geneseed 4.9.4 → 4.14.0

package/js/inspect/checks-repo.mjs

@@ -9,7 +9,8 @@
  */
 import path from 'node:path';
 import {
-  ALIASES_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf, knownSkillIds,
+  ALIASES_RE, CREDIT_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf,
+  knownSkillIds, upstreams,
 } from '../build/source.mjs';
 import { HOSTS } from '../hosts/hosts.mjs';
 import { installTargets, installsReferencingShim } from '../hosts/installs.mjs';
@@ -22,7 +23,7 @@ import { splitLines } from '../lib/udiff.mjs';
 import { ENTITY_STATUSES } from './inventory.mjs';
 import { assessRepo } from './scorecard.mjs';
 import { badgeUrl, renderSvg } from './scorecard-svg.mjs';
-import { isDir, isFile, rglob, srcStems } from './scan.mjs';
+import { isDir, isFile, rglob, srcStems, within } from './scan.mjs';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 
 /**
@@ -225,14 +226,17 @@ const MOVING_REFS = new Set(['main', 'master', 'develop', 'dev', 'head', 'latest
 
 /**
  * `_harness_build._vendor_pin_problems` — every vendored skill folder records where it came
- * from, under which license, and at WHICH immutable commit.
+ * from: `**Upstream key:** <key>`, naming its `src/upstreams.json` entry, which holds the repo,
+ * the pinned commit and the licence (`creditProblems` checks those facts).
  *
  * First-party folders that merely ride the vendored mechanism for their multi-file layout
- * declare that instead (`**Upstream:** this …`) and are exempt from the pin: there is no
- * upstream to drift against.
+ * declare that instead (`**Upstream:** this …`, plus a `**License:**`) and have no key: there is
+ * no upstream to drift against.
  */
 export function vendorPinProblems() {
   const problems = [];
+  let entries;
+  try { entries = upstreams(); } catch { entries = {}; }  // creditProblems names the bad JSON
   for (const name of VENDORED_SKILL_DIRS) {
     const folder = path.join(SRC, 'skills', name);
     if (!isDir(folder)) {
@@ -246,24 +250,95 @@ export function vendorPinProblems() {
         + 'pinned commit and license are unrecorded');
       continue;
     }
-    if (!/\*\*License:\*\*/.test(text)) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md records no '**License:**'`);
-    }
     const upstream = /\*\*Upstream:\*\*\s*(\S+)/.exec(text);
-    if (!upstream) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md declares no '**Upstream:**'`);
+    if (upstream && upstream[1].toLowerCase().startsWith('this')) {  // first-party
+      if (!/\*\*License:\*\*/.test(text)) {
+        problems.push(`[authoring] skills/${name}/VENDOR.md records no '**License:**'`);
+      }
+      continue;
+    }
+    const key = /\*\*Upstream key:\*\*\s*(\S+)/.exec(text);
+    if (!key) {
+      problems.push(`[authoring] skills/${name}/VENDOR.md declares no '**Upstream key:**' `
+        + "(nor '**Upstream:** this repository' for a first-party folder)");
+    } else if (!Object.hasOwn(entries, key[1])) {
+      problems.push(`[authoring] skills/${name}/VENDOR.md names upstream key '${key[1]}', `
+        + 'which src/upstreams.json does not define');
+    }
+  }
+  return problems;
+}
+
+/** The files a `{{CREDIT:` may sit in: those `renderAll` derives a licence copy for, plus agents. */
+const CREDITABLE_RE = /^(?:skills\/[^/_][^/]*(?:\/[^/_][^/]*)?|agents\/[^/_][^/]*)\.md$/;
+
+/**
+ * Every credit ships with what it promises. A `{{CREDIT:<key>:…}}` key resolves in
+ * `src/upstreams.json`; every entry there is credited by a token or a VENDOR.md
+ * `**Upstream key:**`; its `licenseFile` exists (the emit copies it, and throws mid-build if
+ * not); its commit is an immutable sha. A token in a `_` partial is refused: it is included
+ * into other files, whose raw source `renderAll` scans for the licence copy, so it would credit
+ * without shipping the licence. A `licenseFile: null` is only for a key credited from a vendored
+ * folder alone, which ships its upstream's own LICENSE: anywhere else the licence text must
+ * ship with the work, so a token outside those folders needs a licence file.
+ */
+export function creditProblems(src = SRC) {
+  let entries;
+  try { entries = upstreams(src); } catch {
+    return ['[authoring] src/upstreams.json is not valid JSON'];
+  }
+  const problems = [];
+  const used = new Set();
+  /** key -> the first non-vendored file whose token credits it. */
+  const needsLicence = new Map();
+  for (const file of rglob(src)) {
+    if (!file.endsWith('.md') || !isFile(file)) continue;
+    const rel = path.relative(src, file).split(path.sep).join('/');
+    const text = readText(file);
+    const vendorKey = path.basename(file) === 'VENDOR.md' && /\*\*Upstream key:\*\*\s*(\S+)/.exec(text);
+    if (vendorKey) used.add(vendorKey[1]);
+    if (!text.includes('{{CREDIT:')) continue;
+    if (!CREDITABLE_RE.test(rel)) {
+      problems.push(`[authoring] ${rel} carries a {{CREDIT:}} token, but only skills/<stem>.md, `
+        + 'skills/<stem>/*.md and agents/*.md may — the licence copy is derived for those alone');
+      continue;
+    }
+    for (const key of new Set([...text.matchAll(CREDIT_RE)].map((m) => m[1]))) {
+      used.add(key);
+      const sp = rel.split('/');
+      if (!(sp.length > 2 && VENDORED_SKILL_DIRS.has(sp[1])) && !needsLicence.has(key)) needsLicence.set(key, rel);
+      if (!Object.hasOwn(entries, key)) {
+        problems.push(`[authoring] ${rel} credits '${key}', which src/upstreams.json does not define`);
+      }
+    }
+  }
+  for (const [key, u] of Object.entries(entries)) {
+    const where = `src/upstreams.json entry '${key}'`;
+    if (!used.has(key)) problems.push(`[authoring] ${where} is credited by no {{CREDIT:}} token and no VENDOR.md`);
+    const pin = String(u.commit ?? '');
+    if (MOVING_REFS.has(pin.toLowerCase())) {
+      problems.push(`[authoring] ${where} pins '${pin}', a moving branch — record the commit sha instead`);
+    } else if (!HEX40_RE.test(pin.toLowerCase())) {
+      problems.push(`[authoring] ${where} pin '${pin}' is not a 40-character commit sha`);
+    }
+    for (const field of ['repo', 'author', 'license']) {
+      if (!u[field]) problems.push(`[authoring] ${where} has no '${field}'`);
+    }
+    if (u.frozen !== undefined && typeof u.frozen !== 'boolean') {
+      problems.push(`[authoring] ${where} has frozen ${JSON.stringify(u.frozen)}, which is not a boolean`);
+    }
+    if (!u.licenseFile) {
+      if (needsLicence.has(key)) {
+        problems.push(`[authoring] ${where} has licenseFile null, but ${needsLicence.get(key)} credits it `
+          + 'outside a vendored folder — its licence text must ship with the work');
+      }
       continue;
     }
-    if (upstream[1].toLowerCase().startsWith('this')) continue;  // first-party
-    const pin = /\*\*Commit:\*\*\s*(\S+)/.exec(text);
-    if (!pin) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md has no '**Commit:**' pin`);
-    } else if (MOVING_REFS.has(pin[1].toLowerCase())) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md pins '${pin[1]}', a `
-        + 'moving branch — record the commit sha instead');
-    } else if (!HEX40_RE.test(pin[1].toLowerCase())) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md pin '${pin[1]}' is not `
-        + 'a 40-character commit sha');
+    // The emit copies it into every install, so it must be a file of this tree.
+    if (!within(path.resolve(src, u.licenseFile), path.resolve(src))) {
+      problems.push(`[authoring] ${where} names licenseFile '${u.licenseFile}', which resolves outside src/`);
+    } else if (!isFile(path.join(src, u.licenseFile))) {
+      problems.push(`[authoring] ${where} names licenseFile '${u.licenseFile}', which does not exist under src/`);
     }
   }
   return problems;

package/js/inspect/cost.mjs

@@ -35,7 +35,7 @@ import { isFile, readText } from '../lib/fs.mjs';
  * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
  * exactly the measured overrun and say why in that test's docblock, which keeps its history.
  */
-export const CARRIER_CEILING = { full: 62_219, lean: 39_111 };
+export const CARRIER_CEILING = { full: 62_263, lean: 39_156 };
 
 /**
  * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped

package/js/inspect/diff.mjs

@@ -49,7 +49,7 @@ import {
 } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultTheme, doctrinesForBuild, excludedRulesOfDir,
-  excludedSkillsOfDir, gatesOfDir,
+  excludedSkillsOfDir, gatesOfDir, kitsOfDir,
   footprintOfDir, modeOfDir, postureOfDir,
   trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
@@ -265,6 +265,8 @@ export function diffCollect({
     excludeRules: excludedRulesOfDir(dir),
     // The excluded skills, or every skill the install left out reads as deleted.
     excludeSkills: excludedSkillsOfDir(dir),
+    // The kits on, or every kit file reads as added and the Kits block as drift.
+    kits: kitsOfDir(dir),
     // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
     ...gatesOfDir(dir),
   };
@@ -319,8 +321,38 @@ export function diffCollect({
 /** The records that are drift: everything but a `linked` path, which is the user's own. */
 export const drifted = (files) => files.filter((f) => f.status !== 'linked');
 
+/** Where the self-improvement loops write, relative to an install's `notebook/`. */
+export const NOTES_DIRS = ['skill-notes', 'agent-notes'];
+
+/**
+ * The self-improvement notes an install has accumulated, as `{rel, body}` sorted by `rel`.
+ *
+ * WHY THESE ARE NOT DRIFT. The loops used to edit the rendered skill and agent files in place,
+ * which the doctor reported as stale and the next rebuild erased. They now write a sidecar
+ * under the notebook — seed-once and agent-owned, never in the manifest, so no rebuild touches
+ * it. That makes the notes the back-port QUEUE rather than an endangered edit: `diff` lists
+ * them and `--out` carries them so they can reach `src/`, but the upgrade export does not
+ * fire on them alone, because there is nothing for the rebuild to destroy. Empty files are
+ * skipped — an agent that cleared its notes has nothing to back-port.
+ */
+export function collectNotes(dir) {
+  const notes = [];
+  for (const sub of NOTES_DIRS) {
+    const d = path.join(dir, 'notebook', sub);
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const n of names.filter((x) => x.endsWith('.md')).sort()) {
+      const a = path.join(d, n);
+      if (!isFile(a)) continue;
+      const body = readText(a);
+      if (body.trim()) notes.push({ rel: `notebook/${sub}/${n}`, body });
+    }
+  }
+  return notes;
+}
+
 /** `_harness_diff._improvements_md` — pure; `when` is the caller's timestamp. */
-export function improvementsMd(target, theme, allFiles, when) {
+export function improvementsMd(target, theme, allFiles, when, notes = []) {
   // A linked path is never a back-port item: the file is the user's, not a local edit of ours.
   const files = drifted(allFiles);
   const edited = files.filter((f) => f.status === 'edited');
@@ -335,8 +367,8 @@ export function improvementsMd(target, theme, allFiles, when) {
     `- ${edited.length} edited · ${added.length} added in deployed · `
       + `${missing.length} missing from deployed`,
     '',
-    'The deployed harness drifted from a fresh render of `src/` — typically the',
-    'self-improvement loops editing agent/skill files in place. Hand this file to',
+    'The deployed harness drifted from a fresh render of `src/` — typically',
+    'agent/skill files edited in place, by hand or by an older harness. Hand this file to',
     'an agent in the Geneseed source repo and ask it to fold the changes below',
     'back into `src/`. Diffs read source -> deployed; the expected copy was',
     'rendered in the deployed theme, so only genuine local edits appear.',
@@ -350,6 +382,17 @@ export function improvementsMd(target, theme, allFiles, when) {
   for (const f of files) {
     lines.push(`## \`${f.rel}\`  (${label[f.status]})`, '', '```diff', ...f.diff, '```', '');
   }
+  // Only when there are notes, so a report without them stays byte-identical.
+  if (notes.length) {
+    lines.push('# Self-improvement notes', '',
+      'Corrections the agent recorded against a skill or agent instead of editing it.',
+      'Fold each one into the matching file under `src/`, then clear the note. Judge it by',
+      'its `seen:` evidence — a line without one is a claim, not a lesson — and weigh a',
+      '`[general]` line as a law, doctrine or memory rather than an edit to that one file.', '');
+    for (const n of notes) {
+      lines.push(`## \`${n.rel}\``, '', '```markdown', ...splitLines(n.body), '```', '');
+    }
+  }
   return `${lines.join('\n')}\n`;
 }
 
@@ -383,7 +426,9 @@ function stamp(d) {
  * the same instant, so a run that crosses a second boundary cannot name a file one second
  * away from what it says inside.
  */
-export function writeImprovements(target, theme, files, outPath = null) {
+export function writeImprovements(
+  target, theme, files, outPath = null, notes = collectNotes(target),
+) {
   const now = stamp(new Date());
   // `Path(out_path).expanduser()` — again NOT resolved, and again observable: the path is
   // printed, so `--out p.md` reports `p.md`.
@@ -391,7 +436,7 @@ export function writeImprovements(target, theme, files, outPath = null) {
     ? expanduser(outPath)
     : path.join(target, 'improvements', now.file);
   mkdirSync(path.dirname(p), { recursive: true });
-  writeText(p, improvementsMd(target, theme, files, now.when));
+  writeText(p, improvementsMd(target, theme, files, now.when, notes));
   return p;
 }
 
@@ -475,18 +520,21 @@ export function cmdDiff(args) {
     + `${missing.length} missing-from-deployed\n`);
   // Its own line, printed only when there is one, so the summary above is unchanged otherwise.
   if (linked.length) printOut(`[diff] ${linked.length} linked (yours, left alone)\n`);
+  const notes = collectNotes(target);
+  if (notes.length) printOut(`[diff] ${notes.length} self-improvement note(s) to back-port\n`);
   for (const f of edited) printOut(`  ~ ${f.rel}   (edited in deployed — review to back-port)\n`);
   for (const f of added) printOut(`  + ${f.rel}   (only in deployed — your addition)\n`);
   for (const f of missing) printOut(`  - ${f.rel}   (in source, not deployed — re-emit to add)\n`);
   for (const f of linked) printOut(`  = ${f.rel}   (a link — yours, left alone)\n`);
+  for (const n of notes) printOut(`  * ${n.rel}   (self-improvement note — review to back-port)\n`);
   if (args.out) {
-    if (drifted(files).length) {
+    if (drifted(files).length || notes.length) {
       // Bare `--out` is argparse's `nargs="?"` const: True, meaning "the default timestamped
       // path". `parse()` gives a flag `true` and an option a string, so the two arrive
       // distinguishable here without a third kind of entry in the VERBS table.
       const outPath = args.out === true ? null : args.out;
       printOut(`[diff] improvements file written: ${
-        writeImprovements(target, theme, files, outPath)}\n`);
+        writeImprovements(target, theme, files, outPath, notes)}\n`);
     } else {
       printOut('[diff] no differences — nothing written.\n');
     }

package/js/inspect/inventory.mjs

@@ -96,6 +96,8 @@ export const SKILL_CLASS = {
   develop: 'build', refactor: 'build', debug: 'build', dependencies: 'build',
   'frontend-design': 'build', prototype: 'build', deck: 'build',
   'forge-mcp': 'build', bruno: 'build', worktree: 'build',
+  'spring-boot': 'build', 'spring-data-jpa': 'build', 'spring-testing': 'build',
+  react: 'build', 'react-testing': 'build',
   'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'security-audit': 'review',
   'roast-me': 'review', 'review-response': 'review', ponytail: 'review',
   commit: 'ship', ship: 'ship', release: 'ship', handoff: 'ship',

package/js/inspect/status.mjs

@@ -58,12 +58,12 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 
-import { GATE_SWITCHES, THEMES, ROOT, makeCfg } from '../build/source.mjs';
+import { GATE_SWITCHES, THEMES, ROOT, loadKits, makeCfg } from '../build/source.mjs';
 import { tuiInventory } from './inventory.mjs';
 import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import {
   claudeConfigDir, bobConfigDir, openclaudeConfigDir, opencodeConfigDir, opencodeShadowedInstall,
-  isHostGlobalDir, resolvePath, resolveMemoryDir, sovereignBypass, CLAUDE_STYLE, GATE_LEDGER,
+  isHostGlobalDir, resolvePath, resolveMemoryDir, sovereignBypass, CLAUDE_STYLE, GATE_LEDGER, HOSTS,
 } from '../hosts/hosts.mjs';
 // P5f moved the install DETECTORS out of this file — `diff` renders its expected copy in the
 // deployed theme and footprint, and `rebuild-all` re-emits in the deployed everything, so
@@ -238,6 +238,40 @@ export function gateSummary(cfgDirs, platform = process.platform) {
 }
 
 /** `_harness_status._status_data`. */
+/**
+ * Spec R6: the member files of every kit NOT on in this install that are still on disk — the ones
+ * `pruneOwned` kept because their owner edited them — as `{ kit: [rel, ...] }`, or `null` when
+ * there are none. No new state: the kit manifests say which rels a member owns (`skills/<m>.md`,
+ * `skills/<m>/...`, `agents/<m>.md`), the install's layer dir says where to look.
+ */
+export function keptKitFiles(host, scope, root, active) {
+  const marker = HOSTS.find((h) => h.host === host)?.projectMarker;
+  const dir = scope === 'global' || !marker ? root : path.join(root, marker);
+  const walk = (rel) => {
+    const abs = path.join(dir, rel);
+    let entries;
+    try { entries = readdirSync(abs, { withFileTypes: true }); } catch { return []; }
+    return entries.flatMap((e) => (e.isDirectory() ? walk(`${rel}/${e.name}`)
+      : e.isFile() ? [`${rel}/${e.name}`] : []));
+  };
+  const kept = {};
+  let kits;
+  try { kits = loadKits(); } catch (e) {
+    process.stderr.write(`warning: kit rows skipped — ${e.message}\n`);
+    return null;
+  }
+  for (const [kit, m] of kits) {
+    if (active.includes(kit)) continue;
+    const rels = [
+      ...(m.skills ?? []).flatMap((n) => [`skills/${n}.md`].filter((r) => existsSync(path.join(dir, r)))
+        .concat(walk(`skills/${n}`))),
+      ...(m.agents ?? []).map((n) => `agents/${n}.md`).filter((r) => existsSync(path.join(dir, r))),
+    ].sort();
+    if (rels.length) kept[kit] = rels;
+  }
+  return Object.keys(kept).length ? kept : null;
+}
+
 export function statusData() {
   const inst = installedDefaults();
   const theme = inst.theme || defaultTheme();
@@ -304,10 +338,12 @@ export function statusData() {
     installs: installTargets().map(([host, scope, root]) => {
       try {
         const p = installProfile(host, scope, root);
+        // Only when something is kept, so `--json` without kits stays the bytes it was.
+        const kept = keptKitFiles(host, scope, root, p.kits);
         const rebuild = legacyProcessCarrierOfDir(root, host)
           ? "geneseed setup  # pre-comms carrier (names 'process 8') — run setup for this install, not a rebuild"
           : rebuildCommand(p.argv);
-        return { ...p, rebuild };
+        return { ...p, ...(kept ? { keptKitFiles: kept } : {}), rebuild };
       } catch (e) {
         return { host, scope, root, state: 'unreadable', error: String(e?.message ?? e) };
       }
@@ -422,10 +458,15 @@ export function statusLines(d, color = false) {
     const excl = p.excludeRules?.length ? `excluding ${p.excludeRules.join(',')}` : 'no rules excluded';
     rows.push([`${p.host}:${p.scope}`, [p.state, p.theme, p.footprint, `${p.posture}/${p.mode}/${p.trust}`,
       packs, excl, ...(p.excludeSkills?.length ? [`skills off: ${p.excludeSkills.join(',')}`] : []),
+      ...(p.kits?.length ? [`kits: ${p.kits.join(',')}`] : []),
       // Each elided when armed. The law's text still binds; only its tool-boundary gate is off.
       ...GATE_SWITCHES.filter((g) => p[g.key] === false)
         .map((g) => `${g.marker.toLowerCase()}: off (Law ${g.law} text still binds)`)]
       .join(` ${DOT} `) + where]);
+    // R6: a member its owner edited outlives its kit; name it, so turning the kit off is visible.
+    for (const [kit, rels] of Object.entries(p.keptKitFiles ?? {})) {
+      rows.push([`${p.host}:${p.scope}`, `kept from inactive kit ${kit}: ${rels.join(', ')}${where}`]);
+    }
   }
 
   const labelW = Math.max(...rows.map(([k]) => codePointLength(k)));

package/js/inspect/validate.mjs

@@ -34,8 +34,8 @@ export const VALIDATE_USAGE = [
   'usage: geneseed validate [-h] [--theme THEME] [--emit EMIT] [--out OUT] [--root ROOT]',
   '                         [--footprint {lean,full}] [--posture POSTURE] [--mode MODE]',
   '                         [--trust TRUST] [--doctrines DOCTRINES] [--exclude-rules RULES]',
-  '                         [--exclude-skills SKILLS] [--no-secrets-gate] [--no-done-gate]',
-  '                         [--no-deletion-gate] [-v]',
+  '                         [--exclude-skills SKILLS] [--kits KITS] [--no-secrets-gate]',
+  '                         [--no-done-gate] [--no-deletion-gate] [-v]',
   '',
   "Render and emit into a throwaway sandbox, run the doctor's checks, and write nothing real.",
   "Takes the generator's render flags (see geneseed-build --help) except --sync-themes and",
@@ -130,7 +130,7 @@ export function cmdValidate(args) {
     const opts = {
       theme: args.theme, footprint: args.footprint, posture: args.posture, mode: args.mode,
       trust: args.trust, doctrines: args.doctrines, excludeRules: args.excludeRules,
-      excludeSkills: args.excludeSkills,
+      excludeSkills: args.excludeSkills, kits: args.kits,
       ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, args[g.arg] ? false : null])),
     };
     let scanDirs;

package/js/lib/prompt.mjs

@@ -12,6 +12,9 @@ import { readSync } from 'node:fs';
 import { printOut } from './fs.mjs';
 import { parseIntStrict } from './text.mjs';
 
+/** A cell to `Atomics.wait` on: the synchronous pause between `readLine`'s EAGAIN retries. */
+const PAUSE = new Int32Array(new SharedArrayBuffer(4));
+
 /**
  * `_harness_setup._ask` — `input(f"{prompt}{suffix}: ").strip()`, or the default at EOF.
  *
@@ -71,14 +74,28 @@ export function promptLine(prompt) {
  * the wizard's first non-ASCII answer is what exposed it, and the corpus caught it on the
  * first run. Scanning for the terminators a byte at a time is still correct: `\n` and `\r`
  * are ASCII, and no continuation byte of a UTF-8 sequence is below 0x80.
+ *
+ * EAGAIN IS "NOTHING TYPED YET", NOT EOF. Touching `process.stdin` — even `.isTTY`, which
+ * `cmdSetup` reads first — makes libuv put a terminal fd 0 in non-blocking mode, and from then
+ * on `readSync` throws EAGAIN until a key is pressed. Caught as EOF, every prompt took its
+ * default the instant it printed: setup's "Continue without one? (y/N)" answered itself N and
+ * the install stopped before anyone could type (reported 2026-10, reproduced under a pty). So
+ * it waits 20 ms and reads again; any other error is still the end of input. `read` is the
+ * test seam.
  */
-function readLine() {
+export function readLine(read = readSync) {
   const buf = Buffer.alloc(1);
   const bytes = [];
   let eof = false;
   for (;;) {
     let n = 0;
-    try { n = readSync(0, buf, 0, 1, null); } catch { eof = true; break; }
+    try {
+      n = read(0, buf, 0, 1, null);
+    } catch (e) {
+      if (e && e.code === 'EAGAIN') { Atomics.wait(PAUSE, 0, 0, 20); continue; }
+      eof = true;
+      break;
+    }
     if (n === 0) { eof = true; break; }
     if (buf[0] === 0x0a) break;
     if (buf[0] !== 0x0d) bytes.push(buf[0]);