@naswerks/periscope 1.0.0

package/docs/state-machine.md

@@ -0,0 +1,160 @@
+# The session state machine
+
+The declared state model every other part emits into: caused transitions, open entries with ages,
+the durable append-only log they land in, and the coverage tables that make "every hook wired or
+declined" auditable. The package overview is [architecture.md](architecture.md); how transitions
+ride the wire is in [protocol.md](protocol.md).
+
+## Two machines, two altitudes
+
+Periscope's machine speaks the SDK's session lifecycle and lives in memory, per host, one per
+session. A controller's machine speaks the controller's own vocabulary and consumes Periscope's
+transitions as input. The host emits valid, caused transitions and detects unpaired entries; it
+never learns a controller's word and never derives a controller's state. A consumer that finds
+itself adding a status field has found a missing state in this model, not a local column.
+
+## The vocabulary (`src/state/model.ts`)
+
+Seven states: `spawning`, `ready`, `working`, `idle`, `errored`, `interrupted`, `ended`. `ready`
+means the agent reported itself (`system/init`, the only source of the session id, the CLI version,
+the model, the tool, skill and plugin inventory and `apiKeySource`). Init arrives mid-turn, so a
+real trace reads `working` then `ready` then `working`: `UserPromptSubmit` fires before
+`system/init`. A session created but never prompted sits in `spawning` until the start timeout;
+that missing `ready` is what makes the emits-nothing-until-prompted behaviour legible instead of a
+hang.
+
+Two notes for a consumer of the `ended` edge:
+
+- A refused open is emitted as `spawning` to `ended` with cause `{ kind: 'refusal', event: <reason> }`.
+  No machine ever existed, so it is the one transition the host composes by hand: `sessionId: null`,
+  `correlationId` the controller's handle, `seq: 1`, the refusal's detail carried whole. It rides
+  the ordinary `StateTransitionUpdate` lane.
+- The host's `ended` is the controller's fact. A controller ends its own record of the session on
+  it, the refused open included, and never waits for a second signal.
+
+Six activity kinds, structured `{ kind, name }` and never composed strings: `tool`, `subagent`,
+`permission`, `elicitation`, `requesting`, `compacting`. `formatActivity()` makes the display
+string; the structure is the truth. There is no activity for "escalated to a human": that is a
+judgement the host cannot make.
+
+`SessionLifecycle` (`provisioning`, `live`, `ended`, in `src/sessions/session.ts`) is an input to
+this machine; lifecycle changes arrive as `cause.kind: 'process'`. It is not a peer model, and the
+two are not symmetric.
+
+## The transition record
+
+```
+{ sessionId, seq, at, from, to, activity,
+  cause: { kind, event, detail },        // kind: hook | sdk-message | control | timeout | process | refusal
+  where: { worktree, branch, cwd } }
+```
+
+- `cause` is compile-closed and required. `CauseEvent` is the union of the hook events, the message
+  discriminators, `CONTROL_EVENTS`, `PROCESS_EVENTS`, `TIMEOUT_EVENTS` and `RefusalReason`; a
+  transition that cannot name its cause does not compile.
+- `refusal` is the sixth kind because a denial and an outage cannot be told apart with five: a deny
+  is `control/permission_denied`, an outage is `refusal/permission-decision-unavailable`, different
+  in kind and in event, never only in prose. `detail` is for people and is never branched on.
+- `kind` and `event` are validated independently, never as a pair: `nameable()`
+  (`src/state/machine.ts`) accepts `{ kind: 'hook', event: 'permission_denied' }` although it is
+  incoherent. Coherence is the author's job, stated at `CONTROL_EVENTS`.
+- `where` carries forward across transitions and updates on `CwdChanged`; `src/host/git-facts.ts`
+  reads worktree and branch read-only and understands the linked-worktree `.git` file. The
+  `spawning` transition's `where.cwd` is the workspace the session got, and that property is
+  pinned.
+
+## The state is the record
+
+`SessionStateMachine` has no backing fields: `state`, `activity`, `sessionId` and `where` all derive
+from the last recorded transition, and the commit has one assignment, no branches and one exit
+(`pins/state-record.test.ts`). A path that skips the record therefore also fails to change the
+state, so suppression is self-defeating instead of silent. Two laws follow: a state record and a
+control signal never share a guard, and no state is inferred from the absence of something.
+
+`record()` never throws, deliberately. Every hook handler is wrapped in `try/catch` (a throwing hook
+is fail-open in the SDK), so a throw from the emitter would be swallowed by the safety wrapper and
+the transition would vanish. Loud means refused, counted and reported on `onRejected`; emission
+rides outside the deny path's wrapper.
+
+## Open entries are aged, never silently reconciled
+
+Entry operations are `open`, `close`, `background` and `abandon-open`. Every entry gets an exit or
+is surfaced open with an age. A session sitting in `tool:Bash` for forty minutes is the most useful
+thing this layer can say, and cleanup may mark an entry abandoned but never erase that it happened.
+Backgrounding: an entry moves to the background set at the moment it backgrounds, with a cause
+(`task_updated`'s `is_backgrounded`), still owes an exit (`task_notification`), and a session with
+only background work is `idle`; it can take a new prompt while a build runs.
+
+For a denied tool call `PostToolUse` does not fire; `PostToolBatch` is the entry backstop (its
+`tool_calls` includes denied ids) and it records "closed by the end of its batch". It never says
+denied. The denial itself is the gate's own `control/permission_denied` transition
+([gate.md](gate.md)).
+
+A transition recorded before `system/init` has `sessionId: null`, and a `SessionFrame` requires a
+non-empty id; the frame's `sessionId` is the controller's handle for exactly this reason. The one
+pre-init transition that rides the wire is the refused open above: the frame carries the
+controller's handle, the body carries `sessionId: null`.
+
+## Where a transition ends up
+
+Three destinations, not interchangeable:
+
+| Destination                                           | What it holds                                         | The rule                                                                                                                         |
+| ----------------------------------------------------- | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `TransitionStore` (`src/state/store.ts`)              | A bounded in-memory ring, rejections included         | It drops its oldest once a session outruns the window; never the record of anything                                              |
+| The wire                                              | Every recorded transition, whichever lane produced it | `forwardSession` subscribes to `machine.onTransition`, so a hold, a deny, an outage and a local refusal all reach the controller |
+| The durable log (`src/persistence/transition-log.ts`) | The keepable record                                   | Append-only; the single point of truth for locally-decided refusals                                                              |
+
+Append-only is load-bearing. The ring overwrites and the wire is delivery, not storage, so the
+durable log is the only place a path-jail denial, a boundary command, a credential-path read or an
+unconvertible tool descriptor survives at all. A tidy-up here does not lose a log line; it loses
+the only evidence that the gate ever ran.
+
+- `markAbandoned` appends, never edits. It writes a new record carrying the reason; a reconciler
+  that quietly closed the entry would destroy the forty-minute sentence above.
+- The cause survives the round trip or the read refuses. The encoder writes all three parts and the
+  decoder rejects an entry that lost any of them rather than substituting a plausible default.
+- Deltas never enter it (declared in `MESSAGE_ROUTING`), and that half of the replay rule points
+  the opposite way from retransmission ([protocol.md](protocol.md)). Both halves are pinned.
+
+## The coverage tables
+
+`src/state/coverage.ts` lists every hook event and every `SDKMessage` discriminator as wired or
+declined, each row carrying its reason. Count the tables; never carry the numbers. They are kept
+honest three ways: `satisfies Record<HookEvent, CoverageRow>` breaks the build when the SDK adds an
+event; `pins/hook-coverage.test.ts` parses the unions out of the installed `sdk.d.ts` itself, with a
+positive control on the parser; and `observationHooks()` derives its registrations from the table,
+pinned to match. An event absent from the table is a gap, not a default.
+
+The table answers "does this move the machine". `MESSAGE_ROUTING` (`src/control/stream-routing.ts`)
+answers "does this go on the wire". They disagree in both directions on purpose (`assistant` is
+declined here and forwarded there; `session_state_changed` is wired here and declined there) and
+must never be merged.
+
+The runtime wins over the types. Four wired events are measured not to fire under an SDK-hosted
+session: `SessionStart` (take the start receipt from `system/init`), `PermissionRequest` and
+`PermissionDenied` (a hook-authored deny blocks while both stay silent), and
+`system/session_state_changed` (`Stop` and `result` are the observed turn boundaries). The rows stay
+wired, because "wired and not observed" is a question and "declined" closes one, and each says
+"measured not to fire" at the row. Re-measure before relying on any of the four.
+
+## The reporter is not a roster
+
+`SessionStateReporter` enumerates this host's sessions with state, activity and open-entry ages:
+the raw material a controller's roster aggregates. It has no predicate, no search and no notion of
+which sessions are interesting; a host that judges gets rebuilt per product. Do not grow it one.
+
+## Where things live
+
+| Path                                | What                                                                                           |
+| ----------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `src/state/model.ts`                | States, activities, the closed cause vocabularies, `SessionTransition`, `OpenEntry`            |
+| `src/state/machine.ts`              | `SessionStateMachine`: derive from the last transition; `record`, `onTransition`, `onRejected` |
+| `src/state/observer.ts`             | The one translation site from SDK hooks and messages to transition requests                    |
+| `src/state/store.ts`                | `TransitionStore`, the bounded in-memory ring that retains rejections and drops its oldest     |
+| `src/persistence/transition-log.ts` | The durable append-only log; `markAbandoned`; the cause-survives-or-refuse decoder             |
+| `src/state/coverage.ts`             | `HOOK_COVERAGE` and `MESSAGE_COVERAGE`, wired or declined with reasons                         |
+| `src/state/reporter.ts`             | Enumeration of this host's sessions                                                            |
+| `src/host/hooks.ts`                 | `observationHooks()`, derived from the table, and `mergeHooks()`                               |
+| `src/host/git-facts.ts`             | Read-only `where`, including the linked-worktree `.git` file                                   |
+| `src/pins/state-record.test.ts`     | The no-suppressing-branch structural pin                                                       |

package/examples/README.md

@@ -0,0 +1,141 @@
+# Examples
+
+Three things live here: **the smallest controller that completes a link**, **a reference
+implementation of a controller**, and **a proof that this package is usable by somebody who did not
+write it**, driven against a real agent.
+
+Both consume Periscope by **package name** — `@naswerks/periscope` and `@naswerks/periscope/protocol` — through the
+`exports` map, exactly as `npm install` resolves it. Not one deep relative import. A deep import
+would prove the files exist; these prove the published entry points are sufficient.
+
+## Running them
+
+Node 22.18 or later strips types natively, so there is no build step for the examples themselves.
+
+```
+npm run build                              # the package's own dist/, which the examples import
+npm run typecheck:examples
+node examples/minimal-controller/controller.ts   # the two URLs a host needs, then denies every tool
+node examples/test-controller/serve.ts           # the reference, with a pair code printed to redeem
+node examples/parallel-run-proof/run.ts          # the proof; drives a real agent
+```
+
+`test-controller/serve.ts` is the local rehearsal of the pairing walk-through: it prints the exact
+`periscope pair <code> --controller <origin>` line, and a host paired to it shows up in its log.
+
+The proof drives a **real agent** and costs real money. `PERISCOPE_PROOF_OUT=<path>` writes the
+whole run to a file.
+
+## `minimal-controller/`
+
+The smallest controller that completes a link: it welcomes the host, answers its heartbeat, acks
+every frame and denies every tool call. It stays this small on purpose, and the reference controller
+below is where every further behaviour lives. It is `minimal-controller/controller.ts`, verbatim (a
+pin keeps the two identical):
+
+```ts
+// The smallest controller that completes a link: the WebSocket the host dials, answering the hello,
+// the heartbeat and every session frame's ack, and the HTTP endpoint that denies every tool call.
+// Both transports are required; a host with nowhere to send a decision refuses to start.
+import { createServer } from 'node:http';
+import { WebSocketServer, type RawData } from 'ws';
+import { PROTOCOL_VERSION, decode, encode, type ControlPayload } from '@naswerks/periscope/protocol';
+
+const text = (data: RawData): string =>
+  Buffer.concat(Array.isArray(data) ? data : [Buffer.from(data as ArrayBuffer)]).toString('utf8');
+
+new WebSocketServer({ port: 8790, path: '/link' }).on('connection', (socket) => {
+  const control = (payload: ControlPayload): void => {
+    const frame = encode({ frame: 'control', at: new Date().toISOString(), payload });
+    if (frame.ok) socket.send(frame.value);
+  };
+  socket.on('message', (data) => {
+    const frame = decode(text(data));
+    if (!frame.ok) return;
+    if (frame.value.frame === 'session') {
+      control({ kind: 'link_ack', cursors: [{ sessionId: frame.value.sessionId, seq: frame.value.seq }] });
+    } else if (frame.value.payload.kind === 'link_hello') {
+      control({ kind: 'link_welcome', protocolVersion: PROTOCOL_VERSION, capabilities: [], cursors: [] });
+    } else if (frame.value.payload.kind === 'link_ping') {
+      control({ kind: 'link_pong', nonce: frame.value.payload.nonce });
+    }
+  });
+});
+
+createServer((_request, response) => {
+  response.writeHead(200, { 'content-type': 'application/json' });
+  response.end(
+    JSON.stringify({ behavior: 'deny', message: 'the minimal controller denies every tool call' }),
+  );
+}).listen(8791);
+
+console.log(
+  'PERISCOPE_CONTROLLER_URL=ws://127.0.0.1:8790/link PERISCOPE_DECISION_URL=http://127.0.0.1:8791/decisions',
+);
+```
+
+Run it with `node examples/minimal-controller/controller.ts`, export the two URLs it prints, and
+start a host with `periscope`.
+
+## `test-controller/`
+
+The reference controller, not a harness: the smallest complete other end of a host. It accepts the
+outbound connection, negotiates the version, answers the heartbeat, acks every frame, answers
+permission escalations over HTTP, serves a couple of tools, receives bulk posts, and renders every
+frame to a log a human can read. Two things a controller in another language copies from it:
+
+- **The doors.** `POST /asks/<kind>` for every host-scoped ask (`session_list`, `transcript_list`,
+  `transcript_tail`, `workspace_list`, `workspace_release`, `workspace_release_bulk`,
+  `host_configure`, `repository_list`, `repository_read`): the JSON body is the ask's members
+  without `requestId`, the controller mints one, sends the ask on the host's discovery channel, and
+  answers the result payload whole when the frame carrying that `requestId` arrives. An ask the codec
+  refuses is answered 400 before a sequence number is spent; a host that does not answer is 504.
+- **Pairing.** `POST /api/periscope/pair-codes` mints a single-use code; `POST /api/periscope/pair`
+  with `{ code, machineLabel }` redeems it for `{ hostId, hostCredential, controllerUrl, decisionUrl }`,
+  which is what `periscope pair <code> --controller <origin>` expects. Once a machine has paired,
+  every WebSocket upgrade presents the paired bearer or is refused with 401, which the host reads as
+  `link-unauthorized` and does not retry. Until one has, the door is open, because this reference
+  cannot validate a sign-in token without an identity provider; a real controller does.
+
+**It keeps one host row and the frames it saw, in memory, and no more.** No roster, no queue, no
+orchestration of its own: what a session means is the embedder's. `src/host/end-to-end.test.ts`
+drives every door, the pair round-trip and a host-scoped ask across a reconnect against a real host.
+
+Its permission endpoint is typed by `DecisionRequest` and `Decision` from
+`@naswerks/periscope/protocol`, the same names a controller in another language reproduces from
+[the wire protocol](../docs/protocol.md).
+
+## `parallel-run-proof/`
+
+Drives a genuine multi-turn piece of work in a real git worktree and reports its assertions, each
+of them **observed** or **`not exercised` with a reason**. Nothing in it concludes a property from
+reading the code. `permission-mode-probe.ts` beside it is the receipt for what an allowed call
+reaches with and without `grantOnAllow` (`SECURITY.md`, fact 5).
+
+## A controller in another language
+
+Nothing here is TypeScript-specific: the wire is [the protocol document](../docs/protocol.md) and
+the vectors under `contracts/wire-vectors/`, and a controller that reads them implements the same
+door in any language. The controller these examples rehearse against is one of two the package is
+measured against; the other is written in C#, in a separate application, and pairs a stock install
+of this package the same way.
+
+## What a controller provides beyond the wire
+
+The wire is half of a controller. The other half is stated here because a first implementer meets
+it only by running a host:
+
+1. **Two transports.** Frames ride the WebSocket; a permission escalation arrives as an ordinary
+   HTTP `POST` to a URL the host is configured with (`PERISCOPE_DECISION_URL`). Nothing on the wire
+   announces that endpoint; [the wire protocol](../docs/protocol.md) states its request and answer.
+2. **The permission types are the highest-consequence surface.** `@naswerks/periscope/protocol`
+   exports `Decision`, `DecisionRequest`, `Decider` and `EscalationTransport`, so a TypeScript
+   controller types its decision endpoint without the privileged entry point; a controller in
+   another language reproduces the member table in the protocol document.
+3. **There is no wire lane for registering an in-process tool.** Descriptors are the embedder's
+   (`PeriscopeHostOptions.tools`); a controller gives a session its tools through
+   `session_new.request.mcpServers`, an HTTP or stdio MCP server declaration.
+4. **`escalatingDecider` is on the main entry point, not the wire subpath.** The subpath carries
+   the types; the function that POSTs a decision request ships from `@naswerks/periscope`, which
+   reaches the privileged module. The proof hand-writes an eight-line replacement to record what a
+   controller-side implementer actually has to reproduce.

package/examples/minimal-controller/controller.ts

@@ -0,0 +1,38 @@
+// The smallest controller that completes a link: the WebSocket the host dials, answering the hello,
+// the heartbeat and every session frame's ack, and the HTTP endpoint that denies every tool call.
+// Both transports are required; a host with nowhere to send a decision refuses to start.
+import { createServer } from 'node:http';
+import { WebSocketServer, type RawData } from 'ws';
+import { PROTOCOL_VERSION, decode, encode, type ControlPayload } from '@naswerks/periscope/protocol';
+
+const text = (data: RawData): string =>
+  Buffer.concat(Array.isArray(data) ? data : [Buffer.from(data as ArrayBuffer)]).toString('utf8');
+
+new WebSocketServer({ port: 8790, path: '/link' }).on('connection', (socket) => {
+  const control = (payload: ControlPayload): void => {
+    const frame = encode({ frame: 'control', at: new Date().toISOString(), payload });
+    if (frame.ok) socket.send(frame.value);
+  };
+  socket.on('message', (data) => {
+    const frame = decode(text(data));
+    if (!frame.ok) return;
+    if (frame.value.frame === 'session') {
+      control({ kind: 'link_ack', cursors: [{ sessionId: frame.value.sessionId, seq: frame.value.seq }] });
+    } else if (frame.value.payload.kind === 'link_hello') {
+      control({ kind: 'link_welcome', protocolVersion: PROTOCOL_VERSION, capabilities: [], cursors: [] });
+    } else if (frame.value.payload.kind === 'link_ping') {
+      control({ kind: 'link_pong', nonce: frame.value.payload.nonce });
+    }
+  });
+});
+
+createServer((_request, response) => {
+  response.writeHead(200, { 'content-type': 'application/json' });
+  response.end(
+    JSON.stringify({ behavior: 'deny', message: 'the minimal controller denies every tool call' }),
+  );
+}).listen(8791);
+
+console.log(
+  'PERISCOPE_CONTROLLER_URL=ws://127.0.0.1:8790/link PERISCOPE_DECISION_URL=http://127.0.0.1:8791/decisions',
+);

package/examples/parallel-run-proof/permission-mode-probe.ts

@@ -0,0 +1,129 @@
+/**
+ * What actually happens to a tool call under each decision, measured side by side.
+ *
+ * Run it:  node examples/parallel-run-proof/permission-mode-probe.ts
+ *
+ * It exists because two different causes produce the same visible outcome (the file is not there)
+ * and telling them apart is the difference between "the gate works" and "nothing runs anyway":
+ *
+ *   DENIED   the controller said no. The tool must not run, and the MODEL must be told why, in the
+ *            controller's own words.
+ *   ALLOWED  the controller said yes. The tool must run.
+ *
+ * A probe that only checked whether the file appeared would score both as a pass for the deny case
+ * and would never notice that the allow case fails for a reason that has nothing to do with the
+ * gate. So both are run and both tool results are printed verbatim; the reader compares.
+ *
+ * It composes the parts by hand rather than calling `composeSession`, so nothing here can be an
+ * artifact of the composer. This is the wiring the package documents, typed out.
+ */
+import { existsSync, mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { Decision } from '@naswerks/periscope';
+import {
+  SessionObserver,
+  SessionRegistry,
+  SessionStateMachine,
+  mergeHooks,
+  observationHooks,
+  permissionHooks,
+  readTurnSpend,
+  systemClock,
+  systemTicker,
+} from '@naswerks/periscope';
+
+interface Case {
+  readonly label: string;
+  readonly decision: Decision;
+  /** Whether the gate's decision is made EFFECTIVE. The third case is the whole point. */
+  readonly grantOnAllow: boolean;
+}
+
+const CASES: Case[] = [
+  {
+    label: 'DENIED         ',
+    decision: { behavior: 'deny', message: 'the probe controller refuses this write' },
+    grantOnAllow: false,
+  },
+  // The residual, kept as a permanent case. An embedder who composes by hand and does not grant
+  // gets a gate that cannot say yes, and nothing tells them: the tool simply does not run.
+  { label: 'ALLOWED-SILENT ', decision: { behavior: 'allow' }, grantOnAllow: false },
+  { label: 'ALLOWED-GRANTED', decision: { behavior: 'allow' }, grantOnAllow: true },
+];
+
+let spentUsd = 0;
+
+for (const one of CASES) {
+  const cwd = mkdtempSync(join(tmpdir(), 'periscope-permission-probe-'));
+
+  const machine = new SessionStateMachine({
+    where: { cwd, worktree: null, branch: null, unknownReason: 'a probe workspace is not a repository' },
+    clock: systemClock,
+    ticker: systemTicker,
+  });
+  const observer = new SessionObserver(machine);
+  const causes: string[] = [];
+  machine.onTransition((transition) => causes.push(`${transition.cause.kind}/${transition.cause.event}`));
+
+  const registry = new SessionRegistry({
+    baseEnv: process.env,
+    homeDir: process.env['USERPROFILE'] ?? process.env['HOME'] ?? '',
+    startTimeoutMs: 120_000,
+  });
+
+  const opened = await registry.open({
+    cwd,
+    prompt:
+      `Use the Write tool once to write the single word pomegranate to ${join(cwd, 'probe.txt').replace(/\\/g, '/')}. ` +
+      'If it is refused, do not retry and do not use any other tool — just say REFUSED. Then stop.',
+    hooks: mergeHooks(
+      observationHooks({ observer }),
+      permissionHooks({
+        sessionKey: `probe-${one.label}`,
+        decide: () => Promise.resolve(one.decision),
+        onOutcome: () => undefined,
+        grantOnAllow: one.grantOnAllow,
+      }),
+    ),
+  });
+
+  if (!opened.ok) {
+    console.log(`${one.label} THE SESSION DID NOT START: ${opened.refusal.reason} ${opened.refusal.detail}`);
+    continue;
+  }
+
+  const session = opened.value;
+  let toolResult = '(no tool result was seen)';
+
+  await new Promise<void>((resolve) => {
+    const timer = setTimeout(resolve, 150_000);
+    session.onMessage((message) => {
+      const seen = message as unknown as { type: string; message?: { content?: unknown } };
+      // A `user` message on the output stream IS the tool result. It is the only place the CLI says
+      // why a tool did not run, and the only place the model's own explanation can be read.
+      if (seen.type === 'user') toolResult = JSON.stringify(seen.message?.content);
+      if (seen.type === 'result') {
+        spentUsd += readTurnSpend(message)?.totalCostUsd ?? 0;
+        clearTimeout(timer);
+        resolve();
+      }
+    });
+  });
+
+  console.log(
+    `${one.label} permissionMode reported by the agent: ${session.facts?.permissionMode ?? '(unknown)'}`,
+  );
+  console.log(`${one.label} probe.txt on disk: ${existsSync(join(cwd, 'probe.txt'))}`);
+  console.log(
+    `${one.label} the trace says: ${[...new Set(causes)].filter((c) => !c.startsWith('sdk-message')).join(', ')}`,
+  );
+  console.log(`${one.label} TOOL RESULT: ${toolResult.slice(0, 600)}`);
+  console.log('');
+
+  session.stop('the probe finished');
+}
+
+console.log(`MEASURED SPEND: $${spentUsd.toFixed(4)} — read with readTurnSpend, never computed`);
+process.exit(0);