@ashlr/hub 3.8.0 → 3.9.0

package/CHANGELOG.md

@@ -339,6 +339,207 @@ superseded, not a setup procedure. Use [runtime activation authority](docs/RUNTI
 and the [current architecture boundary](docs/ARCHITECTURE.md#legacy-fleet-activation-boundary).
 Neither the historical record nor a successful test activates a resident fleet.
 
+## [3.9.0] — 2026-09-24 UTC — the context meter tells the truth, and long sessions have somewhere to go
+
+The Verse context meter was wrong on every engine, in a different way each time,
+and a session that was filling up had nowhere to go but a cold new chat. The
+numbers below were read from the pinned CLI binaries, each seat's own model
+catalog and every September Codex rollout on this machine; no paid model was
+prompted to produce them. `docs/VERSE-CONTEXT.md` is the new authority for all of it.
+
+### Behaviour change: new Claude chats compact at ≈367k, existing ones keep ≈967k
+
+- **New Claude chats on a 1M model start in Standard** and compact at ≈367k
+  (`--autocompact 400000`), not near 967k as every Claude chat did before.
+  Expansive — the old full window — is one click away, and can be a seat's default.
+- **Chats created before 3.9 keep the window they ran with.** A Claude chat with
+  no recorded mode is marked **Expansive** the first time 3.9 loads it and runs
+  with `--autocompact auto`, exactly as before, so upgrading compacts nothing and
+  spends nothing. Codex, Grok, local and 200k-Claude chats from before 3.9 stay
+  Standard, which is what they already ran at.
+- **Switching a chat to Standard above ≈367k compacts it on the next turn.** The
+  CLI then summarizes the whole context — on a paid seat that spends usage — and
+  early turns survive only as that summary. The same holds for a Codex chat
+  switched back from Expansive above 244.8k. Switching to Expansive is always
+  free. The mode menu warns before you switch.
+
+### Windows read from the CLIs, not assumed
+
+- **Claude.** Six of the eight models run a **1M** window and compact near
+  967k; Verse showed 200k for all of them, so a Fable session went red at 180k
+  and then sat at 100 % while it grew to 967k — hiding exactly the range where
+  every turn is most expensive. Each model now carries its real window, and the
+  window the CLI reports at runtime (`result.modelUsage`) wins, which also
+  catches the CLI dropping a session to 200k when long-context credit runs out.
+- **"Opus 5.5" was running Opus 5.** Verse offered `claude-opus-5.5`; Claude
+  Code's id parser rejects the dotted suffix and falls back to a substring match
+  on `claude-opus-5`. The real id is `claude-opus-5-5`, which needs Claude Code
+  2.1.280 — and the claude-a seat is pinned to 2.1.257. Opus 5.5 is now listed on
+  that seat **disabled, with the reason** and the fix
+  (`ashlr resources profile repin`, new in this release — below), rather than
+  silently running a different model. Old sessions keep their recorded id, but
+  their turns now ask for the real model, so on a seat that cannot run it the
+  turn is refused up front (409 `VERSE_MODEL_UNAVAILABLE`, with the reason)
+  instead of starting a CLI that would reject the id. A client that still sends
+  `claude-opus-5.5` when creating a chat gets `claude-opus-5-5`.
+- **Codex.** The CLI measures against 95 % of the window — 258,400, reported by
+  every one of 151,715 rollout readings — and compacts near 244,800. Occupancy was
+  the turn's *summed* input — a median 28.8× the real last-call prompt across 260
+  recent turns — so the meter sat red on almost every turn. It now comes from the
+  seat's own rollout — the last call's `last_token_usage.total_tokens`, the
+  figure Codex itself compacts against, and the window the rollout reports —
+  read every 2 s during a turn; until that is readable the figure is marked `≤`. The rollout also fixes per-turn usage: on `exec resume`,
+  Codex's reported usage is the whole thread's running total, which Verse would
+  have added again every turn (no Verse codex chat had run yet, so no stored
+  total is wrong). Models come from each seat's own catalog, so hidden slugs are
+  no longer offered.
+- **Grok** is 500k compacting at 400k, not 256k — the meter read twice the real
+  fill. Labels come from the catalog ("Grok 4.7 Fast"), and only its `.info`
+  entries are read: the same file carries a per-model `api_key` field. Like
+  Claude, the window Grok reports at runtime wins.
+- **Local.** Claude Code assumes 200k for a model it does not know, so a local
+  seat never compacted before a 64k runner overflowed. Verse now tells it the
+  real window (`CLAUDE_CODE_MAX_CONTEXT_TOKENS`), resolves that window from what
+  the runner actually serves (llama-server's per-slot window on that lane,
+  Ollama's own server default for unpinned tags — preferred over whatever
+  context a resident runner was loaded with, since another app may have loaded
+  it at 8k), and parses `-ctx64k` tags, which the old suffix pattern missed.
+  Before every local turn the chat's stored window is refreshed from live
+  discovery, so the window the CLI is told and the one the meter shows are the
+  same, current number. Tags under a 56k window are listed disabled with the
+  reason: after Claude Code's 33k reserve and its ~15k base prompt they would
+  compact on every turn. The fleet's model catalog no longer
+  tags the 64k local coder `long-context` (a capability defined as ≥ 100k), which
+  had routed long-context work to a model that would overflow.
+- Readings are stored **unclamped**: an overflow is information, and the old
+  clamp erased it on disk.
+
+### Compaction you can see
+
+Native compactions become persisted `compaction` events — Claude and Grok from
+`compact_boundary`, Codex from its rollout, sized from the readings just before
+and after it — with a transcript divider ("Auto-compacted 967k → 19k in 1m 58s")
+and a per-session count. The meter draws the whole window with a tick at the
+compaction point and warns at 80 % / 95 % of **that point**. The old fixed
+70 / 90 % of the window turned red only after Grok and Codex had already
+compacted.
+
+**Compact now** — in the chip beside the meter on every Claude and local session
+(a "Context" chip where the model has no second mode), and in the handoff banner — sends `/compact` as an ordinary turn,
+through the same gate as every turn, and the divider reads "Compacted on
+request". It was verified headless on a local seat, where it is free but slow
+(about 2½ minutes for a 15k context on a 27B model). **On a paid seat it spends
+usage**: the CLI reads the whole context to write its summary.
+
+### Standard and expansive context
+
+A new chat on any Claude 1M model now compacts at ≈367k by default
+(`--autocompact 400000`) instead of ≈967k (chats from before 3.9 keep ≈967k —
+above). Each turn re-sends the whole conversation, and long-context
+recall degrades with length on every published benchmark, so a session held
+near 900k re-reads about 2.3× what one held under 400k does. **Expansive** mode
+restores the full window — and on GPT-6 / GPT-5.6 raises Codex to its 872k
+catalog maximum, passing `model_context_window` and
+`model_auto_compact_token_limit` together (one without the other breaks Codex's
+compaction). The mode is per session, applies from the next turn, can be a
+seat's default, and exists only where it is real. Verse may suggest it; it never
+switches it on. The menu's cost note is the ratio of the two compaction points
+(≈2.6× on Claude, ≈3.2× on Codex). On Codex every Expansive surface also says
+that GPT-5.6 requests above 272k reportedly count about 2× against plan limits
+(one secondary source; GPT-6 Astra reportedly exempt) — if that holds, a turn
+near the expansive limit counts nearer 6× a standard one.
+
+### Continue in a fresh chat
+
+A banner appears when a session nears its compaction point, has compacted twice,
+or has sat idle past the prompt cache's lifetime with a large context. It builds
+a handoff note from the session's own log — goal, latest asks, state, files,
+commands, errors, `git diff --stat` per root — with no model call, lets you edit
+it and pick any seat (a Claude chat can continue on Codex), creates the new
+session for free and leaves the note in its composer. Nothing is sent until you
+press send.
+
+### Shared memory, fit, search, efficiency
+
+- **Project memory:** one private directory per project under
+  `~/.ashlr/verse/memory/`, shared by every seat, with a fixed instruction block
+  that stays byte-identical across turns so the prompt cache survives. On by
+  default, per-project opt-out, editable from the Resources panel. Claude and
+  local seats get the directory with `--add-dir` and the block with
+  `--append-system-prompt`; Codex through `-c` overrides (a writable root and
+  `developer_instructions`), since `exec resume` takes no `--add-dir`. Grok, whose
+  CLI can be granted nothing beyond its working directory, gets a read-only
+  snapshot through `--rules`. **It is not free on a paid seat:** the block (up
+  to 6 KB) rides in the system prompt of every turn of every new session —
+  cached after the first turn, but cached tokens still count — and it asks the
+  agent to read and update `MEMORY.md`, which is extra tool calls and output.
+  Turn it off per project, or for every project, in the Resources panel.
+  The editor shows the sanitized copy the API serves and says so; a save that
+  would write `[REDACTED]` placeholders over real values is refused.
+- **Context fit:** per-model verdicts — fits, tight, needs expansive, or split —
+  for a folder or workspace, from `git ls-files` sizes, plus each engine's base
+  prompt (local 15k, measured; Claude 25k, Codex 15k, Grok 20k, estimated), so
+  a handoff note fits the 64k local seat while a whole repository shows split.
+- **Session search** across past chats from the sidebar: a bounded keyword scan
+  of Verse's own session store (newest 200 sessions, 20 MB of message text), with
+  no index and no embeddings.
+- **Efficiency:** cache-hit ratio, context per turn, compactions and an
+  idle-cache warning, computed in the browser.
+
+Memory aside, all of it is deterministic and spends nothing: the handoff
+preview, context fit, search and the efficiency stats make no model call. The
+only model calls remain the turns you send, through the same local-only-gated
+chokepoint as before.
+
+### Re-pin a seat to a newer CLI
+
+`ashlr resources profile repin --directory <profile> --executable <binary>`
+points an existing prepared native profile at another CLI binary — the fix the
+claude-a seat's note names for Opus 5.5. It changes only the pinned executable
+(the launcher's one `const profile=` line and `profile.json`) and refuses a
+profile that is not unmodified `prepare` output. `--dry-run` checks everything
+and writes nothing. A real repin first saves `launcher.mjs`, `profile.json` and
+`command.json` as `.prev` files — one rollback set; restoring all three restores
+the old pin. Re-running an interrupted repin finishes it, repinning to the
+current binary reports `unchanged`, and failures say whether the profile
+changed. It does not check sign-in: run `ashlr resources launcher check`
+afterwards. The command ships in the built CLI, so it needs `npm run build` in a
+source checkout.
+
+### For API clients
+
+- New routes under `/api/verse`: `POST /sessions/:id/context-mode`,
+  `POST /sessions/:id/handoff-preview`, `GET`/`POST /preferences`,
+  `GET /context-fit`, `GET /search`, `GET`/`POST /memory`. None starts a model
+  call. `handoff-preview` is a POST because it runs `git`, so like every POST it
+  answers 404 on a read-only server.
+- `POST /sessions` is now strict: an unknown key is a 400, and `workspaceName` is
+  refused (the server fills it from `workspaceId`). New sessions always carry
+  `memoryEnabled`, `false` when memory is off for the project.
+- The new GETs reject unknown or duplicated query parameters; `context-fit`
+  takes `extraRoots` repeated once per root, because a comma is legal in a path.
+- `POST /memory` content is capped at 64 KiB; that route alone accepts a body
+  of up to 2 × 64 KiB + 8 KiB so a full-size file survives JSON escaping. It
+  answers 409 `VERSE_MEMORY_REDACTED` when the content holds more `[REDACTED]`
+  placeholders than the file on disk, and `GET`/`POST /memory` responses carry
+  `contentSanitized: true` whenever the content sent is not the file's bytes.
+- New sessions always record `contextMode` (`'standard'` included); an absent
+  key marks a pre-3.9 record (resolved as above).
+- New persisted events `compaction` and `context`; `context` may carry
+  `contextWindowSource` (absent = `runtime`), so a catalog budget written after
+  a mode switch is not shown as a measurement. `VERSE_HANDOFF_SUMMARY_REQUEST`
+  (`types.ts`) is the fixed "summarize first" turn. The full additive contract
+  is in `docs/VERSE-CONTRACT-V1.md`.
+
+### Hygiene
+
+- `eslint.config.js` ignores `.claude/**`. Agent worktrees there produced about
+  98k lint errors, which made `npm run lint` — and so `prepublishOnly` — fail on
+  this machine.
+- Two release-truth test pins that asserted superseded facts (npm provenance,
+  removed on purpose in `e24a7dae`, and the pre-rewrite desktop README) now
+  assert the current policy.
+
 ## [3.8.0] — 2026-09-23 UTC — local-only actually prevents spend
 
 Two gates that make a promise the UI was already making. Both landed after the

package/dist/build-identity.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "3.8.0",
-  "revision": "a3a44cbbc5599bdb369c3cba1d7fcd53a45fa854",
+  "packageVersion": "3.9.0",
+  "revision": "4be748c6b2176684892bebb3acdb488ab5522326",
   "dirty": false,
   "provenance": "git"
 }

package/dist/cli/resource-profile.js

@@ -1,13 +1,27 @@
 import { isAbsolute, parse as parsePath, resolve } from 'node:path';
 const USAGE = `usage: ashlr resources profile prepare --provider codex|claude|grok
   --directory NEW_ABS --executable ABS [--json]
+       ashlr resources profile repin --directory EXISTING_ABS --executable ABS
+  [--dry-run] [--json]
 
-Creates one new private profile under an existing owned mode-0700 parent.
+prepare creates one new private profile under an existing owned mode-0700 parent.
 Writes a standalone launcher, command.json, preparation manifest and empty native
 state directories. Existing targets are never overwritten, repaired or reused.
 On failure, a partially prepared directory may remain; inspect it rather than
 deleting account state automatically. No parent directories are created.
 
+repin points one existing prepared profile at a different native executable,
+for example a newer CLI version that a model requires. It rewrites only the
+executable locator in launcher.mjs and profile.json (command.json names node and
+the launcher, never the native executable, so its bytes do not change), keeps
+the provider, native state and sign-in untouched, and first copies the three
+files to launcher.mjs.prev, profile.json.prev and command.json.prev. Every file
+must still be prepare's unmodified output; a hand-edited profile is refused.
+Rerunning the same repin after an interruption finishes it; repinning to the
+current executable writes nothing. Sessions already running keep the binary
+they started with; the next launch through the profile uses the new one.
+--dry-run validates everything and reports the change without writing.
+
 No executable is launched, credentials read/copied, account signed in, provider
 contacted, pool enrolled or resident service installed. The returned login argv
 is a separate interactive native action, not something this command executes.
@@ -16,12 +30,17 @@ environment; they are operator-owned code, not a sandbox or billing attestation.
 Node with process.execve support and a supported POSIX platform are required.
 --executable must name a canonical regular executable file, not an install symlink.
 Output includes private local paths, never authentication material.
-Exit codes: 0 prepared (authentication not checked), 1 preparation unavailable,
-2 invalid arguments. Grok preparation supports separate native login/metadata;
-it does not enable a Grok task-generation adapter.
+Exit codes: 0 prepared, repinned or already pinned (authentication not checked),
+1 preparation or repin unavailable, 2 invalid arguments. Grok preparation
+supports separate native login/metadata; it does not enable a Grok
+task-generation adapter.
 `;
 class UsageError extends Error {
 }
+/** A repin failure whose message is fixed, path-free text saying whether the profile changed. */
+class RepinFailure extends Error {
+}
+const REPIN_UNAVAILABLE = 'Native profile repin unavailable; inspect the profile before retrying';
 function parse(args) {
     if (args.length > 12 || args.some((arg) => typeof arg !== 'string' || Buffer.byteLength(arg) > 4096 ||
         [...arg].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) >= 127 && char.charCodeAt(0) <= 159)) ||
@@ -29,10 +48,14 @@ function parse(args) {
         throw new UsageError('Invalid profile arguments');
     if (args.length === 1 && ['--help', '-h'].includes(args[0]))
         return { help: true };
-    if (args[0] !== 'prepare')
-        throw new UsageError('Expected prepare subcommand');
+    const subcommand = args[0];
+    if (subcommand !== 'prepare' && subcommand !== 'repin')
+        throw new UsageError('Expected prepare or repin subcommand');
+    // repin reads the provider from the existing profile and never changes it.
+    const valued = subcommand === 'prepare' ? ['--provider', '--directory', '--executable'] : ['--directory', '--executable'];
     const values = new Map();
     let json = false;
+    let dryRun = false;
     for (let i = 1; i < args.length; i++) {
         const flag = args[i];
         if (flag === '--json') {
@@ -41,16 +64,21 @@ function parse(args) {
             json = true;
             continue;
         }
-        if (!['--provider', '--directory', '--executable'].includes(flag) || values.has(flag))
+        if (flag === '--dry-run' && subcommand === 'repin') {
+            if (dryRun)
+                throw new UsageError('Duplicate profile option');
+            dryRun = true;
+            continue;
+        }
+        if (flag === '--provider' && subcommand === 'repin')
+            throw new UsageError('repin keeps the profile provider; --provider is not accepted');
+        if (!valued.includes(flag) || values.has(flag))
             throw new UsageError('Unknown or duplicate profile option');
         const value = args[++i];
         if (!value || value.startsWith('-'))
             throw new UsageError('Profile option requires a value');
         values.set(flag, value);
     }
-    const provider = values.get('--provider');
-    if (provider !== 'codex' && provider !== 'claude' && provider !== 'grok')
-        throw new UsageError('Expected codex, claude or grok provider');
     const path = (flag) => {
         const value = values.get(flag);
         if (!value || !isAbsolute(value) || resolve(value) !== value || parsePath(value).root === value) {
@@ -58,28 +86,74 @@ function parse(args) {
         }
         return value;
     };
-    return { help: false, json, provider, directory: path('--directory'), executable: path('--executable') };
+    if (subcommand === 'repin')
+        return { help: false, subcommand, json, dryRun, directory: path('--directory'), executable: path('--executable') };
+    const provider = values.get('--provider');
+    if (provider !== 'codex' && provider !== 'claude' && provider !== 'grok')
+        throw new UsageError('Expected codex, claude or grok provider');
+    return { help: false, subcommand, json, provider, directory: path('--directory'), executable: path('--executable') };
+}
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+async function prepare(options) {
+    const { prepareResourceNativeProfile } = await import('../core/resources/native-profile.js');
+    const report = prepareResourceNativeProfile({ provider: options.provider, directory: options.directory, executable: options.executable });
+    console.log(options.json ? JSON.stringify(report, null, 2) : [
+        `Native profile · ${report.provider} · prepared · authentication not checked`,
+        `Directory: ${report.directory}`, `Command file: ${report.commandPath}`,
+        `Separate interactive sign-in: ${report.loginCommand.map(quote).join(' ')}`,
+        'No login was executed. Verify native account, billing route and quota before enrolling capacity.',
+    ].join('\n'));
+}
+async function repin(options) {
+    const { repinResourceNativeProfile, ResourceNativeProfileRepinError } = await import('../core/resources/native-profile.js');
+    let report;
+    try {
+        report = repinResourceNativeProfile({ directory: options.directory, executable: options.executable, dryRun: options.dryRun });
+    }
+    catch (error) {
+        throw new RepinFailure(error instanceof ResourceNativeProfileRepinError ? error.message : REPIN_UNAVAILABLE);
+    }
+    if (options.json) {
+        console.log(JSON.stringify(report, null, 2));
+        return;
+    }
+    const heading = report.status === 'repinned' ? (report.resumed ? 'repinned (finished an interrupted repin)' : 'repinned')
+        : report.status === 'would-repin' ? (report.resumed ? 'dry run · would finish an interrupted repin' : 'dry run · would repin')
+            : 'already pinned · nothing written';
+    const lines = [`Native profile · ${report.provider} · ${heading} · authentication not checked`, `Directory: ${report.directory}`];
+    if (report.status === 'unchanged')
+        lines.push(`Executable: ${report.executable}`);
+    else
+        lines.push(`Executable: ${report.previousExecutable} -> ${report.executable}`);
+    if (report.backups) {
+        lines.push(`Previous files kept: ${[report.backups.launcherPath, report.backups.manifestPath, report.backups.commandPath].map(quote).join(' ')}`);
+        lines.push('Sessions already running keep the binary they started with; the next launch through this profile uses the new one.');
+    }
+    if (report.status === 'would-repin')
+        lines.push('Nothing was written.');
+    lines.push(`Nothing was executed. Check the new binary with: ashlr resources launcher check --provider ${report.provider} --command ${quote(report.commandPath)} --cwd <private dir>`);
+    console.log(lines.join('\n'));
 }
 export async function cmdResourceProfile(args) {
+    let subcommand = null;
     try {
         const options = parse(args);
         if (options.help) {
             console.log(USAGE);
             return 0;
         }
-        const { prepareResourceNativeProfile } = await import('../core/resources/native-profile.js');
-        const report = prepareResourceNativeProfile({ provider: options.provider, directory: options.directory, executable: options.executable });
-        const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-        console.log(options.json ? JSON.stringify(report, null, 2) : [
-            `Native profile · ${report.provider} · prepared · authentication not checked`,
-            `Directory: ${report.directory}`, `Command file: ${report.commandPath}`,
-            `Separate interactive sign-in: ${report.loginCommand.map(quote).join(' ')}`,
-            'No login was executed. Verify native account, billing route and quota before enrolling capacity.',
-        ].join('\n'));
+        subcommand = options.subcommand;
+        if (options.subcommand === 'repin')
+            await repin(options);
+        else
+            await prepare(options);
         return 0;
     }
     catch (error) {
-        const message = error instanceof UsageError ? error.message : 'Native profile preparation unavailable; inspect the selected target for partial files';
+        // Repin failures carry fixed, path-free text that says whether the profile
+        // changed; anything else (and every prepare failure) stays generic.
+        const message = error instanceof UsageError || error instanceof RepinFailure ? error.message
+            : subcommand === 'repin' ? REPIN_UNAVAILABLE : 'Native profile preparation unavailable; inspect the selected target for partial files';
         if (args.includes('--json'))
             console.log(JSON.stringify({ error: message }));
         else

package/dist/cli/resource-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-profile.js","sourceRoot":"","sources":["../../src/cli/resource-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpE,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;CAoBb,CAAC;AACF,MAAM,UAAW,SAAQ,KAAK;CAAG;AAEjC,SAAS,KAAK,CAAC,IAAc;IAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI;QACjG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3G,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,CAAC;IAC7F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAAC,IAAI,IAAI,GAAG,KAAK,CAAC;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAC,IAAI,IAAI;gBAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7G,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;QACnJ,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,CAAC,CAAC;QACtH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAChG,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAW,CAAC;AAC7H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAc;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAChF,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1I,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,oBAAoB,MAAM,CAAC,QAAQ,0CAA0C;YAC7E,cAAc,MAAM,CAAC,SAAS,EAAE,EAAE,iBAAiB,MAAM,CAAC,WAAW,EAAE;YACvE,iCAAiC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC3E,kGAAkG;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uFAAuF,CAAC;QACtJ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;;YAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1G,OAAO,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}
+{"version":3,"file":"resource-profile.js","sourceRoot":"","sources":["../../src/cli/resource-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpE,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCb,CAAC;AACF,MAAM,UAAW,SAAQ,KAAK;CAAG;AACjC,iGAAiG;AACjG,MAAM,YAAa,SAAQ,KAAK;CAAG;AACnC,MAAM,iBAAiB,GAAG,uEAAuE,CAAC;AAOlG,SAAS,KAAK,CAAC,IAAc;IAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI;QACjG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3G,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpF,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;IACrH,2EAA2E;IAC3E,MAAM,MAAM,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAAC,IAAI,IAAI,GAAG,KAAK,CAAC;IAAC,IAAI,MAAM,GAAG,KAAK,CAAC;IAC/E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAC,IAAI,IAAI;gBAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7G,IAAI,IAAI,KAAK,WAAW,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAAC,IAAI,MAAM;gBAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9I,IAAI,IAAI,KAAK,YAAY,IAAI,UAAU,KAAK,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;QAC1I,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;QAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,CAAC,CAAC;QACtH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAChG,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;IAC/I,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IAC1I,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAEvE,KAAK,UAAU,OAAO,CAAC,OAA2D;IAChF,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1I,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,oBAAoB,MAAM,CAAC,QAAQ,0CAA0C;QAC7E,cAAc,MAAM,CAAC,SAAS,EAAE,EAAE,iBAAiB,MAAM,CAAC,WAAW,EAAE;QACvE,iCAAiC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC3E,kGAAkG;KACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAyD;IAC5E,MAAM,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAC5H,IAAI,MAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,0BAA0B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,KAAK,YAAY,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,UAAU,CAAC;QACvH,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC5H,CAAC,CAAC,kCAAkC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,oBAAoB,MAAM,CAAC,QAAQ,MAAM,OAAO,+BAA+B,EAAE,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClI,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;;QAC7E,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,kBAAkB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClJ,KAAK,CAAC,IAAI,CAAC,oHAAoH,CAAC,CAAC;IACnI,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,8FAA8F,MAAM,CAAC,QAAQ,cAAc,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACvL,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAc;IACrD,IAAI,UAAU,GAA+B,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAChF,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAChC,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;;YAAM,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,OAAO,GAAG,KAAK,YAAY,UAAU,IAAI,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;YAC1F,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uFAAuF,CAAC;QACzI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;;YAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1G,OAAO,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/core/resources/native-profile.d.ts

@@ -21,9 +21,65 @@ export interface ResourceNativeProfile {
     command: string[];
     loginCommand: string[];
 }
+/**
+ * Key order of profile.json, exactly as `prepareResourceNativeProfile` builds it.
+ * Exported so a test can pin prepare's output to it: repin refuses any other
+ * shape, so the two must never drift apart silently.
+ */
+export declare const RESOURCE_NATIVE_PROFILE_MANIFEST_KEYS: readonly ["schemaVersion", "scope", "status", "authentication", "provider", "directory", "executable", "nodeExecutable", "commandPath", "launcherPath", "nativeStatePath", "anthropicStatePath", "manifestPath", "command", "loginCommand"];
 /**
  * Exclusive private leaf only. Existing paths are never reused, removed, repaired
  * or overwritten. A failed write may leave a partial directory for inspection.
  * Native login remains a separate operation through the generated command.
  */
 export declare function prepareResourceNativeProfile(options: ResourceNativeProfileOptions): ResourceNativeProfile;
+export interface ResourceNativeProfileRepinOptions {
+    directory: string;
+    executable: string;
+    /** Validate everything and report what would change; write nothing. */
+    dryRun?: boolean;
+}
+export interface ResourceNativeProfileRepin {
+    schemaVersion: 1;
+    scope: 'native-profile-repin';
+    /**
+     * `repinned`    — launcher.mjs and profile.json now name `executable`.
+     * `unchanged`   — both already named `executable`; nothing was written.
+     * `would-repin` — dry run: every check passed; nothing was written.
+     */
+    status: 'repinned' | 'unchanged' | 'would-repin';
+    authentication: 'not-checked';
+    provider: ResourceNativeProfileProvider;
+    directory: string;
+    previousExecutable: string;
+    executable: string;
+    launcherPath: string;
+    manifestPath: string;
+    commandPath: string;
+    /** The `*.prev` copies of the three files as they stood before this repin; null when nothing was repinned. */
+    backups: {
+        launcherPath: string;
+        manifestPath: string;
+        commandPath: string;
+    } | null;
+    /** True when this call finished (or, dry, would finish) a repin interrupted between its launcher and profile.json publishes. */
+    resumed: boolean;
+}
+/**
+ * - `invalid`          — options, executable, runtime, private directories or file modes failed validation. Nothing written.
+ * - `inconsistent`     — the files are not an unmodified prepared profile, or disagree with each other. Nothing written.
+ * - `failed-unchanged` — a write failed before launcher.mjs changed; the profile still runs its previous executable.
+ * - `failed-partial`   — launcher.mjs changed but the rest did not complete; rerun the same repin, or restore `*.prev`.
+ */
+export type ResourceNativeProfileRepinFailure = 'invalid' | 'inconsistent' | 'failed-unchanged' | 'failed-partial';
+export declare class ResourceNativeProfileRepinError extends Error {
+    readonly failure: ResourceNativeProfileRepinFailure;
+    constructor(failure: ResourceNativeProfileRepinFailure);
+}
+/**
+ * Re-pin one existing prepared profile to a different native executable.
+ * Rewrites only the executable locator (see the section comment above);
+ * idempotent when already pinned; resumes its own interrupted run; never
+ * executes anything and never reads native state or credentials.
+ */
+export declare function repinResourceNativeProfile(options: ResourceNativeProfileRepinOptions): ResourceNativeProfileRepin;