@arnilo/prism-coding-agent 0.2.5 → 0.2.6

package/dist/language/client.js

@@ -18,6 +18,10 @@ export class LspClient {
     capabilities = {};
     /** file URI → latest diagnostics payload from publishDiagnostics */
     diagnosticsByUri = new Map();
+    /** file URI → monotonic document version (didOpen=1, each didChange += 1) */
+    documentVersions = new Map();
+    /** file URI → last pull-diagnostic resultId (textDocument/diagnostic) */
+    pullResultIds = new Map();
     onUnexpectedExit;
     constructor(spec, limits, hooks) {
         this.spec = spec;
@@ -88,6 +92,55 @@ export class LspClient {
             return;
         this.write({ jsonrpc: "2.0", method, params });
     }
+    /**
+     * Full-content textDocument/didChange (LSP 3.17; protocol-valid, no diff
+     * engine needed). Monotonic version: didOpen stamps 1, each didChange
+     * increments. No-op when the document was never opened.
+     */
+    didChange(uri, text) {
+        const version = (this.documentVersions.get(uri) ?? 0) + 1;
+        this.documentVersions.set(uri, version);
+        this.notify("textDocument/didChange", {
+            textDocument: { uri, version },
+            contentChanges: [{ text }],
+        });
+    }
+    /** true when the server advertises textDocument/diagnostic (pull diagnostics). */
+    hasPullDiagnostics() {
+        const provider = this.capabilities.diagnosticProvider;
+        if (!provider || provider === false)
+            return false;
+        return true;
+    }
+    /**
+     * Pull diagnostics for one opened document (textDocument/diagnostic) with
+     * resultId reuse: `kind: "full"` replaces the set, `kind: "unchanged"`
+     * reuses the previous payload. Returns the version at request time so the
+     * caller can drop stale responses. Falls back to the push cache when the
+     * server has no pull support.
+     */
+    async pullDiagnostics(uri, signal) {
+        const version = this.documentVersions.get(uri) ?? 1;
+        if (!this.hasPullDiagnostics()) {
+            return { kind: "full", diagnostics: this.diagnosticsByUri.get(uri) ?? [], version };
+        }
+        const previousResultId = this.pullResultIds.get(uri);
+        const result = (await this.request("textDocument/diagnostic", { textDocument: { uri }, ...(previousResultId === undefined ? {} : { previousResultId }) }, signal));
+        if (!result || typeof result !== "object") {
+            return { kind: "full", diagnostics: this.diagnosticsByUri.get(uri) ?? [], version };
+        }
+        if (result.kind === "unchanged") {
+            const cached = this.diagnosticsByUri.get(uri) ?? [];
+            if (typeof result.resultId === "string")
+                this.pullResultIds.set(uri, result.resultId);
+            return { kind: "unchanged", diagnostics: cached, resultId: result.resultId, version };
+        }
+        const items = Array.isArray(result.items) ? result.items : [];
+        this.diagnosticsByUri.set(uri, items);
+        if (typeof result.resultId === "string")
+            this.pullResultIds.set(uri, result.resultId);
+        return { kind: "full", diagnostics: items, resultId: result.resultId, version };
+    }
     hasCapability(key) {
         return this.capabilities[key] !== undefined && this.capabilities[key] !== false;
     }
@@ -177,6 +230,7 @@ export class LspClient {
                     textDocument: {
                         hover: { contentFormat: ["plaintext", "markdown"] },
                         publishDiagnostics: {},
+                        diagnostic: { dynamicRegistration: false },
                     },
                 },
                 workspaceFolders: [{ uri: this.spec.rootUri, name: "workspace" }],

package/dist/language/index.d.ts

@@ -1,4 +1,4 @@
 export { encodeLspFrame, LspFrameError, LspFrameReader } from "./framing.js";
 export { LspClient } from "./client.js";
 export { applyTextEdits, createLanguageIntelligence, LanguageIntelligenceError, resolveLanguageIntelligenceLimits, } from "./intelligence.js";
-export type { CreateLanguageIntelligenceOptions, LanguageDiagnostic, LanguageIntelligence, LanguageIntelligenceLimits, LanguageLocation, LanguageServerSpec, LanguageSymbol, LanguageTextEdit, LanguageWorkspaceEdit, } from "./types.js";
+export type { CreateLanguageIntelligenceOptions, LanguageDiagnostic, LanguageDiagnosticDeltaRequest, LanguageDiagnosticDeltaResult, LanguageFileDiagnostics, LanguageIntelligence, LanguageIntelligenceLimits, LanguageLocation, LanguageServerSpec, LanguageSymbol, LanguageTextEdit, LanguageWorkspaceEdit, } from "./types.js";

package/dist/language/intelligence.js

@@ -7,6 +7,7 @@ import { extname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertExecutionAllowed, ExecutionDeniedError } from "@arnilo/prism";
 import { atomicWriteUtf8File } from "../atomic-write.js";
+import { diagnosticDelta } from "../diagnostics.js";
 import { withFileMutationQueue } from "../file-mutation-queue.js";
 import { resolveContainedMutationPath } from "../mutation-path.js";
 import { LspClient } from "./client.js";
@@ -126,6 +127,7 @@ export function createLanguageIntelligence(options) {
         client.notify("textDocument/didOpen", {
             textDocument: { uri, languageId, version: 1, text },
         });
+        client.documentVersions.set(uri, 1);
         set.add(uri);
     }
     async function ensureAllStarted(signal) {
@@ -212,6 +214,62 @@ export function createLanguageIntelligence(options) {
             const text = hoverToText(contents);
             return text === undefined ? undefined : { text };
         },
+        async syncDocument(file, opts) {
+            assertNotDisposed();
+            const { client, uri, abs } = await clientForFile(file, opts?.signal);
+            const text = await readFile(abs, "utf8");
+            if (opts?.signal?.aborted) {
+                throw new LanguageIntelligenceError("ERR_PRISM_LSP_TIMEOUT", "syncDocument aborted");
+            }
+            client.didChange(uri, text);
+            const version = client.documentVersions.get(uri) ?? 1;
+            return { version };
+        },
+        async diagnosticDelta(request, opts) {
+            assertNotDisposed();
+            if (!Array.isArray(request.files) || request.files.length === 0) {
+                throw new LanguageIntelligenceError("ERR_PRISM_LSP_UNSUPPORTED", "diagnosticDelta requires a non-empty files list");
+            }
+            if (request.files.length > limits.maxResultsPerQuery) {
+                throw new LanguageIntelligenceError("ERR_PRISM_LSP_LIMIT", `diagnosticDelta files exceed ${limits.maxResultsPerQuery}`);
+            }
+            const previous = request.previous ?? {};
+            const files = {};
+            let latestGeneration = 0;
+            for (const file of request.files) {
+                const { client, uri } = await clientForFile(file, opts?.signal);
+                const pulled = await client.pullDiagnostics(uri, opts?.signal);
+                // Stale-version guard: the pull result carries the version at request
+                // time; if the document advanced meanwhile, drop the response.
+                const currentVersion = client.documentVersions.get(uri) ?? 1;
+                if (pulled.version < currentVersion)
+                    continue;
+                const generation = currentVersion;
+                latestGeneration = Math.max(latestGeneration, generation);
+                const prior = previous[file];
+                if (prior && prior.generation > generation)
+                    continue; // stale previous view
+                const raw = normalizeDiagnostics(workspaceRoot, uri, pulled.diagnostics, limits.maxDiagnosticsPerFile);
+                const stamped = raw.map((diagnostic) => ({
+                    file: diagnostic.file,
+                    line: diagnostic.line,
+                    character: diagnostic.character,
+                    endLine: diagnostic.endLine,
+                    endCharacter: diagnostic.endCharacter,
+                    severity: diagnostic.severity,
+                    message: diagnostic.message,
+                    source: diagnostic.source ?? "lsp",
+                    code: diagnostic.code,
+                    generation,
+                }));
+                const delta = diagnosticDelta({
+                    next: stamped,
+                    previous: prior?.diagnostics,
+                });
+                files[file] = delta;
+            }
+            return { files, generation: latestGeneration };
+        },
         async rename(loc, opts) {
             if (!loc.newName || typeof loc.newName !== "string") {
                 throw new LanguageIntelligenceError("ERR_PRISM_LSP_UNSUPPORTED", "newName is required");

package/dist/language/types.d.ts

@@ -96,8 +96,40 @@ export interface LanguageIntelligence {
     }, opts?: {
         signal?: AbortSignal;
     }): Promise<LanguageWorkspaceEdit>;
+    /**
+     * Re-sync one file after an external edit: full-content didChange with a
+     * monotonic version. No-op when no host server handles the file's language
+     * (throws ERR_PRISM_LSP_UNSUPPORTED only when servers exist but none match).
+     */
+    syncDocument(file: string, opts?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        version: number;
+    }>;
+    /**
+     * Bounded push/pull diagnostic refresh for changed files. Generations are
+     * document versions; stale-version results never overwrite newer views.
+     */
+    diagnosticDelta(request: LanguageDiagnosticDeltaRequest, opts?: {
+        signal?: AbortSignal;
+    }): Promise<LanguageDiagnosticDeltaResult>;
     dispose(): Promise<void>;
 }
+export interface LanguageDiagnosticDeltaRequest {
+    /** Workspace-relative files to refresh; bounded per request. */
+    readonly files: readonly string[];
+    /** Prior normalized view per file (generation + diagnostics); optional. */
+    readonly previous?: Readonly<Record<string, LanguageFileDiagnostics>>;
+}
+export interface LanguageFileDiagnostics {
+    readonly generation: number;
+    readonly diagnostics: readonly import("../diagnostics.js").NormalizedDiagnostic[];
+}
+export interface LanguageDiagnosticDeltaResult {
+    /** Per-file delta; stale files (previous generation >= new generation) are omitted. */
+    readonly files: Record<string, import("../diagnostics.js").DiagnosticDelta>;
+    readonly generation: number;
+}
 export interface CreateLanguageIntelligenceOptions {
     readonly workspaceRoot: string;
     readonly servers: Readonly<Record<string, LanguageServerSpec>>;

package/dist/limits.d.ts

@@ -122,6 +122,42 @@ export declare const HARD_MAX_PROCESS_OUTPUT_CHUNK_BYTES: number;
 /** Total output reuses existing accumulator ceilings (64 MiB / 1 GiB). */
 export declare const DEFAULT_MAX_PROCESS_TOTAL_OUTPUT_BYTES: number;
 export declare const HARD_MAX_PROCESS_TOTAL_OUTPUT_BYTES: number;
+/** Phase 26 Task 0 freeze: host-selected PTY terminal caps (interactive sessions). */
+export declare const DEFAULT_MAX_TERMINAL_COLUMNS = 120;
+export declare const HARD_MAX_TERMINAL_COLUMNS = 500;
+export declare const DEFAULT_MAX_TERMINAL_ROWS = 40;
+export declare const HARD_MAX_TERMINAL_ROWS = 200;
+export declare const DEFAULT_MAX_TERMINAL_TERM_BYTES = 64;
+export declare const HARD_MAX_TERMINAL_TERM_BYTES = 256;
+export declare const DEFAULT_MAX_TERMINAL_RESIZES_PER_MINUTE = 60;
+export declare const HARD_MAX_TERMINAL_RESIZES_PER_MINUTE = 600;
+export declare const DEFAULT_MAX_PTY_ATTACH_TIMEOUT_MS = 30000;
+export declare const HARD_MAX_PTY_ATTACH_TIMEOUT_MS = 120000;
+export declare const DEFAULT_MAX_PTY_BACKEND_METADATA_BYTES: number;
+export declare const HARD_MAX_PTY_BACKEND_METADATA_BYTES: number;
+/** Phase 26 Task 0 freeze: host index caps (indexed_literal/semantic repo_search). */
+export declare const DEFAULT_MAX_INDEX_UPDATE_FILES = 1000;
+export declare const HARD_MAX_INDEX_UPDATE_FILES = 10000;
+export declare const DEFAULT_MAX_INDEX_UPDATE_BYTES: number;
+export declare const HARD_MAX_INDEX_UPDATE_BYTES: number;
+/** Index result cap reuses the repository results caps (1000 / 10000). */
+export declare const DEFAULT_MAX_INDEX_SNIPPET_BYTES: number;
+export declare const HARD_MAX_INDEX_SNIPPET_BYTES: number;
+export declare const DEFAULT_MAX_INDEX_STALE_MAX_AGE_MS = 60000;
+export declare const HARD_MAX_INDEX_STALE_MAX_AGE_MS = 300000;
+export declare const DEFAULT_MAX_INDEX_QUERY_TIMEOUT_MS = 30000;
+export declare const HARD_MAX_INDEX_QUERY_TIMEOUT_MS = 120000;
+/** Phase 26 Task 0 freeze: patch-review manifest and diagnostic delta caps. */
+export declare const DEFAULT_MAX_REVIEW_REVISIONS = 8;
+export declare const HARD_MAX_REVIEW_REVISIONS = 32;
+export declare const DEFAULT_MAX_REVIEW_DIAGNOSTICS = 500;
+export declare const HARD_MAX_REVIEW_DIAGNOSTICS = 5000;
+export declare const DEFAULT_MAX_REVIEW_MANIFEST_BYTES: number;
+export declare const HARD_MAX_REVIEW_MANIFEST_BYTES: number;
+export declare const DEFAULT_MAX_REVIEW_DELTA_ENTRIES = 2000;
+export declare const HARD_MAX_REVIEW_DELTA_ENTRIES = 10000;
+export declare const DEFAULT_MAX_DIAGNOSTIC_MESSAGE_BYTES: number;
+export declare const HARD_MAX_DIAGNOSTIC_MESSAGE_BYTES: number;
 /** Forge (GitHub adapter) defaults and hard caps (Phase 9 Task 5). */
 export declare const DEFAULT_MAX_FORGE_PAGES_PER_OPERATION = 10;
 export declare const HARD_MAX_FORGE_PAGES_PER_OPERATION = 100;
@@ -133,6 +169,29 @@ export declare const DEFAULT_MAX_FORGE_REQUEST_CONCURRENCY = 4;
 export declare const HARD_MAX_FORGE_REQUEST_CONCURRENCY = 8;
 export declare const DEFAULT_MAX_FORGE_REQUEST_TIMEOUT_MS = 30000;
 export declare const HARD_MAX_FORGE_REQUEST_TIMEOUT_MS = 120000;
+/** Phase 26 Task 0 freeze: coding workspace lifecycle caps (multi-repo/worktree, plan 026 Task 3). */
+export declare const DEFAULT_MAX_WORKSPACE_REPOSITORIES = 4;
+export declare const HARD_MAX_WORKSPACE_REPOSITORIES = 16;
+/** Worktree cap reuses the git worktree caps (4 / 16). */
+export declare const DEFAULT_MAX_WORKSPACE_WORKTREES = 4;
+export declare const HARD_MAX_WORKSPACE_WORKTREES = 16;
+export declare const DEFAULT_MAX_WORKSPACE_RECORD_BYTES: number;
+export declare const HARD_MAX_WORKSPACE_RECORD_BYTES: number;
+export declare const DEFAULT_MAX_WORKSPACE_LEASE_TTL_MS = 30000;
+export declare const HARD_MAX_WORKSPACE_LEASE_TTL_MS = 300000;
+export declare const DEFAULT_MAX_WORKSPACE_CLEANUP_OPERATIONS = 100;
+export declare const HARD_MAX_WORKSPACE_CLEANUP_OPERATIONS = 1000;
+/** Plan 026 Task 5: durable process/ACP recovery caps (frozen in the phase26 manifest). */
+export declare const DEFAULT_MAX_RECOVERY_RECORDS = 32;
+export declare const HARD_MAX_RECOVERY_RECORDS = 128;
+export declare const DEFAULT_MAX_RECOVERY_LEASE_TTL_MS = 30000;
+export declare const HARD_MAX_RECOVERY_LEASE_TTL_MS = 300000;
+export declare const DEFAULT_MAX_RECOVERY_ATTACH_TIMEOUT_MS = 30000;
+export declare const HARD_MAX_RECOVERY_ATTACH_TIMEOUT_MS = 120000;
+export declare const DEFAULT_MAX_RECOVERY_BACKEND_REF_BYTES = 1024;
+export declare const HARD_MAX_RECOVERY_BACKEND_REF_BYTES: number;
+export declare const DEFAULT_MAX_RECOVERY_RECORD_BYTES: number;
+export declare const HARD_MAX_RECOVERY_RECORD_BYTES: number;
 /** Validate one configurable coding resource limit. Invalid values fail instead of clamping. */
 export declare function validateCodingLimit(name: string, value: number, hardCap: number): number;
 /** Validate a non-negative integer limit (0 allowed), still capped. */

package/dist/limits.js

@@ -122,6 +122,42 @@ export const HARD_MAX_PROCESS_OUTPUT_CHUNK_BYTES = 1024 * 1024;
 /** Total output reuses existing accumulator ceilings (64 MiB / 1 GiB). */
 export const DEFAULT_MAX_PROCESS_TOTAL_OUTPUT_BYTES = DEFAULT_MAX_TOTAL_OUTPUT_BYTES;
 export const HARD_MAX_PROCESS_TOTAL_OUTPUT_BYTES = HARD_MAX_TOTAL_OUTPUT_BYTES;
+/** Phase 26 Task 0 freeze: host-selected PTY terminal caps (interactive sessions). */
+export const DEFAULT_MAX_TERMINAL_COLUMNS = 120;
+export const HARD_MAX_TERMINAL_COLUMNS = 500;
+export const DEFAULT_MAX_TERMINAL_ROWS = 40;
+export const HARD_MAX_TERMINAL_ROWS = 200;
+export const DEFAULT_MAX_TERMINAL_TERM_BYTES = 64;
+export const HARD_MAX_TERMINAL_TERM_BYTES = 256;
+export const DEFAULT_MAX_TERMINAL_RESIZES_PER_MINUTE = 60;
+export const HARD_MAX_TERMINAL_RESIZES_PER_MINUTE = 600;
+export const DEFAULT_MAX_PTY_ATTACH_TIMEOUT_MS = 30_000;
+export const HARD_MAX_PTY_ATTACH_TIMEOUT_MS = 120_000;
+export const DEFAULT_MAX_PTY_BACKEND_METADATA_BYTES = 4 * 1024;
+export const HARD_MAX_PTY_BACKEND_METADATA_BYTES = 16 * 1024;
+/** Phase 26 Task 0 freeze: host index caps (indexed_literal/semantic repo_search). */
+export const DEFAULT_MAX_INDEX_UPDATE_FILES = 1_000;
+export const HARD_MAX_INDEX_UPDATE_FILES = 10_000;
+export const DEFAULT_MAX_INDEX_UPDATE_BYTES = 16 * 1024 * 1024;
+export const HARD_MAX_INDEX_UPDATE_BYTES = 64 * 1024 * 1024;
+/** Index result cap reuses the repository results caps (1000 / 10000). */
+export const DEFAULT_MAX_INDEX_SNIPPET_BYTES = 4 * 1024;
+export const HARD_MAX_INDEX_SNIPPET_BYTES = 16 * 1024;
+export const DEFAULT_MAX_INDEX_STALE_MAX_AGE_MS = 60_000;
+export const HARD_MAX_INDEX_STALE_MAX_AGE_MS = 300_000;
+export const DEFAULT_MAX_INDEX_QUERY_TIMEOUT_MS = 30_000;
+export const HARD_MAX_INDEX_QUERY_TIMEOUT_MS = 120_000;
+/** Phase 26 Task 0 freeze: patch-review manifest and diagnostic delta caps. */
+export const DEFAULT_MAX_REVIEW_REVISIONS = 8;
+export const HARD_MAX_REVIEW_REVISIONS = 32;
+export const DEFAULT_MAX_REVIEW_DIAGNOSTICS = 500;
+export const HARD_MAX_REVIEW_DIAGNOSTICS = 5_000;
+export const DEFAULT_MAX_REVIEW_MANIFEST_BYTES = 64 * 1024;
+export const HARD_MAX_REVIEW_MANIFEST_BYTES = 256 * 1024;
+export const DEFAULT_MAX_REVIEW_DELTA_ENTRIES = 2_000;
+export const HARD_MAX_REVIEW_DELTA_ENTRIES = 10_000;
+export const DEFAULT_MAX_DIAGNOSTIC_MESSAGE_BYTES = 4 * 1024;
+export const HARD_MAX_DIAGNOSTIC_MESSAGE_BYTES = 16 * 1024;
 /** Forge (GitHub adapter) defaults and hard caps (Phase 9 Task 5). */
 export const DEFAULT_MAX_FORGE_PAGES_PER_OPERATION = 10;
 export const HARD_MAX_FORGE_PAGES_PER_OPERATION = 100;
@@ -133,6 +169,29 @@ export const DEFAULT_MAX_FORGE_REQUEST_CONCURRENCY = 4;
 export const HARD_MAX_FORGE_REQUEST_CONCURRENCY = 8;
 export const DEFAULT_MAX_FORGE_REQUEST_TIMEOUT_MS = 30_000;
 export const HARD_MAX_FORGE_REQUEST_TIMEOUT_MS = 120_000;
+/** Phase 26 Task 0 freeze: coding workspace lifecycle caps (multi-repo/worktree, plan 026 Task 3). */
+export const DEFAULT_MAX_WORKSPACE_REPOSITORIES = 4;
+export const HARD_MAX_WORKSPACE_REPOSITORIES = 16;
+/** Worktree cap reuses the git worktree caps (4 / 16). */
+export const DEFAULT_MAX_WORKSPACE_WORKTREES = DEFAULT_MAX_GIT_WORKTREES;
+export const HARD_MAX_WORKSPACE_WORKTREES = HARD_MAX_GIT_WORKTREES;
+export const DEFAULT_MAX_WORKSPACE_RECORD_BYTES = 64 * 1024;
+export const HARD_MAX_WORKSPACE_RECORD_BYTES = 256 * 1024;
+export const DEFAULT_MAX_WORKSPACE_LEASE_TTL_MS = 30_000;
+export const HARD_MAX_WORKSPACE_LEASE_TTL_MS = 300_000;
+export const DEFAULT_MAX_WORKSPACE_CLEANUP_OPERATIONS = 100;
+export const HARD_MAX_WORKSPACE_CLEANUP_OPERATIONS = 1_000;
+/** Plan 026 Task 5: durable process/ACP recovery caps (frozen in the phase26 manifest). */
+export const DEFAULT_MAX_RECOVERY_RECORDS = 32;
+export const HARD_MAX_RECOVERY_RECORDS = 128;
+export const DEFAULT_MAX_RECOVERY_LEASE_TTL_MS = 30_000;
+export const HARD_MAX_RECOVERY_LEASE_TTL_MS = 300_000;
+export const DEFAULT_MAX_RECOVERY_ATTACH_TIMEOUT_MS = 30_000;
+export const HARD_MAX_RECOVERY_ATTACH_TIMEOUT_MS = 120_000;
+export const DEFAULT_MAX_RECOVERY_BACKEND_REF_BYTES = 1024;
+export const HARD_MAX_RECOVERY_BACKEND_REF_BYTES = 4 * 1024;
+export const DEFAULT_MAX_RECOVERY_RECORD_BYTES = 64 * 1024;
+export const HARD_MAX_RECOVERY_RECORD_BYTES = 256 * 1024;
 /** Validate one configurable coding resource limit. Invalid values fail instead of clamping. */
 export function validateCodingLimit(name, value, hardCap) {
     if (!Number.isSafeInteger(value) || value < 1 || value > hardCap) {

package/dist/process/index.d.ts

@@ -1,3 +1,6 @@
-export type { CodingProcessEvent, CreateProcessSessionsOptions, ProcessExitResult, ProcessOutputChunk, ProcessSandboxBackend, ProcessSandboxHandle, ProcessSandboxStartRequest, ProcessSession, ProcessSessionLimits, ProcessSessionMetadata, ProcessSessions, ProcessSessionState, ProcessStartRequest, ResolvedProcessSessionLimits, } from "./types.js";
+export type { CodingProcessEvent, CreateProcessSessionsOptions, ProcessExitResult, ProcessOutputChunk, ProcessPtyBackend, ProcessPtyHandle, ProcessPtyStartRequest, ProcessSandboxBackend, ProcessSandboxHandle, ProcessSandboxStartRequest, ProcessSession, ProcessSessionLimits, ProcessSessionMetadata, ProcessSessions, ProcessSessionState, ProcessStartRequest, ProcessTerminalRequest, ProcessTerminalResize, ResolvedProcessSessionLimits, } from "./types.js";
 export { ProcessSessionError, resolveProcessSessionLimits } from "./types.js";
 export { createProcessSessions } from "./sessions.js";
+export { PROCESS_RECOVERY_CATEGORY, PROCESS_RECOVERY_LEASE_NAMESPACE, PROCESS_RECOVERY_NAMESPACE, PROCESS_RECOVERY_SCHEMA_VERSION, ProcessRecoveryError, acquireRecordLease, attachWithTimeout, buildProcessRecoveryRecord, deleteProcessRecoveryRecord, isOwnershipConflict, loadProcessRecoveryRecord, loadProcessRecoveryRecords, releaseRecordLease, resolveProcessRecoveryLimits, saveProcessRecoveryRecord, validateBackendRef, validateProcessRecoveryRecord, } from "./recovery.js";
+export type { ProcessRecoveryErrorCode, ProcessRecoveryLimits, ProcessRecoveryRecord, ProcessRecoveryRecordReport, ProcessRecoveryReport, ResolvedProcessRecoveryLimits, RecoveryRecordPage, } from "./recovery.js";
+export type { ProcessRecoveryBackend, ProcessRecoveryOutcome } from "./recovery.js";

package/dist/process/index.js

@@ -1,3 +1,4 @@
 export { ProcessSessionError, resolveProcessSessionLimits } from "./types.js";
 export { createProcessSessions } from "./sessions.js";
+export { PROCESS_RECOVERY_CATEGORY, PROCESS_RECOVERY_LEASE_NAMESPACE, PROCESS_RECOVERY_NAMESPACE, PROCESS_RECOVERY_SCHEMA_VERSION, ProcessRecoveryError, acquireRecordLease, attachWithTimeout, buildProcessRecoveryRecord, deleteProcessRecoveryRecord, isOwnershipConflict, loadProcessRecoveryRecord, loadProcessRecoveryRecords, releaseRecordLease, resolveProcessRecoveryLimits, saveProcessRecoveryRecord, validateBackendRef, validateProcessRecoveryRecord, } from "./recovery.js";
 //# sourceMappingURL=index.js.map

package/dist/process/recovery.d.ts

@@ -0,0 +1,174 @@
+import type { CheckpointStore, LeaseStore, LeaseRecord, OwnershipScope } from "@arnilo/prism";
+import type { ProcessPtyHandle, ProcessSandboxHandle, ProcessSessionState } from "./types.js";
+/** Versioned durable namespace for managed-process recovery records (separate from CodingCheckpointMetadata v1). */
+export declare const PROCESS_RECOVERY_NAMESPACE = "prism.coding-agent.process.v1";
+/** Namespace for per-record recovery leases. */
+export declare const PROCESS_RECOVERY_LEASE_NAMESPACE = "prism.coding-agent.process.lease.v1";
+export declare const PROCESS_RECOVERY_SCHEMA_VERSION = 1;
+export declare const PROCESS_RECOVERY_CATEGORY = "coding-process";
+export type ProcessRecoveryOutcome = "attached" | "terminal" | "unknown";
+/** One durable process recovery record. Metadata only — no handles, no output, no secrets. */
+export interface ProcessRecoveryRecord {
+    readonly schemaVersion: typeof PROCESS_RECOVERY_SCHEMA_VERSION;
+    /** ProcessSessions session id (`proc_<hex>`); also the checkpoint key. */
+    readonly id: string;
+    readonly owner: string;
+    readonly workspace: string;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly commandFingerprint: string;
+    readonly policyDecision: string;
+    readonly startedAt: string;
+    readonly state: ProcessSessionState;
+    readonly exitCode: number | null;
+    readonly releaseOnCancel: boolean;
+    readonly expiresAt: number;
+    /** Opaque non-secret host reattachment ref; absent => no attach possible. */
+    readonly backendRef?: string;
+    /** Bounded PTY geometry metadata only (never terminal output); resolved columns/rows/term. */
+    readonly pty?: {
+        readonly columns: number;
+        readonly rows: number;
+        readonly term: string;
+    };
+    /** Monotonic lease fencing token from the record's recovery lease. */
+    readonly fencingToken: number;
+    readonly updatedAt: string;
+}
+/** Host-attested reattachment capability. `attach` resolves an opaque ref to a live handle or returns null. */
+export interface ProcessRecoveryBackend {
+    /**
+     * Resolve an opaque non-secret ref to a live process handle. Return null when
+     * the ref cannot be attested. Throwing is treated as attach failure and the
+     * record becomes unknown; backend error text is never surfaced.
+     */
+    attach(ref: string): Promise<ProcessPtyHandle | ProcessSandboxHandle | null> | ProcessPtyHandle | ProcessSandboxHandle | null;
+}
+/** Per-record recovery report entry. */
+export interface ProcessRecoveryRecordReport {
+    readonly id: string;
+    readonly outcome: ProcessRecoveryOutcome;
+    readonly state: ProcessSessionState;
+    readonly exitCode: number | null;
+    /** Generic failure code when the record could not be attached or transitioned (never backend error text). */
+    readonly error?: ProcessRecoveryErrorCode;
+}
+/** Bounded recover() report. */
+export interface ProcessRecoveryReport {
+    readonly records: readonly ProcessRecoveryRecordReport[];
+    readonly attached: number;
+    readonly terminal: number;
+    readonly unknown: number;
+}
+export type ProcessRecoveryErrorCode = "ERR_PRISM_RECOVERY_UNSUPPORTED" | "ERR_PRISM_RECOVERY_LIMIT" | "ERR_PRISM_RECOVERY_OWNERSHIP" | "ERR_PRISM_RECOVERY_FENCE" | "ERR_PRISM_RECOVERY_UNKNOWN" | "ERR_PRISM_RECOVERY_UNTRUSTED" | "ERR_PRISM_RECOVERY_TIMEOUT";
+/** Stable typed failures for the recovery seam. */
+export declare class ProcessRecoveryError extends Error {
+    readonly code: ProcessRecoveryErrorCode;
+    constructor(code: ProcessRecoveryErrorCode, message: string);
+}
+export interface ProcessRecoveryLimits {
+    readonly maxRecords?: number;
+    readonly leaseTtlMs?: number;
+    readonly attachTimeoutMs?: number;
+    readonly backendRefBytes?: number;
+    readonly recordBytes?: number;
+}
+export interface ResolvedProcessRecoveryLimits {
+    readonly maxRecords: number;
+    readonly leaseTtlMs: number;
+    readonly attachTimeoutMs: number;
+    readonly backendRefBytes: number;
+    readonly recordBytes: number;
+}
+export declare function resolveProcessRecoveryLimits(limits?: ProcessRecoveryLimits): ResolvedProcessRecoveryLimits;
+/** Bounded validation of one recovery record. Corrupt/oversized/foreign records fail closed. */
+export declare function validateProcessRecoveryRecord(record: unknown, limits: ResolvedProcessRecoveryLimits): ProcessRecoveryRecord;
+/** Validate one opaque backend ref (non-secret, bounded, control-free). */
+export declare function validateBackendRef(ref: unknown, limits: ResolvedProcessRecoveryLimits): string;
+/** Build a fresh record for an in-memory session (intent or transition). */
+export declare function buildProcessRecoveryRecord(input: {
+    readonly id: string;
+    readonly owner: string;
+    readonly workspace: string;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly commandFingerprint: string;
+    readonly policyDecision: string;
+    readonly startedAt: string;
+    readonly state: ProcessSessionState;
+    readonly exitCode: number | null;
+    readonly releaseOnCancel: boolean;
+    readonly expiresAt: number;
+    readonly backendRef?: string;
+    readonly pty?: {
+        readonly columns: number;
+        readonly rows: number;
+        readonly term: string;
+    };
+    readonly fencingToken: number;
+    readonly updatedAt?: string;
+}): ProcessRecoveryRecord;
+export interface RecoveryRecordPage {
+    readonly records: ReadonlyArray<{
+        readonly record: ProcessRecoveryRecord;
+        readonly version: number;
+    }>;
+}
+/** Bounded load of recovery records under one ownership scope (O(maxRecords)). */
+export declare function loadProcessRecoveryRecords(input: {
+    readonly checkpoints: CheckpointStore;
+    readonly limits: ResolvedProcessRecoveryLimits;
+    readonly ownership?: OwnershipScope;
+    readonly signal?: AbortSignal;
+}): Promise<RecoveryRecordPage>;
+/** Load one recovery record by session id (null when absent or corrupt). */
+export declare function loadProcessRecoveryRecord(input: {
+    readonly checkpoints: CheckpointStore;
+    readonly id: string;
+    readonly limits: ResolvedProcessRecoveryLimits;
+    readonly ownership?: OwnershipScope;
+    readonly signal?: AbortSignal;
+}): Promise<{
+    readonly record: ProcessRecoveryRecord;
+    readonly version: number;
+} | null>;
+/** CAS save of one recovery record. Fence/version conflicts throw ERR_PRISM_RECOVERY_FENCE. */
+export declare function saveProcessRecoveryRecord(input: {
+    readonly checkpoints: CheckpointStore;
+    readonly record: ProcessRecoveryRecord;
+    readonly expectedVersion: number;
+    readonly version: number;
+    readonly ownership?: OwnershipScope;
+    readonly signal?: AbortSignal;
+}): Promise<{
+    readonly version: number;
+}>;
+/** Delete one recovery record (false when absent). */
+export declare function deleteProcessRecoveryRecord(input: {
+    readonly checkpoints: CheckpointStore;
+    readonly id: string;
+    readonly ownership?: OwnershipScope;
+    readonly signal?: AbortSignal;
+}): Promise<boolean>;
+/** Acquire the per-record recovery lease; null => another replica owns or is recovering the record. */
+export declare function acquireRecordLease(input: {
+    readonly leases: LeaseStore;
+    readonly id: string;
+    readonly ownerId: string;
+    readonly ttlMs: number;
+    readonly ownership?: OwnershipScope;
+    readonly signal?: AbortSignal;
+}): Promise<LeaseRecord | null>;
+/** Release a recovery lease (best effort; ignores conflicts). */
+export declare function releaseRecordLease(input: {
+    readonly leases: LeaseStore;
+    readonly id: string;
+    readonly ownerId: string;
+    readonly token: string;
+    readonly ownership?: OwnershipScope;
+    readonly signal?: AbortSignal;
+}): Promise<void>;
+/** Bounded attach deadline: a backend that does not answer within attachTimeoutMs fails closed. */
+export declare function attachWithTimeout(backend: ProcessRecoveryBackend, ref: string, timeoutMs: number): Promise<ProcessPtyHandle | ProcessSandboxHandle | null>;
+/** True when a checkpoint load/save failure is an ownership conflict (fail closed as OWNERSHIP). */
+export declare function isOwnershipConflict(error: unknown): boolean;