@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-subagents/src/workflows/workflow-resources.js

@@ -3,8 +3,12 @@ import { stableJsonDigest } from "../shared/launch-contract.js";
 import {
   createWorkflowResourcePermit
 } from "../shared/workflow-child-permit.js";
+import { buildStructuredWorkflowScript, isPlainRecord } from "./structured-workflow-scripts.js";
 const RESOURCE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-const MAX_ARGS_BYTES = 16 * 1024;
+export const MAX_ARGS_BYTES = 16 * 1024;
+export const MAX_ARGS_FIELDS = 16;
+export const MAX_ARGS_ITEMS = 64;
+export const MAX_ARGS_DEPTH = 8;
 const MAX_STRING_BYTES = 16 * 1024;
 function registry() {
   const key = Symbol.for("dm-subagents.workflow-resources.v1");
@@ -34,7 +38,7 @@ export function registerWorkflowResource(input) {
     throw new Error("Workflow definition version must be a positive safe integer.");
   if (typeof resolve !== "function")
     throw new Error("Workflow definition requires a synchronous resolve function.");
-  if (findWorkflowResource(name))
+  if (findWorkflowResource(name) || STRUCTURED_WORKFLOW_RESOURCE_NAMES.includes(name))
     throw new Error(`Workflow resource '${name}' is a protected builtin.`);
   const current = registry();
   const bucket = current.bySession.get(sessionId) ?? new Map;
@@ -58,12 +62,6 @@ export function registerWorkflowResource(input) {
     }
   };
 }
-function isPlainRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
 function jsonByteLength(value) {
   try {
     const encoded = JSON.stringify(value);
@@ -75,7 +73,7 @@ function jsonByteLength(value) {
   }
 }
 function validatePlainJson(value, path, depth = 0) {
-  if (depth > 8)
+  if (depth > MAX_ARGS_DEPTH)
     throw new Error(`${path} is too deeply nested.`);
   if (value === null || typeof value === "boolean")
     return;
@@ -92,7 +90,7 @@ function validatePlainJson(value, path, depth = 0) {
     return;
   }
   if (Array.isArray(value)) {
-    if (value.length > 64)
+    if (value.length > MAX_ARGS_ITEMS)
       throw new Error(`${path} contains too many items.`);
     for (const [index, entry] of value.entries())
       validatePlainJson(entry, `${path}[${index}]`, depth + 1);
@@ -100,7 +98,7 @@ function validatePlainJson(value, path, depth = 0) {
   }
   if (!isPlainRecord(value))
     throw new Error(`${path} must contain plain JSON data.`);
-  if (Object.keys(value).length > 16)
+  if (Object.keys(value).length > MAX_ARGS_FIELDS)
     throw new Error(`${path} contains too many fields.`);
   for (const [key, entry] of Object.entries(value)) {
     if (!key.trim())
@@ -150,6 +148,16 @@ function resolveRunCi(args) {
     hostCommands: [{ key: "ci", command }]
   };
 }
+function resolveParallel(args) {
+  const unsupported = Object.keys(args).filter((key) => key !== "tasks");
+  if (unsupported.length > 0)
+    return { error: `workflow 'parallel' args contain unsupported fields: ${unsupported.join(", ")}. Pass args.tasks: [{ agent, task }, ...].` };
+  try {
+    return { script: buildStructuredWorkflowScript("tasks", args.tasks, undefined) };
+  } catch (error) {
+    return { error: `workflow 'parallel' args.${error instanceof Error ? error.message : String(error)}` };
+  }
+}
 function resolveReview(args) {
   const unsupported = Object.keys(args).filter((key) => key !== "task");
   if (unsupported.length > 0)
@@ -163,7 +171,8 @@ function resolveReview(args) {
 }
 const WORKFLOW_RESOURCES = [
   { name: "review", version: 1, resolve: resolveReview },
-  { name: "run-ci", version: 1, resolve: resolveRunCi }
+  { name: "run-ci", version: 1, resolve: resolveRunCi },
+  { name: "parallel", version: 1, resolve: resolveParallel }
 ];
 function findWorkflowResource(name) {
   return WORKFLOW_RESOURCES.find((resource) => resource.name === name);
@@ -171,6 +180,29 @@ function findWorkflowResource(name) {
 function listWorkflowResourceNames() {
   return WORKFLOW_RESOURCES.map((resource) => resource.name);
 }
+const STRUCTURED_WORKFLOW_RESOURCE_NAMES = ["tasks", "chain"];
+const STRUCTURED_WORKFLOW_RESOURCE_VERSION = 1;
+export function resolveStructuredWorkflowResource(input) {
+  try {
+    if (!isPlainRecord(input) || input.kind !== "tasks" && input.kind !== "chain")
+      return { ok: false, error: "Structured workflow kind must be 'tasks' or 'chain'." };
+    const { kind, steps, task } = input;
+    if (!Array.isArray(steps) || steps.length === 0)
+      return { ok: false, error: `${kind} must be a non-empty array.` };
+    validatePlainJson(steps, kind);
+    if (task !== undefined) {
+      if (typeof task !== "string" || !task.trim())
+        return { ok: false, error: "task must be a non-empty string when provided." };
+      validatePlainJson(task, "task");
+    }
+    if (jsonByteLength({ [kind]: steps, task }) > MAX_ARGS_BYTES)
+      return { ok: false, error: `${kind} input exceeds ${MAX_ARGS_BYTES} bytes.` };
+    const script = buildStructuredWorkflowScript(kind, JSON.parse(JSON.stringify(steps)), task);
+    return { ok: true, resource: issueWorkflowResource(kind, STRUCTURED_WORKFLOW_RESOURCE_VERSION, script) };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message.slice(0, 4096) : "Structured workflow resolution failed." };
+  }
+}
 export function resolveWorkflowResource(nameValue, argsValue, sessionId) {
   try {
     const result = resolveResource(nameValue, argsValue, sessionId);
@@ -206,21 +238,24 @@ function resolveResource(nameValue, argsValue, sessionId) {
   const { script, hostCommands } = resolved;
   if (Object.keys(resolved).some((key) => key !== "script" && key !== "hostCommands") || typeof script !== "string" || !script.trim())
     throw new Error("Workflow resource returned an invalid expansion.");
+  return { ok: true, resource: issueWorkflowResource(resource.name, resource.version, script, hostCommands) };
+}
+function issueWorkflowResource(name, version, script, hostCommands) {
   const resourceId = randomUUID();
   const permit = createWorkflowResourcePermit({
-    resourceName: resource.name,
-    resourceVersion: resource.version,
+    resourceName: name,
+    resourceVersion: version,
     resourceId,
     scriptDigest: stableJsonDigest(script),
     authority: { host: hostCommands }
   });
   const provenance = Object.freeze({
     kind: "workflow",
-    name: resource.name,
-    version: resource.version,
+    name,
+    version,
     invocation: "named",
     expansion: "resolved",
     id: resourceId
   });
-  return { ok: true, resource: { script, permit, provenance } };
+  return { script, permit, provenance };
 }

package/extensions/dm-subagents/src/workflows/workflow-reuse.js

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { readRecentTerminalRunIndex } from "../runs/background/terminal-run-index.js";
+import { readStatus } from "../shared/utils.js";
+import { workflowRunParamsFingerprint } from "./scripted-workflow.js";
+const WORKFLOW_STOP_CAUSE_RUNTIME_REPLACED = "runtime-replaced";
+const WORKFLOW_CHILD_JOURNAL_FILE = "workflow-children.jsonl";
+export const WORKFLOW_RUNTIME_REPLACED_RELAUNCH_NOTICE = "Async children that were still running keep running; relaunch the same workflow script with the same args to reuse finished children and re-attach to running ones.";
+export function runtimeReplacedAbortReason() {
+  return Object.assign(new Error("Workflow stopped because the extension session was replaced or reloaded."), { workflowStopCause: WORKFLOW_STOP_CAUSE_RUNTIME_REPLACED });
+}
+export function workflowStopCause(reason) {
+  return reason instanceof Error && "workflowStopCause" in reason && reason.workflowStopCause === WORKFLOW_STOP_CAUSE_RUNTIME_REPLACED ? WORKFLOW_STOP_CAUSE_RUNTIME_REPLACED : undefined;
+}
+function sha256(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+export function workflowScriptDigest(script) {
+  return sha256(script);
+}
+export function workflowChildFingerprint(params) {
+  return sha256(workflowRunParamsFingerprint(params));
+}
+export function appendWorkflowChildJournal(workflowAsyncDir, record) {
+  const journalPath = path.join(workflowAsyncDir, WORKFLOW_CHILD_JOURNAL_FILE);
+  try {
+    fs.appendFileSync(journalPath, `${JSON.stringify(record)}
+`, "utf-8");
+  } catch (error) {
+    console.error(`Failed to append workflow child journal '${journalPath}':`, error);
+  }
+}
+function readWorkflowChildJournal(runId, workflowAsyncDir) {
+  const source = { runId, started: new Map, settled: new Map };
+  let text = "";
+  try {
+    text = fs.readFileSync(path.join(workflowAsyncDir, WORKFLOW_CHILD_JOURNAL_FILE), "utf-8");
+  } catch {
+    return source;
+  }
+  for (const line of text.split(`
+`)) {
+    let record;
+    try {
+      record = line.trim() ? JSON.parse(line) : undefined;
+    } catch {
+      continue;
+    }
+    if (!record || typeof record.key !== "string" || typeof record.fingerprint !== "string")
+      continue;
+    if (record.type === "start" && typeof record.runId === "string") {
+      source.started.set(record.key, { fingerprint: record.fingerprint, runId: record.runId });
+    } else if (record.type === "settle" && record.result && typeof record.result === "object") {
+      source.settled.set(record.key, { fingerprint: record.fingerprint, result: record.result });
+    }
+  }
+  return source;
+}
+export function findWorkflowReuseSource(asyncDirRoot, sessionId, scriptDigest, argsDigest) {
+  let runIds;
+  try {
+    runIds = readRecentTerminalRunIndex(asyncDirRoot, { sessionId });
+  } catch {
+    return;
+  }
+  for (const runId of runIds) {
+    const asyncDir = path.join(asyncDirRoot, runId);
+    let status;
+    try {
+      status = readStatus(asyncDir);
+    } catch {
+      continue;
+    }
+    if (status?.mode !== "workflow" || status.workflow?.scriptDigest !== scriptDigest || status.workflow.argsDigest !== argsDigest)
+      continue;
+    return status.workflow.stopCause === WORKFLOW_STOP_CAUSE_RUNTIME_REPLACED ? readWorkflowChildJournal(runId, asyncDir) : undefined;
+  }
+  return;
+}
+export function matchWorkflowReuse(source, key, fingerprint) {
+  const settled = source.settled.get(key);
+  if (settled)
+    return settled.fingerprint === fingerprint && settled.result.ok ? { kind: "settled", result: settled.result } : undefined;
+  const started = source.started.get(key);
+  return started?.fingerprint === fingerprint ? { kind: "started", runId: started.runId } : undefined;
+}

package/extensions/dm-subagents/src/workflows/workflow-revival.js

@@ -0,0 +1,80 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writePrivateAtomicJson } from "../shared/atomic-json.js";
+import { readStatus } from "../shared/utils.js";
+const REVIVAL_LINK_FILE = "workflow-revival.json";
+export const REVIVAL_ORIGIN_FILE = "workflow-revival-origin.json";
+const MAX_REVIVAL_DEPTH = 16;
+const KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function isRunId(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 255 && path.basename(value) === value && value !== "." && value !== "..";
+}
+function readLink(file) {
+  let value;
+  try {
+    value = JSON.parse(fs.readFileSync(file, "utf-8"));
+  } catch {
+    return;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  const link = value;
+  if (link.version !== 1 || !isRunId(link.workflowRunId) || typeof link.workflowKey !== "string" || !KEY_PATTERN.test(link.workflowKey) || !isRunId(link.sourceRunId) || !isRunId(link.revivedRunId))
+    return;
+  if (!Number.isInteger(link.depth) || link.depth < 1 || link.depth > MAX_REVIVAL_DEPTH)
+    return;
+  return { version: 1, workflowRunId: link.workflowRunId, workflowKey: link.workflowKey, sourceRunId: link.sourceRunId, revivedRunId: link.revivedRunId, depth: link.depth };
+}
+export function recordWorkflowRevival(asyncDirRoot, sourceRunId, revivedRunId) {
+  const sourceDir = path.join(asyncDirRoot, sourceRunId);
+  const status = readStatus(sourceDir);
+  if (status?.runId !== sourceRunId || status.state !== "failed")
+    return;
+  const origin = isRunId(status.parentWorkflowRunId) && typeof status.workflowKey === "string" && KEY_PATTERN.test(status.workflowKey) ? { workflowRunId: status.parentWorkflowRunId, workflowKey: status.workflowKey, depth: 0 } : readLink(path.join(sourceDir, REVIVAL_ORIGIN_FILE));
+  if (!origin || "revivedRunId" in origin && origin.revivedRunId !== sourceRunId)
+    return;
+  if (origin.depth >= MAX_REVIVAL_DEPTH)
+    throw new Error(`workflow key '${origin.workflowKey}' of ${origin.workflowRunId} already has ${MAX_REVIVAL_DEPTH} chained revivals.`);
+  const link = { version: 1, workflowRunId: origin.workflowRunId, workflowKey: origin.workflowKey, sourceRunId, revivedRunId, depth: origin.depth + 1 };
+  const originFile = path.join(asyncDirRoot, revivedRunId, REVIVAL_ORIGIN_FILE);
+  writePrivateAtomicJson(originFile, link);
+  try {
+    writePrivateAtomicJson(path.join(sourceDir, REVIVAL_LINK_FILE), link);
+  } catch (error) {
+    if (readLink(path.join(sourceDir, REVIVAL_LINK_FILE))?.revivedRunId !== revivedRunId)
+      fs.rmSync(originFile, { force: true });
+    throw error;
+  }
+}
+export function projectWorkflowKeyRevival(asyncDirRoot, workflowRunId, workflowKey, runId) {
+  if (!isRunId(runId))
+    return;
+  const revivedRunIds = [];
+  let current = runId;
+  while (revivedRunIds.length < MAX_REVIVAL_DEPTH) {
+    const link = readLink(path.join(asyncDirRoot, current, REVIVAL_LINK_FILE));
+    if (!link || link.sourceRunId !== current || link.workflowRunId !== workflowRunId || link.workflowKey !== workflowKey)
+      break;
+    revivedRunIds.push(link.revivedRunId);
+    current = link.revivedRunId;
+  }
+  if (revivedRunIds.length === 0)
+    return;
+  let status = null;
+  try {
+    status = readStatus(path.join(asyncDirRoot, current));
+  } catch {}
+  return { revivedRunIds, latestRunId: current, ...status?.runId === current ? { state: status.state } : {} };
+}
+export function formatWorkflowKeyRevival(revival) {
+  return `Revived → ${revival.revivedRunIds.join(" → ")}: ${revival.state === "complete" ? "completed" : revival.state ?? "status unavailable"}`;
+}
+export function withWorkflowRevivals(asyncDirRoot, workflowRunId, children) {
+  return children.map((child) => {
+    if (child.ok || child.state === "running" || !child.runId)
+      return child;
+    const lineage = child.continuation?.runIds ?? [child.runId];
+    const revival = projectWorkflowKeyRevival(asyncDirRoot, workflowRunId, child.key, lineage.at(-1) ?? child.runId);
+    return revival ? { ...child, continuation: { runIds: [...lineage, ...revival.revivedRunIds] }, revival } : child;
+  });
+}

package/extensions/dm-tty/control.js

@@ -0,0 +1,150 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, lstatSync, mkdirSync, readdirSync, unlinkSync } from "node:fs";
+import { createServer, request } from "node:http";
+import { createServer as createProbe } from "node:net";
+import { networkInterfaces } from "node:os";
+import { join } from "node:path";
+function controlDirectory(create) {
+  if (!process.getuid)
+    throw new Error("TTY control requires a POSIX host");
+  const directory = `/tmp/dm-tty-${process.getuid()}`;
+  try {
+    if (create) {
+      try {
+        mkdirSync(directory, { mode: 448 });
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+    }
+    const info = lstatSync(directory);
+    if (!info.isDirectory() || info.uid !== process.getuid() || (info.mode & 511) !== 448) {
+      throw new Error("Unsafe TTY control directory; expected an owner-only directory");
+    }
+    return directory;
+  } catch (error) {
+    if (!create && error.code === "ENOENT")
+      return;
+    throw error;
+  }
+}
+export async function startTtyControl(port, stop) {
+  const path = join(controlDirectory(true), `${port}-${process.pid}-${randomBytes(8).toString("hex")}.sock`);
+  const server = createServer((incoming, response) => {
+    response.setHeader("connection", "close");
+    if (incoming.method !== "POST" || incoming.url !== "/stop") {
+      response.writeHead(404).end();
+      return;
+    }
+    stop().then(() => response.end(`dm-tty stopped
+`), () => response.writeHead(500).end("Stop failed"));
+  });
+  server.maxConnections = 4;
+  server.requestTimeout = 2000;
+  server.headersTimeout = 2000;
+  server.setTimeout(1e4, (socket) => socket.destroy());
+  try {
+    await new Promise((done, reject) => {
+      server.once("error", reject);
+      server.listen(path, () => {
+        server.off("error", reject);
+        done();
+      });
+    });
+    chmodSync(path, 384);
+  } catch (error) {
+    server.close();
+    throw error;
+  }
+  return () => {
+    server.close();
+    server.closeIdleConnections();
+    try {
+      unlinkSync(path);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  };
+}
+async function stopSocket(path) {
+  return new Promise((done, reject) => {
+    const call = request({ socketPath: path, path: "/stop", method: "POST", agent: false }, (response) => {
+      let body = "";
+      response.setEncoding("utf8");
+      response.on("data", (chunk) => {
+        body += chunk;
+        if (body.length > 128)
+          call.destroy(new Error("Invalid TTY control response"));
+      });
+      response.on("error", reject);
+      response.on("end", () => {
+        if (response.statusCode === 200 && body === `dm-tty stopped
+`)
+          done(true);
+        else
+          reject(new Error("TTY service did not confirm shutdown"));
+      });
+    });
+    const timeout = setTimeout(() => call.destroy(new Error("TTY shutdown timed out")), 1e4);
+    call.on("close", () => clearTimeout(timeout));
+    call.on("error", (error) => {
+      if (["ENOENT", "ECONNREFUSED", "FailedToOpenSocket"].includes(error.code ?? ""))
+        done(false);
+      else
+        reject(error);
+    });
+    call.end();
+  });
+}
+export async function ttyPortOccupied(port) {
+  const addresses = new Set(["127.0.0.1", "::1"]);
+  for (const entries of Object.values(networkInterfaces())) {
+    for (const entry of entries ?? [])
+      addresses.add(entry.address);
+  }
+  for (const host of addresses) {
+    const occupied = await new Promise((done, reject) => {
+      const probe = createProbe();
+      probe.once("error", (error) => {
+        if (error.code === "EADDRINUSE")
+          done(true);
+        else if (["EAFNOSUPPORT", "EADDRNOTAVAIL"].includes(error.code ?? ""))
+          done(false);
+        else
+          reject(error);
+      });
+      probe.listen({ port, host, ipv6Only: true }, () => probe.close(() => done(false)));
+    });
+    if (occupied)
+      return true;
+  }
+  return false;
+}
+export async function stopTtyServices(port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error("Invalid TTY control port");
+  const directory = controlDirectory(false);
+  let stopped = 0;
+  if (directory) {
+    const pattern = new RegExp(`^${port}-\\d+-[a-f0-9]{16}\\.sock$`);
+    for (const name of readdirSync(directory).filter((entry) => pattern.test(entry))) {
+      const path = join(directory, name);
+      try {
+        const info = lstatSync(path);
+        if (!info.isSocket() || info.uid !== process.getuid() || info.mode & 63)
+          continue;
+      } catch (error) {
+        if (error.code === "ENOENT")
+          continue;
+        throw error;
+      }
+      if (await stopSocket(path))
+        stopped++;
+    }
+  }
+  if (await ttyPortOccupied(port)) {
+    throw new Error(`Port ${port} is still occupied by an unmanaged listener; no unrelated process was killed. Older DM TTY services must be stopped in their owning terminal and restarted with this version.`);
+  }
+  return stopped;
+}

package/extensions/dm-tty/index.js

@@ -0,0 +1,122 @@
+import { resolve } from "node:path";
+import { createTtyToken, DmTtyServer } from "./server.js";
+import { stopTtyServices } from "./control.js";
+const USAGE = 'usage: /tty start|status|stop [--host HOST] [--port PORT] [--cwd "PATH"]';
+export function parseCommand(args, cwd) {
+  const values = [];
+  let current = "", quote = "", escaped = false, present = false;
+  for (const character of args.trim()) {
+    if (escaped) {
+      current += character;
+      escaped = false;
+    } else if (character === "\\" && quote !== "'") {
+      escaped = true;
+      present = true;
+    } else if (quote) {
+      if (character === quote)
+        quote = "";
+      else
+        current += character;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+      present = true;
+    } else if (/\s/.test(character)) {
+      if (present)
+        values.push(current);
+      current = "";
+      present = false;
+    } else {
+      current += character;
+      present = true;
+    }
+  }
+  if (quote || escaped)
+    throw new Error("Unclosed quote or escape in /tty arguments");
+  if (present)
+    values.push(current);
+  const action = values.shift() ?? "status";
+  if (action !== "start" && action !== "stop" && action !== "status")
+    throw new Error(USAGE);
+  if (action === "status" && values.length)
+    throw new Error(USAGE);
+  const result = { action, host: "0.0.0.0", port: action === "stop" ? 0 : 8765, cwd };
+  const seen = new Set;
+  for (let index = 0;index < values.length; index++) {
+    const value = values[index];
+    const split = value.indexOf("=");
+    const key = split < 0 ? value : value.slice(0, split);
+    const next = split < 0 ? values[++index] : value.slice(split + 1);
+    if (seen.has(key) || !next || next.startsWith("--"))
+      throw new Error(`Invalid or duplicate option: ${key}`);
+    if (action === "stop" && key !== "--port")
+      throw new Error(USAGE);
+    seen.add(key);
+    if (key === "--host")
+      result.host = next;
+    else if (key === "--port" && /^\d+$/.test(next))
+      result.port = Number(next);
+    else if (key === "--cwd")
+      result.cwd = resolve(cwd, next);
+    else
+      throw new Error(`Unknown or incomplete option: ${key}. ${USAGE}`);
+  }
+  if (!Number.isInteger(result.port) || result.port < 0 || result.port > 65535)
+    throw new Error("Port must be an integer from 0 through 65535");
+  if (action === "stop" && seen.has("--port") && result.port === 0)
+    throw new Error("Stop requires a port from 1 through 65535");
+  return result;
+}
+function describe(info) {
+  const host = info.host.includes(":") ? `[${info.host}]` : info.host;
+  return `dm-tty: http://${["0.0.0.0", "::"].includes(info.host) ? "127.0.0.1" : host}:${info.port}/
+Token: ${info.token}
+Shell ${info.running ? `running (pid ${info.pid})` : "exited; use /tty stop then /tty start"}; cwd: ${info.cwd}
+This opens a separate shell, not a mirror of this DM session. Run dm in the browser to start a new session.
+The token grants full shell access as your OS user. Use an SSH tunnel or HTTPS for remote access; never expose this HTTP listener to the public Internet.${["0.0.0.0", "::"].includes(info.host) ? `
+Listening on all interfaces; use this machine's reachable address in the browser. Use --host 127.0.0.1 to restrict access to this machine.` : ""}`;
+}
+export default function dmTty(dm) {
+  let server;
+  let operations = Promise.resolve();
+  dm.registerCommand("tty", {
+    description: "Authenticated browser terminal: /tty start|status|stop",
+    handler: async (args, ctx) => {
+      operations = operations.then(async () => {
+        try {
+          const command = parseCommand(args, ctx.cwd);
+          if (command.action === "stop") {
+            const port = command.port || server?.info().port || 8765;
+            const owned = server?.info().port === port;
+            if (owned) {
+              await server.close();
+              server = undefined;
+            }
+            const stopped = await stopTtyServices(port);
+            return ctx.ui.notify(owned || stopped ? `dm-tty stopped; port ${port} is free` : `dm-tty is not running on port ${port}`, "info");
+          }
+          if (command.action === "status" || server) {
+            return ctx.ui.notify(server ? describe(server.info()) : "dm-tty is not running; use /tty start", "info");
+          }
+          if (!ctx.hasUI)
+            throw new Error("/tty start requires an interactive DM session to display the access token");
+          const candidate = new DmTtyServer({ ...command, token: createTtyToken() });
+          const info = await candidate.start();
+          server = candidate;
+          candidate.closed.then(() => {
+            if (server === candidate)
+              server = undefined;
+          });
+          ctx.ui.notify(describe(info), "info");
+        } catch (error) {
+          ctx.ui.notify(`dm-tty: ${error instanceof Error ? error.message : String(error)}`, "error");
+        }
+      });
+      await operations;
+    }
+  });
+  dm.on("session_shutdown", async () => {
+    await operations;
+    await server?.close();
+    server = undefined;
+  });
+}

package/extensions/dm-tty/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "dm-tty",
+  "version": "0.1.0",
+  "description": "Authenticated browser access to a local POSIX shell terminal",
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "duckmind",
+    "dm",
+    "dm-extension",
+    "terminal",
+    "browser",
+    "remote"
+  ],
+  "dm": {
+    "extensions": [
+      "./index.js"
+    ]
+  }
+}