faberun 0.17.2 → 0.19.0

package/src/report/message.mjs

@@ -24,7 +24,7 @@
  */
 import { renderStatusJson } from "./render.mjs";
 import { buildCampaignProgress, remainingEstimateMs } from "./progress.mjs";
-import { detectLanguage, labelsFor } from "./locale.mjs";
+import { chooseLanguage, labelsFor } from "./locale.mjs";
 import { readNodeSnapshot } from "../run/node-store.mjs";
 import { campaignDir } from "../campaign/layout.mjs";
 import { readJournal } from "../campaign/journal.mjs";
@@ -106,7 +106,7 @@ export function renderRunProgress(runDir, event) {
   const objectives = readObjectives(runDir);
   const snapshots = new Map(payload.nodes.map((node) => [node.id, readSnapshotSafe(runDir, node.id)]));
   const campaign = campaignSummary(runsDir, payload.campaignId);
-  const label = labelsFor(detectLanguage([campaign?.goal], journalTexts(runsDir, payload.campaignId), [...objectives.values()]));
+  const label = labelsFor(chooseLanguage(process.env, [campaign?.goal], journalTexts(runsDir, payload.campaignId), [...objectives.values()]));
   const subject = subjectNode(payload.nodes, event.nodeId ?? null);
   /** @type {View} */
   const view = { runDir, runId: event.runId ?? basename(runDir), payload, objectives, snapshots, campaign, label, subject };

package/src/report/next.mjs

@@ -432,12 +432,26 @@ function renderLine(item) {
 
 /**
  * Quote a shell argument only when it needs it, so a normal path stays bare and
- * a path with a space (or any other shell metacharacter) is single-quoted.
+ * a path with a space (or any other shell metacharacter) is quoted the way the
+ * shell reading this line quotes.
  *
  * @param {string} value
  * @returns {string}
  */
 function quoteArg(value) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/u.test(value)) return value;
+  // A Windows path is not a POSIX word: every separator is a backslash, so the
+  // rule above rejects even a plain run directory. Quoting it the POSIX way
+  // would leave the line worse than bare — cmd.exe reads a single quote as a
+  // literal character and would look for a directory named with one. There the
+  // separator is ordinary, and only a space (or a character the shell reads)
+  // needs the quotes that platform does understand.
+  // `~` is in the set because a Windows temporary directory is routinely an
+  // 8.3 short name — `C:\Users\RUNNER~1\AppData\Local\Temp` on a CI runner —
+  // and nothing reads a tilde inside a path: cmd.exe has no expansion for it,
+  // and PowerShell expands one only at the start of a path.
+  if (process.platform === "win32") {
+    return /^[A-Za-z0-9_@%+=:,.~\\/-]+$/u.test(value) ? value : `"${value.replaceAll('"', '\\"')}"`;
+  }
   return `'${value.replaceAll("'", `'\\''`)}'`;
 }

package/src/run/availability.mjs

@@ -0,0 +1,138 @@
+/**
+ * The durable store of live-preflight verdicts: which providers answered the
+ * dispatch gate's hello, and when.
+ *
+ * The gate's verdicts used to live only in a run's own env-preflight.json and
+ * died with the run, so every launch paid the ask again -- measured
+ * 2026-09-22 at about 18s for four runtimes in parallel. This store is the
+ * home that outlives the launch, and it is keyed on the provider -- harness,
+ * model and the executable actually resolved -- never on a contract's local
+ * runtime id: whether `codex` answers is a fact about this machine and this
+ * operator, so two contracts naming the same provider share one answer and
+ * one provider reached under two local names stays one record.
+ *
+ * A record is the catalogue's own RuntimeAvailability shape, so reuse is
+ * decided by `isRuntimeAvailable` -- the one home of the freshness rule --
+ * and the window a record names (`PREFLIGHT_WINDOW`) is the hello's own
+ * clock, declared beside the quota windows it must never be derived from.
+ */
+import { validateRuntimeAvailability } from "../contract/runtime.mjs";
+import { isRuntimeAvailable, PREFLIGHT_WINDOW } from "../engine/runtime-discovery.mjs";
+import { mkdirSync, readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { availabilityPath } from "./paths.mjs";
+import { writeJsonAtomic } from "./store.mjs";
+
+/** @typedef {import("../engine/runtime-discovery.mjs").RuntimeAvailability} RuntimeAvailability */
+
+/** The store shape this module reads and writes; a foreign shape reads as empty. */
+const STORE_SCHEMA_VERSION = 1;
+
+/**
+ * The key one verdict is stored under. The executable is the path the harness
+ * adapter itself resolves -- the same string a probe reports -- so a runtime
+ * whose model, harness or binary changed is a different question by
+ * construction, and no second catalogue-change mechanism is needed. The
+ * contract-local runtime id is absent on purpose.
+ *
+ * @param {{harness: string, model: string, executable: string}} provider
+ * @returns {string}
+ */
+export function availabilityKey(provider) {
+  return `${provider.harness}:${provider.model}:${provider.executable}`;
+}
+
+/**
+ * The fresh verdict stored for one provider, or null whenever nothing may
+ * skip the ask: no record, a record that fails its own validator, and an
+ * observation outside its window all read as null, because the caller's only
+ * fallback is to ask again and asking again is always safe.
+ *
+ * @param {string} key
+ * @param {number} [now] epoch milliseconds; defaults to the current clock
+ * @returns {RuntimeAvailability|null}
+ */
+export function readAvailability(key, now = Date.now()) {
+  const record = loadVerdicts()[key];
+  return record && isRuntimeAvailable(record, now) ? record : null;
+}
+
+/**
+ * Record that the named providers answered the live preflight at `now`. The
+ * only verdict this store ever holds is "answered": silence
+ * (preflight_timeout, spawn_error) and a command that never reached a
+ * provider are the gate's to report and are never persisted, so the cache can
+ * never turn a pass into a block or the reverse -- it decides only whether
+ * the next launch asks.
+ *
+ * The observation instant is fixed when the verdict is recorded, never
+ * refreshed on read: a sliding window would let a continuously launching
+ * operator keep a long-dead provider admitted forever.
+ *
+ * A launch racing another on this store loses at most its own entries, and a
+ * lost verdict costs one extra ask -- operator-scale launches are not a hot
+ * loop, so the read-modify-write takes no lock.
+ *
+ * @param {string[]} keys
+ * @param {number} [now] epoch milliseconds; the instant the verdicts were observed
+ * @returns {void}
+ */
+export function recordAvailability(keys, now = Date.now()) {
+  if (keys.length === 0) return;
+  const store = loadStore();
+  for (const key of keys) {
+    store.verdicts[key] = {
+      available: true,
+      exhaustedUntil: null,
+      // This store's own verdict name: the provider answered the ask. Nothing
+      // here claims spend-readiness -- a refusal is an answer too.
+      reason: "answered",
+      observedAt: new Date(now).toISOString(),
+      window: PREFLIGHT_WINDOW,
+    };
+  }
+  const path = availabilityPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeJsonAtomic(path, store);
+}
+
+/**
+ * @returns {{schemaVersion: number, verdicts: Record<string, RuntimeAvailability>}}
+ */
+function loadStore() {
+  try {
+    const parsed = JSON.parse(readFileSync(availabilityPath(), "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      && parsed.schemaVersion === STORE_SCHEMA_VERSION
+      && parsed.verdicts && typeof parsed.verdicts === "object" && !Array.isArray(parsed.verdicts)) {
+      return parsed;
+    }
+  } catch {
+    // ENOENT (the first launch on this machine) and a store a truncated write
+    // or a future shape left unparseable mean the same thing here: no verdict
+    // is known, so every provider is asked. That is the safe direction.
+  }
+  return { schemaVersion: STORE_SCHEMA_VERSION, verdicts: {} };
+}
+
+/**
+ * The stored verdicts that pass their own validator. Anything the store
+ * cannot vouch for is dropped rather than trusted or repaired: a dropped
+ * verdict costs one ask, a trusted one costs a launch gated on bytes nobody
+ * can type.
+ *
+ * @returns {Record<string, RuntimeAvailability>}
+ */
+function loadVerdicts() {
+  /** @type {Record<string, RuntimeAvailability>} */
+  const verdicts = {};
+  for (const [key, record] of Object.entries(loadStore().verdicts)) {
+    try {
+      validateRuntimeAvailability(record, `availability verdict ${key}`);
+    } catch {
+      continue;
+    }
+    verdicts[key] = /** @type {RuntimeAvailability} */ (record);
+  }
+  return verdicts;
+}

package/src/run/disk-gc.mjs

@@ -16,7 +16,7 @@
  * what a caller passes in.
  */
 import { readFileSync, readdirSync, rmSync, statSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { TERMINAL } from "../engine/prompts.mjs";
 import { lockStale, readLock } from "./lock.mjs";
 
@@ -214,7 +214,11 @@ export function writeRunTextWithDiskPressureRetry(runDir, path, text) {
  */
 function simulateEnospcForTest(path) {
   const match = process.env.FABERUN_SIMULATE_ENOSPC_MATCH;
-  if (!match || !path.includes(match)) return;
+  // The substring is authored in the portable spelling — a case names
+  // `nodes/build.json` — while the path carries this host's separator, so both
+  // are compared in that spelling. Raw, the match never fires on Windows and
+  // the injection is inert while the case still reports what it proved.
+  if (!match || !posixSpelling(path).includes(posixSpelling(match))) return;
   const remaining = Number(process.env.FABERUN_SIMULATE_ENOSPC_COUNT ?? "0");
   if (!Number.isInteger(remaining) || remaining <= 0) return;
   process.env.FABERUN_SIMULATE_ENOSPC_COUNT = String(remaining - 1);
@@ -224,6 +228,16 @@ function simulateEnospcForTest(path) {
   );
 }
 
+/**
+ * One path spelled with forward slashes, whatever separator this host uses.
+ *
+ * @param {string} path
+ * @returns {string}
+ */
+function posixSpelling(path) {
+  return path.split(sep).join("/");
+}
+
 /**
  * Deterministic stand-in for "free space is still below the threshold",
  * paired with `simulateEnospcForTest` so a case can prove the removal loop

package/src/run/lock.mjs

@@ -57,6 +57,14 @@ export function lockPath(runDir) {
  * different one for whatever process next reuses that pid, without a
  * compiled addon or elevated privileges. Every other platform has no cheap
  * equivalent, so the pid probe alone decides there.
+ *
+ * Windows is that other platform, measured 2026-09-21 on Windows 11 26200:
+ * `wmic` — the one cheap process-table reader — is no longer installed, and
+ * the PowerShell that replaced it costs about 400 ms per probe cold, on a path
+ * a controller walks every time it reads a lock. So the token stays null and
+ * ownership falls back to liveness alone: a lock whose pid has been recycled
+ * into an unrelated process reads as still held there, and its holder has to
+ * be taken over by the stale-heartbeat path rather than recognized as gone.
  * @param {number|null} pid @returns {string|null}
  */
 export function processStartToken(pid) {

package/src/run/paths.mjs

@@ -134,6 +134,19 @@ export function runDirectory(cwd, runId) {
   return join(runsRoot(cwd), runId);
 }
 
+/**
+ * The live-preflight verdict store, at the top of the home. Whether a
+ * provider answers is a fact about this machine and this operator -- the same
+ * binary, model and credential whatever repository or contract asks -- so the
+ * record outlives any one run and is shared by every project. This module
+ * owns every path under the home and is the only place that names this one.
+ *
+ * @returns {string}
+ */
+export function availabilityPath() {
+  return join(faberunHome(), "availability.json");
+}
+
 /**
  * The campaigns directory beneath a runs root: `<runs>/campaigns`.
  * Composes `campaign/layout.mjs`'s `campaignsDir`, which owns the shape given

package/src/seat/allowance.mjs

@@ -21,6 +21,7 @@
  */
 import { spawn as nodeSpawn } from "node:child_process";
 import { getHarness } from "../harnesses/index.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 // `window` is optional on the type (not every construction site names one --
 // `plan/pipeline.mjs` rebuilds a start sample from journal fields that predate
@@ -70,8 +71,10 @@ export function defaultInvoke(harness, { spawn = nodeSpawn } = {}) {
   return new Promise((settle) => {
     let child;
     try {
-      child = spawn(command.executable, command.args, {
+      const invocation = spawnInvocation(command.executable, command.args);
+      child = spawn(invocation.command, invocation.args, {
         stdio: ["pipe", "pipe", "pipe"],
+        ...invocation.options,
       });
     } catch {
       settle(null);

package/src/seat/tmux.mjs

@@ -10,6 +10,7 @@
 import { execFileSync } from "node:child_process";
 import { NOTIFY_SESSION_ENV } from "../notify/session.mjs";
 import { errorCode, exitStatus } from "../util.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 /** The single seat session every campaign window lives in. */
 export const SEAT_SESSION = "faberun-seat";
@@ -43,8 +44,15 @@ const TMUX_TIMEOUT_MS = 10_000;
  */
 function runTmux(args, options = {}) {
   try {
-    const stdout = execFileSync("tmux", args, {
+    // The seat reaches tmux the way this platform reaches any command: a
+    // name through PATHEXT, a shim through the interpreter that runs it.
+    // Nothing here claims tmux exists on Windows -- ADR 0009 says it does
+    // not -- only that the probe answers `tmux_unavailable` for the right
+    // reason instead of failing to spell the name.
+    const invocation = spawnInvocation("tmux", args, { cwd: options.cwd });
+    const stdout = execFileSync(invocation.command, invocation.args, {
       cwd: options.cwd,
+      ...invocation.options,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: TMUX_TIMEOUT_MS,