fraim-hub 2.0.269 → 2.0.271

package/dist/src/ai-hub/catalog.js

@@ -14,6 +14,7 @@ exports.getAiHubCategories = getAiHubCategories;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+const resolve_phase_edge_1 = require("../core/resolve-phase-edge");
 // Directories scanned for employee jobs at runtime, in lowest-to-highest
 // precedence order. Later entries win on {categoryId, jobId} collision.
 //
@@ -411,21 +412,6 @@ function findJobStubPath(projectPath, jobId) {
     }
     return null;
 }
-// Resolve a phase's `onSuccess` edge to the next phase id given the run's
-// discriminant. Returns null when the edge is absent or terminal.
-function nextPhase(edge, discriminant) {
-    if (edge == null)
-        return null;
-    if (typeof edge === 'string')
-        return edge;
-    if (typeof edge === 'object') {
-        if (typeof edge[discriminant] === 'string')
-            return edge[discriminant];
-        if (typeof edge.default === 'string')
-            return edge.default;
-    }
-    return null;
-}
 // Parse the ordered phase list from a job stub's ## Steps section.
 // Real FRAIM job stubs use Markdown steps rather than JSON frontmatter;
 // this is the fallback parser that makes the pizza tracker work for them.
@@ -460,7 +446,7 @@ function loadJobPhases(jobId, projectPath, discriminant = 'feature') {
         const phaseDef = fm.phases[cursor];
         if (!phaseDef)
             break;
-        cursor = nextPhase(phaseDef.onSuccess, discriminant);
+        cursor = (0, resolve_phase_edge_1.resolvePhaseEdge)(fm.phases[cursor]?.onSuccess, discriminant);
     }
     const labels = fm.phaseLabels || {};
     return ordered.map((id) => ({ id, label: friendlyPhaseLabel(id, labels[id]) }));
@@ -482,7 +468,7 @@ function resolveJobPhaseTransition(jobId, projectPath, phaseId, outcome, discrim
     if (!phaseDef)
         return null;
     const edge = outcome === 'complete' ? phaseDef.onSuccess : phaseDef.onFailure;
-    return nextPhase(edge, discriminant);
+    return (0, resolve_phase_edge_1.resolvePhaseEdge)(edge, discriminant);
 }
 function loadAllJobPhaseIds(jobId, projectPath) {
     const stubPath = findJobStubPath(projectPath, jobId);

package/dist/src/ai-hub/cli.js

@@ -53,15 +53,8 @@ const hub_launch_decision_1 = require("./hub-launch-decision");
 const hub_runtime_file_1 = require("./hub-runtime-file");
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
 const version_utils_1 = require("../cli/utils/version-utils");
-function resolveElectronBinary() {
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        return require('electron');
-    }
-    catch {
-        return null;
-    }
-}
+const electron_dist_1 = require("./electron-dist");
+const process_liveness_1 = require("./process-liveness");
 function resolveDesktopEntry() {
     const candidates = [
         path_1.default.resolve(__dirname, 'desktop-main.js'),
@@ -78,10 +71,20 @@ function resolveDesktopEntry() {
     }
     return null;
 }
-function openDesktopWindow(projectPath, preferredPort, runtimeId) {
-    const electronBinary = resolveElectronBinary();
+// #1112: the Electron binary is resolved (and, on a first launch for a version, extracted) before
+// the spawn, not inside waitForDesktopHubReady. A one-time extraction is minutes of work on a slow
+// disk; charging it to the readiness budget is exactly the mistake #1110 fixed, so it happens here
+// with progress on stdout while nothing is being waited on.
+async function openDesktopWindow(projectPath, preferredPort, runtimeId) {
     const desktopEntry = resolveDesktopEntry();
-    if (!electronBinary || !desktopEntry) {
+    if (!desktopEntry) {
+        return null;
+    }
+    const electron = await (0, electron_dist_1.resolveHubElectronBinary)({
+        onProgress: (message) => console.log(message),
+        onError: (error) => console.log(`Could not prepare the shared Electron runtime (${error.message}). Opening the FRAIM Hub in your browser instead.`),
+    });
+    if (!electron) {
         return null;
     }
     const args = projectPath
@@ -90,7 +93,7 @@ function openDesktopWindow(projectPath, preferredPort, runtimeId) {
     if (runtimeId && runtimeId !== 'hub') {
         args.push('--hub-runtime-id', runtimeId);
     }
-    const child = (0, child_process_1.spawn)(electronBinary, args, {
+    const child = (0, child_process_1.spawn)(electron.binaryPath, args, {
         detached: true,
         stdio: 'ignore',
     });
@@ -110,15 +113,6 @@ function openBrowser(url) {
     const child = (0, child_process_1.spawn)('xdg-open', [url], { detached: true, stdio: 'ignore' });
     child.unref();
 }
-function isProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (e) {
-        return !!(e && e.code === 'EPERM');
-    }
-}
 function killPid(pid) {
     try {
         if (process.platform === 'win32') {
@@ -307,7 +301,7 @@ async function waitForDesktopHubReady(child, preferredPort, options = {}) {
 async function reconcileRunningHub(flags, runtimeId = 'hub') {
     const running = (0, hub_runtime_file_1.readHubRuntimeFile)((0, project_fraim_paths_1.getUserFraimDirPath)(), runtimeId);
     const confirmedVersion = running ? await fetchRunningHubVersion(running.port) : null;
-    const live = !!(running && confirmedVersion && isProcessAlive(running.pid));
+    const live = !!(running && confirmedVersion && (0, process_liveness_1.isPidAlive)(running.pid));
     const effective = live && running ? { ...running, version: confirmedVersion } : null;
     const decision = (0, hub_launch_decision_1.decideHubLaunch)({
         running: effective,
@@ -340,7 +334,7 @@ async function runHub(options) {
         if (wantDesktop) {
             await reconcileRunningHub({ restart: !!options.restart, keepRunning: !!options.keepRunning }, runtimeId);
         }
-        const desktopChild = wantDesktop ? openDesktopWindow(projectPath, preferredPort, runtimeId) : null;
+        const desktopChild = wantDesktop ? await openDesktopWindow(projectPath, preferredPort, runtimeId) : null;
         if (!desktopChild) {
             const port = await findAvailablePort(preferredPort);
             const server = new AiHubServer(projectPath ? { projectPath } : {});

package/dist/src/ai-hub/conversation-store-lock.js

@@ -7,22 +7,13 @@ exports.isLockStale = isLockStale;
 exports.withBucketLock = withBucketLock;
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
+const process_liveness_1 = require("./process-liveness");
 const DEFAULT_TIMEOUT_MS = 5000;
 const DEFAULT_STALE_MS = 10000;
 // Synchronous sleep without a busy spin (the store's write path is synchronous).
 function sleepMs(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function pidAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        // ESRCH: no such process. EPERM: exists but not ours (still alive).
-        return error.code === 'EPERM';
-    }
-}
 // A lock is stale (safe to steal) if its file is unreadable/absent, its timestamp is older than
 // staleMs, or it names a dead pid on this same host.
 function isLockStale(lockPath, staleMs = DEFAULT_STALE_MS) {
@@ -35,7 +26,7 @@ function isLockStale(lockPath, staleMs = DEFAULT_STALE_MS) {
     }
     if (typeof info.ts === 'number' && Date.now() - info.ts > staleMs)
         return true;
-    if (typeof info.pid === 'number' && info.host === os_1.default.hostname() && !pidAlive(info.pid))
+    if (typeof info.pid === 'number' && info.host === os_1.default.hostname() && !(0, process_liveness_1.isPidAlive)(info.pid))
         return true;
     return false;
 }

package/dist/src/ai-hub/conversation-store.js

@@ -26,7 +26,6 @@ const HEADER_OMITTED_FIELDS = [
     'events',
     'artifacts',
     'run',
-    'delegation',
     'handoffSummary',
     '_bodyLoaded',
     '_stopping',
@@ -181,13 +180,34 @@ function placeConversationInBucket(bucket, conv) {
     const existingScore = conversationRichness(existing);
     const incomingScore = conversationRichness(conv);
     if (incomingScore > existingScore) {
-        bucket.conversations[idx] = conv;
+        bucket.conversations[idx] = withStableConversationCreatedAt(existing, conv);
     }
     else if (incomingScore === existingScore
         && timestampValue(value?.lastUpdatedAt) > timestampValue(existing.lastUpdatedAt)) {
-        bucket.conversations[idx] = conv;
+        bucket.conversations[idx] = withStableConversationCreatedAt(existing, conv);
     }
 }
+function stableConversationCreatedAt(existing, incoming) {
+    const existingValue = existing?.createdAt;
+    const incomingValue = incoming?.createdAt;
+    const existingTs = timestampValue(existingValue);
+    const incomingTs = timestampValue(incomingValue);
+    if (existingTs > 0 && incomingTs > 0)
+        return existingTs <= incomingTs ? existingValue : incomingValue;
+    if (existingTs > 0)
+        return existingValue;
+    if (incomingTs > 0)
+        return incomingValue;
+    return existingValue ?? incomingValue;
+}
+function withStableConversationCreatedAt(existing, incoming) {
+    if (!incoming || typeof incoming !== 'object')
+        return incoming;
+    const createdAt = stableConversationCreatedAt(existing, incoming);
+    if (createdAt === undefined)
+        return incoming;
+    return { ...incoming, createdAt };
+}
 // Relocate any project-scoped record mis-filed under the wrong project bucket back to its own
 // project (see docs/rca/hub-conversation-cross-project-leak.md). Sentinel buckets are left as-is.
 function migrateProjectBuckets(store) {
@@ -303,14 +323,45 @@ function newestFirst(a, b) {
 }
 function toHeader(conv) {
     const header = { ...conv };
+    const delegation = compactDelegationForHeader(header.delegation);
     for (const field of HEADER_OMITTED_FIELDS)
         delete header[field];
+    if (delegation)
+        header.delegation = delegation;
     for (const field of Object.keys(header)) {
         if (field.startsWith('_'))
             delete header[field];
     }
     return header;
 }
+function compactDelegationForHeader(raw) {
+    if (!raw || typeof raw !== 'object')
+        return undefined;
+    const delegation = raw;
+    const tasks = Array.isArray(delegation.tasks) ? delegation.tasks : [];
+    if (!tasks.length)
+        return undefined;
+    return {
+        delegationRequired: delegation.delegationRequired === true,
+        objective: delegation.objective,
+        orchestratorPersonaKey: delegation.orchestratorPersonaKey,
+        rootRunId: delegation.rootRunId,
+        managerRunId: delegation.managerRunId,
+        tasks: tasks.map((task) => {
+            const value = task && typeof task === 'object' ? task : {};
+            return {
+                taskId: value.taskId,
+                title: value.title,
+                status: value.status,
+                personaKey: value.personaKey,
+                jobId: value.jobId,
+                runId: value.runId,
+                conversationId: value.conversationId,
+                dependsOn: Array.isArray(value.dependsOn) ? value.dependsOn : [],
+            };
+        }),
+    };
+}
 function headerNeedsSanitization(header) {
     const value = header;
     return Object.keys(value).some((field) => HEADER_OMITTED_FIELD_SET.has(field) || field.startsWith('_'));
@@ -345,6 +396,17 @@ class AiHubConversationStore {
         // Sibling directory of the legacy file, e.g. ~/.fraim/ai-hub-conversations/
         this.shardRoot = path_1.default.join(dir, base);
     }
+    /**
+     * Root directory holding the per-bucket shards.
+     *
+     * Issue #1164: exposed read-only so callers that walk the shard layout, such as
+     * the stale-bucket sweep, ask the store where its data lives instead of
+     * re-deriving the path. Two independent derivations of the same layout drift the
+     * moment one changes, and a sweep pointed at the wrong directory fails silently.
+     */
+    get shardRootPath() {
+        return this.shardRoot;
+    }
     // ---- path helpers ----
     bucketDir(bucketKey) {
         const canonical = bucketKey === exports.MANAGER_SCOPE_KEY || bucketKey === exports.COMPANY_SCOPE_KEY
@@ -732,6 +794,7 @@ class AiHubConversationStore {
                 id: existing.id,
                 projectPath: key,
                 agentName: patch.agentName || existing.agentName,
+                createdAt: stableConversationCreatedAt(existing, patch) ?? existing.createdAt,
                 lastUpdatedAt: patch.lastUpdatedAt ?? new Date().toISOString(),
             }) ?? existing;
             this.writeConvFile(bucketDir, key, merged);

package/dist/src/ai-hub/electron-dist.js

@@ -0,0 +1,265 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HUB_ELECTRON_VERSION = void 0;
+exports.electronExecutableRelativePath = electronExecutableRelativePath;
+exports.resolveSharedElectronDistDir = resolveSharedElectronDistDir;
+exports.resolveSharedElectronBinaryPath = resolveSharedElectronBinaryPath;
+exports.isElectronDistComplete = isElectronDistComplete;
+exports.ensureSharedElectronDist = ensureSharedElectronDist;
+exports.resolveHubElectronBinary = resolveHubElectronBinary;
+// #1112: one shared, versioned Electron dist instead of a private 345 MB copy per npx install.
+//
+// `electron` used to be a hard dependency of packages/fraim-hub. npm runs its postinstall in every
+// tree it installs into, and that postinstall extracts the ~345 MB platform zip. Because
+// `npx fraim-hub@latest` creates a fresh `_npx/<hash>/` tree for every published version, the same
+// dist was unpacked again on every upgrade: 27 copies and 9.1 GB on one developer machine, and a
+// first-execution cost on freshly written binaries that was the largest remaining term in the Hub
+// cold start measured in #1110.
+//
+// The extraction cannot be skipped at launch time. electron/install.js short-circuits only on
+// ELECTRON_SKIP_BINARY_DOWNLOAD, read from the environment of the npm process, and by the time
+// src/ai-hub/cli.ts runs npm has already unpacked. So `electron` is no longer declared at all, and
+// the Hub resolves the binary itself from ~/.fraim/bin/electron/<version>/ — extracted once per
+// Electron version per machine, shared by every installed and future fraim-hub version.
+//
+// The zip still comes from the same shared cache npm used (~/AppData/Local/electron/Cache on
+// Windows, ~/Library/Caches/electron on macOS, ~/.cache/electron on Linux), because this reuses
+// @electron/get and extract-zip — the two modules electron/install.js itself uses. That keeps
+// checksum validation, mirror and proxy environment variables, and symlink- and mode-preserving
+// extraction behaving exactly as they do today.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+const process_liveness_1 = require("./process-liveness");
+/**
+ * The exact Electron release the Hub runs on, and the runtime source of truth for it.
+ *
+ * @electron/get needs an exact version: a range cannot name a download. Two other declarations are
+ * pinned to this value and `scripts/validate-package-split.ts` fails the build if either drifts:
+ *   - `packages/fraim-hub` `build.electronVersion`, which is how electron-builder learns the
+ *     version now that `electron` is absent from that manifest.
+ *   - the repo root's `dependencies.electron` range, which still installs Electron for local dev,
+ *     `npm run hub:desktop`, and the Electron-launching test suites.
+ */
+exports.HUB_ELECTRON_VERSION = '41.2.2';
+/** Relative path of the Electron executable inside a dist, matching getPlatformPath() in electron/install.js. */
+function electronExecutableRelativePath(platform = process.platform) {
+    switch (platform) {
+        case 'darwin':
+            return path_1.default.join('Electron.app', 'Contents', 'MacOS', 'Electron');
+        case 'win32':
+            return 'electron.exe';
+        default:
+            return 'electron';
+    }
+}
+// An Electron release is `x.y.z` or `x.y.z-<prerelease>`, and nothing else. Anchoring on that shape
+// means a version string can never carry path syntax into the directory name below, which matters
+// because `ensureSharedElectronDist` calls a recursive `fs.rmSync` on the resulting path: a version
+// of `../../..` would delete an unrelated tree. Not reachable today - every caller resolves to the
+// compile-time `HUB_ELECTRON_VERSION` - so this is a guard at the write boundary, kept next to the
+// path construction it protects rather than left to every future caller to remember.
+const EXACT_ELECTRON_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+function assertPathSafeVersion(version) {
+    if (!EXACT_ELECTRON_VERSION.test(version)) {
+        throw new Error(`Refusing to use "${version}" as an Electron version: expected an exact release such as 41.2.2.`);
+    }
+    return version;
+}
+/**
+ * `~/.fraim/bin/electron/<version>/`.
+ *
+ * Deliberately a sibling of, not a child of, `resolveHubInstallDir()`
+ * (`~/.fraim/bin/fraim-hub-electron/`). That directory belongs to the installed Hub application:
+ * `runHubInstall` writes `fraim-hub.exe` and the downloaded release asset into it, and
+ * `installDownloadedAsset` does an `fs.rmSync` inside it on macOS. A shared runtime with a
+ * different lifecycle should not live inside a tree another code path deletes from.
+ */
+function resolveSharedElectronDistDir(version, fraimDir = (0, project_fraim_paths_1.getUserFraimDirPath)()) {
+    return path_1.default.join(fraimDir, 'bin', 'electron', assertPathSafeVersion(version));
+}
+/** Absolute path of the Electron executable inside the shared dist for a version. */
+function resolveSharedElectronBinaryPath(version, fraimDir = (0, project_fraim_paths_1.getUserFraimDirPath)(), platform = process.platform) {
+    return path_1.default.join(resolveSharedElectronDistDir(version, fraimDir), electronExecutableRelativePath(platform));
+}
+/**
+ * Whether a directory holds a complete dist for exactly this version.
+ *
+ * Same two conditions electron's own `isInstalled()` checks: the `version` file names this release,
+ * and the platform executable is present. A dist that fails either is stale or half-written, and
+ * spawning from it would fail at launch instead of here.
+ */
+function isElectronDistComplete(distDir, version, platform = process.platform) {
+    try {
+        const recorded = fs_1.default.readFileSync(path_1.default.join(distDir, 'version'), 'utf8').trim().replace(/^v/, '');
+        if (recorded !== version)
+            return false;
+        return fs_1.default.existsSync(path_1.default.join(distDir, electronExecutableRelativePath(platform)));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolve the platform zip through @electron/get, so a zip npm already cached for this version is a
+ * cache hit and no bytes cross the network. Checksums stay enabled: @electron/get validates the
+ * artifact against SHASUMS256.txt, fetching that 2 KB file when no local checksums.json is
+ * available. That is the only integrity check standing between a 345 MB download and executing it.
+ */
+const downloadElectronZip = async ({ version, platform, arch }) => {
+    // Required lazily: @electron/get pulls in got, fs-extra, and sumchecker, and none of that belongs
+    // in the module graph of a launch that resolves an already-extracted dist.
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const { downloadArtifact } = require('@electron/get');
+    return downloadArtifact({ version, artifactName: 'electron', platform, arch });
+};
+const extractElectronZip = async (zipPath, destDir) => {
+    // extract-zip is what electron/install.js uses, and it preserves the mode bits and the symlinks
+    // inside Electron.app/Contents/Frameworks that a naive zip reader drops.
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const extract = require('extract-zip');
+    await extract(zipPath, { dir: destDir });
+};
+/**
+ * Remove staging trees whose owning process is gone.
+ *
+ * The `finally` that cleans up a staging tree does not run when the process is killed, and the
+ * window it covers is a visible "Preparing the shared Electron runtime" message that invites a
+ * Ctrl+C. Without this sweep, one impatient interrupt strands ~345 MB under `~/.fraim` forever,
+ * which is the same disk leak this change exists to stop. A staging tree whose pid is still alive
+ * belongs to a concurrent launch and is left alone.
+ */
+function sweepDeadStagingDirs(distDir) {
+    const parent = path_1.default.dirname(distDir);
+    const prefix = `${path_1.default.basename(distDir)}.staging-`;
+    let entries;
+    try {
+        entries = fs_1.default.readdirSync(parent, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !entry.name.startsWith(prefix))
+            continue;
+        const pid = Number(entry.name.slice(prefix.length));
+        if (Number.isInteger(pid) && pid > 0 && (0, process_liveness_1.isPidAlive)(pid))
+            continue;
+        try {
+            fs_1.default.rmSync(path_1.default.join(parent, entry.name), { recursive: true, force: true });
+        }
+        catch {
+            /* best effort: a tree we cannot delete is not a reason to fail a launch */
+        }
+    }
+}
+/**
+ * Return the Electron executable in the shared dist for this version, extracting it first if it is
+ * not already there. Returns immediately when a complete dist exists, which is the case on every
+ * launch after the first for a given Electron version.
+ *
+ * Extraction goes to a staging sibling and is promoted with a rename, matching the
+ * `${dir}.staging-${pid}` pattern in `org-pack-sync.ts` and `manager-pack-sync.ts`. A failure
+ * therefore leaves no partial tree at the versioned path, so the next launch cannot mistake one for
+ * a usable dist.
+ */
+async function ensureSharedElectronDist(options = {}) {
+    const version = options.version ?? exports.HUB_ELECTRON_VERSION;
+    const fraimDir = options.fraimDir ?? (0, project_fraim_paths_1.getUserFraimDirPath)();
+    const platform = options.platform ?? process.platform;
+    const arch = options.arch ?? process.arch;
+    const distDir = resolveSharedElectronDistDir(version, fraimDir);
+    const binaryPath = resolveSharedElectronBinaryPath(version, fraimDir, platform);
+    if (isElectronDistComplete(distDir, version, platform)) {
+        return binaryPath;
+    }
+    const downloadZip = options.downloadZip ?? downloadElectronZip;
+    const extractZip = options.extractZip ?? extractElectronZip;
+    const onProgress = options.onProgress;
+    onProgress?.(`Preparing the shared Electron ${version} runtime in ${distDir}. `
+        + 'This happens once per Electron version on this machine; later Hub launches reuse it.');
+    const zipPath = await downloadZip({ version, platform, arch });
+    await extractAndPromote({ zipPath, distDir, version, platform, extractZip });
+    onProgress?.(`Shared Electron ${version} runtime ready.`);
+    return binaryPath;
+}
+/**
+ * Unpack a zip into `distDir`, atomically.
+ *
+ * Extraction goes to a `${distDir}.staging-${pid}` sibling and is promoted with a rename, matching
+ * the pattern in `org-pack-sync.ts` and `manager-pack-sync.ts`. A failure therefore leaves no
+ * partial tree at the versioned path, so the next launch cannot mistake one for a usable dist.
+ */
+async function extractAndPromote(args) {
+    const { zipPath, distDir, version, platform, extractZip } = args;
+    const stagingDir = `${distDir}.staging-${process.pid}`;
+    fs_1.default.mkdirSync(path_1.default.dirname(distDir), { recursive: true });
+    sweepDeadStagingDirs(distDir);
+    fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
+    try {
+        await extractZip(zipPath, stagingDir);
+        if (!isElectronDistComplete(stagingDir, version, platform)) {
+            throw new Error(`Extracted Electron ${version} is missing its version file or ${electronExecutableRelativePath(platform)}; `
+                + `refusing to install an incomplete dist from ${zipPath}.`);
+        }
+        // A concurrent launch may have finished extracting the same version while this one worked.
+        // Promoting over a complete dist would delete the tree that launch is spawning from, so the
+        // winner keeps it and this one discards its own copy.
+        if (!isElectronDistComplete(distDir, version, platform)) {
+            fs_1.default.rmSync(distDir, { recursive: true, force: true });
+            try {
+                fs_1.default.renameSync(stagingDir, distDir);
+            }
+            catch (error) {
+                // The same race, one step later: the target can appear between that check and this rename.
+                // A complete dist at the target is the outcome this call wanted, so it is success.
+                if (!isElectronDistComplete(distDir, version, platform))
+                    throw error;
+            }
+        }
+    }
+    finally {
+        fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
+    }
+}
+/** Resolve the `electron` npm package's own binary, or null when it is absent or points nowhere. */
+function resolveInstalledElectronBinary(requireElectron) {
+    try {
+        const binaryPath = requireElectron();
+        return typeof binaryPath === 'string' && fs_1.default.existsSync(binaryPath) ? binaryPath : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The Electron binary this Hub should launch, or null when there is none.
+ *
+ * An installed `electron` package wins when one is present. That is this repo, and any consumer who
+ * depends on Electron themselves: its dist is already on disk, so preferring it avoids a needless
+ * download and keeps `npm run hub:desktop` and the Electron-launching suites on the exact path they
+ * use today. The published `fraim-hub` package declares no `electron`, so it takes the shared dist.
+ *
+ * Null is a supported outcome, not a failure: `openDesktopWindow()` returns null in that case and
+ * `runHub` starts the in-process server and opens a browser. An offline first launch must reach that
+ * fallback rather than throwing, so a download failure is reported through `onError` and swallowed.
+ */
+async function resolveHubElectronBinary(options = {}) {
+    const requireElectron = options.requireElectron
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        ?? (() => require('electron'));
+    const installed = resolveInstalledElectronBinary(requireElectron);
+    if (installed) {
+        return { binaryPath: installed, source: 'installed-package' };
+    }
+    try {
+        return { binaryPath: await ensureSharedElectronDist(options), source: 'shared-dist' };
+    }
+    catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)));
+        return null;
+    }
+}

package/dist/src/ai-hub/hosts.js

@@ -381,7 +381,19 @@ function extractSignalFromArgs(args) {
         : 'starting';
     const findings = args.findings;
     const findingsText = findings && typeof findings.summary === 'string' ? findings.summary : undefined;
-    const discriminant = typeof args.runDiscriminant === 'string' ? args.runDiscriminant : undefined;
+    // Issue #1135: `runDiscriminant` is not a field of the seekMentoring tool schema
+    // and no agent sends it, so before issue #1123 this was populated only by the
+    // scripted test double and production always resolved with the literal default
+    // 'feature'. The real discriminant is the one the mentor routes on
+    // (`findings.phaseOutcome`), so read that first and keep the legacy field as a
+    // fallback for the test double.
+    const evidenceArgs = args.evidence;
+    const discriminantFromFindings = findings && typeof findings.phaseOutcome === 'string' ? findings.phaseOutcome
+        : findings && typeof findings.issueType === 'string' ? findings.issueType
+            : evidenceArgs && typeof evidenceArgs.issueType === 'string' ? evidenceArgs.issueType
+                : undefined;
+    const discriminant = discriminantFromFindings
+        ?? (typeof args.runDiscriminant === 'string' ? args.runDiscriminant : undefined);
     const jobName = typeof args.jobName === 'string' ? args.jobName : undefined;
     const jobId = typeof args.jobId === 'string' ? args.jobId : undefined;
     const issueNumber = typeof args.issueNumber === 'string' ? args.issueNumber
@@ -1787,6 +1799,7 @@ class CliHostRuntime {
 exports.CliHostRuntime = CliHostRuntime;
 class FakeHostRuntime {
     constructor() {
+        this.isTestDouble = true;
         this.employees = [
             { id: 'codex', label: 'Codex', available: true, detail: 'Test double employee.', supportsRaw: true },
             { id: 'claude', label: 'Claude Code', available: true, detail: 'Test double employee.', supportsRaw: true },
@@ -1878,6 +1891,7 @@ exports.FakeHostRuntime = FakeHostRuntime;
 // FakeHostRuntime (smaller surface, no seekMentoring).
 class ScriptedHostRuntime {
     constructor() {
+        this.isTestDouble = true;
         this.employees = [
             { id: 'codex', label: 'Codex', available: true, detail: 'Scripted test double.', supportsRaw: true },
             { id: 'claude', label: 'Claude Code', available: true, detail: 'Scripted test double.', supportsRaw: true },

package/dist/src/ai-hub/process-liveness.js

@@ -0,0 +1,25 @@
+"use strict";
+// Is a pid on this host still running? A leaf with no dependencies, so any Hub module can use it
+// without pulling in a graph or creating an import cycle.
+//
+// #1112 consolidated three byte-identical copies of this: `isProcessAlive` in `cli.ts` (which
+// decides whether a recorded Hub instance is live), `pidAlive` in `conversation-store-lock.ts`
+// (which decides whether a lock is stealable), and a third that the shared-Electron-dist sweep
+// would otherwise have added.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPidAlive = isPidAlive;
+/**
+ * `process.kill(pid, 0)` sends no signal; it only checks that the process exists and is signalable.
+ * `ESRCH` means no such process. `EPERM` means it exists but belongs to another user, which still
+ * counts as alive — treating it as dead is what would let a caller steal a live lock or delete a
+ * live process's working tree.
+ */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}