@with-logic/elwood 0.1.0

package/dist/runtime/shutdown/terminate.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared PTY termination helper for graceful stop and force kill.
+ * Implements PRD §5.3 and §9.4.
+ */
+import type { PtyProcess } from "../../pty/types.ts";
+import type { SessionReaper } from "./reap-tree.ts";
+type TerminationTimeouts = {
+    readonly gracefulMs: number;
+    readonly forceMs: number;
+};
+/**
+ * Signal the PTY, wait for exit, and reap the leader's process group. The reap is
+ * ATTEMPTED on EVERY exit path — normal exit, timeout, or a throwing PTY operation
+ * — so no path skips it. It does NOT guarantee the tree is gone: a failing reap
+ * (e.g. EPERM) still leaves descendants alive, so that failure is PROPAGATED as a
+ * typed `termination_failed` (never swallowed) and the reaper stays unlatched so a
+ * later `teardown()` RETRIES it. A successful reap latches, so a later reuse is a
+ * harmless no-op (see SessionReaper) (C-LIFE-10).
+ */
+export declare function terminatePty(pty: PtyProcess, signal: "SIGTERM" | "SIGKILL", reaper: Pick<SessionReaper, "reap">, timeouts?: TerminationTimeouts): Promise<void>;
+export {};
+//# sourceMappingURL=terminate.d.ts.map

package/dist/runtime/shutdown/terminate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminate.d.ts","sourceRoot":"","sources":["../../../src/runtime/shutdown/terminate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,KAAK,mBAAmB,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAKrF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EACnC,QAAQ,GAAE,mBAAqC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/runtime/shutdown/terminate.js

@@ -0,0 +1,129 @@
+/**
+ * Shared PTY termination helper for graceful stop and force kill.
+ * Implements PRD §5.3 and §9.4.
+ */
+import { causeDetails, ElwoodError, elwoodError, errnoCode } from "../../core/errors.js";
+const defaultTimeouts = { gracefulMs: 5_000, forceMs: 1_000 };
+const POST_EXIT_REAP_RETRIES = 4;
+const POST_EXIT_REAP_RETRY_MS = 25;
+/**
+ * Signal the PTY, wait for exit, and reap the leader's process group. The reap is
+ * ATTEMPTED on EVERY exit path — normal exit, timeout, or a throwing PTY operation
+ * — so no path skips it. It does NOT guarantee the tree is gone: a failing reap
+ * (e.g. EPERM) still leaves descendants alive, so that failure is PROPAGATED as a
+ * typed `termination_failed` (never swallowed) and the reaper stays unlatched so a
+ * later `teardown()` RETRIES it. A successful reap latches, so a later reuse is a
+ * harmless no-op (see SessionReaper) (C-LIFE-10).
+ */
+export async function terminatePty(pty, signal, reaper, timeouts = defaultTimeouts) {
+    let terminationError;
+    let observedExit = false;
+    try {
+        const timeoutMs = signal === "SIGTERM" ? timeouts.gracefulMs : timeouts.forceMs;
+        const exited = await waitForExitAfterSignal(pty, signal, timeoutMs);
+        // On a SIGTERM timeout, escalate to SIGKILL. The reported signal is the one
+        // whose wait actually failed, so an operator is sent to the right phase.
+        const escalated = !exited && signal === "SIGTERM"
+            ? await waitForExitAfterSignal(pty, "SIGKILL", timeouts.forceMs)
+            : exited;
+        observedExit = escalated;
+        if (!escalated) {
+            const failedSignal = signal === "SIGTERM" ? "SIGKILL" : signal;
+            terminationError = elwoodError("termination_failed", `PTY did not exit after ${failedSignal}.`);
+        }
+    }
+    catch (error) {
+        terminationError = error;
+    }
+    // Reap on every path — even if the wait timed out or a PTY call threw — so a
+    // termination_failed outcome never leaks the descendant tree (C-LIFE-10). The
+    // reaper does NOT latch on failure, so a later teardown can retry. When BOTH
+    // termination and reap fail, neither cause is dropped: the thrown error keeps
+    // the termination message and carries the reap failure in its details. When
+    // ONLY the reap fails (termination succeeded), the raw system error is wrapped
+    // as a typed `termination_failed` so the caller always rejects with an
+    // ElwoodError, never a bare EPERM (PRD §10, C-ERR-01).
+    try {
+        await reapAfterTermination(reaper, observedExit);
+    }
+    catch (reapError) {
+        if (terminationError === undefined)
+            throw reapOnlyFailed(reapError);
+        throw bothFailed(terminationError, reapError);
+    }
+    if (terminationError !== undefined)
+        throw terminationError;
+}
+async function reapAfterTermination(reaper, observedExit) {
+    let retries = observedExit ? POST_EXIT_REAP_RETRIES : 0;
+    while (true) {
+        try {
+            reaper.reap();
+            return;
+        }
+        catch (error) {
+            if (errnoCode(error) !== "EPERM" || retries === 0)
+                throw error;
+            retries -= 1;
+            await new Promise((resolve) => setTimeout(resolve, POST_EXIT_REAP_RETRY_MS));
+        }
+    }
+}
+/**
+ * Builds one error preserving BOTH the termination and the reap failure causes.
+ * The reap cause is carried on a dedicated `.reapError` string property (NOT the
+ * standard `.cause`, which the termination error may already use for its own root
+ * cause): an ElwoodError gets it in `details.reapError`; any other Error gets it as
+ * a `.reapError` property added in place, preserving the original identity/stack.
+ * Either way neither cause is dropped, whether termination failed with a typed
+ * ElwoodError or a plain PTY Error (C-LIFE-10). Callers/tests read `.reapError`.
+ */
+function bothFailed(terminationError, reapError) {
+    const reap = reapError instanceof Error ? reapError.message : String(reapError);
+    if (terminationError instanceof ElwoodError) {
+        return elwoodError(terminationError.code, terminationError.message, {
+            ...terminationError.details,
+            reapError: reap,
+        });
+    }
+    // Any other termination error reaching here is always an Error (ElwoodError is
+    // handled above; a thrown PTY value was normalized to Error in
+    // waitForExitAfterSignal). Preserve the reap cause on it without losing the
+    // original identity/stack.
+    terminationError.reapError = reap;
+    return terminationError;
+}
+/**
+ * Wraps a reap-only failure (PTY termination SUCCEEDED, the group reap FAILED) as
+ * a typed `termination_failed` error with a normalized cause (errno/syscall/path
+ * when available), so `stop()`/`kill()` reject with an ElwoodError rather than a
+ * raw system error (PRD §10, C-ERR-01, C-LIFE-10).
+ */
+function reapOnlyFailed(reapError) {
+    return elwoodError("termination_failed", "PTY exited but its process group could not be reaped.", {
+        ...causeDetails(reapError),
+    });
+}
+function waitForExitAfterSignal(pty, signal, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let unsubscribe;
+        const timer = setTimeout(() => {
+            unsubscribe?.();
+            resolve(false);
+        }, timeoutMs);
+        try {
+            unsubscribe = pty.onExit(() => {
+                clearTimeout(timer);
+                unsubscribe?.();
+                resolve(true);
+            });
+            pty.kill(signal);
+        }
+        catch (error) {
+            clearTimeout(timer);
+            unsubscribe?.();
+            reject(error instanceof Error ? error : new Error(String(error)));
+        }
+    });
+}
+//# sourceMappingURL=terminate.js.map

package/dist/runtime/shutdown/terminate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminate.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/terminate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAKzF,MAAM,eAAe,GAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnF,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,MAA6B,EAC7B,MAAmC,EACnC,WAAgC,eAAe;IAE/C,IAAI,gBAAyB,CAAC;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,SAAS,GACb,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/D,gBAAgB,GAAG,WAAW,CAC5B,oBAAoB,EACpB,0BAA0B,YAAY,GAAG,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,IAAI,gBAAgB,KAAK,SAAS;YAAE,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,UAAU,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS;QAAE,MAAM,gBAAgB,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,MAAmC,EACnC,YAAqB;IAErB,IAAI,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC/D,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,gBAAyB,EAAE,SAAkB;IAC/D,MAAM,IAAI,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,gBAAgB,YAAY,WAAW,EAAE,CAAC;QAC5C,OAAO,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE;YAClE,GAAG,gBAAgB,CAAC,OAAO;YAC3B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,+EAA+E;IAC/E,+DAA+D;IAC/D,4EAA4E;IAC5E,2BAA2B;IAC1B,gBAAmD,CAAC,SAAS,GAAG,IAAI,CAAC;IACtE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAkB;IACxC,OAAO,WAAW,CAChB,oBAAoB,EACpB,uDAAuD,EACvD;QACE,GAAG,YAAY,CAAC,SAAS,CAAC;KAC3B,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAAe,EACf,MAA6B,EAC7B,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,IAAI,WAAqC,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,WAAW,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,CAAC;YACH,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,WAAW,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/shutdown-coordinator.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Serializes a session's overlapping stop/kill/teardown so the PTY is signaled at
+ * most once (PRD §5.3/§9.4, C-LIFE-10). Concurrent shutdown calls can each snapshot
+ * a non-terminal status and race into `terminatePty`; if the OS process exits before
+ * node-pty's exit callback updates status, a later caller could signal the numeric
+ * PID again AFTER the kernel recycled it, and duplicate waiters / first-wins evidence
+ * could mislabel a force-killed exit as merely stopped.
+ *
+ * Two pieces of state, tracked SEPARATELY, make this safe and still retryable:
+ *   - `signaled` — sticky, set the first time any shutdown signals the PTY. It is
+ *     NEVER cleared. A later caller that finds it set does NOT re-signal solely
+ *     because the lifecycle status is still non-terminal (a predecessor that
+ *     signaled+reaped but threw before submitting terminal status must not cause a
+ *     re-signal of a possibly-recycled PID); it may still reap/cleanup/teardown.
+ *   - `inFlight` — the current in-flight run, CLEARED on settlement (with identity
+ *     protection). A failed `stop()`/`kill()`/`teardown()` therefore does not return
+ *     a permanently rejected promise to every later caller: once it settles, a later
+ *     call starts a fresh operation that RETRIES reap/cleanup/removal without
+ *     re-signaling the PTY (C-LIFE-10 retry posture).
+ */
+/** Ordered so a later request can tell whether it escalates the in-flight one. */
+export type ShutdownLevel = "stop" | "kill" | "teardown";
+/** What a coordinated shutdown operation is told about prior signal ownership. */
+export type ShutdownContext = {
+    /** True once ANY prior shutdown signaled the PTY — do not re-signal, only reap/cleanup. */
+    readonly alreadySignaled: boolean;
+    /** Record that this operation is about to signal the PTY (idempotent). */
+    readonly markSignaled: () => void;
+};
+type ShutdownOperation = (context: ShutdownContext) => Promise<void>;
+/**
+ * One coordinator per session. `run` is claimed synchronously: it records the
+ * in-flight request before returning control, so a concurrent caller entering the
+ * same tick sees it and joins instead of starting a second, racing shutdown.
+ */
+export declare class ShutdownCoordinator {
+    private inFlight;
+    private signaled;
+    /**
+     * Claim (or join) the in-flight shutdown for `level`, running `operation` only
+     * when this call actually owns work:
+     *   - No in-flight run: this caller owns it; `operation` runs immediately.
+     *   - In-flight run of an equal-or-higher level: JOIN it (await the same promise);
+     *     `operation` never runs, so the PTY is not signaled a second time.
+     *   - In-flight run of a LOWER level (escalation): chain `operation` AFTER the
+     *     in-flight run settles, so it observes the terminal status that run produced.
+     * The operation is told whether the PTY was `alreadySignaled` so it reaps/cleans
+     * up instead of re-signaling. On settlement `inFlight` is cleared (identity-guarded)
+     * so a later call can retry a failed reap/cleanup without re-signaling.
+     */
+    run(level: ShutdownLevel, operation: ShutdownOperation): Promise<void>;
+    /** Drop the active entry once it settles, but never clobber a newer one. */
+    private clear;
+    private context;
+}
+export {};
+//# sourceMappingURL=shutdown-coordinator.d.ts.map

package/dist/runtime/shutdown-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown-coordinator.d.ts","sourceRoot":"","sources":["../../src/runtime/shutdown-coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAIzD,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAEF,KAAK,iBAAiB,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAGrE;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAuB;IAGvC,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBtE,4EAA4E;IAC5E,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,OAAO;CAQhB"}

package/dist/runtime/shutdown-coordinator.js

@@ -0,0 +1,77 @@
+/**
+ * Serializes a session's overlapping stop/kill/teardown so the PTY is signaled at
+ * most once (PRD §5.3/§9.4, C-LIFE-10). Concurrent shutdown calls can each snapshot
+ * a non-terminal status and race into `terminatePty`; if the OS process exits before
+ * node-pty's exit callback updates status, a later caller could signal the numeric
+ * PID again AFTER the kernel recycled it, and duplicate waiters / first-wins evidence
+ * could mislabel a force-killed exit as merely stopped.
+ *
+ * Two pieces of state, tracked SEPARATELY, make this safe and still retryable:
+ *   - `signaled` — sticky, set the first time any shutdown signals the PTY. It is
+ *     NEVER cleared. A later caller that finds it set does NOT re-signal solely
+ *     because the lifecycle status is still non-terminal (a predecessor that
+ *     signaled+reaped but threw before submitting terminal status must not cause a
+ *     re-signal of a possibly-recycled PID); it may still reap/cleanup/teardown.
+ *   - `inFlight` — the current in-flight run, CLEARED on settlement (with identity
+ *     protection). A failed `stop()`/`kill()`/`teardown()` therefore does not return
+ *     a permanently rejected promise to every later caller: once it settles, a later
+ *     call starts a fresh operation that RETRIES reap/cleanup/removal without
+ *     re-signaling the PTY (C-LIFE-10 retry posture).
+ */
+const levelRank = { stop: 0, kill: 1, teardown: 2 };
+/**
+ * One coordinator per session. `run` is claimed synchronously: it records the
+ * in-flight request before returning control, so a concurrent caller entering the
+ * same tick sees it and joins instead of starting a second, racing shutdown.
+ */
+export class ShutdownCoordinator {
+    inFlight;
+    // Sticky: once the PTY is signaled it must never be signaled again (recycled PID),
+    // independently of whether a run reached a terminal status before it settled.
+    signaled = false;
+    /**
+     * Claim (or join) the in-flight shutdown for `level`, running `operation` only
+     * when this call actually owns work:
+     *   - No in-flight run: this caller owns it; `operation` runs immediately.
+     *   - In-flight run of an equal-or-higher level: JOIN it (await the same promise);
+     *     `operation` never runs, so the PTY is not signaled a second time.
+     *   - In-flight run of a LOWER level (escalation): chain `operation` AFTER the
+     *     in-flight run settles, so it observes the terminal status that run produced.
+     * The operation is told whether the PTY was `alreadySignaled` so it reaps/cleans
+     * up instead of re-signaling. On settlement `inFlight` is cleared (identity-guarded)
+     * so a later call can retry a failed reap/cleanup without re-signaling.
+     */
+    run(level, operation) {
+        const current = this.inFlight;
+        if (current && levelRank[current.level] >= levelRank[level])
+            return current.promise;
+        const invoke = () => operation(this.context());
+        // No in-flight run: this caller owns it and starts SYNCHRONOUSLY (no microtask gap
+        // before the PTY signal). An escalation chains AFTER the lower-level in-flight run
+        // so it observes the terminal status that run produced; the predecessor's rejection
+        // is absorbed here (each shutdown still surfaces its own failure to its own caller).
+        const promise = current ? current.promise.then(invoke, invoke) : invoke();
+        const entry = { level, promise };
+        this.inFlight = entry;
+        // Clear on settlement so a settled failure never permanently blocks a retry — but
+        // only if this is still the active entry (a newer run must not be clobbered). The
+        // rejection is swallowed on THIS observer only; the `promise` returned to the
+        // caller still rejects so each shutdown surfaces its own failure.
+        promise.then(() => this.clear(entry), () => this.clear(entry));
+        return promise;
+    }
+    /** Drop the active entry once it settles, but never clobber a newer one. */
+    clear(entry) {
+        if (this.inFlight === entry)
+            this.inFlight = undefined;
+    }
+    context() {
+        return {
+            alreadySignaled: this.signaled,
+            markSignaled: () => {
+                this.signaled = true;
+            },
+        };
+    }
+}
+//# sourceMappingURL=shutdown-coordinator.js.map

package/dist/runtime/shutdown-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown-coordinator.js","sourceRoot":"","sources":["../../src/runtime/shutdown-coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,MAAM,SAAS,GAA4C,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAa7F;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACtB,QAAQ,CAAuB;IACvC,mFAAmF;IACnF,8EAA8E;IACtE,QAAQ,GAAG,KAAK,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,KAAoB,EAAE,SAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACpF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,mFAAmF;QACnF,mFAAmF;QACnF,oFAAoF;QACpF,qFAAqF;QACrF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,kEAAkE;QAClE,OAAO,CAAC,IAAI,CACV,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACvB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CACxB,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,KAAe;QAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IACzD,CAAC;IAEO,OAAO;QACb,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,QAAQ;YAC9B,YAAY,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/runtime/startup/buffer.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Bounded, release-able collector for the first PTY output of a session.
+ *
+ * The startup usability check (see index.ts, `assertStartupUsable`) reads the
+ * agent's early output exactly once at ~500ms to detect a crash or auth banner.
+ * The PTY data handler is never detached for the session's lifetime, so a naive
+ * `startupOutput += data` accumulates a second unbounded in-memory transcript
+ * for the WHOLE session even though only the startup snapshot is ever consumed.
+ *
+ * This collector appends only while the startup gate is open and caps the buffer
+ * so a chatty CLI cannot balloon it; once `release()` is called (right after the
+ * usability check reads it) further chunks are dropped and the retained string is
+ * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
+ * usability and §9.4 resource cleanup.
+ */
+import type { PtyExit } from "../../pty/types.ts";
+import { type StartupAdapter } from "./index.ts";
+export type StartupBuffer = {
+    /** Appends a PTY chunk while the gate is open; a no-op once released. */
+    readonly push: (data: string) => void;
+    /** Returns the collected startup output (empty once released). */
+    readonly read: () => string;
+    /** Stops collecting and clears the retained buffer for the rest of the session. */
+    readonly release: () => void;
+};
+export declare function createStartupBuffer(cap?: number): StartupBuffer;
+/**
+ * Runs the ~500ms startup usability check against `buffer`, then releases it on
+ * every path (success OR failure) so the collector stops appending and clears
+ * its retained string for the rest of the session (§9.1, §9.4).
+ */
+export declare function assertStartupThenRelease(adapter: StartupAdapter, buffer: StartupBuffer, exit: () => PtyExit | undefined): Promise<void>;
+//# sourceMappingURL=buffer.d.ts.map

package/dist/runtime/startup/buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buffer.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAMtE,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAA2B,GAAG,aAAa,CAiBnF;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/runtime/startup/buffer.js

@@ -0,0 +1,53 @@
+/**
+ * Bounded, release-able collector for the first PTY output of a session.
+ *
+ * The startup usability check (see index.ts, `assertStartupUsable`) reads the
+ * agent's early output exactly once at ~500ms to detect a crash or auth banner.
+ * The PTY data handler is never detached for the session's lifetime, so a naive
+ * `startupOutput += data` accumulates a second unbounded in-memory transcript
+ * for the WHOLE session even though only the startup snapshot is ever consumed.
+ *
+ * This collector appends only while the startup gate is open and caps the buffer
+ * so a chatty CLI cannot balloon it; once `release()` is called (right after the
+ * usability check reads it) further chunks are dropped and the retained string is
+ * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
+ * usability and §9.4 resource cleanup.
+ */
+import { assertStartupUsable } from "./index.js";
+// Startup output is tiny (a banner, a prompt); this cap is comfortably larger
+// than any real startup screen while still bounding a misbehaving CLI.
+const STARTUP_BUFFER_CAP = 64 * 1024;
+export function createStartupBuffer(cap = STARTUP_BUFFER_CAP) {
+    let buffer = "";
+    let open = true;
+    return {
+        push(data) {
+            if (!open || buffer.length >= cap)
+                return;
+            buffer += data;
+            if (buffer.length > cap)
+                buffer = buffer.slice(0, cap);
+        },
+        read() {
+            return buffer;
+        },
+        release() {
+            open = false;
+            buffer = "";
+        },
+    };
+}
+/**
+ * Runs the ~500ms startup usability check against `buffer`, then releases it on
+ * every path (success OR failure) so the collector stops appending and clears
+ * its retained string for the rest of the session (§9.1, §9.4).
+ */
+export async function assertStartupThenRelease(adapter, buffer, exit) {
+    try {
+        await assertStartupUsable({ adapter, exit, output: () => buffer.read() });
+    }
+    finally {
+        buffer.release();
+    }
+}
+//# sourceMappingURL=buffer.js.map

package/dist/runtime/startup/buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buffer.js","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAC;AAEtE,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,kBAAkB;IAClE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,IAAY;YACf,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO;YAC1C,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO;YACL,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/startup/cleanup.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Best-effort startup cleanup that preserves the original startup error.
+ * Implements PRD §9.1 and §10 error stability.
+ */
+import type { PtyProcess } from "../../pty/types.ts";
+export type StartupTerminationTimeouts = {
+    readonly gracefulMs: number;
+    readonly forceMs: number;
+};
+export type StartupCleanupResources = {
+    readonly before?: () => void;
+    readonly bridge?: {
+        readonly stop: () => Promise<void>;
+    };
+    readonly pty?: PtyProcess;
+    readonly terminal?: {
+        readonly dispose: () => void;
+    };
+    readonly after?: () => void;
+    /** Overrides the bounded PTY termination window (tests only; production defaults). */
+    readonly terminationTimeouts?: StartupTerminationTimeouts;
+};
+/**
+ * Wraps the ENTIRE `start*FromRecord` body so the fresh per-launch socket FILE the
+ * launch minted is removed on ANY failure before the session takes ownership — a
+ * failed state/runtime write, bridge start, PTY start, or guarded post-spawn step
+ * otherwise leaks a socket under `/tmp/elwood-*` (§9.1). It removes only THIS launch's
+ * own file, never the shared stable home a concurrent launch may still own; the home is
+ * deterministic, so the session's next start/resume/teardown collects any empty
+ * leftover. On success ownership transfers to the returned session (teardown removes the
+ * whole home). The cleanup is contained so it never replaces the original startup error.
+ */
+export declare function withSocketHomeCleanup<T>(removeOwnSocketFile: () => void, build: () => Promise<T>): Promise<T>;
+export declare function cleanupStartupResources(resources: StartupCleanupResources): Promise<void>;
+/**
+ * Runs the post-session-construction startup steps behind ONE cleanup boundary
+ * (PRD §9.1, §9.4): if `region` rejects — a failed startup assertion, a PTY write
+ * fault, anything — the now-live PTY, bridge, terminal, and any watcher
+ * are torn down via `cleanupStartupResources` before the original error rethrows, so
+ * a rejected `startClaude`/`startCodex` never leaks live resources.
+ */
+export declare function guardStartupRegion(region: () => Promise<void>, resources: StartupCleanupResources): Promise<void>;
+//# sourceMappingURL=cleanup.d.ts.map

package/dist/runtime/startup/cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,mBAAmB,EAAE,MAAM,IAAI,EAC/B,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAMD,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F;AAUD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/runtime/startup/cleanup.js

@@ -0,0 +1,89 @@
+/**
+ * Best-effort startup cleanup that preserves the original startup error.
+ * Implements PRD §9.1 and §10 error stability.
+ */
+import { SessionReaper } from "../shutdown/reap-tree.js";
+import { terminatePty } from "../shutdown/terminate.js";
+/**
+ * Wraps the ENTIRE `start*FromRecord` body so the fresh per-launch socket FILE the
+ * launch minted is removed on ANY failure before the session takes ownership — a
+ * failed state/runtime write, bridge start, PTY start, or guarded post-spawn step
+ * otherwise leaks a socket under `/tmp/elwood-*` (§9.1). It removes only THIS launch's
+ * own file, never the shared stable home a concurrent launch may still own; the home is
+ * deterministic, so the session's next start/resume/teardown collects any empty
+ * leftover. On success ownership transfers to the returned session (teardown removes the
+ * whole home). The cleanup is contained so it never replaces the original startup error.
+ */
+export async function withSocketHomeCleanup(removeOwnSocketFile, build) {
+    try {
+        return await build();
+    }
+    catch (error) {
+        try {
+            removeOwnSocketFile();
+        }
+        catch {
+            // Secondary: the original startup error is the one that rejects.
+        }
+        throw error;
+    }
+}
+// Bounded so a failed startup never hangs on an unresponsive CLI while still
+// giving the leader a chance to exit gracefully before the group SIGKILL reap.
+const startupTermination = { gracefulMs: 5_000, forceMs: 1_000 };
+export async function cleanupStartupResources(resources) {
+    tryCall(resources.before);
+    // Route the PTY through the SAME group-reaping primitive the normal exit path
+    // uses: it signals, waits (bounded), and SIGKILLs the leader's process group on
+    // EVERY path — even when the PTY signal throws — so CLI descendants (e.g. a
+    // hook-bridge grandchild reparented to PID 1) cannot survive a failed startup
+    // (PRD §9.1, §9.4, C-LIFE-10). A termination/reap failure stays SECONDARY: it is
+    // contained here so the original startup error is the one that rejects.
+    if (resources.pty)
+        await reapPtyGroup(resources.pty, resources.terminationTimeouts ?? startupTermination);
+    await stopQuietly(resources.bridge);
+    tryCall(resources.after);
+    tryCall(resources.terminal?.dispose.bind(resources.terminal));
+}
+async function reapPtyGroup(pty, timeouts) {
+    try {
+        await terminatePty(pty, "SIGTERM", new SessionReaper(pty.pid), timeouts);
+    }
+    catch {
+        // Preserve the original startup error; a reap/termination failure is secondary.
+    }
+}
+/**
+ * Runs the post-session-construction startup steps behind ONE cleanup boundary
+ * (PRD §9.1, §9.4): if `region` rejects — a failed startup assertion, a PTY write
+ * fault, anything — the now-live PTY, bridge, terminal, and any watcher
+ * are torn down via `cleanupStartupResources` before the original error rethrows, so
+ * a rejected `startClaude`/`startCodex` never leaks live resources.
+ */
+export async function guardStartupRegion(region, resources) {
+    try {
+        await region();
+    }
+    catch (error) {
+        await cleanupStartupResources(resources);
+        throw error;
+    }
+}
+/** Stops the bridge if one exists; a sync throw or rejection stays secondary. */
+async function stopQuietly(bridge) {
+    try {
+        await bridge?.stop();
+    }
+    catch {
+        // Preserve the original startup error.
+    }
+}
+function tryCall(callback) {
+    try {
+        callback?.();
+    }
+    catch {
+        // Preserve the original startup error.
+    }
+}
+//# sourceMappingURL=cleanup.js.map

package/dist/runtime/startup/cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["../../../src/runtime/startup/cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBxD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,mBAA+B,EAC/B,KAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,kBAAkB,GAA+B,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE7F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAkC;IAC9E,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,iFAAiF;IACjF,wEAAwE;IACxE,IAAI,SAAS,CAAC,GAAG;QACf,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,IAAI,kBAAkB,CAAC,CAAC;IACzF,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,QAAoC;IAC/E,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA2B,EAC3B,SAAkC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,MAAyC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,QAAkC;IACjD,IAAI,CAAC;QACH,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC"}

package/dist/runtime/startup/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Startup readiness checks for newly spawned agent PTYs.
+ * Implements PRD §9.1 and §10.
+ */
+import type { PtyExit } from "../../pty/types.ts";
+export type StartupAdapter = "claude" | "codex";
+type StartupValue<T> = T | (() => T);
+export declare function setStartupWaitMsForTests(value: number): void;
+export declare function resetStartupWaitMsForTests(): void;
+export declare function assertStartupUsable(input: {
+    readonly adapter: StartupAdapter;
+    readonly exit: StartupValue<PtyExit | undefined>;
+    readonly output: StartupValue<string>;
+    readonly waitMs?: number;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/startup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAGrC,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB"}

package/dist/runtime/startup/index.js

@@ -0,0 +1,47 @@
+/**
+ * Startup readiness checks for newly spawned agent PTYs.
+ * Implements PRD §9.1 and §10.
+ */
+import { isClaudeReauthRequiredText } from "../../claude/login/expiry-screen.js";
+import { elwoodError } from "../../core/errors.js";
+let startupWaitMs = 500;
+export function setStartupWaitMsForTests(value) {
+    startupWaitMs = value;
+}
+export function resetStartupWaitMsForTests() {
+    startupWaitMs = 500;
+}
+export async function assertStartupUsable(input) {
+    await new Promise((resolve) => setTimeout(resolve, input.waitMs ?? startupWaitMs));
+    const exit = readStartupValue(input.exit);
+    if (exit) {
+        throw elwoodError(`${input.adapter}_start_failed`, `${input.adapter} exited during startup.`, {
+            exitCode: exit.exitCode,
+            signal: exit.signal,
+        });
+    }
+    if (isAuthFailure(input.adapter, readStartupValue(input.output))) {
+        throw elwoodError(`${input.adapter}_not_authenticated`, `${input.adapter} is not authenticated.`);
+    }
+}
+function isAuthFailure(adapter, output) {
+    // Claude's re-authentication banner ("Login expired" then "Please run /login")
+    // spans multiple lines, so it is matched against the WHOLE output, not per line,
+    // and only for Claude (C-CLAUDE-17). Other forms are single-line, both adapters.
+    if (adapter === "claude" && isClaudeReauthRequiredText(output))
+        return true;
+    return output.split(/\r?\n/).some((line) => isAuthFailureLine(adapter, line));
+}
+function isAuthFailureLine(adapter, line) {
+    if (/not authenticated|login required|authentication failed/i.test(line))
+        return true;
+    if (!/not logged in/i.test(line))
+        return false;
+    if (adapter === "codex" && /\bmcp server\b/i.test(line))
+        return false;
+    return true;
+}
+function readStartupValue(value) {
+    return typeof value === "function" ? value() : value;
+}
+//# sourceMappingURL=index.js.map

package/dist/runtime/startup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/startup/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKnD,IAAI,aAAa,GAAG,GAAG,CAAC;AAExB,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,GAAG,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,WAAW,CAAC,GAAG,KAAK,CAAC,OAAO,eAAe,EAAE,GAAG,KAAK,CAAC,OAAO,yBAAyB,EAAE;YAC5F,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,CACf,GAAG,KAAK,CAAC,OAAO,oBAAoB,EACpC,GAAG,KAAK,CAAC,OAAO,wBAAwB,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAuB,EAAE,MAAc;IAC5D,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,IAAI,OAAO,KAAK,QAAQ,IAAI,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB,EAAE,IAAY;IAC9D,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAI,KAAsB;IACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC"}