dsh-notch 0.3.1 → 0.3.4

package/tests/unread-hold.test.mjs

@@ -1,90 +0,0 @@
-import { test, after } from 'node:test'
-import assert from 'node:assert/strict'
-import os from 'node:os'
-import { mkdtempSync, rmSync } from 'node:fs'
-import { syncBuiltinESMExports } from 'node:module'
-
-const testDir = mkdtempSync(os.tmpdir() + '/notch-unread-')
-const realHomedir = os.homedir
-os.homedir = () => testDir
-syncBuiltinESMExports()
-const { Board } = await import('../src/board.ts')
-os.homedir = realHomedir
-syncBuiltinESMExports()
-after(() => rmSync(testDir, { recursive: true, force: true }))
-
-test('a single running task becomes a green unread lamp instead of vanishing', () => {
-  let running = true
-  const events = [{ type: 'turn/start', time: 1 }]
-  const session = {
-    id: 'session-one',
-    header: {},
-    snapshotEvents: () => events,
-  }
-  const ctx = {
-    sessions: { list: () => [session] },
-    agents: { get: () => ({ status: running ? 'running' : 'idle' }) },
-    get: () => undefined,
-    logger: { warn() {} },
-  }
-  const board = new Board(ctx)
-  assert.equal(board.snapshot('').rows[0].busy, true)
-
-  running = false
-  events.push({ type: 'turn/end', time: 2, data: { reason: { kind: 'completed' } } })
-  const done = board.snapshot('').rows[0]
-  assert.equal(done.busy, false)
-  assert.equal(done.unread, true)
-  assert.equal(board.snapshot('').rows[0].unread, true)
-
-  board.markSeen(session.id)
-  assert.equal(board.snapshot('').rows.length, 0)
-})
-
-test('clicking seen clears green even if the sidebar still says completed', () => {
-  let running = true
-  const events = [{ type: 'turn/start', time: 1 }]
-  const session = {
-    id: 'session-sidebar',
-    header: {},
-    snapshotEvents: () => events,
-  }
-  const ctx = {
-    sessions: { list: () => [session] },
-    agents: { get: () => ({ status: running ? 'running' : 'idle' }) },
-    get: () => undefined,
-    logger: { warn() {} },
-  }
-  const board = new Board(ctx)
-  board.snapshot('')
-  running = false
-  events.push({ type: 'turn/end', time: 2, data: { reason: { kind: 'completed' } } })
-  board.snapshot('')
-  board.syncSidebar({
-    clientId: 'app',
-    focused: true,
-    rows: [{ id: session.id, title: 'Done', running: false, completed: true }],
-  })
-  assert.equal(board.snapshot('').rows[0].unread, true)
-  board.markSeen(session.id)
-  assert.equal(board.snapshot('').rows.length, 0)
-})
-
-test('cold completed history is not replayed as green', () => {
-  const session = {
-    id: 'session-old',
-    header: {},
-    snapshotEvents: () => [
-      { type: 'turn/start', time: 1 },
-      { type: 'turn/end', time: 2, data: { reason: { kind: 'completed' } } },
-    ],
-  }
-  const ctx = {
-    sessions: { list: () => [session] },
-    agents: { get: () => ({ status: 'idle' }) },
-    get: () => undefined,
-    logger: { warn() {} },
-  }
-  const board = new Board(ctx)
-  assert.equal(board.snapshot('').rows.length, 0)
-})

package/tools/desktop-shell/README.md

@@ -1,56 +0,0 @@
-# Desktop renderer recovery
-
-This optional thin-shell patch prevents an unexpected renderer exit from leaving
-an existing DSH window permanently blank. It does **not** identify or fix the
-underlying long-idle renderer termination.
-
-The recovery controller listens to `render-process-gone`, including `clean-exit`.
-While the app/window remains open it reloads the original WebContents, preserves
-its navigation/auth context, requests a repaint after load, and records the result.
-It never starts, stops or restarts a Host. Two automatic attempts are allowed per
-minute; further exits and a 15-second load timeout go to a native error prompt.
-App quit/window close cancels pending work. The shell integration adds window and
-system idle metadata to bounded local diagnostic logs.
-
-`child-log.mjs` fixes a separate shutdown race: each child stdout/stderr stream
-pipes with `end: false` so EOF cannot close the shared desktop log before an exit
-callback writes to it. Logging errors cannot raise an uncaught main-process error.
-
-## Checks
-
-```sh
-node --test tools/desktop-shell/*.test.mjs tools/diagnostics/renderer-diagnostics.test.mjs
-"$DSH_TEST_ELECTRON" tools/desktop-shell/recovery-probe.cjs --baseline
-"$DSH_TEST_ELECTRON" tools/desktop-shell/recovery-probe.cjs
-```
-
-Use the target app's matching Electron executable. The baseline is expected to
-fail: it has no recovery handler. The repaired native integration fixture uses a
-temporary profile/static page, crashes only its own renderer, checks both visible
-and hidden windows twice, verifies an actual painted frame against its healthy
-baseline (including display color management), and verifies retry limiting.
-It never reads DSH conversations or invokes models. This is an Electron lifecycle
-test, not an alternative browser automation interface.
-
-## Package and activate
-
-`package-recovery.py <original-app.asar> <staging-directory>` produces a patched
-ASAR, readable main module, and input/output hash manifest. It requires the known
-thin-shell source shape with the earlier diagnostics hook and refuses an already
-patched or unfamiliar archive. Every unrelated archive entry is preserved and
-all output entry bytes are verified. To test packaged recovery, set
-`DSH_RECOVERY_MODULE` to the staged ASAR's `src/renderer-recovery.mjs` before the
-native probe. The script never installs or controls a process.
-
-Keep a verified copy of the original ASAR. Installation is a separate, authorized,
-atomic resource replacement after checking that the current archive still matches
-the reviewed input. Shell-main changes require a controlled App reopen. The current
-App owns its Host: do this only with the applicable task authorization and an idle
-runtime, and prove that the old Host exited before launching the original App.
-Once active, routine renderer recovery does not require another App/Host restart.
-Verify diagnostic attachment plus the actual conversation/composer through the
-normal app. A package checksum or a recovery log is not visual acceptance.
-
-For rollback, restore the exact preserved original archive and perform the same
-controlled App reopen. Never replace the user's checkout, history or Notch assets.
-Do not commit local logs, screenshots, session data or installed-artifact backups.

package/tools/desktop-shell/child-log.mjs

@@ -1,6 +0,0 @@
-// stdout and stderr (and sometimes several children) share one desktop log.
-// EOF belongs to an input stream; it must not end the shared destination.
-export function pipeChildLog(child, log) {
-  child.stdout?.pipe(log, {end: false});
-  child.stderr?.pipe(log, {end: false});
-}

package/tools/desktop-shell/child-log.test.mjs

@@ -1,14 +0,0 @@
-import {test} from 'node:test';import assert from 'node:assert/strict';import {PassThrough} from 'node:stream';
-import {pipeChildLog} from './child-log.mjs';
-test('child EOF leaves shared log open for exit callback and other child',async()=>{
- const log=new PassThrough(),chunks=[],errors=[];log.on('data',c=>chunks.push(c.toString()));log.on('error',e=>errors.push(e));
- const first={stdout:new PassThrough(),stderr:new PassThrough()},second={stdout:new PassThrough(),stderr:new PassThrough()};
- pipeChildLog(first,log);pipeChildLog(second,log);
- first.stdout.end('first-out\n');first.stderr.end('first-err\n');
- await new Promise(setImmediate);
- assert.equal(log.writableEnded,false);
- log.write('first-exit\n');second.stdout.end('second-out\n');second.stderr.end('second-err\n');
- await new Promise(setImmediate);
- log.write('second-exit\n');await new Promise(setImmediate);
- assert.equal(errors.length,0);assert.match(chunks.join(''),/first-exit/);assert.match(chunks.join(''),/second-exit/);log.end();
-});

package/tools/desktop-shell/package-recovery.py

@@ -1,78 +0,0 @@
-#!/usr/bin/env python3
-"""Stage a reviewed thin-shell patch. Never installs or restarts DSH."""
-from pathlib import Path
-import argparse, hashlib, json, struct
-p=argparse.ArgumentParser();p.add_argument('archive',type=Path);p.add_argument('output',type=Path);args=p.parse_args()
-raw=args.archive.read_bytes();hs=struct.unpack_from('<I',raw,4)[0];js=struct.unpack_from('<I',raw,12)[0]
-tree=json.loads(raw[16:16+js]);files={}
-def walk(entries,prefix=''):
- for name,e in entries.items():
-  key=prefix+name
-  if 'files' in e:walk(e['files'],key+'/')
-  else:
-   assert not e.get('unpacked') and 'link' not in e, 'unsupported archive entry'
-   start=8+hs+int(e['offset']);files[key]=raw[start:start+e['size']]
-walk(tree['files'])
-original=dict(files);source=files['src/main.mjs'].decode()
-assert 'installRendererRecovery' not in source, 'recovery already installed; use the preserved base archive'
-def replace(old,new):
- global source
- assert source.count(old)==1, 'unexpected shell source: '+old[:70]
- source=source.replace(old,new,1)
-replace("import { createDiagnosticLog, installRendererDiagnostics }", "import { pipeChildLog } from './child-log.mjs'\nimport { installRendererRecovery } from './renderer-recovery.mjs'\nimport { createDiagnosticLog, installRendererDiagnostics }")
-replace('const { app, BrowserWindow, Menu, clipboard, session, shell, systemPreferences } = electron','const { app, BrowserWindow, Menu, clipboard, session, shell, systemPreferences, powerMonitor, dialog } = electron')
-replace('''  const attachDiagnostics = contents => installRendererDiagnostics({
-    app, contents, write: diagnosticWrite,
-    related: () => ({hostPid: sidecar?.pid ?? null, notchPid: notch?.pid ?? null}),
-  })''','''  const attachDiagnostics = contents => {
-    const owner = BrowserWindow.fromWebContents(contents)
-    installRendererDiagnostics({
-      app, contents, window: owner, powerMonitor, write: diagnosticWrite,
-      related: () => ({hostPid: sidecar?.pid ?? null, notchPid: notch?.pid ?? null}),
-    })
-    let promptOpen = false
-    installRendererRecovery({
-      app, window: owner, write: diagnosticWrite,
-      onUnavailable: async () => {
-        if (promptOpen || owner.isDestroyed()) return
-        promptOpen = true
-        try {
-          const result = await dialog.showMessageBox(owner, {
-            type: 'error', title: 'DSH 页面未能恢复',
-            message: '页面连续异常退出或重新加载超时。',
-            detail: '后台服务没有因页面恢复而重启。可以重新加载页面，或稍后从 View → Reload 重试。',
-            buttons: ['重新加载页面', '稍后'], defaultId: 0, cancelId: 1, noLink: true,
-          })
-          if (result.response === 0 && !owner.isDestroyed()) contents.reload()
-        } finally { promptOpen = false }
-      },
-    })
-  }''')
-pair="  child.stdout?.pipe(log)\n  child.stderr?.pipe(log)"
-assert source.count(pair)==2
-source=source.replace(pair, '  pipeChildLog(child, log)')
-replace("  return log\n}", "  log.on('error', () => {}) // Logging failure must not crash the desktop shell.\n  return log\n}")
-root=Path(__file__).parent
-files['src/child-log.mjs']=(root/'child-log.mjs').read_bytes()
-files['src/main.mjs']=source.encode()
-files['src/renderer-recovery.mjs']=(root/'renderer-recovery.mjs').read_bytes()
-files['src/renderer-diagnostics.mjs']=(root.parent/'diagnostics/renderer-diagnostics.mjs').read_bytes()
-header={'files':{}};payload=bytearray()
-for name,body in files.items():
- node=header['files'];parts=name.split('/')
- for part in parts[:-1]:node=node.setdefault(part,{'files':{}})['files']
- digest=hashlib.sha256(body).hexdigest()
- node[parts[-1]]={'size':len(body),'offset':str(len(payload)),'integrity':{'algorithm':'SHA256','hash':digest,'blockSize':4194304,'blocks':[hashlib.sha256(body[i:i+4194304]).hexdigest() for i in range(0,len(body),4194304)]}}
- payload.extend(body)
-encoded=json.dumps(header,separators=(',',':')).encode();body=struct.pack('<I',len(encoded))+encoded;body+=b'\0'*((-len(body))%4);pickle=struct.pack('<I',len(body))+body
-archive=struct.pack('<II',4,len(pickle))+pickle+payload
-args.output.mkdir(parents=True,exist_ok=True)
-(args.output/'app.asar').write_bytes(archive)
-(args.output/'main.mjs').write_text(source)
-new_hs=struct.unpack_from('<I',archive,4)[0]
-for name,expected in files.items():
- node=header['files']
- for part in name.split('/')[:-1]:node=node[part]['files']
- e=node[name.split('/')[-1]];start=8+new_hs+int(e['offset']);assert archive[start:start+e['size']]==expected
-manifest={'inputSHA256':hashlib.sha256(raw).hexdigest(),'outputSHA256':hashlib.sha256(archive).hexdigest(),'changed':[n for n,b in files.items() if original.get(n)!=b]}
-(args.output/'manifest.json').write_text(json.dumps(manifest,indent=2)+'\n');print(json.dumps(manifest))

package/tools/desktop-shell/recovery-probe.cjs

@@ -1,50 +0,0 @@
-// Native integration test: isolated profile/static fixture, never the user's DSH.
-const {app,BrowserWindow}=require('electron');
-const assert=require('node:assert/strict');
-const fs=require('node:fs'),os=require('node:os'),path=require('node:path');
-const {pathToFileURL}=require('node:url');
-const profile=fs.mkdtempSync(path.join(os.tmpdir(),'dsh-recovery-test-'));
-app.setPath('userData',profile);app.setPath('sessionData',profile);
-app.on('window-all-closed',()=>{});
-const nativePid=process.pid;
-const waitFor=(emitter,event)=>new Promise(resolve=>emitter.once(event,resolve));
-const delay=ms=>new Promise(resolve=>setTimeout(resolve,ms));
-const deadline=setTimeout(()=>{console.error('native recovery timeout');app.exit(2)},20000);
-app.whenReady().then(async()=>{
- const {installRendererRecovery}=await import(pathToFileURL(process.env.DSH_RECOVERY_MODULE||path.join(__dirname,'renderer-recovery.mjs')));
- const results=[];
- for(const hidden of [false,true]){
-  const events=[];let unavailable=0;
-  const window=new BrowserWindow({width:460,height:220,show:false,webPreferences:{sandbox:true,contextIsolation:true,nodeIntegration:false}});
-  const wc=window.webContents;
-  let complete;
-  if(!process.argv.includes('--baseline'))installRendererRecovery({app,window,write:(event,data)=>{events.push({event,...data});if(event==='renderer-recovery-complete')complete?.()},onUnavailable:()=>unavailable++});
-  await window.loadURL('data:text/html,<title>DSH recovery fixture</title><body style="margin:0;background:%23004c2e;color:white;font:24px sans-serif;padding:32px"><h1>Recovery fixture</h1><p>Local static page. No model calls.</p></body>');
-  if(!hidden)window.showInactive();
-  const originalContents=wc.id;
-  const baselinePixels=(await wc.capturePage()).toBitmap();
-  const reference=Array.from(baselinePixels.subarray(0,4));
-  assert.ok(reference[1]>reference[0]&&reference[1]>reference[2]&&reference[3]>0,'baseline fixture must be green');
-  for(let cycle=1;cycle<=2;cycle++){
-   const oldPid=wc.getOSProcessId();
-   const recovered=new Promise(resolve=>{complete=resolve});
-   const gone=waitFor(wc,'render-process-gone');
-   wc.forcefullyCrashRenderer();
-   await gone;
-   if(process.argv.includes('--baseline')){await delay(700);assert.ok(wc.getOSProcessId()>0,'renderer remains dead: persistent blank window after exit');}
-   await recovered;
-   assert.equal(process.pid,nativePid);assert.equal(wc.id,originalContents);
-   assert.ok(wc.getOSProcessId()>0);assert.notEqual(wc.getOSProcessId(),oldPid);
-   assert.equal(await wc.executeJavaScript('document.querySelector("h1").textContent'),'Recovery fixture');
-   const frame=await wc.capturePage();const pixels=frame.toBitmap();
-   let green=0;for(let i=0;i<pixels.length;i+=4)if(reference.every((v,j)=>Math.abs(pixels[i+j]-v)<=3))green++;
-   assert.ok(green>pixels.length/4*.5,'recovered page must paint fixture background instead of white');
-   results.push({hidden,cycle,recovered:true,sameContents:true,painted:true});
-  }
-  const gone=waitFor(wc,'render-process-gone');wc.forcefullyCrashRenderer();await gone;await delay(400);
-  assert.equal(unavailable,1,'third rapid exit must stop auto reload');
-  window.destroy();
- }
- console.log(JSON.stringify({electron:process.versions.electron,results,boundedRetry:true}));
- clearTimeout(deadline);app.exit(0);
-}).catch(error=>{console.error(error.stack);clearTimeout(deadline);app.exit(1)});

package/tools/desktop-shell/renderer-recovery.mjs

@@ -1,95 +0,0 @@
-// Recovery belongs to the desktop window, never to the Host or a plugin session.
-// A zero exit code is still unexpected while the user's window remains open.
-export function installRendererRecovery({
-  app, window, write = () => {}, onUnavailable = () => {},
-  repaint = () => window.webContents.invalidate(),
-  now = Date.now, scheduler = {setTimeout, clearTimeout},
-  retryDelayMs = 250, loadTimeoutMs = 15000, maxAttempts = 2, retryWindowMs = 60000,
-}) {
-  const contents = window.webContents;
-  const listeners = [];
-  let disposed = false, quitting = false, closing = false;
-  let pending = false, reloadTimer = null, deadlineTimer = null, attempts = [];
-  const on = (emitter, event, fn) => {
-    emitter.on(event, fn);
-    listeners.push(() => emitter.removeListener(event, fn));
-  };
-  const live = () => !disposed && !quitting && !closing && !window.isDestroyed() && !contents.isDestroyed();
-  const record = (event, data = {}) => {
-    try { write(event, {contentsId: contents.id, ...data}); } catch {}
-  };
-  const clearTimers = () => {
-    if (reloadTimer !== null) scheduler.clearTimeout(reloadTimer);
-    if (deadlineTimer !== null) scheduler.clearTimeout(deadlineTimer);
-    reloadTimer = deadlineTimer = null;
-  };
-  const unavailable = reason => {
-    record('renderer-recovery-unavailable', {reason});
-    try { Promise.resolve(onUnavailable(reason)).catch(() => {}); } catch {}
-  };
-  const watchLoad = () => {
-    if (deadlineTimer !== null) scheduler.clearTimeout(deadlineTimer);
-    deadlineTimer = scheduler.setTimeout(() => {
-      deadlineTimer = null;
-      if (live() && pending) unavailable('load-timeout');
-    }, loadTimeoutMs);
-  };
-  on(contents, 'render-process-gone', (_event, details) => {
-    if (!live()) return;
-    if (reloadTimer !== null) return;
-    clearTimers();
-    pending = false;
-    const time = now();
-    attempts = attempts.filter(at => time - at < retryWindowMs);
-    if (attempts.length >= maxAttempts) { unavailable('repeated-exit'); return; }
-    attempts.push(time);
-    pending = true;
-    record('renderer-recovery-scheduled', {reason: details.reason, exitCode: details.exitCode, attempt: attempts.length});
-    reloadTimer = scheduler.setTimeout(() => {
-      reloadTimer = null;
-      if (!live() || !pending) return;
-      watchLoad();
-      try {
-        // Preserve the existing navigation controller, auth session and conversation.
-        if (!contents.isLoading()) contents.reload();
-      } catch {
-        clearTimers();
-        pending = false;
-        unavailable('reload-failed');
-      }
-    }, retryDelayMs);
-  });
-  on(contents, 'did-start-loading', () => {
-    if (!live() || !pending) return;
-    // A user's manual Reload can win the race with our queued recovery.
-    if (reloadTimer !== null) scheduler.clearTimeout(reloadTimer);
-    reloadTimer = null;
-    watchLoad();
-  });
-  on(contents, 'did-finish-load', () => {
-    if (!live() || !pending || contents.getOSProcessId() <= 0) return;
-    clearTimers();
-    pending = false;
-    try { repaint(); } catch { record('renderer-repaint-failed'); }
-    record('renderer-recovery-complete', {rendererPid: contents.getOSProcessId()});
-  });
-  on(app, 'before-quit', () => { quitting = true; pending = false; clearTimers(); });
-  on(window, 'close', () => {
-    closing = true;
-    pending = false;
-    clearTimers();
-    // A cancelled close must not disable recovery for the remaining window.
-    queueMicrotask(() => { if (!disposed && !quitting && !window.isDestroyed()) closing = false; });
-  });
-  on(contents, 'will-prevent-unload', () => { quitting = false; closing = false; });
-  function dispose() {
-    if (disposed) return;
-    disposed = true;
-    clearTimers();
-    for (const remove of listeners) remove();
-  }
-  on(window, 'closed', dispose);
-  on(contents, 'destroyed', dispose);
-  record('renderer-recovery-attached');
-  return dispose;
-}

package/tools/desktop-shell/renderer-recovery.test.mjs

@@ -1,24 +0,0 @@
-import {test} from 'node:test'
-import assert from 'node:assert/strict'
-import {EventEmitter} from 'node:events'
-import {installRendererRecovery} from './renderer-recovery.mjs'
-
-function fixture(options={}) {
- const app=new EventEmitter(),window=new EventEmitter(),contents=new EventEmitter(),rows=[],failures=[];
- let reloaded=0,destroyed=false,pid=17,loading=false,clock=0,seq=0;
- const jobs=new Map();
- window.webContents=contents;window.isDestroyed=()=>destroyed;
- contents.isDestroyed=()=>destroyed;contents.getOSProcessId=()=>pid;
- contents.isLoading=()=>loading;contents.reload=()=>{reloaded++;loading=true;contents.emit('did-start-loading')};
- const scheduler={setTimeout:(fn,ms)=>{const id=++seq;jobs.set(id,{fn,at:clock+ms});return id},clearTimeout:id=>jobs.delete(id)};
- const dispose=installRendererRecovery({app,window,write:(event,data)=>rows.push({event,...data}),onUnavailable:reason=>failures.push(reason),repaint:()=>rows.push({event:'repaint'}),now:()=>clock,scheduler,...options});
- const tick=ms=>{const end=clock+ms;while(true){const ready=[...jobs].filter(([,j])=>j.at<=end).sort((a,b)=>a[1].at-b[1].at)[0];if(!ready)break;clock=ready[1].at;jobs.delete(ready[0]);ready[1].fn()}clock=end};
- return {app,window,contents,rows,failures,dispose,tick,jobs,get reloads(){return reloaded},gone(reason='clean-exit'){pid=0;loading=false;contents.emit('render-process-gone',{}, {reason,exitCode:0,url:'private-token'})},loaded(){pid=18;loading=false;contents.emit('did-finish-load')},destroy(){destroyed=true;window.emit('closed')}}
-}
-test('unexpected clean exit reloads original contents and completes recovery',()=>{const f=fixture();f.gone();f.tick(300);assert.equal(f.reloads,1);f.loaded();assert.equal(f.rows.at(-1).event,'renderer-recovery-complete');assert.ok(f.rows.some(r=>r.event==='repaint'));assert.ok(!JSON.stringify(f.rows).includes('private-token'));f.dispose()})
-test('duplicate exit before scheduled reload does not consume another attempt',()=>{const f=fixture();f.gone();f.gone();f.tick(300);assert.equal(f.reloads,1);f.loaded();f.dispose()})
-test('normal quit and closed windows never resurrect a renderer',()=>{for(const stop of [f=>f.app.emit('before-quit'),f=>f.destroy()]){const f=fixture();f.gone();stop(f);f.tick(20000);assert.equal(f.reloads,0);f.dispose()}})
-test('crash loop is bounded, including repeated clean exits',()=>{const f=fixture();for(let i=0;i<3;i++){f.gone();f.tick(300);f.loaded()}assert.equal(f.reloads,2);assert.equal(f.failures.length,1);f.tick(60000);f.gone();f.tick(300);assert.equal(f.reloads,3);f.dispose()})
-test('manual reload wins over queued automatic recovery',()=>{const f=fixture();f.gone();f.contents.reload();f.loaded();f.tick(20000);assert.equal(f.reloads,1);assert.equal(f.failures.length,0);f.dispose()})
-test('load timeout is reported once; late load may still recover',()=>{const f=fixture();f.gone();f.tick(20000);assert.equal(f.reloads,1);assert.deepEqual(f.failures,['load-timeout']);f.loaded();assert.equal(f.rows.at(-1).event,'renderer-recovery-complete');f.dispose()})
-test('disposal cancels work and removes all owned listeners',()=>{const f=fixture();f.gone();f.dispose();f.tick(20000);assert.equal(f.reloads,0);assert.equal(f.jobs.size,0);assert.equal(f.contents.listenerCount('render-process-gone'),0);assert.equal(f.app.listenerCount('before-quit'),0)})

package/tools/diagnostics/completion-watch.py

@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Read-only process/status correlation. Stops with the selected DSH app."""
-import datetime
-import json
-import os
-from pathlib import Path
-import subprocess
-import sys
-import time
-import urllib.parse
-import urllib.request
-
-
-def counts(snapshot):
-    rows = snapshot.get('rows', [])
-    result = {'doing': 0, 'done': 0, 'error': 0, 'decision': 0}
-    for row in rows:
-        if row.get('ask') or row.get('approval'):
-            result['decision'] += 1
-        elif row.get('busy'):
-            result['doing'] += 1
-        elif (row.get('lastTurn') or {}).get('failed'):
-            result['error'] += 1
-        elif row.get('unread'):
-            result['done'] += 1
-    result['sidebarFresh'] = isinstance(snapshot.get('sidebarSyncedAt'), (int, float))
-    return result
-
-
-def status(runtime):
-    file = json.loads(runtime.read_text())
-    origin = urllib.parse.urlsplit(file['origin'])
-    if origin.scheme != 'http' or origin.hostname not in ('127.0.0.1', 'localhost', '::1'):
-        raise ValueError('not loopback')
-    request = urllib.request.Request(file['origin'] + '/dsh-notch/status', headers={'Authorization': 'Bearer ' + file['token']})
-    # Never send local credentials through a machine proxy or follow redirects.
-    class NoRedirect(urllib.request.HTTPRedirectHandler):
-        def redirect_request(self, *args, **kwargs):
-            return None
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect())
-    with opener.open(request, timeout=1) as response:
-        snapshot = json.load(response)
-    if snapshot.get('ok') is not True:
-        raise ValueError('invalid snapshot')
-    return counts(snapshot)
-
-
-def processes(app_pid, base):
-    result = []
-    output = subprocess.check_output(['ps', '-axo', 'pid=,ppid=,rss=,comm='], text=True, timeout=2)
-    for line in output.splitlines():
-        fields = line.strip().split(None, 3)
-        if len(fields) != 4:
-            continue
-        pid, parent, rss, command = fields
-        if command.startswith(base) or (int(parent) == app_pid and command.endswith('/node')):
-            role = ('renderer' if 'DSH Helper (Renderer)' in command else
-                    'notch' if command.endswith('/dsh-notch') else
-                    'app' if int(pid) == app_pid else
-                    'host' if command.endswith('/node') else 'helper')
-            result.append({'pid': int(pid), 'role': role, 'rssKB': int(rss)})
-    return result
-
-
-def main():
-    app_pid, app_path, output = int(sys.argv[1]), Path(sys.argv[2]), Path(sys.argv[3])
-    runtime = Path.home() / '.dsh/dsh-notch/runtime.json'
-    output.parent.mkdir(parents=True, exist_ok=True)
-    previous = None
-    heartbeat = 0
-    while True:
-        began = time.monotonic()
-        try:
-            rows = processes(app_pid, str(app_path / 'Contents') + '/')
-            alive = any(row['pid'] == app_pid and row['role'] == 'app' for row in rows)
-            try:
-                board = status(runtime) if alive else {'unavailable': 'app-ended'}
-            except Exception as error:
-                board = {'unavailable': type(error).__name__}
-            signature = ([(r['pid'], r['role']) for r in rows], board)
-            if signature != previous or began - heartbeat >= 30:
-                event = {'at': datetime.datetime.now(datetime.timezone.utc).isoformat(),
-                         'event': 'state-change' if signature != previous else 'heartbeat',
-                         'appPid': app_pid, 'processes': rows, 'notch': board,
-                         'sampleDurationMs': round((time.monotonic()-began)*1000),
-                         'exitReason': 'unavailable-to-external-observer'}
-                if output.exists() and output.stat().st_size >= 1024 * 1024:
-                    os.replace(output, str(output) + '.1')
-                with output.open('a') as file:
-                    file.write(json.dumps(event) + '\n')
-                os.chmod(output, 0o600)
-                previous, heartbeat = signature, began
-            if not alive:
-                return
-        except (OSError, subprocess.SubprocessError):
-            pass
-        time.sleep(max(.1, 1 - (time.monotonic() - began)))
-
-
-if __name__ == '__main__':
-    main()

package/tools/diagnostics/completion-watch.test.py

@@ -1,17 +0,0 @@
-import importlib.util
-from pathlib import Path
-import json
-import unittest
-spec=importlib.util.spec_from_file_location('watch',Path(__file__).with_name('completion-watch.py'))
-watch=importlib.util.module_from_spec(spec);spec.loader.exec_module(watch)
-class Tests(unittest.TestCase):
-    def test_counts_match_native_precedence_and_redact(self):
-        snapshot={'rows':[{'title':'secret','id':'secret','unread':True} for _ in range(5)]+[
-            {'busy':True,'unread':True}, {'lastTurn':{'failed':True},'unread':True},
-            {'ask':{'id':'secret'},'busy':True}], 'sidebarSyncedAt':123,'token':'secret'}
-        result=watch.counts(snapshot)
-        self.assertEqual(result,{'doing':1,'done':5,'error':1,'decision':1,'sidebarFresh':True})
-        self.assertNotIn('secret',json.dumps(result))
-    def test_expired_mirror_recorded_separately(self):
-        self.assertEqual(watch.counts({'rows':[]})['sidebarFresh'],False)
-if __name__=='__main__':unittest.main()

package/tools/diagnostics/renderer-diagnostics.mjs

@@ -1,56 +0,0 @@
-import {appendFileSync, mkdirSync, renameSync, statSync} from 'node:fs'
-import {dirname} from 'node:path'
-import {freemem,totalmem} from 'node:os'
-
-// Deliberately excludes URLs, page text, tokens and arbitrary error messages.
-export function createDiagnosticLog(path, {maxBytes=1024*1024}={}) {
-  return (event, data={}) => {
-    try {
-      mkdirSync(dirname(path),{recursive:true,mode:0o700})
-      try {if(statSync(path).size>=maxBytes)renameSync(path,path+'.1')} catch {}
-      appendFileSync(path,JSON.stringify({at:new Date().toISOString(),event,...data})+'\n',{mode:0o600})
-    } catch {} // Diagnostic failure must never break the shell.
-  }
-}
-export function installRendererDiagnostics({app,contents,window,powerMonitor,write,related=()=>({}),intervalMs=30000}) {
-  const disposers=[]
-  const on=(emitter,event,fn)=>{emitter.on(event,fn);disposers.push(()=>emitter.removeListener(event,fn))}
-  let lastRendererPid=null, loadedAt=null
-  const read=(object,method)=>{try{return object?.[method]?.()}catch{return undefined}}
-  const snapshot=()=>{
-    let processes=[]
-    try {processes=app.getAppMetrics().map(p=>({pid:p.pid,type:p.type,cpu:p.cpu?.percentCPUUsage,rssKB:p.memory?.workingSetSize,peakKB:p.memory?.peakWorkingSetSize}))}catch{}
-    let rendererPid=null
-    try{rendererPid=contents.getOSProcessId()}catch{}
-    if(rendererPid>0)lastRendererPid=rendererPid
-    return {appPid:process.pid,contentsId:contents.id,rendererPid,lastRendererPid,
-      pageAgeMs:loadedAt===null?null:Date.now()-loadedAt,
-      systemIdleSeconds:read(powerMonitor,'getSystemIdleTime'),
-      windowVisible:read(window,'isVisible'),windowMinimized:read(window,'isMinimized'),
-      windowFocused:read(window,'isFocused'),appHidden:read(app,'isHidden'),
-      loading:read(contents,'isLoading'),backgroundThrottling:read(contents,'getBackgroundThrottling'),
-      processes,freeMemoryBytes:freemem(),totalMemoryBytes:totalmem(),...related()}
-  }
-  const record=(event,data={})=>{try{write(event,{...snapshot(),...data})}catch{}}
-  on(contents,'render-process-gone',(_event,details)=>record('renderer-exited',{reason:details.reason,exitCode:details.exitCode}))
-  on(contents,'unresponsive',()=>record('renderer-unresponsive'))
-  on(contents,'responsive',()=>record('renderer-responsive'))
-  on(contents,'did-start-loading',()=>record('page-loading'))
-  on(contents,'did-finish-load',()=>{loadedAt=Date.now();record('page-loaded')})
-  on(contents,'did-fail-load',(_event,errorCode,_description,_url,isMainFrame)=>record('page-load-failed',{errorCode,isMainFrame}))
-  on(app,'child-process-gone',(_event,details)=>record('child-exited',{type:details.type,reason:details.reason,exitCode:details.exitCode}))
-  // No URLs, navigation arguments, input text or session content are recorded.
-  for(const event of ['render-view-deleted','render-view-ready','dom-ready','will-prevent-unload'])
-    on(contents,event,()=>record(event))
-  if(window)for(const event of ['show','hide','minimize','restore','focus','blur','resize','close','closed'])
-    on(window,event,()=>record('window-'+event))
-  if(powerMonitor)for(const event of ['suspend','resume','lock-screen','unlock-screen'])
-    on(powerMonitor,event,()=>record('system-'+event))
-  on(app,'before-quit',()=>record('app-before-quit'))
-  const timer=setInterval(()=>record('heartbeat'),intervalMs);timer.unref?.()
-  let disposed=false
-  function dispose(){if(disposed)return;disposed=true;clearInterval(timer);for(const fn of disposers)fn()}
-  on(contents,'destroyed',()=>{record('contents-destroyed');dispose()})
-  record('diagnostics-attached')
-  return dispose
-}

package/tools/diagnostics/renderer-diagnostics.test.mjs

@@ -1,32 +0,0 @@
-import {test} from 'node:test';import assert from 'node:assert/strict';import {EventEmitter} from 'node:events';
-import {mkdtempSync,readFileSync,rmSync,existsSync} from 'node:fs';import {tmpdir} from 'node:os';
-import {createDiagnosticLog,installRendererDiagnostics} from './renderer-diagnostics.mjs';
-function fixture(){const app=new EventEmitter(),contents=new EventEmitter();app.getAppMetrics=()=>[{pid:7,type:'Tab',memory:{workingSetSize:123}}];contents.id=3;contents.getOSProcessId=()=>7;return {app,contents}}
-test('renderer termination retains reason and exit code, strips secrets',()=>{const f=fixture(),rows=[];const dispose=installRendererDiagnostics({...f,write:(event,data)=>rows.push({event,...data})});f.contents.emit('render-process-gone',{}, {reason:'oom',exitCode:137,url:'secret',message:'secret'});const row=rows.at(-1);assert.equal(row.event,'renderer-exited');assert.equal(row.reason,'oom');assert.equal(row.exitCode,137);assert.equal(row.rendererPid,7);assert.ok(!JSON.stringify(rows).includes('secret'));dispose();assert.equal(f.contents.listenerCount('render-process-gone'),0)})
-test('secondary process and loading events exclude URLs and messages',()=>{const f=fixture(),rows=[];const dispose=installRendererDiagnostics({...f,write:(e,d)=>rows.push({e,...d})});f.contents.emit('did-fail-load',{},-2,'secret','token-url',true);f.app.emit('child-process-gone',{}, {type:'GPU',reason:'crashed',exitCode:1,name:'secret'});assert.equal(rows.at(-1).type,'GPU');assert.ok(!JSON.stringify(rows).includes('secret'));assert.ok(!JSON.stringify(rows).includes('token-url'));dispose()})
-test('diagnostic errors cannot break shell, destruction cleans up',()=>{const f=fixture();installRendererDiagnostics({...f,write:()=>{throw Error('disk full')}});assert.doesNotThrow(()=>f.contents.emit('render-process-gone',{}, {reason:'crashed',exitCode:1}));f.contents.emit('destroyed');assert.equal(f.app.listenerCount('child-process-gone'),0)})
-test('rotates log at limit',()=>{const dir=mkdtempSync(tmpdir()+'/notch-diag-');try{const path=dir+'/events.jsonl',write=createDiagnosticLog(path,{maxBytes:1});write('one');write('two');assert.ok(existsSync(path+'.1'));assert.equal(JSON.parse(readFileSync(path,'utf8')).event,'two')}finally{rmSync(dir,{recursive:true,force:true})}})
-test('idle renderer loss preserves departed PID and window state without private event arguments',()=>{
-  const f=fixture(),window=new EventEmitter(),powerMonitor=new EventEmitter(),rows=[];
-  window.isVisible=()=>true;window.isMinimized=()=>false;window.isFocused=()=>false;
-  powerMonitor.getSystemIdleTime=()=>7200;
-  const dispose=installRendererDiagnostics({...f,window,powerMonitor,write:(event,data)=>rows.push({event,...data})});
-  f.contents.emit('did-finish-load');
-  f.contents.getOSProcessId=()=>0;
-  f.contents.emit('render-process-gone',{}, {reason:'clean-exit',exitCode:0});
-  const row=rows.at(-1);
-  assert.equal(row.rendererPid,0);assert.equal(row.lastRendererPid,7);
-  assert.equal(row.systemIdleSeconds,7200);assert.equal(row.windowFocused,false);
-  assert.ok(row.pageAgeMs>=0);
-  powerMonitor.emit('suspend','private');window.emit('hide','private');
-  assert.equal(rows.at(-2).event,'system-suspend');assert.equal(rows.at(-1).event,'window-hide');
-  assert.ok(!JSON.stringify(rows).includes('private'));
-  dispose();assert.equal(window.listenerCount('hide'),0);assert.equal(powerMonitor.listenerCount('suspend'),0);
-});
-test('unsupported or destroyed window and power APIs do not break remaining evidence',()=>{
-  const f=fixture(),window=new EventEmitter(),powerMonitor=new EventEmitter(),rows=[];
-  window.isVisible=()=>{throw Error('destroyed')};powerMonitor.getSystemIdleTime=()=>{throw Error('unsupported')};
-  const dispose=installRendererDiagnostics({...f,window,powerMonitor,write:(event,data)=>rows.push({event,...data})});
-  f.contents.emit('render-process-gone',{}, {reason:'killed',exitCode:15});
-  assert.equal(rows.at(-1).reason,'killed');assert.equal(rows.at(-1).systemIdleSeconds,undefined);dispose();
-});