@evomap/evolver-core 2.0.0-beta.0

package/dist/daemon/guards.js

@@ -0,0 +1,142 @@
+// Resident-daemon preflight guards (ported from v1 evolve/guards.js — the portable, decision-relevant core).
+// Before a resident loop starts a cycle it should YIELD when: a human put a cooperative `.evolver.lock` in the
+// repo, a release is in flight (last commit is a release bump), or the host is under load. And when it does
+// back off, it should persist its partial state (the "dormant hypothesis") so the next cycle resumes instead
+// of starting cold. Pairs with ops/health (resource snapshot) — health observes, these decide.
+//
+// All decision logic is PURE: the caller performs the fs/git/os reads and passes the values in, so every
+// branch is deterministically testable. The dormant-state store takes an injected path + clock.
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+const MIN_ASSUMED_CPU_COUNT = 4; // os.cpus() can return [] (Android/Termux) — floor so load max never collapses to 0
+const MIN_LOCK_TTL_MS = 1000; // catches the parseInt('5m')===5 quirk → a 5ms TTL would insta-stale every lock
+const MIN_RELEASE_WINDOW_MS = 1000;
+/** Clamp os.loadavg() to at most 2× cores so a misreported sample (Windows zeros, Termux process-counters) can't force a permanent backoff. */
+export function clampSystemLoad(loadavg, cpuCount) {
+    const cap = Math.max(1, cpuCount) * 2;
+    return {
+        load1m: Math.min(loadavg[0] || 0, cap),
+        load5m: Math.min(loadavg[1] || 0, cap),
+        load15m: Math.min(loadavg[2] || 0, cap),
+    };
+}
+/** Sensible default load ceiling for N cores (reserve ~10% headroom); floors CPU count so it's never 0. */
+export function defaultLoadMax(cpuCount) {
+    const cpu = cpuCount > 0 ? cpuCount : MIN_ASSUMED_CPU_COUNT;
+    return cpu <= 1 ? 0.9 : cpu * 0.9;
+}
+/**
+ * Cooperative `.evolver.lock`: a human (release script, IDE refactor) drops the file to make the daemon yield;
+ * whoever drops it removes it. A lock older than ttlMs is ignored (forgotten lock won't dormant the daemon
+ * forever). A future mtime (clock skew) counts as fresh. Pure — caller supplies presence + mtime.
+ */
+export function evaluateUserLock(input) {
+    if (!Number.isFinite(input.ttlMs) || input.ttlMs < MIN_LOCK_TTL_MS)
+        return { yield: false, reason: 'invalid_ttl' };
+    if (!input.present)
+        return { yield: false, reason: 'no_lock' };
+    if (input.mtimeMs === undefined || !Number.isFinite(input.mtimeMs))
+        return { yield: false, reason: 'stat_failed' };
+    const ageMs = input.now - input.mtimeMs;
+    if (ageMs < 0)
+        return { yield: true, reason: 'lock_active_future_mtime', ageMs };
+    if (ageMs <= input.ttlMs)
+        return { yield: true, reason: 'lock_active', ageMs };
+    return { yield: false, reason: 'lock_stale', ageMs };
+}
+/**
+ * Release-window quiet period: if the last commit is a release bump (chore(release)…), a human is mid-deploy —
+ * yield until the window passes so the daemon doesn't dirty the tree under a publish. windowMs===0 disables.
+ * Pure — caller supplies the last commit subject + unix ts.
+ */
+export function evaluateReleaseWindow(input) {
+    if (input.windowMs === 0)
+        return { yield: false, reason: 'disabled' };
+    if (!Number.isFinite(input.windowMs) || input.windowMs < MIN_RELEASE_WINDOW_MS)
+        return { yield: false, reason: 'invalid_window' };
+    if (!Number.isFinite(input.lastCommitUnixTs))
+        return { yield: false, reason: 'no_commit' };
+    if (!/^chore\(release\)/i.test(String(input.lastCommitSubject ?? '')))
+        return { yield: false, reason: 'not_release_commit' };
+    const ageMs = input.now - input.lastCommitUnixTs * 1000;
+    if (ageMs < 0)
+        return { yield: true, reason: 'release_window_future_commit', ageMs };
+    if (ageMs <= input.windowMs)
+        return { yield: true, reason: 'release_window_active', ageMs };
+    return { yield: false, reason: 'window_passed', ageMs };
+}
+/**
+ * Combine the preflight guards in priority order — user lock → release window → system load — and return the
+ * first that says yield. `clear` when none fire. The daemon supplies live readings; this stays pure.
+ */
+export function evaluateGuards(input) {
+    if (input.lock) {
+        const r = evaluateUserLock({ present: input.lock.present, mtimeMs: input.lock.mtimeMs, now: input.now, ttlMs: input.lock.ttlMs ?? 3_600_000 });
+        if (r.yield)
+            return { yield: true, reason: 'user_lock', detail: { lockReason: r.reason, ageMs: r.ageMs } };
+    }
+    if (input.release) {
+        const r = evaluateReleaseWindow({ lastCommitSubject: input.release.lastCommitSubject, lastCommitUnixTs: input.release.lastCommitUnixTs, now: input.now, windowMs: input.release.windowMs ?? 300_000 });
+        if (r.yield)
+            return { yield: true, reason: 'release_window', detail: { windowReason: r.reason, ageMs: r.ageMs } };
+    }
+    if (input.load) {
+        const max = input.load.max ?? defaultLoadMax(input.load.cpuCount ?? MIN_ASSUMED_CPU_COUNT);
+        if (input.load.load1m > max)
+            return { yield: true, reason: 'system_load', detail: { load1m: input.load.load1m, max } };
+    }
+    return { yield: false, reason: 'clear' };
+}
+/**
+ * Persists the daemon's partial state before a backoff so the next cycle resumes the same hypothesis instead of
+ * starting cold. TTL-bounded — a stale dormant state (older than ttlMs) is discarded on read. Atomic write.
+ */
+export class DormantHypothesisStore {
+    path;
+    opts;
+    constructor(path, opts = {}) {
+        this.path = path;
+        this.opts = opts;
+    }
+    ttl() { return this.opts.ttlMs ?? 3_600_000; }
+    now() { return (this.opts.now ?? (() => Date.now()))(); }
+    /** Save partial state before backing off. Never throws. */
+    write(data) {
+        try {
+            mkdirSync(dirname(this.path), { recursive: true });
+            const obj = { ...data, created_at: new Date(this.now()).toISOString(), ttl_ms: this.ttl() };
+            const tmp = `${this.path}.tmp`;
+            writeFileSync(tmp, `${JSON.stringify(obj, null, 2)}\n`, 'utf8');
+            renameSync(tmp, this.path);
+        }
+        catch { /* non-fatal */ }
+    }
+    /** Recover partial state, or null if absent/expired/corrupt. Expired state is cleared as a side effect. */
+    read() {
+        try {
+            if (!existsSync(this.path))
+                return null;
+            const raw = readFileSync(this.path, 'utf8').trim();
+            if (!raw)
+                return null;
+            const obj = JSON.parse(raw);
+            const createdAt = obj.created_at ? new Date(obj.created_at).getTime() : 0;
+            const ttl = Number.isFinite(Number(obj.ttl_ms)) ? Number(obj.ttl_ms) : this.ttl();
+            if (this.now() - createdAt > ttl) {
+                this.clear();
+                return null;
+            }
+            return obj;
+        }
+        catch {
+            return null;
+        }
+    }
+    clear() {
+        try {
+            if (existsSync(this.path))
+                unlinkSync(this.path);
+        }
+        catch { /* non-fatal */ }
+    }
+}

package/dist/daemon/idempotency.d.ts

@@ -0,0 +1,11 @@
+/** 闸4: cycle_id 幂等键. 同 cycleId+opKey 的副作用只执行一次(daemon 重启 replay/重试不重复). */
+export declare class IdempotencyGuard {
+    private readonly path?;
+    private readonly done;
+    constructor(path?: string | undefined);
+    private k;
+    has(cycleId: string, opKey: string): boolean;
+    once<T>(cycleId: string, opKey: string, fn: () => Promise<T> | T): Promise<T>;
+    private persist;
+    private load;
+}

package/dist/daemon/idempotency.js

@@ -0,0 +1,36 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+/** 闸4: cycle_id 幂等键. 同 cycleId+opKey 的副作用只执行一次(daemon 重启 replay/重试不重复). */
+export class IdempotencyGuard {
+    path;
+    done = new Map();
+    constructor(path) {
+        this.path = path;
+        if (path && existsSync(path))
+            this.load();
+    }
+    k(cycleId, opKey) { return `${cycleId}\x1f${opKey}`; }
+    has(cycleId, opKey) { return this.done.has(this.k(cycleId, opKey)); }
+    async once(cycleId, opKey, fn) {
+        const key = this.k(cycleId, opKey);
+        if (this.done.has(key))
+            return this.done.get(key);
+        const r = await fn();
+        this.done.set(key, r);
+        this.persist();
+        return r;
+    }
+    persist() {
+        if (!this.path)
+            return;
+        mkdirSync(dirname(this.path), { recursive: true });
+        writeFileSync(this.path, JSON.stringify(Object.fromEntries(this.done)));
+    }
+    load() {
+        if (!this.path)
+            return;
+        const o = JSON.parse(readFileSync(this.path, 'utf8'));
+        for (const [k, v] of Object.entries(o))
+            this.done.set(k, v);
+    }
+}

package/dist/daemon/idleScheduler.d.ts

@@ -0,0 +1,55 @@
+interface IdleCommandResult {
+    status: number | null;
+    stdout?: string | Buffer | null;
+}
+type IdleCommandRunner = (command: string, args: readonly string[]) => IdleCommandResult;
+export type Intensity = 'normal' | 'aggressive' | 'deep';
+export interface IdleThresholds {
+    /** Idle ≥ this (s) → aggressive. Default 300 (5min). */
+    idleSeconds: number;
+    /** Idle ≥ this (s) → deep. Default 1800 (30min). */
+    deepIdleSeconds: number;
+}
+export declare const DEFAULT_IDLE_THRESHOLDS: IdleThresholds;
+/** Map idle seconds → evolution intensity. Unknown idle (-1) or active → normal. Pure. */
+export declare function determineIntensity(idleSeconds: number, th?: IdleThresholds): Intensity;
+export interface ScheduleRecommendation {
+    enabled: boolean;
+    idleSeconds: number;
+    /** normal / aggressive / deep — encodes the level; a consumer derives any per-intensity action from it. */
+    intensity: Intensity;
+    /** Poll-interval multiplier: <1 runs more often when idle, 1 = normal cadence. */
+    sleepMultiplier: number;
+}
+/**
+ * Turn an idle reading into a scheduling recommendation: aggressive idle → run twice as often; deep idle → 4×.
+ * Pure given idleSeconds. enabled:false → a normal-cadence no-op. The `intensity` is the single signal a consumer
+ * acts on (the previous per-action `should*` flags were never consumed anywhere, so they are not emitted —
+ * re-derive any action mapping at the consumer from `intensity` if/when one exists).
+ */
+export declare function recommendSchedule(idleSeconds: number, opts?: {
+    enabled?: boolean;
+    thresholds?: IdleThresholds;
+}): ScheduleRecommendation;
+/** Reads the OS user-idle time in seconds; -1 when unknown. Inject a fake in tests / a better probe in the daemon. */
+export type IdleProbe = () => number;
+type LinuxIdleMethodName = 'xprintidle' | 'gnome-mutter' | 'loginctl';
+export declare function tryLinuxXprintidle(): number;
+export declare function tryLinuxGnomeMutterIdleMonitor(): number;
+export declare function tryLinuxLoginctlIdleHint(): number;
+export declare function getLinuxIdleSeconds(): number;
+export declare function resetLinuxIdleProbeCacheForTests(): void;
+export declare function setIdleCommandRunnerForTests(runner?: IdleCommandRunner): void;
+export declare function getCachedLinuxIdleMethodForTests(): LinuxIdleMethodName | undefined;
+/**
+ * Best-effort default idle probe. linux: xprintidle → GNOME Mutter → loginctl; darwin: ioreg HIDIdleTime (ns). win32 and any
+ * missing tool → -1 (→ normal cadence) rather than failing — idle detection is an optimization, not a gate.
+ */
+export declare function defaultIdleProbe(): number;
+/** Convenience: probe idle then recommend. The probe defaults to the platform reader; inject for tests. */
+export declare function getScheduleRecommendation(opts?: {
+    enabled?: boolean;
+    thresholds?: IdleThresholds;
+    probe?: IdleProbe;
+}): ScheduleRecommendation;
+export {};

package/dist/daemon/idleScheduler.js

@@ -0,0 +1,181 @@
+// Idle-aware scheduler (ported from v1 gep/idleScheduler.js). A "good neighbour" for the resident loop: when
+// the machine has been idle a while, evolution can run harder (distill / reflect / explore) and more often;
+// when the user is active, it backs off to a normal cadence. The DECISION logic is pure and config-driven; the
+// platform idle reading is an injected probe seam (default best-effort, graceful → -1 → normal cadence).
+import { spawnSync } from 'node:child_process';
+const IDLE_PROBE_TIMEOUT_MS = 5000;
+function defaultIdleCommandRunner(command, args) {
+    return spawnSync(command, [...args], { encoding: 'utf8', timeout: IDLE_PROBE_TIMEOUT_MS });
+}
+let idleCommandRunner = defaultIdleCommandRunner;
+function readIdleCommand(command, args) {
+    try {
+        const result = idleCommandRunner(command, args);
+        if (result.status !== 0)
+            return null;
+        return String(result.stdout ?? '').trim();
+    }
+    catch {
+        // Idle detection is advisory. Treat command failures as unknown idle.
+        return null;
+    }
+}
+export const DEFAULT_IDLE_THRESHOLDS = { idleSeconds: 300, deepIdleSeconds: 1800 };
+/** Map idle seconds → evolution intensity. Unknown idle (-1) or active → normal. Pure. */
+export function determineIntensity(idleSeconds, th = DEFAULT_IDLE_THRESHOLDS) {
+    if (!Number.isFinite(idleSeconds) || idleSeconds < 0)
+        return 'normal';
+    if (idleSeconds >= th.deepIdleSeconds)
+        return 'deep';
+    if (idleSeconds >= th.idleSeconds)
+        return 'aggressive';
+    return 'normal';
+}
+/**
+ * Turn an idle reading into a scheduling recommendation: aggressive idle → run twice as often; deep idle → 4×.
+ * Pure given idleSeconds. enabled:false → a normal-cadence no-op. The `intensity` is the single signal a consumer
+ * acts on (the previous per-action `should*` flags were never consumed anywhere, so they are not emitted —
+ * re-derive any action mapping at the consumer from `intensity` if/when one exists).
+ */
+export function recommendSchedule(idleSeconds, opts = {}) {
+    if (opts.enabled === false)
+        return { enabled: false, idleSeconds: -1, intensity: 'normal', sleepMultiplier: 1 };
+    const intensity = determineIntensity(idleSeconds, opts.thresholds);
+    const sleepMultiplier = intensity === 'aggressive' ? 0.5 : intensity === 'deep' ? 0.25 : 1;
+    return { enabled: true, idleSeconds, intensity, sleepMultiplier };
+}
+export function tryLinuxXprintidle() {
+    const out = readIdleCommand('xprintidle', []);
+    if (out === null)
+        return -1;
+    const ms = Number.parseInt(out, 10);
+    if (!Number.isFinite(ms) || ms < 0)
+        return -1;
+    return Math.floor(ms / 1000);
+}
+export function tryLinuxGnomeMutterIdleMonitor() {
+    const out = readIdleCommand('gdbus', [
+        'call',
+        '--session',
+        '--dest',
+        'org.gnome.Mutter.IdleMonitor',
+        '--object-path',
+        '/org/gnome/Mutter/IdleMonitor/Core',
+        '--method',
+        'org.gnome.Mutter.IdleMonitor.GetIdletime',
+    ]);
+    if (out === null)
+        return -1;
+    const match = /uint64\s+(\d+)/.exec(out);
+    if (!match)
+        return -1;
+    const rawMs = match[1];
+    if (rawMs === undefined)
+        return -1;
+    const ms = Number.parseInt(rawMs, 10);
+    if (!Number.isFinite(ms) || ms < 0)
+        return -1;
+    return Math.floor(ms / 1000);
+}
+export function tryLinuxLoginctlIdleHint() {
+    const sessionId = process.env['XDG_SESSION_ID'];
+    if (!sessionId || !isSafeLoginctlSessionId(sessionId))
+        return -1;
+    const out = readIdleCommand('loginctl', ['show-session', sessionId, '-p', 'IdleHint', '-p', 'IdleSinceHint']);
+    if (out === null)
+        return -1;
+    const hintMatch = /(?:^|\n)IdleHint=(yes|no)(?:\n|$)/.exec(out);
+    if (!hintMatch)
+        return -1;
+    const idleHint = hintMatch[1];
+    if (idleHint === undefined)
+        return -1;
+    if (idleHint === 'no')
+        return 0;
+    const sinceMatch = /(?:^|\n)IdleSinceHint=(\d+)(?:\n|$)/.exec(out);
+    if (!sinceMatch)
+        return -1;
+    const rawSinceUsec = sinceMatch[1];
+    if (rawSinceUsec === undefined)
+        return -1;
+    const sinceUsec = Number.parseInt(rawSinceUsec, 10);
+    if (!Number.isFinite(sinceUsec) || sinceUsec <= 0)
+        return -1;
+    const idleSeconds = Math.floor(((Date.now() * 1000) - sinceUsec) / 1_000_000);
+    return idleSeconds >= 0 ? idleSeconds : -1;
+}
+function isSafeLoginctlSessionId(sessionId) {
+    if (!/^[A-Za-z0-9]+$/.test(sessionId))
+        return false;
+    const lowerSessionId = sessionId.toLowerCase();
+    return lowerSessionId !== 'self' && lowerSessionId !== 'auto';
+}
+const LINUX_IDLE_PROBES = {
+    xprintidle: tryLinuxXprintidle,
+    'gnome-mutter': tryLinuxGnomeMutterIdleMonitor,
+    loginctl: tryLinuxLoginctlIdleHint,
+};
+function isWaylandSession() {
+    return process.env['XDG_SESSION_TYPE']?.toLowerCase() === 'wayland';
+}
+function isGnomeMutterDesktop() {
+    const currentDesktop = process.env['XDG_CURRENT_DESKTOP']?.toLowerCase();
+    return currentDesktop?.split(':').some((part) => part === 'gnome' || part.includes('mutter')) === true;
+}
+function getLinuxIdleMethodOrder() {
+    if (!isWaylandSession())
+        return ['xprintidle', 'gnome-mutter', 'loginctl'];
+    if (isGnomeMutterDesktop())
+        return ['gnome-mutter', 'loginctl', 'xprintidle'];
+    return ['loginctl', 'xprintidle', 'gnome-mutter'];
+}
+let cachedLinuxIdleMethod;
+export function getLinuxIdleSeconds() {
+    if (cachedLinuxIdleMethod) {
+        const idleSeconds = LINUX_IDLE_PROBES[cachedLinuxIdleMethod]();
+        if (idleSeconds >= 0)
+            return idleSeconds;
+        cachedLinuxIdleMethod = undefined;
+    }
+    for (const name of getLinuxIdleMethodOrder()) {
+        const idleSeconds = LINUX_IDLE_PROBES[name]();
+        if (idleSeconds >= 0) {
+            cachedLinuxIdleMethod = name;
+            return idleSeconds;
+        }
+    }
+    return -1;
+}
+export function resetLinuxIdleProbeCacheForTests() {
+    cachedLinuxIdleMethod = undefined;
+}
+export function setIdleCommandRunnerForTests(runner) {
+    idleCommandRunner = runner ?? defaultIdleCommandRunner;
+}
+export function getCachedLinuxIdleMethodForTests() {
+    return cachedLinuxIdleMethod;
+}
+/**
+ * Best-effort default idle probe. linux: xprintidle → GNOME Mutter → loginctl; darwin: ioreg HIDIdleTime (ns). win32 and any
+ * missing tool → -1 (→ normal cadence) rather than failing — idle detection is an optimization, not a gate.
+ */
+export function defaultIdleProbe() {
+    if (process.platform === 'linux')
+        return getLinuxIdleSeconds();
+    if (process.platform === 'darwin') {
+        const out = readIdleCommand('ioreg', ['-c', 'IOHIDSystem']);
+        if (out !== null) {
+            const match = /"HIDIdleTime"\s*=\s*(\d+)/.exec(out);
+            if (match?.[1] !== undefined)
+                return Math.floor(Number(match[1]) / 1_000_000_000);
+        }
+        return -1;
+    }
+    return -1; // win32 / unsupported / tool missing → unknown
+}
+/** Convenience: probe idle then recommend. The probe defaults to the platform reader; inject for tests. */
+export function getScheduleRecommendation(opts = {}) {
+    if (opts.enabled === false)
+        return recommendSchedule(-1, { enabled: false });
+    return recommendSchedule((opts.probe ?? defaultIdleProbe)(), { ...(opts.thresholds ? { thresholds: opts.thresholds } : {}) });
+}

package/dist/daemon/index.d.ts

@@ -0,0 +1,8 @@
+export * from './cycleContext.js';
+export * from './idempotency.js';
+export * from './watchdog.js';
+export * from './drain.js';
+export * from './stepRunner.js';
+export * from './guards.js';
+export * from './idleScheduler.js';
+export * from './unhandledRejectionWindow.js';

package/dist/daemon/index.js

@@ -0,0 +1,8 @@
+export * from './cycleContext.js';
+export * from './idempotency.js';
+export * from './watchdog.js';
+export * from './drain.js';
+export * from './stepRunner.js';
+export * from './guards.js';
+export * from './idleScheduler.js';
+export * from './unhandledRejectionWindow.js';

package/dist/daemon/stepRunner.d.ts

@@ -0,0 +1,12 @@
+import { CycleContext } from './cycleContext.js';
+import type { DrainController } from './drain.js';
+/** loop 调度与 step 执行解耦 (批注#1): --once 与 daemon 跑同一 step 路径. */
+export type StepFn = (ctx: CycleContext) => Promise<void> | void;
+/** 单步 (evolver run --once 与 daemon 单轮共用). */
+export declare function runStep(cycleId: string, step: StepFn): Promise<void>;
+/** daemon 循环: 反复调 runStep (同一 step 路径); drain 时停接. */
+export declare function runLoop(opts: {
+    nextCycleId: () => string | null;
+    step: StepFn;
+    drain: DrainController;
+}): Promise<number>;

package/dist/daemon/stepRunner.js

@@ -0,0 +1,31 @@
+import { CycleContext } from './cycleContext.js';
+/** 单步 (evolver run --once 与 daemon 单轮共用). */
+export async function runStep(cycleId, step) {
+    const ctx = new CycleContext(cycleId); // 闸1: 每 cycle 新 context
+    try {
+        await step(ctx);
+    }
+    finally {
+        ctx.dispose();
+    }
+}
+/** daemon 循环: 反复调 runStep (同一 step 路径); drain 时停接. */
+export async function runLoop(opts) {
+    let n = 0;
+    for (;;) {
+        if (!opts.drain.acceptCycle())
+            break;
+        const id = opts.nextCycleId();
+        if (id === null)
+            break;
+        opts.drain.beginCycle();
+        try {
+            await runStep(id, opts.step);
+            n += 1;
+        }
+        finally {
+            opts.drain.endCycle();
+        }
+    }
+    return n;
+}

package/dist/daemon/unhandledRejectionWindow.d.ts

@@ -0,0 +1,21 @@
+export declare const DEFAULT_UNHANDLED_REJECTION_WINDOW_MS: number;
+export declare const DEFAULT_UNHANDLED_REJECTION_THRESHOLD = 5;
+export type UnhandledRejectionListener = (reason: unknown, promise?: Promise<unknown>) => void;
+export interface UnhandledRejectionProcess {
+    on(event: 'unhandledRejection', listener: UnhandledRejectionListener): unknown;
+    off?(event: 'unhandledRejection', listener: UnhandledRejectionListener): unknown;
+    removeListener?(event: 'unhandledRejection', listener: UnhandledRejectionListener): unknown;
+}
+export interface UnhandledRejectionWindowOptions {
+    windowMs?: number;
+    threshold?: number;
+    now?: () => number;
+    write?: (line: string) => void;
+    beforeExit?: () => void;
+    exit?: (code: number) => void;
+}
+export interface InstallUnhandledRejectionWindowOptions extends UnhandledRejectionWindowOptions {
+    process?: UnhandledRejectionProcess;
+}
+export declare function createUnhandledRejectionWindowHandler(options?: UnhandledRejectionWindowOptions): UnhandledRejectionListener;
+export declare function installUnhandledRejectionWindow(options?: InstallUnhandledRejectionWindowOptions): () => void;

package/dist/daemon/unhandledRejectionWindow.js

@@ -0,0 +1,52 @@
+export const DEFAULT_UNHANDLED_REJECTION_WINDOW_MS = 5 * 60 * 1000;
+export const DEFAULT_UNHANDLED_REJECTION_THRESHOLD = 5;
+export function createUnhandledRejectionWindowHandler(options = {}) {
+    const windowMs = positiveNumber(options.windowMs, DEFAULT_UNHANDLED_REJECTION_WINDOW_MS);
+    const threshold = positiveNumber(options.threshold, DEFAULT_UNHANDLED_REJECTION_THRESHOLD);
+    const now = options.now ?? (() => Date.now());
+    const write = options.write ?? ((line) => { process.stderr.write(`${line}\n`); });
+    const exit = options.exit ?? ((code) => { process.exit(code); });
+    let timestamps = [];
+    let exiting = false;
+    return (reason) => {
+        if (exiting)
+            return;
+        const at = now();
+        timestamps.push(at);
+        timestamps = timestamps.filter((t) => at - t < windowMs);
+        write(`[FATAL] Unhandled promise rejection (${timestamps.length} in window): ${formatReason(reason)}`);
+        if (timestamps.length < threshold)
+            return;
+        exiting = true;
+        write(`[FATAL] ${timestamps.length} unhandled rejections within ${windowMs / 1000}s. Exiting to avoid corrupt state.`);
+        try {
+            options.beforeExit?.();
+        }
+        catch (e) {
+            write(`[FATAL] unhandled rejection shutdown hook failed: ${formatReason(e)}`);
+        }
+        exit(1);
+    };
+}
+export function installUnhandledRejectionWindow(options = {}) {
+    const proc = options.process ?? process;
+    const handler = createUnhandledRejectionWindowHandler(options);
+    proc.on('unhandledRejection', handler);
+    return () => {
+        if (proc.off) {
+            proc.off('unhandledRejection', handler);
+            return;
+        }
+        proc.removeListener?.('unhandledRejection', handler);
+    };
+}
+function positiveNumber(value, fallback) {
+    if (value === undefined || !Number.isFinite(value) || value <= 0)
+        return fallback;
+    return value;
+}
+function formatReason(reason) {
+    if (reason instanceof Error && reason.stack)
+        return reason.stack;
+    return String(reason);
+}

package/dist/daemon/watchdog.d.ts

@@ -0,0 +1,11 @@
+/** 闸3: 外部 watchdog, 按 root_events 最后写入时间判挂死 (硬化 A8). 不依赖主进程自报活. */
+export interface WatchdogOptions {
+    lastWriteAt: () => number;
+    stallThresholdMs: number;
+    onStall: (idleMs: number) => void;
+}
+export declare class Watchdog {
+    private readonly opts;
+    constructor(opts: WatchdogOptions);
+    check(now: number): boolean;
+}

package/dist/daemon/watchdog.js

@@ -0,0 +1,14 @@
+export class Watchdog {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    check(now) {
+        const idle = now - this.opts.lastWriteAt();
+        if (idle >= this.opts.stallThresholdMs) {
+            this.opts.onStall(idle);
+            return true;
+        }
+        return false;
+    }
+}