@timurproko/a1 0.2.7-dev.1276 → 0.2.7-dev.1285

package/dist/foundation/release/release-state.js

@@ -1,21 +1,23 @@
 import { randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export const RELEASE_STATE_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
-/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+/** Minimum age retention; live, uncertain, and legacy ownership independently overrides age. */
 export const RELEASE_RETENTION_MS = 7 * 24 * 60 * 60 * 1_000;
 /**
  * Age-based retention. A release stays while a selector names it (active, its rollback, or a
  * candidate still being certified), while an unfinished update may return to it, while the
  * reconciling command runs from it, or while its approval is younger than the retention window.
- * Nothing asks which processes are running: a session that outlives the window and two updates
- * can lose its release files, which is the documented trade-off.
+ * Process-lifetime claims override age; legacy approved binaries remain conservatively retained.
  */
 export function planProtectedReleases(state, inputs = {}) {
     const protectedIds = new Set();
+    for (const claim of Object.values(state.uses ?? {}))
+        if (releaseUseIsLive(claim))
+            protectedIds.add(claim.releaseId);
     for (const id of [state.references.active, state.references.pending, state.references.approved, state.references.rollback]) {
         if (id !== null)
             protectedIds.add(id);
@@ -28,7 +30,7 @@ export function planProtectedReleases(state, inputs = {}) {
     const now = inputs.now ?? Date.now();
     const window = inputs.retentionMs ?? RELEASE_RETENTION_MS;
     for (const release of Object.values(state.releases)) {
-        if (withinRetention(release, now, window))
+        if (withinRetention(release, now, window) || (release.approval === "approved" && release.lifetimeClaims !== true))
             protectedIds.add(release.releaseId);
     }
     const protectedReleaseIds = [...protectedIds].sort();
@@ -104,6 +106,7 @@ export class ReleaseStateStore {
                 packageVersion: release.packageVersion,
                 contentDigest: release.contentDigest,
                 ...(release.launchContract === undefined ? {} : { launchContract: release.launchContract }),
+                ...(release.files.some(file => file.path === "dist/foundation/release/release-use.js") ? { lifetimeClaims: true } : {}),
                 approval: "candidate",
                 materializedAt: new Date().toISOString(),
                 certifiedAt: null,
@@ -363,7 +366,7 @@ async function acquireLock(path) {
     while (true) {
         try {
             const lock = await open(path, "wx", 0o600);
-            await lock.writeFile(JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }));
+            await lock.writeFile(JSON.stringify({ pid: process.pid, token: randomUUID(), createdAt: new Date().toISOString() }));
             await lock.sync();
             return lock;
         }
@@ -382,31 +385,35 @@ async function acquireLock(path) {
     }
 }
 async function reclaimAbandonedLock(path) {
-    let abandoned = false;
+    let owner;
     try {
-        const value = JSON.parse(await readFile(path, "utf8"));
-        if (typeof value.pid === "number") {
-            try {
-                process.kill(value.pid, 0);
-            }
-            catch (error) {
-                abandoned = !(error instanceof Error && "code" in error && error.code === "EPERM");
-            }
+        owner = await readFile(path, "utf8");
+        const value = JSON.parse(owner);
+        if (!Number.isSafeInteger(value.pid) || value.pid <= 0)
+            return false;
+        try {
+            process.kill(value.pid, 0);
+            return false;
+        }
+        catch (error) {
+            if (!(error instanceof Error && "code" in error && error.code === "ESRCH"))
+                return false;
         }
     }
     catch {
-        const metadata = await stat(path).catch(() => null);
-        abandoned = metadata !== null && Date.now() - metadata.mtimeMs > 10_000;
+        return false;
+    } // Security: unknown ownership never becomes safe merely through age.
+    const gate = `${path}.reclaim`;
+    try {
+        await mkdir(gate);
     }
-    if (!abandoned)
+    catch {
         return false;
-    const quarantine = `${path}.abandoned`;
-    const oldQuarantine = await stat(quarantine).catch(() => null);
-    if (oldQuarantine && Date.now() - oldQuarantine.mtimeMs > 10_000)
-        await rm(quarantine, { force: true });
+    }
     try {
-        // Concurrency: the fixed destination lets exactly one waiter claim the stale lock;
-        // another waiter cannot accidentally rename a newly acquired replacement.
+        if (await readFile(path, "utf8") !== owner)
+            return false;
+        const quarantine = `${path}.abandoned-${randomUUID()}`;
         await rename(path, quarantine);
         await rm(quarantine, { force: true });
         return true;
@@ -414,6 +421,9 @@ async function reclaimAbandonedLock(path) {
     catch {
         return false;
     }
+    finally {
+        await rm(gate, { recursive: true, force: true });
+    }
 }
 function normalizeState(value) {
     if (!value || typeof value !== "object")
@@ -424,6 +434,8 @@ function normalizeState(value) {
     const cleanup = state.cleanup;
     return {
         ...state,
+        // Compatibility: one-way control-state upgrade fences pre-claim cleanup workers; session files are untouched.
+        ...(state.schema === "a1-release-cohort-v1" ? { schema: RELEASE_STATE_SCHEMA } : {}),
         cleanup: cleanup
             ? { ...cleanup, workerRuns: cleanup.workerRuns ?? [] }
             : { pending: {}, diagnostics: [], workerRuns: [] },
@@ -436,6 +448,13 @@ function validateState(state) {
         || !Array.isArray(state.cleanup.workerRuns)) {
         throw new Error("invalid release state");
     }
+    if (state.uses !== undefined && (state.uses === null || typeof state.uses !== "object" || Array.isArray(state.uses)))
+        throw new Error("invalid release use claims");
+    for (const [token, claim] of Object.entries(state.uses ?? {})) {
+        if (!/^[a-f0-9-]{36}$/.test(token) || !claim || !RELEASE_ID_PATTERN.test(claim.releaseId)
+            || !Number.isSafeInteger(claim.pid) || claim.pid <= 0 || !["launching", "running"].includes(claim.phase))
+            throw new Error("invalid release use claim");
+    }
     for (const run of state.cleanup.workerRuns) {
         if (!run || typeof run.runId !== "string" || run.runId.length === 0
             || !["scheduled", "running", "completed", "blocked", "continued", "failed", "skipped"].includes(run.status)
@@ -473,6 +492,18 @@ function validateTransition(current, next) {
     if (next.revision !== current.revision)
         throw new Error("release revision is controlled by the state store");
 }
+export function releaseUseIsLive(claim) {
+    if (claim.phase === "launching")
+        return true;
+    // Security: PID reuse only over-retains: no live/uncertain process identity ever proves a claim dead.
+    try {
+        process.kill(claim.pid, 0);
+        return true;
+    }
+    catch (error) {
+        return !(error instanceof Error && "code" in error && error.code === "ESRCH");
+    }
+}
 function boundedError(error) {
     return (error instanceof Error ? error.message : String(error)).replace(/[\r\n]+/g, " ").slice(0, 1_000);
 }

package/dist/foundation/release/release-use.d.ts

@@ -0,0 +1,10 @@
+import { type ChildProcess, type SpawnOptions } from "node:child_process";
+export declare function spawnReleaseEntry(entry: string, args: readonly string[], options: SpawnOptions): Promise<ChildProcess & {
+    releaseSettled: Promise<void>;
+}>;
+/** A durable launch reservation closes selection/collection and spawn/handoff races. */
+export declare function acquireReleaseUse(dataDir: string, releaseId: string): Promise<{
+    track(child: ChildProcess): Promise<void>;
+    started(pid: number): Promise<void>;
+    release(): Promise<void>;
+}>;

package/dist/foundation/release/release-use.js

@@ -0,0 +1,70 @@
+import { randomUUID } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { basename, dirname, resolve } from "node:path";
+import { resolveProductPaths } from "../lifecycle/index.js";
+import { ReleaseStateStore, releaseUseIsLive } from "./release-state.js";
+/** Mutable installed entries are not GC-managed; immutable helper processes need their own claim. */
+async function claimReleaseEntry(entry, environment) {
+    const dataDir = resolveProductPaths(environment).dataDir;
+    const root = await realpath(dirname(dirname(resolve(entry))));
+    const storeRoot = await realpath(resolve(dataDir, "releases")).catch(() => undefined);
+    if (dirname(root) !== storeRoot)
+        return undefined;
+    return acquireReleaseUse(dataDir, basename(root));
+}
+export async function spawnReleaseEntry(entry, args, options) {
+    const use = await claimReleaseEntry(entry, options.env ?? process.env);
+    try {
+        const child = spawn(process.execPath, [entry, ...args], options);
+        const releaseSettled = use?.track(child) ?? Promise.resolve();
+        // Concurrency: detached callers need no waiter; awaited callers still observe release failures.
+        void releaseSettled.catch(() => undefined);
+        return Object.assign(child, { releaseSettled });
+    }
+    catch (error) {
+        await use?.release();
+        throw error;
+    }
+}
+/** A durable launch reservation closes selection/collection and spawn/handoff races. */
+export async function acquireReleaseUse(dataDir, releaseId) {
+    const store = new ReleaseStateStore(dataDir);
+    const token = randomUUID();
+    await store.update(state => {
+        if (!state.releases[releaseId])
+            throw new Error("Selected release is no longer available for launch");
+        const uses = Object.fromEntries(Object.entries(state.uses ?? {}).filter(([, claim]) => releaseUseIsLive(claim)));
+        return { ...state, uses: { ...uses, [token]: { releaseId, pid: process.pid, phase: "launching" } } };
+    });
+    let released = false;
+    return {
+        track(child) {
+            let handoff = Promise.resolve();
+            child.once("spawn", () => { handoff = this.started(child.pid).catch(() => undefined); });
+            return new Promise((resolve, reject) => {
+                child.once("close", () => { void handoff.then(() => this.release()).then(resolve, reject); });
+            });
+        },
+        async started(pid) {
+            if (!Number.isSafeInteger(pid) || pid <= 0 || released)
+                throw new Error("Invalid release process handoff");
+            await store.update(state => {
+                if (!state.uses?.[token])
+                    throw new Error("Release launch reservation was lost");
+                const claim = { releaseId, pid, phase: "running" };
+                return { ...state, uses: { ...state.uses, [token]: claim } };
+            });
+        },
+        async release() {
+            if (released)
+                return;
+            await store.update(state => {
+                const uses = { ...state.uses };
+                delete uses[token];
+                return { ...state, uses };
+            });
+            released = true;
+        },
+    };
+}

package/dist/foundation/release/update-activation.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -77,7 +77,7 @@ export async function readActivationContracts(packageRoot, read = path => readFi
  */
 export async function delegateActivation(request, callbacks) {
     const entry = resolve(request.packageRoot, UPDATE_ACTIVATION_ENTRY);
-    const child = spawn(process.execPath, [entry, "--data-dir", request.dataDir, "--target-version", request.targetVersion], {
+    const child = await spawnReleaseEntry(entry, ["--data-dir", request.dataDir, "--target-version", request.targetVersion], {
         env: request.environment,
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,

package/dist/foundation/release/update-recovery.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -303,7 +303,7 @@ export async function cleanupUpdateRecoveryCapsules(dataDir) {
     }
 }
 async function spawnRecoveryWorker(entry, manifestPath, environment) {
-    const child = spawn(process.execPath, [entry, "--worker", manifestPath], { detached: true, stdio: "ignore", windowsHide: true, env: environment });
+    const child = await spawnReleaseEntry(entry, ["--worker", manifestPath], { detached: true, stdio: "ignore", windowsHide: true, env: environment });
     await new Promise((resolvePromise, rejectPromise) => {
         child.once("spawn", resolvePromise);
         child.once("error", rejectPromise);

package/dist/foundation/release/update.js

@@ -164,7 +164,7 @@ export function renderUpdateProgressBar(percent, accent = SHARED_PROGRESS_ACCENT
     // percentage retain the update meter's neutral treatment.
     const gray = "\u001b[38;2;128;128;128m";
     const track = "\u001b[38;2;102;102;102m";
-    return `${accent}${"━".repeat(filled)}${track}${"─".repeat(PROGRESS_BAR_WIDTH - filled)}${gray} ${bounded}%\u001b[39m`;
+    return `${accent}${"━".repeat(filled)}${track}${"━".repeat(PROGRESS_BAR_WIDTH - filled)}${gray} ${bounded}%\u001b[39m`;
 }
 function updateProgressAccent(environment) {
     return earlyAccentPalette(resolveEarlyAccentColor(environment), earlyTerminalAppearance(environment), earlyTerminalColorMode(environment)).accent;

package/dist/foundation/release/warmup.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { resolveReleaseEntryPoint } from "./release-store.js";
 import { releaseEnvironment } from "./bootstrap.js";
 import { launchContractTarget, launchEnvironmentKeys } from "../launch-context/index.js";
@@ -11,15 +11,13 @@ function warmupDiagnostics(text) {
 /** Import the exact immutable startup graph in a terminal-free bounded child process. */
 export async function warmMaterializedRelease(release, environment, timeoutMs = 30_000) {
     const entry = await resolveReleaseEntryPoint(release, "bin/warmup.js");
+    const child = await spawnReleaseEntry(entry, [], {
+        env: { ...releaseEnvironment(environment, release), [launchEnvironmentKeys(launchContractTarget(release)).immutableWarmup]: "1" },
+        stdio: ["ignore", "ignore", "pipe"],
+        windowsHide: true,
+    });
     await new Promise((resolvePromise, rejectPromise) => {
-        // Rationale: the child still gets no terminal, but a discarded failure reason leaves an
-        // update reporting only an exit status. Its own diagnostics are read and bounded so the
-        // transaction journal records why the graph could not be imported.
-        const child = spawn(process.execPath, [entry], {
-            env: { ...releaseEnvironment(environment, release), [launchEnvironmentKeys(launchContractTarget(release)).immutableWarmup]: "1" },
-            stdio: ["ignore", "ignore", "pipe"],
-            windowsHide: true,
-        });
+        // Rationale: bounded diagnostics explain graph-import failures without attaching a terminal.
         let diagnostics = "";
         child.stderr?.setEncoding("utf8");
         child.stderr?.on("data", chunk => { diagnostics = `${diagnostics}${chunk}`.slice(-WARMUP_DIAGNOSTIC_LIMIT); });
@@ -44,4 +42,5 @@ export async function warmMaterializedRelease(release, environment, timeoutMs =
         }, timeoutMs);
         timer.unref?.();
     });
+    await child.releaseSettled;
 }

package/dist/foundation/session-writer-lock/index.d.ts

@@ -20,8 +20,8 @@ export interface SessionWriterHandle {
     release(): void;
 }
 /**
- * A crashed writer is not released by the kernel; its lock becomes stale once its holder stops
- * refreshing it. The bound keeps resume after a crash a matter of seconds.
+ * Heartbeats diagnose ownership loss, but never authorize takeover of a live writer.
+ * Dead owners are recovered by process absence; legacy or uncertain owners stay protected.
  */
 export declare const SESSION_WRITER_STALE_MS = 10000;
 /**

package/dist/foundation/session-writer-lock/index.js

@@ -1,7 +1,7 @@
-import { existsSync, mkdirSync, realpathSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, realpathSync, statSync, readFileSync, writeFileSync, unlinkSync, rmdirSync, utimesSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import lockfile from "proper-lockfile";
 /** Reports that a canonical session identity already has a live writer. */
 export class SessionWriterConflict extends Error {
@@ -15,8 +15,8 @@ export class SessionWriterConflict extends Error {
     }
 }
 /**
- * A crashed writer is not released by the kernel; its lock becomes stale once its holder stops
- * refreshing it. The bound keeps resume after a crash a matter of seconds.
+ * Heartbeats diagnose ownership loss, but never authorize takeover of a live writer.
+ * Dead owners are recovered by process absence; legacy or uncertain owners stay protected.
  */
 export const SESSION_WRITER_STALE_MS = 10_000;
 let backendOverride;
@@ -35,15 +35,37 @@ export function lockfileBackend(root = join(tmpdir(), "a1-session-writer-locks")
     };
     const acquireAuthority = (path) => {
         mkdirSync(root, { recursive: true, mode: 0o700 });
-        // Rationale: the lock directory is the authority; no target file exists or is needed.
-        return lockfile.lockSync(path, {
-            realpath: false,
-            lockfilePath: path,
-            stale: staleMs,
-            // Rationale: a missed refresh means this process stalled; the next writer takes over, and the
-            // stalled one must not crash for it.
-            onCompromised: () => { },
+        // Compatibility: the nonempty owner record also prevents legacy heartbeat-only clients from reclaiming
+        // a stalled live writer: proper-lockfile removes directories non-recursively.
+        reclaimDeadWriter(path);
+        const release = lockfile.lockSync(path, {
+            realpath: false, lockfilePath: path, stale: staleMs,
+            onCompromised: () => { throw new Error("Session writer ownership was lost; execution has been stopped."); },
         });
+        const owner = { pid: process.pid, token: randomUUID() };
+        const stamp = statSync(path).mtime;
+        try {
+            writeFileSync(join(path, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 0o600 });
+            // Concurrency: creating the owner record must not masquerade as a foreign heartbeat.
+            utimesSync(path, stamp, stamp);
+        }
+        catch (error) {
+            try {
+                unlinkSync(join(path, "owner.json"));
+                release();
+            }
+            catch { /* Security: retain uncertain ownership. */ }
+            throw error;
+        }
+        return () => {
+            if (readWriterOwner(path)?.token !== owner.token)
+                throw new Error("Session writer ownership was lost");
+            // Concurrency: a legacy contender must not reclaim the short empty-directory release interval.
+            const now = new Date();
+            utimesSync(path, now, now);
+            unlinkSync(join(path, "owner.json"));
+            release();
+        };
     };
     return {
         acquire(requested) {
@@ -92,6 +114,54 @@ export function lockfileBackend(root = join(tmpdir(), "a1-session-writer-locks")
         },
     };
 }
+function readWriterOwner(path) {
+    try {
+        const source = readFileSync(join(path, "owner.json"), "utf8");
+        if (source.length > 1024)
+            return null;
+        const value = JSON.parse(source);
+        return Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.token === "string"
+            && /^[a-f0-9-]{36}$/.test(value.token) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writerAbsent(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        return error instanceof Error && "code" in error && error.code === "ESRCH";
+    }
+}
+function reclaimDeadWriter(path) {
+    if (!existsSync(path))
+        return;
+    const owner = readWriterOwner(path);
+    // Security: age and malformed/legacy records cannot prove that a writer is absent.
+    if (owner === null || !writerAbsent(owner.pid))
+        throw new Error("Session writer is live or unverifiable");
+    const gate = join(path, ".reclaim");
+    mkdirSync(gate);
+    try {
+        if (readWriterOwner(path)?.token !== owner.token || !writerAbsent(owner.pid))
+            throw new Error("Session writer changed during recovery");
+        const now = new Date();
+        utimesSync(path, now, now);
+        unlinkSync(join(path, "owner.json"));
+        rmdirSync(gate);
+        rmdirSync(path);
+    }
+    catch (error) {
+        try {
+            rmdirSync(gate);
+        }
+        catch { /* Security: a partial recovery remains conservatively blocked. */ }
+        throw error;
+    }
+}
 function backend() {
     return backendOverride ?? (cachedBackend ??= lockfileBackend());
 }

package/dist/foundation/startup/startup-descriptor.js

@@ -10,7 +10,7 @@ export const STARTUP_DESCRIPTOR = Object.freeze({
   ],
   "generatedArtifact": {
     "path": "dist/integrations/pi/startup-public.js",
-    "sha256": "e6a12f0ec3c5f2ada12bb29f8a02584f0724b37d107c29608b6629a4196cca13"
+    "sha256": "c1fca0ab0fe9d078a80faac1dad7d9f719cfc553645e38c2244a9c9ad381c205"
   },
   "dependencyLayerIdentity": {
     "source": "A1_RELEASE_LAYERS",
@@ -19,7 +19,7 @@ export const STARTUP_DESCRIPTOR = Object.freeze({
   "compileCacheNamespace": {
     "strategy": "node-abi-version-and-ordered-layer-sha256-v1"
   },
-  "identity": "1823698969cb8a551539b6351a7ba7b0756121369e6f9bf898347080d7892ece"
+  "identity": "3a54e70a22a20fa71dc2916cff394d4b06a3359677b3423002ff5b2dfbdccd70"
 });
 
 export function loadDeclaredStartupGraph() {

package/dist/foundation/terminal-cleanup/fatal-diagnostic.d.ts

@@ -0,0 +1,2 @@
+/** Loaded only on a failure; persistence must never impede terminal restoration. */
+export declare function writeFatalDiagnostic(directory: string, origin: string, error: unknown, releaseId?: string): Promise<string | null>;

package/dist/foundation/terminal-cleanup/fatal-diagnostic.js

@@ -0,0 +1,59 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+/** Loaded only on a failure; persistence must never impede terminal restoration. */
+export async function writeFatalDiagnostic(directory, origin, error, releaseId) {
+    try {
+        // Security: only known classifications and code locations are retained, never private messages or objects.
+        const cleanupFailed = error instanceof AggregateError && error.cause instanceof Error;
+        const primary = cleanupFailed ? error.cause : error;
+        const classification = primary instanceof TypeError ? "TypeError" : primary instanceof RangeError ? "RangeError" : "Error";
+        const stack = primary instanceof Error && typeof primary.stack === "string" ? primary.stack.slice(0, 32768) : "";
+        const locations = stack.split("\n").slice(1).flatMap(line => {
+            const match = /\/(?:dist|src)\/([a-zA-Z0-9_./-]+\.[cm]?[jt]s):(\d+):(\d+)\)?$/.exec(line.replaceAll("\\", "/"));
+            return match ? [{ file: match[1].slice(0, 160), line: Number(match[2]), column: Number(match[3]) }] : [];
+        }).slice(0, 16);
+        const delivery = deliveryFailure(primary);
+        const record = {
+            timestamp: new Date().toISOString(),
+            origin: ["uncaughtException", "unhandledRejection", "entry", "delivery"].includes(origin) ? origin : "entry",
+            ...(delivery === null ? {} : { deliveryFailure: delivery }),
+            classification, cleanupFailed, locations, node: process.version, platform: process.platform,
+            releaseId: releaseId && /^[a-zA-Z0-9._-]{1,128}$/.test(releaseId) ? releaseId : "unknown",
+        };
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        const name = `${origin === "delivery" ? "delivery" : "fatal"}-${Date.now()}-${randomUUID()}.json`;
+        const path = join(directory, name);
+        const text = JSON.stringify(record, null, 2);
+        if (Buffer.byteLength(text) > 16 * 1024)
+            return null;
+        await writeFile(path, text, { flag: "wx", mode: 0o600 });
+        const names = (await readdir(directory)).filter(file => /^(?:fatal|delivery)-\d+-[a-f0-9-]+\.json$/.test(file))
+            .sort((a, b) => Number(b.split("-")[1]) - Number(a.split("-")[1]));
+        await Promise.all(names.slice(10).map(file => unlink(join(directory, file)).catch(() => undefined)));
+        return path;
+    }
+    catch {
+        return null;
+    }
+}
+function deliveryFailure(error) {
+    if (!(error instanceof Error) || !("deliveryFailure" in error))
+        return null;
+    const value = error.deliveryFailure;
+    if (!value || typeof value !== "object")
+        return null;
+    const record = value;
+    if (!["event-count", "retained-bytes", "listener"].includes(String(record.reason))
+        || !["snapshot", "session-view", "transcript-block", "session-lifecycle", "status", "editor-state", "terminal-surface",
+            "agent-run-started", "agent-run-settled", "assistant-message-completed", "command-outcome", "diagnostic"].includes(String(record.event)))
+        return null;
+    const result = { reason: String(record.reason), event: String(record.event) };
+    for (const key of ["generation", "pending", "bytes"]) {
+        const number = record[key];
+        if (typeof number !== "number" || !Number.isSafeInteger(number) || number < 0)
+            return null;
+        result[key] = number;
+    }
+    return result;
+}

package/dist/foundation/terminal-cleanup/fatal-exit.js

@@ -1,36 +1,8 @@
-import { randomUUID } from "node:crypto";
-import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { writeSync } from "node:fs";
-import { join } from "node:path";
 import { boundedCleanup, restoreProcessTerminal } from "./terminal-reset.js";
 export async function writeFatalDiagnostic(directory, origin, error, releaseId) {
     try {
-        // Security: only known classifications and code locations are retained. Error messages,
-        // function names, arbitrary paths, and request objects are never persisted.
-        const cleanupFailed = error instanceof AggregateError && error.cause instanceof Error;
-        const primary = cleanupFailed ? error.cause : error;
-        const classification = primary instanceof TypeError ? "TypeError" : primary instanceof RangeError ? "RangeError" : "Error";
-        const stack = primary instanceof Error && typeof primary.stack === "string" ? primary.stack.slice(0, 32768) : "";
-        const locations = stack.split("\n").slice(1).flatMap(line => {
-            const match = /\/(?:dist|src)\/([a-zA-Z0-9_./-]+\.[cm]?[jt]s):(\d+):(\d+)\)?$/.exec(line.replaceAll("\\", "/"));
-            return match ? [{ file: match[1].slice(0, 160), line: Number(match[2]), column: Number(match[3]) }] : [];
-        }).slice(0, 16);
-        const record = {
-            timestamp: new Date().toISOString(),
-            origin: ["uncaughtException", "unhandledRejection", "entry"].includes(origin) ? origin : "entry",
-            classification, cleanupFailed, locations, node: process.version, platform: process.platform,
-            releaseId: releaseId && /^[a-zA-Z0-9._-]{1,128}$/.test(releaseId) ? releaseId : "unknown",
-        };
-        await mkdir(directory, { recursive: true, mode: 0o700 });
-        const name = `fatal-${Date.now()}-${randomUUID()}.json`;
-        const path = join(directory, name);
-        const text = JSON.stringify(record, null, 2);
-        if (Buffer.byteLength(text) > 16 * 1024)
-            return null;
-        await writeFile(path, text, { flag: "wx", mode: 0o600 });
-        const names = (await readdir(directory)).filter(file => /^fatal-\d+-[a-f0-9-]+\.json$/.test(file)).sort().reverse();
-        await Promise.all(names.slice(10).map(file => unlink(join(directory, file)).catch(() => undefined)));
-        return path;
+        return await (await import("./fatal-diagnostic.js")).writeFatalDiagnostic(directory, origin, error, releaseId);
     }
     catch {
         return null;

package/dist/integrations/pi/components/resources/builtin-themes.d.ts

@@ -1,6 +1,6 @@
 /**
- * Attributed owned theme resources adapted from @earendil-works/pi-coding-agent 1.5.1 (MIT),
- * commit dd30101cfc5b0609411dd80b6f93adbc14db14cf.
+ * Attributed owned theme resources adapted from @earendil-works/pi-coding-agent 1.5.2 (MIT),
+ * commit b4afdddf44e059c67ccf5097e5317d913521b470.
  * Upstream dark.json SHA-256: e1f96982f8cb7d2a48eca7db03c9cb282cb1e14a243680cd855638ecd6a251b6
  * Upstream light.json SHA-256: 2dee6a4be7f765e7fd7728166b7ebf8c29e4ce313f8ec6b38ae50699e3abc2f3
  * Modifications: removed upstream schema/export metadata; runtime color data is unchanged.

package/dist/integrations/pi/components/resources/builtin-themes.js

@@ -1,6 +1,6 @@
 /**
- * Attributed owned theme resources adapted from @earendil-works/pi-coding-agent 1.5.1 (MIT),
- * commit dd30101cfc5b0609411dd80b6f93adbc14db14cf.
+ * Attributed owned theme resources adapted from @earendil-works/pi-coding-agent 1.5.2 (MIT),
+ * commit b4afdddf44e059c67ccf5097e5317d913521b470.
  * Upstream dark.json SHA-256: e1f96982f8cb7d2a48eca7db03c9cb282cb1e14a243680cd855638ecd6a251b6
  * Upstream light.json SHA-256: 2dee6a4be7f765e7fd7728166b7ebf8c29e4ce313f8ec6b38ae50699e3abc2f3
  * Modifications: removed upstream schema/export metadata; runtime color data is unchanged.

package/dist/integrations/pi/components/share-operation-dialog.d.ts

@@ -1,8 +1,9 @@
+import type { ProgressSpinnerSource } from "../../../contracts/presentation/index.js";
 import { type PiShellComponentPort, type PiShellEditorOptions } from "./shell-shared-facade.js";
 export interface PiShellOperationLoaderPort extends PiShellComponentPort {
     readonly signal: AbortSignal;
     /** Relabels the running operation; the pinned comparison loader keeps its first label. */
     readonly setMessage?: (message: string) => void;
 }
-export declare function createPiShellShareOperationDialog(runtime: Pick<PiShellEditorOptions, "getColumns" | "getRows" | "requestRender">, message: string): PiShellOperationLoaderPort;
+export declare function createPiShellShareOperationDialog(runtime: Pick<PiShellEditorOptions, "getColumns" | "getRows" | "requestRender">, message: string, spinner?: ProgressSpinnerSource): PiShellOperationLoaderPort;
 export declare function createPiShellOperationLoader(runtime: Pick<PiShellEditorOptions, "getColumns" | "getRows" | "requestRender">, message: string): PiShellOperationLoaderPort;