@nimbus-sh/worker 0.10.0 → 0.11.0

package/dist/runtime/opencode-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode-artifact.d.ts","sourceRoot":"","sources":["../../src/runtime/opencode-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAcH,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAwFD,oDAAoD;AACpD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,gBAAgB,EACrB,IAAI,GAAE,SAAS,GAAG,QAAoB,GACrC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,WAAW,CAAC,CAEtB;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAYjC"}
+{"version":3,"file":"opencode-artifact.d.ts","sourceRoot":"","sources":["../../src/runtime/opencode-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAgDD,oDAAoD;AACpD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,gBAAgB,EACrB,IAAI,GAAE,SAAS,GAAG,QAAoB,GACrC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,WAAW,CAAC,CAEtB;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAYjC"}

package/dist/runtime/opencode-artifact.js

@@ -20,19 +20,9 @@
  * (see OPENCODE_TREE_SITTER_WASMS and FacetManager.treeSitterModuleEntries).
  */
 import { OPENCODE_ARTIFACT_BUILD_ID, OPENCODE_ARTIFACT_DIGESTS, OPENCODE_ARTIFACT_PRESENT, OPENCODE_ARTIFACT_VERSION, } from '../opencode-artifact.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
-import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
+import { fetchStagedBytes } from './staged-source.js';
 /** Base asset path of the staged opencode bundle directory. */
 const OPENCODE_ASSET_BASE = `/_assets/opencode/${OPENCODE_ARTIFACT_VERSION}`;
-// The build id (content hash of the staged dist) is part of the L2 key so a
-// same-version rebuild with different bytes never serves stale content from a
-// warm colo cache.
-function l2Key(file) {
-    return `https://nimbus-cache.invalid${OPENCODE_ASSET_BASE}/${OPENCODE_ARTIFACT_BUILD_ID}/${file}`;
-}
-function assetUrl(file) {
-    return `https://nimbus-internal.invalid${OPENCODE_ASSET_BASE}/${file}`;
-}
 /**
  * The pinned digest for a staged file. Unstaged builds carry an empty map, so
  * the two conditions are reported apart: "this build has no artifact at all"
@@ -54,48 +44,22 @@ function pinnedDigest(file) {
 }
 async function fetchAsset(env, file) {
     const expected = pinnedDigest(file);
-    const caches = globalThis.caches;
-    let ab = null;
-    try {
-        if (caches?.default) {
-            const hit = await caches.default.match(new Request(l2Key(file)));
-            if (hit && hit.ok)
-                ab = await hit.arrayBuffer();
-        }
-    }
-    catch { /* fall through to ASSETS */ }
-    const fromCache = ab !== null;
-    if (!ab) {
-        const res = await env.ASSETS.fetch(new Request(assetUrl(file)));
-        try {
-            if (!res.ok) {
-                throw new Error(`opencode asset fetch failed: ${res.status} ${res.statusText} for ` +
-                    `${OPENCODE_ASSET_BASE}/${file} — deploy is missing the staged opencode artifact`);
-            }
-            ab = await res.arrayBuffer();
-        }
-        finally {
-            disposeRpcResource(res);
-        }
-    }
-    const digest = await sha256Hex(ab);
-    if (digest !== expected) {
-        throw new Error(`opencode asset integrity check failed for ${OPENCODE_ASSET_BASE}/${file}: expected ` +
-            `${expected}, got ${digest} (${fromCache ? 'L2 cache' : 'ASSETS'}) — the staged ` +
-            'artifact is corrupt or out of sync; rerun scripts/bundle-opencode.mjs and redeploy');
-    }
-    if (!fromCache) {
-        try {
-            if (caches?.default) {
-                const writeBack = new Response(new Uint8Array(ab), {
-                    headers: { 'Cache-Control': 'public, max-age=31536000, immutable' },
-                });
-                await caches.default.put(new Request(l2Key(file)), writeBack);
-            }
-        }
-        catch { /* silent */ }
-    }
-    return ab;
+    const path = `${OPENCODE_ASSET_BASE}/${file}`;
+    return fetchStagedBytes(env, {
+        path,
+        // The build id (content hash of the staged dist) is part of the key so a
+        // same-version rebuild with different bytes never serves stale content
+        // from a warm colo cache.
+        l2Key: `https://nimbus-cache.invalid${OPENCODE_ASSET_BASE}/${OPENCODE_ARTIFACT_BUILD_ID}/${file}`,
+        sha256: expected,
+        poisonedCache: 'reject',
+        missingBinding: `Nimbus: opencode requires an env.ASSETS binding (serves ${path})`,
+        fetchFailed: (res) => `opencode asset fetch failed: ${res.status} ${res.statusText} for ` +
+            `${path} — deploy is missing the staged opencode artifact`,
+        integrityFailed: (digest, from) => `opencode asset integrity check failed for ${path}: expected ` +
+            `${expected}, got ${digest} (${from}) — the staged ` +
+            'artifact is corrupt or out of sync; rerun scripts/bundle-opencode.mjs and redeploy',
+    });
 }
 /** Fetch the opencode CLI bundle source as text. */
 /**

package/dist/runtime/opencode-facet-runner.d.ts

@@ -35,6 +35,7 @@
  * map (see SQLITE_WASM_MODULE_NAME) and is booted before opencode opens the
  * DB at ~/.local/share/opencode/*.db.
  */
+import type { NodeFacetSources } from './node-shims-artifact.js';
 /** Map-module specifier for the opencode ESM bundle. */
 export declare const OPENCODE_BUNDLE_MODULE_NAME = "opencode-bundle.js";
 /**
@@ -75,18 +76,14 @@ export interface OpencodeRunnerOptions {
     };
     cwd: string;
     stdin: string;
-    /** The node-compat shim source (fetchNodeShimsCode — the staged asset). */
-    shimsCode: string;
+    /** The node-compat layer's sources (fetchNodeFacetSources — the staged assets). */
+    sources: NodeFacetSources;
     /**
      * Serialized VFS snapshot bundle (the `_serializeBundleForFacet` IIFE
      * string). Provides sync VFS reads; async writes/mkdir flush live through
      * the SUPERVISOR RPC binding.
      */
     vfsBundle: string;
-    /** Serialized VFS directory manifest (JSON) for readdir/stat coherence. */
-    vfsManifest: string;
-    /** Serialized VFS inode metadata (JSON) for stat and permission checks. */
-    vfsMetadata: string;
     /** The coherence cursor the snapshot above was read at, as a JSON literal. */
     vfsCursor: string;
     /**

package/dist/runtime/opencode-facet-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode-facet-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/opencode-facet-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAkBH,wDAAwD;AACxD,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AA0JzE;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAchG;AAkCD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAuDnE,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,oBAAoB,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAevC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAmOjC,CAAC;AA2BF;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAssB9E"}
+{"version":3,"file":"opencode-facet-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/opencode-facet-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgBjE,wDAAwD;AACxD,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AA0JzE;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAchG;AAkCD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAuDnE,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,oBAAoB,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAevC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAmOjC,CAAC;AA2BF;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAwuB9E"}

package/dist/runtime/opencode-facet-runner.js

@@ -37,13 +37,14 @@
  */
 import { generateSqliteFacetPreamble } from './sqlite-shim.js';
 import { VFS_CURSOR_SEED_SOURCE } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
-import { VFS_WRITE_LEDGER_SOURCE } from '@nimbus-sh/core/_shared/vfs-write-ledger.js';
+import { ONE_SHOT_STORE_MEMORY_BYTES } from '../vfs/facet-resident-limits.js';
 import { OPENTUI_BACKEND_FACET_SRC, OPENTUI_BACKEND_GLOBAL, OPENTUI_WASM_MODULE_NAME, generateOpenTUIBackendBootCode, } from './opentui-facet-backend.js';
 import { OPENCODE_TREE_SITTER_WASMS, OPENCODE_YOGA_WASM } from '../opencode-artifact.generated.js';
-// The ~230 KiB node-compat shim source is staged as a static asset
-// (scripts/bundle-node-shims.mjs) — promoted out of the worker bundle for the
-// ≤6 MiB gate. The caller (FacetManager.execStagedArtifact) awaits the
-// memoized fetchNodeShimsCode and threads it in via opts.shimsCode.
+// The node-compat layer's sources (the ~230 KiB shims and the VFS write ledger
+// they write through) are staged as static assets (scripts/bundle-node-shims.mjs),
+// promoted out of the worker bundle for its size gate. The caller
+// (opencode-staging.ts) awaits the memoized fetchNodeFacetSources and threads
+// them in via opts.sources.
 /** Map-module specifier for the opencode ESM bundle. */
 export const OPENCODE_BUNDLE_MODULE_NAME = 'opencode-bundle.js';
 /**
@@ -705,12 +706,18 @@ let stdout = "";
 let stderr = "";
 let exitCode = 0;
 let __supervisor = null;
-const __vfsBundle = ${opts.vfsBundle};
-const __vfsManifest = ${opts.vfsManifest};
-const __vfsMetadata = ${opts.vfsMetadata};
+// The process's view of the filesystem: the same store and namespace a node
+// process boots on (vfs/facet-resident-store.ts), in this facet's heap and
+// bounded there. An opencode facet has no storage allowance of the session's
+// ledger to grow a SQLite store under. Bound and booted by __ocBootStore
+// before the opencode bundle is imported; the shims read it through
+// __nimbusResidentBundle.
+let __MODULE_VFS_BUNDLE = ${opts.vfsBundle};
 const __MODULE_VFS_CURSOR = ${opts.vfsCursor};
+${opts.sources.residentStore}
+const __vfsBundle = __nimbusResidentBundle;
 ${VFS_CURSOR_SEED_SOURCE}
-${VFS_WRITE_LEDGER_SOURCE}
+${opts.sources.ledger}
 const __vfsDirs = {};
 const __nimbusDeferProcessExitReport = true;
 // Ledger of in-flight facet I/O the teardown drain must await. The shims push
@@ -739,7 +746,7 @@ class __ProcessExit extends Error {
   constructor(code) { super("process.exit(" + code + ")"); this.code = code; }
 }
 
-${opts.shimsCode}
+${opts.sources.shims}
 
 globalThis.${BUILTINS_GLOBAL} = builtins;
 // Capture workerd's real process.memoryUsage BEFORE the shim process takes over
@@ -1182,9 +1189,33 @@ async function __ocDispatchHttp(request) {
   return globalThis.__nimbusServeHttp(request);
 }
 
+/**
+ * Bind and boot the store, and require its namespace, before any opencode code
+ * runs: every synchronous stat, exists and readdir reads it. Resolves to null,
+ * or to the launch's failure naming why.
+ */
+async function __ocBootStore() {
+  __residentBindInMemory(${ONE_SHOT_STORE_MEMORY_BYTES});
+  __residentSetStorage(undefined, __supervisor);
+  __nsSetCred(cred);
+  __residentSetPlan([]);
+  __residentSetPushRoots([cwd || "/home/user", "/tmp"]);
+  const __booted = await __residentBoot(
+    () => { const __bundle = __MODULE_VFS_BUNDLE; __MODULE_VFS_BUNDLE = null; return __bundle; },
+    __MODULE_VFS_CURSOR,
+    __supervisor,
+  );
+  if (__booted.cursor) {
+    globalThis.__nimbusVfsCursor = { epoch: __booted.cursor.epoch, rev: __booted.cursor.rev };
+  }
+  return __residentRequireNamespace(__supervisor, __booted.failure);
+}
+
 export class NimbusProcess extends __NimbusDurableObject {
   async startProcess() {
     __supervisor = (this.env && this.env.SUPERVISOR) || null;
+    const __bootFailure = await __ocBootStore();
+    if (__bootFailure) throw new Error(__bootFailure);
     // Run the resident lifecycle and hold THIS RPC open until it exits — the
     // same contract the long-running node path uses (its startProcess awaits
     // the resident lifecycle). The open call keeps the caller's stubs live for
@@ -1267,6 +1298,10 @@ async function __ocRunServe() {
 
 async function __ocOneShotFetch(request, workerEnv) {
     __supervisor = (workerEnv && workerEnv.SUPERVISOR) || null;
+    const __bootFailure = await __ocBootStore();
+    if (__bootFailure) {
+      return __ocHostResponse.json({ exitCode: 1, stdout: "", stderr: __bootFailure + "\\n", vfsWrites: {} });
+    }
     try {
       const __ocBundle = await import("${OPENCODE_BUNDLE_MODULE_NAME}");
       if (argv[2] === "${OPENCODE_TREE_SITTER_DIAG_ARG}") {

package/dist/runtime/opentui-wasm-bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opentui-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/opentui-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AASD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAqD1F"}
+{"version":3,"file":"opentui-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/opentui-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAyBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAEpF"}

package/dist/runtime/opentui-wasm-bytes.js

@@ -16,14 +16,26 @@
  * the backend.
  */
 import { OPENTUI_WASM_BUILD_ID, OPENTUI_WASM_ENTRY, OPENTUI_WASM_SHA256, } from '../opentui-wasm-artifact.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
-import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
+import { fetchStagedBytes } from './staged-source.js';
 /**
  * Synthetic L2 cache key for the OpenTUI wasm asset. Build-id-pinned so a
  * same-version rebuild with different bytes lands a fresh entry instead of
  * serving stale content from a warm colo cache.
  */
 const OPENTUI_WASM_L2_KEY = `https://nimbus-cache.invalid${OPENTUI_WASM_ENTRY}?build=${OPENTUI_WASM_BUILD_ID}`;
+const OPENTUI_WASM_ASSET = {
+    path: OPENTUI_WASM_ENTRY,
+    l2Key: OPENTUI_WASM_L2_KEY,
+    sha256: OPENTUI_WASM_SHA256,
+    contentType: 'application/wasm',
+    poisonedCache: 'reject',
+    missingBinding: `Nimbus: the OpenTUI backend requires an env.ASSETS binding (serves ${OPENTUI_WASM_ENTRY})`,
+    fetchFailed: (res) => `OpenTUI wasm asset fetch failed: ${res.status} ${res.statusText} for ` +
+        `${OPENTUI_WASM_ENTRY} — deploy is missing the staged opentui artifact`,
+    integrityFailed: (digest, from) => `OpenTUI wasm integrity check failed: expected ${OPENTUI_WASM_SHA256}, got ` +
+        `${digest} (${from}) — the staged artifact is ` +
+        `corrupt or out of sync with opentui-wasm-artifact.generated.ts`,
+};
 /**
  * Fetch the staged OpenTUI wasm bytes and verify their SHA-256 against the
  * generated digest.
@@ -32,51 +44,6 @@ const OPENTUI_WASM_L2_KEY = `https://nimbus-cache.invalid${OPENTUI_WASM_ENTRY}?b
  * failures are silent — ASSETS is always the source of truth. A non-200 from
  * ASSETS, or a digest mismatch, throws.
  */
-export async function fetchOpenTUIWasmBytes(env) {
-    const caches = globalThis.caches;
-    let bytes = null;
-    try {
-        if (caches?.default) {
-            const hit = await caches.default.match(new Request(OPENTUI_WASM_L2_KEY));
-            if (hit && hit.ok)
-                bytes = await hit.arrayBuffer();
-        }
-    }
-    catch { /* fall through to ASSETS */ }
-    let fromCache = bytes !== null;
-    if (!bytes) {
-        const url = `https://nimbus-internal.invalid${OPENTUI_WASM_ENTRY}`;
-        const res = await env.ASSETS.fetch(new Request(url));
-        try {
-            if (!res.ok) {
-                throw new Error(`OpenTUI wasm asset fetch failed: ${res.status} ${res.statusText} for ` +
-                    `${OPENTUI_WASM_ENTRY} — deploy is missing the staged opentui artifact`);
-            }
-            bytes = await res.arrayBuffer();
-        }
-        finally {
-            disposeRpcResource(res);
-        }
-    }
-    const digest = await sha256Hex(bytes);
-    if (digest !== OPENTUI_WASM_SHA256) {
-        throw new Error(`OpenTUI wasm integrity check failed: expected ${OPENTUI_WASM_SHA256}, got ` +
-            `${digest} (${fromCache ? 'L2 cache' : 'ASSETS'}) — the staged artifact is ` +
-            `corrupt or out of sync with opentui-wasm-artifact.generated.ts`);
-    }
-    if (!fromCache) {
-        try {
-            if (caches?.default) {
-                const writeBack = new Response(new Uint8Array(bytes), {
-                    headers: {
-                        'Content-Type': 'application/wasm',
-                        'Cache-Control': 'public, max-age=31536000, immutable',
-                    },
-                });
-                await caches.default.put(new Request(OPENTUI_WASM_L2_KEY), writeBack);
-            }
-        }
-        catch { /* silent */ }
-    }
-    return bytes;
+export function fetchOpenTUIWasmBytes(env) {
+    return fetchStagedBytes(env, OPENTUI_WASM_ASSET);
 }

package/dist/runtime/package-manager.d.ts

@@ -14,7 +14,6 @@
 import { runtimeCatalogSource, type RuntimeCatalogEnv } from './runtime-catalog.js';
 import type { CredentialedVfs } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
 import type { RuntimeManager } from '@nimbus-sh/core/runtime/runtime-manager.js';
-import type { RuntimeAvailability } from '@nimbus-sh/core/runtime/runtime-package.js';
 import { type RuntimeWarmHook } from '@nimbus-sh/core/runtime/nimbus-command.js';
 import type { MinShellRegistry } from '@nimbus-sh/core/runtime/installed-runtimes.js';
 export { runtimeCatalogSource };
@@ -54,7 +53,6 @@ export declare function ensureRuntimesProgrammatic(deps: {
 }, specs: string[], opts?: {
     force?: boolean;
 }): Promise<RuntimeInstallSummary[]>;
-export declare function listAvailableRuntimes(env: RuntimeCatalogEnv): Promise<RuntimeAvailability[]>;
 /**
  * Command-not-found hints, catalog-driven: a bare name the shell could not
  * resolve is answered with the runtime that provides it, so `python3` hints

package/dist/runtime/package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/runtime/package-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,oBAAoB,EACpB,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,IAAI,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6B/E;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,IAAI,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAMpF;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAElG;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAyChI"}
+{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/runtime/package-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,oBAAoB,EACpB,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,IAAI,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6B/E;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,IAAI,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAMpF;AAID;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAyChI"}

package/dist/runtime/package-manager.js

@@ -59,9 +59,6 @@ export async function ensureRuntimesProgrammatic(deps, specs, opts = {}) {
     }
     return results;
 }
-export async function listAvailableRuntimes(env) {
-    return runtimeCatalogSource(env).list();
-}
 /**
  * Command-not-found hints, catalog-driven: a bare name the shell could not
  * resolve is answered with the runtime that provides it, so `python3` hints

package/dist/runtime/python-repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/python-repl.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+CAA+C,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAMnF,OAAO,EAAe,KAAK,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AActG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC;IACvB,sEAAsE;IACtE,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAgRD,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAIzE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC,GAChF,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"python-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/python-repl.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+CAA+C,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAMnF,OAAO,EAAe,KAAK,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAetG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC;IACvB,sEAAsE;IACtE,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAgRD,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAIzE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC,GAChF,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/runtime/python-repl.js

@@ -1,5 +1,5 @@
 import { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
-import { withHostFilesystem } from '@nimbus-sh/core/shell/execution-fs.js';
+import { withHostView } from '@nimbus-sh/core/runtime/process-files.js';
 import { z } from 'zod/v4';
 import { ReplSession } from './repl-session.js';
 import { sessionUsesSciVariant } from '@nimbus-sh/core/runtime/python-pip.js';
@@ -162,7 +162,7 @@ class PythonReplAdapter {
         }
     }
     async ensurePool() {
-        await withHostFilesystem(this.deps.authority, CRED_KERNEL, (vfs) => this.ensurePoolFrom(vfs));
+        await withHostView(this.deps.authority, CRED_KERNEL, (vfs) => this.ensurePoolFrom(vfs));
     }
     async ensurePoolFrom(vfs) {
         const sciPath = `${this.deps.installRoot}/${CPYTHON_SCI_WASM_REL}`;

package/dist/runtime/repl-session.d.ts

@@ -53,6 +53,16 @@ export type ReplPushResult = {
     kind: 'error';
     stderr: string;
 };
+/** The result of one Node/Bun facet evaluation. */
+export interface ReplFacetResult {
+    stdout: string;
+    stderr: string;
+    incomplete?: boolean;
+    exit?: boolean;
+    exitCode?: number;
+    error?: string;
+}
+export declare function replPushResult(result: ReplFacetResult): ReplPushResult;
 export declare class ReplSession {
     private adapter;
     private detachRepl;

package/dist/runtime/repl-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repl-session.d.ts","sourceRoot":"","sources":["../../src/runtime/repl-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+CAA+C,CAAC;AAI3E;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;mCAC+B;IAC/B,MAAM,IAAI,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C;6DACyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,oFAAoF;IACpF,SAAS,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAiBtC,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,QAAQ,CAA+C;IAE/D,8DAA8D;IAC9D,OAAO,CAAC,OAAO,CAAc;IAC7B,sDAAsD;IACtD,OAAO,CAAC,SAAS,CAAa;IAC9B,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAgB;IAChC,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAkB;IAC9B,mEAAmE;IACnE,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,gBAAgB,CAA0C;IAClE,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,MAAM,CAA8B;IAE5C,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAa;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAUrG;4EACwE;IAClE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;YAuCd,UAAU;IAiBxB;;qCAEiC;YACnB,WAAW;IA0EzB,OAAO,CAAC,aAAa;YAiBP,UAAU;IA0FxB,6CAA6C;IAC7C,OAAO,CAAC,SAAS;IAMjB,mDAAmD;IACnD,OAAO,CAAC,WAAW;IAUnB,gEAAgE;IAChE,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,UAAU;CAwBnB"}
+{"version":3,"file":"repl-session.d.ts","sourceRoot":"","sources":["../../src/runtime/repl-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+CAA+C,CAAC;AAI3E;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;mCAC+B;IAC/B,MAAM,IAAI,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C;6DACyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,oFAAoF;IACpF,SAAS,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAItE;AAiBD,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,QAAQ,CAA+C;IAE/D,8DAA8D;IAC9D,OAAO,CAAC,OAAO,CAAc;IAC7B,sDAAsD;IACtD,OAAO,CAAC,SAAS,CAAa;IAC9B,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAgB;IAChC,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAkB;IAC9B,mEAAmE;IACnE,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,gBAAgB,CAA0C;IAClE,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,MAAM,CAA8B;IAE5C,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAa;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAUrG;4EACwE;IAClE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;YAuCd,UAAU;IAiBxB;;qCAEiC;YACnB,WAAW;IA0EzB,OAAO,CAAC,aAAa;YAiBP,UAAU;IA0FxB,6CAA6C;IAC7C,OAAO,CAAC,SAAS;IAMjB,mDAAmD;IACnD,OAAO,CAAC,WAAW;IAUnB,gEAAgE;IAChE,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,UAAU;CAwBnB"}

package/dist/runtime/repl-session.js

@@ -13,6 +13,13 @@
  */
 import { errorText } from '@nimbus-sh/core/_shared/error-text.js';
 import { normalizeTerminalNewlines } from '@nimbus-sh/core/_shared/terminal.js';
+export function replPushResult(result) {
+    if (result.exit)
+        return { kind: 'exit', exitCode: result.exitCode || 0, stdout: result.stdout, stderr: result.stderr };
+    if (result.incomplete)
+        return { kind: 'incomplete' };
+    return { kind: 'output', stdout: result.stdout || '', stderr: result.stderr || '' };
+}
 export class ReplSession {
     adapter;
     detachRepl = null;

package/dist/runtime/ruby-repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruby-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,EAAe,KAAK,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAGtG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,qEAAqE;IACrE,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;CACrB;AA8MD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE"}
+{"version":3,"file":"ruby-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,EAAe,KAAK,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAItG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,qEAAqE;IACrE,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;CACrB;AA8MD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE"}

package/dist/runtime/ruby-repl.js

@@ -27,7 +27,7 @@
 import { ReplSession } from './repl-session.js';
 import { buildRubyPreamble } from '@nimbus-sh/core/runtime/ruby-runner.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { withHostFilesystem } from '@nimbus-sh/core/shell/execution-fs.js';
+import { withHostView } from '@nimbus-sh/core/runtime/process-files.js';
 class RubyReplAdapter {
     pool = null;
     deps;
@@ -147,7 +147,7 @@ class RubyReplAdapter {
             return;
         const { installRoot, facetMgr } = this.deps;
         const wasmPath = `${installRoot}/share/ruby/ruby+stdlib.wasm`;
-        this.wasmBytesAB = toAB(await withHostFilesystem(this.deps.authority, CRED_KERNEL, async (vfs) => {
+        this.wasmBytesAB = toAB(await withHostView(this.deps.authority, CRED_KERNEL, async (vfs) => {
             if (!(await vfs.exists(wasmPath))) {
                 throw new Error(`ruby+stdlib.wasm missing at ${wasmPath} (run 'nimbus install ruby')`);
             }

package/dist/runtime/ruby-resident.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruby-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAezD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,iBAAiB,CAgF3E;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAsKrE"}
+{"version":3,"file":"ruby-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAezD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,iBAAiB,CA+D3E;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAqLrE"}

package/dist/runtime/ruby-resident.js

@@ -13,7 +13,7 @@ import { z } from 'zod';
 import { buildRubyPreamble, normalizeRubyFacetResult, } from '@nimbus-sh/core/runtime/ruby-runner.js';
 import { VIRTUAL_SOCKET_KERNEL_SRC } from '@nimbus-sh/core/runtime/virtual-socket-kernel.generated.js';
 const RubySocketProcessBootResponseSchema = z.object({
-    state: z.string().optional(),
+    state: z.enum(['listening', 'exited']),
     port: z.number().optional(),
     stdout: z.string().optional(),
     stderr: z.string().optional(),
@@ -35,7 +35,11 @@ export function rubyResidentStart(facetMgr) {
             // value may carry — so whichever host runs this process reads it itself.
             vfsWasmModules: { 'ruby+stdlib.wasm': args.wasmVfsPath },
             startArgs: args.startArgs,
+            foreground: { signal: args.signal, write: args.write },
         }).catch(() => null);
+        // Interrupted while it waited to bind or exit: the process is gone with it.
+        if (args.signal.aborted)
+            return { exitCode: 130, stdout: '', stderr: '' };
         if (!spawned) {
             return { exitCode: 1, stdout: '', stderr: 'ruby process boot failed\n' };
         }
@@ -69,34 +73,16 @@ export function rubyResidentStart(facetMgr) {
                 port: routeablePort,
             };
         }
-        const reservedPorts = await facetMgr.waitForRouteablePorts(spawned.pid);
-        if (reservedPorts.length > 0) {
-            return {
-                exitCode: 0,
-                stdout: `${boot.stdout || ''}\x1b[2m[started (long-running): pid=${spawned.pid} cmd="${command}" port=${reservedPorts[0]}]\x1b[0m\n`,
-                stderr: boot.stderr || '',
-                spawnedPid: spawned.pid,
-                port: reservedPorts[0],
-            };
-        }
-        if (boot.state === 'exited') {
-            const result = normalizeRubyFacetResult(boot.result) || {
-                exitCode: 1,
-                stdout: '',
-                stderr: 'ruby process returned an invalid exit payload\n',
-            };
-            facetMgr.finishProcess(spawned.pid, result.exitCode, result.stderr || 'ruby process exited');
-            return {
-                exitCode: result.exitCode,
-                stdout: result.stdout,
-                stderr: result.stderr || result.error || '',
-            };
-        }
+        const result = normalizeRubyFacetResult(boot.result) || {
+            exitCode: 1,
+            stdout: '',
+            stderr: 'ruby process returned an invalid exit payload\n',
+        };
+        facetMgr.finishProcess(spawned.pid, result.exitCode, result.stderr || 'ruby process exited');
         return {
-            exitCode: 0,
-            stdout: `${boot.stdout || ''}\x1b[2m[started (long-running): pid=${spawned.pid} cmd="${command}"]\x1b[0m\n`,
-            stderr: boot.stderr || '',
-            spawnedPid: spawned.pid,
+            exitCode: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr || result.error || '',
         };
     };
 }
@@ -205,6 +191,19 @@ export function buildRubySocketProcessWorker(preamble) {
         '  return true;',
         '};',
         '',
+        // What the process writes goes out as it is written: to the command that
+        // launched it while that command waits, to the process log after. One
+        // write at a time, in order; the runner's own markers are not output.
+        'globalThis.__nimbusRubyEmitChain = globalThis.__nimbusRubyEmitChain || Promise.resolve();',
+        'globalThis.__nimbusRubyEmit = function __nimbusRubyEmit(stream, text) {',
+        '  const supervisor = globalThis.__nimbusRubySupervisor;',
+        '  if (!supervisor) return;',
+        '  const clean = String(text).replace(/__NIMBUS_RESUMED_(true|false)_[^\\n]*\\n?/g, "").replace(/__NIMBUS_RUBY_EXIT_-?\\d+\\n?/g, "");',
+        '  if (!clean) return;',
+        '  const bytes = new TextEncoder().encode(clean);',
+        '  globalThis.__nimbusRubyEmitChain = globalThis.__nimbusRubyEmitChain.then(() => supervisor[stream](bytes)).catch(() => {});',
+        '};',
+        '',
         'async function __nimbusStartRubyProcess(args) {',
         '  if (!globalThis.__nimbusRubyProcessPromise) {',
         '    const stdoutStart = (globalThis.__nimbusRubyStdout || []).length;',
@@ -223,18 +222,20 @@ export function buildRubySocketProcessWorker(preamble) {
         '    });',
         '  }',
         '  const started = globalThis.__nimbusRubyProcessOutputStart || { stdoutStart: 0, stderrStart: 0 };',
-        '  const listen = globalThis.__nimbusVirtualSockets.waitForListen(10_000).then((port) => ({ state: port ? "listening" : "pending", port }));',
+        // No deadline: a server reports once it binds, however long its requires take.
+        '  const listen = globalThis.__nimbusVirtualSockets.waitForListen().then((port) => ({ state: "listening", port }));',
         '  const exit = globalThis.__nimbusRubyProcessPromise.then((result) => ({ state: "exited", result }));',
         '  const first = await Promise.race([listen, exit]);',
         '  const registrations = globalThis.__nimbusVirtualPortRegistrationPromises || [];',
         '  if (registrations.length > 0) await Promise.allSettled(registrations.splice(0));',
-        '  const stdout = (globalThis.__nimbusRubyStdout || []).slice(started.stdoutStart).join("");',
-        '  const stderr = (globalThis.__nimbusRubyStderr || []).slice(started.stderrStart).join("");',
+        // Streamed already, so the answer carries none of it.
+        '  await globalThis.__nimbusRubyEmitChain;',
+        '  const streamed = !!globalThis.__nimbusRubySupervisor;',
+        '  const stdout = streamed ? "" : (globalThis.__nimbusRubyStdout || []).slice(started.stdoutStart).join("");',
+        '  const stderr = streamed ? "" : (globalThis.__nimbusRubyStderr || []).slice(started.stderrStart).join("");',
         '  if (first.state === "listening") return { state: "listening", port: first.port, stdout, stderr };',
-        '  if (first.state === "exited") return { state: "exited", result: first.result, stdout, stderr };',
-        '  const currentPort = globalThis.__nimbusVirtualSockets.firstListeningPort();',
-        '  if (currentPort) return { state: "listening", port: currentPort, stdout, stderr };',
-        '  return { state: "running", stdout, stderr };',
+        '  const result = streamed ? { ...first.result, stdout: "", stderr: "" } : first.result;',
+        '  return { state: "exited", result, stdout, stderr };',
         '}',
         '',
         // Only adopt a real binding: routed handleHttpRequest/fetch hops resolve

package/dist/runtime/runtime-catalog.d.ts

@@ -53,6 +53,7 @@ type R2BucketLike = {
     get(key: string): Promise<{
         arrayBuffer(): Promise<ArrayBuffer>;
         text(): Promise<string>;
+        readonly body: ReadableStream<Uint8Array>;
     } | null>;
 } | null | undefined;
 /** Minimal env shape this module consumes. */
@@ -95,15 +96,21 @@ export declare function fetchCatalog(env: RuntimeCatalogEnv): Promise<RuntimeCat
  */
 export declare function fetchManifest(env: RuntimeCatalogEnv, entry: CatalogVersionEntry): Promise<RuntimeManifest>;
 /**
- * Fetch the blob a manifest file entry points at, verified against the
- * digest that same entry carries.
+ * Stream the blob a manifest file entry points at, verified against the
+ * digest that same entry carries: from the colo cache when it has it, else
+ * from R2, read once either way. The stream errors at its end, rather than
+ * closing, with a {@link RuntimeBlobDigestMismatch} when its bytes do not
+ * hash to the digest; a colo-cache entry that fails is evicted and
+ * distrusted first, so the installer's second read of that blob comes from
+ * R2 whatever the cache holds by then. The installer commits
+ * a blob only after that clean close, so no step holds a blob whole.
  *
  * The digest is not optional and does not travel separately from the key:
  * a `ManifestFile` always has both, and it is the only thing this takes.
  * Blobs are interpreters, so an unverified read here is arbitrary code
  * execution in whichever session installs it.
  */
-export declare function fetchBlob(env: RuntimeCatalogEnv, file: ManifestFile): Promise<Uint8Array>;
+export declare function fetchBlob(env: RuntimeCatalogEnv, file: ManifestFile): Promise<ReadableStream<Uint8Array>>;
 export declare function runtimeAbiForCatalogName(name: string): RuntimePackageAbi;
 /**
  * The R2 catalog as a core `RuntimeSource` — the worker adapter half of the

package/dist/runtime/runtime-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-catalog.d.ts","sourceRoot":"","sources":["../../src/runtime/runtime-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yCAAyC,CAAC;AAEjD,2CAA2C;AAC3C,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KACzB,GAAG,IAAI,CAAC,CAAC;CACX,GAAG,IAAI,GAAG,SAAS,CAAC;AAErB,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,CAAC,EAAE,YAAY,CAAC;CACrC;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB;2EACuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC/C;AAiBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAElE;AA4DD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBlF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAID,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,aAAa,CAwE1E"}
+{"version":3,"file":"runtime-catalog.d.ts","sourceRoot":"","sources":["../../src/runtime/runtime-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yCAAyC,CAAC;AAEjD,2CAA2C;AAC3C,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;KAC3C,GAAG,IAAI,CAAC,CAAC;CACX,GAAG,IAAI,GAAG,SAAS,CAAC;AAErB,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,CAAC,EAAE,YAAY,CAAC;CACrC;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB;2EACuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC/C;AAiBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAElE;AA4DD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBlF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CA8BrC;AA2DD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,aAAa,CAwE1E"}