@platless/axom-cli 0.5.9 → 0.6.36

package/dist/workstation/register.js

@@ -1,46 +1,36 @@
-import { UsageError } from '../config.js';
-import { clientDir, loadClientConfig, saveClientConfig, writeKeys } from './config.js';
+import { randomUUID } from 'node:crypto';
+import { clientDir } from './config.js';
 import { osInfo } from './osinfo.js';
-export async function registerWorkstation(server, clientName, token, ws) {
-    const dir = clientDir();
-    const existing = await loadClientConfig(dir).catch(() => undefined);
-    const body = {
-        name: clientName,
-        ...(existing?.server === server ? { workstationId: existing.workstationId } : {}),
-        os: osInfo(),
-        defaultWorkspace: { name: ws.name, cwd: ws.cwd, shell: ws.shell },
-    };
+import { workstationEndpoint } from './control/serverIdentity.js';
+import { LocalControlError } from './control/protocol.js';
+import { z } from 'zod';
+export const registerResponseSchema = z.object({ workstationId: z.string().min(1), ownerUserId: z.string().min(1).optional(), clientKey: z.string(), serverPub: z.string() });
+/** No persistence; callers own the operation lock and identity transaction. */
+export async function requestWorkstationRegistration(server, clientName, token, ws, workstationId, shell = ws?.shell ?? '/bin/sh') {
     let res;
     try {
-        res = await fetch(new URL('/workstation/register', server), {
-            method: 'POST',
+        res = await fetch(workstationEndpoint(server, '/workstation/register'), { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(30_000),
             headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
-            body: JSON.stringify(body),
+            body: JSON.stringify({ name: clientName, ...(workstationId ? { workstationId } : {}), os: osInfo(), shell, ...(ws ? { defaultWorkspace: ws } : {}) }),
         });
     }
-    catch (err) {
-        throw new Error(`Failed to reach ${server}/workstation/register: ${err instanceof Error ? err.message : err}`);
+    catch {
+        throw new LocalControlError('OUTCOME_UNKNOWN', 'Registration was sent but its outcome could not be confirmed. Check your workstation list before trying again.');
+    }
+    if (res.status === 409)
+        throw new LocalControlError('BINDING_CONFLICT', 'A workstation with this name is already registered. Check Settings → Workstations.');
+    if (res.status === 401 || res.status === 403)
+        throw new LocalControlError('AUTHORIZATION_REQUIRED', 'Workstation permission is required. Run `axom auth` and select workstation, then try again.');
+    if (!res.ok)
+        throw new LocalControlError('OUTCOME_UNKNOWN', 'Registration could not be confirmed. Check your workstation list.');
+    try {
+        return registerResponseSchema.parse(await res.json());
     }
-    if (!res.ok) {
-        // A workstation with this name is already registered for this account — most commonly because
-        // this same machine registered before an axom-cli upgrade and no longer has a local config at
-        // the new config-directory path (see the client's move from ~/.axom-workstation to
-        // ~/.axom/workstation). Rebinding the existing row silently would hand this machine's identity
-        // to whichever caller re-registers next, so the server refuses instead of upserting.
-        if (res.status === 409) {
-            throw new UsageError(`A workstation named '${clientName}' is already registered for this account. This is expected `
-                + `when the same machine re-registers after an axom-cli upgrade. Delete it under Settings → `
-                + 'Workstations, then run `axom workstation start` again.');
-        }
-        if (res.status === 403) {
-            throw new UsageError('This credential is not authorized to register a workstation. '
-                + 'Run `axom auth` and select workstation, then try again.');
-        }
-        throw new Error(`Registration failed: ${res.status} ${await res.text()}`);
+    catch {
+        throw new LocalControlError('OUTCOME_UNKNOWN', 'Registration response was incomplete. Check your workstation list.');
     }
-    const data = (await res.json());
-    if (!data.workstationId)
-        throw new Error('Registration response missing workstationId');
-    await saveClientConfig(dir, { server, workstationId: data.workstationId, workspaces: [{ name: ws.name, cwd: ws.cwd }] });
-    await writeKeys(dir, data.clientKey, data.serverPub);
+}
+export async function registerWorkstation(server, clientName, token, ws) {
+    const { enrollLegacyWorkstation } = await import('./control/enrollment.js');
+    await enrollLegacyWorkstation({ server, name: clientName, accessToken: token, workspace: ws, operationId: randomUUID() }, clientDir());
 }

package/dist/workstation/service/installer.js

@@ -58,6 +58,22 @@ async function assertWritable(directory) {
 }
 const defaultDeps = {
     run: runProcess,
+    readLaunchAgent: async (file) => {
+        const handle = await fs.open(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.size > 65536)
+                throw new Error('Invalid LaunchAgent');
+        }
+        finally {
+            await handle.close();
+        }
+        const result = await runProcess('/usr/bin/plutil', ['-convert', 'json', '-o', '-', file]);
+        const value = JSON.parse(result.stdout);
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('Invalid LaunchAgent');
+        return value;
+    },
     writeTemp,
     assertWritable,
     ensureDirectory: async (directory) => { await fs.mkdir(directory, { recursive: true }); },
@@ -219,24 +235,38 @@ export function createServiceManager(context, overrides = {}) {
         // durable LaunchAgent plist. This keeps explicit stop meaningful across both service managers.
         if (action === 'stop')
             return deps.run('launchctl', ['bootout', launchdDomain]);
-        if (action === 'restart') {
-            try {
-                await deps.run('launchctl', ['bootout', launchdDomain]);
-            }
-            catch (error) {
-                // `restart` after an explicit `stop` is a valid request: absence means there is nothing
-                // left to unload, and launchdStart will bootstrap the durable plist.
-                if (!launchdAbsent(error))
-                    throw error;
+        return launchdStart();
+    };
+    const enabled = async (plistDisabled = false) => {
+        if (context.platform === 'darwin') {
+            const result = await deps.run('launchctl', ['print-disabled', `gui/${context.userId}`]);
+            if (!result.stdout.includes('{') || !result.stdout.includes('}'))
+                throw new Error('Cannot determine launchd enablement');
+            const line = result.stdout.split('\n').find(line => line.includes(`"${SERVICE_LABEL}"`));
+            if (line) {
+                const override = /=>\s*(true|false|enabled|disabled)\b/.exec(line);
+                if (!override)
+                    throw new Error('Cannot determine launchd enablement');
+                return override[1] === 'true' || override[1] === 'disabled' ? false : true;
             }
-            return launchdStart();
+            return !plistDisabled;
+        }
+        try {
+            return (await deps.run('systemctl', ['--user', 'is-enabled', `${SERVICE_LABEL}.service`])).stdout.trim() === 'enabled';
+        }
+        catch (error) {
+            if (/disabled|not-found/.test(String(error)))
+                return false;
+            throw error;
         }
-        return launchdStart();
     };
     // Extracted so `start()` can reuse it: reinstalling is the same work whether triggered
     // explicitly (`axom workstation install`) or as `start()`'s self-heal for a missing definition
     // file. Both platform branches leave the service running, so callers need no separate start.
     const performInstall = async (_options = {}) => {
+        const present = await deps.pathExists(target);
+        const plistDisabled = context.platform === 'darwin' && present && (await deps.readLaunchAgent(target)).Disabled === true;
+        const preserveDisabled = (context.platform === 'darwin' || present) && !await enabled(plistDisabled);
         await deps.assertWritable(context.npmPrefix);
         await deps.ensureDirectory(path.dirname(target));
         const temp = await deps.writeTemp(contents);
@@ -246,7 +276,8 @@ export function createServiceManager(context, overrides = {}) {
             await deps.run('mv', [targetTemp, target]);
             if (context.platform === 'linux') {
                 await deps.run('systemctl', ['--user', 'daemon-reload']);
-                await deps.run('systemctl', ['--user', 'enable', '--now', `${SERVICE_LABEL}.service`]);
+                if (!preserveDisabled)
+                    await deps.run('systemctl', ['--user', 'enable', '--now', `${SERVICE_LABEL}.service`]);
             }
             else {
                 // Reload an existing service before bootstrapping the replacement into the GUI domain.
@@ -255,7 +286,8 @@ export function createServiceManager(context, overrides = {}) {
                 // bounded probe/bootstrap path so Bootstrap failed: 5 is confirmed then kickstarted, and
                 // so a launchd that never releases the job is reported instead of leaving the machine
                 // with the bootout applied and nothing bootstrapped in its place.
-                await launchdStart();
+                if (!preserveDisabled)
+                    await launchdStart();
             }
         }
         finally {
@@ -303,6 +335,11 @@ export function createServiceManager(context, overrides = {}) {
          */
         async start() {
             await withGuiSessionHint(async () => {
+                // An explicit Start is consent to re-enable; install/update alone preserves OFF.
+                if (context.platform === 'darwin')
+                    await deps.run('launchctl', ['enable', launchdDomain]);
+                else
+                    await deps.run('systemctl', ['--user', 'enable', `${SERVICE_LABEL}.service`]);
                 if (!(await deps.pathExists(target)))
                     await performInstall({});
                 await lifecycle('start');
@@ -310,6 +347,60 @@ export function createServiceManager(context, overrides = {}) {
         },
         async stop() { await withGuiSessionHint(() => lifecycle('stop')); },
         async restart() { await withGuiSessionHint(() => lifecycle('restart')); },
+        async setEnabled(value) {
+            await withGuiSessionHint(async () => {
+                if (context.platform === 'darwin') {
+                    await deps.run('launchctl', [value ? 'enable' : 'disable', launchdDomain]);
+                    if (value) {
+                        if (!await deps.pathExists(target))
+                            await performInstall({});
+                        await launchdStart();
+                    }
+                    else {
+                        try {
+                            await lifecycle('stop');
+                        }
+                        catch (error) {
+                            if (!launchdAbsent(error))
+                                throw error;
+                        }
+                    }
+                }
+                else
+                    await deps.run('systemctl', ['--user', value ? 'enable' : 'disable', '--now', `${SERVICE_LABEL}.service`]);
+            });
+        },
+        async enablement() {
+            const installed = await deps.pathExists(target);
+            if (!installed)
+                return { installed: false, enabled: false, loaded: false, running: false };
+            let value;
+            try {
+                let disabled = false;
+                if (context.platform === 'darwin') {
+                    const plist = await deps.readLaunchAgent(target);
+                    const args = plist.ProgramArguments;
+                    const environment = plist.EnvironmentVariables;
+                    if (plist.Label !== SERVICE_LABEL || !Array.isArray(args) || args.length !== 3 || args[0] !== context.nodePath || args[1] !== context.cliPath || args[2] !== '__daemon' || environment?.AXOM_WORKSTATION_CONFIG_DIR !== context.configDir) {
+                        return { installed, enabled: null, loaded: false, running: false, reason: 'service_identity_mismatch' };
+                    }
+                    disabled = plist.Disabled === true;
+                }
+                value = await enabled(disabled);
+            }
+            catch {
+                return { installed, enabled: null, loaded: false, running: false, reason: 'service_state_unknown' };
+            }
+            try {
+                const result = await lifecycle('status');
+                return { installed, enabled: value, loaded: true, running: context.platform === 'darwin' ? launchdIsRunning(result.stdout) : true };
+            }
+            catch (error) {
+                if (launchdAbsent(error) || /inactive|not loaded|not-found/.test(String(error)))
+                    return { installed, enabled: value, loaded: false, running: false };
+                return { installed, enabled: value, loaded: false, running: false, reason: 'runtime_state_unknown' };
+            }
+        },
         async status() {
             try {
                 const result = await lifecycle('status');

package/dist/workstation/service/launchd.js

@@ -31,6 +31,7 @@ ${keyValue('AXOM_WORKSTATION_CONFIG_DIR', context.configDir)}
 ${keyValue('AXOM_WORKSTATION_NPM_PATH', context.npmPath)}
 ${keyValue('AXOM_WORKSTATION_NPM_PREFIX', context.npmPrefix)}
 ${keyValue('PATH', context.pathEnv)}
+${context.npmConfigPrefix ? keyValue('NPM_CONFIG_PREFIX', context.npmConfigPrefix) : ''}
 \t</dict>
 \t<key>StandardOutPath</key>
 \t<string>${xml(`${context.configDir}/daemon.log`)}</string>

package/dist/workstation/storageMetrics.js

@@ -0,0 +1,118 @@
+import { execFile } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const LOCAL_FILESYSTEMS = new Set([
+    'ext2', 'ext3', 'ext4', 'xfs', 'btrfs', 'zfs', 'f2fs', 'bcachefs',
+    'vfat', 'exfat', 'ntfs', 'ntfs3', 'fuseblk',
+]);
+export function linuxStoragePools(mounts) {
+    const pools = new Map();
+    for (const mount of mounts) {
+        if (!LOCAL_FILESYSTEMS.has(mount.fstype) || mount.options?.split(',').includes('ro'))
+            continue;
+        if (/^\/(?:boot|efi)(?:\/|$)/.test(mount.target))
+            continue;
+        const source = mount.source.split('[')[0];
+        const key = mount.fstype === 'zfs'
+            ? `zfs:${source.split('/')[0]}`
+            : mount.uuid ? `${mount.fstype}:${mount.uuid}` : `dev:${mount['maj:min']}`;
+        const existing = pools.get(key);
+        if (existing)
+            existing.paths.push(mount.target);
+        else
+            pools.set(key, { key, label: mount.label || source, paths: [mount.target] });
+    }
+    if (pools.size === 0) {
+        const root = mounts.find((mount) => mount.target === '/' && mount.fstype === 'overlay');
+        if (root)
+            pools.set('overlay:/', { key: 'overlay:/', label: 'Container storage', paths: ['/'] });
+    }
+    return [...pools.values()];
+}
+export function darwinStoragePools(disks, physicalDisks, containers) {
+    const physical = new Set(physicalDisks.flatMap((disk) => [disk.DeviceIdentifier, ...(disk.Partitions ?? []).map((part) => part.DeviceIdentifier)]));
+    const volumes = disks.flatMap((disk) => [disk, ...(disk.Partitions ?? []), ...(disk.APFSVolumes ?? [])]);
+    const pools = [];
+    for (const container of containers) {
+        if (!container.PhysicalStores.some((store) => physical.has(store.DeviceIdentifier)))
+            continue;
+        const userVolumes = container.Volumes.filter((volume) => volume.Roles.length === 0 || volume.Roles.includes('Data'));
+        userVolumes.sort((first, second) => Number(second.Roles.includes('Data')) - Number(first.Roles.includes('Data')));
+        const mounted = userVolumes.flatMap((volume) => {
+            const disk = volumes.find((candidate) => candidate.DeviceIdentifier === volume.DeviceIdentifier);
+            return disk?.MountPoint ? [{ name: volume.Name, mount: disk.MountPoint }] : [];
+        });
+        if (mounted.length === 0)
+            continue;
+        const system = container.Volumes.find((volume) => volume.Roles.includes('System'));
+        pools.push({
+            key: `apfs:${container.APFSContainerUUID}`,
+            label: system?.Name || mounted[0].name,
+            paths: mounted.map((volume) => volume.mount),
+        });
+    }
+    for (const volume of volumes) {
+        if (!physical.has(volume.DeviceIdentifier) || !volume.MountPoint)
+            continue;
+        if (!['Apple_HFS', 'Microsoft Basic Data', 'Windows_NTFS', 'DOS_FAT_32', 'DOS_FAT_16', 'ExFAT'].includes(volume.Content ?? ''))
+            continue;
+        pools.push({
+            key: `volume:${volume.VolumeUUID || volume.DiskUUID || volume.DeviceIdentifier}`,
+            label: volume.VolumeName || volume.MountPoint,
+            paths: [volume.MountPoint],
+        });
+    }
+    return pools;
+}
+async function diskutilJson(args) {
+    const { stdout } = await execFileAsync('/usr/sbin/diskutil', args, {
+        timeout: 5_000, maxBuffer: 4 * 1024 * 1024,
+    });
+    const json = await new Promise((resolve, reject) => {
+        const child = execFile('/usr/bin/plutil', ['-convert', 'json', '-o', '-', '-'], {
+            timeout: 2_000, maxBuffer: 4 * 1024 * 1024,
+        }, (error, output) => error ? reject(error) : resolve(output));
+        child.stdin?.on('error', reject);
+        child.stdin?.end(stdout);
+    });
+    return JSON.parse(json);
+}
+export async function discoverStoragePools(platform, workspaces) {
+    if (platform === 'linux') {
+        const { stdout } = await execFileAsync('findmnt', [
+            '--json', '--list', '--output', 'TARGET,SOURCE,FSTYPE,UUID,LABEL,MAJ:MIN,OPTIONS',
+        ], { timeout: 5_000, maxBuffer: 4 * 1024 * 1024, env: { ...process.env, LC_ALL: 'C' } });
+        const mounts = JSON.parse(stdout).filesystems;
+        return linuxStoragePools(mounts.filter((mount) => {
+            try {
+                return statSync(mount.target).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        }));
+    }
+    if (platform === 'darwin') {
+        const [all, physical, apfs] = await Promise.all([
+            diskutilJson(['list', '-plist']),
+            diskutilJson(['list', '-plist', 'physical']),
+            diskutilJson(['apfs', 'list', '-plist']),
+        ]);
+        return darwinStoragePools(all.AllDisksAndPartitions, physical.AllDisksAndPartitions, apfs.Containers ?? []);
+    }
+    const pools = new Map();
+    for (const { cwd } of workspaces) {
+        try {
+            const key = `dev:${statSync(cwd).dev}`;
+            const existing = pools.get(key);
+            if (existing)
+                existing.paths.push(cwd);
+            else
+                pools.set(key, { key, label: path.parse(cwd).root, paths: [cwd] });
+        }
+        catch { }
+    }
+    return [...pools.values()];
+}

package/dist/workstation/systemMetrics.js

@@ -2,8 +2,8 @@ import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { readFileSync, statfsSync, statSync } from 'node:fs';
 import os from 'node:os';
-import path from 'node:path';
 import { promisify } from 'node:util';
+import { discoverStoragePools } from './storageMetrics.js';
 const execFileAsync = promisify(execFile);
 export const STORAGE_TOPOLOGY_REFRESH_MS = 10 * 60 * 1000;
 function cpuTotals(cpus) {
@@ -36,45 +36,6 @@ function linuxMemoryPressure(readFile) {
 function stablePoolId(key) {
     return createHash('sha256').update(key).digest('hex').slice(0, 16);
 }
-async function defaultIdentifyStorage(platform, cwd, device) {
-    try {
-        if (platform === 'darwin') {
-            const mounted = await execFileAsync('/bin/df', ['-P', cwd], {
-                timeout: 1_000,
-                env: { ...process.env, LC_ALL: 'C' },
-            });
-            const mountFields = mounted.stdout.trim().split('\n').at(-1)?.trim().split(/\s+/) ?? [];
-            const mountPoint = mountFields.slice(5).join(' ') || path.parse(cwd).root;
-            const { stdout } = await execFileAsync('/usr/sbin/diskutil', ['info', mountPoint], {
-                timeout: 1_000,
-                env: { ...process.env, LC_ALL: 'C' },
-            });
-            const container = /^\s*APFS Container Reference:\s*(\S+)\s*$/m.exec(stdout)?.[1];
-            const volume = /^\s*Volume Name:\s*(.+?)\s*$/m.exec(stdout)?.[1];
-            return container
-                ? { key: `apfs:${container}`, label: `APFS Container ${container}` }
-                : { key: `dev:${device}`, label: volume };
-        }
-        if (platform === 'linux') {
-            const { stdout } = await execFileAsync('findmnt', ['-n', '-P', '-o', 'FSTYPE,SOURCE,UUID,LABEL,TARGET', '--target', cwd], {
-                timeout: 2_000,
-                env: { ...process.env, LC_ALL: 'C' },
-            });
-            const fields = Object.fromEntries([...stdout.matchAll(/(\w+)="([^"]*)"/g)].map((match) => [match[1], match[2]]));
-            if (fields.FSTYPE === 'btrfs' && fields.UUID)
-                return { key: `btrfs:${fields.UUID}`, label: fields.SOURCE };
-            if (fields.FSTYPE === 'zfs' && fields.SOURCE) {
-                const pool = fields.SOURCE.split('/')[0];
-                return { key: `zfs:${pool}`, label: pool };
-            }
-            return { key: `dev:${device}`, label: fields.LABEL || fields.TARGET || fields.SOURCE };
-        }
-    }
-    catch {
-        // Resource-pool recognition is best-effort. Device identity below is the conservative fallback.
-    }
-    return { key: `dev:${device}` };
-}
 async function defaultDarwinAvailableMemory() {
     try {
         const { stdout } = await execFileAsync('/usr/bin/vm_stat', [], { timeout: 2_000 });
@@ -216,7 +177,7 @@ export class SystemMetricsSampler {
         readFile: readFileSync,
         statfs: statfsSync,
         stat: statSync,
-        identifyStorage: (cwd, device) => defaultIdentifyStorage(process.platform, cwd, device),
+        discoverStorage: () => discoverStoragePools(process.platform, workspaces),
         darwinAvailableMemory: defaultDarwinAvailableMemory,
         darwinMemoryPressure: defaultDarwinMemoryPressure,
         probeGpus: () => defaultProbeGpus(process.platform),
@@ -261,20 +222,23 @@ export class SystemMetricsSampler {
                 : (this.deps.platform === 'darwin' ? this.darwinMemoryPressure : null);
             const pools = new Map();
             for (const pool of this.storage) {
-                try {
-                    const stats = this.deps.statfs(pool.cwd);
-                    const totalBytes = Number(stats.blocks) * Number(stats.bsize);
-                    const availableBytes = Number(stats.bavail) * Number(stats.bsize);
-                    pools.set(pool.key, {
-                        id: stablePoolId(pool.key),
-                        label: pool.label,
-                        workspaces: pool.workspaces,
-                        totalBytes,
-                        availableBytes,
-                    });
-                }
-                catch {
-                    // A removed/unmounted workspace must not suppress CPU and memory metrics.
+                for (const cwd of pool.paths) {
+                    try {
+                        if (String(this.deps.stat(cwd).dev) !== pool.devices[cwd])
+                            continue;
+                        const stats = this.deps.statfs(cwd);
+                        const totalBytes = Number(stats.blocks) * Number(stats.bsize);
+                        const availableBytes = Number(stats.bavail) * Number(stats.bsize);
+                        pools.set(pool.key, {
+                            id: stablePoolId(pool.key),
+                            label: pool.label,
+                            workspaces: pool.workspaces,
+                            totalBytes,
+                            availableBytes,
+                        });
+                        break;
+                    }
+                    catch { }
                 }
             }
             return {
@@ -338,43 +302,31 @@ export class SystemMetricsSampler {
         this.darwinMemoryPressure = pressure;
     }
     async refreshTopology() {
-        const candidates = this.workspaces.map(({ name, cwd }) => {
-            try {
-                this.deps.statfs(cwd);
-                const device = String(this.deps.stat(cwd).dev);
-                return { name, cwd, device };
-            }
-            catch {
-                return null;
-            }
-        }).filter((candidate) => candidate !== null);
-        const representatives = new Map();
-        candidates.forEach(({ cwd, device }) => {
-            if (!representatives.has(device))
-                representatives.set(device, { cwd, device });
-        });
-        const identities = new Map(await Promise.all([...representatives.values()].map(async ({ cwd, device }) => [
-            device,
-            await this.deps.identifyStorage(cwd, device).catch(() => null),
-        ])));
-        const identified = candidates.map(({ name, cwd, device }) => {
-            try {
-                const identity = identities.get(device);
-                const key = identity?.key ?? `dev:${device}`;
-                return { name, cwd, key, label: identity?.label || path.parse(cwd).root || cwd };
-            }
-            catch {
-                return null;
-            }
-        });
-        const grouped = new Map();
-        for (const entry of identified.filter((candidate) => candidate !== null)) {
-            const existing = grouped.get(entry.key);
-            if (existing)
-                existing.workspaces.push(entry.name);
-            else
-                grouped.set(entry.key, { cwd: entry.cwd, key: entry.key, label: entry.label, workspaces: [entry.name] });
+        try {
+            const pools = await this.deps.discoverStorage();
+            this.storage = pools.map((pool) => {
+                const devices = Object.fromEntries(pool.paths.flatMap((cwd) => {
+                    try {
+                        return [[cwd, String(this.deps.stat(cwd).dev)]];
+                    }
+                    catch {
+                        return [];
+                    }
+                }));
+                const poolDevices = new Set(Object.values(devices));
+                const workspaces = this.workspaces.filter(({ cwd }) => {
+                    try {
+                        return poolDevices.has(String(this.deps.stat(cwd).dev));
+                    }
+                    catch {
+                        return false;
+                    }
+                }).map(({ name }) => name);
+                return { ...pool, workspaces, devices };
+            });
+        }
+        catch {
+            return;
         }
-        this.storage = [...grouped.values()];
     }
 }

package/dist/workstation/toolchain.js

@@ -0,0 +1,94 @@
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+const PROBE_TIMEOUT_MS = 10_000;
+const VERIFY_TIMEOUT_MS = 3_000;
+/** Interpreters rarely appear or vanish; a slow refresh keeps the heartbeat itself free of any spawning. */
+export const TOOLCHAIN_REFRESH_MS = 15 * 60_000;
+/**
+ * Shells whose `-lc` runs a POSIX-ish command string with `command -v` (fish ≥ 3 included). Any other shell (csh, tcsh,
+ * nu, pwsh, …) is not probed: its answer is unknown, never "missing".
+ */
+const PROBED_SHELLS = new Set(['sh', 'bash', 'zsh', 'dash', 'ksh', 'mksh', 'fish']);
+/** Separates the probe's answers; no leading `=` (zsh would expand a bare `=word`). */
+const SPLIT = 'AXOM-PROBE-SPLIT';
+const DONE = 'AXOM-PROBE-DONE';
+const NAMES = ['python3', 'python', 'node'];
+/**
+ * One `<shell> -lc` run of `command -v` for each interpreter, the way commands run on this workstation (exec spawns the
+ * same login shell), so a Python found only through the user's profile counts. Each answer is the last absolute-path
+ * line of its segment (a login profile may print its own lines first). Null = unknown: a shell we do not probe, a shell
+ * that could not run, or a run that did not reach its end marker.
+ */
+export async function probeToolchain(shell, env = process.env, options = {}) {
+    if (!PROBED_SHELLS.has(path.basename(shell)))
+        return null;
+    const script = [...NAMES.map((name) => `command -v ${name}`), `echo ${DONE}`].join(`; echo ${SPLIT}; `);
+    const stdout = await run(shell, ['-lc', script], env, PROBE_TIMEOUT_MS);
+    if (stdout === undefined)
+        return null;
+    const lines = stdout.split('\n').map((line) => line.trim());
+    const doneAt = lines.lastIndexOf(DONE);
+    if (doneAt < 0)
+        return null;
+    const segments = [[]];
+    for (const line of lines.slice(0, doneAt)) {
+        if (line === SPLIT)
+            segments.push([]);
+        else
+            segments[segments.length - 1].push(line);
+    }
+    // `command -v python3; echo SPLIT; …; echo SPLIT; echo DONE`: one segment per name, then an empty one. A login
+    // profile's own output lands in the first segment, before the answer, so each answer is its segment's last path.
+    if (segments.length !== NAMES.length + 1)
+        return null;
+    const answers = segments.slice(0, NAMES.length);
+    const found = (index) => [...answers[index]].reverse().find((line) => path.isAbsolute(line)) ?? null;
+    let python3 = found(0);
+    if (python3 === '/usr/bin/python3' && (options.platform ?? process.platform) === 'darwin') {
+        if (!(await (options.macStubRuns ?? macCommandLineToolsInstalled)()))
+            python3 = null;
+    }
+    return { python: python3 ?? found(1), node: found(2) };
+}
+async function macCommandLineToolsInstalled() {
+    return (await run('/usr/bin/xcode-select', ['-p'], process.env, VERIFY_TIMEOUT_MS, true)) !== undefined;
+}
+/** The command's stdout; undefined = it did not run, timed out, or (with [strict]) exited non-zero. */
+function run(file, args, env, timeout, strict = false) {
+    return new Promise((resolve) => {
+        execFile(file, args, { env, timeout, windowsHide: true }, (error, stdout) => {
+            const code = error?.code;
+            if (error && (strict || typeof code !== 'number')) {
+                resolve(undefined);
+                return;
+            }
+            resolve(String(stdout));
+        });
+    });
+}
+/** Holds the latest probe; the first answer arrives shortly after start, until then the heartbeat simply omits it. */
+export class ToolchainProbe {
+    shell;
+    env;
+    latest = null;
+    timer;
+    constructor(shell, env = () => process.env) {
+        this.shell = shell;
+        this.env = env;
+    }
+    current() { return this.latest; }
+    start() {
+        if (process.platform === 'win32' || this.timer)
+            return;
+        const refresh = async () => {
+            const found = await probeToolchain(this.shell(), this.env()).catch(() => null);
+            if (found)
+                this.latest = found;
+        };
+        void refresh();
+        this.timer = setInterval(() => { void refresh(); }, TOOLCHAIN_REFRESH_MS);
+        this.timer.unref();
+    }
+    stop() { if (this.timer)
+        clearInterval(this.timer); this.timer = undefined; }
+}