@timurproko/a1 0.2.7-dev.794 → 0.2.7-dev.806

package/dist/app/session-shell/clipboard-diagnostics.js

@@ -39,7 +39,7 @@ export class ClipboardDiagnosticCapture {
         // Security: project only declared scalar fields. Never serialize the supplied event object or raw errors.
         this.#records.push({ source, phase: event.phase, atMs: scalar(event.atMs), request: event.request !== undefined && event.request < 0 ? -scalar(-event.request) : scalar(event.request), pending: scalar(event.pending), bytes: scalar(event.bytes), elapsedMs: scalar(event.elapsedMs),
             sourceUnits: scalar(event.sourceUnits), pendingBytes,
-            transport: ["native", "terminal", "provided", "injected"].includes(event.transport ?? "") ? event.transport : "none",
+            transport: ["native", "terminal", "platform", "provided", "injected"].includes(event.transport ?? "") ? event.transport : "none",
             outcome: ["ready", "failed", "canceled", "delivered", "submitted-unverified", "timed-out", "superseded"].includes(event.outcome ?? "") ? event.outcome : "none" });
         if (this.#records.length > 128)
             this.#records.shift();

package/dist/app/session-shell/response-copy-helper.js

@@ -1,5 +1,6 @@
 import { MAX_COPY_ROWS, MAX_COPY_SOURCE_UNITS, selectionCopyRowText } from "../../ui/components/index.js";
 import { COPY_CHUNK_UNITS, MAX_COPY_BYTES, MAX_COPY_CONTROL_BYTES } from "./response-copy-protocol.js";
+const NATIVE_RETRY_DELAYS_MS = [20, 60];
 // Security: this isolated executor never inherits the UI terminal and never logs clipboard contents.
 let header;
 let fragments = [];
@@ -24,6 +25,14 @@ function nextOutput() {
     send({ kind: "data", text });
 }
 function send(message) { process.send?.(message); }
+function transientClipboardError(error) {
+    const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
+    const message = error instanceof Error ? error.message : String(error);
+    return /^(?:EAGAIN|EBUSY)$/iu.test(code) || /(?:busy|locked|contention|temporar|try again)/iu.test(message);
+}
+function delay(milliseconds) {
+    return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
 function finish(result, control) {
     if (finished)
         return;
@@ -97,13 +106,19 @@ async function receive(message) {
             return;
         }
         send({ kind: "phase", phase: "submitting", bytes });
-        try {
-            await native.setText(text);
-            finish({ outcome: "delivered" });
-        }
-        catch {
-            finish({ outcome: "failed", failure: "denied" });
+        for (let attempt = 0; attempt <= NATIVE_RETRY_DELAYS_MS.length; attempt++) {
+            try {
+                await native.setText(text);
+                finish({ outcome: "delivered" });
+                return;
+            }
+            catch (error) {
+                if (!transientClipboardError(error) || attempt === NATIVE_RETRY_DELAYS_MS.length)
+                    break;
+                await delay(NATIVE_RETRY_DELAYS_MS[attempt]);
+            }
         }
+        finish({ outcome: "failed", failure: "denied" });
         return;
     }
     else

package/dist/app/session-shell/response-copy-protocol.d.ts

@@ -19,7 +19,7 @@ export interface ResponseCopyEvent {
     readonly pending: number;
     readonly sourceUnits: number;
     readonly bytes?: number;
-    readonly transport?: "native" | "terminal" | "injected";
+    readonly transport?: "native" | "terminal" | "platform" | "injected";
     readonly outcome?: CopyOutcome;
 }
 /** One request per helper lifetime. Each source fragment is acknowledged before the next is sent. */

package/dist/app/session-shell/response-copy-transport.d.ts

@@ -7,7 +7,7 @@ export interface ResponseCopyJob {
     readonly stopped: Promise<void>;
     cancel(): void;
 }
-export type CopyPhaseObserver = (phase: "extracted" | "encoded" | "submitting", bytes: number, transport: "native" | "terminal" | "injected") => void;
+export type CopyPhaseObserver = (phase: "extracted" | "encoded" | "submitting", bytes: number, transport: "native" | "terminal" | "platform" | "injected") => void;
 export type ResponseCopyExecutor = (snapshot: SelectionCopySnapshot, phase: CopyPhaseObserver) => ResponseCopyJob;
 /** The production executor also holds a spare helper; the owner warms it at start and disposes it at shutdown unless the pool is shared. */
 export interface OwnedResponseCopyExecutor extends ResponseCopyExecutor {
@@ -22,17 +22,14 @@ export interface ResponseCopyTerminal {
 }
 /** Never substitute a remote host's native clipboard for the terminal user's clipboard. */
 export declare function responseCopyDestination(env: NodeJS.ProcessEnv): "native" | "terminal";
-/** Node documents synchronous POSIX TTY and Windows pipe writes; do not put clipboard traffic there. */
-export declare function hasAsyncClipboardOutput(platform?: NodeJS.Platform, stdout?: {
-    readonly isTTY?: boolean | undefined;
-    readonly fd?: number | undefined;
-}): boolean;
 /** Isolates preparation and native clipboard access; only the owner may submit terminal controls. */
 export declare function createResponseCopyExecutor(options?: {
     readonly terminal?: ResponseCopyTerminal;
     readonly destination?: "native" | "terminal";
     /** Explicit host seam: must be non-blocking and honor cancellation, or its unresolved lifetime is quarantined. */
     readonly writeText?: (text: string, signal: AbortSignal) => Promise<void>;
+    /** Platform/fault-test seam; production writes through the supported operating-system command. */
+    readonly platformWriteText?: (text: string, signal: AbortSignal) => Promise<boolean>;
     /** Package/fault-test seam: the production helper is always an emitted sibling. */
     readonly helper?: URL;
     /** Idle bound for the spare helper; production keeps the default. */

package/dist/app/session-shell/response-copy-transport.js

@@ -1,25 +1,58 @@
-import { fork } from "node:child_process";
-import { fstatSync } from "node:fs";
+import { execFile, fork } from "node:child_process";
 import { HelperPool } from "./helper-pool.js";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { COPY_CHUNK_UNITS, COPY_CLEANUP_MS, MAX_COPY_BYTES, MAX_COPY_CONTROL_BYTES } from "./response-copy-protocol.js";
+const PLATFORM_WRITE_TIMEOUT_MS = 1_500;
 /** Never substitute a remote host's native clipboard for the terminal user's clipboard. */
 export function responseCopyDestination(env) {
-    return env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY || env.TMUX || env.STY || env.WSL_DISTRO_NAME
+    return env[PRODUCT_IDENTITY.environment.tabId] || env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY || env.TMUX || env.STY || env.WSL_DISTRO_NAME
         ? "terminal" : "native";
 }
-/** Node documents synchronous POSIX TTY and Windows pipe writes; do not put clipboard traffic there. */
-export function hasAsyncClipboardOutput(platform = process.platform, stdout = process.stdout) {
-    if (stdout.isTTY)
-        return platform === "win32";
-    if (platform === "win32")
-        return false;
-    try {
-        const stat = fstatSync(stdout.fd ?? -1);
-        return stat.isFIFO() || stat.isSocket();
-    }
-    catch {
-        return false;
+function platformClipboardCommands() {
+    if (process.platform === "win32")
+        return [{
+                command: "powershell.exe",
+                args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", "$value=[Console]::In.ReadToEnd(); Set-Clipboard -Value $value"],
+            }];
+    if (process.platform === "darwin")
+        return [{ command: "pbcopy", args: [] }];
+    return [
+        { command: "wl-copy", args: ["--type", "text/plain;charset=utf-8"] },
+        { command: "xclip", args: ["-selection", "clipboard", "-in"] },
+    ];
+}
+async function writePlatformClipboardText(text, signal) {
+    for (const route of platformClipboardCommands()) {
+        if (signal.aborted)
+            return false;
+        const delivered = await new Promise(resolve => {
+            let settled = false;
+            const done = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(value);
+            };
+            const child = execFile(route.command, [...route.args], {
+                signal,
+                windowsHide: true,
+                timeout: PLATFORM_WRITE_TIMEOUT_MS,
+                killSignal: "SIGKILL",
+                maxBuffer: 1_024,
+            }, error => done(error === null));
+            child.once("error", () => done(false));
+            if (child.stdin === null) {
+                child.kill("SIGKILL");
+                done(false);
+                return;
+            }
+            child.stdin.once("error", () => { child.kill("SIGKILL"); done(false); });
+            child.stdin.end(text);
+        });
+        if (delivered)
+            return true;
     }
+    return false;
 }
 /** Isolates preparation and native clipboard access; only the owner may submit terminal controls. */
 export function createResponseCopyExecutor(options = {}) {
@@ -43,8 +76,18 @@ export function createResponseCopyExecutor(options = {}) {
             };
             let outcome = await execute(destination);
             // Concurrency: helper results settle only after exit; fallback cannot race an older native write.
-            if (!controller.signal.aborted && destination === "native" && outcome.result.failure === "unavailable" && options.terminal !== undefined) {
-                outcome = await execute("terminal");
+            if (!controller.signal.aborted && destination === "native" && outcome.result.outcome === "failed") {
+                const prepared = await execute("prepare");
+                if (prepared.result.outcome === "delivered" && prepared.text !== undefined) {
+                    phase("submitting", prepared.bytes ?? 0, "platform");
+                    const delivered = await (options.platformWriteText ?? writePlatformClipboardText)(prepared.text, controller.signal);
+                    outcome = { kind: "result", result: delivered ? { outcome: "delivered" } : { outcome: "failed", failure: "unavailable" } };
+                }
+                else
+                    outcome = { kind: "result", result: { outcome: "failed", failure: "transport" } };
+                if (!controller.signal.aborted && outcome.result.outcome === "failed" && options.terminal !== undefined) {
+                    outcome = await execute("terminal");
+                }
             }
             if (controller.signal.aborted)
                 return { outcome: "canceled" };

package/dist/app/session-shell/session-shell-root.js

@@ -438,6 +438,7 @@ export class OwnedUiSessionShellRoot {
             ? Math.max(0, dock.inputRows - 2)
             : 0;
         const copyableDockRows = [
+            ...dock.copyableMessageRows,
             ...Array.from({ length: promptCopyRows }, (_value, index) => ({
                 row: editorOffset + index + 1,
                 prompt: index === 0 ? "first" : "continuation",
@@ -620,7 +621,10 @@ export class OwnedUiSessionShellRoot {
     #renderDockLayout(width) {
         const queued = this.#customViewport ? [] : this.#renderQueued(width);
         const statusRows = this.#customViewport ? this.#status.renderDock(width) : this.#renderStatus(width);
-        const transientRows = [...queued, ...statusRows, ...this.#renderDockNotice(width)];
+        const noticeRows = this.#renderDockNotice(width);
+        const transientRows = [...queued, ...statusRows, ...noticeRows];
+        const messageStart = queued.length;
+        const copyableMessageRows = Array.from({ length: statusRows.length + noticeRows.length }, (_value, index) => ({ row: messageStart + index }));
         const aboveWidgets = this.#renderWidgets("aboveEditor", width);
         const input = this.#inputSurface.render(width);
         const body = this.usesDefaultInputSurface() ? this.editor.bodyGeometry?.() : undefined;
@@ -634,6 +638,7 @@ export class OwnedUiSessionShellRoot {
             editorOffset: inputOffset + (body?.rowOffset ?? 0),
             inputRows: body?.rowCount ?? input.length,
             footerRows: footer.length,
+            copyableMessageRows,
         };
     }
     #renderCopyAcknowledgement(width) {

package/dist/app/session-shell/session-shell.js

@@ -1,5 +1,5 @@
 import { ResponseCopyCoordinator } from "./response-copy-coordinator.js";
-import { createResponseCopyExecutor, hasAsyncClipboardOutput, responseCopyDestination } from "./response-copy-transport.js";
+import { createResponseCopyExecutor, responseCopyDestination } from "./response-copy-transport.js";
 import { MAX_COPY_CONTROL_BYTES } from "./response-copy-protocol.js";
 import { PromptHistoryController } from "./prompt-history-controller.js";
 import { PRODUCT_TEXT } from "../../product-identity.js";
@@ -129,31 +129,24 @@ export class OwnedUiSessionPresenter {
         // throw releases them in reverse, so a shell that never finished constructing holds nothing.
         const constructed = [() => host.disconnect(this)];
         try {
-            const terminalCopy = terminal !== undefined || hasAsyncClipboardOutput();
             this.#responseCopy = this.#customViewport ? new ResponseCopyCoordinator({
                 execute: responseCopy?.execute ?? (this.#copyExecutor = createResponseCopyExecutor({
                     ...(sharedClipboard === undefined ? {} : { pool: sharedClipboard.copy }),
                     ...(terminal === undefined && clipboard === undefined ? {} : { destination: "terminal" }),
                     ...(clipboard?.writeText === undefined ? {} : { writeText: (text, signal) => clipboard.writeText(text, signal) }),
-                    ...(terminalCopy ? { terminal: { submit: async (control, signal) => {
-                                if (signal.aborted || this.#disposed || !this.#terminal.running)
-                                    throw new Error("Copy canceled");
-                                // Performance: never grow the real terminal's pending buffer with another clipboard payload.
-                                if (terminal === undefined && process.stdout.writableLength + control.length > MAX_COPY_CONTROL_BYTES) {
-                                    throw new Error("Clipboard terminal is busy");
-                                }
-                                this.#terminal.writeControl(control);
-                            } } } : {}),
+                    // Invariant: the owned host is the route contract. Resident and pseudoterminal children must not infer
+                    // clipboard reachability from Node's view of stdout, and inactive presenters are fenced here.
+                    terminal: { submit: async (control, signal) => {
+                            if (signal.aborted || this.#disposed || !this.#terminal.running || !this.#terminal.attached)
+                                throw new Error("Copy canceled");
+                            // Performance: never grow the real terminal's pending buffer with another clipboard payload.
+                            if (terminal === undefined && process.stdout.writableLength + control.length > MAX_COPY_CONTROL_BYTES) {
+                                throw new Error("Clipboard terminal is busy");
+                            }
+                            this.#terminal.writeControl(control);
+                        } },
                 })),
                 ...(responseCopy?.onEvent === undefined ? {} : { onEvent: responseCopy.onEvent }),
-                onFailure: result => {
-                    if (this.#disposed || !this.#terminal.running)
-                        return;
-                    this.root.appendWorkflowStatus(result.outcome === "timed-out" ? "Copy timed out; the clipboard did not respond."
-                        : result.failure === "size" ? "Selection exceeds this clipboard route's size limit."
-                            : "Could not copy the selection; the clipboard is unavailable.");
-                    this.#terminal.requestRender();
-                },
             }) : null;
             constructed.push(() => { this.#responseCopy?.dispose(); this.#copyExecutor?.dispose(); });
             const readClipboard = async (signal) => {

package/dist/native/darwin-arm64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:41:09.288Z",
+  "builtAt": "2026-10-19T04:50:42.711Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "a87eaaffcd986b624c8b044b756446cc1bdaf4334a1775b97820542fe34f9fb7",

package/dist/native/darwin-arm64/terminal-host.manifest.json

@@ -9,7 +9,7 @@
   "architecture": "arm64",
   "target": "aarch64-apple-darwin",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:43:27.368Z",
+  "builtAt": "2026-10-19T04:52:31.538Z",
   "artifact": {
     "filename": "terminal-host.node",
     "sha256": "af7b9fee2efa8478c728465031e73fb316b6b7012d11de0364130b0acd1b6e62",

package/dist/native/darwin-x64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "darwin",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:41:16.359Z",
+  "builtAt": "2026-10-19T04:50:48.870Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "783a65f0de287a1c02cd5429dbe97bc8633f4cc8a7b92e3e961180b9bdcff814",

package/dist/native/darwin-x64/terminal-host.manifest.json

@@ -9,7 +9,7 @@
   "architecture": "x64",
   "target": "x86_64-apple-darwin",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:45:43.907Z",
+  "builtAt": "2026-10-19T04:54:11.822Z",
   "artifact": {
     "filename": "terminal-host.node",
     "sha256": "1a5465ea12ecfe76d5f0c8fd5c11dee99597b4206a7e9ece01b37fc5c477c211",

package/dist/native/linux-x64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:40:48.343Z",
+  "builtAt": "2026-10-19T04:50:20.956Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "118e5954e3864672bd8482ab7edf419cb27dcdf2533720316979b7f5cc5a53a5",

package/dist/native/linux-x64/terminal-host.manifest.json

@@ -9,7 +9,7 @@
   "architecture": "x64",
   "target": "x86_64-unknown-linux-gnu",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:43:45.076Z",
+  "builtAt": "2026-10-19T04:53:24.471Z",
   "artifact": {
     "filename": "terminal-host.node",
     "sha256": "843b10ab29eddf859a74a97875ba646a90917d9ec78445474895bb64f6e0772a",

package/dist/native/win32-x64/manifest.json

@@ -7,10 +7,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:41:31.607Z",
+  "builtAt": "2026-10-19T04:51:53.049Z",
   "artifact": {
     "filename": "process-guardian.node",
-    "sha256": "6299956800f1ab62f2e5bb4a1e4d61dbd45ce70a7711cbb9aca8f23033bdbbaf",
+    "sha256": "19eb07160f90033855f43c38008aaf90665e40bc68a87fac0c44585b362977cd",
     "size": 402432
   },
   "provenance": {

package/dist/native/win32-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-pc-windows-msvc",
   "capability": "supported",
-  "builtAt": "2026-10-18T08:44:54.428Z",
+  "builtAt": "2026-10-19T04:54:01.087Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "de82227898a90a6ec6bda0c8b503148388d3769ef4ab7f1176e56c8472b76232",
-    "size": 5617664
+    "sha256": "2e11d6f772aac6780a0d4d55a6a79169483b14b2b1e055f0f694702d38cab825",
+    "size": 5617152
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/docs/architecture/terminal-host-provenance.md

@@ -76,6 +76,6 @@ Unverified, mismatched, or unsigned/unattested artifacts are not eligible for co
 
 ## Release artifact
 
-`npm run build:terminal-host` (`scripts/development/build-terminal-host.mjs`) runs only on release and native validation runners. It builds the library once with `cargo build --release --locked --lib --features node-addon`, copies the cdylib as `terminal-host.node`, loads the addon in Node, and checks its `version()` report: protocol, generation, crate version, pinned `libghostty-vt` commit, and the absence of `fault-injection` and `resident-fixtures`. The macOS x64 cross build may use the recorded Mach-O architecture check when the arm64 runner cannot load the addon.
+`npm run build:terminal-host` (`scripts/development/build-terminal-host.mjs`) builds the library once with `cargo build --release --locked --lib --features node-addon`, copies the cdylib as `terminal-host.node`, loads the addon in Node, and checks its `version()` report: protocol, generation, crate version, pinned `libghostty-vt` commit, and the absence of `fault-injection` and `resident-fixtures`. Release and native validation runners invoke it with their pinned Zig toolchain. The normal developer `npm run build` invokes the same release-profile builder for the current platform; on Windows it links a manifest-verified terminal library exported by trusted CI and records the repository-pinned Zig producer version without invoking Zig on the workstation. The macOS x64 cross build may use the recorded Mach-O architecture check when the arm64 runner cannot load the addon.
 
 The generated `terminal-host.manifest.json` uses schema `a1-terminal-host-artifact-v2` and records `kind: "node-addon"`, Node-API 9, the addon's SHA-256 and size, the release-relative role-entry digest, the notices digest, target triple, Rust and Zig versions, and `Cargo.lock` digest. The role entry passes only the fixed role grammar and records `{ executable: process.execPath, entry, artifact: addonPath }` once in the addon; the explicit loaded artifact identity makes release-hold reporting independent of development environment propagation. Detached and WMI resident starts use the recorded Node-and-entry command and never resolve an A1-built executable. The publication `package` job refuses to pack unless every platform's process-guardian and terminal-host addons match their manifests, and A1 verifies the addon, entry, and notices before loading the host.

package/docs/architecture/toolchain.md

@@ -38,7 +38,9 @@ It contains no executable built from A1 sources, separate session-lock addon, br
 
 Source builds require Rust/Cargo 1.85 or newer; `rust-toolchain.toml` pins the exact version CI and publication install through `scripts/development/prepare-ci-rust.sh`, and rustup selects that version for Cargo commands inside the repository, installing it on first use. The Zig cache (`mlugg/setup-zig`, one entry per workflow and platform per run, bounded to 512 MiB) stays enabled: measured on 2026-10-16, a cold Zig build of `libghostty-vt` added about 40 to 60 seconds to a terminal-host test build (Linux 2m21s cold against 1m20s warm, Windows 2m05s against 1m26s), which the cache saves on every warm run.
 
-`npm run build` compiles `native/process-guardian` as the host platform's Node-API 9 addon, places `process-guardian.node` under `dist/native/<platform>-<architecture>/`, loads it to observe its version identity, and writes the v2 integrity manifest. Preview and stable candidate workflows build the addon on isolated Windows, Linux, and macOS arm64 runners, cross-compile the macOS x64 addon on the arm64 runner with `--target x86_64-apple-darwin`, and assemble all targets before packing. The same release runners compile TypeScript and run `npm run build:terminal-host`, which builds one Node-API 9 `terminal-host.node` containing the fixed roles and the session-writer lock. Its v2 manifest binds the addon, `dist/foundation/resident-tabs/host-entry.js`, and notices. The local `npm run build` does not build that addon because the Zig fetch for `libghostty-vt` is quarantined by workstation antivirus on Windows; local native iteration uses a verified terminal library downloaded from a CI lane (see [`terminal-host-provenance.md`](terminal-host-provenance.md) and [`resident-tabs.md`](resident-tabs.md)). Cross-compiled artifacts record a Mach-O architecture check when they cannot be loaded on the producing runner. Supported native code is always loaded by Node; an absent, incompatible, or unsupported addon fails before runtime startup rather than falling back to PID-only cleanup. The process-guardian addon inherits terminal handles but transports no terminal bytes. Its separate Node-hosted exit watcher restores terminal state after guardian failure, subject to the documented node-wide-kill gap. See [`process-guardian-provenance.md`](process-guardian-provenance.md).
+`npm run build` compiles `native/process-guardian` as the host platform's Node-API 9 addon, places `process-guardian.node` under `dist/native/<platform>-<architecture>/`, loads it to observe its version identity, and writes the v2 integrity manifest. It also builds the current platform's release-profile `terminal-host.node`, whose v2 manifest binds the addon, `dist/foundation/resident-tabs/host-entry.js`, and notices, so the ordinary `npm run build && ./scripts/dev` handoff exercises resident tabs without deployment. On Windows the normal build reuses a compatible ignored terminal-library cache or downloads the newest compatible library from the current branch or a successful CI run belonging to a pull request already merged into `develop`, then links it under the crate's manifest verification; it never silently invokes the quarantined Zig package fetch. An unavailable or mismatched prerequisite fails the build instead of leaving a nominally successful single-agent-only tree. The npm `prepare` lifecycle and validation preflight use the explicit core build because selected native lanes assemble and certify terminal hosts separately.
+
+Preview and stable candidate workflows build the addons on isolated Windows, Linux, and macOS arm64 runners, cross-compile the macOS x64 addons on the arm64 runner with `--target x86_64-apple-darwin`, and assemble all targets before packing. Those release runners retain their explicit `npm run build:terminal-host` step and pinned Zig input rather than consuming a workstation cache. Cross-compiled artifacts record a Mach-O architecture check when they cannot be loaded on the producing runner. Supported native code is always loaded by Node; an absent, incompatible, or unsupported addon fails before runtime startup rather than falling back to PID-only cleanup. The process-guardian addon inherits terminal handles but transports no terminal bytes. Its separate Node-hosted exit watcher restores terminal state after guardian failure, subject to the documented node-wide-kill gap. See [`process-guardian-provenance.md`](process-guardian-provenance.md), [`terminal-host-provenance.md`](terminal-host-provenance.md), and [`resident-tabs.md`](resident-tabs.md).
 
 ## Gates
 

package/docs/ci-release-runbook.md

@@ -193,7 +193,7 @@ validation; malformed, mixed, renamed, stale, or unavailable inputs fail closed.
 A legitimate generated baseline update remains outside the allowlist and follows the
 manually accepted mixed/code path.
 
-A new implementation-bound specification starts as OpenSpec-only artifacts in one normally named draft PR. Explicit approval to implement continues in that same worktree, branch, history, and PR; the plan does not merge first. Approved refinements reconcile planning before code. After implementation, add one to ten plain implementation-specific bullets under `## Acceptance` and mark the PR ready; the trusted `OpenSpec finalization` workflow conservatively synchronizes deltas, stages the dated archive plus conditional acceptance manifest, and commits them to the same branch, and exact-head CI validates that head. Auto-merge remains disabled: an authorized maintainer's manual merge accepts the listed scenarios and atomically integrates implementation, specs, and archive. No acceptance or archive follow-up PR is created. Closing an unmerged draft integrates nothing; cleanup still needs separate approval. See [delivery and archive handoff](openspec-archive-automation.md) for commands and legacy compatibility.
+A new implementation-bound specification starts as OpenSpec-only artifacts in one normally named draft PR. Explicit approval to implement continues in that same worktree, branch, history, and PR; the plan does not merge first. Approved refinements reconcile planning before code. After implementation, add one to ten plain implementation-specific bullets under `## Acceptance` and mark the PR ready; the trusted `OpenSpec finalization` workflow conservatively synchronizes deltas, stages the dated archive plus conditional acceptance manifest, and commits them to the same branch, and exact-head CI validates that head. Automation-owned auto-merge remains disabled: an authorized maintainer's direct merge, personal exact-head auto-merge arm, or explicit request for the active agent to expected-head squash-merge the currently eligible candidate accepts the listed scenarios and atomically integrates implementation, specs, and archive. No acceptance or archive follow-up PR is created. Closing an unmerged draft integrates nothing; cleanup still needs separate approval. See [delivery and archive handoff](openspec-archive-automation.md) for commands and legacy compatibility.
 
 ## Numbered development previews
 

package/docs/openspec-archive-automation.md

@@ -1,6 +1,6 @@
 # Atomic OpenSpec delivery and legacy archival
 
-New OpenSpec deliveries use one ordinary development pull request from draft planning through implementation, validation, acceptance, specification synchronization, and archival. An authorized maintainer chooses integration by manually merging the exact validated head or personally enabling GitHub native auto-merge for that unchanged head. Agents, Apps, bots, merge queue, and repository automation never arm or invoke implementation integration and never create a version-3 acceptance or archive follow-up PR.
+New OpenSpec deliveries use one ordinary development pull request from draft planning through implementation, validation, acceptance, specification synchronization, and archival. An authorized maintainer chooses integration by manually merging the exact validated head, personally enabling GitHub native auto-merge for that unchanged head, or explicitly asking the active agent to merge the identified currently eligible head. Agents never infer or independently choose integration; Apps, bots, merge queue, workflows, and repository automation receive no implementation authority, and no version-3 acceptance or archive follow-up PR is created.
 
 Unrelated standalone documentation remains separate: a non-draft unassociated PR changing only `openspec/**`, `docs/**`, and/or root `README.md` retains the existing CI-gated automatic route. A new active change, implementation association, malformed lifecycle data, or mixed path remains outside documentation-owned integration. Before finalization or without valid human provenance, any arm is disabled; a finalized version-3 human arm remains a separate maintainer-owned route.
 
@@ -14,9 +14,23 @@ Version-1 and version-2 deliveries and their existing comments, acceptance PRs,
 4. **Plain acceptance list:** before checking the final item, keep the body phase-free and add final `## Acceptance` with one to ten concise implementation-specific behavior-and-result bullets. Do not use checkboxes, generic review/CI/approval/archive statements, angle-bracket placeholders or HTML, URLs, mentions, or automated-test inventory.
 5. **Automatic readiness and finalization:** reconcile and push current `origin/develop`, run the [delivery body check](#delivery-body-check) on the intended final body, then check the final item. That checkbox update completes the agent-owned implementation job; agents never mark implementation PRs ready themselves. Trusted automation revalidates the exact fully complete version-3 task-list snapshot and all pre-finalization inputs, marks the PR ready, and then conservatively synchronizes all deltas, moves the active change into its dated archive, stages the conditional acceptance manifest, commits that to the same branch with the archive App identity, and writes the emitted paths into the body's implementation fence. It never checks tasks or infers completion. Running the [finalization command](#finalization-command) locally first is optional and yields the same bytes.
 6. **Validate:** one normal exact-head workflow validates the finalized head: implementation, synchronized specs, archive, manifest, tasks/evidence, exact PR-body list, and every selected product/governance scope before emitting the stable protected aggregate. A new commit or acceptance-list change re-finalizes automatically when needed and requires full renewed validation; no lifecycle body edit or second workflow run is required.
-7. **Maintainer integration accepts:** after reviewing the finalized candidate, an authorized human either manually merges the exact validated head after the stable protected aggregate succeeds or personally enables GitHub native auto-merge for that unchanged head so protected integration waits for the aggregate. That human action means the listed scenarios are accepted. Agents, Apps, bots, merge queue, automation-owned implementation arms, and documentation integration remain forbidden. A changed head, acceptance list, or finalization invalidates the earlier arm and requires the maintainer to choose again.
+7. **Maintainer integration accepts:** after reviewing the finalized candidate, an authorized human manually merges the exact validated head, personally enables GitHub native auto-merge for that unchanged head, or explicitly asks the active agent to merge that identified head while it is currently eligible. The agent route re-reads authoritative state, requires the exact finalized head and acceptance list, current `develop`, successful `Development validation required`, positive mergeability, and the maintainer's authenticated human `User`, then issues one protected squash merge with expected-head enforcement. It never waits, arms auto-merge, retries later, uses automation credentials or merge queue, or bypasses protection. Each route means the listed scenarios are accepted. A candidate change invalidates the decision and requires the maintainer to choose again.
 8. **Verify and clean:** trusted post-merge policy derives `Archived` and reports `accepted-and-archived` from committed bytes and immutable GitHub provenance without editing the accepted PR body. It publishes no lifecycle branch or PR. Shared exact-head remote cleanup may delete the unchanged topic ref; local cleanup remains separately ownership-controlled: the agent parks the worktree with `handoff` at step 7, and the next session's `sweep` removes it once the merge, archive, and remote-ref evidence verify (see [local cleanup](local-worktree-cleanup.md)).
 
+### Maintainer-requested agent merge
+
+The permission is one-shot and candidate-bound. A same-session instruction such as “merge it” is sufficient only when the conversation identifies one handed-off PR and head unambiguously; implementation approval, green CI, an earlier request, or a standing preference is not merge authority. If the PR is not currently eligible, report the blocker and stop. Do not poll, watch, arm native auto-merge, or retain the instruction for later.
+
+Immediately before mutation, refresh the PR and authenticated principal. Require an open non-draft same-repository PR into `develop`, the requested exact finalized head and acceptance list, `MERGEABLE`/`CLEAN` state, successful `Development validation required` for that head, and a human `User` with write, maintain, or admin repository permission. Then use the ordinary protected route with no `--admin` or `--auto`:
+
+```bash
+gh pr merge <pr> --repo <owner>/<repository> --squash --match-head-commit <exact-head-sha>
+```
+
+GitHub branch protection remains authoritative. A refusal, changed head, advanced target, stale finalization, failed or pending check, ambiguous identity, or unavailable read ends the attempt and needs a fresh maintainer request. After success, use the ordinary read-only accepted/archive verification and cleanup path.
+
+The policy PR introducing this route must integrate through the previously deployed maintainer-owned route. Only a later candidate may use a requested agent merge after this policy is present on `develop`.
+
 ### Complete-regression evidence ordering
 
 PR-attached Full regression is selected only for a repair that the trusted triage created from a failed Full regression: base policy verifies the immutable `openspec-ci` App author, generated candidate identity, and `regression-provenance.json`. Human-authored lookalikes, publishing or validation-authority changes, labels, Publish-only repairs, and successful-run persistent-overrun candidates retain bounded ordinary validation. Generated repair drafts run no Development test suites, including after implementation begins. Finish substantive implementation tasks, focused local evidence, pre-finalization observations, and known-gap disposition before checking the final Implementation item. The ready active head defers testing while trusted finalization publishes the candidate; the finalized head then receives all four native lanes as new full evidence, required by `Development validation required` alongside the existing gates.
@@ -153,7 +167,7 @@ node scripts/governance/check-delivery-body.mjs --body-file .artifacts/agent/pr-
 
 `--final` validates the body as if every Implementation item were checked, so it can run before the last marker changes. `--pr <n>` reads the current pull request body instead. A defect exits 1 and prints the same `draft-<code>` reason the finalization run would report. The check covers association, Implementation, layout, and Acceptance only; detailed tasks, evidence, and target state remain covered by the [finalization command](#finalization-command) inspection mode.
 
-The committed conditional manifest contains the same ordered text. Trusted policy validates membership but never checks or edits it and never claims that the scenarios passed. The authorized maintainer's manual merge or personal native auto-merge arm for the unchanged exact head is the acceptance decision; no acceptance comment, checkbox edit, review-approval requirement, JSON edit, acceptance PR, archive PR, or later command is needed.
+The committed conditional manifest contains the same ordered text. Trusted policy validates membership but never checks or edits it and never claims that the scenarios passed. The authorized maintainer's direct merge, personal native auto-merge arm, or explicit request for the active agent to merge the unchanged currently eligible exact head is the acceptance decision; no acceptance comment, checkbox edit, review-approval requirement, JSON edit, acceptance PR, archive PR, or later command is needed.
 
 If the body list changes, candidate validation reruns and compares it with the committed manifest. If the head changes, all prior exact-head CI is stale. If only the body changes to disagree with the manifest, integration remains blocked until the list and committed candidate agree again. No lifecycle body edit is needed after green CI.
 
@@ -214,7 +228,7 @@ Before a first finalization, canonical specs must still equal the selected targe
 
 ## Conditional acceptance and derived receipt
 
-`acceptance.md` truthfully says its verdict activates only when an authorized human manually merges the containing exact head after required current-head checks or personally arms native auto-merge for that unchanged head and GitHub integrates it after those checks. Its `openspec-delivery` block records stable pre-merge facts:
+`acceptance.md` truthfully says its verdict activates only when an authorized human directly merges the containing exact head after required current-head checks, explicitly asks the active agent to execute that protected exact-head merge while it is eligible, or personally arms native auto-merge for the unchanged head and GitHub integrates it after those checks. Its `openspec-delivery` block records stable pre-merge facts:
 
 - schema version, repository, change, and source PR;
 - archive and manifest paths and finalization date;
@@ -223,7 +237,7 @@ Before a first finalization, canonical specs must still equal the selected targe
 - archive, canonical-spec, task, and evidence digests; and
 - explicit known-gap dispositions.
 
-It does not predict source head, merge commit, merger, or merge time. The PR head contains the manifest, so required CI binds those bytes without a recursive self-hash. After merge, the shared reader combines the manifest with immutable GitHub source head, successful required run, authorized human actor and permission, integration route, merge commit/time, and `develop` ancestry. Direct manual integration requires no active automatic authority. Human-enabled native auto-merge additionally requires a matching final-head enable event and `auto_merge.enabled_by`, with no later candidate commit or disable event. Queue, App/Bot, automation-owned, stale, malformed, or differently authored authority remains invalid. A human enable followed by disable before a valid manual merge is an abandoned attempt, not contradictory provenance. That shared result is the durable version-3 receipt used by audit and cleanup.
+It does not predict source head, merge commit, merger, or merge time. The PR head contains the manifest, so required CI binds those bytes without a recursive self-hash. After merge, the shared reader combines the manifest with immutable GitHub source head, successful required run, authorized human actor and permission, integration route, merge commit/time, and `develop` ancestry. Direct integration, including an explicitly requested agent invocation through the maintainer's credential, requires no active automatic authority and retains the same authenticated-human merge provenance. Human-enabled native auto-merge additionally requires a matching final-head enable event and `auto_merge.enabled_by`, with no later candidate commit or disable event. Queue, App/Bot, automation-owned, stale, malformed, or differently authored authority remains invalid. A human enable followed by disable before a valid direct merge is an abandoned attempt, not contradictory provenance. That shared result is the durable version-3 receipt used by audit and cleanup.
 
 Unavailable, stale, automatic, unauthorized, conflicting, or contradictory provenance produces `invalid-provenance`/`blocked`, not acceptance. Post-merge code does not repair it by pushing `develop` or publishing another PR.
 
@@ -277,7 +291,7 @@ This bootstrap policy itself finishes under deployed version-2 authority. The fi
 - draft planning remaining unmerged;
 - explicit plan approval and same-PR implementation;
 - automated current-target finalization and exact-head CI;
-- authorized human integration, including manual merge and personally enabled exact-head native auto-merge, with plain acceptance scenarios;
+- authorized human integration, including direct merge, an explicit exact-head agent-merge request, and personally enabled exact-head native auto-merge, with plain acceptance scenarios;
 - integrated canonical specs/archive and no generated acceptance/archive PR;
 - read-only `accepted-and-archived` verification and exact-head branch cleanup;
 - stale head/body/base/arm, incomplete tasks/evidence, malformed manifest, and automated or unauthorized auto-merge refusal fixtures; and

package/docs/validation.md

@@ -126,7 +126,7 @@ Download these artifacts from the exact workflow run:
 
 For selected implementation candidates, record focused and pre-finalization full observations before finalization. Keep final head/run/selection identity in Actions and handoff rather than adding a post-success commit that invalidates that evidence. A successful selected PR run replaces an additional mandatory dispatch; standalone runs remain diagnostic, and numbered-package nightly recovery remains independent.
 
-Draft pull requests run no Development test suites. A ready version-3 PR whose body still identifies an active change defers testing and emits no protected aggregate while `OpenSpec finalization` publishes the candidate. A ready unassociated PR also fails closed when immutable base/head evidence shows that it introduces or restores active delivery content, or combines active-change edits with code or operational paths; it does not fall through to ordinary validation merely because its body fence is absent. Existing active-change documentation-only revisions and ordinary code PRs without active delivery paths retain their established routes. After finalization records the archive and acceptance manifest, the ordinary exact-head workflow runs selected product/governance lanes and `Finalized delivery validation` in parallel, then emits the stable protected `Development validation required` aggregate only when both authorities succeed. Green CI enables maintainer review and manual merge but does not claim human acceptance or merge automatically. The finalization fence update is the validation trigger, so no pre-finalization test run or later lifecycle body edit is required. Any subsequent eligible implementation commit changes the head and reruns applicable validation; any body change reruns readiness and finalized-record validation and must continue to match the committed manifest. Legacy acceptance-record-only PRs retain their separate trusted `Acceptance record validation` route. Queue availability remains explicitly unavailable inside a runner and is calculated from the Actions API during final run analysis rather than guessed.
+Draft pull requests run no Development test suites. A ready version-3 PR whose body still identifies an active change defers testing and emits no protected aggregate while `OpenSpec finalization` publishes the candidate. A ready unassociated PR also fails closed when immutable base/head evidence shows that it introduces or restores active delivery content, or combines active-change edits with code or operational paths; it does not fall through to ordinary validation merely because its body fence is absent. Existing active-change documentation-only revisions and ordinary code PRs without active delivery paths retain their established routes. After finalization records the archive and acceptance manifest, the ordinary exact-head workflow runs selected product/governance lanes and `Finalized delivery validation` in parallel, then emits the stable protected `Development validation required` aggregate only when both authorities succeed. Green CI enables maintainer review and an explicit integration decision but does not claim human acceptance or merge automatically. After green exact-head validation, the maintainer may directly merge, personally arm native auto-merge, or explicitly ask the active agent to perform one expected-head protected squash merge for that currently eligible candidate. The finalization fence update is the validation trigger, so no pre-finalization test run or later lifecycle body edit is required. Any subsequent eligible implementation commit changes the head and reruns applicable validation; any body change reruns readiness and finalized-record validation and must continue to match the committed manifest. Legacy acceptance-record-only PRs retain their separate trusted `Acceptance record validation` route. Queue availability remains explicitly unavailable inside a runner and is calculated from the Actions API during final run analysis rather than guessed.
 
 ## Rollback
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.2.7-dev.794",
+  "version": "0.2.7-dev.806",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",
@@ -23,7 +23,9 @@
   },
   "scripts": {
     "clean": "node scripts/clean.mjs",
-    "build": "node scripts/development/check-environment.mjs && npm run clean && tsc -p tsconfig.build.json && node scripts/release/generate-release-notes-resource.mjs && node scripts/pi/build-pi-settings-metadata.mjs && node scripts/pi/build-startup-public.mjs && node scripts/development/build-process-guardian.mjs && node scripts/release/generate-runtime-payload-inventory.mjs",
+    "build": "node scripts/development/check-environment.mjs && npm run build:managed && node scripts/development/prepare-local-terminal-host.mjs && node scripts/release/generate-runtime-payload-inventory.mjs",
+    "build:core": "node scripts/development/check-environment.mjs && npm run build:managed && node scripts/release/generate-runtime-payload-inventory.mjs",
+    "build:managed": "npm run clean && tsc -p tsconfig.build.json && node scripts/release/generate-release-notes-resource.mjs && node scripts/pi/build-pi-settings-metadata.mjs && node scripts/pi/build-startup-public.mjs && node scripts/development/build-process-guardian.mjs",
     "build:process-guardian": "node scripts/development/build-process-guardian.mjs",
     "build:terminal-host": "node scripts/development/build-terminal-host.mjs",
     "typecheck": "tsgo -p tsconfig.json --noEmit && tsgo -p tsconfig.bin.json",
@@ -65,7 +67,7 @@
     "start:pi": "npm run build && node scripts/development/dev-launch.mjs pi",
     "prepack": "node scripts/release/validate-packaged-release-note.mjs && node scripts/release/prepack-gate.mjs",
     "prepublishOnly": "npm run test:release",
-    "prepare": "npm run build",
+    "prepare": "npm run build:core",
     "typecheck:bin": "tsgo -p tsconfig.bin.json"
   },
   "dependencies": {