@nimbus-sh/worker 0.3.0 → 0.5.0

package/dist/session/hibernation.js

@@ -22,10 +22,10 @@
  *     reason dispatcher with this session's handlers registered.
  *   - flushOnClose(host) — synchronous flush on ws close.
  *
- * The alarm multiplexer itself (reason map, scheduleAlarm, the per-instance
- * chain) and maybeBumpIsolateGen are fabric machinery —
- * `@nimbus-sh/fabric/alarms.js`; this module registers the session's reasons
- * ('w9-flush' | 'log-janitor' | 'resident-launch') on top of it.
+ * The timer multiplexer itself (reason map, schedule, the per-instance
+ * chain) is fabric machinery — `@nimbus-sh/fabric/timers.js`; this module
+ * registers the session's reasons ('w9-flush' | 'log-janitor' |
+ * 'resident-launch') on top of it.
  *
  * **`ctx` taken as a separate arg from `host`** because the parent
  * `CloudflareDurableObject` class declares `ctx` as `protected`, which
@@ -39,7 +39,7 @@
  * wireProcessLogPersist again.
  */
 import { configureWsHibernation } from '@nimbus-sh/fabric/ws-hibernation-config.js';
-import { dispatchAlarm as dispatchAlarmReasons, scheduleAlarm, } from '@nimbus-sh/fabric/alarms.js';
+import { timers } from '@nimbus-sh/fabric/timers.js';
 import { SESSION_DESTROYED_KEY, W9_FLUSH_DEBOUNCE_MS } from './keys.js';
 /**
  * Run at DO ctor time. Returns the result for the class to assign to
@@ -216,11 +216,11 @@ export function ensureLogJanitor(host, ctx) {
     if (host._w1SessionDestroyed)
         return;
     // Optimistic flag (dedupes same-tick appends), CONFIRMED by the schedule
-    // outcome: scheduleAlarm swallows storage errors, and a failure with the
+    // outcome: timers.schedule swallows storage errors, and a failure with the
     // flag left set would mean no alarm AND nothing ever re-arming until the
     // instance recycles.
     host._w1JanitorArmed = true;
-    void scheduleAlarm(host, ctx, 'log-janitor', Date.now() + 60_000).then((ok) => {
+    void timers(host, ctx).schedule('log-janitor', Date.now() + 60_000).then((ok) => {
         if (!ok)
             host._w1JanitorArmed = false;
     });
@@ -249,7 +249,7 @@ export function ensureHibSchema(host, ctx) {
 /**
  * W9: ensure the alarm is set for the next flush window. Cheap to
  * call repeatedly — we only schedule the in-isolate flush timer if
- * it isn't already set. The persistent alarm goes through scheduleAlarm
+ * it isn't already set. The persistent alarm goes through timers.schedule
  * so it coordinates with W1's log-janitor sweep.
  */
 export function scheduleHibFlush(host, ctx) {
@@ -271,10 +271,10 @@ export function scheduleHibFlush(host, ctx) {
     }, W9_FLUSH_DEBOUNCE_MS);
     // Persistent alarm: fires post-hibernation if the in-isolate timer
     // didn't get a chance to run (DO evicted under memory pressure
-    // before the 250ms debounce expired). Coordinated via scheduleAlarm
+    // before the 250ms debounce expired). Coordinated via timers.schedule
     // so W1's log-janitor doesn't clobber it (or vice-versa).
-    // Fire-and-forget — scheduleAlarm is fail-soft.
-    void scheduleAlarm(host, ctx, 'w9-flush', Date.now() + W9_FLUSH_DEBOUNCE_MS * 4);
+    // Fire-and-forget — timers.schedule is fail-soft.
+    void timers(host, ctx).schedule('w9-flush', Date.now() + W9_FLUSH_DEBOUNCE_MS * 4);
 }
 /**
  * W1: this session's alarm() handler body — the fabric's multi-reason
@@ -288,8 +288,8 @@ export function scheduleHibFlush(host, ctx) {
  * caller (typically `(pid) => !host.processes.get(pid)`). Decoupled
  * so HibHost doesn't need to import ProcessTable.
  */
-export function dispatchAlarm(host, ctx, janitorOrphanCheck, pumpResidentLaunches) {
-    return dispatchAlarmReasons(host, ctx, {
+export function dispatchAlarm(host, ctx, janitorOrphanCheck, pumpResidentLaunches, alarmInfo) {
+    return timers(host, ctx).dispatch({
         'w9-flush': () => {
             host.processes.flushLogs();
         },
@@ -322,14 +322,14 @@ export function dispatchAlarm(host, ctx, janitorOrphanCheck, pumpResidentLaunche
         // Legacy path: pre-W1 deploys had no map. dispatchAlarm was called
         // with no map and unconditionally ran the log flush. Preserve
         // that on a missing map (one-time post-deploy, then the map is
-        // populated by the next scheduleHibFlush / scheduleAlarm call).
+        // populated by the next scheduleHibFlush / timers.schedule call).
         try {
             host.processes.flushLogs();
         }
         catch (e) {
             console.warn('[nimbus/W9] legacy flush threw:', e?.message);
         }
-    });
+    }, alarmInfo);
 }
 /**
  * W9: synchronous flush of the process-log ring on session close.

package/dist/session/init-phases.d.ts

@@ -32,7 +32,8 @@
  * preserved — old probes still see it. New phase entries are
  * additional ring entries, not replacements.
  */
-import { type SessionState } from '@nimbus-sh/core/observability/oom-discriminator.js';
+import { type SessionState } from '@nimbus-sh/platform/oom-discriminator.js';
+import { type AutoResponseHost } from './shell-socket.js';
 /**
  * Set the current phase + record a transition. Fail-soft on the
  * observability call; the phase update on `self` is direct and
@@ -40,39 +41,32 @@ import { type SessionState } from '@nimbus-sh/core/observability/oom-discriminat
  */
 export declare function setPhase(self: {
     _b4Phase: SessionState | null;
-    _isolateGen?: number;
+    ctx?: unknown;
 }, toState: SessionState, trigger: string): void;
+type WsUpgradeDecision = 'warm-join' | 'conflict' | 'cold';
 /**
- * [B'.5] Identify the original phase-based warm-rejoin case. The /ws
- * upgrade classifier below also recognizes headless sessions whose
- * lifecycle phase does not describe a real terminal attachment.
+ * Decide what a /ws upgrade should do with the session it lands on.
  *
- * Conditions for warm rejoin:
- *   1. Phase = 'drained' (a wsClose / wsError fired since last init).
- *   2. Kernel + Shell + Terminal are still alive in-memory (the
- *      [B'.5] change to wsClose stopped nulling them).
- *   3. Same isolate (no DO eviction since the close).
+ *   - cold:      no session to join. Either nothing was ever built, or a
+ *                previous teardown left the object half-built. A Shell
+ *                without its Kernel or its Terminal serves nobody, and
+ *                nothing else rebuilds one, so the upgrade does.
+ *   - conflict:  another browser terminal holds this session. The caller
+ *                answers 409, which is what stops two tabs from driving
+ *                one shell. See `shell-socket.ts` for what proves that a
+ *                socket still has a peer on it.
+ *   - warm-join: the session is built and unattended. Skip the rebuild
+ *                and hand the live Shell to the incoming socket.
  *
- */
-export declare function isWarmRejoin(self: {
-    _b4Phase: SessionState | null;
-    shell: any;
-    terminal: any;
-    kernel: any;
-}): boolean;
-type WsUpgradeDecision = 'warm-join' | 'conflict' | 'cold';
-/**
- * Classify a shell WebSocket upgrade from the actual attachment state.
- * A non-null Shell can belong to a headless programmatic boot, so only an
- * open socket tagged as `shell` proves that another browser terminal is
- * currently attached.
+ * The caller classifies BEFORE it accepts the incoming socket, so the
+ * upgrade cannot count itself as the incumbent.
  */
 export declare function classifyWsUpgrade(self: {
-    _b4Phase: SessionState | null;
     shell: unknown;
     terminal: unknown;
     kernel: unknown;
-}, sockets: readonly WebSocket[]): WsUpgradeDecision;
+    ctx?: AutoResponseHost;
+}, sockets: readonly WebSocket[], now?: number): WsUpgradeDecision;
 /**
  * [B'.5] Run the warm-rejoin path. Skips Phase B (kernel + shell are
  * already built and alive in-memory). Phase R loads any state that
@@ -93,7 +87,6 @@ export declare function joinExistingSession(self: {
         write(s: string): void;
     };
     _b4Phase: SessionState | null;
-    _isolateGen?: number;
     _b4WarmJoinCount: number;
 }, ws: WebSocket, appendScrollback: (ctx: any, data: string, atMs: number) => void, loadScrollback: (ctx: any) => string): void;
 export {};

package/dist/session/init-phases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-phases.d.ts","sourceRoot":"","sources":["../../src/session/init-phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,oDAAoD,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE;IAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,IAAI,CAcN;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CACxC,GAAG,OAAO,CAKV;AAED,KAAK,iBAAiB,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,iBAAiB,CAmBnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpG,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,EACD,EAAE,EAAE,SAAS,EACb,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,EAChE,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GACnC,IAAI,CAsCN"}
+{"version":3,"file":"init-phases.d.ts","sourceRoot":"","sources":["../../src/session/init-phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAElG,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE;IAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EACtD,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,IAAI,CAcN;AAED,KAAK,iBAAiB,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,iBAAiB,CAG7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpG,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,EACD,EAAE,EAAE,SAAS,EACb,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,EAChE,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GACnC,IAAI,CAsCN"}

package/dist/session/init-phases.js

@@ -32,7 +32,9 @@
  * preserved — old probes still see it. New phase entries are
  * additional ring entries, not replacements.
  */
-import { recordRecoveryEvent } from '@nimbus-sh/core/observability/oom-discriminator.js';
+import { recordRecoveryEvent } from '@nimbus-sh/platform/oom-discriminator.js';
+import { generation } from '@nimbus-sh/fabric/generation.js';
+import { hasLiveShellOwner } from './shell-socket.js';
 /**
  * Set the current phase + record a transition. Fail-soft on the
  * observability call; the phase update on `self` is direct and
@@ -47,7 +49,7 @@ export function setPhase(self, toState, trigger) {
             fromState,
             toState,
             trigger,
-            isolateGen: self._isolateGen ?? 0,
+            isolateGen: generation(self.ctx),
             dataLoss: false,
             snapshotKeysRehydrated: 0,
         });
@@ -55,51 +57,26 @@ export function setPhase(self, toState, trigger) {
     catch { /* observability is non-critical */ }
 }
 /**
- * [B'.5] Identify the original phase-based warm-rejoin case. The /ws
- * upgrade classifier below also recognizes headless sessions whose
- * lifecycle phase does not describe a real terminal attachment.
+ * Decide what a /ws upgrade should do with the session it lands on.
  *
- * Conditions for warm rejoin:
- *   1. Phase = 'drained' (a wsClose / wsError fired since last init).
- *   2. Kernel + Shell + Terminal are still alive in-memory (the
- *      [B'.5] change to wsClose stopped nulling them).
- *   3. Same isolate (no DO eviction since the close).
+ *   - cold:      no session to join. Either nothing was ever built, or a
+ *                previous teardown left the object half-built. A Shell
+ *                without its Kernel or its Terminal serves nobody, and
+ *                nothing else rebuilds one, so the upgrade does.
+ *   - conflict:  another browser terminal holds this session. The caller
+ *                answers 409, which is what stops two tabs from driving
+ *                one shell. See `shell-socket.ts` for what proves that a
+ *                socket still has a peer on it.
+ *   - warm-join: the session is built and unattended. Skip the rebuild
+ *                and hand the live Shell to the incoming socket.
  *
+ * The caller classifies BEFORE it accepts the incoming socket, so the
+ * upgrade cannot count itself as the incumbent.
  */
-export function isWarmRejoin(self) {
-    return self._b4Phase === 'drained'
-        && self.shell != null
-        && self.terminal != null
-        && self.kernel != null;
-}
-/**
- * Classify a shell WebSocket upgrade from the actual attachment state.
- * A non-null Shell can belong to a headless programmatic boot, so only an
- * open socket tagged as `shell` proves that another browser terminal is
- * currently attached.
- */
-export function classifyWsUpgrade(self, sockets) {
-    if (isWarmRejoin(self))
-        return 'warm-join';
-    if (self.shell == null)
+export function classifyWsUpgrade(self, sockets, now = Date.now()) {
+    if (self.shell == null || self.terminal == null || self.kernel == null)
         return 'cold';
-    if (self.terminal == null || self.kernel == null)
-        return 'conflict';
-    const hasOpenShellSocket = sockets.some((socket) => {
-        if (socket.readyState !== WebSocket.OPEN)
-            return false;
-        try {
-            const attachment = socket.deserializeAttachment();
-            return typeof attachment === 'object'
-                && attachment !== null
-                && 'kind' in attachment
-                && attachment.kind === 'shell';
-        }
-        catch {
-            return false;
-        }
-    });
-    return hasOpenShellSocket ? 'conflict' : 'warm-join';
+    return hasLiveShellOwner(self.ctx, sockets, now) ? 'conflict' : 'warm-join';
 }
 /**
  * [B'.5] Run the warm-rejoin path. Skips Phase B (kernel + shell are

package/dist/session/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/session/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA8EH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;GAQG;AACH,KAAK,QAAQ,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC;AAa3E,wBAAsB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAosF9E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/session/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA8EH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;GAQG;AACH,KAAK,QAAQ,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC;AAa3E,wBAAsB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAysF9E"}

package/dist/session/init.js

@@ -58,7 +58,6 @@ import { installNpmBinFallbackResolver } from '../shell/npm-bin-entrypoints.js';
 import { parseNpmInstallInvocation } from '../npm/install-args.js';
 import { npmLogEnabled } from '../npm/npm-log.js';
 import { materializeNpmBinShims } from '../npm/bin-links.js';
-import { registerGitCommands } from '../git/commands.js';
 import { makeNimbusVerbHandler, createRuntimeCommandHintResolver, } from '../runtime/package-manager.js';
 import { listInstalledRuntimes, rehydrateInstalledRuntimes, registerRunnerFactory, } from '@nimbus-sh/core/runtime/installed-runtimes.js';
 // Runtime factories (clang/python/ruby/bash/wasm) are imported lazily at
@@ -68,10 +67,11 @@ import { listInstalledRuntimes, rehydrateInstalledRuntimes, registerRunnerFactor
 // one-time Worker Startup Time paid on every fresh-isolate cold run.
 import { hasSeededProject, SEED_PROJECT_DIR } from '@nimbus-sh/core/vfs/seed-project.js';
 import { notifyTerminalEvent } from '../runtime/process-logs-api.js';
+import { generation } from '@nimbus-sh/fabric/generation.js';
 import { stripAnsi } from '@nimbus-sh/core/runtime/process-logs.js';
 import { DEFAULT_MOUNT_POINTS, NODE_VERSION, } from '@nimbus-sh/core/constants.js';
 import { ensureSessionStateSchema, loadShellState, stampHydratedAt, countSessionStateKeys, loadKernelMounts, persistKernelMounts, appendScrollback, loadScrollback, } from './state-store.js';
-import { recordRecoveryEvent } from '@nimbus-sh/core/observability/oom-discriminator.js';
+import { recordRecoveryEvent } from '@nimbus-sh/platform/oom-discriminator.js';
 import { sessionAiEnv } from './ai.js';
 import { routeSessionLoopback } from './loopback.js';
 import { setPhase } from './init-phases.js';
@@ -166,7 +166,7 @@ export async function initSession(self, ws) {
             + 'running was lost with the old one — re-run it if it had not finished.\x1b[0m\r\n');
     }
     // A reset that killed a resident launch left its journal row behind
-    // (fabric's ResidentLaunchJournal.recoverInterrupted). The alarm the dying
+    // (fabric's FencedWork.recoverInterrupted). The alarm the dying
     // instance was using for launch turns is NOT a trigger recovery can rely
     // on — measured live, a launch killed early in its first chunks rolls the
     // alarm-map put back with the rest of the dying turn, so the replacement
@@ -453,8 +453,13 @@ export async function initSession(self, ws) {
     }));
     // ── Git integration (isomorphic-git) ──
     // ctx + env are passed for clone/fetch/pull which run in a facet to avoid
-    // exhausting the supervisor DO's CPU budget on large repos.
-    registerGitCommands(registry, sqliteFs, self.ctx, self.env);
+    // exhausting the supervisor DO's CPU budget on large repos. The command
+    // module (+ its ~106 KB network-facet dependency) is loaded lazily on the
+    // first `git` invocation so it stays out of the cold script-eval graph.
+    registry.register('git', async (ctx) => {
+        const { runGitCommand } = await import('../git/commands.js');
+        return runGitCommand(ctx, sqliteFs, self.ctx, self.env);
+    });
     // ── runtime package manager: `nimbus install` package manager + runner registry.
     //
     // 1. Register the clang-runner factory FIRST so the rehydration step
@@ -481,7 +486,7 @@ export async function initSession(self, ws) {
     registerRunnerFactory('cpython-runner', (manifest, installRoot, binName, binKind) => async function pythonReplOrOneShot(ctx) {
         const argv = ctx.args || [];
         // No args at all → REPL session. Hand off to runPythonRepl
-        // which builds its own LoaderPool (separate from the
+        // which builds its own IsolatePool (separate from the
         // one-shot dispatch's pool) and drives a ReplSession.
         if (argv.length === 0 && self.terminal) {
             const { runPythonRepl } = await import('../runtime/python-repl.js');
@@ -688,7 +693,7 @@ export async function initSession(self, ws) {
             getEsbuild: () => {
                 if (!self.esbuildService) {
                     self.ensureSqliteFs();
-                    self.esbuildService = new EsbuildService(self.sqliteFs);
+                    self.esbuildService = new EsbuildService(kernelFs);
                 }
                 return self.esbuildService;
             },
@@ -837,7 +842,7 @@ export async function initSession(self, ws) {
             getEsbuild: () => {
                 if (!self.esbuildService) {
                     self.ensureSqliteFs();
-                    self.esbuildService = new EsbuildService(self.sqliteFs);
+                    self.esbuildService = new EsbuildService(kernelFs);
                 }
                 return self.esbuildService;
             },
@@ -885,7 +890,7 @@ export async function initSession(self, ws) {
                     getEsbuild: () => {
                         if (!self.esbuildService) {
                             self.ensureSqliteFs();
-                            self.esbuildService = new EsbuildService(self.sqliteFs);
+                            self.esbuildService = new EsbuildService(kernelFs);
                         }
                         return self.esbuildService;
                     },
@@ -955,7 +960,7 @@ export async function initSession(self, ws) {
         // Lazy-init esbuild service
         if (!self.esbuildService) {
             self.ensureSqliteFs();
-            self.esbuildService = new EsbuildService(self.sqliteFs);
+            self.esbuildService = new EsbuildService(kernelFs);
         }
         // Parse flags
         const flags = {};
@@ -1090,7 +1095,7 @@ export async function initSession(self, ws) {
                     // Transform TS to JS
                     if (cfgName.endsWith('.ts')) {
                         if (!self.esbuildService)
-                            self.esbuildService = new EsbuildService(self.sqliteFs);
+                            self.esbuildService = new EsbuildService(kernelFs);
                         const t = await self.esbuildService.transform(cfgCode, { loader: 'ts', format: 'esm' });
                         cfgCode = t.code;
                     }
@@ -1105,7 +1110,7 @@ export async function initSession(self, ws) {
         // ── vite build ──
         if (args[0] === 'build') {
             if (!self.esbuildService)
-                self.esbuildService = new EsbuildService(self.sqliteFs);
+                self.esbuildService = new EsbuildService(kernelFs);
             const htmlPath = cwd + '/index.html';
             let entryPoint = cwd + '/src/main.tsx';
             let origHtml = '';
@@ -1221,7 +1226,7 @@ export async function initSession(self, ws) {
             }
             // Start vite on the dist directory
             if (!self.esbuildService)
-                self.esbuildService = new EsbuildService(self.sqliteFs);
+                self.esbuildService = new EsbuildService(kernelFs);
             if (self.viteDevServer?.isRunning)
                 self.viteDevServer.stop();
             const previewBasePath = self.viteBasePath;
@@ -1394,7 +1399,7 @@ export async function initSession(self, ws) {
             }
         }
         if (!self.esbuildService)
-            self.esbuildService = new EsbuildService(self.sqliteFs);
+            self.esbuildService = new EsbuildService(kernelFs);
         const previewBasePath = self.viteBasePath;
         const viteDefine = viteConfig.define;
         // Vite dev servers are represented as long-running process-table
@@ -1562,7 +1567,7 @@ export async function initSession(self, ws) {
         // Lazy-init esbuild
         if (!self.esbuildService) {
             self.ensureSqliteFs();
-            self.esbuildService = new EsbuildService(self.sqliteFs);
+            self.esbuildService = new EsbuildService(kernelFs);
         }
         // Parse --root flag; default to the shell cwd so `npm run dev` from
         // a project directory picks up that project's wrangler.jsonc.
@@ -1665,7 +1670,7 @@ export async function initSession(self, ws) {
             kernelFs.writeFile(pkgJsonPath, '{"name":"project","version":"1.0.0","dependencies":{}}\n');
         }
         ctx.stdout.write('\x1b[36mNimbus npm v2 (batched writes)\x1b[0m\n');
-        self.ensureNpmInstaller((msg) => {
+        await self.ensureNpmInstaller((msg) => {
             ctx.stdout.write('[npm] ' + msg + '\n');
         });
         const result = await self.npmInstaller.install(cwd, { packages, pid: ctx.pid });
@@ -2163,7 +2168,7 @@ export async function initSession(self, ws) {
                 ? `${explicitPkgs.length} packages`
                 : 'dependencies from package.json';
             ctx.stdout.write(`\x1b[36mInstalling ${pkgLabel} (npm v2 — batched writes)...\x1b[0m\n`);
-            self.ensureNpmInstaller((msg) => {
+            await self.ensureNpmInstaller((msg) => {
                 ctx.stdout.write('[npm] ' + msg + '\n');
             });
             // `--loglevel` selects npm's own log protocol on stderr, where npm
@@ -2332,7 +2337,7 @@ export async function initSession(self, ws) {
         }
         // Nimbus-native npx install + run path. Routes package installation
         // through NpmInstaller's full-packument resolver.
-        self.ensureNpmInstaller((msg) => ctx.stdout.write('[npm] ' + msg + '\n'));
+        await self.ensureNpmInstaller((msg) => ctx.stdout.write('[npm] ' + msg + '\n'));
         self.ensureSqliteFs();
         const installer = self.npmInstaller;
         const resolveResult = await resolveNpxBinary(installer, self.sqliteFs.as(requireVfsCred('cred' in ctx ? ctx.cred : undefined, 'npx')), ctx.cwd || '/home/user', npxArgs, (msg) => ctx.stdout.write(msg + '\n'), ctx.pid);
@@ -2705,7 +2710,7 @@ export async function initSession(self, ws) {
                 fromState: fromState,
                 toState: 'hydrated',
                 trigger: 'init-session',
-                isolateGen: self._isolateGen,
+                isolateGen: generation(self.ctx),
                 dataLoss: false,
                 snapshotKeysRehydrated: snapshotKeys,
             });

package/dist/session/keys.d.ts

@@ -51,6 +51,14 @@ export declare const ATTACH_BOOTSTRAP_JTI_KEY_PREFIX = "attach-bootstrap-jti:";
  * these rows.
  */
 export declare const PORT_CAPABILITY_KEY_PREFIX = "nimbus_preview_capability:";
+/**
+ * Prefix for a durable application's facet-slot row, keyed by owner.
+ * `durable-slot:next` and `durable-slot:free` under the same prefix are the
+ * allocator's counter and free list; `durable-slot:<owner>` pins the owner to
+ * its `app-slot-<n>` facet name for the application's whole life. Owned by
+ * `facets/durable-slots.ts`, the only module that reads or writes these rows.
+ */
+export declare const DURABLE_SLOT_KEY_PREFIX = "durable-slot:";
 /**
  * Prefix for a named programmatic shell's durable cwd+env, keyed by shell id.
  * One row per id the embedder has actually used; bounded by the embedder's own

package/dist/session/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/session/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH;2EAC2E;AAC3E,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;yDAEyD;AACzD,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD;0DAC0D;AAC1D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;uBAEuB;AACvB,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;4EAG4E;AAC5E,eAAO,MAAM,+BAA+B,0BAA0B,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/session/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;2EAC2E;AAC3E,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;yDAEyD;AACzD,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD;0DAC0D;AAC1D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;uBAEuB;AACvB,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;4EAG4E;AAC5E,eAAO,MAAM,+BAA+B,0BAA0B,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC"}

package/dist/session/keys.js

@@ -17,9 +17,10 @@
  *   These keys persist DO state across deploys. Renaming any key is a
  *   storage migration — never do it without an explicit migration plan.
  */
-// The isolate-generation counter key (ISOLATE_GEN_KEY) and the multi-reason
-// alarm map key (ALARM_REASONS_KEY) live with their machinery in
-// @nimbus-sh/fabric/alarms.js; their persisted VALUES are unchanged.
+// The isolate-generation counter key (GENERATION_KEY) and the multi-reason
+// timer map key (TIMER_REASONS_KEY) live with their machinery in
+// @nimbus-sh/fabric/generation.js and @nimbus-sh/fabric/timers.js; their
+// persisted VALUES are unchanged.
 /** W9: debounce window in ms before flushing pending process-log writes
  *  to SQL. Hot path (every append schedules a flush via this debounce). */
 export const W9_FLUSH_DEBOUNCE_MS = 250;
@@ -54,6 +55,14 @@ export const ATTACH_BOOTSTRAP_JTI_KEY_PREFIX = 'attach-bootstrap-jti:';
  * these rows.
  */
 export const PORT_CAPABILITY_KEY_PREFIX = 'nimbus_preview_capability:';
+/**
+ * Prefix for a durable application's facet-slot row, keyed by owner.
+ * `durable-slot:next` and `durable-slot:free` under the same prefix are the
+ * allocator's counter and free list; `durable-slot:<owner>` pins the owner to
+ * its `app-slot-<n>` facet name for the application's whole life. Owned by
+ * `facets/durable-slots.ts`, the only module that reads or writes these rows.
+ */
+export const DURABLE_SLOT_KEY_PREFIX = 'durable-slot:';
 /**
  * Prefix for a named programmatic shell's durable cwd+env, keyed by shell id.
  * One row per id the embedder has actually used; bounded by the embedder's own

package/dist/session/nimbus-session.d.ts

@@ -15,13 +15,14 @@ import { SqliteRuntimeFsBridge } from '@nimbus-sh/core/runtime/sqlite-runtime-fs
 import { type VfsAcquireResult, type VfsListPage } from '@nimbus-sh/core/runtime/os-contracts.js';
 import type { WsHibernationConfigResult } from './hibernation.js';
 import { PortRegistry } from '@nimbus-sh/core/runtime/port-registry.js';
-import { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
 import { ViteDevServer } from '../facets/vite-dev-server.js';
 import { CirrusReal } from '../facets/cirrus-real.js';
+import { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
 import { NimbusWrangler } from '../wrangler/nimbus-wrangler.js';
-import { NpmInstaller } from '../npm/installer.js';
+import type { NpmInstaller } from '../npm/installer.js';
 import { type TryEnableReplicasResult as _W12EnableResult } from '../replica/routing.js';
 import * as _rpc from './rpc.js';
+import type { SupervisorOpEnvelope } from '@nimbus-sh/core/workspace/supervisor-op.js';
 import type { HostedHttpRequest, HostedHttpResponse } from '@nimbus-sh/fabric/process-host.js';
 import { WebSocketRelay } from './ws-relay.js';
 import * as _programmatic from './programmatic.js';
@@ -120,17 +121,8 @@ export declare class NimbusSession extends CloudflareDurableObject {
      * catch-all).
      */
     _w9WsConfig: WsHibernationConfigResult | null;
-    /**
-     * Monotonic isolate generation counter. Each fresh isolate (cold start
-     * or post-hibernation wake) increments this and persists to storage.
-     * Lets `/api/_diag/memory` confirm whether a wake actually happened
-     * between two probe calls.
-     */
-    _isolateGen: number;
-    /** True once we've persisted the bumped gen counter to storage. */
-    _isolateGenPersisted: boolean;
-    /** W1: serializes every alarm-map read-modify-write (fabric alarms.ts). */
-    _alarmChain?: Promise<unknown>;
+    /** W1: serializes every timer-map read-modify-write (fabric timers.ts). */
+    _timerChain?: Promise<unknown>;
     /** SQL DDL — idempotent; run on first fetch. */
     _w9SchemaInit: boolean;
     /** Have we wired the persist adapter into ProcessLogStore yet? */
@@ -207,7 +199,7 @@ export declare class NimbusSession extends CloudflareDurableObject {
      * 'log-janitor' (dropOlderThan sweep). The janitor body needs an
      * orphan-pid predicate so we close over the process supervisor here.
      */
-    alarm(): Promise<void>;
+    alarm(alarmInfo?: AlarmInvocationInfo): Promise<void>;
     /**
      * Grant the fresh turn a suspended launch asked for.
      *
@@ -234,8 +226,6 @@ export declare class NimbusSession extends CloudflareDurableObject {
      * budget rather than the one the launch has already been spending.
      */
     private _scheduleLaunchTurn;
-    /** W9: increment + persist isolate-gen counter once per fresh isolate. */
-    _w9MaybeBumpIsolateGen(): Promise<void>;
     /**
      * Convenience: the full URL prefix for the Vite dev server inside this
      * session (e.g. `/s/nimble-otter-4271/preview`). Falls back to the
@@ -260,6 +250,7 @@ export declare class NimbusSession extends CloudflareDurableObject {
      * get/put, so two concurrent exchanges cannot both observe "absent".
      */
     _rpcConsumeAttachBootstrap(jti: string): Promise<boolean>;
+    supervisorOp(envelope: SupervisorOpEnvelope): Promise<unknown>;
     _rpcReadFile(path: string, pid?: number): Promise<string | null>;
     _rpcReadFileBytes(path: string, pid?: number): Promise<Uint8Array | null>;
     _rpcInnerDoFetch(req: any): Promise<any>;
@@ -448,12 +439,29 @@ export declare class NimbusSession extends CloudflareDurableObject {
         exit: import("@nimbus-sh/core/runtime/process-logs.js").ProcessExitInfo | null;
     }>;
     _rpcListPorts(): Promise<_programmatic.SerializedPort[]>;
-    _rpcExposePort(port: number): Promise<{
+    _rpcExposePort(port: number, options?: {
+        visibility?: 'scoped' | 'public';
+    }): Promise<{
         port: number;
         listening: boolean;
         pid: number | null;
         registeredAt: number | null;
         capability: string | null;
+        visibility: "scoped" | "public";
+    }>;
+    _rpcEnsureDurableApp(input: {
+        owner: string;
+        preferredPort?: number;
+        visibility?: 'scoped' | 'public';
+    }): Promise<{
+        port: number;
+        capability: string | null;
+        visibility: "scoped" | "public";
+    }>;
+    _rpcRemoveDurableApp(owner: string): Promise<{
+        owner: string;
+        removed: boolean;
+        port: number | null;
     }>;
     _rpcUnexposePort(port: number): Promise<{
         port: number;
@@ -461,6 +469,12 @@ export declare class NimbusSession extends CloudflareDurableObject {
     }>;
     /** Capability-authenticated port route, for an embedder holding the token. */
     _rpcRouteCapabilityPort(port: number, capability: string, request: Request, innerPath: string): Promise<Response>;
+    /**
+     * The port route's recovery seam: a durable application journalled but
+     * dead is re-driven on demand rather than left for the alarm pump. The
+     * manager decides 'started' | 'absent' | 'failed'; the route maps them.
+     */
+    ensureDurableAppOnPort(port: number): Promise<'started' | 'absent' | 'failed'>;
     _rpcDeleteFile(path: string, options?: {
         recursive?: boolean;
     }): Promise<void>;
@@ -517,7 +531,7 @@ export declare class NimbusSession extends CloudflareDurableObject {
     _w5LastPersistRingSize: number;
     /** B'.4 — live initSession phase. Surfaced via
      *  /api/_diag/session.phase. null pre-first-init. */
-    _b4Phase: import('@nimbus-sh/core/observability/oom-discriminator.js').SessionState | null;
+    _b4Phase: import('@nimbus-sh/platform/oom-discriminator.js').SessionState | null;
     /** B'.5 — count of warm-rejoin /ws upgrades. Increments each
      *  time the join path is taken (Phase B skipped). 0 means no
      *  warm rejoins yet. Surfaced via /api/_diag/session.warmJoinCount. */
@@ -557,7 +571,7 @@ export declare class NimbusSession extends CloudflareDurableObject {
      * All concurrent fetches share ONE worker — no port exhaustion.
      */
     buildFetchFn(log?: (msg: string) => void): ((url: string, init?: RequestInit) => Promise<Response>) | undefined;
-    ensureNpmInstaller(onProgress?: (msg: string) => void): void;
+    ensureNpmInstaller(onProgress?: (msg: string) => void): Promise<void>;
     /**
      * Read an environment flag with default-on semantics. Mirrors the
      * shouldUseFacetPool / shouldUseFacetResolver / shouldUseBatchFacet