conductor-remote 1.117.0 → 1.118.0

package/dist-node/src/writes/applescript/workspace-targeting.applescript

@@ -0,0 +1,359 @@
+
+on sidebarLinks()
+	-- The sidebar rows are AXLinks named "<repo> <title> +adds -dels". They live
+	-- two levels under the web area; collect them wherever they are at that depth.
+	--
+	-- `get` in front of each `whose` clause is load-bearing, and it is the whole
+	-- cost of this handler. Without it the clause stays a *reference*, so pulling
+	-- the elements out of it one at a time re-runs the filter against the live tree
+	-- for each one: measured on a 45-row sidebar, walking the references cost
+	-- 10.8s against 0.9s for the same query forced to a list once. That is paid by
+	-- every send the deep link doesn't answer and by every status change, which has
+	-- no path but this one.
+	set wa to my webArea()
+	tell application "System Events" to tell process "Conductor"
+		set out to {}
+		repeat with a in (UI elements of wa)
+			try
+				set out to out & (get UI elements of a whose role is "AXLink")
+				repeat with b in (UI elements of a)
+					set out to out & (get UI elements of b whose role is "AXLink")
+				end repeat
+			end try
+		end repeat
+		return out
+	end tell
+end sidebarLinks
+
+on findSidebarRowOnce()
+	set titles to my targetSidebarTitles()
+	if (count of titles) is 0 then return missing value
+	set repoName to system attribute "RELAY_WS_REPO"
+	set pair to my sidebarRowsAndNames()
+	set refs to item 1 of pair
+	set nms to item 2 of pair
+	set total to count of refs
+	if total is 0 or (count of nms) is not total then return missing value
+	repeat with candidate in titles
+		set needle to candidate as text
+		if needle is not "" then
+			set hits to {}
+			repeat with i from 1 to total
+				set rowName to my textOrEmpty(item i of nms)
+				if rowName contains needle then
+					if repoName is "" or rowName contains repoName then set end of hits to i
+				end if
+			end repeat
+			if (count of hits) is 1 then
+				set idx to item 1 of hits
+				set hit to item idx of refs
+				-- The references and the names are two reads, so a sidebar that
+				-- re-rendered between them (every commit rewrites a row's
+				-- "+adds -dels") would have shifted the index under us — and pressing
+				-- the neighbour sets the wrong workspace's status, which is the one
+				-- failure this whole file is built to refuse. Confirm the element
+				-- still carries the name it was picked for.
+				if (my axName(hit)) is (my textOrEmpty(item idx of nms)) then return hit
+				return missing value
+			end if
+		end if
+	end repeat
+	return missing value
+end findSidebarRowOnce
+
+on findSidebarRow()
+	-- The workspace's own sidebar row. Only rows that are actually rendered exist
+	-- in the AX tree (a collapsed section has none — expandSections is what opens
+	-- those), and the title follows Conductor's precedence, so we try each
+	-- candidate and require a *unique* hit — anything ambiguous returns nothing
+	-- rather than guessing at a neighbour. Two passes because the only thing that
+	-- fails the check inside is a sidebar that moved mid-read, and that is worth
+	-- one cheap retry.
+	set hit to my findSidebarRowOnce()
+	if hit is not missing value then return hit
+	return my findSidebarRowOnce()
+end findSidebarRow
+
+on textOrEmpty(v)
+	try
+		if v is missing value then return ""
+		return v as text
+	on error
+		return ""
+	end try
+end textOrEmpty
+
+on childRoles(el)
+	-- Every child's role in *one* Apple event. Every AX read here is a round trip
+	-- to another process, so asking element by element is what turned a sidebar
+	-- scan into 15 seconds — more, by itself, than this write's whole budget.
+	tell application "System Events" to tell process "Conductor"
+		try
+			return role of (UI elements of el)
+		on error
+			return {}
+		end try
+	end tell
+end childRoles
+
+on childRolesAndNames(el)
+	tell application "System Events" to tell process "Conductor"
+		try
+			return {role of (UI elements of el), name of (UI elements of el)}
+		on error
+			return {{}, {}}
+		end try
+	end tell
+end childRolesAndNames
+
+on looksLikeSidebarList(el)
+	-- The sidebar's workspace list is one flat run of section headers
+	-- (AXStaticText) and workspace rows (AXLink), with nothing else beside them.
+	-- That shape is the whole test, because the *transcript* hangs off the same
+	-- web area and holds AXLinks of its own — "the element with links in it"
+	-- would happily hand back a message bubble, and every press below would then
+	-- land in one.
+	set roleList to my childRoles(el)
+	if (count of roleList) is 0 then return false
+	set seenLink to false
+	repeat with r in roleList
+		set rt to my textOrEmpty(contents of r)
+		if rt is "AXLink" then
+			set seenLink to true
+		else if rt is not "AXStaticText" then
+			return false
+		end if
+	end repeat
+	return seenLink
+end looksLikeSidebarList
+
+on sidebarList()
+	-- Found by that shape rather than by an index, since the chrome above it
+	-- (project pickers, the resource-usage button) comes and goes. Two levels
+	-- deep, the same reach sidebarLinks() uses.
+	set wa to my webArea()
+	repeat with a in (my axKids(wa))
+		set nodeA to contents of a
+		if my looksLikeSidebarList(nodeA) then return nodeA
+		repeat with b in (my axKids(nodeA))
+			set nodeB to contents of b
+			if my looksLikeSidebarList(nodeB) then return nodeB
+		end repeat
+	end repeat
+	return missing value
+end sidebarList
+
+on sidebarRowsAndNames()
+	-- Every sidebar row paired with its name. Two Apple events off the list found
+	-- above, against one per row before.
+	set listEl to my sidebarList()
+	if listEl is not missing value then
+		tell application "System Events" to tell process "Conductor"
+			try
+				return {(UI elements of listEl whose role is "AXLink"), name of (UI elements of listEl whose role is "AXLink")}
+			end try
+		end tell
+	end if
+	-- No list matched the shape, so Conductor has reorganised its sidebar. Fall
+	-- back to the broad two-level sweep and one name read per row: slow, and the
+	-- reason the fast path exists, but it assumes nothing about the layout.
+	set refs to my sidebarLinks()
+	set nms to {}
+	repeat with entry in refs
+		set end of nms to my axName(contents of entry)
+	end repeat
+	return {refs, nms}
+end sidebarRowsAndNames
+
+on looksNumeric(t)
+	-- A folded section draws its row count where its rows would be. That number is
+	-- a sibling of the header, not a child of it, so it has to be told apart from a
+	-- header by hand — digits only, which no status or repo name is.
+	if t is "" then return false
+	repeat with c in (characters of t)
+		if "0123456789" does not contain (c as text) then return false
+	end repeat
+	return true
+end looksNumeric
+
+on collapsedSectionNames()
+	-- The sections someone has folded shut. A section's rows are *siblings* of
+	-- its header, so an expanded one is followed by an AXLink and a collapsed one
+	-- by its count, by the next header, or by nothing — and a collapsed section
+	-- renders no rows at all, which is why its workspaces are invisible to
+	-- Accessibility. Names, not element references: everything below re-finds the
+	-- header when it needs it, because the list re-renders under us (a status
+	-- change moves a row to another group) and a System Events reference is an
+	-- index into a tree that has already changed.
+	set listEl to my sidebarList()
+	if listEl is missing value then return {}
+	set pair to my childRolesAndNames(listEl)
+	set roleList to item 1 of pair
+	set nameList to item 2 of pair
+	set total to count of roleList
+	if total is 0 or (count of nameList) is not total then return {}
+	set out to {}
+	repeat with i from 1 to total
+		if (my textOrEmpty(item i of roleList)) is "AXStaticText" then
+			set nm to my textOrEmpty(item i of nameList)
+			if nm is not "" and not (my looksNumeric(nm)) then
+				set nextRole to ""
+				if i < total then set nextRole to my textOrEmpty(item (i + 1) of roleList)
+				if nextRole is not "AXLink" then set end of out to nm
+			end if
+		end if
+	end repeat
+	return out
+end collapsedSectionNames
+
+on sectionHeaderNamed(wanted)
+	-- Unique or nothing, like every other lookup here: two sections cannot share
+	-- a name, so an ambiguous hit means we are reading the wrong list.
+	set listEl to my sidebarList()
+	if listEl is missing value then return missing value
+	tell application "System Events" to tell process "Conductor"
+		try
+			set hits to (UI elements of listEl whose role is "AXStaticText" and name is wanted)
+		on error
+			return missing value
+		end try
+	end tell
+	if (count of hits) is 1 then return item 1 of hits
+	return missing value
+end sectionHeaderNamed
+
+on toggleSection(headerName)
+	set head to my sectionHeaderNamed(headerName)
+	if head is missing value then return false
+	tell application "System Events" to tell process "Conductor"
+		try
+			perform action "AXScrollToVisible" of head
+		end try
+		try
+			perform action "AXPress" of head
+			return true
+		on error
+			return false
+		end try
+	end tell
+end toggleSection
+
+on expandSections()
+	-- Open every folded section and report which ones we opened, so the caller can
+	-- put the sidebar back the way it found it. The header is the whole control —
+	-- it carries AXPress and toggles the group — so this needs no chevron, which
+	-- the webview does not expose anyway.
+	set opened to {}
+	repeat with nm in (my collapsedSectionNames())
+		if my toggleSection(nm as text) then set end of opened to (nm as text)
+	end repeat
+	if (count of opened) > 0 then delay 0.6
+	return opened
+end expandSections
+
+on restoreSections(names)
+	-- Fold back exactly what we opened. Best-effort on purpose: this runs after
+	-- the write has already landed, so a header that moved or vanished must not
+	-- turn a status change that worked into a reported failure.
+	repeat with nm in names
+		try
+			my toggleSection(nm as text)
+		end try
+	end repeat
+end restoreSections
+
+on focusViaSidebar()
+	-- Press that row: no keystrokes at all, so nothing can be swallowed by a
+	-- focused field or fire a palette *command*. Being wrong is survivable here —
+	-- assertWorkspace re-checks before we type — and a miss falls back to the palette.
+	set hit to my findSidebarRow()
+	if hit is missing value then return false
+	tell application "System Events" to tell process "Conductor"
+		perform action "AXPress" of hit
+	end tell
+	delay 0.9
+	return true
+end focusViaSidebar
+
+on focusViaPalette()
+	tell application "System Events"
+		key code 53
+		delay 0.25
+		keystroke "k" using {command down}
+		delay 0.7
+		keystroke (my targetField(2))
+		delay 0.9
+		key code 36
+		delay 1.3
+	end tell
+end focusViaPalette
+
+on paneAgrees()
+	-- Nothing in the open pane contradicts the target: a chat pane is there and its
+	-- header assertion passed (which is a no-op when there's no branch to check it
+	-- against). This is what confirms a sidebar press landed.
+	try
+		set strips to my tabGroups()
+		if (count of strips) is 0 then return false
+		my assertWorkspace(item 1 of strips)
+		return true
+	end try
+	return false
+end paneAgrees
+
+on atTargetWorkspace()
+	-- "Are we already there?" — the *strict* form of the question, so it needs a
+	-- branch to have been checked and not merely skipped. Worth asking first because
+	-- the pane header answers in ~0.5s where reading the sidebar's rows to press one
+	-- measured 5-7s, and ~1s since that scan went to bulk reads — still the larger
+	-- cost of the two: a phone sends to the same workspace over and over, and
+	-- Conductor stays where it was left. Safe as a shortcut because it *is* the
+	-- assertion the send makes before typing anyway.
+	if (system attribute "RELAY_WS_BRANCH") is "" then return false
+	return my paneAgrees()
+end atTargetWorkspace
+
+on openViaDeepLink()
+	-- Conductor's *own* workspace link, the one its sidebar row menu copies under
+	-- "Copy link" (Cmd+Shift+C): one URL carrying the workspace id and the chat id,
+	-- addressed the way the relay already reads them rather than by any label a
+	-- release can rename. It replaces the entire focus dance below - no sidebar
+	-- scan, no palette keystrokes, no title precedence to reproduce - and measures
+	-- ~0.6s against the 5-10s the row press costs on a 30-workspace sidebar.
+	--
+	-- Two things it fixes outright rather than merely speeding up. It navigates by
+	-- *id*, so a collapsed sidebar section (which hides the row from Accessibility
+	-- entirely) stops mattering; and it opens the chat tab explicitly, so a pane
+	-- left on a file view or a terminal - where the chat strip does not exist in
+	-- the AX tree at all, and every send failed with "couldn't identify the chat
+	-- tab strip" - comes back to the composer on its own.
+	--
+	-- Still fail-closed: the URL is fire-and-forget, so what counts as success is
+	-- the same pane assertion every other path here has to pass. A Conductor
+	-- without the route (before 0.71) ignores it silently, and a scheme macOS
+	-- can't resolve fails the "open" outright - both fall through to the sidebar.
+	set linkURL to system attribute "RELAY_WS_LINK"
+	if linkURL is "" then return false
+	try
+		do shell script "open " & quoted form of linkURL
+	on error
+		return false
+	end try
+	-- Bounded on purpose: this poll is also the cost of *not* having the route, and
+	-- the fallback below still has to run inside the same budget afterwards.
+	repeat with attempt from 1 to 10
+		delay 0.15
+		if my paneAgrees() then return true
+	end repeat
+	return false
+end openViaDeepLink
+
+on focusWorkspace()
+	if (my targetField(2)) is "" then return
+	if my openViaDeepLink() then return
+	if my atTargetWorkspace() then return
+	if my focusViaSidebar() then
+		if my paneAgrees() then return
+	end if
+	my focusViaPalette()
+end focusWorkspace

package/dist-node/src/writes/chats.js

@@ -0,0 +1,160 @@
+import { MAC_LOCKED } from "../shared.js";
+import { screenLocked } from "./guards.js";
+import { CONDUCTOR_HANDLERS, osaError, SEND_ATTEMPT_MS } from "./runner.js";
+import { focusQuery, withTargetEnvironment, workspaceLink } from "./targeting.js";
+import { exec, uiTurn } from "./ui-lock.js";
+/**
+ * Stop the answer a chat is streaming — the desktop app's stop button, reached
+ * through the same focus-and-assert path as a send and then Conductor's own
+ * "Cancel agent" shortcut (see `cancelAgent` in src/writes/applescript/lifecycle.applescript for why a
+ * keystroke rather than the button).
+ *
+ * The branch is required rather than optional. Everywhere else a workspace with
+ * no branch merely loses the pane assertion; here that assertion is the only thing
+ * standing between "stop this agent" and "throw away a different agent's turn", so
+ * a target that can't be checked is refused instead of aimed.
+ *
+ * Nothing is confirmed here: `sessions.status` leaving `working` is the receipt and
+ * src/http/routes/sessions.ts waits for it, the same way agent settings are confirmed against the DB
+ * rather than against the UI that was just driven.
+ */
+export async function stopTurn(target) {
+    if (!target.workspace.branch) {
+        return { ok: false, strategy: 'applescript', error: 'workspace has no branch to focus' };
+    }
+    const script = `
+${CONDUCTOR_HANDLERS}
+
+my activateConductor()
+my focusWorkspace()
+my selectChatTab()
+my cancelAgent()
+return "ok"`.trim();
+    try {
+        await withTargetEnvironment(target, targetEnvironment => uiTurn(() => exec('osascript', ['-e', script], {
+            env: { ...process.env, ...targetEnvironment },
+            timeout: SEND_ATTEMPT_MS
+        })));
+        return { ok: true, strategy: 'applescript' };
+    }
+    catch (err) {
+        return { ok: false, strategy: 'applescript', error: osaError(err) };
+    }
+}
+/**
+ * Hide one chat through Conductor's own Close tab action (Command-W).
+ *
+ * Like `stopTurn`, the branch is required because Command-W acts on whatever has
+ * keyboard focus. `selectChatTab` proves the target and `closeChatTab` moves focus
+ * back out of the terminal before pressing it. Closing is reversible in Conductor,
+ * but a running chat still gets its desktop confirmation: `closeRunning` is the
+ * caller's explicit answer to that prompt, never something this layer infers.
+ *
+ * The script only reports that it pressed the action. `sessions.is_hidden` is the
+ * receipt; src/http/routes/sessions.ts waits until `Reads.listSessions` no longer returns this id.
+ */
+export async function closeChat(target, closeRunning) {
+    if (!target.workspace.branch) {
+        return { ok: false, strategy: 'applescript', error: 'workspace has no branch to focus' };
+    }
+    const script = `
+${CONDUCTOR_HANDLERS}
+
+my activateConductor()
+my focusWorkspace()
+my selectChatTab()
+my closeChatTab()
+return "ok"`.trim();
+    try {
+        await withTargetEnvironment(target, targetEnvironment => uiTurn(() => exec('osascript', ['-e', script], {
+            env: {
+                ...process.env,
+                ...targetEnvironment,
+                RELAY_CLOSE_RUNNING: closeRunning ? '1' : ''
+            },
+            timeout: SEND_ATTEMPT_MS
+        })));
+        return { ok: true, strategy: 'applescript' };
+    }
+    catch (err) {
+        return { ok: false, strategy: 'applescript', error: osaError(err) };
+    }
+}
+/**
+ * Conductor's workspace route restores a hidden session before selecting it.
+ * Keep the UI lease through the DB receipt: another focus operation must not
+ * navigate away while Conductor's asynchronous route handler is unhiding it.
+ * The callback is deliberately exact-id and read-only, supplied by the server.
+ */
+export async function restoreChat(workspaceId, sessionId, isVisible) {
+    return uiTurn(async () => {
+        if (isVisible())
+            return { ok: true, strategy: 'deep-link', alreadyOpen: true };
+        if ((await screenLocked()) === true) {
+            return { ok: false, strategy: 'deep-link', error: `${MAC_LOCKED}. Unlock it, then try again.` };
+        }
+        try {
+            await exec('open', [workspaceLink(workspaceId, sessionId)], { timeout: 5_000 });
+            for (let attempt = 0; attempt < 40; attempt++) {
+                await new Promise(resolve => setTimeout(resolve, 250));
+                if (isVisible())
+                    return { ok: true, strategy: 'deep-link' };
+            }
+            return {
+                ok: false,
+                strategy: 'deep-link',
+                error: 'Conductor has not restored this tab yet. Try again, or update Conductor on your Mac.'
+            };
+        }
+        catch (error) {
+            return { ok: false, strategy: 'deep-link', error: osaError(error) };
+        }
+    });
+}
+/**
+ * Open a new chat in the target workspace — Conductor's "New chat, same files"
+ * (Cmd+T). Focuses the workspace first (its own link, see `workspaceLink`), then
+ * Cmd+T; the caller detects the freshly-created session id from the DB.
+ *
+ * The pane is asserted before the keystroke for the same reason a send asserts before
+ * typing: `focusWorkspace` confirms every route it takes except its last one, the
+ * palette, and Cmd+T against an unconfirmed pane opens a tab in someone else's
+ * workspace. Nothing catches that afterwards — the caller looks for the new session in
+ * *this* workspace's tab list, so a stray tab reads as "the id could not be read back"
+ * while sitting in a conversation nobody asked to change.
+ *
+ * Cmd+L ("Focus chat input") goes first for the reason `cancelAgent` does the same: a
+ * keystroke lands wherever focus is, and a focused terminal panel swallows this one.
+ * Measured live before the fix — the run reported success, `sessions` gained nothing,
+ * and `terminal_sessions` gained a row in this very workspace at the second the chord
+ * was sent. Both chords are Conductor's own, confirmed against its Cmd+/ dialog.
+ */
+export async function newChat(workspace) {
+    if (!focusQuery(workspace))
+        return { ok: false, strategy: 'applescript', error: 'workspace has no branch to focus' };
+    const script = `
+${CONDUCTOR_HANDLERS}
+
+my activateConductor()
+my focusWorkspace()
+set strips to my tabGroups()
+if (count of strips) is 0 then error "couldn't find the chat pane to open a tab in"
+my assertWorkspace(item 1 of strips)
+tell application "System Events"
+	keystroke "l" using {command down}
+	delay 0.2
+	keystroke "t" using {command down}
+end tell`.trim();
+    try {
+        // Shares the focus path with a send, so it needs the same ceiling: 15s was under
+        // the cost of activating a cold Conductor and finding the row on its own.
+        await withTargetEnvironment({ workspace, sessionId: null }, targetEnvironment => uiTurn(() => exec('osascript', ['-e', script], {
+            env: { ...process.env, ...targetEnvironment },
+            timeout: SEND_ATTEMPT_MS
+        })));
+        return { ok: true, strategy: 'applescript' };
+    }
+    catch (err) {
+        return { ok: false, strategy: 'applescript', error: osaError(err) };
+    }
+}

package/dist-node/src/writes/guards.js

@@ -0,0 +1,77 @@
+import { isLockedError } from "../shared.js";
+import { exec } from "./ui-lock.js";
+/**
+ * Failures no amount of retrying will fix, so a caller that retries can stop at
+ * once instead of spending a whole budget to arrive at the same sentence.
+ *
+ * Matched on phrases this file writes itself — the first two from `refusalReason`,
+ * the rest from the target checks below — never on macOS's own wording, which we
+ * quote verbatim precisely because it drifts. The refusals are the ones a node
+ * upgrade causes by silently revoking Accessibility: they fail instantly and
+ * identically every time, so making the phone sit through a whole retry budget to
+ * be told a permission is missing is worse than being told at once. The rest are
+ * malformed targets — no session, no branch — which no attempt can turn into one.
+ */
+const TERMINAL_ERRORS = [
+    'not trusted for Accessibility',
+    'blocked the relay from controlling the UI',
+    'no session id to target',
+    'workspace has no branch to focus'
+];
+export function retryWontHelp(error) {
+    return error !== undefined && TERMINAL_ERRORS.some(phrase => error.includes(phrase));
+}
+/**
+ * A send that failed because the Mac's screen is locked. Deliberately *not* in
+ * `TERMINAL_ERRORS`: it isn't terminal (an unlock fixes it) but it also isn't a
+ * warm-up cost a retry loop should burn budget on — the caller parks the prompt
+ * instead (src/delivery/parked.ts) and the queue delivers it when the lock lifts. Matched
+ * on the phrase every lock refusal in src/writes/applescript/window.applescript starts with; the
+ * words are ours, so they can't drift under us the way macOS's can. The phrase
+ * itself lives in src/shared.ts because the phone matches it too — it is what
+ * puts the Screen Sharing link beside a refusal nobody else can clear.
+ */
+export function lockBlocked(error) {
+    return isLockedError(error);
+}
+/**
+ * A run that ended with the prompt still sitting in Conductor's composer
+ * (`submitComposer`). The draft was never consumed, so this run wrote no row and
+ * the caller's confirm window has nothing to wait for — six seconds spent watching
+ * for something the run already proved didn't happen. Only the *waiting* is
+ * skipped: an earlier attempt's row can still be arriving, so the caller checks
+ * once before typing again.
+ *
+ * Matched on the phrase the send script writes itself, like `lockBlocked` above,
+ * so macOS wording can't drift under it.
+ */
+export function sendNeverStarted(error) {
+    return (error ?? '').includes('still sitting in its composer');
+}
+/**
+ * Node's own read of the lock screen — the same CGSessionCopyCurrentDictionary
+ * probe `screenLocked()` in src/writes/applescript/window.applescript makes, minus the AppleScript
+ * wrapper, so the parked-prompt queue can poll it without spinning up a whole
+ * UI script (and without needing Accessibility at all). `null` means the probe
+ * itself failed — callers should treat that as "try the send and let it tell
+ * you", not as either lock state.
+ */
+export async function screenLocked() {
+    // Keep in lockstep with `screenLocked()` in src/writes/applescript/window.applescript, traps and
+    // all: $.CFBridgingRelease segfaults under JXA, and without the bindFunction
+    // rebind deepUnwrap reads the CF dictionary as undefined — a silent "unlocked"
+    // on a locked Mac.
+    const jxa = "ObjC.import('CoreGraphics'); ObjC.bindFunction('CGSessionCopyCurrentDictionary', ['id', []]); const d = ObjC.deepUnwrap($.CGSessionCopyCurrentDictionary()) || {}; d.CGSSessionScreenIsLocked ? 'locked' : 'unlocked'";
+    try {
+        const { stdout } = await exec('osascript', ['-l', 'JavaScript', '-e', jxa], { timeout: 5_000 });
+        const out = stdout.trim();
+        if (out === 'locked')
+            return true;
+        if (out === 'unlocked')
+            return false;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist-node/src/writes/runner.js

@@ -0,0 +1,67 @@
+import { WorkflowGatedCommandError } from "../orchestration/workflow/effect-runner.js";
+import { readConductorAppleScript } from "./applescript/source.js";
+/**
+ * How long one AppleScript run may take before it's killed.
+ *
+ * Sized from measurement, not taste. A send that *worked* measured 23.6s end to
+ * end on a 30-workspace sidebar — past the 20s ceiling this replaces, which is why
+ * ordinary sends were being killed mid-run and reported as "Conductor took too long
+ * to respond". The cost is Accessibility round trips, not waiting: activating a
+ * backgrounded Conductor and reading the pane cost ~10s cold, and finding the
+ * sidebar row to press another ~10s.
+ *
+ * `openViaDeepLink` took the row scan out of the common path — a whole send now
+ * measures ~4s, and focusing alone ~2s against the ~18s the same focus costs when
+ * the link is unavailable — so this budget is really the *fallback's*, kept at the
+ * size that fallback still needs. A ceiling costs nothing when a send is fast; only
+ * a doomed one waits it out, and the caller's own deadline is what bounds that.
+ */
+export const SEND_ATTEMPT_MS = 28_000;
+/**
+ * A restart's own ceiling. It is longer than a send's because it is mostly *waiting*:
+ * up to 4s for the quit to be honoured, then a cold launch, then `waitForWindow(60)`'s
+ * 15s for the first window — none of which can be hurried, and all of which the caller
+ * would rather wait through than be told "try again" about.
+ */
+export const RESTART_ATTEMPT_MS = 45_000;
+/**
+ * A run's own ceiling, taken off the caller's deadline at the moment it actually
+ * starts.
+ *
+ * Both halves matter. `uiTurn` above means a run can sit in the queue behind
+ * another write, so a duration computed when it was *requested* would let a queued
+ * run overshoot a deadline the caller is still holding a phone open on.
+ * `SEND_ATTEMPT_MS` then caps it, because a caller with a minute of budget still
+ * shouldn't spend all of it on one doomed run when a retry is the thing that works.
+ * The floor keeps a squeezed run honest instead of passing `timeout: 0`, which node
+ * reads as "no timeout at all".
+ */
+export function runCeiling(deadline) {
+    return Math.max(5_000, Math.min(SEND_ATTEMPT_MS, deadline - Date.now()));
+}
+/**
+ * Every AppleScript handler the write path uses, assembled as one program from
+ * src/writes/applescript/. The source manifest also drives checking and copying.
+ *
+ * The source module resolves its sibling assets in both the checkout and the
+ * emitted package. Joining inserts nothing and trimming matches the original
+ * single-file loader, so every actuator appends to the same program as before.
+ * Read once at import, because a missing copy is a packaging bug and a relay that
+ * refuses to boot naming the missing assets is the loudest way to say so.
+ */
+export const CONDUCTOR_HANDLERS = readConductorAppleScript().trimEnd();
+/** osascript echoes the whole failing script back; keep just the reason for the phone. */
+export function osaError(err, timeoutMsg = 'Conductor took too long to respond') {
+    const raw = err instanceof WorkflowGatedCommandError
+        ? [err.message, err.stderr].filter(Boolean).join('\n')
+        : err instanceof Error
+            ? err.message
+            : String(err);
+    // A timeout kill carries no execution error at all — its first line is
+    // "Command failed: osascript -e" plus the whole script, which is useless here.
+    if ((err instanceof WorkflowGatedCommandError && err.code === 'timed_out') ||
+        (err && typeof err === 'object' && 'killed' in err && err.killed)) {
+        return timeoutMsg;
+    }
+    return raw.match(/execution error: (.+?) \(-?\d+\)/)?.[1] ?? raw.split('\n')[0];
+}

package/dist-node/src/{sidecar.js → writes/sidecar.js}

@@ -14,7 +14,7 @@ import path from 'node:path';
  * UI updates correctly because it's the real dispatch path. It is also the most
  * update-fragile surface (a private, versioned IPC), which is why it lives
  * behind the Actuator interface and falls back to AppleScript when the socket
- * can't be reached (see writes.ts).
+ * can't be reached (see src/writes/actuator.ts).
  *
  * Reverse-engineered from conductor-runtime (Conductor 0.76):
  *   - socket:      `$TMPDIR/conductor-sidecar-v2-<sidecarPid>.sock`