@with-logic/elwood 0.1.0

package/dist/runtime/startup-buffer.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Bounded, release-able collector for the first PTY output of a session.
+ *
+ * The startup usability check (see startup.ts, `assertStartupUsable`) reads the
+ * agent's early output exactly once at ~500ms to detect a crash or auth banner.
+ * The PTY data handler is never detached for the session's lifetime, so a naive
+ * `startupOutput += data` accumulates a second unbounded in-memory transcript
+ * for the WHOLE session even though only the startup snapshot is ever consumed.
+ *
+ * This collector appends only while the startup gate is open and caps the buffer
+ * so a chatty CLI cannot balloon it; once `release()` is called (right after the
+ * usability check reads it) further chunks are dropped and the retained string is
+ * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
+ * usability and §9.4 resource cleanup.
+ */
+import type { PtyExit } from "../pty/types.ts";
+import { type StartupAdapter } from "./startup.ts";
+export type StartupBuffer = {
+    /** Appends a PTY chunk while the gate is open; a no-op once released. */
+    readonly push: (data: string) => void;
+    /** Returns the collected startup output (empty once released). */
+    readonly read: () => string;
+    /** Stops collecting and clears the retained buffer for the rest of the session. */
+    readonly release: () => void;
+};
+export declare function createStartupBuffer(cap?: number): StartupBuffer;
+/**
+ * Runs the ~500ms startup usability check against `buffer`, then releases it on
+ * every path (success OR failure) so the collector stops appending and clears
+ * its retained string for the rest of the session (§9.1, §9.4).
+ */
+export declare function assertStartupThenRelease(adapter: StartupAdapter, buffer: StartupBuffer, exit: () => PtyExit | undefined): Promise<void>;
+//# sourceMappingURL=startup-buffer.d.ts.map

package/dist/runtime/startup-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-buffer.d.ts","sourceRoot":"","sources":["../../src/runtime/startup-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAMxE,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAA2B,GAAG,aAAa,CAiBnF;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/runtime/startup-buffer.js

@@ -0,0 +1,53 @@
+/**
+ * Bounded, release-able collector for the first PTY output of a session.
+ *
+ * The startup usability check (see startup.ts, `assertStartupUsable`) reads the
+ * agent's early output exactly once at ~500ms to detect a crash or auth banner.
+ * The PTY data handler is never detached for the session's lifetime, so a naive
+ * `startupOutput += data` accumulates a second unbounded in-memory transcript
+ * for the WHOLE session even though only the startup snapshot is ever consumed.
+ *
+ * This collector appends only while the startup gate is open and caps the buffer
+ * so a chatty CLI cannot balloon it; once `release()` is called (right after the
+ * usability check reads it) further chunks are dropped and the retained string is
+ * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
+ * usability and §9.4 resource cleanup.
+ */
+import { assertStartupUsable } from "./startup.js";
+// Startup output is tiny (a banner, a prompt); this cap is comfortably larger
+// than any real startup screen while still bounding a misbehaving CLI.
+const STARTUP_BUFFER_CAP = 64 * 1024;
+export function createStartupBuffer(cap = STARTUP_BUFFER_CAP) {
+    let buffer = "";
+    let open = true;
+    return {
+        push(data) {
+            if (!open || buffer.length >= cap)
+                return;
+            buffer += data;
+            if (buffer.length > cap)
+                buffer = buffer.slice(0, cap);
+        },
+        read() {
+            return buffer;
+        },
+        release() {
+            open = false;
+            buffer = "";
+        },
+    };
+}
+/**
+ * Runs the ~500ms startup usability check against `buffer`, then releases it on
+ * every path (success OR failure) so the collector stops appending and clears
+ * its retained string for the rest of the session (§9.1, §9.4).
+ */
+export async function assertStartupThenRelease(adapter, buffer, exit) {
+    try {
+        await assertStartupUsable({ adapter, exit, output: () => buffer.read() });
+    }
+    finally {
+        buffer.release();
+    }
+}
+//# sourceMappingURL=startup-buffer.js.map

package/dist/runtime/startup-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-buffer.js","sourceRoot":"","sources":["../../src/runtime/startup-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,cAAc,CAAC;AAExE,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,kBAAkB;IAClE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,IAAY;YACf,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO;YAC1C,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO;YACL,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/startup-cleanup.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Best-effort startup cleanup that preserves the original startup error.
+ * Implements PRD §9.1 and §10 error stability.
+ */
+import type { PtyProcess } from "../pty/types.ts";
+export type StartupTerminationTimeouts = {
+    readonly gracefulMs: number;
+    readonly forceMs: number;
+};
+export type StartupCleanupResources = {
+    readonly before?: () => void;
+    readonly bridge?: {
+        readonly stop: () => Promise<void>;
+    };
+    readonly pty?: PtyProcess;
+    readonly terminal?: {
+        readonly dispose: () => void;
+    };
+    readonly after?: () => void;
+    /** Overrides the bounded PTY termination window (tests only; production defaults). */
+    readonly terminationTimeouts?: StartupTerminationTimeouts;
+};
+/**
+ * Wraps the ENTIRE `start*FromRecord` body so the fresh per-launch socket FILE the
+ * launch minted is removed on ANY failure before the session takes ownership — a
+ * failed state/runtime write, bridge start, PTY start, or guarded post-spawn step
+ * otherwise leaks a socket under `/tmp/elwood-*` (§9.1). It removes only THIS launch's
+ * own file, never the shared stable home a concurrent launch may still own; the home is
+ * deterministic, so the session's next start/resume/teardown collects any empty
+ * leftover. On success ownership transfers to the returned session (teardown removes the
+ * whole home). The cleanup is contained so it never replaces the original startup error.
+ */
+export declare function withSocketHomeCleanup<T>(removeOwnSocketFile: () => void, build: () => Promise<T>): Promise<T>;
+export declare function cleanupStartupResources(resources: StartupCleanupResources): Promise<void>;
+/**
+ * Runs the post-session-construction startup steps behind ONE cleanup boundary
+ * (PRD §9.1, §9.4): if `region` rejects — a failed startup assertion, a PTY write
+ * fault, anything — the now-live PTY, bridge, terminal, and any watcher
+ * are torn down via `cleanupStartupResources` before the original error rethrows, so
+ * a rejected `startClaude`/`startCodex` never leaks live resources.
+ */
+export declare function guardStartupRegion(region: () => Promise<void>, resources: StartupCleanupResources): Promise<void>;
+//# sourceMappingURL=startup-cleanup.d.ts.map

package/dist/runtime/startup-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-cleanup.d.ts","sourceRoot":"","sources":["../../src/runtime/startup-cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAIlD,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,mBAAmB,EAAE,MAAM,IAAI,EAC/B,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAMD,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F;AAUD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/runtime/startup-cleanup.js

@@ -0,0 +1,89 @@
+/**
+ * Best-effort startup cleanup that preserves the original startup error.
+ * Implements PRD §9.1 and §10 error stability.
+ */
+import { SessionReaper } from "./reap-tree.js";
+import { terminatePty } from "./terminate.js";
+/**
+ * Wraps the ENTIRE `start*FromRecord` body so the fresh per-launch socket FILE the
+ * launch minted is removed on ANY failure before the session takes ownership — a
+ * failed state/runtime write, bridge start, PTY start, or guarded post-spawn step
+ * otherwise leaks a socket under `/tmp/elwood-*` (§9.1). It removes only THIS launch's
+ * own file, never the shared stable home a concurrent launch may still own; the home is
+ * deterministic, so the session's next start/resume/teardown collects any empty
+ * leftover. On success ownership transfers to the returned session (teardown removes the
+ * whole home). The cleanup is contained so it never replaces the original startup error.
+ */
+export async function withSocketHomeCleanup(removeOwnSocketFile, build) {
+    try {
+        return await build();
+    }
+    catch (error) {
+        try {
+            removeOwnSocketFile();
+        }
+        catch {
+            // Secondary: the original startup error is the one that rejects.
+        }
+        throw error;
+    }
+}
+// Bounded so a failed startup never hangs on an unresponsive CLI while still
+// giving the leader a chance to exit gracefully before the group SIGKILL reap.
+const startupTermination = { gracefulMs: 5_000, forceMs: 1_000 };
+export async function cleanupStartupResources(resources) {
+    tryCall(resources.before);
+    // Route the PTY through the SAME group-reaping primitive the normal exit path
+    // uses: it signals, waits (bounded), and SIGKILLs the leader's process group on
+    // EVERY path — even when the PTY signal throws — so CLI descendants (e.g. a
+    // hook-bridge grandchild reparented to PID 1) cannot survive a failed startup
+    // (PRD §9.1, §9.4, C-LIFE-10). A termination/reap failure stays SECONDARY: it is
+    // contained here so the original startup error is the one that rejects.
+    if (resources.pty)
+        await reapPtyGroup(resources.pty, resources.terminationTimeouts ?? startupTermination);
+    await stopQuietly(resources.bridge);
+    tryCall(resources.after);
+    tryCall(resources.terminal?.dispose.bind(resources.terminal));
+}
+async function reapPtyGroup(pty, timeouts) {
+    try {
+        await terminatePty(pty, "SIGTERM", new SessionReaper(pty.pid), timeouts);
+    }
+    catch {
+        // Preserve the original startup error; a reap/termination failure is secondary.
+    }
+}
+/**
+ * Runs the post-session-construction startup steps behind ONE cleanup boundary
+ * (PRD §9.1, §9.4): if `region` rejects — a failed startup assertion, a PTY write
+ * fault, anything — the now-live PTY, bridge, terminal, and any watcher
+ * are torn down via `cleanupStartupResources` before the original error rethrows, so
+ * a rejected `startClaude`/`startCodex` never leaks live resources.
+ */
+export async function guardStartupRegion(region, resources) {
+    try {
+        await region();
+    }
+    catch (error) {
+        await cleanupStartupResources(resources);
+        throw error;
+    }
+}
+/** Stops the bridge if one exists; a sync throw or rejection stays secondary. */
+async function stopQuietly(bridge) {
+    try {
+        await bridge?.stop();
+    }
+    catch {
+        // Preserve the original startup error.
+    }
+}
+function tryCall(callback) {
+    try {
+        callback?.();
+    }
+    catch {
+        // Preserve the original startup error.
+    }
+}
+//# sourceMappingURL=startup-cleanup.js.map

package/dist/runtime/startup-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-cleanup.js","sourceRoot":"","sources":["../../src/runtime/startup-cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAiB9C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,mBAA+B,EAC/B,KAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,kBAAkB,GAA+B,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE7F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAkC;IAC9E,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,iFAAiF;IACjF,wEAAwE;IACxE,IAAI,SAAS,CAAC,GAAG;QACf,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,IAAI,kBAAkB,CAAC,CAAC;IACzF,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,QAAoC;IAC/E,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA2B,EAC3B,SAAkC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,MAAyC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,QAAkC;IACjD,IAAI,CAAC;QACH,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC"}

package/dist/runtime/startup.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Startup readiness checks for newly spawned agent PTYs.
+ * Implements PRD §9.1 and §10.
+ */
+import type { PtyExit } from "../pty/types.ts";
+export type StartupAdapter = "claude" | "codex";
+type StartupValue<T> = T | (() => T);
+export declare function setStartupWaitMsForTests(value: number): void;
+export declare function resetStartupWaitMsForTests(): void;
+export declare function assertStartupUsable(input: {
+    readonly adapter: StartupAdapter;
+    readonly exit: StartupValue<PtyExit | undefined>;
+    readonly output: StartupValue<string>;
+    readonly waitMs?: number;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=startup.d.ts.map

package/dist/runtime/startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../../src/runtime/startup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAGrC,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB"}

package/dist/runtime/startup.js

@@ -0,0 +1,47 @@
+/**
+ * Startup readiness checks for newly spawned agent PTYs.
+ * Implements PRD §9.1 and §10.
+ */
+import { isClaudeReauthRequiredText } from "../claude/login/expiry-screen.js";
+import { elwoodError } from "../core/errors.js";
+let startupWaitMs = 500;
+export function setStartupWaitMsForTests(value) {
+    startupWaitMs = value;
+}
+export function resetStartupWaitMsForTests() {
+    startupWaitMs = 500;
+}
+export async function assertStartupUsable(input) {
+    await new Promise((resolve) => setTimeout(resolve, input.waitMs ?? startupWaitMs));
+    const exit = readStartupValue(input.exit);
+    if (exit) {
+        throw elwoodError(`${input.adapter}_start_failed`, `${input.adapter} exited during startup.`, {
+            exitCode: exit.exitCode,
+            signal: exit.signal,
+        });
+    }
+    if (isAuthFailure(input.adapter, readStartupValue(input.output))) {
+        throw elwoodError(`${input.adapter}_not_authenticated`, `${input.adapter} is not authenticated.`);
+    }
+}
+function isAuthFailure(adapter, output) {
+    // Claude's re-authentication banner ("Login expired" then "Please run /login")
+    // spans multiple lines, so it is matched against the WHOLE output, not per line,
+    // and only for Claude (C-CLAUDE-17). Other forms are single-line, both adapters.
+    if (adapter === "claude" && isClaudeReauthRequiredText(output))
+        return true;
+    return output.split(/\r?\n/).some((line) => isAuthFailureLine(adapter, line));
+}
+function isAuthFailureLine(adapter, line) {
+    if (/not authenticated|login required|authentication failed/i.test(line))
+        return true;
+    if (!/not logged in/i.test(line))
+        return false;
+    if (adapter === "codex" && /\bmcp server\b/i.test(line))
+        return false;
+    return true;
+}
+function readStartupValue(value) {
+    return typeof value === "function" ? value() : value;
+}
+//# sourceMappingURL=startup.js.map

package/dist/runtime/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","sourceRoot":"","sources":["../../src/runtime/startup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD,IAAI,aAAa,GAAG,GAAG,CAAC;AAExB,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,GAAG,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,WAAW,CAAC,GAAG,KAAK,CAAC,OAAO,eAAe,EAAE,GAAG,KAAK,CAAC,OAAO,yBAAyB,EAAE;YAC5F,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,CACf,GAAG,KAAK,CAAC,OAAO,oBAAoB,EACpC,GAAG,KAAK,CAAC,OAAO,wBAAwB,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAuB,EAAE,MAAc;IAC5D,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,IAAI,OAAO,KAAK,QAAQ,IAAI,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB,EAAE,IAAY;IAC9D,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAI,KAAsB;IACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC"}

package/dist/runtime/status-emit.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Status + activity event delivery for a session's applied status change,
+ * extracted to keep AgentSessionBase within the file-size cap. A throwing status
+ * listener PROPAGATES here by design: the `initial_ready` transition relies on it
+ * to trigger its classify-and-release fallback (C-API-42). The status engine commits
+ * the live in-memory `current` status BEFORE calling this, so a throw here can never
+ * leave the emitted event disagreeing with that live status (status is live-only,
+ * never persisted, §8.2; status-evidence.apply). Implements PRD §5.3.
+ */
+import { type ElwoodAgentKind } from "../core/activity.ts";
+import type { ElwoodSessionStatus } from "../core/types.ts";
+import type { SessionStatusEmitter } from "./session-base-types.ts";
+export declare function emitStatusEvents(emitter: SessionStatusEmitter, agent: ElwoodAgentKind, id: string, status: ElwoodSessionStatus): void;
+//# sourceMappingURL=status-emit.d.ts.map

package/dist/runtime/status-emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-emit.d.ts","sourceRoot":"","sources":["../../src/runtime/status-emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,eAAe,EACtB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,mBAAmB,GAC1B,IAAI,CAGN"}

package/dist/runtime/status-emit.js

@@ -0,0 +1,15 @@
+/**
+ * Status + activity event delivery for a session's applied status change,
+ * extracted to keep AgentSessionBase within the file-size cap. A throwing status
+ * listener PROPAGATES here by design: the `initial_ready` transition relies on it
+ * to trigger its classify-and-release fallback (C-API-42). The status engine commits
+ * the live in-memory `current` status BEFORE calling this, so a throw here can never
+ * leave the emitted event disagreeing with that live status (status is live-only,
+ * never persisted, §8.2; status-evidence.apply). Implements PRD §5.3.
+ */
+import { activityFromStatus } from "../core/activity.js";
+export function emitStatusEvents(emitter, agent, id, status) {
+    emitter.emit("status", { elwoodSessionId: id, status });
+    emitter.emit("activity", activityFromStatus(agent, id, status));
+}
+//# sourceMappingURL=status-emit.js.map

package/dist/runtime/status-emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-emit.js","sourceRoot":"","sources":["../../src/runtime/status-emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAwB,MAAM,qBAAqB,CAAC;AAI/E,MAAM,UAAU,gBAAgB,CAC9B,OAA6B,EAC7B,KAAsB,EACtB,EAAU,EACV,MAA2B;IAE3B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/runtime/status-evidence.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Evidence-driven session status engine: every status transition flows from
+ * an explicit evidence record so transitions stay idempotent and explainable.
+ * Implements PRD §5.3 and §9 lifecycle guarantees.
+ */
+import type { ElwoodSessionStatus, ElwoodStatusDecision, ElwoodStatusEvidence } from "../core/types.ts";
+/** The evidence kinds the engine accepts; the public alias is the source. */
+export type StatusEvidenceKind = ElwoodStatusEvidence;
+export type StatusDecision = ElwoodStatusDecision;
+export declare function decideStatus(from: ElwoodSessionStatus, evidence: StatusEvidenceKind): StatusDecision;
+/** Diagnostics stay bounded; the log is live-only and never persisted. */
+export declare const maxStatusDecisions = 50;
+export type StatusEngineIo = {
+    /** Note that the session reached `ready` at least once (idempotent, live-only). */
+    readonly onReady: () => void;
+    /** Deliver status/activity events to listeners (a listener throw propagates). */
+    readonly emitStatus: (status: ElwoodSessionStatus) => void;
+    readonly queueRunning: () => void;
+    readonly queueReady: () => void;
+    /** Suspend queue readiness without implying a new turn (blocked dialog). */
+    readonly queueBlocked: () => void;
+    readonly queueClose: () => void;
+    readonly cleanup: () => void;
+};
+export declare class SessionStatusEngine {
+    private readonly io;
+    private readonly log;
+    private current;
+    constructor(io: StatusEngineIo);
+    get status(): ElwoodSessionStatus;
+    decisions(): readonly StatusDecision[];
+    submit(kind: StatusEvidenceKind): StatusDecision;
+    private apply;
+}
+//# sourceMappingURL=status-evidence.d.ts.map

package/dist/runtime/status-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-evidence.d.ts","sourceRoot":"","sources":["../../src/runtime/status-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAgClD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,kBAAkB,GAC3B,cAAc,CAiChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,OAAO,CAAmC;gBAEtC,EAAE,EAAE,cAAc;IAI9B,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc;IAQhD,OAAO,CAAC,KAAK;CA6Cd"}

package/dist/runtime/status-evidence.js

@@ -0,0 +1,143 @@
+/**
+ * Evidence-driven session status engine: every status transition flows from
+ * an explicit evidence record so transitions stay idempotent and explainable.
+ * Implements PRD §5.3 and §9 lifecycle guarantees.
+ */
+import { liveStatuses } from "../core/status-categories.js";
+import { canTransition } from "./session/status.js";
+const evidenceTargets = {
+    startup_usable: "running",
+    initial_ready: "ready",
+    hook_turn_ended: "ready",
+    rendered_turn_started: "running",
+    rendered_turn_ended: "ready",
+    caller_submitted: "running",
+    blocking_prompt_shown: "blocked",
+    blocking_prompt_cleared: "ready",
+    terminal_exited: "exited",
+    stop_completed: "stopped",
+    kill_completed: "killed",
+    teardown_completed: "torn_down",
+};
+/**
+ * Turn and blocking evidence is only meaningful once the session is live: it
+ * describes activity within an interactive session and must not fire from
+ * `starting`. Readiness bootstrap (`startup_usable`, `initial_ready`) is
+ * excluded — those are the transitions that establish liveness.
+ */
+const requiresLiveSession = new Set([
+    "hook_turn_ended",
+    "rendered_turn_started",
+    "rendered_turn_ended",
+    "caller_submitted",
+    "blocking_prompt_shown",
+    "blocking_prompt_cleared",
+]);
+export function decideStatus(from, evidence) {
+    const target = evidenceTargets[evidence];
+    const ignored = (reason) => ({ evidence, from, to: undefined, reason });
+    // Turn/blocking evidence describes in-session activity; before the session
+    // is live (`starting`) it must not fabricate `ready`/`running`/`blocked`.
+    if (requiresLiveSession.has(evidence) && !liveStatuses.has(from)) {
+        return ignored(`ignored: ${evidence} before the session is live (${from})`);
+    }
+    // Startup readiness must not regress a session that a hook already advanced:
+    // if `initial_ready` reached `ready` first, a late `startup_usable` is stale.
+    if (evidence === "startup_usable" && from !== "starting") {
+        return ignored(`ignored: startup_usable after the session left starting (${from})`);
+    }
+    // A blocking dialog only blocks a session that is mid-turn or idle-ready.
+    if (evidence === "blocking_prompt_shown" && !(from === "running" || from === "ready")) {
+        return ignored(`ignored: cannot block from ${from}`);
+    }
+    // Initial readiness must not reopen a session that is currently blocked: a
+    // startup dialog (e.g. a trust prompt) can be on screen when the readiness
+    // hook or its deadline fires, and applying `ready` here would drain queued
+    // input into the dialog. Only `blocking_prompt_cleared` may leave `blocked`.
+    if (evidence === "initial_ready" && from === "blocked") {
+        return ignored("ignored: initial_ready must not reopen a blocked session");
+    }
+    // A cleared blocking prompt only settles a session that was actually
+    // blocked; otherwise the clear is stale (the composer resumed on its own).
+    if (evidence === "blocking_prompt_cleared" && from !== "blocked") {
+        return ignored(`ignored: ${from} is not blocked`);
+    }
+    if (!canTransition(from, target)) {
+        return ignored(`ignored: ${from} cannot become ${target}`);
+    }
+    return { evidence, from, to: target, reason: `applied: ${from} became ${target}` };
+}
+/** Diagnostics stay bounded; the log is live-only and never persisted. */
+export const maxStatusDecisions = 50;
+export class SessionStatusEngine {
+    io;
+    log = [];
+    current = "starting";
+    constructor(io) {
+        this.io = io;
+    }
+    get status() {
+        return this.current;
+    }
+    decisions() {
+        return this.log;
+    }
+    submit(kind) {
+        const decision = decideStatus(this.current, kind);
+        this.log.push(decision);
+        if (this.log.length > maxStatusDecisions)
+            this.log.shift();
+        if (decision.to !== undefined)
+            this.apply(decision.to);
+        return decision;
+    }
+    apply(to) {
+        if (to === "running") {
+            // Turn start: commit `current` and suspend the queue BEFORE the public emit, so a
+            // throwing status LISTENER can never skip the suspend (it runs after). A throwing
+            // caller_submitted listener is additionally CONTAINED in ControlQueue.beginSubmission
+            // so it cannot abort the pending PTY write.
+            this.current = to;
+            this.io.queueRunning();
+            this.io.emitStatus(to);
+            return;
+        }
+        this.current = to;
+        if (to === "ready") {
+            // `onReady` (a non-throwing latch) runs before listeners so one checking
+            // "has been ready" sees it. The queue reopen is guaranteed in a `finally`: a
+            // throwing status listener must NOT skip queueReady(), or the queue stays
+            // suspended while `current` is already `ready`, so later ready evidence is a
+            // no-op and queued work starves.
+            this.io.onReady();
+            try {
+                this.io.emitStatus(to);
+            }
+            finally {
+                this.io.queueReady();
+            }
+            return;
+        }
+        if (to === "blocked") {
+            // A human-decision dialog is on screen: suspend the queue BEFORE the emit so a
+            // status listener that synchronously calls back cannot drain a queued send into
+            // the dialog. Suspend-first also means a throwing listener can't skip the suspend.
+            this.io.queueBlocked();
+            this.io.emitStatus(to);
+            return;
+        }
+        this.io.queueClose();
+        // On an unsolicited exit, runtime cleanup must run even if emitting the `exited`
+        // status throws — otherwise a throwing status listener would leak the
+        // bridge/watcher/terminal (PRD §9.4). `cleanup()` is itself failure-isolated (it
+        // floats a retryable promise), so it never re-throws here.
+        try {
+            this.io.emitStatus(to);
+        }
+        finally {
+            if (to === "exited")
+                this.io.cleanup();
+        }
+    }
+}
+//# sourceMappingURL=status-evidence.js.map

package/dist/runtime/status-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-evidence.js","sourceRoot":"","sources":["../../src/runtime/status-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAM5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,MAAM,eAAe,GAA8D;IACjF,cAAc,EAAE,SAAS;IACzB,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,OAAO;IACxB,qBAAqB,EAAE,SAAS;IAChC,mBAAmB,EAAE,OAAO;IAC5B,gBAAgB,EAAE,SAAS;IAC3B,qBAAqB,EAAE,SAAS;IAChC,uBAAuB,EAAE,OAAO;IAChC,eAAe,EAAE,QAAQ;IACzB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,QAAQ;IACxB,kBAAkB,EAAE,WAAW;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAqB;IACtD,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,kBAAkB;IAClB,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAC1B,IAAyB,EACzB,QAA4B;IAE5B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAkB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,YAAY,QAAQ,gCAAgC,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,gBAAgB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,4DAA4D,IAAI,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,OAAO,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,QAAQ,KAAK,eAAe,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,QAAQ,KAAK,yBAAyB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,YAAY,IAAI,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,MAAM,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAerC,MAAM,OAAO,mBAAmB;IACb,EAAE,CAAiB;IACnB,GAAG,GAAqB,EAAE,CAAC;IACpC,OAAO,GAAwB,UAAU,CAAC;IAElD,YAAY,EAAkB;QAC5B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,IAAwB;QAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,kBAAkB;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,EAAuB;QACnC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,kFAAkF;YAClF,kFAAkF;YAClF,sFAAsF;YACtF,4CAA4C;YAC5C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACnB,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,6EAA6E;YAC7E,iCAAiC;YACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,+EAA+E;YAC/E,gFAAgF;YAChF,mFAAmF;YACnF,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;QACrB,iFAAiF;QACjF,sEAAsE;QACtE,iFAAiF;QACjF,2DAA2D;QAC3D,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,QAAQ;gBAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}

package/dist/runtime/teardown.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Attempt-all sequencing for owned runtime resources: `runTeardownSteps` is the
+ * §8.4 teardown (typed `teardown_failed`, §10) and `runCleanupSteps` is the §9.4
+ * runtime-cleanup primitive every exit path shares (its caller wraps the failure).
+ */
+export declare function runTeardownSteps(steps: readonly (() => Promise<void> | void)[]): Promise<void>;
+/**
+ * Runs every runtime-cleanup step even if one rejects, so a failing bridge stop still
+ * disposes the terminal and finishes the transcript watcher — no resource is leaked
+ * because an earlier step threw (PRD §9.4). Rejects with an aggregated Error whose
+ * message lists each failure; upstream (`stopRuntime` callers) fold it into their own
+ * typed error (`termination_failed`/`teardown_failed`) so no new public code appears.
+ */
+export declare function runCleanupSteps(steps: readonly (() => Promise<void> | void)[]): Promise<void>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/runtime/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../src/runtime/teardown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/runtime/teardown.js

@@ -0,0 +1,40 @@
+/**
+ * Attempt-all sequencing for owned runtime resources: `runTeardownSteps` is the
+ * §8.4 teardown (typed `teardown_failed`, §10) and `runCleanupSteps` is the §9.4
+ * runtime-cleanup primitive every exit path shares (its caller wraps the failure).
+ */
+import { elwoodError } from "../core/errors.js";
+/** Runs every step even if earlier ones reject, returning the collected failure messages. */
+async function attemptAllSteps(steps) {
+    const failures = [];
+    for (const step of steps) {
+        try {
+            await step();
+        }
+        catch (error) {
+            failures.push(error instanceof Error ? error.message : String(error));
+        }
+    }
+    return failures;
+}
+export async function runTeardownSteps(steps) {
+    const failures = await attemptAllSteps(steps);
+    if (failures.length > 0) {
+        throw elwoodError("teardown_failed", "Could not fully tear down Elwood session.", {
+            causes: failures,
+        });
+    }
+}
+/**
+ * Runs every runtime-cleanup step even if one rejects, so a failing bridge stop still
+ * disposes the terminal and finishes the transcript watcher — no resource is leaked
+ * because an earlier step threw (PRD §9.4). Rejects with an aggregated Error whose
+ * message lists each failure; upstream (`stopRuntime` callers) fold it into their own
+ * typed error (`termination_failed`/`teardown_failed`) so no new public code appears.
+ */
+export async function runCleanupSteps(steps) {
+    const failures = await attemptAllSteps(steps);
+    if (failures.length > 0)
+        throw new Error(`Runtime cleanup failed: ${failures.join("; ")}`);
+}
+//# sourceMappingURL=teardown.js.map

package/dist/runtime/teardown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.js","sourceRoot":"","sources":["../../src/runtime/teardown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAC5B,KAA8C;IAE9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,iBAAiB,EAAE,2CAA2C,EAAE;YAChF,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC"}

package/dist/runtime/terminate.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared PTY termination helper for graceful stop and force kill.
+ * Implements PRD §5.3 and §9.4.
+ */
+import type { PtyProcess } from "../pty/types.ts";
+import type { SessionReaper } from "./reap-tree.ts";
+type TerminationTimeouts = {
+    readonly gracefulMs: number;
+    readonly forceMs: number;
+};
+/**
+ * Signal the PTY, wait for exit, and reap the leader's process group. The reap is
+ * ATTEMPTED on EVERY exit path — normal exit, timeout, or a throwing PTY operation
+ * — so no path skips it. It does NOT guarantee the tree is gone: a failing reap
+ * (e.g. EPERM) still leaves descendants alive, so that failure is PROPAGATED as a
+ * typed `termination_failed` (never swallowed) and the reaper stays unlatched so a
+ * later `teardown()` RETRIES it. A successful reap latches, so a later reuse is a
+ * harmless no-op (see SessionReaper) (C-LIFE-10).
+ */
+export declare function terminatePty(pty: PtyProcess, signal: "SIGTERM" | "SIGKILL", reaper: Pick<SessionReaper, "reap">, timeouts?: TerminationTimeouts): Promise<void>;
+export {};
+//# sourceMappingURL=terminate.d.ts.map