@nimbus-sh/worker 0.5.0 → 0.7.0

package/dist/runtime/package-manager.js

@@ -200,12 +200,19 @@ export async function ensureRuntimesProgrammatic(deps, specs, opts = {}) {
     }
     return results;
 }
+const NIMBUS_USAGE = [
+    'usage: nimbus install <name>[@<version>] | nimbus install --list | nimbus install --available | nimbus uninstall <name>',
+    '       nimbus expose <port|pid> [--public] [--name <name>]',
+    '       nimbus app list | url <name|port> | rotate <name|port> | remove <name|port>',
+    '       nimbus start [--restart never|on-failure] <command> [args...]',
+].join('\n');
 /**
  * Build the shell-command handler that implements `nimbus install …`,
- * `nimbus uninstall …`. Registered under the name `nimbus`.
+ * `nimbus uninstall …`, `nimbus expose …`, `nimbus app …` and
+ * `nimbus start …`. Registered under the name `nimbus`.
  */
 export function makeNimbusVerbHandler(deps) {
-    const { env, registry, getHome, warmRuntime } = deps;
+    const { env, registry, getHome, warmRuntime, apps } = deps;
     const vfs = deps.vfs.as(CRED_KERNEL);
     return async function nimbus(ctx) {
         const argv = ctx.args || [];
@@ -217,12 +224,170 @@ export function makeNimbusVerbHandler(deps) {
         if (verb === 'uninstall') {
             return runUninstall(rest, ctx, { vfs, registry, getHome });
         }
+        if (verb === 'expose' || verb === 'app' || verb === 'start') {
+            if (verb === 'start')
+                return runStart(rest, ctx, registry);
+            if (!apps) {
+                ctx.stderr.write(`nimbus ${verb}: this host has no session to address applications on\n`);
+                return 1;
+            }
+            try {
+                return verb === 'expose' ? await runExpose(rest, ctx, apps) : await runApp(rest, ctx, apps);
+            }
+            catch (e) {
+                ctx.stderr.write(`nimbus ${verb}: ${e instanceof Error ? e.message : String(e)}\n`);
+                return 1;
+            }
+        }
         // Unknown verb.
         ctx.stderr.write(`nimbus: unknown subcommand '${verb || '(none)'}'\n`);
-        ctx.stderr.write(`usage: nimbus install <name>[@<version>] | nimbus install --list | nimbus install --available | nimbus uninstall <name>\n`);
+        ctx.stderr.write(`${NIMBUS_USAGE}\n`);
         return 2;
     };
 }
+// ── expose / app / start ─────────────────────────────────────────────
+/** `<port|pid|name>` as the verbs take it: digits are a port or pid, anything else a name. */
+function appTargetArg(raw) {
+    return /^\d+$/.test(raw) ? Number(raw) : raw;
+}
+async function runExpose(args, ctx, apps) {
+    let target;
+    let name;
+    let visibility;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--public')
+            visibility = 'public';
+        else if (arg === '--scoped')
+            visibility = 'scoped';
+        else if (arg === '--name') {
+            name = args[++i];
+        }
+        else if (arg.startsWith('--name='))
+            name = arg.slice('--name='.length);
+        else if (arg.startsWith('--')) {
+            ctx.stderr.write(`nimbus expose: unknown flag ${arg}\n`);
+            return 2;
+        }
+        else if (target === undefined)
+            target = arg;
+        else {
+            ctx.stderr.write('nimbus expose: one target only\n');
+            return 2;
+        }
+    }
+    if (target === undefined) {
+        ctx.stderr.write('usage: nimbus expose <port|pid> [--public] [--name <name>]\n');
+        return 2;
+    }
+    const exposed = await apps.expose(appTargetArg(target), {
+        ...(visibility !== undefined ? { visibility } : {}),
+        ...(name !== undefined ? { name } : {}),
+    });
+    ctx.stdout.write(`${exposed.url ?? `(no URL: port ${exposed.port}, capability ${exposed.capability ?? 'none'})`}\n`);
+    ctx.stdout.write(`  ${exposed.visibility} · ${exposed.name ?? exposed.owner} · port ${exposed.port}\n`);
+    return 0;
+}
+async function runApp(args, ctx, apps) {
+    const [sub, target] = args;
+    if (sub === 'list' || sub === 'ls') {
+        const rows = await apps.list();
+        if (rows.length === 0) {
+            ctx.stdout.write('(no applications)\n');
+            return 0;
+        }
+        for (const app of rows) {
+            const label = app.name ?? app.owner;
+            const where = app.port === null ? '-' : String(app.port);
+            const pid = app.pid === null ? '-' : String(app.pid);
+            const status = app.diagnostic ? `${app.status} (${app.diagnostic})` : app.status;
+            ctx.stdout.write(`${label}\t${where}\t${pid}\t${status}\t${app.visibility}\t${app.restart}\t${app.url ?? '-'}\n`);
+        }
+        return 0;
+    }
+    if (target === undefined || (sub !== 'url' && sub !== 'rotate' && sub !== 'remove')) {
+        ctx.stderr.write('usage: nimbus app list | url <name|port> | rotate <name|port> | remove <name|port>\n');
+        return 2;
+    }
+    const t = appTargetArg(target);
+    if (sub === 'url') {
+        const app = (await apps.list()).find((row) => row.name === t || row.owner === t || row.port === t || row.pid === t);
+        if (!app) {
+            ctx.stderr.write(`nimbus app url: no application matches ${target}\n`);
+            return 1;
+        }
+        ctx.stdout.write(`${app.url ?? `(no URL: port ${app.port ?? '-'})`}\n`);
+        return 0;
+    }
+    if (sub === 'rotate') {
+        const rotated = await apps.rotateLink(t);
+        ctx.stdout.write(`${rotated.url ?? `(no URL: port ${rotated.port}, capability ${rotated.capability ?? 'none'})`}\n`);
+        return 0;
+    }
+    const removed = await apps.remove(t);
+    ctx.stdout.write(removed.removed
+        ? `removed ${removed.owner}${removed.port !== null ? ` (port ${removed.port} released)` : ''}\n`
+        : `nothing to remove for ${removed.owner}\n`);
+    return removed.removed ? 0 : 1;
+}
+/**
+ * `nimbus start [--restart <policy>] <command> [args...]` — run a
+ * registered command with the restart policy in its environment, which is
+ * where the resident it starts reads the policy from (`NIMBUS_RESTART`),
+ * exactly as the SDK's `startProcess({ restart })` carries it.
+ */
+async function runStart(args, ctx, registry) {
+    let restart = 'never';
+    let i = 0;
+    for (; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--restart') {
+            const policy = args[++i];
+            if (policy !== 'never' && policy !== 'on-failure') {
+                ctx.stderr.write(`nimbus start: --restart must be never or on-failure, got ${policy ?? '(none)'}\n`);
+                return 2;
+            }
+            restart = policy;
+        }
+        else if (arg.startsWith('--restart=')) {
+            const policy = arg.slice('--restart='.length);
+            if (policy !== 'never' && policy !== 'on-failure') {
+                ctx.stderr.write(`nimbus start: --restart must be never or on-failure, got ${policy}\n`);
+                return 2;
+            }
+            restart = policy;
+        }
+        else if (arg === '--') {
+            i += 1;
+            break;
+        }
+        else if (arg.startsWith('--')) {
+            ctx.stderr.write(`nimbus start: unknown flag ${arg}\n`);
+            return 2;
+        }
+        else
+            break;
+    }
+    const [command, ...commandArgs] = args.slice(i);
+    if (!command) {
+        ctx.stderr.write('usage: nimbus start [--restart never|on-failure] <command> [args...]\n');
+        return 2;
+    }
+    const handler = registry.resolve ? await registry.resolve(command) : null;
+    if (!handler) {
+        ctx.stderr.write(`nimbus start: ${command}: command not found\n`);
+        return 127;
+    }
+    // The shell hands `nimbus` its full CommandContext; ShellCtx is only the
+    // slice this module reads, so the spread carries everything the command
+    // needs (signal, vfs, stdin, ...) through untouched.
+    const full = ctx;
+    return handler({
+        ...full,
+        args: commandArgs,
+        env: { ...full.env, NIMBUS_RESTART: restart },
+    });
+}
 // ── install ──────────────────────────────────────────────────────────
 async function runInstall(args, ctx, deps) {
     // Flag parsing.

package/dist/runtime/ruby-resident.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruby-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAezD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,iBAAiB,CA8E3E;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiLrE"}
+{"version":3,"file":"ruby-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAezD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,iBAAiB,CAgF3E;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiLrE"}

package/dist/runtime/ruby-resident.js

@@ -28,6 +28,8 @@ export function rubyResidentStart(facetMgr) {
         const command = args.command;
         const workerCode = buildRubySocketProcessWorker(buildRubyPreamble());
         const spawned = await facetMgr.spawnWorker(workerCode, command, args.cwd, {
+            resident: { argv: args.argv, runtime: 'ruby' },
+            restart: args.startArgs.userEnv.NIMBUS_RESTART === 'on-failure' ? 'on-failure' : 'never',
             compatibilityFlags: ['nodejs_compat'],
             // By path, not by value: the image is 34.3 MiB — more than a single RPC
             // value may carry — so whichever host runs this process reads it itself.

package/dist/session/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/session/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAUL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAiB3B,UAAU,YAAY;IACpB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE;QACzB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KAC3E,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/B;AAED,UAAU,IAAK,SAAQ,gBAAgB,EAAE,aAAa;IACpD,GAAG,EAAE;QAAE,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC;IAC/B,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxD;AAED,UAAU,iBAAiB;IACzB,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA2BD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2ClG;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,IAAI,CAQxF"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/session/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAYL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAiB3B,UAAU,YAAY;IACpB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE;QACzB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KAC3E,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/B;AAED,UAAU,IAAK,SAAQ,gBAAgB,EAAE,aAAa;IACpD,GAAG,EAAE;QAAE,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC;IAC/B,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxD;AAED,UAAU,iBAAiB;IACzB,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA2BD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2ClG;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,IAAI,CAQxF"}

package/dist/session/agent.js

@@ -12,7 +12,7 @@ import { BASE_PATH_HEADER, TENANT_HEADER } from '../_shared/session-router.js';
 import { decodeJsonBase64Url, encodeJsonBase64Url, pkceChallenge, randomBase64Url, sealJson, unsealJson, } from '@nimbus-sh/core/_shared/crypto.js';
 import { clearNimbusAgentOAuthCookie, fetchNimbusCloudflareAccounts, isNimbusCloudflareAccountId, isNimbusTenantSegment, NIMBUS_CF_OAUTH_AUTH_URL, readNimbusCookie, readNimbusAgentCookieSecret, readNimbusAgentOAuthConfig, requestNimbusCloudflareOAuthToken, serializeNimbusCookie, } from './agent-oauth.js';
 import { clearSessionAiCredential, createSessionAiModel, describeSessionAiConnection, readSessionAiConfig, resolveSessionAiCredential, sessionAiAccountIsAvailable, setSessionAiAccount, storeSessionAiCredential, } from './ai.js';
-import { ensureProgrammaticReady, rpcExec, rpcEnsureRuntimes, rpcInstallRuntime, rpcKillProcess, rpcListPorts, rpcListProcesses, rpcProcessLogs, rpcStartProcess, } from './programmatic.js';
+import { ensureProgrammaticReady, rpcExec, rpcEnsureRuntimes, rpcInstallRuntime, rpcExposeApp, rpcKillProcess, rpcListApps, rpcListPorts, rpcListProcesses, rpcProcessLogs, rpcStartProcess, } from './programmatic.js';
 import { resolveVfsPath } from '@nimbus-sh/core/vfs/path.js';
 import { appendTextPart, interruptRunningTools, textFromParts, upsertStoredMessage, upsertToolPart, } from './agent-contract.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
@@ -645,6 +645,20 @@ function createAiSdkTools(self) {
             inputSchema: toolSchema({}, []),
             execute: async (args) => runTool(self, 'list_ports', args),
         }),
+        expose_app: aiTool({
+            description: 'Expose a running application by port, pid or name: reserves its port under its identity, optionally names it and makes it public, and returns its URL.',
+            inputSchema: toolSchema({
+                target: stringProp('Port number, process id, or app name.'),
+                visibility: stringProp("'scoped' (default) or 'public' — public mints a shareable capability URL."),
+                name: stringProp('Optional DNS-label name for the app, e.g. "api".'),
+            }, ['target']),
+            execute: async (args) => runTool(self, 'expose_app', args),
+        }),
+        list_apps: aiTool({
+            description: 'List every application the session knows: owner, name, port, pid, status, visibility, restart policy and URL.',
+            inputSchema: toolSchema({}, []),
+            execute: async (args) => runTool(self, 'list_apps', args),
+        }),
     };
 }
 function collectTurnParts(result) {
@@ -872,6 +886,19 @@ async function runTool(self, name, args) {
         }
         if (name === 'list_ports')
             return rpcListPorts(self);
+        if (name === 'expose_app') {
+            const raw = String(args.target ?? '').trim();
+            if (!raw)
+                return { error: 'target is required' };
+            const visibility = args.visibility === 'public' ? 'public' : args.visibility === 'scoped' ? 'scoped' : undefined;
+            const appName = typeof args.name === 'string' && args.name.trim() ? args.name.trim() : undefined;
+            return rpcExposeApp(self, /^\d+$/.test(raw) ? Number(raw) : raw, {
+                ...(visibility !== undefined ? { visibility } : {}),
+                ...(appName !== undefined ? { name: appName } : {}),
+            });
+        }
+        if (name === 'list_apps')
+            return rpcListApps(self);
         return { error: `unknown tool: ${name}` };
     }
     catch (e) {

package/dist/session/helpers.d.ts

@@ -127,6 +127,28 @@ export declare function _classifyCommand(name: string): {
  * Returns the detected bundler bin name (e.g. "vite") or null.
  */
 export declare function detectBundlerBin(script: string): string | null;
+/**
+ * Whether `npm run <scriptName>` (or `npm start`/`npm test`) should refuse
+ * before dispatch because the resolved script invokes `next` on a
+ * subcommand Nimbus cannot run: `dev`, `start`, `build`, or `export` all
+ * need the same missing pipeline — webpack/Turbopack bundling,
+ * child_process.fork with v8-IPC, custom http.Server semantics.
+ *
+ * Returns the blocked subcommand ('dev'|'start'|'build'|'export') or null.
+ * `--force` / `--allow-next` in the script args bypasses the refusal.
+ * scriptName 'dev'/'start' on a next-depending package refuses even when
+ * the script body doesn't name `next` (custom dev servers), matching the
+ * pre-extension dev/start-only behavior.
+ */
+export declare function refusedNextSubcommand(scriptName: string, script: string, pkg: {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+}, scriptArgs: readonly string[]): 'dev' | 'start' | 'build' | 'export' | null;
+/**
+ * The refusal message for `refusedNextSubcommand` — identical blockers and
+ * escape hatch for every blocked subcommand.
+ */
+export declare const NEXT_REFUSAL_MESSAGE: string;
 /**
  * Check whether a project directory has installed dependencies.
  *
@@ -140,4 +162,20 @@ export declare function checkNodeModulesGuard(vfs: CredentialedVfs, projectRoot:
     missing: boolean;
     depCount: number;
 };
+/**
+ * Bound for the `vite build` esbuild bundle step (init.ts). Demo-app
+ * builds take seconds; anything past this is a stall, not a build.
+ */
+export declare const VITE_BUILD_TIMEOUT_MS = 120000;
+/**
+ * G5: race an unbounded await against a loud timeout.
+ *
+ * The timeout does not cancel `work` (there is nothing to cancel an
+ * in-isolate esbuild bundle with) — it stops *waiting* and rejects
+ * with an error that names what was attempted and how long it ran,
+ * so a stalled build surfaces as a timeout error instead of silence.
+ * The timer handle never escapes the executor, so there is nothing
+ * to null-check: settle clears it on every path.
+ */
+export declare function withLoudTimeout<T>(work: Promise<T>, timeoutMs: number, what: string): Promise<T>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/session/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/session/helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,MAAM,CAiHT;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAehC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAI5F,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,aAQjC,CAAC;AACH,eAAO,MAAM,iCAAiC,aAG5C,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBzF;AAED;;;;;;;;;;;GAWG;AAiBH,eAAO,MAAM,kCAAkC,UAQ9C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAwC5F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAU3G;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAiBxC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/session/helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,MAAM,CAiHT;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAehC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAI5F,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,aAQjC,CAAC;AACH,eAAO,MAAM,iCAAiC,aAG5C,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBzF;AAED;;;;;;;;;;;GAWG;AAiBH,eAAO,MAAM,kCAAkC,UAQ9C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAwC5F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAU3G;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACxF,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,CAkB7C;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAQuC,CAAC;AAEzE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAiBxC;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAC/B,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,CAAC,CAaZ"}

package/dist/session/helpers.js

@@ -430,6 +430,58 @@ export function detectBundlerBin(script) {
     }
     return null;
 }
+/**
+ * Whether `npm run <scriptName>` (or `npm start`/`npm test`) should refuse
+ * before dispatch because the resolved script invokes `next` on a
+ * subcommand Nimbus cannot run: `dev`, `start`, `build`, or `export` all
+ * need the same missing pipeline — webpack/Turbopack bundling,
+ * child_process.fork with v8-IPC, custom http.Server semantics.
+ *
+ * Returns the blocked subcommand ('dev'|'start'|'build'|'export') or null.
+ * `--force` / `--allow-next` in the script args bypasses the refusal.
+ * scriptName 'dev'/'start' on a next-depending package refuses even when
+ * the script body doesn't name `next` (custom dev servers), matching the
+ * pre-extension dev/start-only behavior.
+ */
+export function refusedNextSubcommand(scriptName, script, pkg, scriptArgs) {
+    if (scriptArgs.includes('--force') || scriptArgs.includes('--allow-next'))
+        return null;
+    if (!(pkg.dependencies?.next || pkg.devDependencies?.next))
+        return null;
+    if (scriptName === 'dev' || scriptName === 'start')
+        return scriptName;
+    // For other script names the script body must actually invoke a blocked
+    // next subcommand. Tokens: skip env assignments and cross-env/env/npx.
+    const tokens = (script || '').trim().split(/\s+/);
+    let i = 0;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (/^[A-Z_][A-Z0-9_]*=/.test(t) || t === 'cross-env' || t === 'env' || t === 'npx') {
+            i++;
+            continue;
+        }
+        break;
+    }
+    const bin = (tokens[i] || '').replace(/^\.\/node_modules\/\.bin\//, '');
+    if (bin !== 'next' && !bin.startsWith('next.'))
+        return null;
+    const sub = tokens[i + 1];
+    if (sub === 'dev' || sub === 'start' || sub === 'build' || sub === 'export')
+        return sub;
+    return null;
+}
+/**
+ * The refusal message for `refusedNextSubcommand` — identical blockers and
+ * escape hatch for every blocked subcommand.
+ */
+export const NEXT_REFUSAL_MESSAGE = '\x1b[31m✘\x1b[0m \x1b[1mNext.js is not supported in Nimbus.\x1b[0m\n' +
+    '   Specific blockers:\n' +
+    "     1. \x1b[2mchild_process.fork\x1b[0m IPC uses v8-serializer (Nimbus ships JSON projection).\n" +
+    '     2. webpack / Turbopack bundlers are not integrated with the pre-bundle pipeline.\n' +
+    '     3. Custom \x1b[2mhttp.Server\x1b[0m semantics (keep-alive, raw sockets) are facet-incompatible.\n' +
+    '\n' +
+    '   Workaround: run the Next.js project outside Nimbus (or a hosted runtime),\n' +
+    '   or pass \x1b[36m--allow-next\x1b[0m to bypass at your own risk.\n';
 /**
  * Check whether a project directory has installed dependencies.
  *
@@ -462,3 +514,27 @@ export function checkNodeModulesGuard(vfs, projectRoot) {
         return { missing: false, depCount: 0 };
     }
 }
+/**
+ * Bound for the `vite build` esbuild bundle step (init.ts). Demo-app
+ * builds take seconds; anything past this is a stall, not a build.
+ */
+export const VITE_BUILD_TIMEOUT_MS = 120_000;
+/**
+ * G5: race an unbounded await against a loud timeout.
+ *
+ * The timeout does not cancel `work` (there is nothing to cancel an
+ * in-isolate esbuild bundle with) — it stops *waiting* and rejects
+ * with an error that names what was attempted and how long it ran,
+ * so a stalled build surfaces as a timeout error instead of silence.
+ * The timer handle never escapes the executor, so there is nothing
+ * to null-check: settle clears it on every path.
+ */
+export function withLoudTimeout(work, timeoutMs, what) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`${what} produced no result after ${(timeoutMs / 1000).toFixed(0)}s — ` +
+                'stopped waiting (the work may still finish in the background; re-run to retry).'));
+        }, timeoutMs);
+        work.then((value) => { clearTimeout(timer); resolve(value); }, (error) => { clearTimeout(timer); reject(error); });
+    });
+}

package/dist/session/init-phases.d.ts

@@ -88,6 +88,6 @@ export declare function joinExistingSession(self: {
     };
     _b4Phase: SessionState | null;
     _b4WarmJoinCount: number;
-}, ws: WebSocket, appendScrollback: (ctx: any, data: string, atMs: number) => void, loadScrollback: (ctx: any) => string): void;
+}, ws: WebSocket, tee: (frame: string) => void, loadScrollback: (ctx: any) => string): void;
 export {};
 //# sourceMappingURL=init-phases.d.ts.map

package/dist/session/init-phases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-phases.d.ts","sourceRoot":"","sources":["../../src/session/init-phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAElG,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE;IAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EACtD,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,IAAI,CAcN;AAED,KAAK,iBAAiB,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,iBAAiB,CAG7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpG,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,EACD,EAAE,EAAE,SAAS,EACb,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,EAChE,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GACnC,IAAI,CAsCN"}
+{"version":3,"file":"init-phases.d.ts","sourceRoot":"","sources":["../../src/session/init-phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAElG,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE;IAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EACtD,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,IAAI,CAcN;AAED,KAAK,iBAAiB,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,iBAAiB,CAG7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpG,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,EACD,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EAC5B,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GACnC,IAAI,CAiCN"}

package/dist/session/init-phases.js

@@ -91,7 +91,7 @@ export function classifyWsUpgrade(self, sockets, now = Date.now()) {
  * needed here; init-phases.ts shouldn't grow a circular dep on
  * nimbus-session-internal.
  */
-export function joinExistingSession(self, ws, appendScrollback, loadScrollback) {
+export function joinExistingSession(self, ws, tee, loadScrollback) {
     // Phase R — pure SQL reads. No-op on warm rejoin (live state is
     // already correct in self.shell / self.terminal). Recorded in the
     // ring for symmetry with cold init.
@@ -101,17 +101,7 @@ export function joinExistingSession(self, ws, appendScrollback, loadScrollback)
     // the same WebSocketTerminal instance is preserved (we mutate
     // its internal ws ref via attach()).
     setPhase(self, 'wire', 'warm-rejoin');
-    self.terminal.attach(ws, (frame) => {
-        try {
-            appendScrollback(self.ctx, frame, Date.now());
-        }
-        catch (e) {
-            try {
-                console.warn("[B'.3] appendScrollback failed:", e?.message || e);
-            }
-            catch { }
-        }
-    });
+    self.terminal.attach(ws, tee);
     // Replay scrollback to the new ws so the user sees the prior
     // session's terminal contents. Same shape as cold-init's replay
     // when persisted state exists.

package/dist/session/init.d.ts

@@ -47,6 +47,20 @@ type InitHost = SessionInternal & {
     readonly ctx: any;
     readonly env: any;
 };
-export declare function initSession(self: InitHost, ws: WebSocket): Promise<void>;
+/**
+ * How the socket being wired came to need a session.
+ *
+ *   - reconnect: a fresh terminal on a fresh /ws upgrade. Its screen is
+ *     empty, so the persisted scrollback is replayed above the live prompt.
+ *   - wake: the socket was accepted by a previous instance and outlived it
+ *     in hibernation; the peer's screen still shows everything up to the
+ *     sleep. Replaying scrollback there duplicates what the peer already
+ *     has, and a driver waiting for a fresh prompt would take the replayed
+ *     one for its answer. Only the resumed-instance notice is written.
+ */
+export interface InitSessionOptions {
+    resume?: 'reconnect' | 'wake';
+}
+export declare function initSession(self: InitHost, ws: WebSocket, options?: InitSessionOptions): Promise<void>;
 export {};
 //# sourceMappingURL=init.d.ts.map

package/dist/session/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/session/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA8EH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;GAQG;AACH,KAAK,QAAQ,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC;AAa3E,wBAAsB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAysF9E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/session/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAkFH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;GAQG;AACH,KAAK,QAAQ,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC;AAQ3E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;CAC/B;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,QAAQ,EACd,EAAE,EAAE,SAAS,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgsEf"}