@with-logic/elwood 0.1.0

package/dist/runtime/session-status-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-status-wiring.d.ts","sourceRoot":"","sources":["../../src/runtime/session-status-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,KAAK,WAAW,GAAG;IAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE9F,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAC/C,gBAAgB,GAAG;IACjB,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5D,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,GAAG,WAAW,CAAC;CACnF,CAAC;AAEJ,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,CAyBvF;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,eAAe,EACtB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,mBAAmB,GAC1B,IAAI,CAGN"}

package/dist/runtime/session-status-wiring.js

@@ -0,0 +1,41 @@
+/**
+ * Connects lifecycle status transitions to the control queue, loops, event
+ * delivery, and cleanup (PRD §5.3/§5.9, C-API-42). Status and activity events are
+ * emitted here; a throwing status listener PROPAGATES by design — the
+ * `initial_ready` transition relies on it to trigger its release-and-warn fallback.
+ * The engine commits its live `current` status BEFORE emitting, so a throw here can
+ * never leave the emitted event disagreeing with that live status (§8.2).
+ */
+import { activityFromStatus, } from "../core/activity.js";
+import { SessionStatusEngine } from "./status-evidence.js";
+export function createSessionStatusEngine(input) {
+    // Both a turn in progress and a blocking dialog suspend delivery the same way:
+    // the queue stops draining and due loops wait (§5.9: "a due loop waits while the
+    // session is running, blocked, or otherwise unable to accept a message"). Neither
+    // implies a NEW turn — that is `turnStarted`, driven by the queue's own submission.
+    const suspend = () => {
+        input.loops.running();
+        input.queue.suspendReadiness();
+    };
+    return new SessionStatusEngine({
+        onReady: input.markReady,
+        emitStatus: (status) => emitStatusEvents(input.emitter, input.agent, input.elwoodSessionId, status),
+        queueRunning: suspend,
+        queueReady: () => {
+            input.loops.ready();
+            input.queue.markReady();
+        },
+        queueBlocked: suspend,
+        queueClose: () => {
+            input.loops.pause();
+            input.queue.close();
+        },
+        cleanup: input.cleanup,
+    });
+}
+/** Deliver the status event and its derived activity event (a listener throw propagates). */
+export function emitStatusEvents(emitter, agent, id, status) {
+    emitter.emit("status", { elwoodSessionId: id, status });
+    emitter.emit("activity", activityFromStatus(agent, id, status));
+}
+//# sourceMappingURL=session-status-wiring.js.map

package/dist/runtime/session-status-wiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-status-wiring.js","sourceRoot":"","sources":["../../src/runtime/session-status-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,kBAAkB,GAGnB,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAsB3D,MAAM,UAAU,yBAAyB,CAAC,KAAwB;IAChE,+EAA+E;IAC/E,iFAAiF;IACjF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC,CAAC;IACF,OAAO,IAAI,mBAAmB,CAAC;QAC7B,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CACrB,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC7E,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,GAAG,EAAE;YACf,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QACD,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,GAAG,EAAE;YACf,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAC9B,OAA6B,EAC7B,KAAsB,EACtB,EAAU,EACV,MAA2B;IAE3B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/runtime/session-status.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Shared lifecycle status helpers for in-memory sessions.
+ * Implements PRD §5 lifecycle guarantees.
+ */
+import type { ElwoodSessionStatus } from "../core/types.ts";
+export declare function canTransition(current: ElwoodSessionStatus, next: ElwoodSessionStatus): boolean;
+//# sourceMappingURL=session-status.d.ts.map

package/dist/runtime/session-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-status.d.ts","sourceRoot":"","sources":["../../src/runtime/session-status.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAW9F"}

package/dist/runtime/session-status.js

@@ -0,0 +1,22 @@
+/**
+ * Shared lifecycle status helpers for in-memory sessions.
+ * Implements PRD §5 lifecycle guarantees.
+ */
+import { terminalStatuses } from "../core/status-categories.js";
+export function canTransition(current, next) {
+    if (current === next)
+        return false;
+    if (current === "torn_down")
+        return false;
+    // `teardown` is the final cleanup and may supersede any earlier terminal
+    // status (e.g. tearing down an already-exited session).
+    if (next === "torn_down")
+        return true;
+    // Otherwise a terminated session keeps its first terminal status: no
+    // terminal status transitions to another, so a racing `exited` cannot
+    // override a controlled `stopped`/`killed`.
+    if (terminalStatuses.has(current))
+        return false;
+    return true;
+}
+//# sourceMappingURL=session-status.js.map

package/dist/runtime/session-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-status.js","sourceRoot":"","sources":["../../src/runtime/session-status.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAGhE,MAAM,UAAU,aAAa,CAAC,OAA4B,EAAE,IAAyB;IACnF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC1C,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,qEAAqE;IACrE,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/shell.d.ts

@@ -0,0 +1,21 @@
+/**
+ * User shell helpers shared by preflight and PTY launch.
+ * Implements PRD §4.2.
+ */
+export declare function userShell(): string;
+/**
+ * Quote one argument for the POSIX login shells used by both adapters: wrap in
+ * single quotes, escaping embedded single quotes as '\''.
+ */
+export declare function shellQuote(value: string): string;
+/** Interactive login shell for the agent PTY — matches Terminal.app (§4.2). */
+export declare function loginShellCommand(command: string): readonly string[];
+/**
+ * Interactive login shell for the non-PTY probes (`--version`, `update`, `--help`).
+ * Deliberately IDENTICAL to `loginShellCommand` today (C-PTY-08): the probes and the
+ * agent PTY must resolve the same CLI installation, so a probe must load the same
+ * user PATH the PTY launch does. Kept as its own name so the CLI's resolution path
+ * reads as a probe and any future divergence is a visible, single-site decision.
+ */
+export declare function probeShellCommand(command: string): readonly string[];
+//# sourceMappingURL=shell.d.ts.map

package/dist/runtime/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/runtime/shell.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEpE"}

package/dist/runtime/shell.js

@@ -0,0 +1,30 @@
+/**
+ * User shell helpers shared by preflight and PTY launch.
+ * Implements PRD §4.2.
+ */
+import { userInfo } from "node:os";
+export function userShell() {
+    return userInfo().shell || "/bin/zsh";
+}
+/**
+ * Quote one argument for the POSIX login shells used by both adapters: wrap in
+ * single quotes, escaping embedded single quotes as '\''.
+ */
+export function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** Interactive login shell for the agent PTY — matches Terminal.app (§4.2). */
+export function loginShellCommand(command) {
+    return ["-l", "-i", "-c", command];
+}
+/**
+ * Interactive login shell for the non-PTY probes (`--version`, `update`, `--help`).
+ * Deliberately IDENTICAL to `loginShellCommand` today (C-PTY-08): the probes and the
+ * agent PTY must resolve the same CLI installation, so a probe must load the same
+ * user PATH the PTY launch does. Kept as its own name so the CLI's resolution path
+ * reads as a probe and any future divergence is a visible, single-site decision.
+ */
+export function probeShellCommand(command) {
+    return loginShellCommand(command);
+}
+//# sourceMappingURL=shell.js.map

package/dist/runtime/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/runtime/shell.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/runtime/shutdown/cleanup-latch.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Coalesces runtime-cleanup attempts while keeping a FAILED cleanup retryable.
+ * PRD §9.4 requires that a settled cleanup failure is not permanently sticky — a
+ * later explicit stop/kill/teardown must run a fresh attempt. A plain `??=` cache
+ * would latch a rejected promise forever, so this latch clears its cache the moment
+ * the attempt rejects. `cachedAttempt` is therefore only ever the reusable non-rejected
+ * attempt (in flight or successfully settled). Implements PRD §9.4.
+ */
+export declare class CleanupLatch {
+    private cachedAttempt;
+    private readonly run;
+    constructor(run: () => Promise<void>);
+    /**
+     * Runs cleanup, coalescing concurrent callers onto one in-flight attempt. On
+     * failure the cache is cleared so the NEXT call re-runs `run` instead of
+     * replaying the old rejection; the rejection still propagates to this caller.
+     */
+    attempt(): Promise<void>;
+    /**
+     * Runs cleanup from a path with no caller to reject to (an unsolicited exit).
+     * Owns the rejection so it never becomes an unhandled rejection; the failure is
+     * swallowed because `attempt` cleared its cache, so a later explicit shutdown
+     * retries cleanup and surfaces any persistent failure through its own error.
+     */
+    float(): void;
+}
+//# sourceMappingURL=cleanup-latch.d.ts.map

package/dist/runtime/shutdown/cleanup-latch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup-latch.d.ts","sourceRoot":"","sources":["../../../src/runtime/shutdown/cleanup-latch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qBAAa,YAAY;IACvB,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAsB;gBAE9B,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAIpC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAaxB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/runtime/shutdown/cleanup-latch.js

@@ -0,0 +1,43 @@
+/**
+ * Coalesces runtime-cleanup attempts while keeping a FAILED cleanup retryable.
+ * PRD §9.4 requires that a settled cleanup failure is not permanently sticky — a
+ * later explicit stop/kill/teardown must run a fresh attempt. A plain `??=` cache
+ * would latch a rejected promise forever, so this latch clears its cache the moment
+ * the attempt rejects. `cachedAttempt` is therefore only ever the reusable non-rejected
+ * attempt (in flight or successfully settled). Implements PRD §9.4.
+ */
+export class CleanupLatch {
+    cachedAttempt;
+    run;
+    constructor(run) {
+        this.run = run;
+    }
+    /**
+     * Runs cleanup, coalescing concurrent callers onto one in-flight attempt. On
+     * failure the cache is cleared so the NEXT call re-runs `run` instead of
+     * replaying the old rejection; the rejection still propagates to this caller.
+     */
+    attempt() {
+        // A cached attempt is reused only when it is in flight or already settled
+        // SUCCESSFULLY; a rejecting attempt clears the cache below before any other
+        // caller can observe it, so no identity guard is needed on the clear.
+        if (this.cachedAttempt)
+            return this.cachedAttempt;
+        const attempt = this.run().catch((error) => {
+            this.cachedAttempt = undefined;
+            throw error;
+        });
+        this.cachedAttempt = attempt;
+        return attempt;
+    }
+    /**
+     * Runs cleanup from a path with no caller to reject to (an unsolicited exit).
+     * Owns the rejection so it never becomes an unhandled rejection; the failure is
+     * swallowed because `attempt` cleared its cache, so a later explicit shutdown
+     * retries cleanup and surfaces any persistent failure through its own error.
+     */
+    float() {
+        void this.attempt().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=cleanup-latch.js.map

package/dist/runtime/shutdown/cleanup-latch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup-latch.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/cleanup-latch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,YAAY;IACf,aAAa,CAA4B;IAChC,GAAG,CAAsB;IAE1C,YAAY,GAAwB;QAClC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAClD,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACH,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/runtime/shutdown/coordinator.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Serializes a session's overlapping stop/kill/teardown so the PTY is signaled at
+ * most once (PRD §5.3/§9.4, C-LIFE-10). Concurrent shutdown calls can each snapshot
+ * a non-terminal status and race into `terminatePty`; if the OS process exits before
+ * node-pty's exit callback updates status, a later caller could signal the numeric
+ * PID again AFTER the kernel recycled it, and duplicate waiters / first-wins evidence
+ * could mislabel a force-killed exit as merely stopped.
+ *
+ * Two pieces of state, tracked SEPARATELY, make this safe and still retryable:
+ *   - `signaled` — sticky, set the first time any shutdown signals the PTY. It is
+ *     NEVER cleared. A later caller that finds it set does NOT re-signal solely
+ *     because the lifecycle status is still non-terminal (a predecessor that
+ *     signaled+reaped but threw before submitting terminal status must not cause a
+ *     re-signal of a possibly-recycled PID); it may still reap/cleanup/teardown.
+ *   - `inFlight` — the current in-flight run, CLEARED on settlement (with identity
+ *     protection). A failed `stop()`/`kill()`/`teardown()` therefore does not return
+ *     a permanently rejected promise to every later caller: once it settles, a later
+ *     call starts a fresh operation that RETRIES reap/cleanup/removal without
+ *     re-signaling the PTY (C-LIFE-10 retry posture).
+ */
+/** Ordered so a later request can tell whether it escalates the in-flight one. */
+export type ShutdownLevel = "stop" | "kill" | "teardown";
+/** What a coordinated shutdown operation is told about prior signal ownership. */
+export type ShutdownContext = {
+    /** True once ANY prior shutdown signaled the PTY — do not re-signal, only reap/cleanup. */
+    readonly alreadySignaled: boolean;
+    /** Record that this operation is about to signal the PTY (idempotent). */
+    readonly markSignaled: () => void;
+};
+type ShutdownOperation = (context: ShutdownContext) => Promise<void>;
+/**
+ * One coordinator per session. `run` is claimed synchronously: it records the
+ * in-flight request before returning control, so a concurrent caller entering the
+ * same tick sees it and joins instead of starting a second, racing shutdown.
+ */
+export declare class ShutdownCoordinator {
+    private inFlight;
+    private signaled;
+    /**
+     * Claim (or join) the in-flight shutdown for `level`, running `operation` only
+     * when this call actually owns work:
+     *   - No in-flight run: this caller owns it; `operation` runs immediately.
+     *   - In-flight run of an equal-or-higher level: JOIN it (await the same promise);
+     *     `operation` never runs, so the PTY is not signaled a second time.
+     *   - In-flight run of a LOWER level (escalation): chain `operation` AFTER the
+     *     in-flight run settles, so it observes the terminal status that run produced.
+     * The operation is told whether the PTY was `alreadySignaled` so it reaps/cleans
+     * up instead of re-signaling. On settlement `inFlight` is cleared (identity-guarded)
+     * so a later call can retry a failed reap/cleanup without re-signaling.
+     */
+    run(level: ShutdownLevel, operation: ShutdownOperation): Promise<void>;
+    /** Drop the active entry once it settles, but never clobber a newer one. */
+    private clear;
+    private context;
+}
+export {};
+//# sourceMappingURL=coordinator.d.ts.map

package/dist/runtime/shutdown/coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../../src/runtime/shutdown/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAIzD,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAEF,KAAK,iBAAiB,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAGrE;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAuB;IAGvC,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBtE,4EAA4E;IAC5E,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,OAAO;CAQhB"}

package/dist/runtime/shutdown/coordinator.js

@@ -0,0 +1,77 @@
+/**
+ * Serializes a session's overlapping stop/kill/teardown so the PTY is signaled at
+ * most once (PRD §5.3/§9.4, C-LIFE-10). Concurrent shutdown calls can each snapshot
+ * a non-terminal status and race into `terminatePty`; if the OS process exits before
+ * node-pty's exit callback updates status, a later caller could signal the numeric
+ * PID again AFTER the kernel recycled it, and duplicate waiters / first-wins evidence
+ * could mislabel a force-killed exit as merely stopped.
+ *
+ * Two pieces of state, tracked SEPARATELY, make this safe and still retryable:
+ *   - `signaled` — sticky, set the first time any shutdown signals the PTY. It is
+ *     NEVER cleared. A later caller that finds it set does NOT re-signal solely
+ *     because the lifecycle status is still non-terminal (a predecessor that
+ *     signaled+reaped but threw before submitting terminal status must not cause a
+ *     re-signal of a possibly-recycled PID); it may still reap/cleanup/teardown.
+ *   - `inFlight` — the current in-flight run, CLEARED on settlement (with identity
+ *     protection). A failed `stop()`/`kill()`/`teardown()` therefore does not return
+ *     a permanently rejected promise to every later caller: once it settles, a later
+ *     call starts a fresh operation that RETRIES reap/cleanup/removal without
+ *     re-signaling the PTY (C-LIFE-10 retry posture).
+ */
+const levelRank = { stop: 0, kill: 1, teardown: 2 };
+/**
+ * One coordinator per session. `run` is claimed synchronously: it records the
+ * in-flight request before returning control, so a concurrent caller entering the
+ * same tick sees it and joins instead of starting a second, racing shutdown.
+ */
+export class ShutdownCoordinator {
+    inFlight;
+    // Sticky: once the PTY is signaled it must never be signaled again (recycled PID),
+    // independently of whether a run reached a terminal status before it settled.
+    signaled = false;
+    /**
+     * Claim (or join) the in-flight shutdown for `level`, running `operation` only
+     * when this call actually owns work:
+     *   - No in-flight run: this caller owns it; `operation` runs immediately.
+     *   - In-flight run of an equal-or-higher level: JOIN it (await the same promise);
+     *     `operation` never runs, so the PTY is not signaled a second time.
+     *   - In-flight run of a LOWER level (escalation): chain `operation` AFTER the
+     *     in-flight run settles, so it observes the terminal status that run produced.
+     * The operation is told whether the PTY was `alreadySignaled` so it reaps/cleans
+     * up instead of re-signaling. On settlement `inFlight` is cleared (identity-guarded)
+     * so a later call can retry a failed reap/cleanup without re-signaling.
+     */
+    run(level, operation) {
+        const current = this.inFlight;
+        if (current && levelRank[current.level] >= levelRank[level])
+            return current.promise;
+        const invoke = () => operation(this.context());
+        // No in-flight run: this caller owns it and starts SYNCHRONOUSLY (no microtask gap
+        // before the PTY signal). An escalation chains AFTER the lower-level in-flight run
+        // so it observes the terminal status that run produced; the predecessor's rejection
+        // is absorbed here (each shutdown still surfaces its own failure to its own caller).
+        const promise = current ? current.promise.then(invoke, invoke) : invoke();
+        const entry = { level, promise };
+        this.inFlight = entry;
+        // Clear on settlement so a settled failure never permanently blocks a retry — but
+        // only if this is still the active entry (a newer run must not be clobbered). The
+        // rejection is swallowed on THIS observer only; the `promise` returned to the
+        // caller still rejects so each shutdown surfaces its own failure.
+        promise.then(() => this.clear(entry), () => this.clear(entry));
+        return promise;
+    }
+    /** Drop the active entry once it settles, but never clobber a newer one. */
+    clear(entry) {
+        if (this.inFlight === entry)
+            this.inFlight = undefined;
+    }
+    context() {
+        return {
+            alreadySignaled: this.signaled,
+            markSignaled: () => {
+                this.signaled = true;
+            },
+        };
+    }
+}
+//# sourceMappingURL=coordinator.js.map

package/dist/runtime/shutdown/coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,MAAM,SAAS,GAA4C,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAa7F;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACtB,QAAQ,CAAuB;IACvC,mFAAmF;IACnF,8EAA8E;IACtE,QAAQ,GAAG,KAAK,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,KAAoB,EAAE,SAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACpF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,mFAAmF;QACnF,mFAAmF;QACnF,oFAAoF;QACpF,qFAAqF;QACrF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,kEAAkE;QAClE,OAAO,CAAC,IAAI,CACV,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACvB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CACxB,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,KAAe;QAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IACzD,CAAC;IAEO,OAAO;QACb,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,QAAQ;YAC9B,YAAY,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/runtime/shutdown/reap-tree.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Reaps the process tree of a PTY leader on session teardown.
+ * Implements PRD §5.3 and §9.4 (C-LIFE-10): a CLI-spawned helper such as the
+ * Claude hook bridge is a descendant of the PTY leader. Because POSIX reparents
+ * a surviving descendant to PID 1 the instant its parent exits, a parent-pid
+ * walk (`pgrep -P`) cannot find it afterwards — but node-pty starts the leader
+ * as its own session/process-group leader, and group membership is inherited
+ * and survives reparenting. So we reap by SIGKILLing the leader's process group,
+ * which reaches every descendant in one in-process syscall: no subprocess, no
+ * PATH lookup, no post-exit reparenting blind spot.
+ */
+/** Injectable so tests never signal real process groups; production uses `process.kill`. */
+export type ProcessGroupKiller = {
+    /** SIGKILLs the process group `pgid` (via `kill(-pgid)`); tolerates an empty/dead group. */
+    readonly killGroup: (pgid: number) => void;
+};
+/**
+ * SIGKILLs the process group led by `leaderPid`, reaping every descendant still
+ * in the group — including one already reparented to PID 1. node-pty starts the
+ * leader via `setsid()`, so it heads its own session and its pgid equals its pid;
+ * that group is always distinct from the host's own group, so this cannot signal
+ * the host process. Refuses only pids the kernel would misroute (see
+ * `isReapableGroupId`), never an arbitrary numeric floor. An already-dead group
+ * (leader and children exited together) is the normal case and its `ESRCH` is
+ * swallowed; a real kill failure such as `EPERM` propagates.
+ */
+export declare function reapProcessGroup(leaderPid: number, ops?: ProcessGroupKiller): void;
+export declare function setGroupKillerForTests(killer: ProcessGroupKiller): void;
+export declare function resetGroupKillerForTests(): void;
+/**
+ * Swallows the ESRCH raised when the group is already empty (the normal case:
+ * the leader and its children exited together) and re-throws any other error —
+ * a real failure (e.g. EPERM) that must not be reported as a successful reap.
+ * Reads the errno through `errnoCode`, which narrows object-ness first, so a
+ * thrown `null`/non-Error is preserved and rethrown rather than triggering a
+ * secondary TypeError while inspecting it (C-ERR-01). Exported for focused
+ * coverage of both branches without an unsafe real signal.
+ */
+export declare function rethrowUnlessGroupGone(error: unknown): void;
+/**
+ * Owns a single PTY leader's group reap. A SUCCESSFUL reap MUST happen at most
+ * once: `stop()` then a later `teardown()` both want to guarantee the group is
+ * gone, but signaling the same numeric pgid twice is unsafe — once the group is
+ * empty the kernel may recycle the pid, and a second `kill(-pgid)` would hit an
+ * unrelated group. So the latch is set only AFTER the kill succeeds (an already
+ * empty group's `ESRCH` is normalized to success by `reapProcessGroup`). A real
+ * failure (e.g. EPERM) leaves the latch OPEN and rethrows, so a later teardown
+ * call can retry rather than leaving the descendant leak permanently unreaped.
+ */
+export declare class SessionReaper {
+    private readonly leaderPid;
+    private readonly ops;
+    private done;
+    constructor(leaderPid: number, ops?: ProcessGroupKiller);
+    /**
+     * Reap the group once it succeeds; a successful call latches so subsequent
+     * calls no-op (no recycled-pgid double-kill). A failed kill does NOT latch and
+     * rethrows, keeping the reap retryable on a later lifecycle call.
+     */
+    reap(): void;
+}
+//# sourceMappingURL=reap-tree.d.ts.map

package/dist/runtime/shutdown/reap-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reap-tree.d.ts","sourceRoot":"","sources":["../../../src/runtime/shutdown/reap-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C,CAAC;AAoBF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,kBAAiC,GAAG,IAAI,CAGhG;AAiBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAEvE;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAE3D;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,IAAI,CAAS;gBAET,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,kBAAiC;IAKrE;;;;OAIG;IACH,IAAI,IAAI,IAAI;CAKb"}

package/dist/runtime/shutdown/reap-tree.js

@@ -0,0 +1,108 @@
+/**
+ * Reaps the process tree of a PTY leader on session teardown.
+ * Implements PRD §5.3 and §9.4 (C-LIFE-10): a CLI-spawned helper such as the
+ * Claude hook bridge is a descendant of the PTY leader. Because POSIX reparents
+ * a surviving descendant to PID 1 the instant its parent exits, a parent-pid
+ * walk (`pgrep -P`) cannot find it afterwards — but node-pty starts the leader
+ * as its own session/process-group leader, and group membership is inherited
+ * and survives reparenting. So we reap by SIGKILLing the leader's process group,
+ * which reaches every descendant in one in-process syscall: no subprocess, no
+ * PATH lookup, no post-exit reparenting blind spot.
+ */
+import { errnoCode } from "../../core/errors.js";
+/**
+ * A pgid is reapable when it identifies the KNOWN-OWNED node-pty leader's group
+ * rather than a system group or the host itself. Ownership is NOT inferred from a
+ * numeric floor — that is an allocation detail, and after PID-space wrap or inside
+ * a constrained namespace a legitimate leader can be low (a prior arbitrary `< 100`
+ * floor silently no-op'd such leaders and leaked their descendants). We instead
+ * accept every valid child pid while refusing the two ids a group SIGKILL must
+ * never touch:
+ *   - `pgid <= 1` — pid 0 means "our own group" to `kill(2)`, and pid 1 is
+ *     `init`/`launchd`; a fake pid 1 in tests once reaped a developer's real apps.
+ *   - the host's OWN pid — node-pty gives the leader a fresh session via `setsid()`
+ *     so its pgid can never legitimately equal ours, but if a bad pgid ever did we
+ *     must not signal `-process.pid` and kill ourselves.
+ */
+function isReapableGroupId(pgid) {
+    return Number.isInteger(pgid) && pgid > 1 && pgid !== process.pid;
+}
+/**
+ * SIGKILLs the process group led by `leaderPid`, reaping every descendant still
+ * in the group — including one already reparented to PID 1. node-pty starts the
+ * leader via `setsid()`, so it heads its own session and its pgid equals its pid;
+ * that group is always distinct from the host's own group, so this cannot signal
+ * the host process. Refuses only pids the kernel would misroute (see
+ * `isReapableGroupId`), never an arbitrary numeric floor. An already-dead group
+ * (leader and children exited together) is the normal case and its `ESRCH` is
+ * swallowed; a real kill failure such as `EPERM` propagates.
+ */
+export function reapProcessGroup(leaderPid, ops = activeKiller) {
+    if (!isReapableGroupId(leaderPid))
+        return;
+    ops.killGroup(leaderPid);
+}
+const defaultKiller = {
+    killGroup(pgid) {
+        try {
+            process.kill(-pgid, "SIGKILL");
+        }
+        catch (error) {
+            rethrowUnlessGroupGone(error);
+        }
+    },
+};
+// The killer used when a caller does not inject one. A test seam so session
+// lifecycle tests can observe (and neutralize) the group SIGKILL without a real
+// signal, and without every session/terminate call site taking a killer param.
+let activeKiller = defaultKiller;
+export function setGroupKillerForTests(killer) {
+    activeKiller = killer;
+}
+export function resetGroupKillerForTests() {
+    activeKiller = defaultKiller;
+}
+/**
+ * Swallows the ESRCH raised when the group is already empty (the normal case:
+ * the leader and its children exited together) and re-throws any other error —
+ * a real failure (e.g. EPERM) that must not be reported as a successful reap.
+ * Reads the errno through `errnoCode`, which narrows object-ness first, so a
+ * thrown `null`/non-Error is preserved and rethrown rather than triggering a
+ * secondary TypeError while inspecting it (C-ERR-01). Exported for focused
+ * coverage of both branches without an unsafe real signal.
+ */
+export function rethrowUnlessGroupGone(error) {
+    if (errnoCode(error) !== "ESRCH")
+        throw error;
+}
+/**
+ * Owns a single PTY leader's group reap. A SUCCESSFUL reap MUST happen at most
+ * once: `stop()` then a later `teardown()` both want to guarantee the group is
+ * gone, but signaling the same numeric pgid twice is unsafe — once the group is
+ * empty the kernel may recycle the pid, and a second `kill(-pgid)` would hit an
+ * unrelated group. So the latch is set only AFTER the kill succeeds (an already
+ * empty group's `ESRCH` is normalized to success by `reapProcessGroup`). A real
+ * failure (e.g. EPERM) leaves the latch OPEN and rethrows, so a later teardown
+ * call can retry rather than leaving the descendant leak permanently unreaped.
+ */
+export class SessionReaper {
+    leaderPid;
+    ops;
+    done = false;
+    constructor(leaderPid, ops = activeKiller) {
+        this.leaderPid = leaderPid;
+        this.ops = ops;
+    }
+    /**
+     * Reap the group once it succeeds; a successful call latches so subsequent
+     * calls no-op (no recycled-pgid double-kill). A failed kill does NOT latch and
+     * rethrows, keeping the reap retryable on a later lifecycle call.
+     */
+    reap() {
+        if (this.done)
+            return;
+        reapProcessGroup(this.leaderPid, this.ops);
+        this.done = true;
+    }
+}
+//# sourceMappingURL=reap-tree.js.map

package/dist/runtime/shutdown/reap-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reap-tree.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/reap-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAQjD;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAA0B,YAAY;IACxF,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAAE,OAAO;IAC1C,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,aAAa,GAAuB;IACxC,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;CACF,CAAC;AAEF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,IAAI,YAAY,GAAuB,aAAa,CAAC;AAErD,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,YAAY,GAAG,aAAa,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAa;IACP,SAAS,CAAS;IAClB,GAAG,CAAqB;IACjC,IAAI,GAAG,KAAK,CAAC;IAErB,YAAY,SAAiB,EAAE,MAA0B,YAAY;QACnE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QACtB,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/runtime/shutdown/teardown.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Attempt-all sequencing for owned runtime resources: `runTeardownSteps` is the
+ * §8.4 teardown (typed `teardown_failed`, §10) and `runCleanupSteps` is the §9.4
+ * runtime-cleanup primitive every exit path shares (its caller wraps the failure).
+ */
+export declare function runTeardownSteps(steps: readonly (() => Promise<void> | void)[]): Promise<void>;
+/**
+ * Runs every runtime-cleanup step even if one rejects, so a failing bridge stop still
+ * disposes the terminal and finishes the transcript watcher — no resource is leaked
+ * because an earlier step threw (PRD §9.4). Rejects with an aggregated Error whose
+ * message lists each failure; upstream (`stopRuntime` callers) fold it into their own
+ * typed error (`termination_failed`/`teardown_failed`) so no new public code appears.
+ */
+export declare function runCleanupSteps(steps: readonly (() => Promise<void> | void)[]): Promise<void>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/runtime/shutdown/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../../src/runtime/shutdown/teardown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/runtime/shutdown/teardown.js

@@ -0,0 +1,40 @@
+/**
+ * Attempt-all sequencing for owned runtime resources: `runTeardownSteps` is the
+ * §8.4 teardown (typed `teardown_failed`, §10) and `runCleanupSteps` is the §9.4
+ * runtime-cleanup primitive every exit path shares (its caller wraps the failure).
+ */
+import { elwoodError } from "../../core/errors.js";
+/** Runs every step even if earlier ones reject, returning the collected failure messages. */
+async function attemptAllSteps(steps) {
+    const failures = [];
+    for (const step of steps) {
+        try {
+            await step();
+        }
+        catch (error) {
+            failures.push(error instanceof Error ? error.message : String(error));
+        }
+    }
+    return failures;
+}
+export async function runTeardownSteps(steps) {
+    const failures = await attemptAllSteps(steps);
+    if (failures.length > 0) {
+        throw elwoodError("teardown_failed", "Could not fully tear down Elwood session.", {
+            causes: failures,
+        });
+    }
+}
+/**
+ * Runs every runtime-cleanup step even if one rejects, so a failing bridge stop still
+ * disposes the terminal and finishes the transcript watcher — no resource is leaked
+ * because an earlier step threw (PRD §9.4). Rejects with an aggregated Error whose
+ * message lists each failure; upstream (`stopRuntime` callers) fold it into their own
+ * typed error (`termination_failed`/`teardown_failed`) so no new public code appears.
+ */
+export async function runCleanupSteps(steps) {
+    const failures = await attemptAllSteps(steps);
+    if (failures.length > 0)
+        throw new Error(`Runtime cleanup failed: ${failures.join("; ")}`);
+}
+//# sourceMappingURL=teardown.js.map

package/dist/runtime/shutdown/teardown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/teardown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAC5B,KAA8C;IAE9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,iBAAiB,EAAE,2CAA2C,EAAE;YAChF,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC"}