@timurproko/a1 0.2.7-dev.754 → 0.2.7-dev.772

package/dist/ui/settings/profile-document.js

@@ -0,0 +1,164 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import lockfile from "proper-lockfile";
+const NAMESPACE_PATTERN = /^[a-z][a-z0-9-]*$/;
+const MAX_RECOVERABLE_PREFIX_BYTES = 256;
+/** Refuse an injected namespace already claimed by the surrounding root schema. */
+export function assertProfileSettingsNamespaceAvailable(namespace, rootSettingKeys) {
+    assertNamespace(namespace);
+    if (rootSettingKeys.includes(namespace))
+        throw new Error(`profile settings namespace collides with a root setting: ${namespace}`);
+}
+/** Read one product-owned root object without exposing unrelated profile settings. */
+export function readProfileSettingsNamespace(file, namespace) {
+    assertNamespace(namespace);
+    let raw;
+    try {
+        raw = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (isMissing(error))
+            return { status: "missing", value: null };
+        return { status: "invalid", value: null, detail: `${file} could not be read: ${describe(error)}` };
+    }
+    const root = parseRoot(raw);
+    if (root === null)
+        return { status: "invalid", value: null, detail: `${file} is not a valid settings object` };
+    if (!Object.hasOwn(root, namespace))
+        return { status: "missing", value: null };
+    const value = root[namespace];
+    if (!isRecord(value)) {
+        return { status: "invalid", value: null, detail: `${file} contains a non-object ${namespace} settings namespace` };
+    }
+    return { status: "available", value: Object.freeze({ ...value }) };
+}
+/**
+ * Remove bounded leading noise only when the remaining bytes are one complete root object.
+ * The repair is silent and uses the same lock and atomic replacement path as namespace writes.
+ */
+export function repairProfileSettingsDocument(file) {
+    if (!existsSync(file))
+        return false;
+    const release = acquireLock(file);
+    try {
+        if (!existsSync(file))
+            return false;
+        const raw = readFileSync(file, "utf8");
+        if (parseRoot(raw) !== null)
+            return false;
+        const root = parseRootAfterLeadingNoise(raw);
+        if (root === null)
+            return false;
+        replaceRoot(file, root);
+        return true;
+    }
+    finally {
+        release();
+    }
+}
+/**
+ * Replace one root namespace through the lock protocol used by pinned Pi.
+ * The updater receives bytes reread while locked, so unrelated concurrent writes survive.
+ */
+export function updateProfileSettingsNamespace(file, namespace, update) {
+    assertNamespace(namespace);
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const release = acquireLock(file);
+    try {
+        const root = existsSync(file) ? parseRoot(readFileSync(file, "utf8")) : {};
+        if (root === null)
+            throw new Error(`${file} is not a valid settings object`);
+        const existing = root[namespace];
+        if (existing !== undefined && !isRecord(existing)) {
+            throw new Error(`${file} contains a non-object ${namespace} settings namespace`);
+        }
+        const nextNamespace = update(existing === undefined ? null : Object.freeze({ ...existing }));
+        const nextRoot = { ...root };
+        if (nextNamespace === null || Object.keys(nextNamespace).length === 0)
+            delete nextRoot[namespace];
+        else
+            nextRoot[namespace] = { ...nextNamespace };
+        replaceRoot(file, nextRoot);
+    }
+    finally {
+        release();
+    }
+}
+function acquireLock(file) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            return lockfile.lockSync(file, { realpath: false });
+        }
+        catch (error) {
+            if (attempt >= 9 || !isLocked(error))
+                throw error;
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+        }
+    }
+}
+function replaceRoot(file, root) {
+    let temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, `${JSON.stringify(root, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        renameSync(temporary, file);
+        temporary = null;
+    }
+    finally {
+        if (temporary !== null) {
+            try {
+                rmSync(temporary, { force: true });
+            }
+            catch {
+                // Invariant: failed temporary cleanup cannot make the target document authoritative.
+            }
+        }
+    }
+}
+function parseRoot(raw) {
+    return parseRootValue(stripBom(raw));
+}
+function parseRootAfterLeadingNoise(raw) {
+    const withoutBom = stripBom(raw);
+    const start = withoutBom.indexOf("{");
+    if (start <= 0)
+        return null;
+    const prefix = withoutBom.slice(0, start);
+    if (Buffer.byteLength(prefix, "utf8") > MAX_RECOVERABLE_PREFIX_BYTES || prefix.trim().length === 0)
+        return null;
+    try {
+        JSON.parse(prefix);
+        return null;
+    }
+    catch {
+        return parseRootValue(withoutBom.slice(start));
+    }
+}
+function parseRootValue(raw) {
+    try {
+        const value = JSON.parse(raw);
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function stripBom(raw) {
+    return raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertNamespace(namespace) {
+    if (!NAMESPACE_PATTERN.test(namespace))
+        throw new Error(`profile settings namespace is invalid: ${namespace}`);
+}
+function isMissing(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function isLocked(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "ELOCKED";
+}
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/docs/architecture/evidence/resident-tabs/linux-x64.md

@@ -0,0 +1,37 @@
+# Resident tabs acceptance: Linux x64
+
+State: CI-verified
+
+Physical acceptance against a published candidate package is pending; the operator runs [the checklist](../../../manual-resident-tabs-acceptance.md) and fills in this record. Until every item passes, resident tabs on this platform are CI-verified, not certified.
+
+| Field | Value |
+|---|---|
+| Package version | pending (first published candidate carrying the terminal host) |
+| terminal-host SHA-256 | pending (from that package's `terminal-host.manifest.json`) |
+| OS build | pending |
+| Terminal | pending |
+| Operator or worker | pending |
+| Date | pending |
+
+## Automated evidence
+
+- Pull-request `terminal-host` lane on `ubuntu-24.04`: native unit and role-integration suites, every named crash point recovering to a clean start, the 10,000-schedule simulation corpus, `a1 tabs` maintenance end to end, and the release build of the terminal host with its manifest, session lock, and notices.
+- Pull-request `resident-chaos` lane on `ubuntu-24.04`: bounded randomized kills of servers, holders, and agents against the release-built host, with no duplicate tabs or holders and no orphaned processes.
+- Publication `terminal_hosts` job on `ubuntu-24.04`: the release artifact is rebuilt, its `--version` identity checked, and packing refuses a missing or altered artifact.
+- Bounded fuzzing of every decoder and parser runs on this lane; it proves parser robustness, not platform behavior.
+
+## Physical verdicts
+
+| # | Item | Verdict | Notes |
+|---|---|---|---|
+| 1 | Terminal close mid-turn | pending |  |
+| 2 | SSH or remote-session loss | pending |  |
+| 3 | Forced attach-client kill | pending |  |
+| 4 | Reattach fidelity | pending |  |
+| 5 | Input and render smoothness | pending |  |
+| 6 | Extension text UI | pending |  |
+| 7 | Two clients and controller transfer | pending |  |
+| 8 | Server, holder, and child failure | pending |  |
+| 9 | Sensitive-data separation | pending |  |
+| 10 | Conflict-safe direct rollback | pending |  |
+| 11 | Logout (Linux) | pending |  |

package/docs/architecture/evidence/resident-tabs/macos-arm64.md

@@ -0,0 +1,36 @@
+# Resident tabs acceptance: macOS arm64
+
+State: CI-verified
+
+Physical acceptance against a published candidate package is pending; the operator runs [the checklist](../../../manual-resident-tabs-acceptance.md) and fills in this record. Until every item passes, resident tabs on this platform are CI-verified, not certified.
+
+| Field | Value |
+|---|---|
+| Package version | pending (first published candidate carrying the terminal host) |
+| terminal-host SHA-256 | pending (from that package's `terminal-host.manifest.json`) |
+| OS build | pending |
+| Terminal | pending |
+| Operator or worker | pending |
+| Date | pending |
+
+## Automated evidence
+
+- Pull-request `terminal-host` lane on `macos-15`: native unit and role-integration suites, every named crash point recovering to a clean start, the 10,000-schedule simulation corpus, `a1 tabs` maintenance end to end, and the release build of the terminal host with its manifest, session lock, and notices.
+- Pull-request `resident-chaos` lane on `macos-15`: bounded randomized kills of servers, holders, and agents against the release-built host, with no duplicate tabs or holders and no orphaned processes.
+- Publication `terminal_hosts` job on `macos-15`: the release artifact is rebuilt, its `--version` identity checked, and packing refuses a missing or altered artifact.
+
+## Physical verdicts
+
+| # | Item | Verdict | Notes |
+|---|---|---|---|
+| 1 | Terminal close mid-turn | pending |  |
+| 2 | SSH or remote-session loss | pending |  |
+| 3 | Forced attach-client kill | pending |  |
+| 4 | Reattach fidelity | pending |  |
+| 5 | Input and render smoothness | pending |  |
+| 6 | Extension text UI | pending |  |
+| 7 | Two clients and controller transfer | pending |  |
+| 8 | Server, holder, and child failure | pending |  |
+| 9 | Sensitive-data separation | pending |  |
+| 10 | Conflict-safe direct rollback | pending |  |
+| 11 | Logout (Linux) | not applicable | Linux-only item. |

package/docs/architecture/evidence/resident-tabs/macos-x64.md

@@ -0,0 +1,35 @@
+# Resident tabs acceptance: macOS x64
+
+State: CI-verified
+
+Physical acceptance against a published candidate package is pending; the operator runs [the checklist](../../../manual-resident-tabs-acceptance.md) and fills in this record. Until every item passes, resident tabs on this platform are CI-verified, not certified.
+
+| Field | Value |
+|---|---|
+| Package version | pending (first published candidate carrying the terminal host) |
+| terminal-host SHA-256 | pending (from that package's `terminal-host.manifest.json`) |
+| OS build | pending |
+| Terminal | pending |
+| Operator or worker | pending |
+| Date | pending |
+
+## Automated evidence
+
+- Publication `terminal_hosts` and `guardians` jobs on `macos-15-intel`: the release terminal host and process guardian are built for Intel macOS, the host's `--version` identity is checked, and packing refuses a missing or altered artifact.
+- Known gap: the pull-request `terminal-host` and `resident-chaos` suites run on macOS arm64 only, because modular validation outcomes are keyed by platform without architecture. Intel macOS has build and identity evidence but no automated behavior suite of its own.
+
+## Physical verdicts
+
+| # | Item | Verdict | Notes |
+|---|---|---|---|
+| 1 | Terminal close mid-turn | pending |  |
+| 2 | SSH or remote-session loss | pending |  |
+| 3 | Forced attach-client kill | pending |  |
+| 4 | Reattach fidelity | pending |  |
+| 5 | Input and render smoothness | pending |  |
+| 6 | Extension text UI | pending |  |
+| 7 | Two clients and controller transfer | pending |  |
+| 8 | Server, holder, and child failure | pending |  |
+| 9 | Sensitive-data separation | pending |  |
+| 10 | Conflict-safe direct rollback | pending |  |
+| 11 | Logout (Linux) | not applicable | Linux-only item. |

package/docs/architecture/evidence/resident-tabs/windows-x64.md

@@ -0,0 +1,36 @@
+# Resident tabs acceptance: Windows x64
+
+State: CI-verified
+
+Physical acceptance against a published candidate package is pending; the operator runs [the checklist](../../../manual-resident-tabs-acceptance.md) and fills in this record. Until every item passes, resident tabs on this platform are CI-verified, not certified.
+
+| Field | Value |
+|---|---|
+| Package version | pending (first published candidate carrying the terminal host) |
+| terminal-host SHA-256 | pending (from that package's `terminal-host.manifest.json`) |
+| OS build | pending |
+| Terminal | pending |
+| Operator or worker | pending |
+| Date | pending |
+
+## Automated evidence
+
+- Pull-request `terminal-host` lane on `windows-2025`: native unit and role-integration suites, every named crash point recovering to a clean start, the 10,000-schedule simulation corpus, `a1 tabs` maintenance end to end, and the release build of the terminal host with its manifest, session lock, and notices.
+- Pull-request `resident-chaos` lane on `windows-2025`: bounded randomized kills of servers, holders, and agents against the release-built host, with no duplicate tabs or holders and no orphaned processes.
+- Publication `terminal_hosts` job on `windows-2025`: the release artifact is rebuilt, its `--version` identity checked, and packing refuses a missing or altered artifact.
+
+## Physical verdicts
+
+| # | Item | Verdict | Notes |
+|---|---|---|---|
+| 1 | Terminal close mid-turn | pending | Milestone 2 passed this item against development build `09028be5` (run 38159593912); that evidence is for that build, not this package. |
+| 2 | SSH or remote-session loss | pending | Milestone 2 passed Windows OpenSSH loss against development build `09028be5`; it is not evidence for this package. |
+| 3 | Forced attach-client kill | pending |  |
+| 4 | Reattach fidelity | pending |  |
+| 5 | Input and render smoothness | pending |  |
+| 6 | Extension text UI | pending |  |
+| 7 | Two clients and controller transfer | pending |  |
+| 8 | Server, holder, and child failure | pending |  |
+| 9 | Sensitive-data separation | pending |  |
+| 10 | Conflict-safe direct rollback | pending |  |
+| 11 | Logout (Linux) | not applicable | Linux-only item. |

package/docs/architecture/internal-naming.md

@@ -31,7 +31,7 @@ The exact externally branded key/member authority is `config/internal-naming-pol
 | `A1_PROCESS_GUARDIAN_PATH` | Explicit executable override in `src/foundation/process-containment/native-guardian-containment.ts`, also configured by CI; exact existing exposure-review entry. |
 | `A1_PROBE_TRACE` | Opt-in diagnostics read by native terminal-host code; exact existing exposure-review entry. |
 | `A1_BUILD_VERBOSE`, `A1_DEV_SHELL` | Developer invocation controls in the build helper and development launcher; exact existing exposure-review entries. |
-| `A1_PANE_ID`, `A1_TERMINAL_SESSION_ID` | Produced by `native/terminal-host/src/workspace.rs` and exported to launched programs; external integration names, unchanged. |
+| `A1_PANE_ID`, `A1_TERMINAL_SESSION_ID` | Reserved compatibility identities retained in the product identity manifest; the resident host does not currently emit them. |
 
 Pending review preserves a possible external interface, not an obsolete private alias. Once a setting is established as private, it cannot keep its branded spelling through that category.
 
@@ -47,6 +47,8 @@ Pending review preserves a possible external interface, not an obsolete private
 | `RELEASE_RUNNER_LABEL` | Release/full-regression workflows supply certification-runner provenance to `run-release-gates.mjs`. |
 | `TERMINAL_FIXTURE_INPUT`, `TERMINAL_FIXTURE_TOKEN` | Native terminal probe producer/consumer in `native/terminal-host/src/main.rs`; expected input and fixture token. |
 | `TERMINAL_HOST_LOCAL_BUILD` | Developer shell sets exactly `1`; `native/terminal-host/build.rs` then permits a Windows build outside CI. |
+| `TERMINAL_HOST_EXPORT_VT` | Native validation lanes in `.github/workflows/ci.yml` name a directory; `build.rs` copies the linked terminal library, headers, and manifest there for upload. |
+| `TERMINAL_HOST_PREBUILT_VT` | Developer shell names a fetched library directory; with `TERMINAL_HOST_LOCAL_BUILD=1` and no `CI`, `build.rs` verifies its manifest and links it instead of running Zig. |
 | `DOCS_AUTO_MERGE_POLL_ATTEMPTS`, `DOCS_AUTO_MERGE_POLL_MS` | Documentation automation polling controls, produced by governance tests and consumed by `manage-documentation-auto-merge.mjs`. |
 | `VALIDATION_JOB_STARTED_MS`, `RENDERING_JOB_STARTED_MS` | CI timing handoffs within `.github/workflows/ci.yml`; epoch milliseconds. |
 | `RUN_PROCESS_CONTAINMENT_INTEGRATION` | CI enables the real containment fixture with exactly `1`; platform containment tests consume it. |

package/docs/architecture/process-guardian-provenance.md

@@ -21,6 +21,8 @@ dist/native/darwin-x64/process-guardian
 dist/native/darwin-arm64/process-guardian
 ```
 
+The publication `guardians` job builds them on `windows-2025`, `ubuntu-24.04`, `macos-15` (arm64), and `macos-15-intel` (x64).
+
 Each supported artifact must be named in the release integrity manifest with target triple, crate version, guardian protocol version, SHA-256, byte size, build provenance, and signature/attestation status. The build marks a platform supported only after its native containment integration runs on that platform. A missing, altered, incompatible, unsupported, or wrong-platform artifact is a concise containment launch error; A1 never silently falls back to PID-only cleanup.
 
 ## Licensing

package/docs/architecture/resident-tabs-requirements.md

@@ -0,0 +1,18 @@
+# Resident tabs — target requirements
+
+Status: one requirement remains outside the delivered milestones. Milestones 1–6 moved every other requirement into their OpenSpec changes, and the canonical specs now hold them. This file keeps only what no milestone has delivered yet; it binds nothing until a later change adopts it. See [`resident-tabs.md`](resident-tabs.md#roadmap).
+
+## Capability: `resident-terminal-host`
+
+### ADDED Requirements
+
+#### Requirement: Host topology mutations are revisioned and atomic
+Client/server topology messages SHALL use the generation-1 protocol established by `resident-tabs-contracts`. A topology subscription SHALL begin with one complete snapshot and monotonic revision, followed by ordered changes. Every create, rename, reorder, close, retry, fresh-start, and stop-all mutation SHALL carry its expected topology or registry revision and SHALL either commit completely at the next revision or be rejected without a partial change. A method absent from an older same-generation server SHALL disable only that operation.
+
+##### Scenario: Two clients mutate one revision
+- **WHEN** two clients submit topology mutations against the same expected revision
+- **THEN** at most one SHALL commit, the stale mutation SHALL receive a typed revision conflict, and every client SHALL converge on the committed topology
+
+##### Scenario: Newer client calls an unavailable method
+- **WHEN** a newer same-generation client attaches to an older server that lacks one optional topology method
+- **THEN** attachment and unrelated operations SHALL remain available while only that method is disabled