@timurproko/a1 0.1.8-dev.282 → 0.1.8-dev.289

package/dist/integrations/pi/session-ui/session-viewport-controller.js

@@ -159,8 +159,16 @@ export class SessionViewportController {
             this.#requestHyperlinkCleanup();
             this.#requestRender(true);
         }
-        if (this.#viewport.frame === null)
-            return { data, consumed: false };
+        if (this.#viewport.frame === null) {
+            // Invariant: a not-yet-painted A1 screen is not Pi's selection surface.
+            return routeMouseInput(data, event => {
+                if (event.kind === "press" && event.button === 0)
+                    this.#tailPointerSuppressed = true;
+                if (event.kind === "release")
+                    this.#tailPointerSuppressed = false;
+                return event.kind === "motion" || event.kind === "release" || (event.kind === "press" && event.button === 0);
+            });
+        }
         if (data === "\u0003") {
             if (this.#editor.hasSelection()) {
                 if (this.#viewport.clearSelection())
@@ -287,6 +295,8 @@ export class SessionViewportController {
                 }
                 if (event.button !== 0)
                     return false;
+                this.#dockPointerSuppressed = false;
+                this.#tailPointerSuppressed = false;
                 this.#stopSelectionAutoScroll();
                 if (this.#viewport.clearSelection())
                     repaint = true;
@@ -335,16 +345,16 @@ export class SessionViewportController {
                 }
                 if (event.row >= 1 && event.row <= hits.viewportHeight && event.column <= frame.contentWidth) {
                     if (!this.#viewport.pressSelection(event.column, event.row, now)) {
-                        // Invariant: a full drag begun on transient tail rows cannot become transcript selection.
-                        if (hits.transientTail.includes(event.row))
-                            this.#tailPointerSuppressed = true;
+                        // Invariant: empty rows and transient tail rows must never start Pi selection.
+                        this.#tailPointerSuppressed = true;
                         repaint = true;
-                        return this.#tailPointerSuppressed;
+                        return true;
                     }
                     repaint = true;
                     return true;
                 }
-                return false;
+                this.#tailPointerSuppressed = true;
+                return true;
             }
             if (event.kind === "release") {
                 if (this.#editor.ownsPointer() && this.#editorPointerFrame !== undefined) {

package/dist/integrations/pi/session-ui/system-clipboard.d.ts

@@ -11,10 +11,10 @@ export declare function preloadSystemClipboard(): void;
  * private clipboard module. Failures are deliberately non-fatal: a denied or
  * unavailable clipboard simply makes the paste action a no-op.
  */
-export declare function readSystemClipboardContent(): Promise<PiShellClipboardContent | null>;
+export declare function readSystemClipboardContent(signal?: AbortSignal): Promise<PiShellClipboardContent | null>;
 export declare function readSystemClipboardImage(reader: SystemClipboardImageReader): Promise<{
     readonly data: string;
     readonly mimeType: string;
 } | null>;
-export declare function readSystemClipboardText(): Promise<string | null>;
+export declare function readSystemClipboardText(signal?: AbortSignal): Promise<string | null>;
 export declare function writeSystemClipboardText(text: string): Promise<void>;

package/dist/integrations/pi/session-ui/system-clipboard.js

@@ -1,5 +1,7 @@
 import { execFile } from "node:child_process";
 import { canonicalizeClipboardImage } from "./clipboard-image.js";
+import { ImageAttachmentError } from "../../../contracts/owned-ui/index.js";
+import { assertSourceBytes } from "./image-source.js";
 const MAX_CLIPBOARD_BYTES = 16 * 1024 * 1024;
 let nativeClipboardPromise;
 let pendingClipboardWrite = Promise.resolve();
@@ -13,13 +15,13 @@ export function preloadSystemClipboard() {
  * private clipboard module. Failures are deliberately non-fatal: a denied or
  * unavailable clipboard simply makes the paste action a no-op.
  */
-export async function readSystemClipboardContent() {
+export async function readSystemClipboardContent(signal) {
     await pendingClipboardWrite;
     const native = await nativeClipboard();
     if (native !== null) {
         try {
             if (process.platform === "win32" && native.availableFormats().some(isFileDropFormat)) {
-                const files = await readSystemClipboardText();
+                const files = await readSystemClipboardText(signal);
                 if (files !== null)
                     return { kind: "text", text: files };
             }
@@ -27,11 +29,13 @@ export async function readSystemClipboardContent() {
             if (image !== null)
                 return { kind: "image", ...image };
         }
-        catch {
+        catch (error) {
+            if (error instanceof ImageAttachmentError)
+                throw error;
             // Compatibility: fall through to text and platform readers.
         }
     }
-    const text = await readSystemClipboardText();
+    const text = await readSystemClipboardText(signal);
     return text === null ? null : { kind: "text", text };
 }
 export async function readSystemClipboardImage(reader) {
@@ -40,14 +44,18 @@ export async function readSystemClipboardImage(reader) {
     if (reader.getImageBinary !== undefined) {
         try {
             const bytes = await reader.getImageBinary();
+            if (bytes.length > 0)
+                assertSourceBytes(bytes.length);
             if (bytes.length > 0 && bytes.every(byte => Number.isInteger(byte) && byte >= 0 && byte <= 255)) {
                 return canonicalizeClipboardImage({
                     data: Buffer.from(bytes).toString("base64"),
                     mimeType: "image/png",
-                });
+                }, true);
             }
         }
-        catch {
+        catch (error) {
+            if (error instanceof ImageAttachmentError)
+                throw error;
             // Compatibility: older or partially available native bindings may still expose base64.
         }
     }
@@ -56,15 +64,17 @@ export async function readSystemClipboardImage(reader) {
             return canonicalizeClipboardImage({
                 data: await reader.getImageBase64(),
                 mimeType: "image/png",
-            });
+            }, true);
         }
-        catch {
+        catch (error) {
+            if (error instanceof ImageAttachmentError)
+                throw error;
             // Compatibility: fall through to the caller's text path.
         }
     }
     return null;
 }
-export async function readSystemClipboardText() {
+export async function readSystemClipboardText(signal) {
     // Concurrency: Ctrl+C/Ctrl+X and Ctrl+V can arrive in adjacent input turns. Serialize the
     // read behind our native write so paste never observes the previous value.
     await pendingClipboardWrite;
@@ -87,12 +97,12 @@ export async function readSystemClipboardText() {
             "$t=Get-Clipboard -Raw -ErrorAction SilentlyContinue",
             "if ($null -ne $t -and $t.Length -gt 0) {[Console]::Out.Write($t)} else {$f=Get-Clipboard -Format FileDropList -ErrorAction SilentlyContinue; if ($f) {[Console]::Out.Write(($f | ForEach-Object {$_.FullName}) -join [Environment]::NewLine)}}",
         ].join("; ");
-        return execClipboard("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script]);
+        return execClipboard("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], signal);
     }
     if (process.platform === "darwin")
-        return execClipboard("pbpaste", []);
-    return (await execClipboard("wl-paste", ["--no-newline", "--type", "text"]))
-        ?? execClipboard("xclip", ["-selection", "clipboard", "-o"]);
+        return execClipboard("pbpaste", [], signal);
+    return (await execClipboard("wl-paste", ["--no-newline", "--type", "text"], signal))
+        ?? execClipboard("xclip", ["-selection", "clipboard", "-o"], signal);
 }
 export function writeSystemClipboardText(text) {
     const write = async () => {
@@ -118,13 +128,14 @@ function nativeClipboard() {
 function isFileDropFormat(format) {
     return /(?:filedrop|hdrop|shell idlist)/iu.test(format);
 }
-function execClipboard(command, args) {
+function execClipboard(command, args, signal) {
     return new Promise(resolve => {
         execFile(command, args, {
             encoding: "utf8",
             maxBuffer: MAX_CLIPBOARD_BYTES,
             timeout: 5_000,
             windowsHide: true,
+            ...(signal === undefined ? {} : { signal }),
         }, (error, stdout) => resolve(error || stdout.length === 0 ? null : stdout));
     });
 }

package/dist/integrations/pi/tui-runtime/adapter.js

@@ -1,4 +1,5 @@
 import { HStack, ProcessTerminal, ScrollView, TuiAltScreen, TuiMainScreen, VStack, visibleWidth, } from "#pi-tui";
+import { boundedCleanup, EMERGENCY_TERMINAL_RESET } from "../../../foundation/terminal-cleanup/index.js";
 import { InputPresentationCoordinator, } from "./input-presentation-coordinator.js";
 /** Identifies the Pi TUI lifecycle stage that failed while preserving the original cause. */
 export class PiTuiRuntimeError extends Error {
@@ -402,11 +403,16 @@ export class PiTuiRuntimeAdapter {
     }
     async #stop(options) {
         this.#state = "stopping";
-        this.#inputCoordinator?.flush();
         let failure;
+        try {
+            this.#inputCoordinator?.dispose(false);
+        }
+        catch (error) {
+            failure = new PiTuiRuntimeError("restoration", error);
+        }
         if (options.drainInput !== false) {
             try {
-                await this.#terminal.drainInput(options.drainMaxMs, options.drainIdleMs);
+                await boundedCleanup(() => this.#terminal.drainInput(options.drainMaxMs, options.drainIdleMs));
             }
             catch (error) {
                 failure = new PiTuiRuntimeError("input-drain", error);
@@ -559,6 +565,11 @@ export class PiTuiRuntimeAdapter {
     }
     #bestEffortTerminalRestore() {
         this.#clearTerminalProgress();
+        try {
+            if (this.mode === "fullscreen")
+                this.#terminal.write(EMERGENCY_TERMINAL_RESET);
+        }
+        catch { }
         try {
             this.#terminal.showCursor();
         }

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-09-08T08:10:40.090Z",
+  "builtAt": "2026-09-10T06:03:25.250Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "dc03605e5780e2aeebb4ecafd62868dc673e22ddd38b024a369aff704ff136dc",

package/dist/native/linux-x64/manifest.json

@@ -5,11 +5,11 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-08T08:10:24.232Z",
+  "builtAt": "2026-09-10T06:03:35.868Z",
   "artifact": {
     "filename": "process-guardian",
-    "sha256": "ee8a00eaaf79c707459bbbfb52518e9739314967049fbe5fa625f36ce33db9ee",
-    "size": 414568
+    "sha256": "d8cda6b0c7cb36c0cc41e90802aceebf6c02eaebbc08a83d7d963d2e918dbd7a",
+    "size": 414536
   },
   "provenance": {
     "language": "Rust",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-08T08:11:13.440Z",
+  "builtAt": "2026-09-10T06:04:05.737Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "b6daac4921fa900e544d9db45f85177267934415ecdf2935c2d6d1ae8bc59b0a",
+    "sha256": "d46f6641ceb7ef4fe2ab74d123f639f9ca6d5192a595d0660536ebc1e2237533",
     "size": 177664
   },
   "provenance": {

package/dist/runtime-payload-inventory.json

@@ -171,9 +171,6 @@
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/pool/package.json",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/utf8/LICENSE",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/utf8/package.json",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/LICENSE.md",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/package.json",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/core/LICENSE",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/core/package.json",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/credential-provider-imds/LICENSE",
@@ -495,6 +492,9 @@
     "node_modules/@mariozechner/clipboard-win32-x64-msvc/clipboard.win32-x64-msvc.node",
     "node_modules/@mariozechner/clipboard-win32-x64-msvc/package.json",
     "node_modules/@mariozechner/clipboard/package.json",
+    "node_modules/@silvia-odwyer/photon-node/LICENSE.md",
+    "node_modules/@silvia-odwyer/photon-node/package.json",
+    "node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm",
     "node_modules/chalk/license",
     "node_modules/chalk/package.json",
     "node_modules/cross-spawn/LICENSE",
@@ -2693,12 +2693,6 @@
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/utf8/tests/data/surrogate_pair_bug.txt",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/utf8/tests/data/utf8.txt",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/utf8/tests/index.js",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/LICENSE.md",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/README.md",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/package.json",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/photon_rs.js",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/photon_rs_bg.js",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/core/LICENSE",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/core/README.md",
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/core/cbor.js",
@@ -6455,6 +6449,11 @@
     "node_modules/@mariozechner/clipboard/src/clipboard_rs/platform/win.rs",
     "node_modules/@mariozechner/clipboard/src/clipboard_rs/platform/x11.rs",
     "node_modules/@mariozechner/clipboard/src/lib.rs",
+    "node_modules/@silvia-odwyer/photon-node/LICENSE.md",
+    "node_modules/@silvia-odwyer/photon-node/README.md",
+    "node_modules/@silvia-odwyer/photon-node/package.json",
+    "node_modules/@silvia-odwyer/photon-node/photon_rs.js",
+    "node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm",
     "node_modules/chalk/license",
     "node_modules/chalk/package.json",
     "node_modules/chalk/readme.md",
@@ -43342,7 +43341,8 @@
       "packageName": "@silvia-odwyer/photon-node",
       "packageVersion": "0.3.4",
       "packagePath": "photon_rs_bg.js",
-      "disposition": "include"
+      "disposition": "exclude",
+      "reason": "unreachable-development"
     },
     {
       "packageName": "@silvia-odwyer/photon-node",
@@ -93110,10 +93110,10 @@
   ],
   "inventory": {
     "schema": "a1-runtime-payload-v1",
-    "includedFiles": 6209,
-    "includedBytes": 44433595,
-    "excludedFiles": 7302,
-    "excludedBytes": 55378954,
+    "includedFiles": 6208,
+    "includedBytes": 44309189,
+    "excludedFiles": 7303,
+    "excludedBytes": 55503360,
     "uncertaintyRetainedFiles": 1082,
     "exclusions": [
       {
@@ -106564,10 +106564,6 @@
         "path": "node_modules/@earendil-works/pi-coding-agent/node_modules/@protobufjs/utf8/index.d.ts",
         "reason": "type-declaration"
       },
-      {
-        "path": "node_modules/@earendil-works/pi-coding-agent/node_modules/@silvia-odwyer/photon-node/photon_rs.d.ts",
-        "reason": "type-declaration"
-      },
       {
         "path": "node_modules/@earendil-works/pi-coding-agent/node_modules/@smithy/core/cbor.d.ts",
         "reason": "type-declaration"
@@ -121836,6 +121832,14 @@
         "path": "node_modules/@mariozechner/clipboard/index.d.ts",
         "reason": "type-declaration"
       },
+      {
+        "path": "node_modules/@silvia-odwyer/photon-node/photon_rs.d.ts",
+        "reason": "type-declaration"
+      },
+      {
+        "path": "node_modules/@silvia-odwyer/photon-node/photon_rs_bg.js",
+        "reason": "unreachable-development"
+      },
       {
         "path": "node_modules/chalk/source/index.d.ts",
         "reason": "type-declaration"

package/docs/architecture/boundaries.md

@@ -31,7 +31,8 @@ The owned Pi-backed surface is not an arbitrary-CLI terminal multiplexer. A feat
 - `storage`: SQLite migrations, prior-boot reconciliation, and plural launch-instance persistence. Legacy foreground rows are historical migration input and never authorize current ownership.
 - `supervisor`: endpoint identity, plural cohort ownership, per-instance reconciliation, and aggregate release shutdown coordination. It owns no terminal surface.
 - `pi-engine-adapter`, `pi-component-adapter`, `pi-tui-runtime-adapter`, and `pi-session-ui-integration`: isolate pinned Pi engine and presentation knowledge behind neutral contracts; product features do not import them directly. The session UI render root assembles semantic document and dock rows, while its focused viewport controller owns follow state, pointer routing, selection, and interaction timers. Owned-app route lifecycle belongs to the neutral `ui-apps` owner and is only hosted by the Pi session UI.
-- release/update/bootstrap: package-derived immutable release identity, process-guardian integrity, cohort selection, durable update transactions, rollback, and dependency-light command entry.
+- release/update/bootstrap: package-derived immutable release identity, process-guardian integrity, cohort selection, durable update transactions, rollback, and dependency-light command entry. After an unsuccessful bare-A1 child exit, the bootstrap restores owned terminal modes; neither guardian emits terminal controls.
+- `terminal-cleanup`: bounded, idempotent emergency restoration and fatal-exit diagnostics for an explicitly owned terminal. It does not inspect commands, relay terminal input/output, or emulate terminal state. The owned UI installs its fatal boundary before terminal activation; packaged bootstrap and checkout launch provide the surviving-owner fallback. Fatal records retain at most ten 16 KiB records with trusted classifications and code locations, never prompts, attachments, raw input, credentials, or arbitrary exception messages.
 
 ## Dependency direction
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.282",
+  "version": "0.1.8-dev.289",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "packageManager": "npm@11.13.0",
@@ -62,6 +62,7 @@
   "dependencies": {
     "@earendil-works/pi-coding-agent": "0.84.2",
     "@earendil-works/pi-tui": "0.84.2",
+    "@silvia-odwyer/photon-node": "0.3.4",
     "chalk": "5.6.2",
     "cross-spawn": "7.0.6",
     "grok-mermaid": "0.2.2",