@tiangong-ai/cli 0.0.45 → 0.0.47

package/dist/research/workspace/setup.js

@@ -10,6 +10,7 @@ import { inspectResearchContext } from "./context.js";
 import { inspectCapabilityCredentialEnvironment, loadCapabilityCredentialMapForIds, reconcileCapabilityCredentialEnvironment, setCapabilityCredentialValue, } from "./credentials.js";
 import { configureExternalSkillProfile, configureTiangongDatabaseCapability, doctorExternalCapabilities, EXTERNAL_SKILL_CONTEXT_PROFILE, EXTERNAL_SKILL_MEDIA_PROFILE, EXTERNAL_SKILL_PROFILE, reconcileSetupManagedCapabilities, } from "./external-skills.js";
 import { appendJournalEvent } from "./journal.js";
+import { researchPlatformCapabilities } from "./platform-capabilities.js";
 import { validateResearchPolicyPack } from "./research-policy.js";
 import { configuredResearchSecrets, isSensitiveEnvironmentName, sanitizeResearchRecord, sanitizeResearchText, } from "./sanitization.js";
 import { inspectResearchSetupCatalog, RESEARCH_SETUP_CREDENTIALS, RESEARCH_SETUP_INSTALLER, RESEARCH_SETUP_SETTINGS, RESEARCH_SETUP_SKILLS, resolveSetupSkills, setupSkill, setupSource, setupTargetRoot, verifyResearchSetupRuntimeContract, } from "./setup-catalog.js";
@@ -1245,13 +1246,8 @@ export async function doctorResearchSetup(workspace, options = {}) {
             return `${command} is executable (${sanitizeResearchText(result.stdout.trim()).slice(0, 120)}).`;
         });
     }
-    if (plan.reviewerExecution.transport === "sandbox-bridge") {
-        await setupDoctorCheck(checks, "platform-sandbox", "runtime", async () => {
-            const status = await inspectReviewerBridgeStatus(root);
-            return `Owner-controlled reviewer sidecar is ready; version=${status.packageVersion}; key=${status.keyFingerprint.slice(0, 12)}.`;
-        });
-    }
-    else if (platform() === "win32") {
+    const platformCapabilities = researchPlatformCapabilities(platform());
+    if (!platformCapabilities.nativeReviewerExecution) {
         const production = plan.workspace.mode === "production-research";
         checks.push({
             id: "platform-sandbox",
@@ -1259,24 +1255,30 @@ export async function doctorResearchSetup(workspace, options = {}) {
             scope: "research-core",
             status: production ? "fail" : "warn",
             detail: production
-                ? "Production research execution is unsupported on Windows because no approved capsule sandbox is available."
-                : "Windows can inspect and smoke-test setup state, but native research execution requires an approved macOS or Linux capsule sandbox.",
+                ? `Production research execution is unsupported on ${platformCapabilities.platform} because no approved capsule sandbox is available.`
+                : `${platformCapabilities.platform} is configuration/smoke-only; it can inspect setup state but cannot start a native reviewer or reviewer sidecar.`,
             minimumAction: production
                 ? "Run production research on macOS with sandbox-exec or Linux with Bubblewrap."
-                : "Use macOS or Linux before switching this workspace to production-research mode.",
+                : "Use macOS or Linux before switching this workspace to production-research mode or starting a reviewer sidecar.",
             blocking: production,
             requiredFor: production ? ["setup", "research-core"] : [],
         });
     }
+    else if (plan.reviewerExecution.transport === "sandbox-bridge") {
+        await setupDoctorCheck(checks, "platform-sandbox", "runtime", async () => {
+            const status = await inspectReviewerBridgeStatus(root);
+            return `Owner-controlled reviewer sidecar is ready; version=${status.packageVersion}; key=${status.keyFingerprint.slice(0, 12)}.`;
+        });
+    }
     else {
         await setupDoctorCheck(checks, "platform-sandbox", "runtime", async () => {
-            if (platform() === "darwin") {
+            if (platformCapabilities.nativeIsolationProvider === "sandbox-exec") {
                 const info = await lstat("/usr/bin/sandbox-exec").catch(() => undefined);
                 if (!info?.isFile())
                     throw new Error("/usr/bin/sandbox-exec is unavailable");
                 return "macOS sandbox-exec is available.";
             }
-            if (platform() === "linux") {
+            if (platformCapabilities.nativeIsolationProvider === "bubblewrap") {
                 const result = await runner({
                     command: "bwrap",
                     args: ["--version"],
@@ -1288,7 +1290,7 @@ export async function doctorResearchSetup(workspace, options = {}) {
                     throw new Error("Bubblewrap is unavailable");
                 return "Linux Bubblewrap is available.";
             }
-            throw new Error("Research execution is unsupported on this platform");
+            throw new Error(`Research execution is unsupported on ${platformCapabilities.platform}`);
         });
     }
     checks.push({
@@ -1700,47 +1702,48 @@ export async function checkResearchSetupUpdates(workspace, environment = process
 export async function clearStaleSetupLock(workspace) {
     const root = requireAbsoluteWorkspace(resolve(workspace));
     const lockPath = workspacePaths(root).setupLock;
-    const info = await lstat(lockPath).catch(() => undefined);
-    if (!info)
-        return;
-    if (!info.isFile() || info.isSymbolicLink()) {
-        throw setupError({
-            code: "RESEARCH_SETUP_LOCK_INVALID",
-            step: "retry",
-            reason: "Setup lock is not a regular file.",
-            minimumAction: "Inspect the lock path manually; it will not be removed automatically.",
-            retryCommand: `tiangong-ai research setup status --workspace ${root} --json`,
-            exitCode: 3,
-        });
-    }
-    let payload;
+    let release;
     try {
-        payload = JSON.parse(await readFile(lockPath, "utf8"));
-    }
-    catch {
-        payload = null;
+        release = await acquireFileLock(lockPath, {
+            operation: "research.setup.lock-recovery",
+            acquiredAt: new Date().toISOString(),
+        });
     }
-    if (isObject(payload) && payload.hostname === hostname() && typeof payload.pid === "number") {
-        try {
-            process.kill(payload.pid, 0);
-            throw setupError({
-                code: "RESEARCH_SETUP_LOCK_ACTIVE",
-                step: "retry",
-                reason: `Setup lock belongs to live process ${payload.pid}.`,
-                minimumAction: "Wait for the active setup process to finish; do not clear its lock.",
-                retryCommand: `tiangong-ai research setup status --workspace ${root} --json`,
+    catch (error) {
+        if (error instanceof CliError && error.code === "RESEARCH_WORKSPACE_LOCKED") {
+            const details = isObject(error.details) ? error.details : {};
+            if (details.ownerState === "alive") {
+                throw new CliError("Setup is already running in another live process.", {
+                    code: "RESEARCH_SETUP_LOCK_ACTIVE",
+                    exitCode: 3,
+                    details: {
+                        ownerState: "alive",
+                        operation: typeof details.operation === "string" ? details.operation : null,
+                        acquiredAt: typeof details.acquiredAt === "string" ? details.acquiredAt : null,
+                        minimumAction: "Wait for the active setup operation to finish, then retry; do not delete lock state manually.",
+                    },
+                });
+            }
+            throw new CliError("Setup lock ownership cannot yet be verified safely.", {
+                code: "RESEARCH_SETUP_LOCK_UNVERIFIABLE",
                 exitCode: 3,
+                details: {
+                    ownerState: "unknown",
+                    retryAfterSeconds: typeof details.retryAfterSeconds === "number" ? details.retryAfterSeconds : null,
+                    minimumAction: "Wait for the reported lease interval and retry; do not delete lock state manually.",
+                },
             });
         }
-        catch (error) {
-            if (error instanceof CliError)
-                throw error;
-            const code = error.code;
-            if (code !== "ESRCH")
-                throw error;
-        }
+        throw new CliError("Setup lock state is unreadable or unsafe.", {
+            code: "RESEARCH_SETUP_LOCK_INVALID",
+            exitCode: 3,
+            details: {
+                ownerState: "unknown",
+                minimumAction: "Inspect workspace filesystem permissions and lock-state integrity; do not delete lock state manually.",
+            },
+        });
     }
-    await rm(lockPath);
+    await release();
 }
 function parseResearchSetupPlan(value) {
     if (!isObject(value) ||