beatrina 0.9.43 → 0.9.83

package/beatrina_V0.9.83.html.inputs.json

@@ -0,0 +1 @@
+{"schema":1,"sources":"a3ef9738bd9d341aca4181dfe7d7522293c1def1568ad55f425b751bedee5f11","artifact":"0d474616d33fdf5a95b6735e25f1214b3f82bf2490ccba3af9d5883e8b9c652c"}

package/build-info.json

@@ -1 +1 @@
-{"version":"0.9.43","commit":"ce1dbc09721024a43c3666122e3e0759a24b294f","dirty":false}
+{"version":"0.9.83","commit":"9d7ed5ae63cb367b7fd428d71041c44cf91fdbb5","dirty":false}

package/host/journal-store.mjs

@@ -22,7 +22,8 @@
 //                                 the page's checkpoint codec wrote)
 //     checkpoint.rev              the revision of that envelope
 //     pins/<rev>.json             a named version, with its content
-//     meta.json                   display name, file binding, gaps, updated
+//     meta.json                   display name, file binding, gaps, updated,
+//                                 and `saved` — what the last Save wrote (N3)
 //     journal.corrupt-<time>      bytes cut from a journal that did not end at
 //                                 a line boundary — kept as evidence
 //
@@ -295,6 +296,10 @@ export function createJournalStore() {
 
   // ── the ops ───────────────────────────────────────────────────────────────
 
+  const HEX64 = /^[0-9a-f]{64}$/;
+  const validSaved = (v) => v != null && typeof v === "object" && !Array.isArray(v)
+    && typeof v.model === "string" && HEX64.test(v.model) && typeof v.file === "string" && HEX64.test(v.file);
+
   const open = (id, key, meta, takeover) => {
     if (!enabled) return err("journal_open", id, "unavailable", "The document journal is disabled (BEATRINA_NO_JOURNAL=1).");
     if (!validKey(key)) return err("journal_open", id, "invalid_key", "A journal needs a durable document key.");
@@ -428,7 +433,7 @@ export function createJournalStore() {
     return before - st.bytes;
   };
 
-  const checkpoint = (id, key, revision, generation, envelope, meta, rebase, epoch) => {
+  const checkpoint = (id, key, revision, generation, envelope, meta, rebase, epoch, saved) => {
     if (!enabled) return err("journal_checkpoint", id, "unavailable", "The document journal is disabled.");
     if (!validKey(key)) return err("journal_checkpoint", id, "invalid_key", "A journal needs a durable document key.");
     const refused = leaseRefusal("journal_checkpoint", id, dirOf(key), epoch);
@@ -437,6 +442,9 @@ export function createJournalStore() {
         || typeof envelope !== "string" || !envelope.length) {
       return err("journal_checkpoint", id, "invalid_checkpoint", "A checkpoint needs a revision and its envelope.");
     }
+    // Refused before anything is written, so a bad marker never leaves a
+    // checkpoint on disk that the store's state does not know about.
+    if (saved != null && !validSaved(saved)) return err("journal_checkpoint", id, "invalid_saved", "A save marker needs two SHA-256 digests.");
     let st;
     try { st = stateOf(key); } catch (e) { return err("journal_checkpoint", id, "io", e.message); }
     const rev = Math.trunc(revision);
@@ -464,6 +472,13 @@ export function createJournalStore() {
       stored.gaps = [...(stored.gaps ?? []), gap];
     }
     if (meta && typeof meta === "object" && Object.keys(meta).length) stored.display = meta;
+    // N3: a Save rides on a checkpoint and says what it wrote — two digests,
+    // the document's content and the file's bytes. It is kept apart from
+    // `display` because the next opening's journal_open replaces `display`
+    // before it loads, and this is exactly what that opening needs to read.
+    // Content-addressed, so it is never cleared: a later edit simply stops it
+    // matching. Anything malformed is refused rather than stored half-read.
+    if (saved != null) stored.saved = { model: saved.model, file: saved.file, at: Date.now() };
     try { writeMeta(st.dir, stored); } catch { /* the checkpoint still stands */ }
     st.checkpoint = rev;
     st.last = rev;
@@ -501,6 +516,7 @@ export function createJournalStore() {
     return { type: "journal_load", id, key, aliases: meta.aliases ?? [],
       checkpointRevision: st.checkpoint, durableRevision: st.last,
       more, repaired: st.repaired === true, gaps: meta.gaps ?? [], pins: pinsOf(st.dir),
+      saved: validSaved(meta.saved) ? meta.saved : null,
       __raw: { records, checkpoint: envelope } };
   };
 
@@ -691,7 +707,7 @@ export function createJournalStore() {
       case "journal_probe": return probe(cmd.id, cmd.key);
       case "journal_append": return append(cmd.id, cmd.key, cmd.records, cmd.epoch);
       case "journal_checkpoint": return checkpoint(cmd.id, cmd.key, cmd.revision, cmd.generation, cmd.envelope,
-        cmd.meta && typeof cmd.meta === "object" ? cmd.meta : null, cmd.rebase === true, cmd.epoch);
+        cmd.meta && typeof cmd.meta === "object" ? cmd.meta : null, cmd.rebase === true, cmd.epoch, cmd.saved ?? null);
       case "journal_archive": return archive(cmd.id, cmd.key);
       case "journal_rename": return rename(cmd.id, cmd.from, cmd.to);
       case "journal_load": return load(cmd.id, cmd.key, cmd.afterRevision);

package/host/planes/choose.mjs

@@ -50,7 +50,12 @@ import { PAGE_ONLY_CLASSES } from "../server.mjs";
 import { canonicalPath, fsAbs, makeRoot } from "./files.mjs";
 
 export const CHOOSE_MODES = Object.freeze(["file", "files", "dir", "save"]);
-const OPS = ["choose"];
+// `choose_cancel` closes the panel the SAME page opened, from the page: the
+// panel can open behind the window or on another Space, and a page that says
+// "a panel is open on your desktop" must also offer a way out of it
+// (FINDINGS 2026-09-22 B6). Answered as a plain cancel, not an error.
+const OPS = ["choose", "choose_cancel"];
+const PAGE_CANCEL = "cancelled from the page";
 /** The env suffix that overrides each tool's binary (BEATRINA_<suffix>). */
 const TOOL_ENV = Object.freeze({ osascript: "OSASCRIPT", powershell: "POWERSHELL", zenity: "ZENITY", kdialog: "KDIALOG" });
 /** Output kept per stream: a path list is small; a runaway tool is not. */
@@ -342,6 +347,11 @@ export function createPlane({ env, audit }) {
         audit("choose-refused", { reason: "class", class: rec.class || "unknown" });
         return reply({ error: "Only the local notebook page may open the file panel." });
       }
+      if (cmd.type === "choose_cancel") {
+        const had = !!(open && open.rec === rec && alive(open.child));
+        if (had) kill(PAGE_CANCEL);
+        return reply({ ok: true, closed: had });
+      }
       const req = readChooseRequest(cmd);
       if (req.error) return reply({ error: req.error });
       if (flagged) return reply({ unsupported: true, reason: offReason });
@@ -382,7 +392,8 @@ export function createPlane({ env, audit }) {
       };
       child.on("error", (e) => finish({ error: `The file panel could not start: ${e.message}` }));
       child.on("close", (status, signal) => {
-        if (mine.killed) return finish({ error: `The file panel was closed (${mine.killed}).` });
+        if (mine.killed) return finish(mine.killed === PAGE_CANCEL ? { cancelled: true }
+          : { error: `The file panel was closed (${mine.killed}).` });
         const read = readChooserResult(spec.tool, req.mode, { status, signal, stdout, stderr });
         if (read.cancelled || read.error) return finish(read);
         finish(validateChosen(req.mode, read, { root }));

package/host/planes/expect-term.mjs

@@ -0,0 +1,102 @@
+// expect-term.mjs — a REAL pty for the terminal, without a native module.
+//
+// A packaged Beatrina executable can load no native module, so node-pty is
+// never there and the terminal fell to plain pipes: "This terminal has no pty:
+// line programs work; full-screen programs and password prompts do not"
+// (FINDINGS 2026-09-22 B8, the installed app). But the machine usually has a
+// pty provider of its own: `expect` (Tcl) ships with macOS and is one package
+// away on Linux, and its whole job is to run a program on a pseudo-terminal
+// while reading and writing plain pipes. Measured on macOS 15: `tty` answers
+// /dev/ttys001, `stty size` the size asked for, and `read -s` hides a
+// password as a terminal should.
+//
+// The shape is node-pty's IPty (pid · pty · onData · onExit · write · resize ·
+// kill), so host/planes/terminal.mjs keeps one code path:
+//   · write: raw bytes into the pty — Enter, ^C, ^D, arrows mean what they
+//     mean at a terminal, because the line discipline is real;
+//   · resize: a private escape sequence the expect script intercepts and turns
+//     into `stty rows … columns …` on the pty, which is what makes the kernel
+//     deliver SIGWINCH to the foreground program;
+//   · kill: the expect process group; the shell, in its own session on the
+//     pty, gets the hangup a closed terminal gives.
+
+import { spawn } from "node:child_process";
+
+/** The escape a resize travels as; nothing a person types can produce it. */
+export const RESIZE_PREFIX = "\x1b]beatrina-resize;";
+
+/**
+ * The expect program. It reads its parameters from the environment rather
+ * than from a command line, so a shell path with a space or a quote is never
+ * pasted into Tcl source: BEATRINA_TERM_ARGV is the argument vector joined by
+ * TAB (a TAB cannot occur in a path we would run), and the size is two numbers.
+ */
+export const EXPECT_SCRIPT = [
+  "log_user 1",
+  "set stty_init \"rows $env(BEATRINA_TERM_ROWS) columns $env(BEATRINA_TERM_COLS)\"",
+  "set argl [split $env(BEATRINA_TERM_ARGV) \"\\t\"]",
+  "spawn -noecho {*}$argl",
+  "set slave $spawn_out(slave,name)",
+  "interact {",
+  "  -re \"\\033\\\\\\]beatrina-resize;(\\[0-9\\]+);(\\[0-9\\]+)\\007\" {",
+  "    catch {stty rows $interact_out(2,string) columns $interact_out(1,string) < $slave}",
+  "  }",
+  "}",
+  "catch {wait} result",
+  "exit [lindex $result 3]",
+].join("\n");
+
+/**
+ * Start `file args…` on a pty through expect.
+ *
+ * @param {string} expectBin   the expect executable (whichSync("expect"))
+ * @param {string} file
+ * @param {string[]} args
+ * @param {{cwd?: string, env?: object, cols?: number, rows?: number, spawnImpl?: Function, signal?: Function}} opts
+ * @returns {{pid:number, pty:true, onData:Function, onExit:Function, write:Function, resize:Function, kill:Function}}
+ */
+export function expectSpawn(expectBin, file, args, opts = {}) {
+  const spawnImpl = opts.spawnImpl || spawn;
+  const signal = opts.signal || ((pid, sig) => process.kill(pid, sig));
+  const cols = Math.round(Number(opts.cols) || 100);
+  const rows = Math.round(Number(opts.rows) || 30);
+  const argv = [file, ...(args || [])];
+  if (argv.some((a) => String(a).includes("\t"))) throw new Error("a terminal argument contains a TAB");
+  const child = spawnImpl(expectBin, ["-c", EXPECT_SCRIPT], {
+    cwd: opts.cwd,
+    env: { ...(opts.env || process.env), BEATRINA_TERM_ARGV: argv.join("\t"),
+      BEATRINA_TERM_COLS: String(cols), BEATRINA_TERM_ROWS: String(rows) },
+    stdio: ["pipe", "pipe", "pipe"],
+    detached: true,
+  });
+  const dataFns = [];
+  const exitFns = [];
+  const emit = (d) => dataFns.forEach((fn) => { try { fn(d); } catch { /* a listener must not break the stream */ } });
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", emit);
+  child.stderr.on("data", emit);
+  child.stdin.on("error", () => { /* the terminal has gone; exit says so */ });
+  let exited = false;
+  const done = (exitCode) => { if (exited) return; exited = true; exitFns.forEach((fn) => fn({ exitCode })); };
+  child.on("exit", (code) => done(code));
+  child.on("error", (e) => { emit(`[the terminal could not start: ${e.message}]\r\n`); done(null); });
+  return {
+    pid: child.pid,
+    pty: true,
+    onData: (fn) => { dataFns.push(fn); },
+    onExit: (fn) => { exitFns.push(fn); },
+    write(text) { try { child.stdin.write(String(text)); } catch { /* gone */ } },
+    resize(c, r) {
+      const cc = Math.round(Number(c)), rr = Math.round(Number(r));
+      if (!(cc > 0) || !(rr > 0)) return;
+      try { child.stdin.write(`${RESIZE_PREFIX}${cc};${rr}\x07`); } catch { /* gone */ }
+    },
+    kill() {
+      try { signal(-child.pid, "SIGKILL"); } catch { /* the group is gone */ }
+      try { signal(child.pid, "SIGKILL"); } catch { /* gone */ }
+    },
+  };
+}
+
+export default expectSpawn;

package/host/planes/terminal.mjs

@@ -30,6 +30,8 @@ import path from "node:path";
 import { createRequire } from "node:module";
 import { killProcessTree } from "./proc-tree.mjs";
 import { PIPE_NOTICE, pipeShell, pipeSpawn } from "./pipe-term.mjs";
+import { expectSpawn } from "./expect-term.mjs";
+import { whichSync } from "../which.mjs";
 import { envSetName, mirrorEnv } from "../env-names.mjs";
 
 const MAX_TERMS = 4;
@@ -123,6 +125,7 @@ export function createPlane({ env, audit }) {
   const terms = new Map();
   let seq = 0;
   let loaded = null;                       // lazy: a kernel that never opens one pays nothing
+  let expectBin;                           // undefined: not yet looked for; "" when there is none
   let ctxRef = null;
   const ctxPort = () => (ctxRef ? ctxRef.port() : 0);
 
@@ -181,7 +184,17 @@ export function createPlane({ env, audit }) {
     if (scalarChr(cmd.cwd) && cmd.cwd) {
       try { if (fs.statSync(cmd.cwd).isDirectory()) wd = cmd.cwd; } catch { /* keep the kernel's cwd */ }
     }
-    const usePipe = !loaded.pty;
+    // THREE rungs: node-pty; else `expect`, which ships with macOS and runs a
+    // program on a real pty over plain pipes (host/planes/expect-term.mjs) —
+    // the packaged app, which can load no native module, gets a real terminal
+    // from it (FINDINGS 2026-09-22 B8); else the pipe. BEATRINA_TERMINAL_EXPECT=0
+    // skips the middle rung, which is how a machine with expect tests the pipe.
+    if (expectBin === undefined) {
+      expectBin = loaded.pty || process.platform === "win32" || env("BEATRINA_TERMINAL_EXPECT") === "0"
+        ? "" : whichSync("expect");
+    }
+    const useExpect = !loaded.pty && !!expectBin;
+    const usePipe = !loaded.pty && !useExpect;
     const sh = usePipe ? pipeShell(process.env) : termShell(process.env);
     const argv = usePipe ? { file: sh.cmd, args: sh.args } : termArgv(sh);
     // The shell runs in the PHYSICAL directory (processx resolves the wd for
@@ -191,16 +204,16 @@ export function createPlane({ env, audit }) {
     let real = wd;
     try { real = fs.realpathSync(wd); } catch { real = wd; }
     let term;
+    const ptyEnv = () => mirrorEnv({ ...process.env, TERM: "xterm-256color", COLORTERM: "truecolor",
+      COLUMNS: String(cols), LINES: String(rows), BEATRINA_PORT: String(ctxPort()) });
     try {
-      term = usePipe
+      term = useExpect
+        ? expectSpawn(expectBin, argv.file, argv.args, { cols, rows, cwd: real, env: ptyEnv() })
+        : usePipe
         ? pipeSpawn(argv.file, argv.args, { cwd: real,
           env: mirrorEnv({ ...process.env, TERM: "dumb", COLUMNS: String(cols), LINES: String(rows), BEATRINA_PORT: String(ctxPort()) }) })
-        : loaded.pty.spawn(argv.file, argv.args, {
-          name: "xterm-256color", cols, rows, cwd: real,
-          // The shell sees BEATRINA_PORT and, mirrored, its older spelling (a script written before the rename).
-          env: mirrorEnv({ ...process.env, TERM: "xterm-256color", COLORTERM: "truecolor",
-            COLUMNS: String(cols), LINES: String(rows), BEATRINA_PORT: String(ctxPort()) }),
-        });
+        // The shell sees BEATRINA_PORT and, mirrored, its older spelling (a script written before the rename).
+        : loaded.pty.spawn(argv.file, argv.args, { name: "xterm-256color", cols, rows, cwd: real, env: ptyEnv() });
     } catch (e) { return refuse(`the shell could not start: ${e.message}`); }
 
     seq += 1;
@@ -218,7 +231,8 @@ export function createPlane({ env, audit }) {
       audit("term-exit", { id, detail: String(exitCode) });
       send(rec, id, { event: "exit", code: exitCode ?? null, reason: "exited" });
     });
-    audit("term-open", { id, detail: sh.cmd, class: rec.class ?? "unknown", pty: !usePipe });
+    audit("term-open", { id, detail: sh.cmd, class: rec.class ?? "unknown", pty: !usePipe,
+      via: loaded.pty ? "node-pty" : useExpect ? "expect" : "pipe" });
     send(rec, id, { event: "open", shell: sh.cmd, pid: term.pid, cols, rows, cwd: wd, pty: !usePipe });
     if (usePipe) {
       if (loaded.error) audit("term-pipe", { id, detail: loaded.error });