@phnx-labs/agents-cli 1.22.114 → 1.22.116

package/dist/lib/browser/runtime-state.js

@@ -258,6 +258,39 @@ function readTaskCount(dir) {
  * alone — we'd rather leak than wrongly kill a user-owned process that
  * happens to share metadata.
  */
+/**
+ * Clean up what a DEAD daemon genuinely left behind — which is not the browser.
+ *
+ * A live local browser outliving its daemon is the NORMAL case, not an orphan.
+ * `BrowserService.shutdown` deliberately closes only CDP and leaves the browser
+ * running, and on macOS the spawn is detached so the daemon's own positive-pid
+ * `killTree` reaches the daemon alone. This reaper used to read "the recorded
+ * `daemonPid` has exited" as "everything it recorded is garbage" and SIGTERM the
+ * browser — so replacing the daemon (a menubar activation, an upgrade, a crash
+ * restart) killed a browser the user was looking at, and `clearProfileRuntime`
+ * then removed the `port`/meta that {@link readProfileRuntime} needs, so even a
+ * survivor could not be re-attached and a second browser would launch beside it.
+ *
+ * The three cases are now decided independently:
+ *
+ * - **A live local browser/electron is preserved untouched** — not signalled, not
+ *   cleared, and its `daemonPid` deliberately NOT rewritten. Ownership is adopted
+ *   only after an identity-checked attach succeeds (`adoptProfileRuntimeOwner`,
+ *   called from the reuse branch in `BrowserService.connectProfile`), so nothing
+ *   claims a browser it has not proven it can talk to. Re-running this is a no-op.
+ * - **A dead browser record is cleared**, with no signal sent: there is nothing
+ *   alive to signal, and the stale pid/port would otherwise mislead the next
+ *   attach.
+ * - **A stale tunnel IS reaped.** A local `ssh -L` cannot outlive its purpose, so
+ *   a dead owner does make it an orphan. This is the one thing the old code was
+ *   right about; it just shared a code path with the browser.
+ *
+ * The accepted trade: a genuinely leaked browser from a long-dead daemon is no
+ * longer force-killed here. Idle/abandoned cleanup has its own owner in
+ * `browser/hygiene.ts` (session-dead + idle), which the daemon's periodic tick and
+ * `agents browser prune` both call — that is the right place for it, because it can
+ * tell "idle and abandoned" from "in use right now" and this function cannot.
+ */
 export function reapOrphanedProcesses() {
     const root = getBrowserRuntimeDir();
     if (!fs.existsSync(root))
@@ -275,28 +308,76 @@ export function reapOrphanedProcesses() {
         // Owning daemon still alive — leave its kids alone.
         if (isProcessAlive(meta.daemonPid))
             continue;
-        // Kill what the dead daemon left behind. Best-effort.
-        const kill = (pid, label) => {
-            if (!pid || pid === 0)
-                return;
-            // Only kill if it matches the recorded command — guards against
-            // pid reuse handing us an unrelated process to murder.
-            if (meta.command && !matchesCommand(pid, meta.command) &&
-                !matchesCommand(pid, 'ssh'))
-                return;
-            try {
-                process.kill(pid, 'SIGTERM');
-                reaped++;
-                details.push(`reaped ${label ?? 'pid'} ${pid} (profile ${profileName})`);
+        // A local `ssh -L` whose owner is gone is genuinely orphaned: nothing is
+        // driving it and it cannot be re-adopted, so it is the one process to signal.
+        // Matched against the recorded command (or `ssh`) so a recycled pid is not
+        // mistaken for our tunnel.
+        if (meta.tunnelPid && meta.tunnelPid !== 0) {
+            const cmdOk = !meta.command
+                || matchesCommand(meta.tunnelPid, meta.command)
+                || matchesCommand(meta.tunnelPid, 'ssh');
+            if (cmdOk) {
+                try {
+                    process.kill(meta.tunnelPid, 'SIGTERM');
+                    reaped++;
+                    details.push(`reaped tunnel ${meta.tunnelPid} (profile ${profileName})`);
+                }
+                catch { /* already gone */ }
             }
-            catch { /* already gone */ }
-        };
-        kill(meta.pid, 'browser');
-        kill(meta.tunnelPid, 'tunnel');
+        }
+        // A tunnel-kind record has no local browser of its own, so clearing it is the
+        // whole cleanup. `pid` on such a record is the REMOTE browser (normally 0) and
+        // is never ours to signal.
+        if (meta.kind === 'tunnel') {
+            clearProfileRuntime(profileName);
+            continue;
+        }
+        // `isProcessAlive` re-checks the recorded command, so a recycled pid does not
+        // read as our browser. A record with no pid at all is stale by definition.
+        const liveBrowser = !!meta.pid && meta.pid !== 0 && isProcessAlive(meta.pid, meta.command);
+        if (liveBrowser) {
+            details.push(`preserved live browser ${meta.pid} (profile ${profileName})`);
+            continue;
+        }
+        // Dead browser: clear the stale record. No signal — there is nothing there.
         clearProfileRuntime(profileName);
+        if (meta.pid)
+            details.push(`cleared dead browser record ${meta.pid} (profile ${profileName})`);
     }
     return { reaped, details };
 }
+/**
+ * Take ownership of a runtime record after an identity-checked attach succeeded.
+ *
+ * Called from the reuse branch in `BrowserService.connectProfile`, which has just
+ * probed `/json/version` and run `verifyBrowserIdentity` against the profile's
+ * expected browser family — so by this point the process on the recorded port is
+ * proven to be ours. Only then may a new service claim it.
+ *
+ * Rewrites `daemonPid` ALONE. Every other field — `pid`, `port`, `command`,
+ * `userDataDir`, `spawnedAt`, `kind`, `tunnelPid` — is the original launch's
+ * metadata and stays exactly as recorded: this is an ownership handover, not a
+ * re-registration, and rewriting the rest would lose the provenance the reaper and
+ * the hygiene pass both read. A record that has since disappeared is left alone
+ * rather than recreated from a partial view.
+ */
+export function adoptProfileRuntimeOwner(profileName, daemonPid = process.pid) {
+    const meta = readProfileRuntimeMeta(profileName);
+    if (!meta)
+        return false;
+    if (meta.daemonPid === daemonPid)
+        return true;
+    const dir = getProfileRuntimeDir(profileName);
+    try {
+        fs.writeFileSync(path.join(dir, META_FILE), JSON.stringify({ ...meta, daemonPid }));
+        return true;
+    }
+    catch {
+        // Losing the handover is not worth failing an otherwise good attach; the next
+        // startup simply preserves the browser again and re-attaches.
+        return false;
+    }
+}
 /**
  * True when ANY cache dir belonging to this profile still has a live browser or
  * SSH tunnel, or an open task. The composite naming (`<name>@<endpoint>`) means
@@ -478,7 +559,7 @@ function matchesCommand(pid, expectedCommand) {
  * determined. The process-listing API differs per OS: Windows has no `ps`, so
  * we query `tasklist` (CSV image name in column 1); POSIX uses `ps -o comm=`.
  */
-function liveProcessCommand(pid) {
+export function liveProcessCommand(pid) {
     try {
         if (process.platform === 'win32') {
             const out = execFileSync('tasklist', ['/FI', `PID eq ${pid}`, '/NH', '/FO', 'CSV'], {

package/dist/lib/browser/service.d.ts

@@ -731,6 +731,16 @@ export declare class BrowserService {
      * async/promise evaluation fails honestly with an AppleScript error.
      */
     private evaluateArcNative;
+    /**
+     * Resolve a task's owned Arc tabs against one shared snapshot of every
+     * window/space/tab, rather than asking Arc per tab as `listArcTaskTabs` does.
+     *
+     * Same ownership rule as the live path — `requireArcTask`, then the recorded
+     * ref must be present in its original window and Space. The snapshot changes
+     * how often Arc is asked, never what counts as owned. Actions keep the live
+     * path, because a snapshot can go stale before it is acted on.
+     */
+    private listArcTaskTabsFromSnapshot;
     private listArcTaskTabs;
     /**
      * Close native Arc tabs owned by a task. Only closes tabs the task created

package/dist/lib/browser/service.js

@@ -8,7 +8,7 @@ import { assertRemoteControlAllowedForRequest } from './remote-control.js';
 import { connectLocal } from './drivers/local.js';
 import { connectSSH, shellQuote } from './drivers/ssh.js';
 import { adoptLegacyRuntimeIfLocal, isLegacyEndpointKey, resolveBrowserTarget, shouldForkProfile, } from './resolve-target.js';
-import { clearProfileRuntime, listProfileCacheDirs, readProfileRuntimeMeta, isProcessAlive } from './runtime-state.js';
+import { adoptProfileRuntimeOwner, clearProfileRuntime, listProfileCacheDirs, readProfileRuntimeMeta, isProcessAlive } from './runtime-state.js';
 import { resolveDomainSkill } from './domain-skills.js';
 import { generateTaskId, generateShortId, asConnectionKey, parseConnectionKey, keyBelongsToProfile, } from './types.js';
 import { reapAbandonedTasks, resolveLiveIdentities, taskOwnerIsGone, } from './hygiene.js';
@@ -333,6 +333,11 @@ export function arcCreateMarker() {
 export function isArcCreateMarker(url) {
     return url.startsWith(ARC_CREATE_MARKER_PREFIX);
 }
+/** Run `fn` once per pass and share its promise, rejections included. */
+function onceAsync(fn) {
+    let pending;
+    return () => (pending ??= fn());
+}
 export class BrowserService {
     static SOURCE_PREFIX = {
         'rush-app': 'rush-app-',
@@ -1212,6 +1217,8 @@ export class BrowserService {
             await this.saveTaskState(task.profile, conn.tasks);
             return { tabId: resolvedTabId };
         }
+        requireCdp(conn, 'enumerate');
+        await conn.cdp.send('Target.activateTarget', { targetId: task.tabs[resolvedTabId] });
         task.currentTabId = resolvedTabId;
         await this.saveTaskState(task.profile, conn.tasks);
         return { tabId: resolvedTabId };
@@ -2196,9 +2203,20 @@ export class BrowserService {
      * it used to return (RUSH-2709).
      */
     async status(profileRef) {
+        // Built before rehydration: a cold pass rehydrates every saved runtime dir
+        // first, and each Arc one probed Arc on its own, spending the budget before
+        // the snapshot existed. One enumeration and one liveness read cover the pass.
+        const arc = {
+            spaces: onceAsync(() => enumerateArcSpaces()),
+            running: onceAsync(() => isArcRunning()),
+        };
         // Reconnect live browsers after a daemon restart so status is not empty
-        // while tasks.json still holds open work.
-        await this.rehydrateAllFromDisk();
+        // while tasks.json still holds open work. Rehydration is per runtime dir:
+        // one unreadable saved profile is reported below, never fatal to the pass.
+        const rehydrateErrors = new Map();
+        await this.rehydrateAllFromDisk(arc.running, (key, err) => {
+            rehydrateErrors.set(key, err instanceof Error ? err.message : String(err));
+        });
         // A caller who pasted a runtime key out of an older listing still gets the
         // profile it belongs to, rather than an empty result.
         const profileName = profileRef ? parseConnectionKey(profileRef).profile : undefined;
@@ -2208,25 +2226,99 @@ export class BrowserService {
             ? [...this.connections.keys()].filter((k) => keyBelongsToProfile(k, profileName))
             : Array.from(this.connections.keys());
         for (const key of candidates) {
-            const status = await this.getProfileStatus(key);
+            // Read-only: a profile that cannot be read is reported as unreadable, not
+            // allowed to abort the listing. Before this, a single stale Arc task made
+            // `status` throw and EVERY profile vanished, including healthy ones.
+            let status;
+            try {
+                status = await this.getProfileStatus(key, arc);
+            }
+            catch (err) {
+                const parsed = parseConnectionKey(key);
+                statuses.push({
+                    name: this.connections.get(key)?.profile ?? parsed.profile,
+                    endpoint: parsed.endpoint,
+                    key,
+                    running: false,
+                    tasks: [],
+                    unavailable: err instanceof Error ? err.message : String(err),
+                });
+                seenProfiles.add(parsed.profile);
+                continue;
+            }
             if (status) {
                 statuses.push(status);
                 seenProfiles.add(status.name);
             }
         }
+        // Reported BEFORE the disk reconcile, and keyed by the runtime dir that
+        // actually failed. Reconcile reads the same `tasks.json`, so without this
+        // ordering one corrupt runtime produced two rows for the same profile: one
+        // keyed here and one unkeyed from reconcile, which the dedupe then missed.
+        for (const [key, message] of rehydrateErrors) {
+            const parsed = parseConnectionKey(key);
+            if (profileName && parsed.profile !== profileName)
+                continue;
+            if (statuses.some((status) => status.key === key))
+                continue;
+            statuses.push({
+                name: parsed.profile,
+                endpoint: parsed.endpoint,
+                key,
+                running: false,
+                tasks: [],
+                unavailable: message,
+            });
+            seenProfiles.add(parsed.profile);
+        }
+        // Disk reconcile reads `tasks.json` too, so it fails on exactly the same
+        // corrupt file — report that profile rather than let it empty the table.
+        const reconcile = async (name) => {
+            const failures = new Map();
+            let reconciled = null;
+            try {
+                reconciled = await this.reconcileFromDisk(name, (key, err) => {
+                    failures.set(key, err instanceof Error ? err.message : String(err));
+                });
+            }
+            catch (err) {
+                // Listing the profile's runtime dirs failed, so no single runtime is at
+                // fault and none is invented: this is reported at profile level.
+                statuses.push({
+                    name,
+                    running: false,
+                    tasks: [],
+                    unavailable: err instanceof Error ? err.message : String(err),
+                });
+                return;
+            }
+            if (reconciled)
+                statuses.push(reconciled);
+            // Keyed by the runtime dir that actually failed, so a profile with several
+            // runtimes names the unreadable one rather than guessing at the first.
+            for (const [key, message] of failures) {
+                if (statuses.some((status) => status.key === key))
+                    continue;
+                const parsed = parseConnectionKey(key);
+                statuses.push({
+                    name,
+                    endpoint: parsed.endpoint,
+                    key,
+                    running: false,
+                    tasks: [],
+                    unavailable: message,
+                });
+            }
+        };
         if (!profileName) {
             for (const profile of await listProfiles()) {
                 if (seenProfiles.has(profile.name))
                     continue;
-                const reconciled = await this.reconcileFromDisk(profile.name);
-                if (reconciled)
-                    statuses.push(reconciled);
+                await reconcile(profile.name);
             }
         }
         else if (statuses.length === 0) {
-            const reconciled = await this.reconcileFromDisk(profileName);
-            if (reconciled)
-                statuses.push(reconciled);
+            await reconcile(profileName);
         }
         return statuses;
     }
@@ -2239,14 +2331,27 @@ export class BrowserService {
      * ({@link listProfileCacheDirs}), including the legacy pre-composite dir named
      * exactly the profile.
      */
-    async reconcileFromDisk(profileName) {
+    async reconcileFromDisk(profileName, 
+    /**
+     * Read-only callers pass a sink so an unreadable runtime dir is attributed
+     * to the dir that actually failed, and the remaining dirs are still tried.
+     * Callers without a sink keep the strict behaviour.
+     */
+    onError) {
         const dirs = listProfileCacheDirs(profileName);
         for (const dir of dirs) {
             const key = asConnectionKey(path.basename(dir));
-            const info = getRunningChromeInfo(key);
-            if (!info)
-                continue;
-            return this.profileStatusFromDisk(profileName, key, info.port, info.pid);
+            try {
+                const info = getRunningChromeInfo(key);
+                if (!info)
+                    continue;
+                return await this.profileStatusFromDisk(profileName, key, info.port, info.pid);
+            }
+            catch (err) {
+                if (!onError)
+                    throw err;
+                onError(key, err);
+            }
         }
         return null;
     }
@@ -2771,6 +2876,12 @@ export class BrowserService {
                 await cdp.connect(wsUrl);
                 await this.enableDomains(cdp);
                 const tasks = this.loadTaskState(key);
+                // The attach is now PROVEN: the stored port answered /json/version and
+                // `verifyBrowserIdentity` matched the profile's browser family. Only here
+                // may this service claim a browser the startup reaper deliberately left
+                // alone — it rewrites `daemonPid` only, keeping the original launch's
+                // metadata. An ambiguous identity throws above and adopts nothing.
+                adoptProfileRuntimeOwner(key);
                 return {
                     backend: 'cdp',
                     cdp,
@@ -3339,7 +3450,13 @@ export class BrowserService {
      * Returns null when nothing is speaking CDP so callers can fall through
      * to disk reconcile.
      */
-    async attachRunningProfile(key, diskTasks) {
+    async attachRunningProfile(key, diskTasks, 
+    /**
+     * Shared Arc liveness for one status pass; each saved Arc runtime used to
+     * probe on its own. Callers with no pass to share pass nothing and probe
+     * directly, as before.
+     */
+    arcRunning) {
         const { profile: bare, endpoint: endpointFromKey } = parseConnectionKey(key);
         const profile = await getProfile(bare);
         if (!profile)
@@ -3363,7 +3480,7 @@ export class BrowserService {
         // is still running. No port, no CDP — just verify Arc is alive and restore
         // the task state.
         if (resolved.target.startsWith('arc-native:')) {
-            if (process.platform !== 'darwin' || !(await isArcRunning()))
+            if (process.platform !== 'darwin' || !(await (arcRunning ?? isArcRunning)()))
                 return null;
             const tasks = this.loadTaskState(key);
             for (const [k, t] of diskTasks) {
@@ -3398,6 +3515,10 @@ export class BrowserService {
             const port = parseEndpointUrl(resolved.target)?.port ?? 9600;
             try {
                 const ff = await connectFirefox(profile, key, port, { profileDir: profile.userDataDir });
+                // A served port that accepted a fresh BiDi session is this profile's own
+                // Firefox, so claim the record for this daemon (see the local-CDP claim
+                // below for why adoption waits for a proven attach).
+                adoptProfileRuntimeOwner(key);
                 const tasks = this.loadTaskState(key);
                 for (const [k, t] of diskTasks) {
                     if (!tasks.has(k))
@@ -3476,6 +3597,14 @@ export class BrowserService {
             const cdp = new CDPClient();
             await cdp.connect(wsUrl);
             await this.enableDomains(cdp);
+            // This is the path a replacement daemon takes to recover a browser its
+            // predecessor launched, so it is where ownership actually transfers. Only
+            // now — after `verifyBrowserIdentity` confirmed the browser family on the
+            // recorded port and CDP is attached — is it proven that this record
+            // describes a browser we are driving. `adoptProfileRuntimeOwner` rewrites
+            // `daemonPid` alone; an ambiguous identity throws above and adopts
+            // nothing, leaving the record (and the browser) untouched.
+            adoptProfileRuntimeOwner(key);
             const tasks = this.loadTaskState(key);
             for (const [k, t] of diskTasks) {
                 if (!tasks.has(k))
@@ -3555,7 +3684,14 @@ export class BrowserService {
         }
         return existing;
     }
-    async rehydrateAllFromDisk() {
+    async rehydrateAllFromDisk(arcRunning, 
+    /**
+     * Read-only callers pass a sink to make rehydration per-runtime: one saved
+     * dir that cannot be read (corrupt `tasks.json`, an Arc Apple Event that
+     * times out) is reported through this instead of aborting the pass. Callers
+     * without a sink keep the strict behaviour and the error propagates.
+     */
+    onError) {
         const runtimeRoot = getBrowserRuntimeDir();
         let dirNames = [];
         try {
@@ -3579,24 +3715,31 @@ export class BrowserService {
             // Skip non-runtime dirs (e.g. profiles/)
             if (dirName === 'profiles' || dirName === 'sessions' || dirName === 'exports')
                 continue;
-            const tasks = this.loadTaskState(key);
-            if (tasks.size === 0)
-                continue;
-            // Soft attach only — never launch / never clear pid files.
-            const conn = await this.attachRunningProfile(key, tasks);
-            if (!conn)
-                continue;
-            // A concurrent rehydrate may have registered one for this key while we
-            // awaited the attach; keep the winner and tear our loser's tunnel down.
-            const registered = this.registerRehydratedConnection(key, conn);
-            if (registered !== conn)
-                continue;
             try {
-                if (conn.backend !== 'arc-native' && conn.backend !== 'bidi')
-                    await this.applyDefaultDownloadBehavior(conn, key);
+                const tasks = this.loadTaskState(key);
+                if (tasks.size === 0)
+                    continue;
+                // Soft attach only — never launch / never clear pid files.
+                const conn = await this.attachRunningProfile(key, tasks, arcRunning);
+                if (!conn)
+                    continue;
+                // A concurrent rehydrate may have registered one for this key while we
+                // awaited the attach; keep the winner and tear our loser's tunnel down.
+                const registered = this.registerRehydratedConnection(key, conn);
+                if (registered !== conn)
+                    continue;
+                try {
+                    if (conn.backend !== 'arc-native' && conn.backend !== 'bidi')
+                        await this.applyDefaultDownloadBehavior(conn, key);
+                }
+                catch {
+                    // Non-fatal for rehydrate.
+                }
             }
-            catch {
-                // Non-fatal for rehydrate.
+            catch (err) {
+                if (!onError)
+                    throw err;
+                onError(key, err);
             }
         }
     }
@@ -3688,14 +3831,29 @@ export class BrowserService {
         return tabs;
     }
     /** Live status for ONE registered connection, addressed by its runtime key. */
-    async getProfileStatus(key) {
+    async getProfileStatus(key, arc) {
         const conn = this.connections.get(key);
         if (!conn)
             return null;
         if (conn.backend === 'arc-native') {
+            // One snapshot and one liveness read for the whole pass, shared across
+            // every task and every Arc profile (built in `status`).
+            const spaces = arc?.spaces ?? onceAsync(() => enumerateArcSpaces());
+            const running = arc?.running ?? onceAsync(() => isArcRunning());
             const tasks = [];
             for (const task of conn.tasks.values()) {
-                const tabs = await this.listArcTaskTabs(task);
+                // The moved-tab refusal is the ownership guarantee actions rely on and
+                // stays strict. `status` only reads, so one stale task must not take down
+                // its neighbours: report what disk knows plus the reason, and leave
+                // `tabs` ABSENT rather than empty so nothing claims a moved tab is live.
+                let tabs = [];
+                let unavailable;
+                try {
+                    tabs = await this.listArcTaskTabsFromSnapshot(task, spaces);
+                }
+                catch (err) {
+                    unavailable = err instanceof Error ? err.message : String(err);
+                }
                 const domains = tabs.flatMap((tab) => {
                     try {
                         const domain = new URL(tab.url).hostname.replace(/^www\./, '');
@@ -3714,6 +3872,7 @@ export class BrowserService {
                     createdAt: task.createdAt,
                     tabs: tabs.length ? tabs : undefined,
                     domains: [...new Set(domains)],
+                    unavailable,
                 });
             }
             const parsed = parseConnectionKey(key);
@@ -3721,7 +3880,7 @@ export class BrowserService {
                 name: conn.profile ?? parsed.profile,
                 endpoint: parsed.endpoint,
                 key,
-                running: await isArcRunning(),
+                running: await running(),
                 port: 0,
                 pid: 0,
                 tasks,
@@ -4197,6 +4356,39 @@ export class BrowserService {
         }
         return executeJavaScript(ref, expression);
     }
+    /**
+     * Resolve a task's owned Arc tabs against one shared snapshot of every
+     * window/space/tab, rather than asking Arc per tab as `listArcTaskTabs` does.
+     *
+     * Same ownership rule as the live path — `requireArcTask`, then the recorded
+     * ref must be present in its original window and Space. The snapshot changes
+     * how often Arc is asked, never what counts as owned. Actions keep the live
+     * path, because a snapshot can go stale before it is acted on.
+     */
+    async listArcTaskTabsFromSnapshot(task, spaces) {
+        // Before the snapshot on purpose: a ref naming a window its task does not
+        // own is a moved tab on the record alone, so it needs no round trip and
+        // reports the right reason even when Arc is unreachable.
+        const native = this.requireArcTask(task);
+        const snapshot = await spaces();
+        const tabs = [];
+        for (const [shortId, ref] of Object.entries(native.tabs)) {
+            const live = snapshot
+                .find((space) => space.windowId === ref.windowId && space.spaceId === ref.spaceId)
+                ?.tabs.find((tab) => tab.tabId === ref.tabId);
+            if (!live) {
+                throw new Error(`Owned Arc tab ${shortId} is missing from its original window/Space; refusing to adopt a moved tab.`);
+            }
+            tabs.push({
+                id: shortId,
+                url: live.url,
+                title: live.title,
+                task: task.name,
+                current: shortId === task.currentTabId,
+            });
+        }
+        return tabs;
+    }
     async listArcTaskTabs(task) {
         const native = this.requireArcTask(task);
         const tabs = [];

package/dist/lib/browser/types.d.ts

@@ -358,6 +358,15 @@ export interface ProfileStatus {
     /** The port declared in the profile's first endpoint, when it differs from the running port. */
     configuredPort?: number;
     tasks: TaskStatus[];
+    /**
+     * Why this profile's live state could not be read, when it could not be.
+     *
+     * `status` is read-only, so one unreadable profile must not hide the others:
+     * the profile is still listed, with what is known from disk, and this says
+     * what is missing. Absent means the read succeeded — it is never set to paper
+     * over a failure that did not happen.
+     */
+    unavailable?: string;
 }
 export interface TaskStatus {
     id: string;
@@ -376,6 +385,15 @@ export interface TaskStatus {
         current?: boolean;
         task?: string;
     }>;
+    /**
+     * Why this task's live tabs could not be enumerated, when they could not be.
+     *
+     * Set together with an ABSENT {@link tabs} — the recorded {@link tabCount}
+     * still reports what the task owns on disk, but nothing claims those tabs are
+     * live, because that is exactly what could not be verified. An Arc tab moved
+     * to another window or Space is the case this exists for.
+     */
+    unavailable?: string;
 }
 export interface HistoricalTask {
     id: string;

package/dist/lib/cli-resources.js

@@ -23,6 +23,7 @@ import * as yaml from 'yaml';
 import { listResources, resolveResource } from './resources.js';
 import { probeCapture } from './probe.js';
 import { composeWin32CommandLine } from './platform/index.js';
+import { execFileShellSpec } from './platform/exec.js';
 import { localBinDir } from './platform/posixpath.js';
 // ─── Validation primitives ───────────────────────────────────────────────────
 /** Token allowed inside `check:` strings — letters, digits, underscore, dot, slash, dash. */
@@ -457,7 +458,8 @@ export function buildInstallCommand(method) {
 function runInstallMethod(method) {
     if ('npm' in method) {
         assertNpmPackage(method.npm);
-        const r = spawnSync('npm', ['install', '-g', method.npm], { stdio: 'inherit' });
+        const invocation = execFileShellSpec('npm', ['install', '-g', method.npm]);
+        const r = spawnSync(invocation.command, invocation.args, { stdio: 'inherit', shell: invocation.shell });
         if (r.status !== 0) {
             throw new Error(`npm install -g ${method.npm} exited with status ${r.status ?? 'unknown'}`);
         }

package/dist/lib/cloud/dispatch.js

@@ -16,7 +16,7 @@ import { insertTask, updateTaskStatus } from './store.js';
 import { renderStream } from './stream.js';
 import { MissingTargetError, MAX_IMAGES_PER_DISPATCH } from './types.js';
 import { emit } from '../feed/events.js';
-import { shareRuntimeEnv } from '../share/config.js';
+import { shareRuntimeEnv } from '../share-runtime.js';
 /** Map a supported image file extension to its wire mimeType. Rejects anything else. */
 function imageMimeFromPath(file) {
     const ext = path.extname(file).toLowerCase();

package/dist/lib/cloudflare/creds.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_CF_BUNDLE = "cloudflare";
+/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
+ * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
+export declare function readCloudflareCreds(bundle?: string, override?: {
+    apiToken?: string;
+    accountId?: string;
+}): {
+    apiToken: string;
+    accountId: string;
+};