@timurproko/a1 0.2.7-dev.754 → 0.2.7-dev.772

package/dist/foundation/resident-tabs/doctor.js

@@ -0,0 +1,166 @@
+import { createHash } from "node:crypto";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { homedir, release as osRelease } from "node:os";
+import { basename, dirname, resolve, sep } from "node:path";
+import { resolveTerminalHostPath } from "./ensure-terminal-host.js";
+import { TERMINAL_HOST_MANIFEST_FILENAME, verifyTerminalHostArtifact } from "./terminal-host-artifact.js";
+import { encodeZip } from "./zip-archive.js";
+export const DOCTOR_MAX_BYTES = 25 * 1024 * 1024;
+const LOG_NAME = /^terminal-host-[a-z0-9-]+\.log(?:\.(\d{1,2}))?$/u;
+const CRASH_NAME = /^crash-[a-z0-9-]+\.json$/u;
+/**
+ * Writes an owner-only diagnostic bundle by allowlist: structured logs, crash records, host
+ * status, a redacted registry, the owner marker without secrets, artifact verification, platform
+ * facts, and the Tabs settings. Secrets, tokens, environment values, prompt journals, drafts,
+ * last screens, the private child-stderr sink, and terminal content are never read.
+ */
+export async function writeDoctorBundle(options) {
+    const home = options.home ?? homedir();
+    const redact = (value) => homeRelative(value, home);
+    const now = options.now ?? new Date();
+    const maxBytes = options.maxBytes ?? DOCTOR_MAX_BYTES;
+    const diagnostics = resolve(options.stateDir, "diagnostics");
+    const names = await readdir(diagnostics).catch(() => []);
+    const fixed = [
+        json("host-status.json", redactHostStatus(options.hostStatus, redact)),
+        json("registry.json", await redactedRegistry(resolve(options.stateDir, "registry.json"), redact)),
+        json("server-marker.json", await redactedMarker(resolve(options.stateDir, "server.json"), redact)),
+        json("artifacts.json", await artifactFacts(options.releaseRoots, options.platform ?? process.platform, options.architecture ?? process.arch, redact)),
+        json("platform.json", {
+            platform: options.platform ?? process.platform,
+            architecture: options.architecture ?? process.arch,
+            osRelease: osRelease(),
+            node: process.version,
+            detachmentMode: options.hostStatus.result?.detachmentMode ?? null,
+        }),
+        json("settings.json", { tabsMax: options.settings.tabsMax, tabsAutoName: options.settings.tabsAutoName }),
+    ];
+    const crashes = [];
+    for (const name of names.filter(name => CRASH_NAME.test(name)).sort()) {
+        crashes.push({ name: `crashes/${name}`, data: await readFile(resolve(diagnostics, name)) });
+    }
+    // Rationale: when the bundle would exceed its cap, the oldest log generations go first.
+    const logs = names
+        .filter(name => LOG_NAME.test(name))
+        .map(name => ({ name, generation: Number(LOG_NAME.exec(name)?.[1] ?? 0) }))
+        .sort((left, right) => left.generation - right.generation || left.name.localeCompare(right.name));
+    const dropped = [];
+    const included = [...fixed, ...crashes];
+    let budget = maxBytes - 64 * 1024 - included.reduce((total, entry) => total + entry.data.length, 0);
+    for (const log of logs) {
+        const size = (await stat(resolve(diagnostics, log.name))).size;
+        if (size > budget) {
+            dropped.push(log.name);
+            continue;
+        }
+        budget -= size;
+        included.push({ name: `logs/${log.name}`, data: await readFile(resolve(diagnostics, log.name)) });
+    }
+    const manifest = [
+        "a1 tabs doctor bundle",
+        `created: ${now.toISOString()}`,
+        ...included.map(entry => `included: ${entry.name}`),
+        ...dropped.map(name => `dropped to stay within ${maxBytes} bytes: logs/${name}`),
+        "",
+    ].join("\n");
+    const archive = encodeZip([{ name: "manifest.txt", data: Buffer.from(manifest, "utf8") }, ...included], now);
+    const directory = resolve(options.stateDir, "doctor");
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const path = resolve(directory, `a1-tabs-doctor-${now.toISOString().replace(/[:.]/gu, "-")}.zip`);
+    await writeFile(path, archive, { mode: 0o600, flag: "wx" });
+    return { path, bytes: archive.length, dropped };
+}
+function json(name, value) {
+    return { name, data: Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8") };
+}
+function stableHash(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+function homeRelative(value, home) {
+    const normalized = resolve(value);
+    const root = resolve(home);
+    const comparable = (path) => process.platform === "win32" ? path.toLowerCase() : path;
+    if (comparable(normalized) === comparable(root))
+        return "~";
+    return comparable(normalized).startsWith(comparable(`${root}${sep}`)) ? `~${normalized.slice(root.length).replaceAll("\\", "/")}` : normalized;
+}
+function redactHostStatus(report, redact) {
+    const result = report.result ? { ...report.result } : undefined;
+    if (result && Array.isArray(result.logs))
+        result.logs = result.logs.map(path => typeof path === "string" ? basename(path) : null);
+    if (result && typeof result.release === "string")
+        result.release = redact(result.release);
+    return {
+        host: report.host,
+        pid: report.pid ?? null,
+        exitCode: report.exitCode,
+        result: result ?? null,
+    };
+}
+async function redactedRegistry(path, redact) {
+    let document;
+    try {
+        document = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        return { readable: false, reason: error instanceof Error && "code" in error ? String(error.code) : "unparseable" };
+    }
+    const tabs = Array.isArray(document.tabs) ? document.tabs : [];
+    const text = (value) => typeof value === "string" ? value : null;
+    return {
+        readable: true,
+        registryRevision: document.registryRevision ?? null,
+        epoch: document.epoch ?? null,
+        tabs: tabs.map(tab => {
+            const sessionFile = text(tab.sessionFile);
+            return {
+                tabId: text(tab.tabId),
+                // Security: names can be generated from prompts, so only a stable hash is kept.
+                nameHash: text(tab.displayName) === null ? null : stableHash(text(tab.displayName)),
+                nameSource: text(tab.nameSource),
+                order: tab.order ?? null,
+                cwd: text(tab.cwd) === null ? null : redact(text(tab.cwd)),
+                sessionDirectory: sessionFile === null ? null : redact(dirname(sessionFile)),
+                sessionFileHash: sessionFile === null ? null : stableHash(basename(sessionFile)),
+                desired: text(tab.desired),
+                lifecycle: text(tab.lifecycle),
+                incarnation: tab.incarnation ?? null,
+                holderPid: tab.holderPid ?? null,
+                childPid: tab.childPid ?? null,
+                release: text(tab.release) === null ? null : redact(text(tab.release)),
+                lastExit: text(tab.lastExit),
+                restarts: tab.restarts ?? null,
+            };
+        }),
+    };
+}
+async function redactedMarker(path, redact) {
+    try {
+        const marker = JSON.parse(await readFile(path, "utf8"));
+        return {
+            present: true,
+            pid: marker.pid ?? null,
+            generation: marker.generation ?? null,
+            verified: marker.verified ?? null,
+            detachmentMode: marker.detachmentMode ?? null,
+            releaseRoot: typeof marker.releaseRoot === "string" ? redact(marker.releaseRoot) : null,
+        };
+    }
+    catch {
+        return { present: false };
+    }
+}
+async function artifactFacts(roots, platform, architecture, redact) {
+    const facts = [];
+    for (const root of roots) {
+        const executable = resolveTerminalHostPath(root, {}, platform, architecture);
+        const manifest = await readFile(resolve(dirname(executable), TERMINAL_HOST_MANIFEST_FILENAME), "utf8")
+            .then(text => JSON.parse(text))
+            .catch(() => null);
+        const verification = await verifyTerminalHostArtifact(executable, platform, architecture)
+            .then(() => "verified")
+            .catch((error) => error instanceof Error && "code" in error ? String(error.code) : "failed");
+        facts.push({ releaseRoot: redact(root), verification, manifest });
+    }
+    return facts;
+}

package/dist/foundation/resident-tabs/draft-checkpoint.d.ts

@@ -0,0 +1,27 @@
+import { ResidentTabFaultInjection } from "./fault-injection.js";
+export interface DraftCheckpointState {
+    readonly text: string;
+    readonly savedAt: string;
+}
+export interface DraftCheckpointOptions {
+    readonly intervalMs?: number;
+    readonly maximumDirtyMs?: number;
+    readonly faults?: ResidentTabFaultInjection;
+    readonly now?: () => number;
+    readonly onDegraded?: (degraded: boolean) => void;
+    readonly write?: (path: string, text: string) => Promise<void>;
+    readonly move?: (from: string, to: string) => Promise<void>;
+    readonly schedule?: (callback: () => void | Promise<void>, delayMs: number) => unknown;
+    readonly cancel?: (timer: unknown) => void;
+}
+/** Periodic rather than inactivity-debounced: continuous input still checkpoints every interval. */
+export declare class DraftCheckpointer {
+    #private;
+    readonly path: string;
+    constructor(path: string, options?: DraftCheckpointOptions);
+    get degraded(): boolean;
+    change(text: string): void;
+    restore(): Promise<DraftCheckpointState | null>;
+    flush(): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/foundation/resident-tabs/draft-checkpoint.js

@@ -0,0 +1,145 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { ResidentTabFaultInjection } from "./fault-injection.js";
+/** Periodic rather than inactivity-debounced: continuous input still checkpoints every interval. */
+export class DraftCheckpointer {
+    path;
+    #intervalMs;
+    #maximumDirtyMs;
+    #faults;
+    #now;
+    #onDegraded;
+    #write;
+    #move;
+    #scheduleTimer;
+    #cancelTimer;
+    #text = "";
+    #dirtySince = null;
+    #timer = null;
+    #degradedTimer = null;
+    #writing = null;
+    #closed = false;
+    #degraded = false;
+    constructor(path, options = {}) {
+        this.path = path;
+        this.#intervalMs = options.intervalMs ?? 500;
+        this.#maximumDirtyMs = options.maximumDirtyMs ?? 1_000;
+        this.#faults = options.faults ?? new ResidentTabFaultInjection();
+        this.#now = options.now ?? Date.now;
+        this.#onDegraded = options.onDegraded ?? (() => { });
+        this.#write = options.write ?? (async (target, text) => writeFile(target, text, { encoding: "utf8", mode: 0o600, flag: "wx" }));
+        this.#move = options.move ?? rename;
+        this.#scheduleTimer = options.schedule ?? ((callback, delayMs) => setTimeout(callback, delayMs));
+        this.#cancelTimer = options.cancel ?? (timer => clearTimeout(timer));
+    }
+    get degraded() { return this.#degraded; }
+    change(text) {
+        if (this.#closed)
+            return;
+        this.#text = text;
+        this.#dirtySince ??= this.#now();
+        this.#schedule();
+        this.#armDegradedDeadline();
+    }
+    async restore() {
+        try {
+            const value = JSON.parse(await readFile(this.path, "utf8"));
+            if (typeof value !== "object" || value === null || typeof value.text !== "string"
+                || typeof value.savedAt !== "string")
+                return null;
+            return value;
+        }
+        catch (error) {
+            if (error.code === "ENOENT" || error instanceof SyntaxError)
+                return null;
+            throw error;
+        }
+    }
+    async flush() {
+        if (this.#timer !== null) {
+            this.#cancelTimer(this.#timer);
+            this.#timer = null;
+        }
+        await this.#writing;
+        if (this.#dirtySince !== null)
+            await this.#checkpoint();
+    }
+    async close() {
+        await this.flush();
+        this.#closed = true;
+    }
+    #armDegradedDeadline() {
+        if (this.#degradedTimer !== null || this.#dirtySince === null || this.#closed)
+            return;
+        const delay = Math.max(0, this.#maximumDirtyMs - (this.#now() - this.#dirtySince));
+        this.#degradedTimer = this.#scheduleTimer(() => {
+            this.#degradedTimer = null;
+            if (this.#dirtySince !== null && this.#now() - this.#dirtySince >= this.#maximumDirtyMs) {
+                this.#setDegraded(true);
+            }
+            else if (this.#dirtySince !== null) {
+                this.#armDegradedDeadline();
+            }
+        }, delay);
+    }
+    #clearDegradedDeadline() {
+        if (this.#degradedTimer !== null)
+            this.#cancelTimer(this.#degradedTimer);
+        this.#degradedTimer = null;
+    }
+    #schedule() {
+        if (this.#timer !== null || this.#writing !== null || this.#closed)
+            return;
+        const age = this.#dirtySince === null ? 0 : this.#now() - this.#dirtySince;
+        if (age > this.#maximumDirtyMs)
+            this.#setDegraded(true);
+        this.#timer = this.#scheduleTimer(async () => {
+            this.#timer = null;
+            this.#writing = this.#checkpoint().finally(() => {
+                this.#writing = null;
+                if (this.#dirtySince !== null)
+                    this.#schedule();
+            });
+            await this.#writing.catch(() => undefined);
+        }, this.#intervalMs);
+    }
+    async #checkpoint() {
+        if (this.#dirtySince === null)
+            return;
+        const snapshot = this.#text;
+        const temporary = `${this.path}.tmp-${process.pid}-${randomUUID()}`;
+        try {
+            await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+            if (process.platform !== "win32")
+                await chmod(dirname(this.path), 0o700);
+            this.#faults.at("draft-during-temp-write");
+            await this.#write(temporary, `${JSON.stringify({ text: snapshot, savedAt: new Date(this.#now()).toISOString() })}\n`);
+            this.#faults.at("draft-before-rename");
+            await this.#move(temporary, this.path);
+            this.#faults.at("draft-after-rename");
+            if (process.platform !== "win32")
+                await chmod(this.path, 0o600);
+            if (this.#text === snapshot)
+                this.#dirtySince = null;
+            else
+                this.#dirtySince = this.#now();
+            this.#clearDegradedDeadline();
+            if (this.#dirtySince !== null)
+                this.#armDegradedDeadline();
+            this.#setDegraded(false);
+        }
+        catch (error) {
+            await unlink(temporary).catch(() => undefined);
+            this.#clearDegradedDeadline();
+            this.#setDegraded(true);
+            throw error;
+        }
+    }
+    #setDegraded(value) {
+        if (this.#degraded === value)
+            return;
+        this.#degraded = value;
+        this.#onDegraded(value);
+    }
+}

package/dist/foundation/resident-tabs/ensure-terminal-host.d.ts

@@ -0,0 +1,31 @@
+export type TerminalHostFallbackReason = "unsupported platform" | "no interactive terminal" | "terminal host not installed" | "terminal host not verified" | "host probe failed" | "incompatible generation" | "registry unreadable" | "recovery blocked" | "launch not verified" | "host startup timed out";
+export type EnsureTerminalHostResult = {
+    readonly status: "ready";
+    readonly executable: string;
+    readonly endpoint: string;
+} | {
+    readonly status: "fallback";
+    readonly reason: TerminalHostFallbackReason;
+};
+interface HostCommandResult {
+    readonly code: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export interface EnsureTerminalHostOptions {
+    readonly releaseRoot: string;
+    readonly profileRoot: string;
+    readonly dataDir: string;
+    readonly runtimeDir: string;
+    readonly environment: NodeJS.ProcessEnv;
+    readonly platform?: NodeJS.Platform;
+    readonly architecture?: string;
+    readonly timeoutMs?: number;
+    readonly maxConcurrentStarts?: number;
+    readonly unresponsiveRestartSeconds?: number;
+    readonly run?: (executable: string, arguments_: readonly string[], environment: NodeJS.ProcessEnv, timeoutMs: number) => Promise<HostCommandResult>;
+    readonly verify?: (executable: string, platform: NodeJS.Platform, architecture: string) => Promise<unknown>;
+}
+export declare function resolveTerminalHostPath(releaseRoot: string, environment?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, architecture?: string): string;
+export declare function ensureTerminalHost(options: EnsureTerminalHostOptions): Promise<EnsureTerminalHostResult>;
+export {};

package/dist/foundation/resident-tabs/ensure-terminal-host.js

@@ -0,0 +1,147 @@
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { constants } from "node:fs";
+import { resolve } from "node:path";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { TerminalHostArtifactError, verifyTerminalHostArtifact } from "./terminal-host-artifact.js";
+export function resolveTerminalHostPath(releaseRoot, environment = process.env, platform = process.platform, architecture = process.arch) {
+    const override = developmentOverride(environment);
+    if (override)
+        return resolve(override);
+    const executable = platform === "win32" ? `${PRODUCT_IDENTITY.artifacts.nativeExecutable}.exe` : PRODUCT_IDENTITY.artifacts.nativeExecutable;
+    return resolve(releaseRoot, "dist", "native", `${platform}-${architecture}`, executable);
+}
+/** The terminal-host override is a development aid; installed releases always run their own verified artifact. */
+function developmentOverride(environment) {
+    if (!environment[PRODUCT_IDENTITY.environment.developmentInstanceId])
+        return undefined;
+    return environment[PRODUCT_IDENTITY.environment.terminalHostPath]?.trim() || undefined;
+}
+export async function ensureTerminalHost(options) {
+    const platform = options.platform ?? process.platform;
+    const architecture = options.architecture ?? process.arch;
+    if (!supported(platform, architecture))
+        return { status: "fallback", reason: "unsupported platform" };
+    const executable = resolveTerminalHostPath(options.releaseRoot, options.environment, platform, architecture);
+    if (developmentOverride(options.environment)) {
+        try {
+            await access(executable, constants.R_OK | (platform === "win32" ? 0 : constants.X_OK));
+        }
+        catch {
+            return { status: "fallback", reason: "terminal host not installed" };
+        }
+    }
+    else {
+        try {
+            await (options.verify ?? verifyTerminalHostArtifact)(executable, platform, architecture);
+        }
+        catch (error) {
+            return { status: "fallback", reason: verificationReason(error) };
+        }
+    }
+    const run = options.run ?? runHostCommand;
+    const timeoutMs = options.timeoutMs ?? 8_000;
+    const common = ["--profile", options.profileRoot, "--data-dir", options.dataDir, "--runtime-dir", options.runtimeDir];
+    const environment = { ...options.environment };
+    try {
+        const probe = await run(executable, ["probe", ...common], environment, Math.min(4_000, timeoutMs));
+        const existing = parseResult(probe.stdout);
+        if (probe.code === 0) {
+            if (existing?.generation === 1 && typeof existing.endpoint === "string") {
+                return { status: "ready", executable, endpoint: existing.endpoint };
+            }
+            return {
+                status: "fallback",
+                reason: typeof existing?.generation === "number" ? "incompatible generation" : "host probe failed",
+            };
+        }
+        if (probe.code === 4 || existing?.outcome === "incompatible-generation")
+            return { status: "fallback", reason: "incompatible generation" };
+        if (existing?.outcome !== "not-running" && probe.code !== 3)
+            return { status: "fallback", reason: classifiedReason(existing?.reason, "host probe failed") };
+        const maximum = Math.max(1, Math.min(8, Math.trunc(options.maxConcurrentStarts ?? 2)));
+        const unresponsiveRestartSeconds = Math.max(30, Math.min(600, Math.trunc(options.unresponsiveRestartSeconds ?? 120)));
+        const start = await run(executable, [
+            "server", "--detach", ...common,
+            "--max-concurrent-starts", String(maximum),
+            "--unresponsive-restart-seconds", String(unresponsiveRestartSeconds),
+        ], environment, timeoutMs);
+        const started = parseResult(start.stdout);
+        if (start.code !== 0)
+            return { status: "fallback", reason: classifiedReason(started?.reason, "launch not verified") };
+        if (started?.verified !== true || typeof started.endpoint !== "string")
+            return { status: "fallback", reason: "launch not verified" };
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            const result = await run(executable, ["probe", ...common], environment, Math.min(1_000, Math.max(1, deadline - Date.now())));
+            const ready = parseResult(result.stdout);
+            if (result.code === 0) {
+                if (ready?.generation === 1 && typeof ready.endpoint === "string") {
+                    return { status: "ready", executable, endpoint: ready.endpoint };
+                }
+                return {
+                    status: "fallback",
+                    reason: typeof ready?.generation === "number" ? "incompatible generation" : "host probe failed",
+                };
+            }
+            if (result.code === 4 || ready?.outcome === "incompatible-generation")
+                return { status: "fallback", reason: "incompatible generation" };
+            await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
+        }
+        return { status: "fallback", reason: "host startup timed out" };
+    }
+    catch (error) {
+        return { status: "fallback", reason: isTimeout(error) ? "host startup timed out" : "host probe failed" };
+    }
+}
+function supported(platform, architecture) {
+    return (platform === "win32" || platform === "linux") && architecture === "x64"
+        || platform === "darwin" && (architecture === "arm64" || architecture === "x64");
+}
+function verificationReason(error) {
+    if (!(error instanceof TerminalHostArtifactError))
+        return "terminal host not verified";
+    if (error.code === "TERMINAL_HOST_ARTIFACT_MISSING")
+        return "terminal host not installed";
+    if (error.code === "TERMINAL_HOST_ARTIFACT_UNSUPPORTED")
+        return "unsupported platform";
+    return "terminal host not verified";
+}
+function parseResult(output) {
+    const line = output.trim().split(/\r?\n/).filter(Boolean).at(-1);
+    if (!line)
+        return null;
+    try {
+        const parsed = JSON.parse(line);
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function classifiedReason(value, fallback) {
+    if (value === "registry-unreadable")
+        return "registry unreadable";
+    if (value === "blocked")
+        return "recovery blocked";
+    if (value === "incompatible-generation")
+        return "incompatible generation";
+    return fallback;
+}
+function isTimeout(error) { return error instanceof Error && "code" in error && error.code === "ETIMEDOUT"; }
+async function runHostCommand(executable, arguments_, environment, timeoutMs) {
+    return await new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(executable, [...arguments_], { env: environment, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", chunk => stdout.push(Buffer.from(chunk)));
+        child.stderr.on("data", chunk => stderr.push(Buffer.from(chunk)));
+        child.once("error", rejectPromise);
+        child.once("close", code => { clearTimeout(timer); resolvePromise({ code: code ?? 1, stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8") }); });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+            rejectPromise(Object.assign(new Error("terminal host command timed out"), { code: "ETIMEDOUT" }));
+        }, timeoutMs);
+        timer.unref();
+    });
+}

package/dist/foundation/resident-tabs/fault-injection.d.ts

@@ -0,0 +1,8 @@
+export declare const RESIDENT_TAB_FAULT_ENVIRONMENT: readonly ["A1_TABS_FAULT_CRASH_POINT", "A1_TABS_HERMETIC_TEST"];
+export declare function residentTabFaultEnvironment(point: string, hermetic?: boolean): NodeJS.ProcessEnv;
+/** Test-only crash points are inert unless the caller explicitly marks a hermetic process. */
+export declare class ResidentTabFaultInjection {
+    #private;
+    constructor(environment?: NodeJS.ProcessEnv, crash?: (point: string) => never);
+    at(point: string): void;
+}

package/dist/foundation/resident-tabs/fault-injection.js

@@ -0,0 +1,26 @@
+const CRASH_POINT = "A1_TABS_FAULT_CRASH_POINT";
+const HERMETIC = "A1_TABS_HERMETIC_TEST";
+export const RESIDENT_TAB_FAULT_ENVIRONMENT = Object.freeze([CRASH_POINT, HERMETIC]);
+export function residentTabFaultEnvironment(point, hermetic = true) {
+    return Object.fromEntries(hermetic ? [[CRASH_POINT, point], [HERMETIC, "1"]] : [[CRASH_POINT, point]]);
+}
+/** Test-only crash points are inert unless the caller explicitly marks a hermetic process. */
+export class ResidentTabFaultInjection {
+    #point;
+    #crash;
+    constructor(environment = process.env, crash = point => {
+        process.stderr.write(`resident tab injected crash: ${point}\n`);
+        process.abort();
+    }) {
+        const point = environment[CRASH_POINT];
+        if (point !== undefined && environment[HERMETIC] !== "1") {
+            throw new Error(`${CRASH_POINT} is available only in a hermetic resident-tab test`);
+        }
+        this.#point = point;
+        this.#crash = crash;
+    }
+    at(point) {
+        if (this.#point === point)
+            this.#crash(point);
+    }
+}

package/dist/foundation/resident-tabs/index.d.ts

@@ -0,0 +1,12 @@
+export { ensureTerminalHost, resolveTerminalHostPath } from "./ensure-terminal-host.js";
+export type { EnsureTerminalHostOptions, EnsureTerminalHostResult, TerminalHostFallbackReason } from "./ensure-terminal-host.js";
+export { readResidentTabLaunchSettings } from "./settings.js";
+export type { ResidentTabLaunchSettings } from "./settings.js";
+export { selectResidentHost } from "./routing.js";
+export type { ResidentHostSelectionOptions } from "./routing.js";
+export { readResidentReleaseHolds } from "./release-holds.js";
+export type { ResidentReleaseHoldReport } from "./release-holds.js";
+export { runTerminalHostMaintenance } from "./maintenance.js";
+export type { MaintenanceAction, MaintenanceHostState, MaintenanceOptions, MaintenanceReport } from "./maintenance.js";
+export { DOCTOR_MAX_BYTES, writeDoctorBundle } from "./doctor.js";
+export type { DoctorBundle, DoctorOptions } from "./doctor.js";

package/dist/foundation/resident-tabs/index.js

@@ -0,0 +1,6 @@
+export { ensureTerminalHost, resolveTerminalHostPath } from "./ensure-terminal-host.js";
+export { readResidentTabLaunchSettings } from "./settings.js";
+export { selectResidentHost } from "./routing.js";
+export { readResidentReleaseHolds } from "./release-holds.js";
+export { runTerminalHostMaintenance } from "./maintenance.js";
+export { DOCTOR_MAX_BYTES, writeDoctorBundle } from "./doctor.js";

package/dist/foundation/resident-tabs/maintenance.d.ts

@@ -0,0 +1,42 @@
+export type MaintenanceAction = "list" | "stop" | "stop-all" | "host-status" | "host-stop";
+export type MaintenanceHostState = "none" | "running" | "stopped" | "unresponsive" | "incompatible" | "refused" | "unverifiable" | "unavailable";
+/** The versioned `a1 tabs` report: `a1-tabs-maintenance-v1`, as printed by the terminal host. */
+export interface MaintenanceReport {
+    readonly schema: "a1-tabs-maintenance-v1";
+    readonly command: string;
+    readonly host: MaintenanceHostState;
+    readonly stateDir?: string;
+    readonly result?: Record<string, unknown>;
+    readonly pid?: number;
+    readonly message?: string;
+    readonly releaseRoot?: string | null;
+    readonly terminatedUnresponsive?: number;
+    /** The terminal host's exit status: 0 success, 3 refused or failed, 4 another generation. */
+    readonly exitCode: number;
+}
+export interface MaintenanceOptions {
+    readonly action: MaintenanceAction;
+    readonly tabId?: string;
+    readonly profileRoot: string;
+    readonly dataDir: string;
+    readonly runtimeDir: string;
+    /** Installed release roots whose verified terminal host may run maintenance, in preference order. */
+    readonly releaseRoots: readonly string[];
+    readonly environment: NodeJS.ProcessEnv;
+    readonly platform?: NodeJS.Platform;
+    readonly architecture?: string;
+    readonly timeoutMs?: number;
+    readonly verify?: (executable: string, platform: NodeJS.Platform, architecture: string) => Promise<unknown>;
+    readonly run?: (executable: string, arguments_: readonly string[], timeoutMs: number) => Promise<{
+        readonly code: number;
+        readonly stdout: string;
+    }>;
+}
+/**
+ * Runs one maintenance form through a verified terminal host. When the running host speaks
+ * another protocol generation, it retries once with the binary from the release that host
+ * recorded, after verifying that release's manifest; it never runs an unverified binary.
+ */
+export declare function runTerminalHostMaintenance(options: MaintenanceOptions): Promise<MaintenanceReport>;
+/** The largest maintenance report accepted from the terminal host. */
+export declare const MAX_MAINTENANCE_REPORT_BYTES: number;