@atomic-chat/core 0.5.1 → 0.13.2

package/dist/host/log-file.js

@@ -0,0 +1,214 @@
+/**
+ * `<dir>/<stem>.log`: a synchronously-written, rotating log file. Internal to the core host layer —
+ * not exported from `src/host/index.ts` or the package. Used for `core.log` (task 3.1 wires the
+ * daemon's own logger and stderr into it); `<stem>` is parameterised so the same code could serve
+ * another rotating file later.
+ *
+ * `formatLogLine` is the single place that builds the `[YYYY-MM-DD][HH:MM:SS][target][LEVEL]`
+ * header (design D3): both this file's entries and every stderr line the core writes go through it,
+ * so a person reading either sees the same format.
+ */
+import { closeSync, existsSync, mkdirSync, openSync, readdirSync, renameSync, statSync, unlinkSync, writeSync, } from 'node:fs';
+import { join } from 'node:path';
+/** The size at which `core.log` (and `app.log`) rotate, matching tauri-plugin-log. */
+export const MAX_LOG_BYTES = 10 * 1024 * 1024;
+/** How many rotated `<stem>_*.log` archives are kept; the oldest beyond this is deleted. */
+export const MAX_LOG_ARCHIVES = 4;
+/** `[`, `]` and the control characters U+0000–U+001F and U+007F: what a target may not contain. */
+// eslint-disable-next-line no-control-regex
+const TARGET_UNSAFE_RE = /[[\]\x00-\x1F\x7F]/g;
+/**
+ * Builds one log entry: UTC, to the second, regardless of the process timezone. A multi-line
+ * `message` carries the header on its first line only; the rest is written verbatim, and one `\n`
+ * is appended, so a caller passes its message without a trailing newline of its own (one that
+ * ends in `\n` leaves an empty line after the entry).
+ *
+ * Each `[`, `]` and control character in `target` becomes `_`: a target comes partly from a model
+ * id, which is a folder name with no character rules (`model [Q4]`), and any of those would break
+ * the header the app splits entries on (`\[[^\]]*\]`, design D7) or split the header line itself.
+ */
+export function formatLogLine(date, target, level, message) {
+    const iso = date.toISOString();
+    const day = iso.slice(0, 10);
+    const time = iso.slice(11, 19);
+    return `[${day}][${time}][${target.replace(TARGET_UNSAFE_RE, '_')}][${level}] ${message}\n`;
+}
+/** `YYYY-MM-DD_HH-MM-SS`, UTC: the timestamp half of an archive's `<stem>_<...>.log` name. */
+function archiveTimestamp(date) {
+    const iso = date.toISOString();
+    return `${iso.slice(0, 10)}_${iso.slice(11, 19).replace(/:/g, '-')}`;
+}
+const ARCHIVE_NAME_RE = /^\d{4}-\d{2}-\d{2}_\d{2}-\d{2}-\d{2}\.log$/;
+const realFs = {
+    mkdirSync,
+    existsSync,
+    statSync,
+    openSync,
+    writeSync,
+    closeSync,
+    renameSync,
+    unlinkSync,
+    readdirSync,
+};
+/**
+ * Opens `<dir>/<stem>.log` for append, creating `dir` if needed, and returns a writer that rotates
+ * the file once an incoming entry would push it past `maxBytes` (default 10 MiB), keeping
+ * `maxArchives` (default 4) archives named `<stem>_YYYY-MM-DD_HH-MM-SS.log`.
+ *
+ * Never throws. An open or write failure, a rotation failure that leaves no writable file open, or
+ * any other error while writing an entry (a close that fails mid-rotation, say) writes one `WARN`
+ * line built by {@link formatLogLine} to `stderr` and disables the writer for good: every
+ * `write`/`close` call afterwards is a silent no-op. A failed rename that still leaves the
+ * *current* file writable is not one of these: the writer keeps appending to it and retries
+ * rotation on the next write; see {@link rotate}.
+ */
+export function openLogFile(dir, stem, options = {}) {
+    const now = options.now ?? (() => new Date());
+    const fs = options.fs ?? realFs;
+    const stderr = options.stderr ?? ((text) => void process.stderr.write(text));
+    const maxBytes = options.maxBytes ?? MAX_LOG_BYTES;
+    const maxArchives = options.maxArchives ?? MAX_LOG_ARCHIVES;
+    const path = join(dir, `${stem}.log`);
+    let fd;
+    let size = 0;
+    let disabled = false;
+    /** Fires the one-time warning and turns every later call into a no-op. Never throws. */
+    function disable(reason) {
+        if (disabled)
+            return;
+        disabled = true;
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // already broken; nothing more to do
+            }
+            fd = undefined;
+        }
+        try {
+            stderr(formatLogLine(now(), 'core', 'WARN', `log file disabled: ${reason}`));
+        }
+        catch {
+            // stderr itself is best-effort
+        }
+    }
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        fd = fs.openSync(path, 'a');
+        size = fs.statSync(path).size;
+    }
+    catch (error) {
+        disable(error.message);
+    }
+    function archivePath(date) {
+        return join(dir, `${stem}_${archiveTimestamp(date)}.log`);
+    }
+    function pruneArchives() {
+        const prefix = `${stem}_`;
+        const archives = fs
+            .readdirSync(dir)
+            .filter((name) => name.startsWith(prefix) && ARCHIVE_NAME_RE.test(name.slice(prefix.length)))
+            .sort()
+            .reverse(); // `<stem>_YYYY-MM-DD_HH-MM-SS.log` sorts lexicographically newest-first this way.
+        for (const name of archives.slice(maxArchives))
+            fs.unlinkSync(join(dir, name));
+    }
+    /**
+     * Closes the current descriptor, renames it to an archive name, and opens a fresh `<stem>.log`.
+     * Order matters: the descriptor is closed *before* the rename (a file open on Windows cannot be
+     * renamed by the process holding it), per design D4.
+     *
+     * Returns whether a writable file is open afterwards. A rename failure alone is not fatal — it
+     * leaves the active file in place under its old name, so this falls back to reopening *that*
+     * file and retries rotation on the next write. Only a failure that leaves nothing open (the
+     * fallback reopen also fails, or the freshly-renamed-to file cannot be opened) is fatal; the
+     * caller disables the writer for that.
+     *
+     * May throw — a failing close, say. `write` turns that into `disable`, so it is fatal too.
+     */
+    function rotate() {
+        const current = fd;
+        if (current === undefined)
+            return false;
+        // Forgotten before the close, not after: a close that throws has still released the number
+        // (close(2) does, even on EIO), so `disable` must not close it again — by then it may be
+        // another file's descriptor.
+        fd = undefined;
+        fs.closeSync(current);
+        const target = archivePath(now());
+        try {
+            if (fs.existsSync(target))
+                fs.renameSync(target, `${target}.bak`);
+            fs.renameSync(path, target);
+        }
+        catch {
+            try {
+                fd = fs.openSync(path, 'a');
+                size = fs.statSync(path).size;
+                return true;
+            }
+            catch {
+                return false;
+            }
+        }
+        try {
+            fd = fs.openSync(path, 'a');
+            size = 0;
+        }
+        catch {
+            return false;
+        }
+        try {
+            pruneArchives();
+        }
+        catch {
+            // Cleanup only — rotation itself already succeeded.
+        }
+        return true;
+    }
+    return {
+        write(target, level, message) {
+            if (disabled)
+                return;
+            // One guard around the whole entry, rotation included: whatever throws in here — a failed
+            // write, a close that fails mid-rotation, anything unforeseen — disables the writer with its
+            // one warning instead of reaching the caller (in the app daemon, a throw here would end the
+            // process). A failed rename is not a throw here: `rotate` recovers from it by itself.
+            try {
+                const entry = formatLogLine(now(), target, level, message);
+                const bytes = Buffer.byteLength(entry, 'utf8');
+                if (size > 0 && size + bytes > maxBytes && !rotate()) {
+                    disable('rotation left no writable file');
+                    return;
+                }
+                const openFd = fd;
+                if (openFd === undefined) {
+                    // Unreachable: `disabled` (checked above) is the only state with no open `fd`, and a
+                    // `rotate()` that returns `true` always leaves one open. Kept as a safety net, not a path
+                    // any test drives.
+                    disable('no open file');
+                    return;
+                }
+                fs.writeSync(openFd, entry);
+                size += bytes;
+            }
+            catch (error) {
+                disable(error instanceof Error ? error.message : String(error));
+            }
+        },
+        close() {
+            if (disabled || fd === undefined)
+                return;
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // best effort — the descriptor may already be unusable
+            }
+            fd = undefined;
+            disabled = true;
+        },
+    };
+}
+//# sourceMappingURL=log-file.js.map

package/dist/host/log-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-file.js","sourceRoot":"","sources":["../../src/host/log-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,QAAQ,EACR,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC7C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAEjC,mGAAmG;AACnG,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAE9C;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,MAAc,EAAE,KAAe,EAAE,OAAe;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9B,OAAO,IAAI,GAAG,KAAK,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,KAAK,KAAK,OAAO,IAAI,CAAA;AAC7F,CAAC;AAED,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,IAAU;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAC9B,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAA;AACtE,CAAC;AAED,MAAM,eAAe,GAAG,4CAA4C,CAAA;AAkBpE,MAAM,MAAM,GAAc;IACxB,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAA;AAoBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY,EAAE,UAA0B,EAAE;IACjF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,MAAM,CAAA;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAA;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAA;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IAErC,IAAI,EAAsB,CAAA;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,wFAAwF;IACxF,SAAS,OAAO,CAAC,MAAc;QAC7B,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;YACD,EAAE,GAAG,SAAS,CAAA;QAChB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC3B,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAE,KAAe,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,SAAS,WAAW,CAAC,IAAU;QAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED,SAAS,aAAa;QACpB,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;QACzB,MAAM,QAAQ,GAAG,EAAE;aAChB,WAAW,CAAC,GAAG,CAAC;aAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;aAC5F,IAAI,EAAE;aACN,OAAO,EAAE,CAAA,CAAC,kFAAkF;QAC/F,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IAChF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,MAAM;QACb,MAAM,OAAO,GAAG,EAAE,CAAA;QAClB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACvC,2FAA2F;QAC3F,yFAAyF;QACzF,6BAA6B;QAC7B,EAAE,GAAG,SAAS,CAAA;QACd,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAErB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,CAAA;YACjE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC3B,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;gBAC7B,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YAC3B,IAAI,GAAG,CAAC,CAAA;QACV,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC;YACH,aAAa,EAAE,CAAA;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO;YAC1B,IAAI,QAAQ;gBAAE,OAAM;YACpB,0FAA0F;YAC1F,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;gBAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBAC9C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACrD,OAAO,CAAC,gCAAgC,CAAC,CAAA;oBACzC,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAG,EAAE,CAAA;gBACjB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,qFAAqF;oBACrF,0FAA0F;oBAC1F,mBAAmB;oBACnB,OAAO,CAAC,cAAc,CAAC,CAAA;oBACvB,OAAM;gBACR,CAAC;gBACD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;gBAC3B,IAAI,IAAI,KAAK,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,QAAQ,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAM;YACxC,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;YACD,EAAE,GAAG,SAAS,CAAA;YACd,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/host/recipes/enable-wsl.d.ts

@@ -0,0 +1,63 @@
+/**
+ * `windows.enable-wsl` (change `add-tensorrt-llm-windows`, task 2.4, design D2): the one privileged
+ * thing Atomic Chat ever asks for on Windows. The app runs `atomic-chat-core.exe host-step exec
+ * <request>` through UAC; the executor runs exactly `wsl --install`, then `wsl --status`, which says
+ * whether a WSL 2 VM can start now or only after a restart.
+ *
+ * Bare `wsl --install`, not `wsl --install --no-distribution`: on a Windows without the WSL package
+ * `System32\wsl.exe` is an inbox stub that understands only the bare form — it answered "The Windows
+ * Subsystem for Linux is not installed" to `--install --no-distribution` and to `--update` alike in
+ * the live acceptance (build 26200). The cost, accepted by the owner (2026-10-02): Windows also
+ * installs its default Ubuntu distribution, which may open its own first-run console after the
+ * restart. Atomic Chat never uses it; its own distribution is still imported unelevated afterwards.
+
+ * It takes no parameter. Nothing a client, a request file or a person could choose reaches the
+ * elevated process: no distribution name, no path, no flag. And it never runs `wsl.exe` with a
+ * distribution (`-d`, `--exec`, `--import`, …): an elevated `wsl.exe` registers and starts
+ * distributions for the elevated token — another user, or another mount namespace of the same one —
+ * where the app would never find them (microsoft/WSL#9690). Importing is the unelevated core's job.
+ *
+ * When no restart is needed (the VM platform was already on), `wsl --install` does not exit: its last
+ * act is to start the Ubuntu it installed, whose first-run prompt waits for a user name in the
+ * executor's hidden console — until the install deadline (live, build 26200, 2026-10-05). So while it
+ * runs the executor asks `wsl --list --running`: a running distribution means the install is done and
+ * a WSL 2 VM has started, and the install's process tree is ended there. A distribution already
+ * running before the install would answer the same, so then the executor waits for the exit as before.
+ *
+ * Its outcome: `completed` when WSL answers `--status` right away, `reboot-required` when the install
+ * succeeded but WSL cannot start until Windows restarts (or the installer said so with 3010), `failed`
+ * with the installer's exit code and output otherwise. `wsl.exe` here is the bare name; the Windows
+ * executor's I/O resolves it to `%SystemRoot%\System32\wsl.exe`, never `PATH`.
+ */
+import type { EnableWslStepParameters, Sha256Digest } from '../../contracts/index.js';
+export declare const ENABLE_WSL_RECIPE_ID = "windows.enable-wsl";
+/** `ERROR_SUCCESS_REBOOT_REQUIRED`: the installer succeeded and Windows must restart before it applies. */
+export declare const REBOOT_REQUIRED_EXIT_CODE = 3010;
+/** The recipe as data: the three argv it runs, frozen, and what its digest is computed from. */
+export declare const ENABLE_WSL_RECIPE: Readonly<{
+    recipe_id: "windows.enable-wsl";
+    install: readonly string[];
+    /** Asked before and while the install runs: exits 0 once a distribution runs. */
+    watch: readonly string[];
+    verify: readonly string[];
+    reboot_required_exit_code: 3010;
+}>;
+export declare const ENABLE_WSL_RECIPE_DIGEST: Sha256Digest;
+/** The digest of the (empty) parameters: what a step and its receipt carry. */
+export declare function enableWslParametersDigest(parameters: EnableWslStepParameters): Sha256Digest;
+export declare const ENABLE_WSL_PARAMETERS_DIGEST: Sha256Digest;
+export type EnableWslValidation = {
+    ok: true;
+    parameters: EnableWslStepParameters;
+} | {
+    ok: false;
+    problems: string[];
+};
+/** The only valid parameters are none: any key at all is refused. */
+export declare function validateEnableWslParameters(value: unknown): EnableWslValidation;
+/** What the Windows provisioner binds a `windows.enable-wsl` step to (`EnableWslBinding`). */
+export declare const ENABLE_WSL_BINDING: Readonly<{
+    recipe_id: "windows.enable-wsl";
+    recipe_digest: `sha256:${string}`;
+    parameters_digest: `sha256:${string}`;
+}>;

package/dist/host/recipes/enable-wsl.js

@@ -0,0 +1,73 @@
+/**
+ * `windows.enable-wsl` (change `add-tensorrt-llm-windows`, task 2.4, design D2): the one privileged
+ * thing Atomic Chat ever asks for on Windows. The app runs `atomic-chat-core.exe host-step exec
+ * <request>` through UAC; the executor runs exactly `wsl --install`, then `wsl --status`, which says
+ * whether a WSL 2 VM can start now or only after a restart.
+ *
+ * Bare `wsl --install`, not `wsl --install --no-distribution`: on a Windows without the WSL package
+ * `System32\wsl.exe` is an inbox stub that understands only the bare form — it answered "The Windows
+ * Subsystem for Linux is not installed" to `--install --no-distribution` and to `--update` alike in
+ * the live acceptance (build 26200). The cost, accepted by the owner (2026-10-02): Windows also
+ * installs its default Ubuntu distribution, which may open its own first-run console after the
+ * restart. Atomic Chat never uses it; its own distribution is still imported unelevated afterwards.
+
+ * It takes no parameter. Nothing a client, a request file or a person could choose reaches the
+ * elevated process: no distribution name, no path, no flag. And it never runs `wsl.exe` with a
+ * distribution (`-d`, `--exec`, `--import`, …): an elevated `wsl.exe` registers and starts
+ * distributions for the elevated token — another user, or another mount namespace of the same one —
+ * where the app would never find them (microsoft/WSL#9690). Importing is the unelevated core's job.
+ *
+ * When no restart is needed (the VM platform was already on), `wsl --install` does not exit: its last
+ * act is to start the Ubuntu it installed, whose first-run prompt waits for a user name in the
+ * executor's hidden console — until the install deadline (live, build 26200, 2026-10-05). So while it
+ * runs the executor asks `wsl --list --running`: a running distribution means the install is done and
+ * a WSL 2 VM has started, and the install's process tree is ended there. A distribution already
+ * running before the install would answer the same, so then the executor waits for the exit as before.
+ *
+ * Its outcome: `completed` when WSL answers `--status` right away, `reboot-required` when the install
+ * succeeded but WSL cannot start until Windows restarts (or the installer said so with 3010), `failed`
+ * with the installer's exit code and output otherwise. `wsl.exe` here is the bare name; the Windows
+ * executor's I/O resolves it to `%SystemRoot%\System32\wsl.exe`, never `PATH`.
+ */
+import { canonicalDigest } from '../../runtime/environment/index.js';
+export const ENABLE_WSL_RECIPE_ID = 'windows.enable-wsl';
+/** `ERROR_SUCCESS_REBOOT_REQUIRED`: the installer succeeded and Windows must restart before it applies. */
+export const REBOOT_REQUIRED_EXIT_CODE = 3010;
+/** The recipe as data: the three argv it runs, frozen, and what its digest is computed from. */
+export const ENABLE_WSL_RECIPE = Object.freeze({
+    recipe_id: ENABLE_WSL_RECIPE_ID,
+    install: Object.freeze(['wsl.exe', '--install']),
+    /** Asked before and while the install runs: exits 0 once a distribution runs. */
+    watch: Object.freeze(['wsl.exe', '--list', '--running']),
+    verify: Object.freeze(['wsl.exe', '--status']),
+    reboot_required_exit_code: REBOOT_REQUIRED_EXIT_CODE,
+});
+export const ENABLE_WSL_RECIPE_DIGEST = canonicalDigest({
+    recipe_id: ENABLE_WSL_RECIPE.recipe_id,
+    install: [...ENABLE_WSL_RECIPE.install],
+    watch: [...ENABLE_WSL_RECIPE.watch],
+    verify: [...ENABLE_WSL_RECIPE.verify],
+    reboot_required_exit_code: ENABLE_WSL_RECIPE.reboot_required_exit_code,
+});
+/** The digest of the (empty) parameters: what a step and its receipt carry. */
+export function enableWslParametersDigest(parameters) {
+    return canonicalDigest(parameters);
+}
+export const ENABLE_WSL_PARAMETERS_DIGEST = enableWslParametersDigest({});
+/** The only valid parameters are none: any key at all is refused. */
+export function validateEnableWslParameters(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return { ok: false, problems: ['parameters must be an object'] };
+    }
+    const keys = Object.keys(value);
+    return keys.length === 0
+        ? { ok: true, parameters: {} }
+        : { ok: false, problems: [`windows.enable-wsl takes no parameters (got ${keys.sort().join(', ')})`] };
+}
+/** What the Windows provisioner binds a `windows.enable-wsl` step to (`EnableWslBinding`). */
+export const ENABLE_WSL_BINDING = Object.freeze({
+    recipe_id: ENABLE_WSL_RECIPE_ID,
+    recipe_digest: ENABLE_WSL_RECIPE_DIGEST,
+    parameters_digest: ENABLE_WSL_PARAMETERS_DIGEST,
+});
+//# sourceMappingURL=enable-wsl.js.map

package/dist/host/recipes/enable-wsl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable-wsl.js","sourceRoot":"","sources":["../../../src/host/recipes/enable-wsl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AAEpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAA;AAExD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAA;AAE7C,gGAAgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,oBAAoB;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAsB;IACrE,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAsB;IAC7E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAsB;IACnE,yBAAyB,EAAE,yBAAyB;CACrD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAiB,eAAe,CAAC;IACpE,SAAS,EAAE,iBAAiB,CAAC,SAAS;IACtC,OAAO,EAAE,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACrC,yBAAyB,EAAE,iBAAiB,CAAC,yBAAyB;CACvE,CAAC,CAAA;AAEF,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,UAAmC;IAC3E,OAAO,eAAe,CAAC,UAAU,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAiB,yBAAyB,CAAC,EAAE,CAAC,CAAA;AAKvF,qEAAqE;AACrE,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,+CAA+C,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AACzG,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,oBAAoB;IAC/B,aAAa,EAAE,wBAAwB;IACvC,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAA"}

package/dist/host/recipes/executor-io-windows.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The real I/O behind `executeHostStep` on Windows (change `add-tensorrt-llm-windows`, task 2.4,
+ * design D15), for a process UAC elevated. The Linux checks (`executor-io.ts`) trust a folder by its
+ * uid and mode bits; Windows has neither, so the same promise is kept with its owner and its ACL.
+ *
+ * The app writes `<step_id>.request.json` into a folder under the user's `%LOCALAPPDATA%` whose ACL
+ * grants access only to the user, `SYSTEM` and `Administrators`, then runs this executor elevated.
+ * Before the request is read and again before the result is written, the folder — and the request
+ * itself — must be:
+ *
+ * - a real directory (file), not a reparse point: a junction or a symlink could send the elevated
+ *   write of `<step_id>.result.json` into a system folder;
+ * - owned by an account, not by a broad group (`Everyone`, `Users`, `Authenticated Users`, …);
+ * - writable by nobody but that owner, `SYSTEM`, `Administrators` and `CREATOR OWNER`: an `Allow`
+ *   entry granting any write, delete or permission-changing right to anyone else refuses it.
+ *
+ * Owner and ACL are read by SID, never by name (names are localized): one PowerShell query per
+ * path, the path passed in an environment variable rather than spliced into the script. Every file
+ * the executor writes goes to a fresh temporary name created exclusively and is renamed into place.
+ *
+ * Commands: only `wsl.exe`, resolved to `%SystemRoot%\System32\wsl.exe`; anything else is refused —
+ * the only recipe that runs on Windows is `windows.enable-wsl`.
+ */
+import type { HostCommandOutput, HostStepExecutorDeps } from './executor.js';
+/** One access rule as `Get-Acl` reports it, by SID. */
+export interface WindowsAclRule {
+    sid: string;
+    allow: boolean;
+    rights: number;
+}
+/** A path's owner, ACL and whether it is a reparse point. */
+export interface WindowsAcl {
+    reparse: boolean;
+    directory: boolean;
+    owner: string;
+    rules: WindowsAclRule[];
+}
+/** Why `acl` cannot be trusted for `what`, or null when it can. Pure. */
+export declare function judgeWindowsAcl(acl: WindowsAcl, what: string, expect: 'directory' | 'file'): string | null;
+/** `Get-Acl`'s answer, parsed; throws when PowerShell did not give one. */
+export declare function parseWindowsAcl(output: HostCommandOutput): WindowsAcl;
+/** The calls this module makes, injectable so a test fakes owners and ACLs it cannot create. */
+export interface WindowsHostStepIo {
+    /** Runs one command, no shell; `env` is added to the inherited environment. */
+    exec(command: string, args: string[], options?: {
+        timeoutMs?: number;
+        env?: Record<string, string>;
+        console?: boolean;
+        /** With `console`: polled while it runs; true ends the process tree (`cutShort`, code 0). */
+        until?: () => Promise<boolean>;
+    }): Promise<HostCommandOutput>;
+    /** Whether `path` is a symlink/junction, a file, a directory, and its size. */
+    lstat(path: string): Promise<{
+        isSymbolicLink(): boolean;
+        isFile(): boolean;
+        isDirectory(): boolean;
+        size: number;
+    }>;
+    readFile(path: string): Promise<string>;
+    /** Creates `path` exclusively and writes `text`; never follows or replaces what is there. */
+    createExclusive(path: string, text: string): Promise<void>;
+    rename(from: string, to: string): Promise<void>;
+    remove(path: string): Promise<void>;
+}
+/**
+ * The executor's dependencies on a Windows machine. `env` gives `%SystemRoot%`, where the only
+ * command it runs — `wsl.exe` — and PowerShell live.
+ */
+export declare function windowsHostStepDeps(env: NodeJS.ProcessEnv, io?: WindowsHostStepIo): HostStepExecutorDeps;