@playcraft/cli 0.1.29 → 0.1.30

package/dist/workspace-runtime/server/lock.js

@@ -0,0 +1,53 @@
+import { closeSync, constants, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+export class RuntimeProcessLock {
+    filePath;
+    fd = null;
+    constructor(stateDir) {
+        this.filePath = join(stateDir, 'workspace-runtime.lock');
+    }
+    acquire() {
+        mkdirSync(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        try {
+            this.fd = openSync(this.filePath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            writeFileSync(this.fd, String(process.pid));
+            return;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const existing = Number.parseInt(readFileSync(this.filePath, 'utf8'), 10);
+        if (Number.isInteger(existing) && processAlive(existing)) {
+            throw Object.assign(new Error(`workspace-runtime already running as pid ${existing}`), {
+                code: 'duplicate_instance',
+            });
+        }
+        unlinkSync(this.filePath);
+        this.acquire();
+    }
+    release() {
+        if (this.fd !== null) {
+            closeSync(this.fd);
+            this.fd = null;
+        }
+        try {
+            if (readFileSync(this.filePath, 'utf8').trim() === String(process.pid)) {
+                unlinkSync(this.filePath);
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/workspace-runtime/server/rfb-watch-gate.js

@@ -0,0 +1,168 @@
+/**
+ * RFB (Remote Framebuffer, 远程帧缓冲) viewing needs a handshake and picture requests.
+ * This gate supports the sandbox's version 3.8 / None security negotiation.
+ * Input requires a hold for the entire message; unsupported framing closes the stream.
+ */
+const INPUT_TYPES = new Set([4, 5, 6, 250, 251, 255]);
+const VERSION = Buffer.from('RFB 003.008\n');
+const MAX_CLIPBOARD_BYTES = 1_000_000;
+export function createRfbWatchGate() {
+    let server = Buffer.alloc(0);
+    let client = Buffer.alloc(0);
+    let phase = 'server-version';
+    let messageInputAllowed = false;
+    const fail = () => {
+        phase = 'failed';
+        server = Buffer.alloc(0);
+        client = Buffer.alloc(0);
+    };
+    const observeServer = (chunk) => {
+        if (phase === 'ready' || phase === 'failed')
+            return;
+        let offset = 0;
+        while (offset < chunk.length) {
+            let size = serverMessageSize(server, phase);
+            if (size === 'invalid') {
+                fail();
+                return;
+            }
+            const count = Math.min(size - server.length, chunk.length - offset);
+            server = Buffer.concat([server, chunk.subarray(offset, offset + count)]);
+            offset += count;
+            size = serverMessageSize(server, phase);
+            if (size === 'invalid') {
+                fail();
+                return;
+            }
+            if (server.length < size)
+                continue;
+            if (phase === 'server-version' && server.equals(VERSION))
+                phase = 'client-version';
+            else if (phase === 'server-types' && server.subarray(1).includes(1))
+                phase = 'client-security';
+            else if (phase === 'server-result' && server.readUInt32BE(0) === 0)
+                phase = 'client-init';
+            else if (phase === 'server-init')
+                phase = 'ready';
+            else {
+                fail();
+                return;
+            }
+            server = Buffer.alloc(0);
+            // The first picture can share the ServerInit chunk; it needs no buffering.
+            if (phase === 'ready')
+                return;
+        }
+    };
+    const clientBytes = (chunk, allowInput) => {
+        if (phase === 'failed')
+            return [];
+        const outgoing = [];
+        let offset = 0;
+        if (client.length > 0)
+            messageInputAllowed &&= allowInput;
+        while (offset < chunk.length) {
+            if (client.length === 0)
+                messageInputAllowed = allowInput;
+            let size = phase === 'client-version' ? 12
+                : phase === 'client-security' || phase === 'client-init' ? 1
+                    : phase === 'server-init' || phase === 'ready' ? clientMessageSize(client)
+                        : 'invalid';
+            if (size === 'invalid') {
+                fail();
+                return [];
+            }
+            const count = Math.min(size - client.length, chunk.length - offset);
+            client = Buffer.concat([client, chunk.subarray(offset, offset + count)]);
+            offset += count;
+            if (phase === 'server-init' || phase === 'ready')
+                size = clientMessageSize(client);
+            if (size === 'invalid') {
+                fail();
+                return [];
+            }
+            if (client.length < size)
+                continue;
+            if (phase === 'client-version' && client.equals(VERSION))
+                phase = 'server-types';
+            else if (phase === 'client-security' && client[0] === 1)
+                phase = 'server-result';
+            else if (phase === 'client-init' && client[0] <= 1)
+                phase = 'server-init';
+            else if (phase !== 'server-init' && phase !== 'ready') {
+                fail();
+                return [];
+            }
+            else if (INPUT_TYPES.has(client[0]) && !messageInputAllowed) {
+                client = Buffer.alloc(0);
+                continue;
+            }
+            outgoing.push(client);
+            client = Buffer.alloc(0);
+        }
+        return outgoing;
+    };
+    return { get failed() { return phase === 'failed'; }, observeServer, clientBytes };
+}
+function serverMessageSize(buffer, phase) {
+    if (phase === 'server-version')
+        return 12;
+    if (phase === 'server-types') {
+        if (buffer.length < 1)
+            return 1;
+        return buffer[0] === 0 ? 'invalid' : 1 + buffer[0];
+    }
+    if (phase === 'server-result')
+        return 4;
+    if (phase === 'server-init') {
+        if (buffer.length < 24)
+            return 24;
+        const length = buffer.readUInt32BE(20);
+        return length > 4096 ? 'invalid' : 24 + length;
+    }
+    return 'invalid';
+}
+function clientMessageSize(buffer) {
+    if (buffer.length === 0)
+        return 1;
+    const type = buffer[0];
+    if (type === 0)
+        return 20;
+    if (type === 3 || type === 150)
+        return 10;
+    if (type === 4)
+        return 8;
+    if (type === 5)
+        return 6;
+    if (type === 250)
+        return 4;
+    if (type === 2) {
+        if (buffer.length < 4)
+            return 4;
+        const count = buffer.readUInt16BE(2);
+        return count > 64 ? 'invalid' : 4 + count * 4;
+    }
+    if (type === 6) {
+        if (buffer.length < 8)
+            return 8;
+        // Extended clipboard messages encode their payload size as a negative length.
+        const length = Math.abs(buffer.readInt32BE(4));
+        return length > MAX_CLIPBOARD_BYTES ? 'invalid' : 8 + length;
+    }
+    if (type === 248) {
+        if (buffer.length < 9)
+            return 9;
+        return buffer[8] > 64 ? 'invalid' : 9 + buffer[8];
+    }
+    if (type === 251) {
+        if (buffer.length < 8)
+            return 8;
+        return buffer[6] > 16 ? 'invalid' : 8 + buffer[6] * 16;
+    }
+    if (type === 255) {
+        if (buffer.length < 2)
+            return 2;
+        return buffer[1] === 0 ? 12 : 'invalid';
+    }
+    return 'invalid';
+}

package/dist/workspace-runtime/server/terminal-host.js

@@ -0,0 +1,366 @@
+import { productionDirectoryBusy } from '../production/controller.js';
+import { createRequire } from 'node:module';
+import { randomUUID } from 'node:crypto';
+import { lstat } from 'node:fs/promises';
+import { StringDecoder } from 'node:string_decoder';
+import { WebSocketServer } from 'ws';
+import { appendTerminalOutput, createTerminalOutputLog, decodeTerminalBytes, runtimeError, terminalClientFrameSchema, terminalOutputSince, } from '@playcraft/common/cloud-workspace/runtime';
+import { resolveWorkspaceFile } from '../workspaces/files.js';
+import { sessionWorkspaceRoot } from '../workspaces/registry.js';
+import { startLauncherProcess } from '../codex/launcher-client.js';
+import { controlTokenMatches, extractControlToken } from './auth.js';
+const require = createRequire(import.meta.url);
+const commands = new WeakMap();
+const hosts = new WeakMap();
+export function setTerminalCommand(state, command) {
+    commands.set(state, command);
+}
+export function terminalHost(state) {
+    let host = hosts.get(state);
+    if (!host) {
+        host = new TerminalHost(state);
+        hosts.set(state, host);
+    }
+    return host;
+}
+export function disposeTerminalHost(state) {
+    hosts.get(state)?.dispose();
+    hosts.delete(state);
+}
+export class TerminalHost {
+    state;
+    disposed = false;
+    sessions = new Map();
+    spawning = new Map();
+    restored;
+    attempted = new Set();
+    closing = new Set();
+    stops = new Map();
+    confirmed = new Set();
+    sockets = new WebSocketServer({ noServer: true });
+    constructor(state) {
+        this.state = state;
+        // An absent in-memory session cannot prove a restored terminal's old process group stopped.
+        this.restored = new Set((state.journal?.listTerminals?.() ?? []).map(terminal => terminal.terminalId));
+    }
+    async handleUpgrade(request, socket, head) {
+        const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+        const match = /^\/runtime\/terminals\/([^/]+)\/connect$/.exec(url.pathname);
+        if (!match || !controlTokenMatches(this.state.config.controlToken, extractControlToken(request.headers))) {
+            rejectUpgrade(socket, 401, runtimeError('unauthenticated', 'control_token_required'));
+            return;
+        }
+        if (this.disposed || this.state.journal.destroyed()) {
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'runtime_destroyed'));
+            return;
+        }
+        let terminalId;
+        try {
+            terminalId = decodeURIComponent(match[1]);
+        }
+        catch {
+            rejectUpgrade(socket, 404, { error: 'terminal_not_found' });
+            return;
+        }
+        const terminal = this.state.journal.getTerminal(terminalId);
+        if (!terminal) {
+            rejectUpgrade(socket, 404, { error: 'terminal_not_found' });
+            return;
+        }
+        if (await productionDirectoryBusy(this.state, terminal.workspaceId, terminal.directoryName)) {
+            rejectUpgrade(socket, 409, { error: 'batch_workspace_readonly' });
+            return;
+        }
+        if (terminal.status === 'destroyed') {
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'terminal_destroyed'));
+            return;
+        }
+        if (this.closing.has(terminalId) || this.restored.has(terminalId) && !this.sessions.has(terminalId)) {
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'terminal_stop_unconfirmed'));
+            return;
+        }
+        let session = this.sessions.get(terminal.terminalId);
+        if (!session) {
+            try {
+                let pending = this.spawning.get(terminal.terminalId);
+                if (!pending) {
+                    pending = terminalDirectory(this.state, terminal).then((cwd) => this.spawn(terminal, cwd))
+                        .finally(() => this.spawning.delete(terminal.terminalId));
+                    this.spawning.set(terminal.terminalId, pending);
+                }
+                session = await pending;
+            }
+            catch {
+                rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'pty_unavailable'));
+                return;
+            }
+        }
+        if (this.disposed || this.state.journal.destroyed() || this.closing.has(terminalId) || this.state.journal.getTerminal(terminalId)?.status === 'destroyed') {
+            if (!this.closing.has(terminalId))
+                this.revoke(terminalId, 'terminal_destroyed');
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'terminal_destroyed'));
+            return;
+        }
+        const active = session;
+        this.sockets.handleUpgrade(request, socket, head, (ws) => this.attach(active, ws));
+    }
+    destroy(terminalId) {
+        const pending = this.stops.get(terminalId);
+        if (pending)
+            return pending;
+        this.closing.add(terminalId);
+        const stopped = (async () => {
+            await this.spawning.get(terminalId);
+            const session = this.sessions.get(terminalId);
+            if (session)
+                await session.stop();
+            else if (!this.confirmed.has(terminalId) && (this.restored.has(terminalId) || this.attempted.has(terminalId)))
+                throw new Error('terminal_stop_unconfirmed');
+            const terminal = this.state.journal.getTerminal(terminalId);
+            if (!terminal)
+                throw new Error('terminal_not_found');
+            const destroyed = terminal.status === 'destroyed' ? terminal : await this.state.journal.putTerminal({
+                ...terminal, status: 'destroyed', destroyedAt: new Date().toISOString(),
+            });
+            this.confirmed.add(terminalId);
+            this.revoke(terminalId, 'terminal_destroyed');
+            this.closing.delete(terminalId);
+            return destroyed;
+        })().finally(() => this.stops.delete(terminalId));
+        this.stops.set(terminalId, stopped);
+        return stopped;
+    }
+    revoke(terminalId, reason) {
+        const session = this.sessions.get(terminalId);
+        if (!session)
+            return;
+        this.sessions.delete(terminalId);
+        const frame = { type: 'revoked', reason };
+        for (const listener of session.listeners)
+            listener(frame);
+        session.listeners.clear();
+        try {
+            session.pty.kill();
+        }
+        catch {
+            /* the process may already have exited */
+        }
+    }
+    dispose() {
+        this.disposed = true;
+        for (const terminalId of [...this.sessions.keys()])
+            this.revoke(terminalId, 'runtime_destroyed');
+        this.sockets.close();
+    }
+    async spawn(terminal, cwd) {
+        if (this.disposed)
+            throw new Error('pty_unavailable');
+        if (this.state.config.workspaceMode === 'multi' || process.env.PLAYCRAFT_LAUNCHER_SOCKET
+            || process.getuid?.() === 1500) {
+            // User shells require the root launcher's fixed development account, even when an
+            // alternative command is installed for local tests. Never fall back to the control user.
+            const socketPath = process.env.PLAYCRAFT_LAUNCHER_SOCKET;
+            if (!socketPath)
+                throw new Error('pty_unavailable');
+            this.attempted.add(terminal.terminalId);
+            const child = await startLauncherProcess({ socketPath, processId: `terminal-${randomUUID()}`,
+                runtimeEpoch: this.state.runtimeEpoch, cwd, argv: [], env: {}, terminal: { cols: 80, rows: 24 } });
+            if (this.disposed) {
+                await child.stop();
+                throw new Error('pty_unavailable');
+            }
+            const session = { terminalId: terminal.terminalId, streamId: randomUUID(), log: createTerminalOutputLog(), listeners: new Set(),
+                stop: () => child.stop(),
+                pty: { write: (data) => { child.stdin?.write(data); }, resize: child.resize,
+                    kill: () => { void child.stop().catch(() => undefined); } } };
+            const decoder = new StringDecoder('utf8');
+            child.stdout?.on('data', (data) => { const text = decoder.write(data); if (text)
+                publish(session, text); });
+            child.onExit((code) => {
+                const tail = decoder.end();
+                if (tail)
+                    publish(session, tail);
+                const stopped = code === undefined ? Promise.resolve(false) : child.stop().then(() => true, () => false);
+                void stopped.then(confirmed => this.exited(terminal.terminalId, session, confirmed ? code : undefined)).catch(() => undefined);
+            });
+            this.sessions.set(terminal.terminalId, session);
+            return session;
+        }
+        const pty = require('node-pty');
+        const command = commands.get(this.state) ?? defaultShell();
+        let finishExit;
+        let didExit = false;
+        const knownExit = new Promise(resolve => { finishExit = () => { didExit = true; resolve(); }; });
+        this.attempted.add(terminal.terminalId);
+        const session = {
+            terminalId: terminal.terminalId,
+            streamId: randomUUID(),
+            log: createTerminalOutputLog(),
+            listeners: new Set(),
+            pty: pty.spawn(command.file, command.args, {
+                name: 'xterm-256color',
+                cols: 80,
+                rows: 24,
+                cwd,
+                env: shellEnv(command.file, cwd),
+            }),
+            stop: async () => {
+                if (!didExit)
+                    session.pty.kill();
+                let timer;
+                try {
+                    await Promise.race([knownExit, new Promise((_resolve, reject) => {
+                            timer = setTimeout(() => reject(new Error('terminal_stop_unconfirmed')), 3000);
+                        })]);
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+            },
+        };
+        const local = session.pty;
+        local.onData((data) => publish(session, data));
+        local.onExit(({ exitCode, signal }) => { finishExit(); void this.exited(terminal.terminalId, session, exitCode, signal).catch(() => undefined); });
+        this.sessions.set(terminal.terminalId, session);
+        return session;
+    }
+    async exited(terminalId, session, code, signal) {
+        session.exited = { code: code ?? null, ...(signal === undefined ? {} : { signal: String(signal) }) };
+        try {
+            if (code !== undefined) {
+                const terminal = this.state.journal.getTerminal(terminalId);
+                if (terminal && terminal.status !== 'destroyed')
+                    await this.state.journal.putTerminal({
+                        ...terminal, status: 'destroyed', destroyedAt: new Date().toISOString(),
+                    });
+                if (terminal)
+                    this.confirmed.add(terminalId);
+            }
+        }
+        finally {
+            for (const listener of session.listeners)
+                listener(exitFrame(session));
+        }
+    }
+    attach(session, ws) {
+        let open = true;
+        let resumed = false;
+        let cursor = 0;
+        const send = (frame) => {
+            if (open && ws.readyState === ws.OPEN)
+                ws.send(JSON.stringify(frame));
+        };
+        const listener = (frame) => {
+            if (!resumed)
+                return;
+            if (frame.type === 'output') {
+                const end = frame.offset + decodeTerminalBytes(frame.data).length;
+                if (end <= cursor)
+                    return;
+                cursor = Math.max(cursor, end);
+            }
+            send(frame);
+        };
+        session.listeners.add(listener);
+        ws.on('message', (raw) => {
+            let body;
+            try {
+                body = JSON.parse(String(raw));
+            }
+            catch {
+                return;
+            }
+            const parsed = terminalClientFrameSchema.safeParse(body);
+            if (!parsed.success || (session.exited || this.closing.has(session.terminalId)) && parsed.data.type !== 'resume')
+                return;
+            const frame = parsed.data;
+            if (frame.type === 'resume') {
+                if (frame.streamId && frame.streamId !== session.streamId) {
+                    send({ type: 'reset', streamId: session.streamId, offset: session.log.end });
+                    cursor = session.log.end;
+                    resumed = true;
+                    if (session.exited)
+                        send(exitFrame(session));
+                    return;
+                }
+                const since = terminalOutputSince(session.log, frame.offset);
+                if (since.gap)
+                    send({ type: 'gap', streamId: session.streamId, offset: since.offset });
+                for (const item of since.frames) {
+                    send({ type: 'output', streamId: session.streamId, offset: item.offset, data: item.data });
+                }
+                cursor = session.log.end;
+                resumed = true;
+                if (session.exited)
+                    send(exitFrame(session));
+                return;
+            }
+            if (!resumed)
+                return;
+            if (frame.type === 'resize') {
+                session.pty.resize(frame.cols, frame.rows);
+                return;
+            }
+            session.pty.write(Buffer.from(decodeTerminalBytes(frame.data)).toString('utf8'));
+        });
+        const detach = () => {
+            open = false;
+            session.listeners.delete(listener);
+        };
+        ws.on('close', detach);
+        ws.on('error', detach);
+    }
+}
+function publish(session, text) {
+    const before = session.log.end;
+    session.log = appendTerminalOutput(session.log, text);
+    const since = terminalOutputSince(session.log, before);
+    for (const item of since.frames) {
+        const frame = {
+            type: 'output',
+            streamId: session.streamId,
+            offset: item.offset,
+            data: item.data,
+        };
+        for (const listener of session.listeners)
+            listener(frame);
+    }
+}
+function exitFrame(session) {
+    return {
+        type: 'exit',
+        streamId: session.streamId,
+        code: session.exited?.code ?? null,
+        ...(session.exited?.signal ? { signal: session.exited.signal } : {}),
+    };
+}
+async function terminalDirectory(state, terminal) {
+    const root = await sessionWorkspaceRoot(state, terminal.workspaceId, terminal.directoryName);
+    if (!terminal.cwd)
+        return root;
+    const resolved = await resolveWorkspaceFile(root, terminal.cwd);
+    const stat = await lstat(resolved);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('pty_unavailable');
+    return resolved;
+}
+function defaultShell() {
+    const shell = process.env.SHELL;
+    const file = shell && shell.startsWith('/') ? shell : '/bin/sh';
+    return { file, args: ['-i'] };
+}
+function shellEnv(file, cwd) {
+    return {
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        HOME: process.env.HOME ?? cwd,
+        TERM: 'xterm-256color',
+        LANG: process.env.LANG ?? 'C.UTF-8',
+        SHELL: file,
+    };
+}
+function rejectUpgrade(socket, status, body) {
+    const payload = JSON.stringify(body);
+    const title = status === 401 ? 'Unauthorized' : status === 404 ? 'Not Found' : 'Conflict';
+    socket.write(`HTTP/1.1 ${status} ${title}\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: ${Buffer.byteLength(payload)}\r\nconnection: close\r\n\r\n${payload}`);
+    socket.destroy();
+}

package/dist/workspace-runtime/server/types.js

@@ -0,0 +1 @@
+export {};

package/dist/workspace-runtime/workspaces/artifact-events.js

@@ -0,0 +1,55 @@
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceRoot } from './registry.js';
+import { WorkspaceArtifactStore } from './artifacts.js';
+export async function refreshWorkspaceArtifacts(state, workspaceId, origin) {
+    if (state.journal.destroyed())
+        throw new Error('runtime_destroyed');
+    const root = await workspaceRoot(state, workspaceId);
+    const result = await new WorkspaceArtifactStore(state.config.stateDir, workspaceId).discover(root, origin?.source, origin?.paths);
+    if (result.changed && !state.journal.destroyed()) {
+        const event = await state.journal.allocateSourceEvent({
+            runtimeId: state.config.runtimeId, generation: state.config.generation, runtimeEpoch: state.runtimeEpoch,
+            workspaceId, type: 'artifact.updated', occurredAt: result.list.scannedAt,
+            payload: { workspaceId, artifacts: result.list.artifacts.map(artifact => ({ id: artifact.id, currentVersionId: artifact.currentVersionId })) },
+        });
+        // The durable source stream remains authoritative when the callback is temporarily unavailable.
+        void fetch(platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.events), {
+            method: 'POST', signal: AbortSignal.timeout(5000),
+            headers: { authorization: `Bearer ${state.config.controlToken}`, 'x-playcraft-control-token': state.config.controlToken, 'content-type': 'application/json' },
+            body: JSON.stringify({ runtimeId: state.config.runtimeId, generation: state.config.generation, runtimeEpoch: state.runtimeEpoch, events: [event] }),
+        }).then(response => response.body?.cancel()).catch(() => undefined);
+    }
+    return result.list;
+}
+/** Completed commands and turns reconcile outputs, including work done before a failed turn. */
+export function observeWorkspaceArtifacts(state) {
+    const pending = new Map();
+    const running = new Set();
+    const reconcile = (workspaceId) => {
+        const task = refreshWorkspaceArtifacts(state, workspaceId).catch(() => undefined);
+        running.add(task);
+        void task.finally(() => running.delete(task));
+    };
+    const stop = state.journal.onSourceEvent((event) => {
+        if (!['file.written', 'files.changed', 'filesystem.changed', 'item/completed', 'turn.completed', 'turn/completed', 'turn.failed', 'turn.interrupted'].includes(event.type))
+            return;
+        const payload = event.payload && typeof event.payload === 'object' ? event.payload : {};
+        const sessionId = typeof payload.sessionId === 'string' ? payload.sessionId : undefined;
+        const workspaceId = typeof payload.workspaceId === 'string' ? payload.workspaceId : sessionId ? state.journal.getSession(sessionId)?.workspaceId : undefined;
+        if (!workspaceId)
+            return;
+        const timer = pending.get(workspaceId);
+        if (timer)
+            clearTimeout(timer);
+        pending.set(workspaceId, setTimeout(() => { pending.delete(workspaceId); reconcile(workspaceId); }, 200));
+    });
+    return async () => {
+        stop();
+        for (const [workspaceId, timer] of pending) {
+            clearTimeout(timer);
+            reconcile(workspaceId);
+        }
+        pending.clear();
+        await Promise.all([...running]);
+    };
+}