@gloom-sh/terminal 0.19.2 → 0.19.3

package/src/plugins/installer.ts

@@ -7,6 +7,7 @@ import { findAbsorbedPlugin, type AbsorbedPlugin } from "./absorbed";
 import type { PluginPin } from "./marketplace/store";
 import { bunCommand, recordDependencyInstall } from "./dependencies";
 import { linkHostPackages, missingPeerPlugins } from "./host-link";
+import { importSiblingsFromTheirFolders } from "./peer-imports";
 import {
   findAbsorbedCheckout,
   getPluginsDir,
@@ -42,7 +43,7 @@ function ensurePluginsDir() {
   }
 }
 
-const GITHUB_SEGMENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const GITHUB_SEGMENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*(?![\s\S])/;
 const COMMIT_PATTERN = /^[0-9a-f]{7,40}$/i;
 
 export function validatePluginDirectoryName(name: string): string {
@@ -114,6 +115,13 @@ interface RunResult {
   stderr: string;
 }
 
+/** Resolves git before a command changes into a plugin checkout. */
+function gitExecutable(): string {
+  const executable = Bun.which("git");
+  if (!executable) throw Object.assign(new Error(gitMissingMessage()), { code: "ENOENT" });
+  return executable;
+}
+
 /**
  * Runs a command without blocking the event loop: a fetch or `bun install`
  * takes seconds, and the terminal UI and the desktop's Bun process keep
@@ -128,7 +136,7 @@ function run(
   env?: NodeJS.ProcessEnv,
 ): Promise<RunResult> {
   return new Promise((resolveRun, reject) => {
-    const child = spawn(command, args, { cwd, env, stdio: ["ignore", output.stdout, output.stderr] });
+    const child = spawn(command === "git" ? gitExecutable() : command, args, { cwd, env, stdio: ["ignore", output.stdout, output.stderr] });
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf-8").on("data", (chunk: string) => { stdout += chunk; });
@@ -297,6 +305,9 @@ async function readPluginExport(targetDir: string): Promise<Pick<GloomPlugin, "i
   if (missingPeerPlugins(targetDir).length > 0) return null;
   const entryFile = await resolvePluginEntry(targetDir);
   if (!entryFile) return null;
+  // The siblings from their folders, as the loader imports them, so the
+  // modules this caches are the ones a load in this process reuses.
+  importSiblingsFromTheirFolders(targetDir);
   // Fresh so an update is validated against the new code, not the module Bun
   // cached when the previous version loaded.
   const plugin = pluginFromModule(await import(`${entryFile}?validate=${Date.now()}`));
@@ -412,7 +423,7 @@ function githubRepoFromUrl(url: string): string | null {
 /** `owner/repo` from the checkout's origin remote, or null for anything that is not a GitHub clone. */
 export function readPluginRemote(pluginDir: string): string | null {
   try {
-    return githubRepoFromUrl(execFileSync("git", ["config", "--get", "remote.origin.url"], { cwd: pluginDir, stdio: ["ignore", "pipe", "ignore"] })
+    return githubRepoFromUrl(execFileSync(gitExecutable(), ["config", "--get", "remote.origin.url"], { cwd: pluginDir, stdio: ["ignore", "pipe", "ignore"] })
       .toString("utf-8"));
   } catch {
     // Intentional ignore: Hand-copied plugins and local repositories may have no origin remote.
@@ -450,7 +461,7 @@ export async function readPluginRemoteHead(name: string): Promise<string | null>
   if (!existsSync(join(dir, ".git"))) return null;
   if (lstatSync(dir, { throwIfNoEntry: false })?.isSymbolicLink()) return null;
   try {
-    const { stdout } = await execFile("git", ["ls-remote", "origin", "HEAD"], {
+    const { stdout } = await execFile(gitExecutable(), ["ls-remote", "origin", "HEAD"], {
       cwd: dir,
       timeout: REMOTE_HEAD_TIMEOUT_MS,
       env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "echo" },

package/src/plugins/loader.ts

@@ -15,8 +15,10 @@ import {
   missingPluginDependencies,
   settleDependencyInstalls,
 } from "./dependencies";
-import { declaredPeerPlugins, describePeerLink, isLinkedPeerModule, linkHostPackages, relinkPeerPlugin } from "./host-link";
+import { declaredPeerPlugins, describePeerLink, installedPeerPlugins, isLinkedPeerModule, linkHostPackages, relinkPeerPlugin } from "./host-link";
+import { importSiblingsFromTheirFolders } from "./peer-imports";
 import { refreshResolverFolders, rekeyedEntry, withoutRetryQuery } from "./peer-retry";
+import { redirectionGuard } from "./redirection-guard";
 import { pluginDirectoryNames } from "./plugin-names";
 import { pluginFromModule, pluginSupportsTarget } from "./plugin-export";
 
@@ -258,7 +260,7 @@ function hasStaleModules(pluginDir: string, commit: string | null): boolean {
  */
 const retriedEntries = new Map<string, string>();
 
-/** Plugin folders whose recovery this process already reported; once is enough to explain it. */
+/** Plugin folders whose recovery, or link that did not resolve, this process already reported; once is enough to explain it. */
 const reportedRecoveries = new Set<string>();
 
 /** Loads running now, which a crash report counts: two at once share the links they rewrite. */
@@ -299,30 +301,55 @@ function failedPeer(pluginDir: string, specifier: string | undefined): string |
 /**
  * The state of the link to `peer` and around it, for the crash report of an
  * import that failed on it: whether the sibling's folder is there, what the
- * link is and where it points, whether the retry rewrote it, how often this
- * process wrote it before, which `bun install` runs this process made, how
- * many loads ran at once, and whether this is the first launch of the version.
+ * link is and where it points, why reading through it failed, whether the
+ * retry rewrote it, how often this process wrote it before, which `bun
+ * install` runs this process made, how many loads ran at once, whether this
+ * is the first launch of the version, and on Windows whether this process
+ * may follow a junction (redirection-guard.ts). `how` leads: the retry's
+ * outcome, or how a plugin that loaded imported the sibling.
  */
-function describePeerFailure(pluginDir: string, peer: string, relinked: string, retry: string): string {
+function describePeerLinkState(pluginDir: string, peer: string, how: string, relinked?: string): string {
   const link = describePeerLink(pluginDir, peer);
   const now = Date.now();
   const installs = describeDependencyInstalls(now);
+  const guard = redirectionGuard();
   const fields = [
-    `retry=${retry}`,
+    how,
     `peer=${peer}`,
     `dir=${link.directory ?? "missing"}`,
     `link=${link.link}${link.target ? `->${link.target}` : ""}${link.linked ? "" : "(not-resolving)"}`,
-    `relinked=${relinked}`,
+    ...(link.resolveError ? [`link-stat=${link.resolveError}`] : []),
+    ...(relinked ? [`relinked=${relinked}`] : []),
     `link-writes=${link.writes}${link.lastWriteAt ? `@${((now - link.lastWriteAt) / 1000).toFixed(1)}s` : ""}`,
     ...(link.lastError ? [`link-error=${link.lastError}`] : []),
     `installs=${installs.length > 0 ? installs.slice(0, 4).join(",") : "none"}`,
     `loads=${loadsInFlight}`,
     `first-launch=${firstLaunchOfVersion === null ? "unknown" : firstLaunchOfVersion ? "yes" : "no"}`,
     ...(typeof Bun !== "undefined" ? [`bun=${Bun.version}`] : []),
+    ...(guard ? [`redirection-guard=${guard}`] : []),
   ];
   return fields.join(" ");
 }
 
+/**
+ * Reports, once per plugin and process, a plugin that loaded while its link
+ * to a sibling it imports does not resolve. The import itself went to the
+ * sibling's folder (peer-imports.ts), so nothing failed; the report says the
+ * link would have failed it, and why, which is how the first launch after an
+ * update looks when the old failure is gone.
+ */
+function reportUnresolvedSiblingLinks(pluginDir: string, directory: string): void {
+  if (reportedRecoveries.has(pluginDir)) return;
+  for (const { peer } of installedPeerPlugins(pluginDir)) {
+    if (describePeerLink(pluginDir, peer).linked) continue;
+    reportedRecoveries.add(pluginDir);
+    const detail = describePeerLinkState(pluginDir, peer, "peer-import=folder");
+    loaderLog.info(`Loaded ${directory} with ${peer} read from its folder; the link to it does not resolve [${detail}]`);
+    reportCrash(new Error(`Loaded ${directory} past a link to ${peer} that does not resolve`), { kind: "plugin", plugin: directory, detail });
+    return;
+  }
+}
+
 type PeerRetry =
   | { module: unknown; detail: string }
   | { error: unknown; detail: string };
@@ -353,14 +380,14 @@ async function retryPeerImport(pluginDir: string, entryFile: string, peer: strin
   refreshResolverFolders(pluginDir, [peer]);
   const specifier = rekeyedEntry(entryFile, pluginDir);
   if (!specifier) {
-    return { error: new Error("This process cannot import a plugin again."), detail: describePeerFailure(pluginDir, peer, relinked, "unavailable") };
+    return { error: new Error("This process cannot import a plugin again."), detail: describePeerLinkState(pluginDir, peer, "retry=unavailable", relinked) };
   }
   try {
     const module = await import(specifier);
     retriedEntries.set(pluginDir, specifier);
-    return { module, detail: describePeerFailure(pluginDir, peer, relinked, "loaded") };
+    return { module, detail: describePeerLinkState(pluginDir, peer, "retry=loaded", relinked) };
   } catch (error) {
-    return { error, detail: describePeerFailure(pluginDir, peer, relinked, "failed") };
+    return { error, detail: describePeerLinkState(pluginDir, peer, "retry=failed", relinked) };
   }
 }
 
@@ -475,6 +502,10 @@ async function loadPluginDirectory(
     };
   };
 
+  // A sibling it imports is read from the sibling's folder, not through the
+  // link just made: a process can be unable to follow that link at all.
+  importSiblingsFromTheirFolders(pluginDir);
+
   let module: unknown;
   try {
     const retried = options.fresh ? undefined : retriedEntries.get(pluginDir);
@@ -496,6 +527,7 @@ async function loadPluginDirectory(
     }
     module = retry.module;
   }
+  reportUnresolvedSiblingLinks(pluginDir, directory);
 
   try {
     const plugin = pluginFromModule(module);

package/src/plugins/peer-imports.ts

@@ -0,0 +1,201 @@
+import { readFileSync, realpathSync } from "fs";
+import { dirname, extname, isAbsolute, join, relative } from "path";
+import type { BunPlugin } from "bun";
+
+import { installedPeerPlugins } from "./host-link";
+
+/**
+ * A plugin's imports of a sibling plugin it declares as a peer (IBKR Gateway
+ * imports `gloom-ibkr/gateway-bridge`), read from the sibling's own folder
+ * instead of through the link in the plugin's `node_modules`.
+ *
+ * That link is a junction on Windows, and a process can be unable to follow
+ * a junction at all. On the first launch after an update the gateway failed
+ * with its link in place and pointing at Interactive Brokers: the loader wrote
+ * it again four times, never saw it resolve, and an import that looked again
+ * failed the same way, while Interactive Brokers itself loaded from its folder
+ * in the same process. The next launch worked.
+ *
+ * So the host resolves those imports itself and hands Bun the sibling's file
+ * by its absolute path: the file the link leads to, under the module key the
+ * sibling's own imports give it, so the plugin still shares the sibling's
+ * modules. The terminal and the desktop's Bun process rewrite the plugin's
+ * source as Bun loads it; the desktop's compile for the view resolves them in
+ * the bundler. The link stays, for editors, `tsc`, and older Gloom versions.
+ */
+
+type SourceLoader = "ts" | "tsx" | "js" | "jsx";
+
+/** What Bun loads a plugin's own source files with, by extension. */
+export const SOURCE_LOADERS: Readonly<Record<string, SourceLoader>> = {
+  ".ts": "ts",
+  ".mts": "ts",
+  ".tsx": "tsx",
+  ".js": "js",
+  ".mjs": "js",
+  ".jsx": "jsx",
+};
+
+export function sourceLoader(file: string): SourceLoader {
+  return SOURCE_LOADERS[extname(file).toLowerCase()] ?? "js";
+}
+
+export function isInside(root: string, path: string): boolean {
+  const inside = relative(root, path);
+  return !!inside && !inside.startsWith("..") && !isAbsolute(inside);
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Where a module is named: after `from`, `import` or `import(`, and in `require(`. */
+const IMPORTED_AT = String.raw`(\bfrom\s*|\bimport\s*(?:\(\s*)?|\brequire\s*\(\s*)`;
+
+/**
+ * `contents` with `specifier` replaced by `replacement` where it is imported.
+ * The same text in a string anywhere else stays.
+ */
+export function replaceSpecifier(contents: string, specifier: string, replacement: string): string {
+  const imported = new RegExp(`${IMPORTED_AT}(["'\`])${escapeRegExp(specifier)}\\2`, "g");
+  return contents.replace(imported, (_match, at: string) => `${at}${JSON.stringify(replacement)}`);
+}
+
+function realFolder(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch {
+    // Intentional ignore: a folder that cannot be resolved is matched as spelled.
+    return path;
+  }
+}
+
+/** Each registered plugin's real folder, with its siblings' folders by package name. */
+const siblingsByPlugin = new Map<string, ReadonlyMap<string, string>>();
+/** Real plugin folders whose source Bun loads through the hook below. */
+const hookedFolders = new Set<string>();
+
+/**
+ * The installed siblings `pluginDir` declares, by package name, each with its
+ * real folder. A sibling that maps its paths with `exports` is left out: only
+ * a lookup through `node_modules` reads that map.
+ */
+function siblingFolders(pluginDir: string, pluginsDir: string = dirname(pluginDir)): Map<string, string> {
+  const folders = new Map<string, string>();
+  for (const { peer, directory } of installedPeerPlugins(pluginDir, pluginsDir)) {
+    const folder = join(pluginsDir, directory);
+    try {
+      const pkg = JSON.parse(readFileSync(join(folder, "package.json"), "utf8")) as { exports?: unknown };
+      if (pkg.exports !== undefined) continue;
+    } catch {
+      // Intentional ignore: a sibling without a readable package.json has no export map.
+    }
+    folders.set(peer, realFolder(folder));
+  }
+  return folders;
+}
+
+/** The file `specifier` names in the sibling `peer`, as Bun resolves it from inside its folder; null when there is none. */
+function siblingModule(peer: string, peerDir: string, specifier: string): string | null {
+  const subpath = specifier.slice(peer.length + 1);
+  try {
+    return Bun.resolveSync(subpath ? `./${subpath}` : ".", peerDir);
+  } catch {
+    // Intentional ignore: left as written, the import fails the way it always did.
+    return null;
+  }
+}
+
+/**
+ * `contents` of `file` with its imports of the siblings its plugin declares
+ * naming the siblings' files by absolute path. Anything else is left as
+ * written: a file outside a registered plugin, and an import the sibling
+ * cannot satisfy, which then fails the way it always did.
+ */
+export function withSiblingImports(file: string, contents: string): string {
+  let siblings: ReadonlyMap<string, string> | undefined;
+  for (const [root, folders] of siblingsByPlugin) {
+    if (isInside(root, file)) siblings = folders;
+  }
+  if (!siblings) return contents;
+  let next = contents;
+  for (const [peer, peerDir] of siblings) {
+    if (!next.includes(peer)) continue;
+    const imported = new RegExp(`${IMPORTED_AT}(["'\`])(${escapeRegExp(peer)}(?:/[^"'\`\\s]*)?)\\2`, "g");
+    next = next.replace(imported, (match, at: string, _quote: string, specifier: string) => {
+      const target = siblingModule(peer, peerDir, specifier);
+      return target ? `${at}${JSON.stringify(target)}` : match;
+    });
+  }
+  return next;
+}
+
+function pathPattern(path: string): string {
+  return path.split(/[\\/]+/).map(escapeRegExp).join("[\\\\/]+");
+}
+
+/**
+ * The plugin's own source files, with an entry imported fresh (`?reload=`,
+ * or the installer's `?validate=`); not its dependencies, and not a retried
+ * import's files, which the retry's own hook loads the same way
+ * (peer-retry.ts).
+ */
+function pluginSourceFilter(root: string): RegExp {
+  return new RegExp(
+    `^${pathPattern(root)}[\\\\/](?!(?:[^?]*[\\\\/])?node_modules[\\\\/])[^?]*\\.(?:tsx?|mts|jsx?|mjs)(?:\\?(?:reload|validate)=\\d+)?$`,
+    process.platform === "win32" ? "i" : "",
+  );
+}
+
+function hookPluginSource(root: string): boolean {
+  if (hookedFolders.has(root)) return true;
+  if (typeof Bun === "undefined" || typeof Bun.plugin !== "function") return false;
+  Bun.plugin({
+    name: "gloomberb-sibling-imports",
+    setup(build) {
+      build.onLoad({ filter: pluginSourceFilter(root) }, (args) => {
+        const file = args.path.replace(/\?.*$/, "");
+        return { contents: withSiblingImports(file, readFileSync(file, "utf8")), loader: sourceLoader(file) };
+      });
+    },
+  });
+  hookedFolders.add(root);
+  return true;
+}
+
+/**
+ * Makes this process import the siblings `pluginDir` declares from their own
+ * folders, from the next import of the plugin on. Returns whether it does: a
+ * plugin with no installed sibling, and a process without Bun's runtime
+ * plugins, go through the links as before.
+ */
+export function importSiblingsFromTheirFolders(pluginDir: string, pluginsDir?: string): boolean {
+  const siblings = siblingFolders(pluginDir, pluginsDir);
+  const root = realFolder(pluginDir);
+  if (siblings.size === 0) {
+    siblingsByPlugin.delete(root);
+    return false;
+  }
+  siblingsByPlugin.set(root, siblings);
+  return hookPluginSource(root);
+}
+
+/**
+ * The same for a bundle of `pluginDir`: a bundler plugin that resolves the
+ * siblings it declares in their folders, or null when none is installed.
+ */
+export function siblingImportsBundlerPlugin(pluginDir: string, pluginsDir?: string): BunPlugin | null {
+  const siblings = siblingFolders(pluginDir, pluginsDir);
+  if (siblings.size === 0) return null;
+  const filter = new RegExp(`^(?:${[...siblings.keys()].map(escapeRegExp).join("|")})(?:/.*)?$`);
+  return {
+    name: "gloomberb-sibling-imports",
+    setup(build) {
+      build.onResolve({ filter }, (args) => {
+        const peer = [...siblings.keys()].find((name) => args.path === name || args.path.startsWith(`${name}/`));
+        const path = peer ? siblingModule(peer, siblings.get(peer)!, args.path) : null;
+        return path ? { path } : undefined;
+      });
+    },
+  };
+}

package/src/plugins/peer-retry.ts

@@ -1,5 +1,8 @@
-import { readdirSync, readFileSync, type Dirent } from "fs";
-import { dirname, extname, isAbsolute, join, relative } from "path";
+import { existsSync, readdirSync, readFileSync, type Dirent } from "fs";
+import { dirname, extname, join } from "path";
+
+import { isInside, replaceSpecifier, SOURCE_LOADERS, sourceLoader, withSiblingImports } from "./peer-imports";
+import { pluginDirectoryNames } from "./plugin-names";
 
 /**
  * A second import of a plugin whose first one failed on a sibling plugin it
@@ -19,19 +22,15 @@ import { dirname, extname, isAbsolute, join, relative } from "path";
  * nothing from the failed attempt is reused. Imports that leave the plugin,
  * the sibling's files included, resolve to the same modules as always, so the
  * plugin shares the sibling's state as on a normal load.
+ *
+ * A plugin's imports of its siblings no longer go through the link at all
+ * (peer-imports.ts), so what is left for the retry is a plugin that Bun
+ * already failed in this process, imported before its sibling was there.
  */
 
 /** The query that gives a plugin's files their new module keys. */
 const RETRY_PARAM = "gloom-plugin-retry";
 const RETRY_QUERY = new RegExp(`[?&]${RETRY_PARAM}=(\\d+)(?:&|$)`);
-const SOURCE_LOADERS: Readonly<Record<string, "ts" | "tsx" | "js" | "jsx">> = {
-  ".ts": "ts",
-  ".mts": "ts",
-  ".tsx": "tsx",
-  ".js": "js",
-  ".mjs": "js",
-  ".jsx": "jsx",
-};
 /** A file name that is never there: looking it up is what clears a folder. */
 const MISSING_FILE = "./.gloom-resolver-refresh";
 const SKIPPED_FOLDERS = new Set(["node_modules", ".git", "dist"]);
@@ -49,11 +48,6 @@ const retryRoots = new Map<number, string>();
 let retries = 0;
 let installed = false;
 
-function isInside(root: string, path: string): boolean {
-  const inside = relative(root, path);
-  return !!inside && !inside.startsWith("..") && !isAbsolute(inside);
-}
-
 /** The plugin's own folders, without dependencies or build output. */
 function sourceFolders(dir: string, out: string[] = [], depth = 0): string[] {
   out.push(dir);
@@ -72,11 +66,11 @@ function sourceFolders(dir: string, out: string[] = [], depth = 0): string[] {
 }
 
 /**
- * Makes Bun read the plugin's folders and its links to `peers` from disk
- * again. Bun drops a folder from its resolver cache when a lookup in it
- * misses, so this looks up a file that is not there in each one. The
- * bundler shares the cache, which is why the desktop's compile of the same
- * plugin failed in the same session too.
+ * Makes Bun read the plugin's folders, its links to `peers` and the peers'
+ * own folders from disk again. Bun drops a folder from its resolver cache
+ * when a lookup in it misses, so this looks up a file that is not there in
+ * each one. The bundler shares the cache, which is why the desktop's compile
+ * of the same plugin failed in the same session too.
  */
 export function refreshResolverFolders(pluginDir: string, peers: readonly string[]): void {
   const modules = join(pluginDir, "node_modules");
@@ -84,6 +78,10 @@ export function refreshResolverFolders(pluginDir: string, peers: readonly string
   for (const peer of peers) {
     if (peer.startsWith("@")) folders.push(join(modules, peer.split("/")[0]!));
     folders.push(join(modules, peer));
+    for (const name of pluginDirectoryNames(peer)) {
+      const peerDir = join(dirname(pluginDir), name);
+      if (existsSync(peerDir)) folders.push(...sourceFolders(peerDir));
+    }
   }
   for (const folder of folders) {
     try {
@@ -97,15 +95,17 @@ export function refreshResolverFolders(pluginDir: string, peers: readonly string
 /**
  * The plugin's file at `path` (with the retry query), its relative imports
  * of other source files in the plugin given the same query, so they load
- * under new keys as well. Imports that leave the plugin keep their keys.
+ * under new keys as well. Imports that leave the plugin keep their keys,
+ * and those of a sibling plugin name its file in the sibling's folder, as
+ * on a first import (peer-imports.ts).
  */
-function rekeyedSource(path: string): { contents: string; loader: "ts" | "tsx" | "js" | "jsx" } {
+function rekeyedSource(path: string): { contents: string; loader: ReturnType<typeof sourceLoader> } {
   const match = RETRY_QUERY.exec(path);
   const file = match ? path.slice(0, match.index) : path;
-  const loader = SOURCE_LOADERS[extname(file).toLowerCase()] ?? "js";
+  const loader = sourceLoader(file);
   let contents = readFileSync(file, "utf8");
   const root = match ? retryRoots.get(Number(match[1])) : undefined;
-  if (!match || !root) return { contents, loader };
+  if (!match || !root) return { contents: withSiblingImports(file, contents), loader };
   const retry = Number(match[1]);
   const specifiers = new Set(
     new Bun.Transpiler({ loader }).scanImports(contents)
@@ -121,12 +121,9 @@ function rekeyedSource(path: string): { contents: string; loader: "ts" | "tsx" |
       continue;
     }
     if (!isInside(root, target) || !SOURCE_LOADERS[extname(target).toLowerCase()]) continue;
-    const rekeyed = `${specifier}?${RETRY_PARAM}=${retry}`;
-    for (const quote of ["\"", "'", "`"]) {
-      contents = contents.split(`${quote}${specifier}${quote}`).join(`${quote}${rekeyed}${quote}`);
-    }
+    contents = replaceSpecifier(contents, specifier, `${specifier}?${RETRY_PARAM}=${retry}`);
   }
-  return { contents, loader };
+  return { contents: withSiblingImports(file, contents), loader };
 }
 
 function installRekeyingLoader(): boolean {

package/src/plugins/plugin-process.ts

@@ -0,0 +1,128 @@
+/**
+ * The `process` a plugin sees in the desktop view and the web app.
+ *
+ * A plugin written for the terminal runs in Bun and reads `process.env`,
+ * `process.platform` and friends without a second thought. The desktop view
+ * and the browser are not Node: there is no `process`, so the same plugin
+ * died on load with `ReferenceError: process is not defined`. Defining a global
+ * `process` would be simpler, but the host itself looks at `globalThis.process`
+ * to tell a Node runtime from a browser (updater, platform labels, libc
+ * detection), so every plugin would change how the host behaves. The bundler
+ * (`bundle.ts`) gives each plugin bundle its own copy instead, as a module
+ * level constant that only that bundle's references to `process` read.
+ *
+ * What it holds is the harmless half of `process`: a copy of `env` with only
+ * `NODE_ENV` in it (never the host's real environment, which the view cannot
+ * read and a plugin should not receive by RPC), the platform of the window it
+ * runs in, empty `argv` and `versions`, and timers and listeners that work or
+ * do nothing. What cannot exist in a view (`exit`, `kill`, `chdir`, memory
+ * and CPU readings) throws an error naming the plugin, instead of "is not a
+ * function". Anything else is left undefined, so feature detection such as
+ * `process.stdin?.isTTY` keeps working.
+ */
+
+/** The name the bundler gives the shim; no plugin source declares it. */
+export const PLUGIN_PROCESS_IDENTIFIER = "__gloomPluginProcess";
+
+/**
+ * Builds the shim. This function is serialised into the plugin bundle with
+ * `toString()`, so it has to stay self-contained: no imports and no module
+ * level names, only globals the view provides.
+ */
+function createPluginProcess(pluginName: string): Record<string, unknown> {
+  const nav = (globalThis as {
+    navigator?: { userAgentData?: { platform?: string }; platform?: string; userAgent?: string };
+  }).navigator;
+  const hint = String(nav?.userAgentData?.platform || nav?.platform || nav?.userAgent || "").toLowerCase();
+  // Mac is tested before Windows because "darwin" contains "win".
+  const platform = /android/.test(hint)
+    ? "android"
+    : /mac|iphone|ipad|darwin/.test(hint)
+      ? "darwin"
+      : /win/.test(hint)
+        ? "win32"
+        : /linux|x11|cros/.test(hint)
+          ? "linux"
+          : "browser";
+
+  const hrtime = (previous?: readonly [number, number]): [number, number] => {
+    const ms = performance.now();
+    let seconds = Math.floor(ms / 1000);
+    let nanos = Math.floor((ms % 1000) * 1e6);
+    if (previous) {
+      seconds -= previous[0];
+      nanos -= previous[1];
+      if (nanos < 0) {
+        seconds -= 1;
+        nanos += 1e9;
+      }
+    }
+    return [seconds, nanos];
+  };
+  const stream = (log: (line: string) => void) => ({
+    isTTY: false,
+    write: (chunk: unknown) => {
+      log(String(chunk).replace(/\n$/, ""));
+      return true;
+    },
+  });
+
+  const proc: Record<string, unknown> = {
+    env: { NODE_ENV: "production" },
+    platform,
+    browser: true,
+    title: "browser",
+    argv: [],
+    execArgv: [],
+    execPath: "",
+    version: "",
+    versions: {},
+    pid: 0,
+    ppid: 0,
+    cwd: () => "/",
+    uptime: () => performance.now() / 1000,
+    hrtime: Object.assign(hrtime, { bigint: () => BigInt(Math.round(performance.now() * 1e6)) }),
+    nextTick: (callback: (...args: unknown[]) => void, ...args: unknown[]) => {
+      queueMicrotask(() => callback(...args));
+    },
+    emitWarning: (warning: unknown) => {
+      console.warn(String((warning as { message?: string } | null)?.message ?? warning));
+    },
+    stdout: stream((line) => console.log(line)),
+    stderr: stream((line) => console.error(line)),
+    emit: () => false,
+    listeners: () => [],
+    listenerCount: () => 0,
+  };
+  // Nothing exits or signals in a view, so a handler would never run.
+  for (const name of [
+    "on", "once", "off", "addListener", "removeListener", "removeAllListeners",
+    "prependListener", "prependOnceListener", "setMaxListeners",
+  ]) {
+    proc[name] = () => proc;
+  }
+  for (const name of [
+    "exit", "abort", "kill", "chdir", "umask", "binding", "memoryUsage", "cpuUsage", "resourceUsage",
+  ]) {
+    proc[name] = () => {
+      throw new Error(
+        `Plugin "${pluginName}" called process.${name}(), which is only available in the terminal app, not in the desktop or web app.`,
+      );
+    };
+  }
+  return proc;
+}
+
+/** The declaration the bundler puts at the top of a bundle that reads `process`. */
+export function pluginProcessDeclaration(pluginName: string): string {
+  return `const ${PLUGIN_PROCESS_IDENTIFIER} = (${createPluginProcess.toString()})(${JSON.stringify(pluginName)});\n`;
+}
+
+/** Source of `import process from "node:process"`, for a plugin that imports it. */
+export function pluginProcessModuleSource(): string {
+  const names = Object.keys(createPluginProcess(""));
+  return [
+    "export default process;",
+    ...names.map((name) => `export const ${name} = process.${name};`),
+  ].join("\n");
+}

package/src/plugins/redirection-guard.ts

@@ -0,0 +1,45 @@
+/**
+ * Whether Windows lets this process follow a junction a standard user made,
+ * which is what every link to a sibling plugin is (host-link.ts).
+ *
+ * Windows 11's RedirectionGuard stops a process that runs with it from
+ * following such a junction at all: the junction is there, points where it
+ * should, and every read through it fails. That is how the gateway's link
+ * looked on the first launch after an update. Some Windows services run with
+ * it; whether that launch did is not known, so the report of a link that does
+ * not resolve carries the answer.
+ */
+
+/** `ProcessRedirectionTrustPolicy` in Windows' PROCESS_MITIGATION_POLICY. */
+const PROCESS_REDIRECTION_TRUST_POLICY = 16;
+const CURRENT_PROCESS = -1;
+const ENFORCE = 0x1;
+const AUDIT = 0x2;
+
+let answer: string | null | undefined;
+
+/** `enforce`, `audit` (only logged), `off`, or `unknown` when Windows does not say. Null on other systems. */
+export function redirectionGuard(): string | null {
+  if (process.platform !== "win32") return null;
+  if (answer !== undefined) return answer;
+  answer = "unknown";
+  try {
+    // Required when asked, not imported: the pane screenshot page bundles the
+    // plugin loader for a browser, which has no `bun:ffi`.
+    const { dlopen, ptr } = import.meta.require("bun:ffi") as typeof import("bun:ffi");
+    const kernel32 = dlopen("kernel32.dll", {
+      GetProcessMitigationPolicy: { args: ["i64", "i32", "ptr", "u64"], returns: "i32" },
+    });
+    try {
+      const flags = new Uint32Array(1);
+      if (kernel32.symbols.GetProcessMitigationPolicy(CURRENT_PROCESS, PROCESS_REDIRECTION_TRUST_POLICY, ptr(flags), 4)) {
+        answer = (flags[0]! & ENFORCE) ? "enforce" : (flags[0]! & AUDIT) ? "audit" : "off";
+      }
+    } finally {
+      kernel32.close();
+    }
+  } catch {
+    // Intentional ignore: a Windows without the policy leaves the answer unknown.
+  }
+  return answer;
+}