@timurproko/a1 0.2.7-dev.754 → 0.2.7-dev.772

package/dist/foundation/release/dependency-certification.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
-import { chmod, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { immutablePlatformPolicy } from "./immutable-platform.js";
 export const DEPENDENCY_CERTIFICATIONS_DIRECTORY = "dependency-certifications";
@@ -194,7 +194,8 @@ async function releasePublicationLock(path, token) {
     while (true) {
         try {
             if (!retired) {
-                await assertPublicationLockOwner(path, token);
+                if (!await assertPublicationLockOwner(path, token))
+                    return;
                 await rename(path, released);
                 retired = true;
             }
@@ -218,24 +219,58 @@ async function releasePublicationLock(path, token) {
 }
 /** Ownership uncertainty is never authority to retire a missing, linked, or replaced generation. */
 async function assertPublicationLockOwner(path, token) {
-    try {
-        const metadata = await lstat(path);
-        if (!metadata.isDirectory() || metadata.isSymbolicLink() || await realpath(path) !== path)
-            throw new Error("invalid lock directory");
-        const ownerPath = resolve(path, "owner.json");
-        const ownerMetadata = await lstat(ownerPath);
-        if (!ownerMetadata.isFile() || ownerMetadata.isSymbolicLink() || await realpath(ownerPath) !== ownerPath)
-            throw new Error("invalid owner file");
-        const owner = JSON.parse(await readFile(ownerPath, "utf8"));
-        if (!owner || typeof owner !== "object" || !("pid" in owner) || !("token" in owner)
-            || owner.pid !== process.pid || owner.token !== token)
-            throw new Error("owner generation differs");
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            const metadata = await lstat(path);
+            if (!metadata.isDirectory() || metadata.isSymbolicLink() || await realpath(path) !== path)
+                throw new Error("invalid lock directory");
+            const ownerPath = resolve(path, "owner.json");
+            const ownerMetadata = await lstat(ownerPath);
+            if (!ownerMetadata.isFile() || ownerMetadata.isSymbolicLink() || await realpath(ownerPath) !== ownerPath)
+                throw new Error("invalid owner file");
+            const owner = JSON.parse(await readFile(ownerPath, "utf8"));
+            if (!owner || typeof owner !== "object" || !("pid" in owner) || !("token" in owner)
+                || owner.pid !== process.pid || owner.token !== token)
+                throw new Error("owner generation differs");
+            return true;
+        }
+        catch (error) {
+            // Platform: Windows can briefly hide a directory immediately after a successful rename
+            // when independent publishers are contending. Re-read the complete identity; never treat
+            // absence as ownership and never retire a generation whose token differs.
+            if (hasCode(error, "ENOENT") && attempt < 3) {
+                await new Promise(resolvePromise => setTimeout(resolvePromise, 20 * attempt));
+                continue;
+            }
+            // Concurrency: a delayed abandoned-owner reclaimer can move a successor generation after
+            // reading the predecessor. If our exact token is now in a managed tombstone, no active
+            // generation belongs to this release call and returning without mutation is fail-safe.
+            if (hasCode(error, "ENOENT") && await publicationLockWasRetired(path, token))
+                return false;
+            if (isReleaseContention(error))
+                throw error;
+            throw new Error("publication lease release ownership could not be verified", { cause: error });
+        }
     }
-    catch (error) {
-        if (isReleaseContention(error))
-            throw error;
-        throw new Error("publication lease release ownership could not be verified", { cause: error });
+}
+async function publicationLockWasRetired(path, token) {
+    const directory = dirname(path);
+    const prefix = `${basename(path)}.`;
+    const entries = await readdir(directory, { withFileTypes: true });
+    if (entries.length > 256)
+        return false;
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink() || !entry.name.startsWith(prefix)
+            || (!entry.name.includes(".abandoned-") && !entry.name.includes(".released-")))
+            continue;
+        const ownerPath = resolve(directory, entry.name, "owner.json");
+        const owner = await readFile(ownerPath, "utf8")
+            .then(source => JSON.parse(source))
+            .catch(() => null);
+        if (owner?.pid === process.pid && owner.token === token)
+            return true;
     }
+    return false;
 }
 function isReleaseContention(error) {
     return ["EPERM", "EACCES", "EBUSY"].some(code => hasCode(error, code));

package/dist/foundation/release/progress-palette.generated.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generated by scripts/pi/sync-progress-palette.ts from @earendil-works/pi-coding-agent 1.1.0
- * (MIT), commit abe508e1b89912adde45528136c3221eb69acdd7. Do not edit directly.
+ * Generated by scripts/pi/sync-progress-palette.ts from @earendil-works/pi-coding-agent 1.2.0
+ * (MIT), commit 06a466935536f8c9bcacb2d5efc0fc021be1bdff. Do not edit directly.
  */
 export declare const SHARED_PROGRESS_ACCENT_ANSI = "\u001B[38;2;167;152;215m";

package/dist/foundation/release/progress-palette.generated.js

@@ -1,5 +1,5 @@
 /**
- * Generated by scripts/pi/sync-progress-palette.ts from @earendil-works/pi-coding-agent 1.1.0
- * (MIT), commit abe508e1b89912adde45528136c3221eb69acdd7. Do not edit directly.
+ * Generated by scripts/pi/sync-progress-palette.ts from @earendil-works/pi-coding-agent 1.2.0
+ * (MIT), commit 06a466935536f8c9bcacb2d5efc0fc021be1bdff. Do not edit directly.
  */
 export const SHARED_PROGRESS_ACCENT_ANSI = "\u001b[38;2;167;152;215m";

package/dist/foundation/release/release-gc.d.ts

@@ -2,6 +2,7 @@ import { rename, rm } from "node:fs/promises";
 import { CohortStateStore, type ExternalReleaseHold, type OrphanReleaseDisposition } from "./cohort-state.js";
 import type { ProductPaths } from "../lifecycle/index.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
+import { type ResidentReleaseHoldReport } from "../resident-tabs/index.js";
 export interface ReleaseCleanupLimits {
     readonly maxItems: number;
     readonly maxDurationMs: number;
@@ -21,6 +22,8 @@ export interface ReleaseCleanupOptions {
     readonly operations?: ReleaseCleanupOperations;
     /** Process-start seam for scheduler and continuation tests. */
     readonly workerSpawner?: (entry: string, environment: NodeJS.ProcessEnv) => Promise<void>;
+    /** Resident-tab inspection seam; the default asks a verified installed terminal host. */
+    readonly residentHolds?: (dataDir: string, releaseRoots: readonly string[]) => Promise<ResidentReleaseHoldReport>;
 }
 export interface ReleaseCleanupWorkerOptions {
     readonly cleanup?: ReleaseCleanupOptions;

package/dist/foundation/release/release-gc.js

@@ -14,6 +14,7 @@ import { UpdateTransactionStore } from "./update-transaction.js";
 import { cleanupUpdateRecoveryCapsules } from "./update-recovery.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { collectCompileCaches, startupCompileCachePath } from "../startup/index.js";
+import { readResidentReleaseHolds } from "../resident-tabs/index.js";
 const DEFAULT_CANDIDATE_AGE_MS = 60 * 60 * 1_000;
 const DEFAULT_LIMITS = { maxItems: 8, maxDurationMs: 2_000, concurrency: 1 };
 const DEFAULT_WORKER_DURATION_MS = 10 * 60 * 1_000;
@@ -30,7 +31,7 @@ export async function prepareReleaseCleanup(dataDir, paths, options = {}) {
     const store = new CohortStateStore(dataDir);
     const discovered = await discoverCleanupInputs(dataDir, store, options);
     const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
-    await store.reconcileRetention(async () => await protectionInputs(paths, transactionStore, options.externalHolds ?? []), discovered.orphans);
+    await store.reconcileRetention(async () => await protectionInputs(dataDir, paths, transactionStore, options.externalHolds ?? [], options.residentHolds), discovered.orphans);
     for (const diagnostic of discovered.diagnostics.slice(0, 16)) {
         await store.recordCleanupFailure(diagnostic.releaseId, diagnostic.stage, diagnostic.error);
     }
@@ -77,7 +78,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
             maximum -= 1;
             const certificationId = certificationReleaseId(artifact);
             if (certificationId !== null) {
-                const inputs = await protectionInputs(paths, transactionStore, options.externalHolds ?? []);
+                const inputs = await protectionInputs(dataDir, paths, transactionStore, options.externalHolds ?? [], options.residentHolds);
                 if (isProtectedDetachedRelease(await store.read(), inputs, certificationId))
                     continue;
             }
@@ -232,7 +233,7 @@ export async function collectRelease(store, dataDir, releaseId, externalReferenc
     const state = await store.read();
     if (!state.releases[releaseId])
         throw new Error(`unknown release ${releaseId}`);
-    await store.reconcileRetention(async () => ({ ...(await protectionInputs(paths, new UpdateTransactionStore(dataDir), holds)) }));
+    await store.reconcileRetention(async () => ({ ...(await protectionInputs(dataDir, paths, new UpdateTransactionStore(dataDir), holds)) }));
     const disposition = (await store.read()).cleanup.pending[releaseId];
     if (!disposition)
         throw new Error(`release ${releaseId} is still referenced and cannot be collected`);
@@ -243,7 +244,7 @@ export async function collectRelease(store, dataDir, releaseId, externalReferenc
 async function collectDisposition(store, dataDir, paths, disposition, options) {
     const releaseId = disposition.release.releaseId;
     try {
-        const inputs = await protectionInputs(paths, options.transactionStore ?? new UpdateTransactionStore(dataDir), options.externalHolds ?? []);
+        const inputs = await protectionInputs(dataDir, paths, options.transactionStore ?? new UpdateTransactionStore(dataDir), options.externalHolds ?? [], options.residentHolds);
         const current = await store.read();
         if (isProtectedDetachedRelease(current, inputs, releaseId))
             return false;
@@ -289,12 +290,47 @@ function isProtectedDetachedRelease(state, inputs, releaseId) {
         || (inputs.externalHolds ?? []).some(hold => hold.releaseId === releaseId)
         || (inputs.transaction?.status === "active" && inputs.transaction.priorActiveReleaseId === releaseId);
 }
-async function protectionInputs(paths, transactionStore, externalHolds) {
-    const [liveIds, transaction] = await Promise.all([
+async function protectionInputs(dataDir, paths, transactionStore, externalHolds, residentHolds) {
+    const [liveIds, transaction, resident] = await Promise.all([
         paths ? liveReleaseIds(paths) : Promise.resolve([]),
         transactionStore.read(),
+        residentReleaseHolds(dataDir, residentHolds),
     ]);
-    return { liveReleaseIds: liveIds, externalHolds, transaction: transactionReference(transaction) };
+    return { liveReleaseIds: liveIds, externalHolds: [...externalHolds, ...resident], transaction: transactionReference(transaction) };
+}
+/**
+ * Holds every release a live resident server, holder, or tab child runs from. Retention fails
+ * closed: an incomplete report, or a recorded root inside the release store that names no known
+ * release, holds every known release.
+ */
+async function residentReleaseHolds(dataDir, reader) {
+    const state = await new CohortStateStore(dataDir).read();
+    const records = [
+        ...Object.values(state.releases),
+        ...Object.values(state.cleanup.pending).map(disposition => disposition.release),
+    ];
+    const preferred = [state.references.active, state.references.rollback]
+        .flatMap(id => id && state.releases[id] ? [state.releases[id].releaseRoot] : []);
+    const roots = [...new Set([...preferred, ...Object.values(state.releases).map(record => record.releaseRoot)])];
+    const report = await (reader ?? ((directory, releaseRoots) => readResidentReleaseHolds({ dataDir: directory, releaseRoots })))(dataDir, roots);
+    const everything = () => [...new Set(records.map(record => record.releaseId))].map(releaseId => ({ authority: "resident", releaseId }));
+    if (!report.complete)
+        return everything();
+    const byRoot = new Map(records.map(record => [comparablePath(record.releaseRoot), record.releaseId]));
+    const store = comparablePath(resolve(dataDir, "releases"));
+    const holds = new Set();
+    for (const root of report.releaseRoots) {
+        const releaseId = byRoot.get(comparablePath(root));
+        if (releaseId)
+            holds.add(releaseId);
+        else if (comparablePath(root).startsWith(`${store}${sep}`))
+            return everything();
+    }
+    return [...holds].sort().map(releaseId => ({ authority: "resident", releaseId }));
+}
+function comparablePath(path) {
+    const absolute = resolve(path);
+    return process.platform === "win32" ? absolute.toLowerCase() : absolute;
 }
 function transactionReference(transaction) {
     return transaction === null ? null : { status: transaction.status, priorActiveReleaseId: transaction.priorActiveReleaseId };
@@ -745,7 +781,7 @@ function parseWorkerHolds(value) {
         if (!Array.isArray(parsed))
             return [];
         return parsed.filter((hold) => Boolean(hold) && typeof hold === "object"
-            && (hold.authority === "agent" || hold.authority === "migration")
+            && ["agent", "migration", "resident"].includes(hold.authority)
             && typeof hold.releaseId === "string");
     }
     catch {

package/dist/foundation/resident-tabs/bounded-host-command.d.ts

@@ -0,0 +1,16 @@
+export interface BoundedHostCommandResult {
+    readonly code: number;
+    readonly stdout: string;
+}
+export interface BoundedHostCommandLimits {
+    /** Output beyond this many bytes fails the exchange instead of being parsed. */
+    readonly maxStdoutBytes: number;
+    readonly timeoutMs: number;
+    /** Names the exchange in the timeout error. */
+    readonly label: string;
+}
+/**
+ * Runs one terminal-host command whose report is small. An oversized report kills the command and
+ * reports a failed exchange; a command that outlives its deadline is killed and rejected.
+ */
+export declare function runBoundedHostCommand(executable: string, arguments_: readonly string[], limits: BoundedHostCommandLimits): Promise<BoundedHostCommandResult>;

package/dist/foundation/resident-tabs/bounded-host-command.js

@@ -0,0 +1,35 @@
+import { spawn } from "node:child_process";
+/**
+ * Runs one terminal-host command whose report is small. An oversized report kills the command and
+ * reports a failed exchange; a command that outlives its deadline is killed and rejected.
+ */
+export async function runBoundedHostCommand(executable, arguments_, limits) {
+    return await new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(executable, [...arguments_], { windowsHide: true, stdio: ["ignore", "pipe", "ignore"] });
+        const stdout = [];
+        let size = 0;
+        let overflowed = false;
+        child.stdout.on("data", chunk => {
+            size += chunk.length;
+            // Security: an oversized answer is a failed exchange, never a truncated report to parse.
+            if (size > limits.maxStdoutBytes) {
+                overflowed = true;
+                child.kill("SIGKILL");
+            }
+            else
+                stdout.push(Buffer.from(chunk));
+        });
+        child.once("error", rejectPromise);
+        child.once("close", code => {
+            clearTimeout(timer);
+            resolvePromise(overflowed
+                ? { code: code === 0 || code === null ? 1 : code, stdout: "" }
+                : { code: code ?? 1, stdout: Buffer.concat(stdout).toString("utf8") });
+        });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+            rejectPromise(new Error(`${limits.label} timed out`));
+        }, limits.timeoutMs);
+        timer.unref();
+    });
+}

package/dist/foundation/resident-tabs/bridge-client.d.ts

@@ -0,0 +1,56 @@
+export type ResidentTabStatus = "starting" | "working" | "needs-input" | "done-unseen" | "idle" | "unresponsive" | "stalled" | "crashed" | "restarting" | "failed";
+export interface TabBridgeCredentials {
+    readonly tabId: string;
+    readonly token: string;
+    readonly endpoint: string;
+}
+export interface TabAttachment {
+    readonly clientId: string;
+    readonly controllerRevision: number;
+}
+export type TabBridgeCommand = {
+    readonly type: "visibility";
+    readonly visible: boolean;
+} | {
+    readonly type: "rename";
+    readonly name: string;
+    readonly nameSource: "default" | "user" | "auto";
+} | {
+    readonly type: "stop";
+    readonly deadlineMs: number;
+};
+interface BridgeTransport {
+    write(bytes: Uint8Array): boolean;
+    destroy(): void;
+    once(event: "connect" | "error" | "close", listener: (...args: unknown[]) => void): unknown;
+    on(event: "data", listener: (bytes: Buffer) => void): unknown;
+}
+export interface TabBridgeOptions {
+    readonly credentials: TabBridgeCredentials;
+    readonly pid?: number;
+    readonly startIdentity?: string;
+    readonly build?: string;
+    readonly connect?: (endpoint: string) => BridgeTransport;
+    readonly heartbeatIntervalMs?: number;
+    readonly setInterval?: (callback: () => void, milliseconds: number) => unknown;
+    readonly clearInterval?: (timer: unknown) => void;
+}
+/** Metadata-only advisory bridge. Terminal input and transcript bytes have no API here. */
+export declare class TabBridgeClient {
+    #private;
+    constructor(options: TabBridgeOptions);
+    get available(): boolean;
+    captureAttachment(): TabAttachment | null;
+    onCommand(listener: (command: TabBridgeCommand) => void): () => void;
+    start(timeoutMs?: number): Promise<boolean>;
+    status(state: ResidentTabStatus, degraded?: boolean, pendingRequests?: number, queuedInput?: number): void;
+    degraded(degraded: boolean): void;
+    accent(accent: string): void;
+    session(file: string | null, name: string | null, nameSource?: "default" | "user" | "auto"): void;
+    prompt(interrupted: boolean): void;
+    requestDetach(origin?: TabAttachment | null, timeoutMs?: number): Promise<boolean>;
+    requestRestart(origin?: TabAttachment | null, timeoutMs?: number): Promise<boolean>;
+    consumeControllerBoundaryInput(data: string): string;
+    close(): void;
+}
+export {};

package/dist/foundation/resident-tabs/bridge-client.js

@@ -0,0 +1,279 @@
+import { connect } from "node:net";
+import { encodeResidentFrame, ResidentFrameDecoder } from "./protocol.js";
+/** Metadata-only advisory bridge. Terminal input and transcript bytes have no API here. */
+export class TabBridgeClient {
+    #options;
+    #transport = null;
+    #connected = false;
+    #available = true;
+    #features = new Set();
+    #sequence = 0;
+    #request = 0;
+    #attachment = null;
+    #closed = false;
+    #retry = null;
+    #latestStatus = null;
+    #accent = null;
+    #latestSession = null;
+    #heartbeat = null;
+    #pending = new Map();
+    #startWaiter = null;
+    #commandListeners = new Set();
+    #boundaryInputRemainder = "";
+    constructor(options) { this.#options = options; }
+    get available() { return this.#available && this.#connected; }
+    captureAttachment() { return this.#attachment === null ? null : { ...this.#attachment }; }
+    onCommand(listener) {
+        this.#commandListeners.add(listener);
+        return () => this.#commandListeners.delete(listener);
+    }
+    async start(timeoutMs = 4_000) {
+        if (this.#closed || this.#transport !== null)
+            return this.available;
+        const transport = (this.#options.connect ?? (endpoint => connect(endpoint)))(this.#options.credentials.endpoint);
+        this.#transport = transport;
+        const decoder = new ResidentFrameDecoder();
+        transport.on("data", bytes => {
+            try {
+                for (const message of decoder.push(bytes))
+                    this.#receive(message);
+            }
+            catch {
+                if (this.#transport === transport)
+                    this.#fail();
+            }
+        });
+        transport.once("close", () => { if (this.#transport === transport)
+            this.#fail(); });
+        transport.once("error", () => { if (this.#transport === transport)
+            this.#fail(); });
+        return await new Promise(resolvePromise => {
+            let settled = false;
+            let timer;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                this.#startWaiter = null;
+                resolvePromise(value);
+            };
+            this.#startWaiter = finish;
+            transport.once("connect", () => {
+                this.#send("hello", {
+                    role: "bridge", generation: 1, build: this.#options.build ?? "a1",
+                    features: ["bridge-status", "bridge-detach", "bridge-heartbeat", "bridge-restart", "bridge-visibility", "bridge-rename", "bridge-stop", "controller-boundary", "recovery-journal"],
+                    token: [...Buffer.from(this.#options.credentials.token, "base64")], tabId: this.#options.credentials.tabId,
+                    pid: this.#options.pid ?? process.pid, startIdentity: this.#options.startIdentity ?? `${process.pid}:node`,
+                }, ++this.#request);
+            });
+            transport.once("error", () => finish(false));
+            timer = setTimeout(() => { this.#fail(); finish(false); }, timeoutMs);
+            timer.unref();
+        });
+    }
+    status(state, degraded = false, pendingRequests = 0, queuedInput = 0) {
+        this.#latestStatus = { state, degraded, accent: this.#accent, pendingRequests, queuedInput };
+        const recoveryState = state === "unresponsive" || state === "stalled" || state === "crashed" || state === "restarting" || state === "failed";
+        if (recoveryState && !this.#supports("recovery-status"))
+            return;
+        this.#send("bridge.status", {
+            seq: ++this.#sequence,
+            state,
+            pendingRequests: Math.max(0, Math.trunc(pendingRequests)),
+            queuedInput: Math.max(0, Math.trunc(queuedInput)),
+            ...(this.#accent === null ? {} : { accent: this.#accent }),
+            ...(degraded && this.#supports("recovery-status") ? { degraded: true } : {}),
+        });
+    }
+    degraded(degraded) {
+        this.status(this.#latestStatus?.state ?? "idle", degraded);
+    }
+    accent(accent) {
+        this.#accent = accent;
+        if (this.#latestStatus !== null)
+            this.status(this.#latestStatus.state, this.#latestStatus.degraded, this.#latestStatus.pendingRequests, this.#latestStatus.queuedInput);
+    }
+    session(file, name, nameSource = "default") {
+        this.#latestSession = { file, name, nameSource };
+        this.#send("bridge.session", { file, name, nameSource });
+    }
+    prompt(interrupted) {
+        this.#send("bridge.prompt", { interrupted });
+    }
+    requestDetach(origin = this.captureAttachment(), timeoutMs = 1_000) {
+        return this.#requestAction("detach", origin, timeoutMs);
+    }
+    requestRestart(origin = this.captureAttachment(), timeoutMs = 1_000) {
+        return this.#requestAction("restart", origin, timeoutMs);
+    }
+    consumeControllerBoundaryInput(data) {
+        const prefix = "\x1bP+a1;controller=";
+        const suffix = "\x1b\\";
+        let pending = this.#boundaryInputRemainder + data;
+        this.#boundaryInputRemainder = "";
+        let output = "";
+        while (pending.length > 0) {
+            const start = pending.indexOf(prefix);
+            if (start === -1) {
+                let retained = 0;
+                const maximum = Math.min(prefix.length - 1, pending.length);
+                for (let length = maximum; length > 0; length--) {
+                    if (pending.endsWith(prefix.slice(0, length))) {
+                        retained = length;
+                        break;
+                    }
+                }
+                const split = pending.length - retained;
+                output += pending.slice(0, split);
+                this.#boundaryInputRemainder = pending.slice(split);
+                break;
+            }
+            output += pending.slice(0, start);
+            const end = pending.indexOf(suffix, start + prefix.length);
+            if (end === -1) {
+                this.#boundaryInputRemainder = pending.slice(start);
+                break;
+            }
+            const body = pending.slice(start + prefix.length, end);
+            const separator = body.indexOf(";");
+            const generation = Number(body.slice(0, separator));
+            const nonceHex = body.slice(separator + 1);
+            if (separator > 0 && Number.isSafeInteger(generation) && generation > 0 && /^[0-9a-f]{32}$/u.test(nonceHex)) {
+                this.#send("bridge.boundary", {
+                    generation,
+                    nonce: [...Buffer.from(nonceHex, "hex")],
+                });
+            }
+            else {
+                output += pending.slice(start, end + suffix.length);
+            }
+            pending = pending.slice(end + suffix.length);
+        }
+        return output;
+    }
+    close() {
+        this.#closed = true;
+        if (this.#retry !== null)
+            clearTimeout(this.#retry);
+        this.#retry = null;
+        this.#stopHeartbeat();
+        const transport = this.#transport;
+        this.#transport = null;
+        transport?.destroy();
+        this.#fail(false);
+    }
+    #emitCommand(command) {
+        for (const listener of this.#commandListeners)
+            listener(command);
+    }
+    #send(type, body, requestId) {
+        if (this.#transport === null || (!this.#connected && type !== "hello"))
+            return;
+        try {
+            this.#transport.write(encodeResidentFrame({ type, ...(requestId === undefined ? {} : { requestId }), body }));
+        }
+        catch {
+            this.#fail();
+        }
+    }
+    #receive(message) {
+        if (message.type === "welcome" && message.body["generation"] === 1) {
+            const advertised = message.body["features"];
+            this.#features = new Set(Array.isArray(advertised) ? advertised.filter((feature) => typeof feature === "string") : []);
+            this.#connected = true;
+            this.#available = true;
+            this.#startWaiter?.(true);
+            if (this.#supports("bridge-heartbeat"))
+                this.#startHeartbeat();
+            if (this.#latestStatus !== null)
+                this.status(this.#latestStatus.state, this.#latestStatus.degraded, this.#latestStatus.pendingRequests, this.#latestStatus.queuedInput);
+            if (this.#latestSession !== null)
+                this.#send("bridge.session", this.#latestSession);
+            return;
+        }
+        if (message.type === "incompatible-generation") {
+            this.#fail();
+            return;
+        }
+        if (message.type === "bridge.visibility" && typeof message.body["visible"] === "boolean") {
+            this.#emitCommand({ type: "visibility", visible: message.body["visible"] });
+            return;
+        }
+        if (message.type === "bridge.rename" && typeof message.body["name"] === "string") {
+            const source = message.body["nameSource"];
+            this.#emitCommand({ type: "rename", name: message.body["name"], nameSource: source === "auto" || source === "default" ? source : "user" });
+            return;
+        }
+        if (message.type === "bridge.stop" && typeof message.body["deadlineMs"] === "number") {
+            this.#emitCommand({ type: "stop", deadlineMs: message.body["deadlineMs"] });
+            return;
+        }
+        if (message.type === "attachment") {
+            const clientId = message.body["clientId"];
+            const revision = message.body["controllerRevision"];
+            if (typeof clientId === "string" && typeof revision === "number")
+                this.#attachment = { clientId, controllerRevision: revision };
+            return;
+        }
+        if ((message.type === "bridge.result" || message.type === "result") && typeof message.requestId === "number") {
+            const resolvePromise = this.#pending.get(message.requestId);
+            if (resolvePromise) {
+                this.#pending.delete(message.requestId);
+                resolvePromise(message.body["accepted"] === true);
+            }
+        }
+    }
+    async #requestAction(action, origin, timeoutMs) {
+        if (!this.available || origin === null || (action === "restart" && !this.#supports("bridge-restart")))
+            return false;
+        const requestId = ++this.#request;
+        const result = new Promise(resolvePromise => this.#pending.set(requestId, resolvePromise));
+        this.#send("bridge.request", { action, clientId: origin.clientId, controllerRevision: origin.controllerRevision }, requestId);
+        const timeout = new Promise(resolvePromise => {
+            const timer = setTimeout(() => { this.#pending.delete(requestId); resolvePromise(false); }, timeoutMs);
+            timer.unref();
+        });
+        return await Promise.race([result, timeout]);
+    }
+    #startHeartbeat() {
+        if (this.#heartbeat !== null)
+            return;
+        const schedule = this.#options.setInterval ?? ((callback, milliseconds) => setInterval(callback, milliseconds));
+        this.#heartbeat = schedule(() => this.#send("bridge.heartbeat", { seq: ++this.#sequence }), this.#options.heartbeatIntervalMs ?? 5_000);
+        this.#heartbeat.unref?.();
+    }
+    #stopHeartbeat() {
+        if (this.#heartbeat === null)
+            return;
+        (this.#options.clearInterval ?? (timer => clearInterval(timer)))(this.#heartbeat);
+        this.#heartbeat = null;
+    }
+    #supports(feature) {
+        return this.#features.has("crash-recovery") || this.#features.has(feature);
+    }
+    #fail(retry = true) {
+        const transport = this.#transport;
+        this.#stopHeartbeat();
+        this.#available = false;
+        this.#connected = false;
+        this.#features.clear();
+        this.#attachment = null;
+        this.#transport = null;
+        transport?.destroy();
+        this.#startWaiter?.(false);
+        this.#startWaiter = null;
+        for (const resolvePromise of this.#pending.values())
+            resolvePromise(false);
+        this.#pending.clear();
+        if (retry && !this.#closed && this.#retry === null) {
+            this.#retry = setTimeout(() => {
+                this.#retry = null;
+                void this.start().then(connected => { if (!connected)
+                    this.#fail(); });
+            }, 250);
+            this.#retry.unref();
+        }
+    }
+}

package/dist/foundation/resident-tabs/doctor.d.ts

@@ -0,0 +1,29 @@
+import type { MaintenanceReport } from "./maintenance.js";
+export declare const DOCTOR_MAX_BYTES: number;
+export interface DoctorOptions {
+    /** The profile's resident state directory, as reported by the terminal host. */
+    readonly stateDir: string;
+    readonly hostStatus: MaintenanceReport;
+    readonly releaseRoots: readonly string[];
+    readonly settings: {
+        readonly tabsMax: number;
+        readonly tabsAutoName: boolean;
+    };
+    readonly home?: string;
+    readonly platform?: NodeJS.Platform;
+    readonly architecture?: string;
+    readonly now?: Date;
+    readonly maxBytes?: number;
+}
+export interface DoctorBundle {
+    readonly path: string;
+    readonly bytes: number;
+    readonly dropped: readonly string[];
+}
+/**
+ * Writes an owner-only diagnostic bundle by allowlist: structured logs, crash records, host
+ * status, a redacted registry, the owner marker without secrets, artifact verification, platform
+ * facts, and the Tabs settings. Secrets, tokens, environment values, prompt journals, drafts,
+ * last screens, the private child-stderr sink, and terminal content are never read.
+ */
+export declare function writeDoctorBundle(options: DoctorOptions): Promise<DoctorBundle>;