@pi-harness/pi-harness 0.1.23 → 0.1.25

package/packages/api-gateway/test/packed-package.test.ts

@@ -0,0 +1,70 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, it } from "vitest";
+
+const execFileAsync = promisify(execFile);
+const fixtures: string[] = [];
+const repositoryRoot = resolve(import.meta.dirname, "../../..");
+
+// Stands in for npm so the smoke test can be exercised without packing and globally installing the real workspace: `pack` reports tarball names and `install` lays out
+// the tree the script inspects, optionally without the files the root bin map points at.
+const fakeNpmSource = `import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import process from "node:process";
+
+const args = process.argv.slice(2);
+if (args[0] === "pack") {
+  process.stdout.write(args.includes("--workspace") ? "core.tgz\\n" : "harness.tgz\\n");
+  process.exit(0);
+}
+if (args[0] !== "install") process.exit(1);
+const prefix = args[args.indexOf("--prefix") + 1];
+const harnessRoot = join(prefix, "lib", "node_modules", "@pi-harness", "pi-harness");
+const agentRoot = join(harnessRoot, "node_modules", "@earendil-works", "pi-coding-agent");
+const write = (path, content) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content);
+};
+const bin = { "pi-harness": "./apps/web/server-dist/bin.js", pih: "./packages/cli/dist/bin.js" };
+write(join(harnessRoot, "package.json"), JSON.stringify({ name: "@pi-harness/pi-harness", version: "9.9.9", bin, dependencies: { "@earendil-works/pi-coding-agent": "0.84.4" } }));
+write(join(agentRoot, "package.json"), JSON.stringify({ name: "@earendil-works/pi-coding-agent", version: "0.84.4", dependencies: {} }));
+write(join(agentRoot, "dist", "cli", "args.js"), "");
+if (process.env.PACKED_PACKAGE_FIXTURE_BINS === "1") for (const target of Object.values(bin)) write(join(harnessRoot, target), "");
+`;
+
+const createFakeNpm = async (): Promise<string> => {
+  const fixture = await mkdtemp(resolve(tmpdir(), "pi-harness-packed-package-fixture-"));
+  fixtures.push(fixture);
+  const fakeNpm = resolve(fixture, "npm.mjs");
+  await writeFile(fakeNpm, fakeNpmSource);
+  return fakeNpm;
+};
+
+const runSmokeTest = async (fakeNpm: string, bins: boolean): ReturnType<typeof execFileAsync> =>
+  execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/test-packed-package.mjs")], {
+    env: { ...process.env, npm_execpath: fakeNpm, PACKED_PACKAGE_FIXTURE_BINS: bins ? "1" : "0" },
+  });
+
+afterEach(async () => {
+  await Promise.all(fixtures.splice(0).map((fixture) => rm(fixture, { recursive: true, force: true })));
+});
+
+describe("packed package smoke test", () => {
+  it("accepts a tarball whose bin entrypoints are present", async () => {
+    const fakeNpm = await createFakeNpm();
+
+    const { stdout } = await runSmokeTest(fakeNpm, true);
+
+    expect(stdout).toContain("Packed package smoke test passed");
+  });
+
+  it("rejects a tarball that ships no runnable bin entrypoint", async () => {
+    // `npm pack --ignore-scripts` never runs prepack, so an unbuilt workspace produces a tarball with a bin map pointing at files the tarball does not contain.
+    const fakeNpm = await createFakeNpm();
+
+    await expect(runSmokeTest(fakeNpm, false)).rejects.toThrow(/missing the pi-harness entrypoint \.\/apps\/web\/server-dist\/bin\.js/u);
+  });
+});

package/packages/api-gateway/test/reference-docs.test.ts

@@ -0,0 +1,50 @@
+import { readdir, readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const repositoryRoot = resolve(import.meta.dirname, "../../..");
+
+const readText = async (path: string): Promise<string> => readFile(resolve(repositoryRoot, path), "utf8");
+
+// The number of built-in plugins that `docs/README.reference.md` still has no `###` section for. It may only ever go down.
+const undocumentedBudget = 53;
+
+describe("reference documentation", () => {
+  it("documents every registered API route", async () => {
+    // The reference is the inventory a reader audits the unauthenticated local port with, so an undocumented route is an invisible attack surface.
+    const gateway = await readText("packages/api-gateway/src/index.ts");
+    const reference = await readText("docs/README.reference.md");
+    const routes = [...gateway.matchAll(/path: "(\/api[^"]*)"/gu)].map((match) => match[1] ?? "");
+
+    expect(routes.length).toBeGreaterThan(0);
+    for (const route of routes) expect(reference, `${route} is not documented`).toContain(`\`${route}\``);
+  });
+
+  it("claims documentation coverage only for the plugins it actually describes", async () => {
+    const readme = await readText("README.md");
+    const reference = await readText("docs/README.reference.md");
+    const sections = new Set([...reference.matchAll(/^### (.+)$/gmu)].map((match) => (match[1] ?? "").toLowerCase().replaceAll(/[^a-z]/gu, "")));
+    const plugins = (await readdir(resolve(repositoryRoot, "packages/core/src/plugins"), { withFileTypes: true }))
+      .filter((entry) => entry.isFile() && entry.name.endsWith(".ts"))
+      .map((entry) => entry.name.replace(/\.ts$/u, "").replaceAll("-", ""));
+    const undocumented = plugins.filter((plugin) => !sections.has(plugin));
+
+    // A ratchet, not a floor: documenting more plugins only lowers the count, while a plugin that arrives without a reference section pushes it over the budget. Lower the budget whenever it drops.
+    expect(undocumented.length, `undocumented built-in plugins: ${undocumented.join(", ")}`).toBeLessThanOrEqual(undocumentedBudget);
+    expect(readme).not.toMatch(/documents every built-in plugin/u);
+    expect(reference).not.toMatch(/canonical reference for the complete plugin catalog/u);
+  });
+
+  it("documents the model the shipped web profile actually selects", async () => {
+    const profile = await readText("apps/web/profile/cordis.yml");
+    const reference = await readText("docs/README.reference.md");
+    const readme = await readText("README.md");
+    const provider = /provider: .*\?\? '([^']+)'/u.exec(profile)?.[1];
+    const model = /model: .*\?\? '([^']+)'/u.exec(profile)?.[1];
+
+    expect(provider).toBeDefined();
+    expect(model).toBeDefined();
+    expect(reference).toContain(`\`${provider ?? ""}/${model ?? ""}\``);
+    for (const variable of ["PI_HARNESS_PROVIDER", "PI_HARNESS_MODEL"]) expect(readme, `${variable} is undocumented`).toContain(variable);
+  });
+});

package/packages/api-gateway/test/release-package.test.ts

@@ -1,4 +1,4 @@
-import { readFile } from "node:fs/promises";
+import { readdir, readFile, stat } from "node:fs/promises";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
@@ -35,4 +35,35 @@ describe("release package", () => {
     expect(workflow).toContain("Verify package availability");
     expect(workflow).not.toContain("RELEASE_TAG_EXISTS");
   });
+
+  it("cleans every compiled workspace output", async () => {
+    // `tsc` never removes stale emit, so an output directory that no clean script touches keeps publishing files whose sources are gone.
+    const rootManifest = await readJson("package.json");
+    const rootClean = (rootManifest.scripts as Record<string, string>).clean ?? "";
+    const outputs: string[] = [];
+
+    for (const root of ["packages", "apps", "examples"]) {
+      for (const entry of await readdir(resolve(repositoryRoot, root), { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const workspace = `${root}/${entry.name}`;
+        const buildConfigPath = resolve(repositoryRoot, workspace, "tsconfig.build.json");
+        const hasBuildConfig = await stat(buildConfigPath).then(
+          () => true,
+          () => false,
+        );
+        if (!hasBuildConfig) continue;
+        const buildConfig = JSON.parse(await readFile(buildConfigPath, "utf8")) as { compilerOptions?: { outDir?: string } };
+        const outDir = buildConfig.compilerOptions?.outDir;
+        expect(outDir, `${workspace}/tsconfig.build.json declares no outDir`).toBeDefined();
+        const workspaceManifest = await readJson(`${workspace}/package.json`);
+        const workspaceClean = (workspaceManifest.scripts as Record<string, string> | undefined)?.clean;
+        outputs.push(`${workspace}/${outDir ?? ""}`);
+        expect(workspaceClean !== undefined || rootClean.includes(`${workspace}/${outDir ?? ""}`), `${workspace}/${outDir ?? ""} survives npm run clean`).toBe(
+          true,
+        );
+      }
+    }
+
+    expect(outputs.length).toBeGreaterThan(0);
+  });
 });

package/packages/api-gateway/test/release-version.test.ts

@@ -78,4 +78,44 @@ describe("release version preparation", () => {
     expect(packedInternalEntry.version).toBe("0.1.3");
     expect(packedExternalEntry.version).toBe("4.5.6");
   });
+
+  it("re-runs against a checkout that already carries the release version", async () => {
+    // A re-dispatched release run checks out the release commit, so every manifest and marketplace entry already holds the requested version.
+    const fixture = await mkdtemp(resolve(tmpdir(), "pi-harness-release-version-"));
+    fixtures.push(fixture);
+    await Promise.all([mkdir(resolve(fixture, "apps")), mkdir(resolve(fixture, "examples"))]);
+    await writeJson(fixture, "package.json", { name: "@pi-harness/pi-harness", version: "0.1.3", dependencies: { "@pi-harness/core": "^0.1.3" } });
+    await writeJson(fixture, "packages/core/package.json", { name: "@pi-harness/core", version: "0.1.3" });
+    await writeJson(fixture, "packages/api-gateway/package.json", { name: "@pi-harness/api-gateway", version: "0.1.3" });
+    await writeJson(fixture, "package-lock.json", {
+      name: "@pi-harness/pi-harness",
+      version: "0.1.3",
+      lockfileVersion: 3,
+      packages: { "": { name: "@pi-harness/pi-harness", version: "0.1.3", dependencies: { "@pi-harness/core": "^0.1.3" } } },
+    });
+    const formattedInternalEntry = `{\n  "packageName": "@pi-harness/core/plugins/example",\n  "version": "0.1.3",\n  "hooks": ["tool", "panel"]\n}\n`;
+    await mkdir(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official"), { recursive: true });
+    await writeFile(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json"), formattedInternalEntry);
+
+    await execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/set-release-version.mjs"), "0.1.3"], { cwd: fixture });
+
+    expect(await readFile(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json"), "utf8")).toBe(formattedInternalEntry);
+    expect(await readFile(resolve(fixture, "packages/api-gateway/dist/marketplace-entries/official/internal.json"), "utf8")).toBe(formattedInternalEntry);
+  });
+
+  it("rejects an internal marketplace entry without a top-level version field", async () => {
+    const fixture = await mkdtemp(resolve(tmpdir(), "pi-harness-release-version-"));
+    fixtures.push(fixture);
+    await Promise.all([mkdir(resolve(fixture, "apps")), mkdir(resolve(fixture, "examples"))]);
+    await writeJson(fixture, "package.json", { name: "@pi-harness/pi-harness", version: "0.1.2" });
+    await writeJson(fixture, "packages/core/package.json", { name: "@pi-harness/core", version: "0.1.2" });
+    await writeJson(fixture, "packages/api-gateway/package.json", { name: "@pi-harness/api-gateway", version: "0.1.2" });
+    await writeJson(fixture, "package-lock.json", { name: "@pi-harness/pi-harness", version: "0.1.2", lockfileVersion: 3, packages: {} });
+    await mkdir(resolve(fixture, "packages/api-gateway/src/marketplace-entries/official"), { recursive: true });
+    await writeJson(fixture, "packages/api-gateway/src/marketplace-entries/official/internal.json", { packageName: "@pi-harness/core/plugins/example" });
+
+    await expect(execFileAsync(process.execPath, [resolve(repositoryRoot, "scripts/set-release-version.mjs"), "0.1.3"], { cwd: fixture })).rejects.toThrow(
+      /has no top-level version field to update/u,
+    );
+  });
 });

package/packages/bundle-web-app/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAeD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;AAI7E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,eAA8B,GAAG,OAAO,CAGpH;;;;mBAwBgB,OAAO,UAAU,YAAY;;AAH9C,wBAsBE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAwBD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;AAI7E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,eAA8B,GAAG,OAAO,CAGpH;;;;mBAwBgB,OAAO,UAAU,YAAY;;AAH9C,wBAuBE"}

package/packages/bundle-web-app/dist/index.js

@@ -8,7 +8,14 @@ const MIME_TYPES = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
     ".json": "application/json; charset=utf-8",
+    ".png": "image/png",
     ".svg": "image/svg+xml",
+    ".webmanifest": "application/manifest+json",
+};
+// The console renders model- and tool-produced markdown through dangerouslySetInnerHTML, so a CSP is the second line of defence behind the sanitizer: a bypass still cannot load a remote script or exfiltrate to another origin. frame-ancestors keeps any page the operator visits from framing the unauthenticated console, which the Host/Origin guard cannot block because browsers send no Origin on a frame navigation. Inline styles stay allowed because React writes element style attributes; nosniff is safe because every extension the bundle ships has an entry in MIME_TYPES.
+const SECURITY_HEADERS = {
+    "content-security-policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "x-content-type-options": "nosniff",
 };
 function contentType(path) {
     const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
@@ -30,7 +37,7 @@ async function sendFile(path, response) {
     const info = await stat(path);
     if (!info.isFile())
         throw new Error("Not a file");
-    response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache" });
+    response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache", ...SECURITY_HEADERS });
     await pipeline(createReadStream(path), response);
 }
 async function sendSafeFile(root, path, response) {
@@ -55,8 +62,10 @@ export default {
                     await sendSafeFile(root, requested, response);
                     return;
                 }
-                catch {
-                    // SPA fallback below.
+                catch (error) {
+                    // SPA fallback below, but only while nothing has reached the wire: once sendFile has written the 200 header the request is committed to that file, so a second writeHead would throw ERR_HTTP_HEADERS_SENT over the real failure.
+                    if (response.headersSent)
+                        throw error;
                 }
             }
             await sendSafeFile(root, index, response);

package/packages/bundle-web-app/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAqB,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,4BAA4B,CAAC;AAMpC,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAC7D,CAAC;AAGD,MAAM,YAAY,GAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAEpE,mOAAmO;AACnO,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAiB,EAAE,UAA2B,YAAY;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,SAAS,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACjI,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAwB;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACzH,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,QAAwB;IAC9E,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7F,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,eAAe;IACb,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,KAAK,CAAC,OAAgB,EAAE,MAAoB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAqB,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,4BAA4B,CAAC;AAMpC,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,cAAc,EAAE,2BAA2B;CAC5C,CAAC;AAEF,8jBAA8jB;AAC9jB,MAAM,gBAAgB,GAAG;IACvB,yBAAyB,EACvB,mPAAmP;IACrP,wBAAwB,EAAE,SAAS;CAC3B,CAAC;AAEX,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAC7D,CAAC;AAGD,MAAM,YAAY,GAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAEpE,mOAAmO;AACnO,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAiB,EAAE,UAA2B,YAAY;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,SAAS,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACjI,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAwB;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;IAC9I,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,QAAwB;IAC9E,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7F,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,eAAe;IACb,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,KAAK,CAAC,OAAgB,EAAE,MAAoB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kOAAkO;oBAClO,IAAI,QAAQ,CAAC,WAAW;wBAAE,MAAM,KAAK,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACF,CAAC"}

package/packages/bundle-web-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/web-app",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "private": true,
   "description": "Patchable Web application bundle for Pi Harness",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/packages/bundle-web-app/src/index.ts

@@ -15,9 +15,18 @@ const MIME_TYPES: Record<string, string> = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
   ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
   ".svg": "image/svg+xml",
+  ".webmanifest": "application/manifest+json",
 };
 
+// The console renders model- and tool-produced markdown through dangerouslySetInnerHTML, so a CSP is the second line of defence behind the sanitizer: a bypass still cannot load a remote script or exfiltrate to another origin. frame-ancestors keeps any page the operator visits from framing the unauthenticated console, which the Host/Origin guard cannot block because browsers send no Origin on a frame navigation. Inline styles stay allowed because React writes element style attributes; nosniff is safe because every extension the bundle ships has an entry in MIME_TYPES.
+const SECURITY_HEADERS = {
+  "content-security-policy":
+    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+  "x-content-type-options": "nosniff",
+} as const;
+
 function contentType(path: string): string {
   const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
   return MIME_TYPES[extension] ?? "application/octet-stream";
@@ -41,7 +50,7 @@ function safePath(root: string, pathname: string): string | undefined {
 async function sendFile(path: string, response: ServerResponse): Promise<void> {
   const info = await stat(path);
   if (!info.isFile()) throw new Error("Not a file");
-  response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache" });
+  response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache", ...SECURITY_HEADERS });
   await pipeline(createReadStream(path), response);
 }
 
@@ -65,8 +74,9 @@ export default {
         try {
           await sendSafeFile(root, requested, response);
           return;
-        } catch {
-          // SPA fallback below.
+        } catch (error) {
+          // SPA fallback below, but only while nothing has reached the wire: once sendFile has written the 200 header the request is committed to that file, so a second writeHead would throw ERR_HTTP_HEADERS_SENT over the real failure.
+          if (response.headersSent) throw error;
         }
       }
       await sendSafeFile(root, index, response);

package/packages/bundle-web-app/test/index.test.ts

@@ -1,13 +1,52 @@
-import { mkdtemp, symlink, writeFile } from "node:fs/promises";
+import { chmod, mkdtemp, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, posix, win32 } from "node:path";
+import { PassThrough } from "node:stream";
 import { Context } from "@deepseek-ai/cordis";
 import { afterEach, describe, expect, test } from "vitest";
-import webServerPlugin from "@pi-harness/host-webserver";
+import webServerPlugin, { type WebRoute, type WebServer } from "@pi-harness/host-webserver";
 import webAppPlugin, { isInsideStaticRoot } from "../src/index.js";
+import type { IncomingMessage, ServerResponse } from "node:http";
 
 const contexts: Context[] = [];
 
+// A response that records every writeHead and rejects a second one exactly like node:http, so a failure raised after the headers are on the wire is observable without a socket.
+type MockResponse = PassThrough & { headersSent: boolean; writeHead: (status: number, headers?: unknown) => MockResponse };
+
+function mockResponse(): { response: ServerResponse; statuses: number[] } {
+  const stream = new PassThrough() as MockResponse;
+  stream.resume();
+  const statuses: number[] = [];
+  stream.headersSent = false;
+  stream.writeHead = (status) => {
+    if (stream.headersSent) throw Object.assign(new Error("Cannot write headers after they are sent to the client"), { code: "ERR_HTTP_HEADERS_SENT" });
+    stream.headersSent = true;
+    statuses.push(status);
+    return stream;
+  };
+  return { response: stream as unknown as ServerResponse, statuses };
+}
+
+// Captures the fallback the web app registers so it can be driven with a mock response instead of a real socket.
+function provideFakeWebServer(context: Context): { current: WebRoute["handler"] | undefined } {
+  const captured: { current: WebRoute["handler"] | undefined } = { current: undefined };
+  const service: WebServer = {
+    host: "127.0.0.1",
+    port: 3141,
+    url: "http://127.0.0.1:3141",
+    register: () => () => {},
+    registerFallback(handler) {
+      captured.current = handler;
+      return () => {
+        captured.current = undefined;
+      };
+    },
+    close: async () => {},
+  };
+  context.provide("webServer", service);
+  return captured;
+}
+
 afterEach(async () => {
   await Promise.all(contexts.splice(0).map(async (context) => context.fiber.dispose()));
 });
@@ -26,6 +65,48 @@ describe("web app plugin", () => {
     await expect(fetch(context.webServer.url + "/missing-route").then((response) => response.text())).resolves.toBe("<main>console</main>");
     await expect(fetch(context.webServer.url + "/leak").then((response) => response.text())).resolves.toBe("<main>console</main>");
   });
+
+  test("sends a content security policy and a declared content type with every static response", async () => {
+    const root = await mkdtemp(join(tmpdir(), "pi-harness-web-root-"));
+    await writeFile(join(root, "index.html"), "<main>console</main>", "utf8");
+    await writeFile(join(root, "icon.png"), Buffer.from("89504e470d0a1a0a", "hex"));
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    await context.plugin(webAppPlugin, { staticDir: root });
+
+    const page = await fetch(context.webServer.url + "/");
+    expect(page.headers.get("x-content-type-options")).toBe("nosniff");
+    const policy = page.headers.get("content-security-policy") ?? "";
+    expect(policy).toContain("default-src 'self'");
+    expect(policy).toContain("script-src 'self'");
+    expect(policy).toContain("object-src 'none'");
+    expect(policy).toContain("frame-ancestors 'none'");
+
+    const icon = await fetch(context.webServer.url + "/icon.png");
+    expect(icon.headers.get("content-type")).toBe("image/png");
+    expect(icon.headers.get("x-content-type-options")).toBe("nosniff");
+  });
+
+  test("reports a read failure raised after the headers are sent instead of writing the SPA fallback over it", async () => {
+    const root = await mkdtemp(join(tmpdir(), "pi-harness-web-root-"));
+    await writeFile(join(root, "index.html"), "<main>console</main>", "utf8");
+    await writeFile(join(root, "locked.js"), "export const value = 1;\n", "utf8");
+    await chmod(join(root, "locked.js"), 0o000);
+    const context = new Context();
+    contexts.push(context);
+    const fallback = provideFakeWebServer(context);
+    await context.plugin(webAppPlugin, { staticDir: root });
+    expect(fallback.current).toBeDefined();
+
+    const locked = mockResponse();
+    await expect(fallback.current?.({ url: "/locked.js" } as IncomingMessage, locked.response)).rejects.toThrow(/EACCES/);
+    expect(locked.statuses).toEqual([200]);
+
+    const missing = mockResponse();
+    await expect(fallback.current?.({ url: "/missing-route" } as IncomingMessage, missing.response)).resolves.toBeUndefined();
+    expect(missing.statuses).toEqual([200]);
+  });
 });
 
 describe("static root containment", () => {

package/packages/cli/dist/main.d.ts

@@ -12,5 +12,6 @@ export interface CliEnvironment {
     forceExit(code: number): void;
     onSignal(listener: (signal: NodeJS.Signals) => void): () => void;
 }
+export declare const DUPLICATE_SIGNAL_WINDOW_MS = 50;
 export declare function runCli(_args: readonly string[], _environment: CliEnvironment): Promise<number>;
 //# sourceMappingURL=main.d.ts.map

package/packages/cli/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAMtD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAClE;AAmCD,wBAAsB,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2KpG"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAMtD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAClE;AAgCD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAM7C,wBAAsB,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmLpG"}

package/packages/cli/dist/main.js

@@ -28,6 +28,8 @@ application plugin. The bundled stdio application reads its prompt from --prompt
 with a dash.
 `;
 const FLUSH_TIMEOUT_MS = 2_000;
+// A terminal broadcasts Ctrl-C to the whole foreground process group, so under `pih --profile development` this process receives SIGINT twice: once from the terminal and once relayed by the supervisor, measured under a millisecond apart. 50ms is far above that relay latency and far below the hundreds of milliseconds between two deliberate key presses, so a repeat inside the window is one keypress delivered twice and a repeat after it is still a force-quit request.
+export const DUPLICATE_SIGNAL_WINDOW_MS = 50;
 function signalExitCode(signal) {
     return signal === "SIGINT" ? 130 : signal === "SIGHUP" ? 129 : 143;
 }
@@ -98,8 +100,17 @@ export async function runCli(_args, _environment) {
     const startupAbort = new AbortController();
     const stdio = new NodeStdio(environment.stdin, environment.stdout, environment.stderr);
     let signalCount = 0;
+    let lastSignal;
+    let lastSignalAt = 0;
     const removeSignals = environment.onSignal((signal) => {
         const code = signalExitCode(signal);
+        // performance.now() is monotonic, so a clock adjustment cannot turn a duplicate into a force-quit or the reverse.
+        const receivedAt = performance.now();
+        // The window is measured from the first delivery, not the previous one, so a burst cannot postpone the force-quit indefinitely.
+        if (signal === lastSignal && receivedAt - lastSignalAt < DUPLICATE_SIGNAL_WINDOW_MS)
+            return;
+        lastSignal = signal;
+        lastSignalAt = receivedAt;
         signalCount += 1;
         if (signalCount > 1) {
             environment.stderr.write(`Received ${signal} again; exiting immediately\n`);

package/packages/cli/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAsB,MAAM,kBAAkB,CAAC;AACtJ,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAkB7D,KAAK,UAAU,YAAY,CAAI,OAAmB,EAAE,SAAiB;IACnE,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QAC1D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,IAAI,KAAK,KAAK,SAAS;QAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,GAAG;;;wDAGsC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;CAUlF,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,SAAS,cAAc,CAAC,MAAsB;IAC5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAE,YAA4B;IACjF,MAAM,IAAI,GAAG,KAAK,CAAC;IACnB,MAAM,WAAW,GAAG,YAAY,CAAC;IACjC,IAAI,UAAgD,CAAC;IACrD,IAAI,CAAC;QACH,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,oBAAoB,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;YAC/H,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC9C,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC;iBAC3C,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,MAAM,KAAK,SAAS;oBAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAkC,CAAC;IACvC,IAAI,UAA8B,CAAC;IACnC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,KAAK;YAAE,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC/D,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,IAAI,aAAmD,CAAC;IACxD,MAAM,oBAAoB,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3D,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,aAAmD,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACpD,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,WAAW,IAAI,CAAC,CAAC;QACjB,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,+BAA+B,CAAC,CAAC;YAC5E,KAAK,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,WAAW,GAAyB,WAAW,CAAC;YACpD,UAAU;YACV,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,YAAY;gBACV,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBACpC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;oBACrI,OAAO;gBACT,CAAC;gBACD,aAAa,EAAE,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,OAAO;gBACb,oBAAoB,CAAC,OAAO,EAAE;oBAC5B,GAAG,EAAE,WAAW,CAAC,GAAG;oBACpB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,CAAC,IAAI;wBACd,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;iBACF,CAAC,CAAC;gBACH,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;SACF,CAAC,CAAC,IAAI,CACL,CAAC,MAAM,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAC7D,CAAC,KAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,OAAO,OAAO,CAAC,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YACpE,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACzG,MAAM,aAAa,GAAG,IAAI,eAAe,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,cAAc;YACd,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;SACpE,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAClB,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE;oBACjB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3G,CAAC,CACF,EACD,WAAW,CAAC,iBAAiB,CAC9B,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,uFAAuF;YACvF,qFAAqF;YACrF,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,cAAc,CAAC,IAAI,CACjB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,EACD,WAAW,CAAC,iBAAiB,CAC9B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzG,UAAU,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,aAAa,EAAE,CAAC;QAChB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE;gBACjB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3G,CAAC,CACF,EACD,WAAW,CAAC,iBAAiB,CAC9B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAsB,MAAM,kBAAkB,CAAC;AACtJ,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAkB7D,KAAK,UAAU,YAAY,CAAI,OAAmB,EAAE,SAAiB;IACnE,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QAC1D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,IAAI,KAAK,KAAK,SAAS;QAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,GAAG;;;wDAGsC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;CAUlF,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,qdAAqd;AACrd,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,SAAS,cAAc,CAAC,MAAsB;IAC5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAE,YAA4B;IACjF,MAAM,IAAI,GAAG,KAAK,CAAC;IACnB,MAAM,WAAW,GAAG,YAAY,CAAC;IACjC,IAAI,UAAgD,CAAC;IACrD,IAAI,CAAC;QACH,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,oBAAoB,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;YAC/H,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC9C,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC;iBAC3C,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,MAAM,KAAK,SAAS;oBAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAkC,CAAC;IACvC,IAAI,UAA8B,CAAC;IACnC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;QACrD,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,KAAK;YAAE,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC/D,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,IAAI,aAAmD,CAAC;IACxD,MAAM,oBAAoB,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3D,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,aAAmD,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACpD,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAsC,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,kHAAkH;QAClH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACrC,gIAAgI;QAChI,IAAI,MAAM,KAAK,UAAU,IAAI,UAAU,GAAG,YAAY,GAAG,0BAA0B;YAAE,OAAO;QAC5F,UAAU,GAAG,MAAM,CAAC;QACpB,YAAY,GAAG,UAAU,CAAC;QAC1B,WAAW,IAAI,CAAC,CAAC;QACjB,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,+BAA+B,CAAC,CAAC;YAC5E,KAAK,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,WAAW,GAAyB,WAAW,CAAC;YACpD,UAAU;YACV,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,YAAY;gBACV,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBACpC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;oBACrI,OAAO;gBACT,CAAC;gBACD,aAAa,EAAE,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,OAAO;gBACb,oBAAoB,CAAC,OAAO,EAAE;oBAC5B,GAAG,EAAE,WAAW,CAAC,GAAG;oBACpB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,CAAC,IAAI;wBACd,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;iBACF,CAAC,CAAC;gBACH,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;SACF,CAAC,CAAC,IAAI,CACL,CAAC,MAAM,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAC7D,CAAC,KAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,OAAO,OAAO,CAAC,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YACpE,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACzG,MAAM,aAAa,GAAG,IAAI,eAAe,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,cAAc;YACd,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;SACpE,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAClB,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE;oBACjB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3G,CAAC,CACF,EACD,WAAW,CAAC,iBAAiB,CAC9B,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,uFAAuF;YACvF,qFAAqF;YACrF,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,cAAc,CAAC,IAAI,CACjB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,EACD,WAAW,CAAC,iBAAiB,CAC9B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzG,UAAU,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,aAAa,EAAE,CAAC;QAChB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE;gBACjB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3G,CAAC,CACF,EACD,WAAW,CAAC,iBAAiB,CAC9B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC"}

package/packages/cli/dist/relaunch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relaunch.d.ts","sourceRoot":"","sources":["../src/relaunch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAW/C,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsCvI;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQjH"}
+{"version":3,"file":"relaunch.d.ts","sourceRoot":"","sources":["../src/relaunch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAW/C,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqCvI;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQjH"}

package/packages/cli/dist/relaunch.js

@@ -18,12 +18,10 @@ export async function superviseDevelopmentProcess(command, args, options = {}) {
         const result = await new Promise((resolve, reject) => {
             const child = spawn(command, [...args], options);
             const signals = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
-            // The child inherits stdio and stays in the terminal's foreground process group, so on POSIX it already receives SIGINT and SIGHUP directly; forwarding them would make it count one Ctrl-C as a repeated signal and skip its graceful shutdown. Listeners are still registered for every signal so the supervisor stays alive to collect the child's exit code. SIGTERM is addressed to this pid alone and is the only one relayed.
-            const forwarded = new Set(process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGTERM"]);
+            // Every signal this supervisor receives is relayed to the child, which is what a signal addressed to this pid alone (`kill -INT`, a process manager, a `timeout` wrapper) needs: it reaches no other process, so without the relay the child keeps running while the supervisor waits for an exit that never comes. Registering a listener also keeps the supervisor alive past the default disposition so it can report the child's exit code. When a terminal broadcasts the signal to the shared foreground process group instead, the child receives it twice - once from the terminal, once from this relay - because nothing observable here separates a group broadcast from a pid-directed signal; a child that treats a repeated signal as a force-quit request has to collapse that pair itself, which `runCli` does with DUPLICATE_SIGNAL_WINDOW_MS in main.ts.
             const handlers = signals.map((signal) => {
                 const handler = () => {
-                    if (forwarded.has(signal))
-                        child.kill(signal);
+                    child.kill(signal);
                 };
                 process.on(signal, handler);
                 return { signal, handler };

package/packages/cli/dist/relaunch.js.map

@@ -1 +1 @@
-{"version":3,"file":"relaunch.js","sourceRoot":"","sources":["../src/relaunch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,SAAS,cAAc,CAAC,MAA6B;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAe,EAAE,IAAuB,EAAE,UAAwB,EAAE;IACpH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,OAAO,GAAqB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzH,qaAAqa;YACra,MAAM,SAAS,GAAG,IAAI,GAAG,CAAiB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtC,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,CAAC,CAAC;gBACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3E,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,OAAO,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAClC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,4BAA4B;YAAE,OAAO,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,iBAAiB;YAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,oBAAoB,iBAAiB,GAAG,KAAK,gBAAgB,CAAC,CAAC;YAC7I,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAAuB,EAAE,QAA2B;IACtG,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"relaunch.js","sourceRoot":"","sources":["../src/relaunch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,SAAS,cAAc,CAAC,MAA6B;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAe,EAAE,IAAuB,EAAE,UAAwB,EAAE;IACpH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,OAAO,GAAqB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzH,20BAA20B;YAC30B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtC,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,CAAC,CAAC;gBACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3E,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,OAAO,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAClC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,4BAA4B;YAAE,OAAO,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,iBAAiB;YAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,oBAAoB,iBAAiB,GAAG,KAAK,gBAAgB,CAAC,CAAC;YAC7I,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAAuB,EAAE,QAA2B;IACtG,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cli",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "private": true,
   "description": "Plugin-first Pi Harness CLI",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/packages/cli/src/main.ts

@@ -48,6 +48,9 @@ with a dash.
 
 const FLUSH_TIMEOUT_MS = 2_000;
 
+// A terminal broadcasts Ctrl-C to the whole foreground process group, so under `pih --profile development` this process receives SIGINT twice: once from the terminal and once relayed by the supervisor, measured under a millisecond apart. 50ms is far above that relay latency and far below the hundreds of milliseconds between two deliberate key presses, so a repeat inside the window is one keypress delivered twice and a repeat after it is still a force-quit request.
+export const DUPLICATE_SIGNAL_WINDOW_MS = 50;
+
 function signalExitCode(signal: NodeJS.Signals): number {
   return signal === "SIGINT" ? 130 : signal === "SIGHUP" ? 129 : 143;
 }
@@ -115,8 +118,16 @@ export async function runCli(_args: readonly string[], _environment: CliEnvironm
   const startupAbort = new AbortController();
   const stdio = new NodeStdio(environment.stdin, environment.stdout, environment.stderr);
   let signalCount = 0;
+  let lastSignal: NodeJS.Signals | undefined;
+  let lastSignalAt = 0;
   const removeSignals = environment.onSignal((signal) => {
     const code = signalExitCode(signal);
+    // performance.now() is monotonic, so a clock adjustment cannot turn a duplicate into a force-quit or the reverse.
+    const receivedAt = performance.now();
+    // The window is measured from the first delivery, not the previous one, so a burst cannot postpone the force-quit indefinitely.
+    if (signal === lastSignal && receivedAt - lastSignalAt < DUPLICATE_SIGNAL_WINDOW_MS) return;
+    lastSignal = signal;
+    lastSignalAt = receivedAt;
     signalCount += 1;
     if (signalCount > 1) {
       environment.stderr.write(`Received ${signal} again; exiting immediately\n`);

package/packages/cli/src/relaunch.ts

@@ -20,11 +20,10 @@ export async function superviseDevelopmentProcess(command: string, args: readonl
     const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve, reject) => {
       const child = spawn(command, [...args], options);
       const signals: NodeJS.Signals[] = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
-      // The child inherits stdio and stays in the terminal's foreground process group, so on POSIX it already receives SIGINT and SIGHUP directly; forwarding them would make it count one Ctrl-C as a repeated signal and skip its graceful shutdown. Listeners are still registered for every signal so the supervisor stays alive to collect the child's exit code. SIGTERM is addressed to this pid alone and is the only one relayed.
-      const forwarded = new Set<NodeJS.Signals>(process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGTERM"]);
+      // Every signal this supervisor receives is relayed to the child, which is what a signal addressed to this pid alone (`kill -INT`, a process manager, a `timeout` wrapper) needs: it reaches no other process, so without the relay the child keeps running while the supervisor waits for an exit that never comes. Registering a listener also keeps the supervisor alive past the default disposition so it can report the child's exit code. When a terminal broadcasts the signal to the shared foreground process group instead, the child receives it twice - once from the terminal, once from this relay - because nothing observable here separates a group broadcast from a pid-directed signal; a child that treats a repeated signal as a force-quit request has to collapse that pair itself, which `runCli` does with DUPLICATE_SIGNAL_WINDOW_MS in main.ts.
       const handlers = signals.map((signal) => {
         const handler = () => {
-          if (forwarded.has(signal)) child.kill(signal);
+          child.kill(signal);
         };
         process.on(signal, handler);
         return { signal, handler };