@songsid/agend 2.1.10-beta.6 → 2.1.11-beta.1

package/dist/rollout-index.d.ts

@@ -0,0 +1,66 @@
+/**
+ * One cached listing of Codex's date-sharded rollout files, shared by every instance
+ * that follows the same sessions directory (#1161, D2).
+ *
+ * Every Codex instance's transcript source used to re-walk, stat and sort the WHOLE
+ * tree on every 2 s poll: N instances × (every directory + every rollout file), and the
+ * tree only ever grows. The listing is the same for all of them, so it is built once
+ * and shared; what is built is kept up to date incrementally:
+ *
+ *   - a listing is reused for `ttlMs` (the pollers' own interval is 2 s, so a new rollout
+ *     is noticed within a second of the next poll);
+ *   - a directory whose mtime has not moved is not read again (creating a rollout bumps
+ *     its directory's mtime; appending to one does not);
+ *   - a rollout that has been quiet for `quietMs` is not stat'ed again until the next
+ *     full refresh (a file's mtime only matters for ordering, and a quiet file is not
+ *     moving), which bounds how stale an old, resumed rollout's position can be by `fullRefreshMs`;
+ *   - a full refresh re-reads and re-stats everything, so none of the shortcuts can go
+ *     wrong for longer than `fullRefreshMs`.
+ *
+ * Returns newest-first, the order the sources always had.
+ */
+export interface RolloutFile {
+    path: string;
+    mtimeMs: number;
+    size: number;
+}
+export interface RolloutFsOps {
+    readdir(dir: string): string[];
+    stat(path: string): {
+        mtimeMs: number;
+        size: number;
+        isDirectory(): boolean;
+    };
+}
+export interface RolloutIndexOptions {
+    ttlMs?: number;
+    quietMs?: number;
+    fullRefreshMs?: number;
+    maxDepth?: number;
+    ops?: RolloutFsOps;
+    now?: () => number;
+}
+export declare const DEFAULT_ROLLOUT_TTL_MS = 1000;
+export declare class RolloutIndex {
+    private readonly root;
+    private readonly ttlMs;
+    private readonly quietMs;
+    private readonly fullRefreshMs;
+    private readonly maxDepth;
+    private readonly ops;
+    private readonly now;
+    private dirs;
+    private files;
+    private listing;
+    private builtAt;
+    private fullAt;
+    constructor(root: string, options?: RolloutIndexOptions);
+    /** Newest rollout first. `fresh` bypasses the shared listing (checkpoints, baselines). */
+    list(fresh?: boolean): RolloutFile[];
+    private rebuild;
+    private readDir;
+}
+/** The listing every source following `root` shares. */
+export declare function sharedRolloutIndex(root: string): RolloutIndex;
+/** Test seam: drop every shared listing and set the TTL new ones get (0 = always rebuild: a test edits its own tree between polls). */
+export declare function resetSharedRolloutIndexesForTests(ttlMs?: number): void;

package/dist/rollout-index.js

@@ -0,0 +1,124 @@
+import { readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+const realOps = { readdir: dir => readdirSync(dir), stat: path => statSync(path) };
+export const DEFAULT_ROLLOUT_TTL_MS = 1_000;
+/** A directory read this soon after its last change is read once more before its mtime is trusted. */
+const HOT_DIR_MS = 2_000;
+export class RolloutIndex {
+    root;
+    ttlMs;
+    quietMs;
+    fullRefreshMs;
+    maxDepth;
+    ops;
+    now;
+    dirs = new Map();
+    files = new Map();
+    listing = [];
+    builtAt = Number.NEGATIVE_INFINITY;
+    fullAt = Number.NEGATIVE_INFINITY;
+    constructor(root, options = {}) {
+        this.root = root;
+        this.ttlMs = options.ttlMs ?? DEFAULT_ROLLOUT_TTL_MS;
+        this.quietMs = options.quietMs ?? 10 * 60_000;
+        this.fullRefreshMs = options.fullRefreshMs ?? 60_000;
+        this.maxDepth = options.maxDepth ?? 4;
+        this.ops = options.ops ?? realOps;
+        this.now = options.now ?? Date.now;
+    }
+    /** Newest rollout first. `fresh` bypasses the shared listing (checkpoints, baselines). */
+    list(fresh = false) {
+        const now = this.now();
+        if (!fresh && now - this.builtAt < this.ttlMs)
+            return this.listing;
+        const full = fresh || now - this.fullAt >= this.fullRefreshMs;
+        this.rebuild(now, full);
+        return this.listing;
+    }
+    rebuild(now, full) {
+        const dirs = new Map();
+        const files = new Map();
+        const walk = (dir, depth) => {
+            let mtimeMs;
+            try {
+                mtimeMs = this.ops.stat(dir).mtimeMs;
+            }
+            catch {
+                return;
+            }
+            let entry = this.dirs.get(dir);
+            // A directory whose last read was taken right after a change is read once more: file times have
+            // coarse granularity, so a rollout created in the same tick as that change shares its mtime and
+            // would otherwise stay unseen until the next full refresh. (Judged by when it was LAST READ, not by
+            // how hot it is now: the next refresh comes a poll interval later, when it has long since cooled.)
+            if (full || !entry || entry.mtimeMs !== mtimeMs || entry.hotWhenRead) {
+                entry = this.readDir(dir, mtimeMs, depth, now);
+            }
+            dirs.set(dir, entry);
+            for (const rollout of entry.rollouts) {
+                const known = this.files.get(rollout);
+                if (!full && known && now - known.mtimeMs > this.quietMs) {
+                    files.set(rollout, known);
+                    continue;
+                }
+                try {
+                    const st = this.ops.stat(rollout);
+                    files.set(rollout, { path: rollout, mtimeMs: st.mtimeMs, size: st.size });
+                }
+                catch { /* raced with deletion */ }
+            }
+            if (depth < this.maxDepth)
+                for (const sub of entry.subdirs)
+                    walk(sub, depth + 1);
+        };
+        walk(this.root, 0);
+        this.dirs = dirs;
+        this.files = files;
+        this.listing = [...files.values()].sort((a, b) => b.mtimeMs - a.mtimeMs);
+        this.builtAt = now;
+        if (full)
+            this.fullAt = now;
+    }
+    readDir(dir, mtimeMs, depth, now) {
+        const entry = { mtimeMs, subdirs: [], rollouts: [], hotWhenRead: now - mtimeMs < HOT_DIR_MS };
+        let names;
+        try {
+            names = this.ops.readdir(dir);
+        }
+        catch {
+            return entry;
+        }
+        for (const name of names) {
+            const path = join(dir, name);
+            if (name.startsWith("rollout-") && name.endsWith(".jsonl")) {
+                entry.rollouts.push(path);
+                continue;
+            }
+            if (depth >= this.maxDepth)
+                continue;
+            try {
+                if (this.ops.stat(path).isDirectory())
+                    entry.subdirs.push(path);
+            }
+            catch { /* raced with deletion */ }
+        }
+        return entry;
+    }
+}
+const shared = new Map();
+let sharedTtlMs = DEFAULT_ROLLOUT_TTL_MS;
+/** The listing every source following `root` shares. */
+export function sharedRolloutIndex(root) {
+    let index = shared.get(root);
+    if (!index) {
+        index = new RolloutIndex(root, { ttlMs: sharedTtlMs });
+        shared.set(root, index);
+    }
+    return index;
+}
+/** Test seam: drop every shared listing and set the TTL new ones get (0 = always rebuild: a test edits its own tree between polls). */
+export function resetSharedRolloutIndexesForTests(ttlMs = DEFAULT_ROLLOUT_TTL_MS) {
+    shared.clear();
+    sharedTtlMs = ttlMs;
+}
+//# sourceMappingURL=rollout-index.js.map

package/dist/rollout-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollout-index.js","sourceRoot":"","sources":["../src/rollout-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8BjC,MAAM,OAAO,GAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAuBjG,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAC5C,sGAAsG;AACtG,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,MAAM,OAAO,YAAY;IAaM;IAZZ,KAAK,CAAS;IACd,OAAO,CAAS;IAChB,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,GAAG,CAAe;IAC3B,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnC,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvC,OAAO,GAAkB,EAAE,CAAC;IAC5B,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE1C,YAA6B,IAAY,EAAE,UAA+B,EAAE;QAA/C,SAAI,GAAJ,IAAI,CAAQ;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,GAAG,MAAM,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,0FAA0F;IAC1F,IAAI,CAAC,KAAK,GAAG,KAAK;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACnE,MAAM,IAAI,GAAG,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,OAAO,CAAC,GAAW,EAAE,IAAa;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;YAChD,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/D,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,gGAAgG;YAChG,gGAAgG;YAChG,oGAAoG;YACpG,mGAAmG;YACnG,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACrE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAClG,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAClC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ;gBAAE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO;oBAAE,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACnB,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IAC9B,CAAC;IAEO,OAAO,CAAC,GAAW,EAAE,OAAe,EAAE,KAAa,EAAE,GAAW;QACtE,MAAM,KAAK,GAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC;QACxG,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpG,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;AAC/C,IAAI,WAAW,GAAG,sBAAsB,CAAC;AAEzC,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uIAAuI;AACvI,MAAM,UAAU,iCAAiC,CAAC,KAAK,GAAG,sBAAsB;IAC9E,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC"}

package/dist/slash-authz.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Who may use a Discord slash command, decided once at the door.
+ *
+ * AgEnD registers its slash commands GLOBALLY: every guild the bot is in, and every DM with it, shows the
+ * same menu — Discord has no per-channel visibility to lean on, and the lock emoji in a description is only
+ * a label. So the handler is the only place authority can be enforced, and for a long time it was not: a
+ * slash command skipped the allowlist that guards the same words typed as a message, never looked at which
+ * guild it came from, and (apart from /start) never looked at whether it came from a DM. Anyone who shared
+ * any server with the bot could `/steer`, `/compact` or `/cancel` a fleet instance, or run `/sysinfo`.
+ *
+ * This is the pure decision. The caller supplies the facts (it owns the routing table, the access managers
+ * and the adapter's config), so the rule is testable without a Discord client and cannot drift between the
+ * two places that dispatch slash commands.
+ *
+ * What it settles, in order:
+ *  1. a DM is refused — nothing in AgEnD is addressed to a DM channel, and `guildId` is the only thing that
+ *     tells a DM from a guild;
+ *  2. the guild must be the adapter's own, unless the channel is a registered ClassicBot channel (those are
+ *     open by design, in any guild the operator allowed) or the command is `/start` (which validates its own
+ *     guild against `allowed_guilds`);
+ *  3. whoever speaks must be someone the text path would also hear: a fleet channel applies the access policy
+ *     of the adapter that owns its instance, anywhere else the invoking adapter's. ClassicBot channels stay
+ *     open, exactly as they are for typed messages.
+ *
+ * Which admin level a command needs stays with the command: this only decides whether the caller may speak.
+ */
+export type SlashScope = "fleet" | "classic" | "none";
+export type SlashSpeaker = 
+/** The caller is an explicit fleet admin, or the access policy of the world that governs this channel admits them. */
+"allowed" | "denied"
+/** A fleet channel whose owning adapter is not running: its policy cannot be applied, so nothing is let through. */
+ | "owner-not-running";
+export interface SlashFacts {
+    command: string;
+    /** Discord's guild id for the interaction; absent in a DM. */
+    guildId?: string;
+    /** The guild this adapter's fleet lives in (`group_id`); empty/absent when the adapter has none. */
+    primaryGuildId?: string;
+    /** What the channel the command was typed in is. */
+    scope: SlashScope;
+    speaker: SlashSpeaker;
+}
+export type SlashDenial = "dm" | "wrong-guild" | "not-allowed" | "owner-not-running";
+export type SlashDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reason: SlashDenial;
+};
+export declare function decideSlash(f: SlashFacts): SlashDecision;

package/dist/slash-authz.js

@@ -0,0 +1,19 @@
+export function decideSlash(f) {
+    if (!f.guildId)
+        return { allow: false, reason: "dm" };
+    const inOwnGuild = !!f.primaryGuildId && f.guildId === f.primaryGuildId;
+    if (!inOwnGuild && f.scope !== "classic" && f.command !== "start") {
+        return { allow: false, reason: "wrong-guild" };
+    }
+    // Typed messages in a ClassicBot channel are open to everyone there, and so are its slash commands.
+    if (f.scope === "classic")
+        return { allow: true };
+    // `/start` in a channel nobody has registered is how a ClassicBot channel comes to exist; its own guild
+    // check (allowed_guilds) is the gate, as it always was.
+    if (f.scope === "none" && f.command === "start")
+        return { allow: true };
+    if (f.speaker === "owner-not-running")
+        return { allow: false, reason: "owner-not-running" };
+    return f.speaker === "allowed" ? { allow: true } : { allow: false, reason: "not-allowed" };
+}
+//# sourceMappingURL=slash-authz.js.map

package/dist/slash-authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slash-authz.js","sourceRoot":"","sources":["../src/slash-authz.ts"],"names":[],"mappings":"AAkDA,MAAM,UAAU,WAAW,CAAC,CAAa;IACvC,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC;IACxE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IAED,oGAAoG;IACpG,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,wGAAwG;IACxG,wDAAwD;IACxD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAExE,IAAI,CAAC,CAAC,OAAO,KAAK,mBAAmB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5F,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC7F,CAAC"}

package/dist/spawn-gate.d.ts

@@ -1,8 +1,11 @@
+import { MemoryPressure } from "./memory-pressure.js";
 import type { StormWindow } from "./storm-window.js";
 export interface SpawnTask {
     instanceName: string;
     workingDirectory: string;
     reason: "startup" | "wake" | "recovery" | "restart";
+    /** Outer fleet operations reserve a slot before their Daemon.trySpawn call. */
+    stage?: "lifecycle";
 }
 export interface SpawnGateOptions {
     storm: StormWindow;
@@ -10,21 +13,30 @@ export interface SpawnGateOptions {
     staggerMs: () => number;
     random?: () => number;
     lowMemoryBytes?: number;
+    memoryPressure?: MemoryPressure;
 }
 /** Persistent fleet-wide concurrency/workdir gate shared by startup and recovery. */
 export declare class SpawnGate {
     private readonly options;
     private queue;
+    private nestedQueue;
     private active;
+    private physicalActive;
     private activeDirectories;
     private activeInstances;
     private lastStartedAt;
     private timer;
+    private capacityWait;
     private stopped;
+    private pumping;
+    private pressureRetryMs;
+    private pressureHeld;
     private readonly random;
-    private readonly lowMemoryBytes;
+    private readonly memoryPressure;
+    private readonly onStormReady;
     constructor(options: SpawnGateOptions);
     run<T>(task: SpawnTask, operation: () => Promise<T>): Promise<T>;
     shutdown(): void;
+    private wait;
     private pump;
 }

package/dist/spawn-gate.js

@@ -1,33 +1,40 @@
-import { freemem } from "node:os";
+import { MemoryPressure } from "./memory-pressure.js";
 /** Persistent fleet-wide concurrency/workdir gate shared by startup and recovery. */
 export class SpawnGate {
     options;
     queue = [];
+    nestedQueue = [];
     active = 0;
+    physicalActive = 0;
     activeDirectories = new Set();
     activeInstances = new Set();
     lastStartedAt = 0;
     timer = null;
+    capacityWait = false;
     stopped = false;
+    pumping = false;
+    pressureRetryMs = 5_000;
+    pressureHeld = false;
     random;
-    lowMemoryBytes;
+    memoryPressure;
+    onStormReady = () => this.pump();
     constructor(options) {
         this.options = options;
         this.random = options.random ?? Math.random;
-        this.lowMemoryBytes = options.lowMemoryBytes ?? 300 * 1024 * 1024;
-        options.storm.on("recovery_due", () => this.pump());
-        options.storm.on("closed", () => this.pump());
+        this.memoryPressure = options.memoryPressure ?? new MemoryPressure({ criticalBytes: options.lowMemoryBytes });
+        options.storm.on("recovery_due", this.onStormReady);
+        options.storm.on("closed", this.onStormReady);
     }
     run(task, operation) {
         if (this.stopped)
             return Promise.reject(new Error("Spawn gate is shutting down"));
         // startInstancesWithConcurrency/restartSingleInstance gate the whole
         // lifecycle operation, whose Daemon.trySpawn reaches this same choke point.
-        // Treat that nested acquisition as re-entrant for the same instance.
-        if (this.activeInstances.has(task.instanceName))
-            return operation();
+        // Keep the outer concurrency/workdir reservation, but recheck pressure
+        // before the nested physical spawn. Reacquiring its own slot would deadlock.
         return new Promise((resolve, reject) => {
-            this.queue.push({ task, run: operation, resolve, reject });
+            const queue = this.activeInstances.has(task.instanceName) ? this.nestedQueue : this.queue;
+            queue.push({ task, run: operation, resolve, reject });
             this.pump();
         });
     }
@@ -36,43 +43,105 @@ export class SpawnGate {
         if (this.timer)
             clearTimeout(this.timer);
         this.timer = null;
+        this.options.storm.off("recovery_due", this.onStormReady);
+        this.options.storm.off("closed", this.onStormReady);
         const err = new Error("Spawn gate shut down before task started");
         for (const item of this.queue.splice(0))
             item.reject(err);
+        for (const item of this.nestedQueue.splice(0))
+            item.reject(err);
+    }
+    wait(ms, capacityWait = false) {
+        this.capacityWait = capacityWait;
+        this.timer = setTimeout(() => { this.timer = null; this.capacityWait = false; this.pump(); }, ms);
+        this.timer.unref?.();
     }
     pump() {
-        if (this.stopped || this.timer || this.options.storm.isSpawnBlocked())
+        if (this.stopped || this.pumping || this.timer || this.options.storm.isSpawnBlocked())
             return;
-        const configured = Math.max(1, Math.min(20, this.options.concurrency()));
-        const limit = this.options.storm.isActive() ? Math.min(4, configured) : configured;
-        while (this.active < limit) {
-            const index = this.queue.findIndex(item => !this.activeDirectories.has(item.task.workingDirectory));
-            if (index < 0)
-                return;
-            if (this.active > 0 && freemem() < this.lowMemoryBytes) {
-                this.timer = setTimeout(() => { this.timer = null; this.pump(); }, 5_000);
-                this.timer.unref?.();
-                return;
+        this.pumping = true;
+        try {
+            while (!this.stopped) {
+                const index = this.queue.findIndex(item => !this.activeDirectories.has(item.task.workingDirectory));
+                if (this.nestedQueue.length === 0 && index < 0)
+                    return;
+                // Explicit zero preserves the existing deterministic test/embedding opt-out.
+                let pressure = this.options.lowMemoryBytes === 0 ? "normal" : this.memoryPressure.sample().level;
+                if (this.stopped)
+                    return;
+                if (pressure === "critical") {
+                    this.pressureHeld = true;
+                    this.wait(this.pressureRetryMs);
+                    this.pressureRetryMs = Math.min(60_000, this.pressureRetryMs * 2);
+                    return;
+                }
+                // A recovered host still uses slow admission while a held task waits
+                // for capacity. Start its full recovery window only when it can run.
+                if (this.pressureHeld && pressure === "normal")
+                    pressure = "elevated";
+                this.pressureRetryMs = 5_000;
+                const configured = Math.max(1, Math.min(20, this.options.concurrency()));
+                const limit = Math.min(pressure === "normal" ? configured : 1, this.options.storm.isActive() ? 4 : configured);
+                const nested = this.nestedQueue.length > 0;
+                const physical = (nested ? this.nestedQueue[0] : this.queue[index]).task.stage !== "lifecycle";
+                if (pressure !== "normal" && physical && this.physicalActive > 0) {
+                    this.wait(5_000, true);
+                    return;
+                }
+                if (!nested && this.active >= limit) {
+                    // Recovery must be able to raise the limit without waiting for a
+                    // long-running outer lifecycle callback to release its slot.
+                    if (pressure !== "normal")
+                        this.wait(5_000, true);
+                    return;
+                }
+                const stagger = Math.max(0, Math.min(30_000, this.options.staggerMs()), pressure === "normal" ? 0 : 5_000);
+                const jitter = this.options.storm.isActive() ? Math.floor(this.random() * 500) : 0;
+                // A healthy nested acquisition already owns its outer admission slot.
+                const delay = nested && pressure === "normal" ? 0 : Math.max(0, this.lastStartedAt + stagger + jitter - Date.now());
+                if (delay > 0) {
+                    this.wait(delay);
+                    return;
+                }
+                const [item] = nested ? this.nestedQueue.splice(0, 1) : this.queue.splice(index, 1);
+                if (this.pressureHeld) {
+                    this.memoryPressure.startRecoveryWindow();
+                    this.pressureHeld = false;
+                }
+                if (!nested) {
+                    this.active++;
+                    this.activeDirectories.add(item.task.workingDirectory);
+                    this.activeInstances.add(item.task.instanceName);
+                }
+                if (physical)
+                    this.physicalActive++;
+                this.lastStartedAt = Date.now();
+                let operation;
+                try {
+                    operation = item.run();
+                }
+                catch (err) {
+                    operation = Promise.reject(err);
+                }
+                void operation.then(item.resolve, item.reject).finally(() => {
+                    if (physical)
+                        this.physicalActive--;
+                    if (!nested) {
+                        this.active--;
+                        this.activeDirectories.delete(item.task.workingDirectory);
+                        this.activeInstances.delete(item.task.instanceName);
+                    }
+                    if (this.capacityWait && this.timer) {
+                        clearTimeout(this.timer);
+                        this.timer = null;
+                        this.capacityWait = false;
+                    }
+                    this.pump();
+                });
             }
-            const stagger = Math.max(0, Math.min(30_000, this.options.staggerMs()));
-            const jitter = this.options.storm.isActive() ? Math.floor(this.random() * 500) : 0;
-            const wait = Math.max(0, this.lastStartedAt + stagger + jitter - Date.now());
-            if (wait > 0) {
-                this.timer = setTimeout(() => { this.timer = null; this.pump(); }, wait);
-                this.timer.unref?.();
-                return;
-            }
-            const [item] = this.queue.splice(index, 1);
-            this.active++;
-            this.activeDirectories.add(item.task.workingDirectory);
-            this.activeInstances.add(item.task.instanceName);
-            this.lastStartedAt = Date.now();
-            void item.run().then(item.resolve, item.reject).finally(() => {
-                this.active--;
-                this.activeDirectories.delete(item.task.workingDirectory);
-                this.activeInstances.delete(item.task.instanceName);
-                this.pump();
-            });
+        }
+        finally {
+            this.pumping = false;
         }
     }
 }

package/dist/spawn-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-gate.js","sourceRoot":"","sources":["../src/spawn-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAwBlC,qFAAqF;AACrF,MAAM,OAAO,SAAS;IAWS;IAVrB,KAAK,GAAiB,EAAE,CAAC;IACzB,MAAM,GAAG,CAAC,CAAC;IACX,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,GAAyC,IAAI,CAAC;IACnD,OAAO,GAAG,KAAK,CAAC;IACP,MAAM,CAAe;IACrB,cAAc,CAAS;IAExC,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,GAAG,CAAI,IAAe,EAAE,SAA2B;QACjD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAClF,qEAAqE;QACrE,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QACpE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAgB,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;YAAE,OAAO;QAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACnF,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACpG,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC1E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7E,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBACzE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC1D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"spawn-gate.js","sourceRoot":"","sources":["../src/spawn-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA2BtD,qFAAqF;AACrF,MAAM,OAAO,SAAS;IAkBS;IAjBrB,KAAK,GAAiB,EAAE,CAAC;IACzB,WAAW,GAAiB,EAAE,CAAC;IAC/B,MAAM,GAAG,CAAC,CAAC;IACX,cAAc,GAAG,CAAC,CAAC;IACnB,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,GAAyC,IAAI,CAAC;IACnD,YAAY,GAAG,KAAK,CAAC;IACrB,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,eAAe,GAAG,KAAK,CAAC;IACxB,YAAY,GAAG,KAAK,CAAC;IACZ,MAAM,CAAe;IACrB,cAAc,CAAiB;IAC/B,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAElD,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,cAAc,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,GAAG,CAAI,IAAe,EAAE,SAA2B;QACjD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAClF,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,6EAA6E;QAC7E,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAgB,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,YAAY,GAAG,KAAK;QAC3C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;YAAE,OAAO;QAC9F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpG,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;oBAAE,OAAO;gBACvD,6EAA6E;gBAC7E,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;gBACjG,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACzB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAChC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,qEAAqE;gBACrE,qEAAqE;gBACrE,IAAI,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,QAAQ;oBAAE,QAAQ,GAAG,UAAU,CAAC;gBACtE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;gBAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACzE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;gBAC/F,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;oBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACvB,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;oBACpC,iEAAiE;oBACjE,6DAA6D;oBAC7D,IAAI,QAAQ,KAAK,QAAQ;wBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnF,sEAAsE;gBACtE,MAAM,KAAK,GAAG,MAAM,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACpH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACpF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACtB,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC;oBAC1C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC5B,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;oBACd,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;oBACvD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnD,CAAC;gBACD,IAAI,QAAQ;oBAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,IAAI,SAA2B,CAAC;gBAChC,IAAI,CAAC;oBAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAChF,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1D,IAAI,QAAQ;wBAAE,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;wBAC1D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACtD,CAAC;oBACD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACpC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;wBAClB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;oBAC5B,CAAC;oBACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/storm-window.d.ts

@@ -1,7 +1,16 @@
 import { EventEmitter } from "node:events";
 export type StormPhase = "closed" | "backing_off" | "recovering";
+/**
+ * What opened the window. `server`: the tmux server died or was replaced (every
+ * window is gone, spawning is held for a backoff). `window_loss`: the server is
+ * fine but several instances lost their windows within seconds of each other
+ * (#1127) — a host or tmux-level event, not N independent crashes; nothing is
+ * held, but the recoveries run at the storm rate and as ONE incident.
+ */
+export type StormKind = "server" | "window_loss";
 export interface StormSnapshot {
     phase: StormPhase;
+    kind: StormKind;
     generation: number;
     crashLevel: number;
     crashCount: number;
@@ -19,6 +28,9 @@ export interface StormWindowOptions {
     backoffsMs?: readonly number[];
     stableResetMs?: number;
     recoveryTimeoutMs?: number;
+    /** Distinct instances losing their window inside `windowLossWindowMs` that count as one event (#1127). */
+    windowLossThreshold?: number;
+    windowLossWindowMs?: number;
 }
 /**
  * Fleet-wide tmux-server storm state.
@@ -35,7 +47,17 @@ export declare class StormWindow extends EventEmitter {
     private readonly backoffsMs;
     private readonly stableResetMs;
     private readonly recoveryTimeoutMs;
+    private readonly windowLossThreshold;
+    /** The span in which `windowLossThreshold` distinct losses make one event. */
+    readonly windowLossWindowMs: number;
     private phase;
+    private kind;
+    private windowLosses;
+    /**
+     * Instances whose last respawn finished outside a storm. A fresh loss withdraws
+     * the entry (noteWindowLoss), so it only ever speaks for the loss it followed.
+     */
+    private windowLossRecovered;
     private generation;
     private crashLevel;
     private crashCount;
@@ -69,6 +91,26 @@ export declare class StormWindow extends EventEmitter {
     observeServerAlive(pid: number | null): boolean;
     addAffected(name: string): void;
     markRecovered(name: string): void;
+    /**
+     * An instance confirmed that its tmux window is gone while the server is
+     * alive. One such loss is an ordinary crash; several inside the window are one
+     * infrastructure event, and N independent respawn loops would stampede (#1127).
+     * Returns true when THIS call opens the window. Once a window is open, a loss
+     * simply joins it.
+     */
+    noteWindowLoss(name: string): boolean;
+    private openWindowLossBurst;
+    /**
+     * A respawn finished outside a storm. Remember it, so that an instance that
+     * recovered before a burst was recognised is not counted as still down when
+     * the next loss opens one (inside an open window the caller marks recovery).
+     */
+    noteWindowRecovered(name: string): void;
+    /**
+     * A live pane inside an open window-loss burst is recovery evidence on its own
+     * (a server storm is different: a pane alive then says nothing about the CLI).
+     */
+    noteWindowAlive(name: string): void;
     shouldSuppress(kind: string): boolean;
     waitForSpawnAllowed(): Promise<void>;
     waitForDeliveryAllowed(name: string): Promise<void>;