@timurproko/a1 0.1.8-dev.134 → 0.1.8-dev.137

package/bin/cli.js

@@ -11,12 +11,23 @@ const capabilities = cliCapabilities(JSON.parse(await readFile(new URL("package.
 
 process.exitCode = await dispatchCli(process.argv.slice(2), {
   launch: async intent => {
-    const [{ prepareInteractiveLaunch }, { runBootstrap }] = await Promise.all([
+    const [{ prepareInteractiveLaunch }, { runBootstrap }, { healModuleIdentityAtLaunch, releaseCopyIsLaunchable }] = await Promise.all([
       import("../dist/features/launch/index.js"),
       import("../dist/foundation/release/index.js"),
+      import("./module-identity.js"),
     ]);
+    // Self-heal the installed tree before the release store copies it: npm 12
+    // blocks install scripts by default, so the postinstall that normally
+    // repairs module identity may never have run (see bin/module-identity.js).
+    const packageRootPath = fileURLToPath(packageRoot);
+    await healModuleIdentityAtLaunch(packageRootPath, message => process.stderr.write(message));
     const prepared = await prepareInteractiveLaunch(intent);
-    return await runBootstrap({ packageRoot: fileURLToPath(packageRoot), launchIntent: intent, environment: prepared.environment });
+    return await runBootstrap({
+      packageRoot: packageRootPath,
+      launchIntent: intent,
+      environment: prepared.environment,
+      releaseIsLaunchable: releaseCopyIsLaunchable,
+    });
   },
   version: async () => {
     const { runVersionStats } = await import("../dist/cli/index.js");

package/bin/module-identity.js

@@ -132,6 +132,29 @@ function message(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+/**
+ * Launch-entry self-heal: when A1 and pinned Pi disagree on the terminal
+ * module, rewrite the proxy to the copy Pi resolves before anything copies
+ * this tree. npm 12 blocks install scripts unless allowScripts covers the
+ * package, so the postinstall that normally rewrites the proxy may never
+ * have run and the installed tree may still carry the published placeholder
+ * path. Named neutrally so the launch entries that call it stay free of
+ * terminal implementation identifiers, as the bootstrap boundary requires.
+ */
+export async function healModuleIdentityAtLaunch(packageRoot, warn) {
+  if (inspectPiTuiModuleIdentity(packageRoot).kind === "unified") return;
+  const { syncPiTuiProxy } = await import("./sync-pi-tui-proxy.js");
+  const outcome = syncPiTuiProxy(packageRoot);
+  if (outcome.kind === "unresolved") {
+    warn(`a1: could not point the terminal module proxy at pinned Pi's copy (${outcome.message}); extension UI may not render.\n`);
+  }
+}
+
+/** Whether a materialized release copy resolves one terminal module for both A1 and Pi. */
+export function releaseCopyIsLaunchable(releaseRoot) {
+  return inspectPiTuiModuleIdentity(releaseRoot).kind === "unified";
+}
+
 /** Launch-entry wrapper: warn on stderr when the two sides disagree. */
 export function assertSinglePiTuiModuleAtLaunch(packageRoot, warn) {
   const outcome = inspectPiTuiModuleIdentity(packageRoot);

package/dist/foundation/release/bootstrap.d.ts

@@ -13,6 +13,16 @@ export interface BootstrapOptions {
     };
     readonly environment?: NodeJS.ProcessEnv;
     readonly output?: Pick<NodeJS.WriteStream, "write">;
+    /**
+     * Whether a materialized release copy is fit to launch. The active release
+     * is normally reused while its version matches the installation, but a copy
+     * can be broken in ways a version cannot see — materialized from a tree a
+     * blocked postinstall never finished repairing. The probe is injected from
+     * the bin entry because deciding it requires inspecting dependency
+     * resolution, which stays out of production code. Absent means every
+     * release is fit.
+     */
+    readonly releaseIsLaunchable?: (releaseRoot: string) => boolean;
 }
 export declare function runBootstrap(options: BootstrapOptions): Promise<number>;
 export declare function certifyMaterializedRelease(release: MaterializedRelease, dataDir: string, verification?: VerifyMaterializedReleaseOptions): Promise<string>;

package/dist/foundation/release/bootstrap.js

@@ -46,7 +46,8 @@ export async function runBootstrap(options) {
     const installedVersion = await readInstalledVersion(options.packageRoot);
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
-    if (active?.approval === "approved" && active.packageVersion === installedVersion) {
+    const activeIsLaunchable = active === undefined || (options.releaseIsLaunchable?.(active.releaseRoot) ?? true);
+    if (activeIsLaunchable && active?.approval === "approved" && active.packageVersion === installedVersion) {
         const endpointMatches = endpoint?.releaseId === active.releaseId
             && endpoint.releaseRoot === active.releaseRoot
             && endpoint.contentDigest === active.contentDigest;
@@ -73,6 +74,17 @@ export async function runBootstrap(options) {
         await stateStore.activate(candidate.releaseId);
         state = await stateStore.read();
     }
+    else if (!activeIsLaunchable && candidate.releaseId !== activeId
+        && state.releases[candidate.releaseId]?.approval !== "approved") {
+        // The active reference points at a copy that cannot launch, so reusing it
+        // is off the table — but an unapproved candidate would lose the selection
+        // below to that same broken active (`start-active`). Approving the healed
+        // candidate here lets ordinary cohort selection activate it, while a live
+        // busy cohort still wins the endpoint checks and keeps its sessions.
+        const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
+        await stateStore.approve(candidate.releaseId, diagnosticsPath);
+        state = await stateStore.read();
+    }
     // The candidate's own endpoint decides whether this launch attaches or starts a supervisor.
     // A cohort other than this one is not in the way: it listens somewhere else.
     endpointPaths = resolveCohortEndpoint(paths, candidate.releaseId, environment);

package/dist/foundation/release/update.js

@@ -403,6 +403,19 @@ export async function runSelfUpdate(options) {
             }
             transaction = await transactionStore.advance("package-installed");
         }
+        // npm 12 blocks install scripts unless allowScripts covers the package, so
+        // the postinstall that points the #pi-tui proxy at the tree npm just built
+        // may never have run. Run the shipped script directly: the proxy must be
+        // correct before the release store copies this tree. A failure is reported
+        // and left to the launch-time self-heal rather than failing the update.
+        try {
+            const proxySync = await runner(process.execPath, [resolve(packageRoot, "bin", "sync-pi-tui-proxy.js")], { captureStdout: true });
+            if (proxySync.code !== 0)
+                output.stderr(`${PRODUCT_TEXT.diagnostic(`could not point the #pi-tui proxy at the installed tree (exited ${formatExitCode(proxySync.code)}).`)}\n`);
+        }
+        catch (error) {
+            output.stderr(`${PRODUCT_TEXT.diagnostic(`could not point the #pi-tui proxy at the installed tree: ${errorMessage(error)}`)}\n`);
+        }
         progress.set(70, 75);
         // Ownership can be reacquired after an interrupted installation (for
         // example, if bare A1 is launched before the update is resumed). Recheck

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "unsupported",
-  "builtAt": "2026-08-25T18:22:19.065Z",
+  "builtAt": "2026-08-26T06:22:58.678Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "7524bf568992517f50ed53196c861c5edeba0d7275633bb4735ab45bd5963a28",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-08-25T18:22:33.863Z",
+  "builtAt": "2026-08-26T06:22:53.598Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "ee8a00eaaf79c707459bbbfb52518e9739314967049fbe5fa625f36ce33db9ee",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-08-25T18:23:18.046Z",
+  "builtAt": "2026-08-26T06:23:46.974Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "2f13a4c73ed082a13cf9947be6f363c3c800eaf40e22ea9ae4674299d7f51cdd",
+    "sha256": "7b6350b01d875ee3d0db81a1ed5126df5e4a796b93c9ea146e9f24d1f1ab5a2e",
     "size": 172544
   },
   "provenance": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.134",
+  "version": "0.1.8-dev.137",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "packageManager": "npm@11.13.0",