instar 1.3.641 → 1.3.643

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.641",
+  "version": "1.3.643",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,7 +28,7 @@
     "test:contract": "node scripts/run-contract-tests.js",
     "test:contract:raw": "vitest run --config vitest.contract.config.ts",
     "test:all": "vitest run && vitest run --config vitest.integration.config.ts && vitest run --config vitest.e2e.config.ts",
-    "lint": "tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-store-retention-declared.js && node scripts/lint-no-wholefile-sync-read.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js",
+    "lint": "tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-store-retention-declared.js && node scripts/lint-no-wholefile-sync-read.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-sync-subprocess-chokepoint.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js",
     "lint:destructive": "node scripts/lint-no-direct-destructive.js",
     "lint:dev-agent-dark-gate": "node scripts/lint-dev-agent-dark-gate.js",
     "lint:guard-manifest": "node scripts/lint-guard-manifest.js",

package/scripts/lint-no-direct-destructive.js

@@ -61,6 +61,15 @@ const ALLOWLIST = new Set([
   'src/core/SafeFsExecutor.ts',
   'tests/unit/SafeGitExecutor.test.ts',
   'tests/unit/SafeFsExecutor.test.ts',
+  // tmux-event-loop-resilience Increment 1 tests: per-test cleanup of
+  // mkdtempSync dirs under os.tmpdir() (the cross-process marker round-trip
+  // needs a real on-disk mirror dir; the e2e needs a throwaway stateDir). The
+  // targets are os.tmpdir paths, never the source tree. Routing through
+  // SafeFsExecutor.safeRmSync would write an audit entry per teardown call —
+  // worse noise than a scoped allowlist entry for a test's own tmpdir cleanup.
+  // (Spec: docs/specs/tmux-event-loop-resilience.md, Step 8.)
+  'tests/unit/InFlightSyncOpMarker.test.ts',
+  'tests/e2e/tmux-resilience-lifecycle.test.ts',
   // The lint rule itself runs before SafeGitExecutor.ts is compiled, so it
   // needs direct execSync as a bootstrap escape. The single git call here is
   // a read-only `git diff --cached --name-only` for staged-file detection.
@@ -96,6 +105,11 @@ const ALLOWLIST = new Set([
   // instar#1069) — read-only `git diff --cached --name-only` for --staged.
   // Cannot depend on the TS funnel because TS is not compiled at pre-push.
   'scripts/lint-no-mainthread-cartographer-walk.js',
+  // Same bootstrap-escape pattern (tmux sync-subprocess chokepoint lint,
+  // docs/specs/tmux-event-loop-resilience.md) — a read-only `git ls-files` /
+  // `git diff --cached --name-only` for staged-file detection. Cannot depend on
+  // the TS funnel because TS is not compiled when the lint runs in pre-push.
+  'scripts/lint-sync-subprocess-chokepoint.js',
   // Postinstall bootstrap script — runs before TypeScript is compiled and
   // before SafeFsExecutor is available. CommonJS, can't use ESM imports.
   'scripts/fix-better-sqlite3.cjs',

package/scripts/lint-sync-subprocess-chokepoint.js

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+/**
+ * lint-sync-subprocess-chokepoint.js — tmux Event-Loop Resilience, Increment 1.
+ *
+ * A SYNCHRONOUS subprocess spawn (`spawnSync` / `execSync` / `execFileSync`) blocks
+ * the single-threaded Node event loop for the FULL duration of the child process. A
+ * slow/wedged tmux (or any slow sync spawn) on the runtime hot path is exactly the
+ * ~0-CPU I/O-wait block this increment exists to make survivable: the marker module
+ * (src/core/InFlightSyncOpMarker.ts) is the SOLE funnel through which a sync blocking
+ * op may run — `withSyncOp(() => execFileSync(...))` records depth so SleepWakeDetector
+ * + ServerSupervisor can tell the block apart from a real sleep instead of mis-reaping
+ * the session or restarting a live-but-blocked server.
+ *
+ * Rule: in src/core/, src/monitoring/, and src/server/, no RAW synchronous child-process
+ * spawn (`spawnSync` / `execSync` / `execFileSync`) outside the chokepoint module. A
+ * raw sync spawn must EITHER funnel through `withSyncOp` (so the (B) marker sees it) OR,
+ * if it is a genuinely pre-runtime / CLI-boot call that can never run on a cadence,
+ * carry an inline justification comment on the same line or the line directly above:
+ *     // lint-allow-sync-spawn: <why this never blocks the runtime event loop>
+ *
+ * This lint bans the RAW spawn outside the funnel — NOT sync-ness itself: the marker
+ * module legitimately WRAPS sync calls, and the D1-excluded injection-sequence callsites
+ * (send-keys + /bin/sleep, where synchronous timing IS the correctness mechanism) stay
+ * sync but funnel through `withSyncOp`. So this lint is satisfied when a sync spawn is
+ * funneled, allow-commented, or grandfathered in the FROZEN baseline.
+ *
+ * COVERAGE HONESTY (No Silent Degradation): a static line-regex, NOT complete — it cannot
+ * prove a flagged line is actually WRAPPED by withSyncOp at runtime (that is the (B) unit
+ * tests' job). It is the cheap FORWARD ratchet that stops a NEW raw sync spawn from being
+ * introduced outside the funnel. The 40+ existing SessionManager callsites are
+ * grandfathered by the baseline so this increment's conversion can land incrementally.
+ *
+ * Ships baseline-grandfathered: a FROZEN baseline records today's literal hits; a NEW hit
+ * (not in the baseline, not funneled, not allow-commented) FAILS. The baseline may only
+ * shrink. Exit codes: 0 — clean; 1 — at least one new violation.
+ *
+ * Usage:
+ *   node scripts/lint-sync-subprocess-chokepoint.js                     # full scan dirs
+ *   node scripts/lint-sync-subprocess-chokepoint.js --staged            # staged files
+ *   node scripts/lint-sync-subprocess-chokepoint.js path/to/file.ts     # explicit files
+ *   node scripts/lint-sync-subprocess-chokepoint.js --write-baseline    # (re)generate baseline
+ *   node scripts/lint-sync-subprocess-chokepoint.js --baseline <p> --root <p>  # test overrides
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const ROOT = path.resolve(path.dirname(__filename), '..');
+
+function argVal(flag) {
+  const i = process.argv.indexOf(flag);
+  return i >= 0 && process.argv[i + 1] ? process.argv[i + 1] : null;
+}
+
+const BASELINE = path.resolve(
+  argVal('--baseline') || path.join(ROOT, 'scripts', 'sync-subprocess-chokepoint-baseline.json'),
+);
+// --root overrides the repo root the SCAN_DIRS are resolved against (tests / alternate checkouts).
+const SCAN_BASE = path.resolve(argVal('--root') || ROOT);
+const SCAN_DIRS = ['src/core', 'src/monitoring', 'src/server'];
+const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
+
+// The chokepoint module itself — the SOLE place a raw sync spawn may legitimately live
+// (it WRAPS the call in withSyncOp; everything else must route through it).
+const CHOKEPOINT = 'src/core/InFlightSyncOpMarker.ts';
+
+// A BARE synchronous child-process spawn imported from node:child_process. The
+// negative lookbehind `(?<![.\w])` rejects a member-access form (`SafeGitExecutor.execSync(`,
+// `SafeFsExecutor.execFileSync(`) — those are the SAFE funnels, not a raw event-loop block —
+// and a longer identifier (`myExecSync`). `\s*\(` so only an actual call matches, never an
+// import name. The *Async variants (execFileAsync / execFile) never match (different verb).
+const VIOLATION = /(?<![.\w])(spawnSync|execSync|execFileSync)\s*\(/;
+const ALLOW = /lint-allow-sync-spawn:/;
+// The FUNNEL: a sync spawn lexically wrapped by withSyncOp(...) on the same line is the
+// REQUIRED pattern (the (B) marker sees it) — never a violation, regardless of baseline.
+const FUNNELED = /\bwithSyncOp\s*\(/;
+
+const inScanDir = (p) => SCAN_DIRS.some((d) => p === d || p.startsWith(d + '/'));
+const normalize = (p) => p.split(path.sep).join('/');
+
+function listFiles() {
+  if (process.argv.includes('--staged')) {
+    const out = execSync('git diff --cached --name-only', { cwd: ROOT, encoding: 'utf-8' });
+    return out
+      .split('\n')
+      .filter(Boolean)
+      .map(normalize)
+      .filter((p) => inScanDir(p));
+  }
+  // Explicit file args are checked as-given (targeted use / self-tests).
+  const explicit = process.argv
+    .slice(2)
+    .filter((a) => !a.startsWith('--'))
+    // Drop the values consumed by --baseline / --root.
+    .filter((a) => a !== argVal('--baseline') && a !== argVal('--root'));
+  if (explicit.length) return explicit;
+
+  const files = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.name === 'node_modules' || e.name === '.git' || e.name === 'dist') continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (EXTENSIONS.has(path.extname(e.name))) files.push(full);
+    }
+  };
+  for (const d of SCAN_DIRS) walk(path.join(SCAN_BASE, d));
+  return files;
+}
+
+// Collect every raw sync-spawn hit not allow-commented and not in the chokepoint module.
+// Keyed on file + the trimmed call line + the occurrence index of that exact line text
+// within the file (line-number-independent so the baseline survives edits above it).
+function collectHits() {
+  const hits = [];
+  for (const fileArg of listFiles()) {
+    const abs = path.isAbsolute(fileArg) ? fileArg : path.join(ROOT, fileArg);
+    const rel = normalize(path.relative(ROOT, abs));
+    if (!EXTENSIONS.has(path.extname(rel))) continue;
+    if (rel === CHOKEPOINT) continue; // the funnel may wrap sync calls
+    let content;
+    try {
+      content = fs.readFileSync(abs, 'utf-8');
+    } catch {
+      continue;
+    }
+    const lines = content.split('\n');
+    const seenLineText = new Map(); // trimmed-line-text → occurrence count so far
+    for (let i = 0; i < lines.length; i++) {
+      const raw = lines[i];
+      const trimmed = raw.trimStart();
+      if (/^(\/\/|\*|\/\*)/.test(trimmed)) continue; // comment-only mention
+      if (!VIOLATION.test(raw)) continue;
+      // FUNNELED: a sync spawn wrapped by withSyncOp(...) on the same line is the required
+      // pattern (the marker sees it) — allowed unconditionally, never grandfathered/baselined.
+      if (FUNNELED.test(raw)) continue;
+      // Inline justification on this line or within the 6 lines directly above.
+      let allowed = false;
+      for (let j = i; j >= Math.max(0, i - 6); j--) {
+        if (ALLOW.test(lines[j])) {
+          allowed = true;
+          break;
+        }
+      }
+      if (allowed) continue;
+      const text = raw.trim();
+      const occ = seenLineText.get(text) ?? 0;
+      seenLineText.set(text, occ + 1);
+      hits.push({ file: rel, line: i + 1, text, key: `${rel}::${text}::${occ}` });
+    }
+  }
+  return hits;
+}
+
+const hits = collectHits();
+
+// Generate-baseline mode: record current hits as grandfathered.
+if (process.argv.includes('--write-baseline')) {
+  fs.writeFileSync(
+    BASELINE,
+    JSON.stringify(
+      {
+        note:
+          'FROZEN baseline of RAW synchronous subprocess spawns (spawnSync/execSync/execFileSync) outside the InFlightSyncOpMarker funnel, at tmux Event-Loop Resilience Increment 1. These are grandfathered while the (A)/(B) conversion lands incrementally. May only SHRINK — a NEW raw sync spawn outside the funnel fails the lint. Funnel a call through withSyncOp(), or add an inline "// lint-allow-sync-spawn: <reason>" for a genuine pre-runtime/CLI-boot call.',
+        frozenAt: '2026-06-22',
+        keys: hits.map((h) => h.key).sort(),
+      },
+      null,
+      2,
+    ) + '\n',
+  );
+  console.log(`lint-sync-subprocess-chokepoint: wrote baseline with ${hits.length} grandfathered hit(s).`);
+  process.exit(0);
+}
+
+let baseline = { keys: [] };
+try {
+  baseline = JSON.parse(fs.readFileSync(BASELINE, 'utf8'));
+} catch {
+  // No baseline yet → treat as empty (every current hit is a NEW violation).
+}
+const baselineSet = new Set(baseline.keys || []);
+
+const newViolations = hits.filter((h) => !baselineSet.has(h.key));
+if (newViolations.length) {
+  console.error('lint-sync-subprocess-chokepoint: FAIL — new RAW synchronous subprocess spawn(s) outside the InFlightSyncOpMarker funnel:');
+  for (const v of newViolations) {
+    console.error(
+      `  • ${v.file}:${v.line} — raw sync spawn (${v.text}). A sync blocking op must funnel through ` +
+        `withSyncOp() so the in-flight marker sees it (or add "// lint-allow-sync-spawn: <reason>" for a genuine ` +
+        `pre-runtime/CLI-boot call). See docs/specs/tmux-event-loop-resilience-spec.md.`,
+    );
+  }
+  console.error(`\nlint-sync-subprocess-chokepoint: ${newViolations.length} new violation(s).`);
+  process.exit(1);
+}
+console.log(
+  `lint-sync-subprocess-chokepoint: clean — ${hits.length} raw sync spawn(s), all grandfathered (${baselineSet.size} baselined).`,
+);
+process.exit(0);

package/scripts/sync-subprocess-chokepoint-baseline.json

@@ -0,0 +1,148 @@
+{
+  "note": "FROZEN baseline of RAW synchronous subprocess spawns (spawnSync/execSync/execFileSync) outside the InFlightSyncOpMarker funnel, at tmux Event-Loop Resilience Increment 1. These are grandfathered while the (A)/(B) conversion lands incrementally. May only SHRINK — a NEW raw sync spawn outside the funnel fails the lint. Funnel a call through withSyncOp(), or add an inline \"// lint-allow-sync-spawn: <reason>\" for a genuine pre-runtime/CLI-boot call.",
+  "frozenAt": "2026-06-22",
+  "keys": [
+    "src/core/AgentRegistry.ts::execSync(`lsof -iTCP:${port} -sTCP:LISTEN -P -n`, { stdio: 'ignore' });::0",
+    "src/core/AgentWorktreeDetector.ts::output = execFileSync('git', ['-C', opts.instarRepo, 'worktree', 'list', '--porcelain'], {::0",
+    "src/core/BitwardenProvider.ts::const created = execFileSync(bw, [::0",
+    "src/core/BitwardenProvider.ts::const existingJson = execFileSync(bw, [::0",
+    "src/core/BitwardenProvider.ts::const output = execFileSync(bw, ['status', '--raw'], {::0",
+    "src/core/BitwardenProvider.ts::const output = execFileSync(bw, [::0",
+    "src/core/BitwardenProvider.ts::const output = execFileSync(bw, [::1",
+    "src/core/BitwardenProvider.ts::const output = execFileSync(bw, [::2",
+    "src/core/BitwardenProvider.ts::const output = execFileSync(bw, [::3",
+    "src/core/BitwardenProvider.ts::const result = execFileSync('which', ['bw'], {::0",
+    "src/core/BitwardenProvider.ts::const session = execFileSync(bw, ['login', email, masterPassword, '--raw'], {::0",
+    "src/core/BitwardenProvider.ts::const session = execFileSync(bw, ['unlock', masterPassword, '--raw'], {::0",
+    "src/core/BitwardenProvider.ts::execFileSync(bw, ['list', 'folders', '--raw'], {::0",
+    "src/core/BitwardenProvider.ts::execFileSync(bw, [::0",
+    "src/core/BitwardenProvider.ts::execFileSync(bw, [::1",
+    "src/core/BitwardenProvider.ts::execFileSync(bw, [::2",
+    "src/core/CaffeinateManager.ts::const result = spawnSync('pgrep', ['-x', 'caffeinate'], {::0",
+    "src/core/Config.ts::const asdfResult = execFileSync(asdfBin, ['which', name], {::0",
+    "src/core/Config.ts::const npmPrefix = execFileSync('npm', ['config', 'get', 'prefix'], {::0",
+    "src/core/Config.ts::const result = execFileSync('which', ['gh'], { encoding: 'utf-8', stdio: 'pipe' }).trim();::0",
+    "src/core/Config.ts::const result = execFileSync('which', ['git'], { encoding: 'utf-8', stdio: 'pipe' }).trim();::0",
+    "src/core/Config.ts::const result = execFileSync('which', ['tmux'], { encoding: 'utf-8', stdio: 'pipe' }).trim();::0",
+    "src/core/Config.ts::const result = execFileSync('which', [name], {::0",
+    "src/core/FileClassifier.ts::execFileSync(bin, args, {::0",
+    "src/core/GitSync.ts::execFileSync('sh', ['-c', validationConfig.buildCommand], {::0",
+    "src/core/GitSync.ts::execFileSync('sh', ['-c', validationConfig.testCommand], {::0",
+    "src/core/GlobalInstallCleanup.ts::execFileSync('asdf', ['reshim', 'nodejs'], {::0",
+    "src/core/InstarWorktreeManager.ts::execFileSync('npm', ['run', 'prepare'], {::0",
+    "src/core/OAuthRefresher.ts::const raw = execFileSync(::0",
+    "src/core/OAuthRefresher.ts::execFileSync(::0",
+    "src/core/PostUpdateMigrator.ts::execFileSync('plutil', ['-lint', plistPath], { stdio: 'pipe' });::0",
+    "src/core/PostUpdateMigrator.ts::try { execFileSync('launchctl', ['bootout', `gui/${uid}`, plistPath], { stdio: 'ignore' }); } catch { /* not loaded */ }::0",
+    "src/core/PostUpdateMigrator.ts::try { execFileSync('launchctl', ['bootstrap', `gui/${uid}`, plistPath], { stdio: 'ignore' }); } catch { /* non-fatal */ }::0",
+    "src/core/Prerequisites.ts::const output = execFileSync(claudePath, ['--version'], {::0",
+    "src/core/Prerequisites.ts::const output = execFileSync(tmuxPath, ['-V'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();::0",
+    "src/core/Prerequisites.ts::execFileSync('/bin/bash', [::0",
+    "src/core/Prerequisites.ts::execFileSync('which', ['brew'], { encoding: 'utf-8', stdio: 'pipe' });::0",
+    "src/core/Prerequisites.ts::execFileSync(cmd, args, {::0",
+    "src/core/SafeGitExecutor.ts::_cachedConfigIdentity.email = execFileSync('git', ['config', '--global', 'user.email'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).toString().trim() || undefined;::0",
+    "src/core/SafeGitExecutor.ts::_cachedConfigIdentity.name = execFileSync('git', ['config', '--global', 'user.name'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).toString().trim() || undefined;::0",
+    "src/core/SafeGitExecutor.ts::static execSync(args: readonly string[], opts: SafeGitOptions): string {::0",
+    "src/core/SafeGitExecutor.ts::stdout = execFileSync('git', args as string[], {::0",
+    "src/core/SafeGitExecutor.ts::stdout = execFileSync('git', args as string[], {::1",
+    "src/core/SecretStore.ts::const result = execFileSync('secret-tool', [::0",
+    "src/core/SecretStore.ts::const result = execFileSync('security', [::0",
+    "src/core/SecretStore.ts::execFileSync('secret-tool', [::0",
+    "src/core/SecretStore.ts::execFileSync('security', [::0",
+    "src/core/SecretStore.ts::execFileSync('security', [::1",
+    "src/core/SessionManager.ts::const out = execFileSync(::0",
+    "src/core/SessionManager.ts::const out = execFileSync(::1",
+    "src/core/SessionManager.ts::const paneInfo = execFileSync(::0",
+    "src/core/SessionManager.ts::const panePid = execFileSync(::0",
+    "src/core/SessionManager.ts::const panePid = execFileSync(::1",
+    "src/core/SessionManager.ts::const panePid = execFileSync(::2",
+    "src/core/SessionManager.ts::const psOutput = execFileSync(::0",
+    "src/core/SessionManager.ts::const psOutput = execFileSync(::1",
+    "src/core/SessionManager.ts::execFileSync('/bin/sleep', [postPasteDelaySec], { timeout: 4000 });::0",
+    "src/core/SessionManager.ts::execFileSync(::0",
+    "src/core/SessionManager.ts::execFileSync(::1",
+    "src/core/SessionManager.ts::execFileSync(::2",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['has-session', '-t', `=${name}`], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['kill-session', '-t', `=${session.tmuxSession}`], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['kill-session', '-t', `=${session.tmuxSession}`], {::1",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['kill-session', '-t', tmuxSession], { encoding: 'utf-8' });::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', `=${tmuxSession}:`, 'Down'], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', `=${tmuxSession}:`, 'Enter'], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '-l', text], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '-l', text], {::1",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, 'Enter'], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, 'Enter'], {::1",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '\\x1b[200~'], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '\\x1b[201~'], {::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, [::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, [::1",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, [::2",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, [::3",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, [::4",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, [::5",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, tmuxArgs, { encoding: 'utf-8' });::0",
+    "src/core/SessionManager.ts::execFileSync(this.config.tmuxPath, tmuxArgs, { encoding: 'utf-8' });::1",
+    "src/core/SessionManager.ts::execFileSync(tmuxPath, ['send-keys', '-t', target, 'C-m'], { encoding: 'utf-8', timeout: 5000 });::0",
+    "src/core/SessionManager.ts::execFileSync(tmuxPath, ['send-keys', '-t', target, 'Enter'], { encoding: 'utf-8', timeout: 5000 });::0",
+    "src/core/SessionManager.ts::execFileSync(tmuxPath, ['send-keys', '-t', target, 'Enter'], { encoding: 'utf-8', timeout: 5000 });::1",
+    "src/core/SessionManager.ts::execFileSync(tmuxPath, ['send-keys', '-t', target, 'Enter'], { encoding: 'utf-8', timeout: 5000 });::2",
+    "src/core/SessionManager.ts::return execFileSync(::0",
+    "src/core/SessionManager.ts::try { execFileSync('/bin/sleep', ['0.15'], { timeout: 1000 }); } catch { /* @silent-fallback-ok — sleep is best-effort */ }::0",
+    "src/core/SessionManager.ts::try { execFileSync('/bin/sleep', ['0.3'], { timeout: 2000 }); } catch { /* ignore */ }::0",
+    "src/core/SessionManager.ts::try { execFileSync('/bin/sleep', ['0.3'], { timeout: 2000 }); } catch { /* ignore */ }::1",
+    "src/core/SessionManager.ts::try { execFileSync('/bin/sleep', ['0.3'], { timeout: 2000 }); } catch { /* ignore */ }::2",
+    "src/core/TopicResumeMap.ts::const hasSession = spawnSync(this.tmuxPath, ['has-session', '-t', `=${info.sessionName}`]);::0",
+    "src/core/UpdateChecker.ts::execFileSync('xattr', ['-rd', attr, shadowDir], { stdio: 'ignore' });::0",
+    "src/core/UpdateChecker.ts::execFileSync(process.execPath, ['-e', `require(\"fs\").readFileSync(${JSON.stringify(newCliPath)})`], {::0",
+    "src/core/WorktreeKeyVault.ts::const raw = execFileSync('secret-tool', ['lookup', 'service', KEYCHAIN_SERVICE, 'account', account], {::0",
+    "src/core/WorktreeKeyVault.ts::const raw = execFileSync('security', [::0",
+    "src/core/WorktreeKeyVault.ts::execFileSync('secret-tool', ['--version'], { stdio: 'pipe', timeout: 2000 });::0",
+    "src/core/WorktreeKeyVault.ts::execFileSync('secret-tool', ['store', '--label', `instar:${account}`,::0",
+    "src/core/WorktreeKeyVault.ts::execFileSync('security', ['delete-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account], {::0",
+    "src/core/WorktreeKeyVault.ts::execFileSync('security', ['list-keychains', '-d', 'user'], { stdio: 'pipe', timeout: 2000 });::0",
+    "src/core/WorktreeKeyVault.ts::execFileSync('security', [::0",
+    "src/core/WorktreeManager.ts::execFileSync('cp', ['-R', '--reflink=auto', mainNodeModules, wtNodeModules], { timeout: 60_000 });::0",
+    "src/core/WorktreeManager.ts::execFileSync('cp', ['-R', mainNodeModules, wtNodeModules], { timeout: 600_000 });::0",
+    "src/core/WorktreeManager.ts::execFileSync('cp', ['-c', '-R', mainNodeModules, wtNodeModules], { timeout: 60_000 });::0",
+    "src/core/WorktreeManager.ts::return execFileSync('sysctl', ['-n', 'kern.boottime'], { encoding: 'utf-8', timeout: 2000 }).trim();::0",
+    "src/core/WorktreeManager.ts::return execFileSync('wmic', ['os', 'get', 'lastbootuptime'], { encoding: 'utf-8', timeout: 2000 }).trim();::0",
+    "src/core/WorktreeManager.ts::try { execFileSync('zstd', ['--version'], { stdio: 'pipe' }); return true; }::0",
+    "src/core/accountFollowMeCooperativeWipe.ts::execFileSync('security', ['delete-generic-password', '-s', service], {::0",
+    "src/core/accountFollowMeCooperativeWipe.ts::execFileSync(spec.cmd, spec.args, {::0",
+    "src/core/codexCapabilities.ts::const help = execFileSync(binaryPath, ['--help'], {::0",
+    "src/core/codexHookArm.ts::const tmux = (args: string[]) => execFileSync(deps.tmuxPath, args, { encoding: 'utf-8', timeout: 10_000 });::0",
+    "src/core/codexHookArm.ts::execFileSync('sleep', ['1']);::0",
+    "src/core/codexHookArm.ts::execFileSync('sleep', ['2']);::0",
+    "src/core/codexHookArm.ts::execFileSync('sleep', ['2']);::1",
+    "src/core/codexHookArm.ts::execFileSync('sleep', ['3']);::0",
+    "src/monitoring/CiFailurePoller.ts::((args) => execFileSync('gh', args, { encoding: 'utf-8', timeout: 15000, stdio: ['pipe', 'pipe', 'pipe'] }));::0",
+    "src/monitoring/CredentialProvider.ts::const result = execFileSync(::0",
+    "src/monitoring/CredentialProvider.ts::const result = execFileSync(::1",
+    "src/monitoring/CredentialProvider.ts::execFileSync('security', ['-i'], {::0",
+    "src/monitoring/CredentialProvider.ts::execFileSync(::0",
+    "src/monitoring/HealthChecker.ts::execFileSync(this.config.sessions.tmuxPath, ['-V'], {::0",
+    "src/monitoring/HealthChecker.ts::execFileSync(this.config.sessions.tmuxPath, ['list-sessions'], {::0",
+    "src/monitoring/MemoryPressureMonitor.ts::const output = spawnSync('vm_stat', [], { encoding: 'utf-8', timeout: 5000 }).stdout ?? '';::0",
+    "src/monitoring/OrphanProcessReaper.ts::return spawnSync('/bin/sh', ['-c', cmd], { encoding: 'utf-8', timeout }).stdout ?? '';::0",
+    "src/monitoring/ResumeQueue.ts::out = execFileSync('df', ['-P', stateDir], { timeout: 3000, encoding: 'utf-8' });::0",
+    "src/monitoring/SessionRecovery.ts::const output = execFileSync('lsof', ['-p', String(pid), '-Fn'], {::0",
+    "src/monitoring/TelemetryHeartbeat.ts::const output = execFileSync('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], { encoding: 'utf-8' });::0",
+    "src/monitoring/WorktreeMonitor.ts::const result = spawnSync('/bin/sh', ['-c', `git ${args}`], {::0",
+    "src/monitoring/agentWorktreeGit.ts::out = execFileSync('lsof', ['-w', '-d', 'cwd', '-Fn'], { encoding: 'utf-8', timeout: 15_000, maxBuffer: 32 * 1024 * 1024 });::0",
+    "src/monitoring/mcpProcessReaperDeps.ts::return execFileSync(file, args, { encoding: 'utf8', timeout, stdio: ['ignore', 'pipe', 'ignore'] });::0",
+    "src/monitoring/probes/PlatformProbe.ts::execSync('sleep 0.2', { timeout: 1000 });::0",
+    "src/monitoring/probes/PlatformProbe.ts::execSync(::0",
+    "src/monitoring/probes/PlatformProbe.ts::execSync(`${tmuxPath} has-session -t ${testSessionName} 2>/dev/null`, { timeout: 1000 });::0",
+    "src/monitoring/probes/PlatformProbe.ts::execSync(`ls \"${testDir}\" > /dev/null 2>&1`, { timeout: 3000 });::0",
+    "src/monitoring/probes/PlatformProbe.ts::try { execSync(`${tmuxPath} kill-session -t ${testSessionName} 2>/dev/null`, { timeout: 3000 }); } catch { /* ok */ }::0",
+    "src/monitoring/probes/PlatformProbe.ts::try { execSync(`${tmuxPath} kill-session -t ${testSessionName} 2>/dev/null`, { timeout: 3000 }); } catch { /* ok */ }::1",
+    "src/monitoring/probes/SessionProbe.ts::execFileSync(deps.tmuxPath, ['-V'], { encoding: 'utf-8', timeout: 3000 });::0",
+    "src/monitoring/probes/SessionProbe.ts::execFileSync(deps.tmuxPath, ['has-session', '-t', session.tmuxSession], {::0",
+    "src/server/routes.ts::const ghRepo = execFileSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'], {::0",
+    "src/server/routes.ts::const out = execFileSync(::0",
+    "src/server/routes.ts::const output = execFileSync(tmuxPath, ['list-sessions', '-F', '#{session_name}'], {::0",
+    "src/server/routes.ts::const result = execFileSync('gh', [::0",
+    "src/server/routes.ts::execFileSync(tmuxPath, ['kill-session', '-t', `=${paneSession}`], { stdio: 'ignore' });::0",
+    "src/server/routes.ts::try { execFileSync(tmuxPath, ['clear-history', '-t', `=${paneSession}:`], { stdio: 'ignore' }); cleared = true; }::0"
+  ]
+}