single SQLite commit binds update policy to the
+next controller. Historical signatures identify an already installed baseline,
+and current TUF metadata alone authorizes its desired successor. Every candidate
+is staged with the locked package manager before the previous runtime drains;
+fenced state-format receipts decide whether recovery can safely open its data.
+Local profiles retain their selected sources and do not follow managed targets.
+
+5a. **One binding selects the whole installation.** Core's validated label,
+   exact source branch and local session select separate mutable roots,
+   credentials, databases, process owners and endpoints; production retains
+   `~/amalgm`, preview uses `~/amalgm-preview`, and local uses
+   `~/amalgm-dev/<session>`. Host effects reserve physical writable roots before
+   use, including aliases and enclosing paths, so a second installation cannot
+   become another writer of the same ground.
 
 6. **Authentication exemptions transfer authority; they do not remove it.**
    Every exempt prefix is explicit and narrow, and the mounted brick must
@@ -799,7 +940,8 @@ shell only assembles.
 
 60. **Runtime binding is proved, never inferred.** A platform adapter adopts
     an existing runtime only when Shell's published loopback address answers
-    its authenticated health probe for the selected user and runtime label. A
+    its authenticated identity probe for the selected user, device, environment,
+    exact branch, local session, and process generation. A
     durable ready registration with no answering runtime may be resumed; an
     absent or incomplete registration requires login. A UI marker, PID, open
     port, or installed executable alone is never service readiness.
@@ -815,7 +957,11 @@ shell only assembles.
 
 62. **PTY is one authenticated Shell host capability.** The running machine
     runtime mounts the Core-owned PTY contract through Shell's native process
-    adapter and closes every spawned process with that runtime. A UI targeting
+    adapter and retains every spawned terminal until native exit, including
+    sessions already removed from the public catalog. Runtime close seals new
+    terminal admission and drains all terminals concurrently: one second permits
+    hangup, then forced termination must prove exit within five seconds before
+    close succeeds. A UI targeting
     this computer connects through the published authenticated loopback
     binding; only a different computer uses the remote relay. Electron never
     creates a second PTY implementation. A session with no explicit working

package/README.md

@@ -4,6 +4,19 @@ The Amalgm runtime, assembled from published `@amalgm/*` SDK capabilities.
 This repository owns their host composition; see [PURPOSE.md](PURPOSE.md) for
 the axioms.
 
+Start with the [operating contract](docs/operating-contract.md) for always-on
+operation, failure containment, repository ownership, and performance gates.
+The [history and implementation audit](docs/operating-audit-2026-09-05.md)
+separates those requirements from current evidence. Persistent OS supervision
+and subsystem crash isolation are not yet certified for this Shell release;
+`amalgm run` currently runs the composed runtime in the foreground.
+The [runtime hardening plan](docs/runtime-hardening-plan.md) gives the
+implementation sequence, owning repositories, and acceptance gates.
+The [release environments and update plan](docs/release-environments-plan.md)
+records the three CI/CD workstreams: environment bindings, deployment to all
+supported surfaces, and background updates. It includes partial local development,
+the public `amalgm` bootstrap target and the two in-progress engineering skills.
+
 The signed runtime composes Core + Files + Agents + Tools + Chat. Agents owns
 identity and immutable revision resolution; Chat alone owns durable
 conversations, turns, reconnect, and interrupt; Shell supplies the host effects
@@ -38,6 +51,9 @@ Provider credentials are never accepted through UI payloads, local credential
 resolution, or environment variables. Products use an injected broker adapter
 that creates a fresh DPoP proof for each protected request.
 
+The [login and setup contract](docs/login-setup.md) records the browser/CLI
+boundary and the shared credential-bearing HTTP guarantees.
+
 ## Run
 
 ```bash
@@ -79,20 +95,67 @@ printf '%s\n' '{"name":"Daily review"}' \
   | npx --package @amalgm/shell amalgm automations create --stdin --user person@example.com
 ```
 
-Requires Node ≥ 20.19 (native `require(esm)` support; all bricks are ESM).
-
-Package releases use `.github/workflows/publish-package.yml`. A reviewed clean
-main commit is tagged exactly `v<package version>`; the workflow verifies and
-publishes that exact package using the `npm-release` environment. Manual
-dirty-worktree publishing is not a release path. The release workflow also
-installs the packed Shell in a clean temporary project and runs the public
-authorization/Chat E2E against the exact registry versions in `package.json`.
+Requires Node ≥ 24 and npm ≥ 11.19.1 < 12.
+
+## Keep the runtime running
+
+`amalgm setup` enrolls the machine and starts its independent OS service.
+The service belongs to the logged-in OS account and survives closing a UI
+or terminal. Use `amalgm service status --user EMAIL` to inspect its controller,
+runtime phase, recovery attempts and last failure. `service stop` drains it;
+`service start` resumes the registered service.
+
+The controller permits an initial launch and eight retries, with backoff capped
+at 30 seconds. Attempts are committed to SQLite before launch and survive
+controller replacement, logout/login and reboot. A ready runtime that answers
+IPC health probes for 30 seconds earns a fresh allowance. Failed launch,
+startup timeout, loss of IPC health and premature exit consume the same budget.
+If it is exhausted, the runtime is parked and the controller remains available.
+After correcting the failure, run `amalgm service retry --user EMAIL` to grant
+another bounded allowance. Repeated start/install calls do not erase failures.
+Portable mode needs an external foreground owner; it does not install an OS service.
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+This owner also derives the public `amalgm` distribution from that packed Shell.
+Every implementation file and locked dependency remains identical; only the
+package identity, version and root lock identity change. Public metadata names
+the exact internal archive and integrity. Both archives pass all native gates
+before either publishes. UI composition selects the public candidate once it is
+available and checks that candidate through its ordinary setup/native gates.
+The existing public registry release is still Engine; candidate construction is
+not a public channel cutover. Its four legacy delivery workflows are disabled.
+
+The release workflow also exercises the packed Shell authorization/Chat path.
 The published `npm-shrinkwrap.json` fixes the complete dependency tree, and
 that examination rejects any installed direct dependency that differs from it.
 
-Every push to `main` and every pull request runs the complete suite plus the
-isolated real-kernel Watch examination on GitHub-hosted Linux, macOS, and
-Windows machines. This certifies the same create, change, rename, move, delete,
+Every main/preview push and pull request requests the package and binding gate
+followed by native OS service and Watch examinations on Linux, macOS and
+Windows. Passing those native jobs certifies the same create, change, rename, move, delete,
 `.git` appearance/disappearance, and root-address mutations on every supported
 watcher backend. Production Fly/R2 examinations remain separate: CI proves the
 platform adapter, while the deployed examination proves the real cloud path.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The scoped release App triggers ordinary CI. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Release App credentials remain an
+external prerequisite; no paid branch-protection or auto-merge feature is needed.

package/config/releases/trust/runtime/main.root.json

@@ -0,0 +1,84 @@
+{
+  "signatures": [
+    {
+      "keyid": "171e413c9b42c3103c93f1cddf3c64092c15d7e93ef0a7bbb57a2c6596536d2d",
+      "sig": "f6b50faf8da046a8f65f50f235d32feb3e4bc3297cd277814eea45c956638e193178115bfa2e92facfea82c996508aed77afecdda5df17f74f64ae2997f21a04"
+    },
+    {
+      "keyid": "72178b873f31dcef2f34b0ee925d6c9e896af029054fe7bc5c15ae25b0b133bf",
+      "sig": "9b1910b53cc2f1416b60d1b56c48d714f59fdc378c18adca8a499632b0a2820fdd5480db7a0dc570b02726721a034fe6e1339be418015420045bbd75b8836f00"
+    }
+  ],
+  "signed": {
+    "_type": "root",
+    "spec_version": "1.0.31",
+    "version": 1,
+    "expires": "2029-09-07T00:00:00.000Z",
+    "keys": {
+      "171e413c9b42c3103c93f1cddf3c64092c15d7e93ef0a7bbb57a2c6596536d2d": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "7059e89c6cfbf2171374223b1ecfc0f121c45a4799d62affe7c339222aea39db"
+        }
+      },
+      "72178b873f31dcef2f34b0ee925d6c9e896af029054fe7bc5c15ae25b0b133bf": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "d5bae5d40548e18b4f66227757e5baf125a9456743d01ec7a0681659138b8d19"
+        }
+      },
+      "a13b9e0ad5de56cc0a1e2def2efa859a651508f380db4acba4655da22ca0e52b": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "439afda8af0c5390bfc7b5ee9f08ec3f2b294bb5d0f1520d4167436f10ba1288"
+        }
+      },
+      "713ba13ba2d7b72d4b5f14c1301ff461d2cc03f8ff7a72e33846f07e4b7a3553": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "c623740f0056e87a0c6810794b072f36cbb9cb11e570998aaf4c6aaa49c8e15f"
+        }
+      },
+      "8c0b42851a3e1019291a7bd0fec457858fe4cbf56b7b4a0dd52fedc58594da11": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "7740ed7fd9f9bc6a4258c28efb52799db2975346057fb1c73a1d67cc2ac8a294"
+        }
+      }
+    },
+    "roles": {
+      "root": {
+        "keyids": [
+          "171e413c9b42c3103c93f1cddf3c64092c15d7e93ef0a7bbb57a2c6596536d2d",
+          "72178b873f31dcef2f34b0ee925d6c9e896af029054fe7bc5c15ae25b0b133bf"
+        ],
+        "threshold": 2
+      },
+      "targets": {
+        "keyids": [
+          "a13b9e0ad5de56cc0a1e2def2efa859a651508f380db4acba4655da22ca0e52b"
+        ],
+        "threshold": 1
+      },
+      "snapshot": {
+        "keyids": [
+          "713ba13ba2d7b72d4b5f14c1301ff461d2cc03f8ff7a72e33846f07e4b7a3553"
+        ],
+        "threshold": 1
+      },
+      "timestamp": {
+        "keyids": [
+          "8c0b42851a3e1019291a7bd0fec457858fe4cbf56b7b4a0dd52fedc58594da11"
+        ],
+        "threshold": 1
+      }
+    },
+    "consistent_snapshot": true,
+    "amalgm": "runtime/main"
+  }
+}

package/config/releases/trust/runtime/preview.root.json

@@ -0,0 +1,84 @@
+{
+  "signatures": [
+    {
+      "keyid": "3e33f991a33d9a91d1a9bfdf407735fb5d80375d0c87af8d319f56d91374fddd",
+      "sig": "e9b48e63dab00d9846c7f629a4abca37765d205efaefd42a9f466da2f2286de3463b016e8f3d28e943ef09494f89f031ca13b294fada668826645e1b038a6c0d"
+    },
+    {
+      "keyid": "b1a1297f592cfcdb8dbaccd5a2df635418fb4a65b596946e4867b88354de3194",
+      "sig": "2b9fef03fe69bcc7a35c7c010a0adc81af6fe5957a7fed645c4afe0ff13890ca48a36829dbd3cb834f59d38753ae00495d549a7faf50c9ee5aadbf199aab0608"
+    }
+  ],
+  "signed": {
+    "_type": "root",
+    "spec_version": "1.0.31",
+    "version": 1,
+    "expires": "2029-09-07T00:00:00.000Z",
+    "keys": {
+      "3e33f991a33d9a91d1a9bfdf407735fb5d80375d0c87af8d319f56d91374fddd": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "8fb6e481577692290e7fd27c30d5d3177f2ee707ef6c81ed9436f0bed3cd54b8"
+        }
+      },
+      "b1a1297f592cfcdb8dbaccd5a2df635418fb4a65b596946e4867b88354de3194": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "8e3ef46a72b35cd7c0d674fc052e83133db9c2cb192f24ad0cf00f4de895f07d"
+        }
+      },
+      "fe66a65c8d70727048f8b79943fedb13b7399f4602a9f79a1e337de14f1dc21a": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "59b1f7ab5afe85ca3a4e0dc84665c5a3dc2fbe913e3d0d75b509cb73a7a35cf6"
+        }
+      },
+      "3c80486cd109baf420901279044a229c1dee7fe3dd01532957da2313b8c233c9": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "8402fb8346333a67479f64a619960806a79443442bb13be909d6f51ec139ad8c"
+        }
+      },
+      "d5b8910b0a6d4cfbce090d080fceb13a3606bef6506512269d8103e5e421dc01": {
+        "keytype": "ed25519",
+        "scheme": "ed25519",
+        "keyval": {
+          "public": "62b7bdb2bc6b105a7b469ccb8240f24d7d775ef55d98b1908dbf3395b43e5aa2"
+        }
+      }
+    },
+    "roles": {
+      "root": {
+        "keyids": [
+          "3e33f991a33d9a91d1a9bfdf407735fb5d80375d0c87af8d319f56d91374fddd",
+          "b1a1297f592cfcdb8dbaccd5a2df635418fb4a65b596946e4867b88354de3194"
+        ],
+        "threshold": 2
+      },
+      "targets": {
+        "keyids": [
+          "fe66a65c8d70727048f8b79943fedb13b7399f4602a9f79a1e337de14f1dc21a"
+        ],
+        "threshold": 1
+      },
+      "snapshot": {
+        "keyids": [
+          "3c80486cd109baf420901279044a229c1dee7fe3dd01532957da2313b8c233c9"
+        ],
+        "threshold": 1
+      },
+      "timestamp": {
+        "keyids": [
+          "d5b8910b0a6d4cfbce090d080fceb13a3606bef6506512269d8103e5e421dc01"
+        ],
+        "threshold": 1
+      }
+    },
+    "consistent_snapshot": true,
+    "amalgm": "runtime/preview"
+  }
+}

package/dist/authorization/recovery-host.d.ts

@@ -12,6 +12,7 @@ export declare function recoverMachineAuthorization(options: Readonly<{
     runtimeVersion: string;
     runtimeLabel: string;
     branch: string;
+    localSession?: string;
     fallbackName: string;
     fallbackPlatform: string;
     stateDir: string;

package/dist/authorization/recovery-host.js

@@ -1,4 +1,4 @@
-import { authFromRecord, mergeRecordAuth, publicComputerRecord, } from "@amalgm/core/identity";
+import { authFromRecord, mergeRecordAuth, publicComputerRecord, resolveRuntimeBinding, runtimeBindingRecord, } from "@amalgm/core/identity";
 import { deviceKeyFromStored, installationDeviceKeyStores, promoteInstallationDeviceKeyRecovery, stageInstallationDeviceKeyRecovery, } from "./index.js";
 import { requestAuthorizationKeyRecovery } from "./recovery-client.js";
 export async function recoverMachineAuthorization(options) {
@@ -55,8 +55,7 @@ function recoveryBody(options, record, deviceId, key) {
         name: text(record.name) || options.fallbackName,
         platform: text(record.platform) || options.fallbackPlatform,
         app_version: options.runtimeVersion,
-        runtime_label: options.runtimeLabel,
-        branch: options.branch,
+        ...runtimeBindingRecord(resolveRuntimeBinding(options)),
         purpose: "authorization_key_recovery",
         authorization_key_thumbprint: key,
     };

package/dist/authorization/recovery-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-host.js","sourceRoot":"","sources":["../../src/authorization/recovery-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAWvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAmBhD;IACA,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,MAAM,aAAa,CAAC,4CAA4C,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,gBAAgB,IAAI,MAAM,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;YAClE,MAAM,oCAAoC,CAAC;gBACzC,GAAG,UAAU;gBACb,qBAAqB,EAAE,MAAM,CAAC,aAAa;aAC5C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC;QACtE,MAAM,EAAE,SAAS;QACjB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,sBAAsB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC;QAC1C,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1G,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;QAC1C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;KAC7B,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,GAAG,UAAU;QACb,qBAAqB,EAAE,SAAS,CAAC,aAAa;KAC/C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CACnB,OAA0D,EAC1D,MAAY,EACZ,QAAgB,EAChB,GAAW;IAEX,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,YAAY;QAC/C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,gBAAgB;QAC3D,WAAW,EAAE,OAAO,CAAC,cAAc;QACnC,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,4BAA4B;QACrC,4BAA4B,EAAE,GAAG;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAc,EACd,QAAyF;IAEzF,IACE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,QAAQ;WAC3C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,UAAU;WAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,MAAM;WAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,KAAK,QAAQ,CAAC,GAAG;WAC5D,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WACnC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,MAAM,CACb,MAAgD,EAChD,QAAgB,EAChB,UAAkB,EAClB,aAAqB;IAErB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"recovery-host.js","sourceRoot":"","sources":["../../src/authorization/recovery-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAWvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAoBhD;IACA,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,MAAM,aAAa,CAAC,4CAA4C,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,gBAAgB,IAAI,MAAM,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;YAClE,MAAM,oCAAoC,CAAC;gBACzC,GAAG,UAAU;gBACb,qBAAqB,EAAE,MAAM,CAAC,aAAa;aAC5C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC;QACtE,MAAM,EAAE,SAAS;QACjB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,sBAAsB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC;QAC1C,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1G,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;QAC1C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;KAC7B,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,GAAG,UAAU;QACb,qBAAqB,EAAE,SAAS,CAAC,aAAa;KAC/C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CACnB,OAA0D,EAC1D,MAAY,EACZ,QAAgB,EAChB,GAAW;IAEX,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,YAAY;QAC/C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,gBAAgB;QAC3D,WAAW,EAAE,OAAO,CAAC,cAAc;QACnC,GAAG,oBAAoB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,EAAE,4BAA4B;QACrC,4BAA4B,EAAE,GAAG;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAc,EACd,QAAyF;IAEzF,IACE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,QAAQ;WAC3C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,UAAU;WAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,MAAM;WAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,KAAK,QAAQ,CAAC,GAAG;WAC5D,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WACnC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,MAAM,CACb,MAAgD,EAChD,QAAgB,EAChB,UAAkB,EAClB,aAAqB;IAErB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/boot.js

@@ -253,26 +253,34 @@ export async function bootShell(config = {}) {
         workspace,
         pty: pty.manager,
         async close() {
-            pty.close();
-            externalProxy.close();
-            const gatewayClosed = new Promise((resolve) => gateway.close(() => resolve()));
-            gateway.closeAllConnections();
-            await Promise.all([
-                gatewayClosed,
-                agentsRest.close(),
-                appsHttp.close(),
-                browserHttp.close(),
-                toolsHttp.close(),
-            ]);
-            await chat.close();
-            await automationsMcp?.close();
-            agentsService.close();
-            await apps.apps.close();
-            stopToolDeploymentEvents();
-            tools.toolbox.close();
-            await Promise.all(browserService.listSessions()
-                .map((session) => browserService.closeSession(session.id)));
-            closeOptionalDatabase(browserService.productOptions.registry);
+            const terminalsClosed = Promise.allSettled([pty.close()]);
+            try {
+                externalProxy.close();
+                const gatewayClosed = new Promise((resolve) => gateway.close(() => resolve()));
+                gateway.closeAllConnections();
+                await Promise.all([
+                    gatewayClosed,
+                    agentsRest.close(),
+                    appsHttp.close(),
+                    browserHttp.close(),
+                    toolsHttp.close(),
+                ]);
+                await chat.close();
+                await automationsMcp?.close();
+                agentsService.close();
+                await apps.apps.close();
+                stopToolDeploymentEvents();
+                tools.toolbox.close();
+                await Promise.all(browserService.listSessions()
+                    .map((session) => browserService.closeSession(session.id)));
+                closeOptionalDatabase(browserService.productOptions.registry);
+            }
+            finally {
+                await terminalsClosed;
+            }
+            const [terminal] = await terminalsClosed;
+            if (terminal.status === "rejected")
+                throw terminal.reason;
         },
     };
 }