@cuna_labs/cli 0.1.0 → 0.1.1

package/dist/platform/process-lock.js

@@ -0,0 +1,114 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, realpath, rename, unlink } from "node:fs/promises";
+import { createConnection, createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/**
+ * Take the lock named by `(scope, key)`, or answer `undefined` when another
+ * live process holds it. `undefined` is an ordinary answer, not a fault.
+ */
+export async function tryAcquireProcessLock(scope, key) {
+    if (!/^[a-z][a-z0-9-]{0,39}$/u.test(scope))
+        throw new TypeError("A process lock scope must be a short lowercase name.");
+    const endpoint = await lockEndpoint(scope, key);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const server = createServer((socket) => socket.destroy());
+        try {
+            await listen(server, endpoint);
+            return heldLock(server);
+        }
+        catch (error) {
+            await closeUnbound(server);
+            if (error.code !== "EADDRINUSE")
+                throw error;
+            if (process.platform === "win32" || await socketIsActive(endpoint))
+                return undefined;
+            await removeStaleSocket(endpoint);
+        }
+    }
+    return undefined;
+}
+async function lockEndpoint(scope, key) {
+    const digest = createHash("sha256").update(`cuna-process-lock-v1\0${scope}\0`).update(key).digest("hex");
+    if (process.platform === "win32")
+        return `\\\\.\\pipe\\cuna-${scope}-${digest}`;
+    const uid = process.getuid?.();
+    if (uid === undefined)
+        throw new Error("The process lock needs a user identity on this platform.");
+    const directory = join(await realpath(tmpdir()), `.cuna-${uid}`);
+    try {
+        await mkdir(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    const entry = await lstat(directory);
+    if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== uid) {
+        throw new Error("The process lock directory is not a private directory of this user.");
+    }
+    await chmod(directory, 0o700);
+    return join(directory, `${scope}-${digest.slice(0, 32)}.sock`);
+}
+async function listen(server, endpoint) {
+    await new Promise((resolveListen, rejectListen) => {
+        const onError = (error) => {
+            server.removeListener("listening", onListening);
+            rejectListen(error);
+        };
+        const onListening = () => {
+            server.removeListener("error", onError);
+            resolveListen();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(endpoint);
+    });
+}
+function heldLock(server) {
+    // A lock must not keep the process alive on its own.
+    server.unref();
+    let released = false;
+    return Object.freeze({
+        release: async () => {
+            if (released)
+                return;
+            released = true;
+            // Node removes a Unix socket's pathname while closing. Never unlink
+            // after: another process may already have bound the name again.
+            await new Promise((resolveClose) => server.close(() => resolveClose()));
+        },
+    });
+}
+async function closeUnbound(server) {
+    if (server.listening)
+        await new Promise((resolveClose) => server.close(() => resolveClose()));
+}
+async function socketIsActive(endpoint) {
+    return new Promise((resolveProbe) => {
+        const socket = createConnection(endpoint);
+        socket.once("connect", () => {
+            socket.destroy();
+            resolveProbe(true);
+        });
+        socket.once("error", (error) => {
+            socket.destroy();
+            resolveProbe(error.code !== "ECONNREFUSED" && error.code !== "ENOENT");
+        });
+    });
+}
+async function removeStaleSocket(endpoint) {
+    const stale = `${endpoint}.stale-${process.pid}-${randomUUID()}`;
+    try {
+        const entry = await lstat(endpoint);
+        if (!entry.isSocket() || entry.isSymbolicLink())
+            throw new Error("The stale process lock is not a socket.");
+        await rename(endpoint, stale);
+        await unlink(stale);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+//# sourceMappingURL=process-lock.js.map

package/dist/platform/process-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-lock.js","sourceRoot":"","sources":["../../src/platform/process-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAe,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkBjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,GAAW;IACpE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IACxH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAK,KAA+B,CAAC,IAAI,KAAK,YAAY;gBAAE,MAAM,KAAK,CAAC;YACxE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,cAAc,CAAC,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrF,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,GAAW;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,qBAAqB,KAAK,IAAI,MAAM,EAAE,CAAC;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,QAAgB;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,qDAAqD;IACrD,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,IAAmB,EAAE;YACjC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,oEAAoE;YACpE,gEAAgE;YAChE,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,OAAO,IAAI,OAAO,CAAU,CAAC,YAAY,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACpD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAG,GAAG,QAAQ,UAAU,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5G,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/runtime/boundary.d.ts

@@ -93,6 +93,8 @@ export interface RuntimeBoundaryOptions {
     readonly readyTimeoutMs?: number;
     readonly outputDeliveryTimeoutMs?: number;
     readonly heartbeatTimeoutMs?: number;
+    /** How long sent input may wait for its acknowledgement; see `INPUT_ACKNOWLEDGEMENT_DEADLINE_MS`. */
+    readonly inputAcknowledgementTimeoutMs?: number;
     readonly onTerminalReady?: (snapshot: RuntimeTerminalSnapshot) => void | Promise<void>;
     readonly onTerminalGeometry?: (event: {
         readonly snapshot: RuntimeTerminalSnapshot;

package/dist/runtime/boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../../src/runtime/boundary.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGvF,OAAO,EACL,mBAAmB,EAEnB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAQL,KAAK,uBAAuB,EAM5B,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAE7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAA6C,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAGhH,OAAO,EAOL,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,UAAU,GACV,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,GAAG,YAAY,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE1D,MAAM,MAAM,+BAA+B,GACvC,QAAQ,GACR,OAAO,GACP,WAAW,GACX,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACpF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAC5D,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChM,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5I,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAAC;QAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;KAC9B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAClI,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACrD,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AA0DD,qBAAa,mBAAmB;;gBAiClB,OAAO,EAAE,sBAAsB;IAkB3C,IAAI,MAAM,IAAI,uBAAuB,CAEpC;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED,IAAI,IAAI,IAAI,mBAAmB,CAE9B;IAED,IAAI,UAAU,IAAI,kCAAkC,CAEnD;IAED,KAAK,CAAC,QAAQ,EAAE,sBAAsB,GAAG,uBAAuB;IA4BhE,eAAe,IAAI,kCAAkC;IAgB/C,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;QACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgOpC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB;IAUpD,uBAAuB,CAAC,KAAK,qBAAoB,GAAG,uBAAuB;IAOrE,SAAS,CACb,KAAK,EAAE,UAAU,EACjB,KAAK,qBAAoB,EACzB,eAAe,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,GACnD,OAAO,CAAC,IAAI,CAAC;IAkBV,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuDtE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,qBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/E,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,EAAE,KAAK,qBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/F,sBAAsB,CAC1B,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,4BAA4B,EAC7H,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,KAAK,qBAAoB,GACxB,OAAO,CAAC,IAAI,CAAC;IAsEhB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkE9G,SAAS,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA8Q7G,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B1C,aAAa,IAAI,SAAS,uBAAuB,EAAE;IAI7C,QAAQ,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;QAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoExB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA2wBhC"}
+{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../../src/runtime/boundary.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGvF,OAAO,EACL,mBAAmB,EAEnB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAQL,KAAK,uBAAuB,EAM5B,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAE7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAA6C,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAGhH,OAAO,EAOL,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,yBAAyB,CAAC;AA4DjC,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,UAAU,GACV,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,GAAG,YAAY,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE1D,MAAM,MAAM,+BAA+B,GACvC,QAAQ,GACR,OAAO,GACP,WAAW,GACX,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACpF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAC5D,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChM,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,qGAAqG;IACrG,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5I,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAAC;QAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;KAC9B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAClI,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACrD,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AA4DD,qBAAa,mBAAmB;;gBAiClB,OAAO,EAAE,sBAAsB;IAkB3C,IAAI,MAAM,IAAI,uBAAuB,CAEpC;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED,IAAI,IAAI,IAAI,mBAAmB,CAE9B;IAED,IAAI,UAAU,IAAI,kCAAkC,CAEnD;IAED,KAAK,CAAC,QAAQ,EAAE,sBAAsB,GAAG,uBAAuB;IA4BhE,eAAe,IAAI,kCAAkC;IAgB/C,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;QACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgOpC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB;IAUpD,uBAAuB,CAAC,KAAK,qBAAoB,GAAG,uBAAuB;IAOrE,SAAS,CACb,KAAK,EAAE,UAAU,EACjB,KAAK,qBAAoB,EACzB,eAAe,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,GACnD,OAAO,CAAC,IAAI,CAAC;IAkBV,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwDtE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,qBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/E,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,EAAE,KAAK,qBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/F,sBAAsB,CAC1B,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,4BAA4B,EAC7H,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,KAAK,qBAAoB,GACxB,OAAO,CAAC,IAAI,CAAC;IAsEhB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkE9G,SAAS,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA8Q7G,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B1C,aAAa,IAAI,SAAS,uBAAuB,EAAE;IAI7C,QAAQ,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;QAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoExB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAy2BhC"}

package/dist/runtime/boundary.js

@@ -8,6 +8,62 @@ import { admitCapability, writerTransferCapability } from "./capability-gate.js"
 import { RuntimeBoundaryError, runtimeFailure, terminalHistoryGap } from "./errors.js";
 import { assertReadyPayloadMatches, assertRemoteAgentSessionEvidence, validateTerminalGrant, } from "./terminal-transport.js";
 const MAX_RUNTIME_EVIDENCE_TTL_MS = 5 * 60_000;
+/**
+ * How long a terminal attach waits for the server to prove the terminal
+ * capability before reporting the refusal it saw last. Two supervisor
+ * heartbeat periods (the slowest measured was 19 s) plus the lease renewal
+ * they carry; long enough for a lapsed lease or a not-yet-attested PTY to
+ * turn into a proof, short enough that a person is not left staring.
+ */
+const TERMINAL_ADMISSION_WAIT_MS = 45_000;
+const TERMINAL_ADMISSION_POLL_MS = 3_000;
+/**
+ * Refusals a later capability read can turn into an admission. Everything
+ * else is reported at once: a gone process, a supervisor that needs an
+ * update, a capability this server does not offer, a snapshot for another
+ * resource.
+ */
+const TERMINAL_ADMISSION_TRANSIENT_REASONS = new Set([
+    "runtime_lease_expired",
+    "supervisor_registry_unavailable",
+]);
+function terminalAdmissionMayResolveByWaiting(error) {
+    if (!(error instanceof RuntimeBoundaryError))
+        return false;
+    if (error.code !== "capability_unavailable" && error.code !== "capability_unknown")
+        return false;
+    const reason = error.safeDetails?.reason_code;
+    // `temporarily_unavailable` with no named reason, or `unknown` availability
+    // with no named reason, are the server's own "not yet"; a named reason is
+    // waited on only when it is one that renews itself.
+    return reason === undefined || TERMINAL_ADMISSION_TRANSIENT_REASONS.has(String(reason));
+}
+function waitForTerminalAdmission(milliseconds, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted === true) {
+            reject(signal.reason);
+            return;
+        }
+        const timer = setTimeout(() => { signal?.removeEventListener("abort", onAbort); resolve(); }, milliseconds);
+        const onAbort = () => { clearTimeout(timer); reject(signal?.reason); };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/**
+ * How long a sent key may go unacknowledged before the CLI treats the
+ * connection as stalled, says so, and reconnects.
+ *
+ * Measured 2026-09-22 17:44Z on qa5 (R12): keys i7–i9 were sent and never
+ * acknowledged, and the screen said nothing for 19.2 s, until Windows gave up
+ * retransmitting and aborted the socket. The only Cuna bound on that path was
+ * the 45 s heartbeat, so a stalled path owned the terminal for up to 45 s.
+ *
+ * 5 000 ms is 1.75x the slowest acknowledgement seen on a healthy path, 2 847 ms
+ * (r12rep1; the rest 134–532 ms), and a quarter of the 18.9 s Windows needs to
+ * abort. A deadline that fires on a slow but live path costs one reconnect; the
+ * input is never resent either way (`retireInputAcceptance`).
+ */
+const INPUT_ACKNOWLEDGEMENT_DEADLINE_MS = 5_000;
 export class CunaRuntimeBoundary {
     #options;
     #clock;
@@ -182,7 +238,7 @@ export class CunaRuntimeBoundary {
                 inputSequence: 0n,
                 acknowledgedInputSequence: 0n,
                 inputContinuity: "none",
-                pendingInputSequences: new Set(),
+                pendingInputSequences: new Map(),
                 historicalInputUncertainty: false,
                 retiredInputSequence: 0n,
                 outputSequence: 0n,
@@ -408,8 +464,9 @@ export class CunaRuntimeBoundary {
             });
             entry.wireSequence = inputSequence;
             entry.inputSequence = inputSequence;
-            entry.pendingInputSequences.add(entry.inputSequence);
+            entry.pendingInputSequences.set(entry.inputSequence, this.#clock());
             entry.inputContinuity = "uncertain";
+            this.#armInputAcknowledgementDeadline(entry, authority.connection, authority.connectionRevision);
             await authority.connection.send(frame);
             this.#publish(entry);
         });
@@ -1093,14 +1150,43 @@ export class CunaRuntimeBoundary {
             throw new AggregateError(failures, "The Cuna runtime stopped with cleanup failures.");
     }
     async #admitRemoteTerminal(agentSessionId, signal) {
-        const snapshot = await this.#options.controlPlane.discoverCapabilities("agent_session", agentSessionId, signal);
-        const capability = admitCapability(snapshot, {
+        const requirement = {
             id: this.#options.terminalCapabilityId,
             scope: "agent_session",
             subjectId: agentSessionId,
             surface: "cli",
             interaction: "native",
-        }, this.#clock());
+        };
+        /*
+         * The terminal capability is a moving fact: the server proves it only
+         * while the AgentSession's runtime lease is fresh and its PTY is attested,
+         * and both are renewed by a supervisor heartbeat every 10-19 s. Read once,
+         * a fresh session is refused at two ordinary moments — the first seconds
+         * after launch, before the attachment is attested, and the last seconds of
+         * a lease window, before the next heartbeat renews it. Measured 2026-09-21
+         * on Machine bd94a624: "could not verify live terminal control" 107 s after
+         * launch, then "needs a fresh runtime check" on a running session whose
+         * lease had 0.7 s left. A person reading either is told to retry something
+         * that resolves itself within a heartbeat, so the CLI waits for it here,
+         * bounded, and only then reports the refusal it saw last. A reason that
+         * cannot change by waiting (a gone process, a supervisor that needs an
+         * update) is reported at once.
+         */
+        const deadline = this.#clock() + TERMINAL_ADMISSION_WAIT_MS;
+        let snapshot;
+        let capability;
+        for (;;) {
+            snapshot = await this.#options.controlPlane.discoverCapabilities("agent_session", agentSessionId, signal);
+            try {
+                capability = admitCapability(snapshot, requirement, this.#clock());
+                break;
+            }
+            catch (error) {
+                if (!terminalAdmissionMayResolveByWaiting(error) || this.#clock() >= deadline || signal?.aborted === true)
+                    throw error;
+                await waitForTerminalAdmission(TERMINAL_ADMISSION_POLL_MS, signal);
+            }
+        }
         const observation = assertRemoteAgentSessionEvidence({
             evidence: await this.#options.controlPlane.observeAgentSession(agentSessionId, signal),
             expectedAgentSessionId: agentSessionId,
@@ -1237,10 +1323,10 @@ export class CunaRuntimeBoundary {
     #requireGrantCapability(entry, name) {
         const matches = entry.capabilities.filter((capability) => capability.name === name);
         if (matches.length !== 1 || matches[0]?.availability === "unknown") {
-            throw runtimeFailure("capability_unknown", `Cuna cannot prove terminal capability ${name}.`);
+            throw runtimeFailure("capability_unknown", `Cuna cannot prove terminal capability ${name}.`, { safeDetails: { capability: name } });
         }
         if (matches[0]?.availability !== "supported") {
-            throw runtimeFailure("capability_unsupported", `Terminal capability ${name} is unsupported.`);
+            throw runtimeFailure("capability_unsupported", `Terminal capability ${name} is unsupported.`, { safeDetails: { capability: name } });
         }
     }
     async #pump(entry, connection, connectionRevision, iterator) {
@@ -1501,7 +1587,7 @@ export class CunaRuntimeBoundary {
                 payload.meaning !== "durably_accepted_not_executed") {
                 throw runtimeFailure("terminal_protocol_error", "Terminal input acknowledgement is invalid.");
             }
-            for (const sequence of entry.pendingInputSequences) {
+            for (const sequence of entry.pendingInputSequences.keys()) {
                 if (sequence <= acknowledged)
                     entry.pendingInputSequences.delete(sequence);
             }
@@ -1684,6 +1770,63 @@ export class CunaRuntimeBoundary {
         this.#publish(entry);
         void connection.close({ code: 1001, reason: "cuna_heartbeat_expired" }).catch(() => undefined);
     }
+    #inputAcknowledgementTimeoutMs() {
+        const timeoutMs = this.#options.inputAcknowledgementTimeoutMs ?? INPUT_ACKNOWLEDGEMENT_DEADLINE_MS;
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 120_000) {
+            throw runtimeFailure("terminal_protocol_error", "The terminal input acknowledgement deadline is invalid.");
+        }
+        return timeoutMs;
+    }
+    /**
+     * One timer per attachment, due when the OLDEST unacknowledged input reaches
+     * the deadline. An acknowledgement does not clear it: when it fires it looks
+     * at whichever input is oldest then, and either interrupts or re-arms for it,
+     * so a later key is measured from its own send time, not from the first one.
+     */
+    #armInputAcknowledgementDeadline(entry, connection, connectionRevision) {
+        if (entry.inputAcknowledgementTimer !== undefined)
+            return;
+        const oldestSentAt = entry.pendingInputSequences.values().next().value;
+        if (oldestSentAt === undefined)
+            return;
+        const deadlineMs = this.#inputAcknowledgementTimeoutMs();
+        entry.inputAcknowledgementTimer = setTimeout(() => {
+            delete entry.inputAcknowledgementTimer;
+            if (this.#closed ||
+                entry.connection !== connection ||
+                entry.connectionRevision !== connectionRevision ||
+                entry.state !== "active")
+                return;
+            const oldest = entry.pendingInputSequences.values().next().value;
+            if (oldest === undefined)
+                return;
+            if (this.#clock() - oldest < deadlineMs) {
+                this.#armInputAcknowledgementDeadline(entry, connection, connectionRevision);
+                return;
+            }
+            this.#expireInputAcknowledgement(entry, connection, connectionRevision);
+        }, Math.max(1, oldestSentAt + deadlineMs - this.#clock()));
+        entry.inputAcknowledgementTimer.unref();
+    }
+    /**
+     * The same interruption as an expired heartbeat, reached sooner and named
+     * for its cause. `retireInputAcceptance` marks the unacknowledged keys as
+     * uncertain history, which is what keeps them from ever being resent.
+     */
+    #expireInputAcknowledgement(entry, connection, connectionRevision) {
+        if (entry.connection !== connection ||
+            entry.connectionRevision !== connectionRevision ||
+            entry.state !== "active")
+            return;
+        this.#clearHeartbeatWatchdog(entry);
+        entry.outputAbort.abort(runtimeFailure("terminal_disconnected", "Terminal input was not acknowledged before its deadline."));
+        entry.state = "interrupted";
+        retireInputAcceptance(entry);
+        entry.outputContinuity = "unknown";
+        entry.reason = "input_ack_timeout";
+        this.#publish(entry);
+        void connection.close({ code: 1001, reason: "cuna_input_ack_timeout" }).catch(() => undefined);
+    }
     #nextActiveTab(excluding) {
         return [...this.#terminals.values()].find((entry) => entry.tabId !== excluding && entry.state === "active")?.tabId;
     }
@@ -1818,6 +1961,10 @@ function retireInputAcceptance(entry) {
     if (entry.inputSequence > entry.retiredInputSequence)
         entry.retiredInputSequence = entry.inputSequence;
     entry.pendingInputSequences.clear();
+    // Retired input has no deadline left to miss; the next scope arms its own.
+    if (entry.inputAcknowledgementTimer !== undefined)
+        clearTimeout(entry.inputAcknowledgementTimer);
+    delete entry.inputAcknowledgementTimer;
     if (entry.historicalInputUncertainty)
         entry.inputContinuity = "uncertain";
 }