peertable 0.8.54 → 0.8.56

package/skill/scripts/doctor.sh

@@ -1,215 +1,4 @@
 #!/bin/bash
-# 卓の健全性を機械判定して表示し、--repair 指定時だけ死んでいるブリッジを立て直す。
-# usage: doctor.sh <project_dir> [--repair]
-#
-# 判定するのは5点だけ:
-#   1. room サーバー到達性（GET /api/<room>/summary）
-#   2. 台帳（room member 行）の素性・本人性の完全性
-#   3. 各席の tmux セッション（peer-<name>）の存在と、席file の pid+lstart による本人性
-#   4. 2ブリッジ（wakeup / seat-status）の record 生存と、record にある識別情報だけで
-#      判定できる範囲の本人性・鮮度（判定できないものは「判定不能」と正直に出す。偽の生存判定を作らない）
-#   5. Lattice 併用モード（mode=lattice）なら `lattice status --json` の state / active_runs
-#
-# 各行は OK / NG / REPAIRED / 判定不能 のいずれかで始まる。--repair は NG のブリッジだけ
-# ensure-bridge.sh で立て直す。**席の再起動はしない**——席は人の判断が要るので、NG 表示に
-# launch-seat.sh を促す一言を添えるだけに留める。
-#
-# 終了コード: 全 OK（判定不能を含む）= 0、NG が1件でもあれば 1（--repair で全部直れば 0）。
+# 既存の引数を共通の製品入口へ渡す。
 set -euo pipefail
-
-proj="${1:-}"
-repair=false
-if [ "${2:-}" = "--repair" ]; then repair=true; fi
-if [ -z "$proj" ]; then
-  echo "usage: doctor.sh <project_dir> [--repair]" >&2
-  exit 1
-fi
-proj=$(cd "$proj" && pwd)
-script_dir=$(cd "$(dirname "$0")" && pwd)
-setup="$proj/.team/setup-state.json"
-if [ ! -f "$setup" ]; then
-  echo "NG .team/setup-state.json が無い（${proj} は peertable setup 済みか確認せよ）" >&2
-  exit 1
-fi
-
-DOCTOR_PROJ="$proj" DOCTOR_SCRIPT_DIR="$script_dir" DOCTOR_REPAIR="$repair" \
-  node --input-type=module <<'NODE'
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
-import { execFileSync, spawnSync } from 'node:child_process'
-import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
-
-const proj = process.env.DOCTOR_PROJ
-const scriptDir = process.env.DOCTOR_SCRIPT_DIR
-const repair = process.env.DOCTOR_REPAIR === 'true'
-const team = join(proj, '.team')
-
-const { bridgeRecordLive } = await import(pathToFileURL(join(scriptDir, 'bridge-record-live.mjs')))
-const { observePidCommand } = await import(pathToFileURL(join(scriptDir, 'refresh-seat-identity.mjs')))
-const { resolveLatticeInvocation, resolveTmuxSocket, tmuxArgv } = await import(pathToFileURL(join(scriptDir, 'seat-usage.mjs')))
-
-let ng = 0
-function line(level, text) {
-  console.log(`${level} ${text}`)
-  if (level === 'NG') ng = 1
-}
-
-const setup = JSON.parse(readFileSync(join(team, 'setup-state.json'), 'utf8'))
-const { room, server_url: url, mode } = setup
-
-// 1. room サーバー到達性
-let summary = null
-try {
-  const res = await fetch(`${url}/api/${encodeURIComponent(room)}/summary`)
-  if (!res.ok) throw new Error(`HTTP ${res.status}`)
-  summary = await res.json()
-  line('OK', `room 到達: ${url} room=${room} seq=${summary.seq} member_count=${summary.member_count}`)
-} catch (error) {
-  line('NG', `room 到達不可: ${url} room=${room}（${error.message}）`)
-}
-
-// members は以降の突合・席チェックにも使う
-let members = []
-let membersOk = false
-try {
-  const res = await fetch(`${url}/api/${encodeURIComponent(room)}/members`)
-  if (!res.ok) throw new Error(`HTTP ${res.status}`)
-  const body = await res.json()
-  members = Array.isArray(body.members) ? body.members : []
-  membersOk = true
-} catch (error) {
-  line('NG', `room members を取得できない（${error.message}）`)
-}
-
-// 2. 台帳の完全性。tmux 席を持つ member（親以外）は本人性欄（pid 等）も台帳に載っている
-// はず（席file は 2026-08-22 廃止・正本は member 行だけ）
-function hasDescriptor(member) {
-  return Boolean(member?.observe && typeof member.observe === 'object'
-    && typeof member.observe.tmux_target === 'string' && member.observe.tmux_target.length > 0)
-}
-const seatRows = new Map()
-if (membersOk) {
-  const seated = members.filter(hasDescriptor)
-  const missingIdentity = seated.filter(m => !Number.isSafeInteger(m.pid) || !m.started_identity || !m.argv_digest)
-  for (const m of seated) seatRows.set(m.name, m)
-  if (missingIdentity.length === 0) {
-    line('OK', `台帳の member 行に素性・本人性が揃っている（${seated.length} 席）`)
-  } else {
-    line('NG', `台帳の本人性欄が欠けている member: ${missingIdentity.map(m => m.name).join(',')}`)
-  }
-}
-
-// 3. 各席の tmux セッション（peer-<name>）の存在と、台帳の pid+lstart による本人性
-for (const [name, seat] of seatRows) {
-  const member = seat
-  const socket = member?.observe?.tmux_socket || resolveTmuxSocket(process.env).socket
-  const target = member?.observe?.tmux_target || `peer-${name}`
-  let sessionExists = false
-  try {
-    execFileSync('tmux', tmuxArgv(['has-session', '-t', target], { socket }), { stdio: 'ignore' })
-    sessionExists = true
-  } catch { /* has-session は非ゼロ終了で無しを表す */ }
-  if (!sessionExists) {
-    line('NG', `席 ${name}: tmux セッション ${target} が無い（launch-seat.sh で立て直す）`)
-    continue
-  }
-  let identity = null
-  let identityError = null
-  try { identity = observePidCommand(seat.pid) } catch (error) { identityError = error }
-  if (identityError) {
-    line('NG', `席 ${name}: pid ${seat.pid} を観測できない（${identityError.message}）（launch-seat.sh で立て直す）`)
-    continue
-  }
-  if (identity.started_identity !== seat.started_identity) {
-    line('NG', `席 ${name}: pid ${seat.pid} は再利用されている（lstart不一致・本人ではない）（launch-seat.sh で立て直す）`)
-    continue
-  }
-  line('OK', `席 ${name}: tmux ${target} 生存・pid ${seat.pid} 本人性確認`)
-}
-
-// 4. 2ブリッジ（run-bridge は 2026-08-22 退役）。record の形式が違うので判定できる範囲だけ判定する
-function judgeWakeup() {
-  const path = join(team, 'wakeup-bridge.json')
-  if (!existsSync(path)) return { level: 'NG', text: 'wakeup-bridge: record が無い（起動していない）' }
-  const record = JSON.parse(readFileSync(path, 'utf8'))
-  if (bridgeRecordLive(record)) {
-    const age = Math.round((Date.now() - Date.parse(record.last_progress_at)) / 1000)
-    return { level: 'OK', text: `wakeup-bridge: 生存 pid=${record.pid} last_progress ${age}秒前` }
-  }
-  return { level: 'NG', text: `wakeup-bridge: pid=${record.pid} が死んでいるか last_progress_at が古い` }
-}
-
-function judgeSeatStatusBridge() {
-  const path = join(team, 'seat-status-bridge.json')
-  if (!existsSync(path)) return { level: 'NG', text: 'seat-status-bridge: record が無い（起動していない）' }
-  const record = JSON.parse(readFileSync(path, 'utf8'))
-  let alive = false
-  try { process.kill(record.pid, 0); alive = true } catch { /* 死んでいる */ }
-  if (!alive) return { level: 'NG', text: `seat-status-bridge: pid=${record.pid} が死んでいる` }
-  return { level: '判定不能', text: `seat-status-bridge: pid=${record.pid} は生存しているが record に lstart が無く本人性を確認できない` }
-}
-
-for (const [name, judge] of [['wakeup', judgeWakeup], ['seat-status', judgeSeatStatusBridge]]) {
-  let result = judge()
-  if (result.level === 'NG' && repair) {
-    const res = spawnSync(join(scriptDir, 'ensure-bridge.sh'), [proj, name], { encoding: 'utf8' })
-    if (res.status === 0) {
-      const after = judge()
-      if (after.level !== 'NG') { line('REPAIRED', `${name}-bridge: 立て直した（${after.text}）`); continue }
-      line('NG', `${name}-bridge: 立て直したが依然として不健全（${after.text}）`)
-      continue
-    }
-    const detail = (res.stderr || res.stdout || '').trim().split('\n').slice(-3).join(' / ')
-    line('NG', `${name}-bridge: 立て直しに失敗（${detail || `exit ${res.status}`}）`)
-    continue
-  }
-  line(result.level, result.text)
-}
-
-// 4.5 端末別の装置可用性（silent absence禁止・2026-08-25 オーナー裁定）:
-// この端末で「動かない」なら動かないと表示する。黙ってMacだけで動く状態を作らない。
-{
-  // job観測（アクティブランプへの預け仕事合成）: tmux list-sessions がこの端末で成立するか
-  try {
-    const probe = spawnSync('tmux', ['list-sessions', '-F', '#{session_name}'], { encoding: 'utf8' })
-    if (probe.error) throw probe.error
-    line('OK', `job観測: tmux list-sessions 実行可（ランプ合成は有効。ジョブは席のシェルからtmuxセッションで走らせる——名前は自由）`)
-  } catch (error) {
-    line('NG', `job観測: tmux list-sessions が失敗——預け仕事のランプ合成はこの端末で無効（${String(error.message ?? error).split('\n')[0]}）`)
-  }
-  // env帰属（2026-08-26 オーナー裁定: 帰属は規約名でなくOSの環境変数継承）: この端末のtmux/psmuxが
-  // update-environment と show-environment を持つか。持たない実装（psmuxの互換欠け等）では
-  // 名前fallback（peer-<name>- 前置）だけで動くので、その事実を機械判定で出す。
-  try {
-    const opts = execFileSync('tmux', tmuxArgv(['show-options', '-g', 'update-environment'], { socket: resolveTmuxSocket(process.env).socket }), { encoding: 'utf8' })
-    if (/PEERTABLE_MEMBER/.test(opts)) line('OK', 'env帰属: update-environment に PEERTABLE_MEMBER が載っている（新規セッションへ持ち主が自動継承される）')
-    else line('NG', 'env帰属: update-environment に PEERTABLE_MEMBER が無い——launch-seat をこの版で一度通すと設定される。それまで帰属は peer-<name>- 前置の名前fallbackのみ')
-  } catch (error) {
-    line('NG', `env帰属: show-options が失敗——この端末のtmux/psmuxはenv帰属を判定できず、名前fallbackのみで動作（${String(error.message ?? error).split('\n')[0]}）`)
-  }
-  // 読了ack: server members に read_seq 欄が観測できるか（席が一度もackしていない間は判定できない）
-  try {
-    const res = JSON.parse(execFileSync('curl', ['-s', `${url}/api/${encodeURIComponent(room)}/members`], { encoding: 'utf8' }))
-    const withAck = (res.members ?? []).filter(m => m.read_seq !== undefined).length
-    if (withAck > 0) line('OK', `読了ack: server対応を確認（read_seq保持 ${withAck} 席）`)
-    else line('判定不能', '読了ack: read_seq を持つ席がまだ無い（旧serverか、席が一度も read_unread→post していないか区別できない）')
-  } catch (error) {
-    line('NG', `読了ack: members を読めない（${String(error.message ?? error).split('\n')[0]}）`)
-  }
-}
-
-// 5. Lattice 併用モードの工程正本
-if (mode === 'lattice') {
-  const latticeCli = process.env.LATTICE_CLI || (typeof setup.lattice_cli === 'string' && setup.lattice_cli) || 'lattice'
-  try {
-    const invocation = resolveLatticeInvocation(latticeCli, ['status', '--json'])
-    const out = execFileSync(invocation.command, invocation.argv, { cwd: proj, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 })
-    const status = JSON.parse(out)
-    line('OK', `Lattice: state=${status.state} active_runs=${(status.active_runs ?? []).length}`)
-  } catch (error) {
-    line('NG', `Lattice status を取得できない（${String(error.message ?? error).split('\n')[0]}）`)
-  }
-}
-
-process.exit(ng)
-NODE
+exec node "$(dirname "$0")/legacy-entry.mjs" doctor "$@"

package/skill/scripts/ensure-all-bridges.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// 既存のsetup記録があるprojectだけを巡回する。npm導入からは呼ばない。
+import { existsSync, readdirSync, statSync, writeFileSync, appendFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { AitermClient } from './aiterm-client.mjs'
+import { RoomApi } from './room-api.mjs'
+import { ensureProjectRuntime } from './ensure-project-runtime.mjs'
+import { resumeProject } from './project-runtime.mjs'
+import { readSetup } from './project-scaffold.mjs'
+import { findSeatSession } from './seat-session.mjs'
+
+const root = resolve(process.argv[2] || join(homedir(), 'Developer'))
+const aiterm = new AitermClient()
+let failed = false
+try {
+  const sessions = await aiterm.sessions(['PEERTABLE_MEMBER', 'PEERTABLE_ROOM'])
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue
+    const project = join(root, entry.name)
+    if (!existsSync(join(project, '.team', 'setup-state.json'))) continue
+    try {
+      const state = readSetup(project)
+      await ensureProjectRuntime(project, { aiterm })
+      const members = await new RoomApi(state).members()
+      const missing = members.filter(member => member.delivery?.kind !== 'parent_watch' && (member.harness ?? member.vendor)
+        && !findSeatSession(member, sessions, state.room))
+      if (!missing.length) continue
+      const lock = join(project, '.team', 'seat-revive.lock')
+      if (existsSync(lock) && Date.now() - statSync(lock).mtimeMs < 600_000) continue
+      writeFileSync(lock, `${new Date().toISOString()}\n`)
+      console.error(`席消失を検知: ${project}: ${missing.map(member => member.name).join(', ')}。resumeで再開します`)
+      const result = await resumeProject({ project })
+      appendFileSync(join(project, '.team', 'seat-revive.log'), `${JSON.stringify(result)}\n`)
+    } catch (error) {
+      failed = true
+      console.error(`PEERTABLE_PATROL_FAILED: ${project}: ${error.message}`)
+      appendFileSync(join(project, '.team', 'seat-revive.log'), `${new Date().toISOString()} ${error.message}\n`)
+    }
+  }
+} finally { await aiterm.close() }
+if (failed) process.exitCode = 1

package/skill/scripts/ensure-all-bridges.sh

@@ -1,81 +1,4 @@
 #!/bin/bash
-# launchd（dev.kitepon.peertable-bridges）から2分周期で呼ばれ、稼働中の全円卓のbridgeを
-# 生存保証する。ensure-bridge.sh は生きていれば何もしない冪等な入口なので、この巡回は
-# 「死んだら次の周期で自動再起動」を意味する（オーナー裁定 2026-08-29「毎回手で復活させるな」）。
-# 対象卓の発見は実物（.team/setup-state.json の存在）だけを根拠にする。登録簿は持たない。
-set -u
-# launchd環境にはTMPDIRが無く、tmux socketの既定解決（$TMPDIR/claude-tmux-sockets/…）が
-# /tmp側へ落ちて全ensureが失敗する（実被弾 2026-08-29）。macOSの正規per-user tempを自前導出する。
-if [ -z "${TMPDIR:-}" ] && command -v getconf >/dev/null; then
-  TMPDIR="$(getconf DARWIN_USER_TEMP_DIR 2>/dev/null || true)"
-  [ -n "$TMPDIR" ] && export TMPDIR
-fi
-# launchd環境には書込tokenが無い。bridgeのreceipt書込とresumeの席起動に必要なので、
-# 標準の置き場から読み込む（無ければ従来どおり進み、書込systemは自分で degrade を報告する）
-[ -f "$HOME/.config/peertable.env" ] && . "$HOME/.config/peertable.env"
-scripts="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-for state in /Users/kite/Developer/*/.team/setup-state.json; do
-  [ -f "$state" ] || continue
-  proj="$(dirname "$(dirname "$state")")"
-  bash "$scripts/ensure-bridge.sh" "$proj" seat-status >/dev/null 2>&1 \
-    || echo "$(date -u +%FT%TZ) ensure失敗: seat-status $proj"
-  bash "$scripts/ensure-bridge.sh" "$proj" alarm >/dev/null 2>&1 \
-    || echo "$(date -u +%FT%TZ) ensure失敗: alarm $proj"
-  # wakeup は配達先の席名一覧が要る。room 台帳から現行メンバーを実物で読む
-  server="$(python3 -c "import json;print(json.load(open('$state'))['server_url'])" 2>/dev/null)"
-  room="$(python3 -c "import json;print(json.load(open('$state'))['room'])" 2>/dev/null)"
-  if [ -n "$server" ] && [ -n "$room" ]; then
-    seats="$(curl -s --max-time 10 "$server/api/$room/members" | python3 -c "
-import json,sys
-try:
-    ms=json.load(sys.stdin).get('members',[])
-except Exception:
-    ms=[]
-print(' '.join(m['name'] for m in ms if m.get('observe') or m.get('harness')))" 2>/dev/null)"
-    if [ -n "$seats" ]; then
-      # shellcheck disable=SC2086
-      bash "$scripts/ensure-bridge.sh" "$proj" wakeup $seats >/dev/null 2>&1 \
-        || echo "$(date -u +%FT%TZ) ensure失敗: wakeup $proj ($seats)"
-    fi
-  fi
-done
-
-# ---- 席の自動蘇生（オーナー恒久裁定「死んだら自動で起こせ。毎回手で復活させるな」）----
-# tmux server死で全席が消える事故が反復した（実被弾 2026-08-29〜30に3回・原因未特定）。
-# 台帳に居るのにtmux sessionが無い席を検知し、**工程が残っている時だけ**resumeで再着席させる。
-# 仕事ゼロの時は起こさない（quotaを浪費しない。SEAT_TUI_GONE通知が親へ届く経路は別に生きている）。
-# 二重起動はresume側のlaunch-seatが同名席を処理するが、周期の重複実行はlockで抑止する。
-for state in /Users/kite/Developer/*/.team/setup-state.json; do
-  [ -f "$state" ] || continue
-  proj="$(dirname "$(dirname "$state")")"
-  lock="$proj/.team/seat-revive.lock"
-  # 10分cooldown（前回の蘇生が走っていれば触らない）
-  if [ -f "$lock" ] && [ -n "$(find "$lock" -mmin -10 2>/dev/null)" ]; then continue; fi
-  server="$(python3 -c "import json;print(json.load(open('$state'))['server_url'])" 2>/dev/null)"
-  room="$(python3 -c "import json;print(json.load(open('$state'))['room'])" 2>/dev/null)"
-  [ -n "$server" ] && [ -n "$room" ] || continue
-  sockprefix=$(node "$scripts/tmux-socket.mjs" --prefix 2>/dev/null) || continue
-  # shellcheck disable=SC2206
-  conn=($sockprefix)
-  dead=""
-  for seat in $(curl -s --max-time 10 "$server/api/$room/members" | python3 -c "
-import json,sys
-try: ms=json.load(sys.stdin).get('members',[])
-except Exception: ms=[]
-print(' '.join(m['name'] for m in ms if m.get('harness')))" 2>/dev/null); do
-    tmux "${conn[@]}" has-session -t "peer-$seat" 2>/dev/null || dead="$dead $seat"
-  done
-  [ -n "$dead" ] || continue
-  work=$(cd "$proj" && lattice todo status --json 2>/dev/null | python3 -c "
-import json,sys
-try: d=json.load(sys.stdin)
-except Exception: print(0); raise SystemExit
-print(len(d.get('next_ready',[]))+len(d.get('active_set',[]))+len(d.get('audit_pending',[])))" 2>/dev/null)
-  # 工程ゼロでも起こす（オーナー裁定 2026-08-30「席全滅で待機でもないのは何もログ取れない」）。
-  # 空の卓は障害の再現条件と席側の証人（pane log・rollout）を失う。蘇生コストは席あたり
-  # 待機宣言1ターンで、観測体制の維持が勝る。
-  date -u +%FT%TZ > "$lock"
-  echo "$(date -u +%FT%TZ) 席消失を検知（$proj:$dead / 残工程 ${work:-0}）。resumeで自動蘇生する"
-  (cd "$proj" && bash "$scripts/resume.sh" "$proj" >> "$proj/.team/seat-revive.log" 2>&1) \
-    || echo "$(date -u +%FT%TZ) 自動蘇生に失敗: $proj（seat-revive.log参照）"
-done
+# 既存projectの任意巡回。npm導入からは呼ばない。
+set -euo pipefail
+exec node "$(dirname "$0")/ensure-all-bridges.mjs" "$@"

package/skill/scripts/ensure-bridge.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { ensureBridge } from './ensure-project-runtime.mjs'
+const [project, kind, ...args] = process.argv.slice(2)
+try {
+  console.log(JSON.stringify(await ensureBridge(project, kind, {
+    force: args.includes('--force'), args: args.filter(arg => arg !== '--force'),
+  })))
+} catch (error) {
+  console.error(`${error.code ?? 'PEERTABLE_RUNTIME_FAILED'}: ${error.message}`)
+  process.exitCode = 1
+}

package/skill/scripts/ensure-bridge.sh

@@ -1,97 +1,4 @@
 #!/bin/bash
-# bridge を tmux に常駐させ、最初の ready_at まで待つ薄い supervisor。
+# 全OS共通の公開API実装へ渡す旧入口。
 set -euo pipefail
-
-proj="$1"; name="$2"; shift 2
-case "$name" in seat-status) script="seat-status-bridge.mjs" ;; wakeup) script="wakeup-bridge.mjs" ;; alarm) script="alarm-bridge.mjs" ;; run) echo "ENSURE_BRIDGE_RETIRED: run-bridge は退役した（2026-08-22）。介入は席が自分の Lattice コマンド応答で受け取る" >&2; exit 1 ;; *) echo "usage: ensure-bridge.sh <project> <seat-status|wakeup|alarm> [args...]" >&2; exit 1 ;; esac
-scripts_dir=$(cd "$(dirname "$0")" && pwd -P)
-repo=$(cd "$scripts_dir/../.." && pwd -P)
-peertable_version=$(node -p "require(process.argv[1]).version" "$repo/package.json")
-peertable_runtime_digest=$(node "$scripts_dir/runtime-digest.mjs")
-team="$proj/.team"; record="$team/$name-bridge.json"; log="$team/$name-bridge.log"
-force=false
-if [ "${1:-}" = "--force" ]; then force=true; shift; fi
-if [ $# -eq 0 ] && [ -f "$record" ]; then
-  saved=()
-  while IFS= read -r arg; do saved+=("$arg"); done < <(node -e 'const x=require(process.argv[1]); for (const a of x.args||[]) console.log(a)' "$record")
-  # macOS 標準 bash 3.2 の set -u では、空配列の展開が unbound variable になる。
-  # args が空なら現在の「引数なし」を保ち、値がある時だけ復元する。
-  if [ "${#saved[@]}" -gt 0 ]; then
-    set -- "${saved[@]}"
-  fi
-fi
-if [ -f "$record" ]; then
-  if node "$scripts_dir/bridge-record-live.mjs" "$record"; then
-    record_version=$(node -e 'const x=require(process.argv[1]);process.stdout.write(x.peertable_version||"")' "$record")
-    record_digest=$(node -e 'const x=require(process.argv[1]);process.stdout.write(x.peertable_runtime_digest||"")' "$record")
-    if [ "$record_version" = "$peertable_version" ] && [ "$record_digest" = "$peertable_runtime_digest" ]; then exit 0; fi
-    echo "${name}-bridge: Peertable ${record_version:-unknown} → ${peertable_version} の現行runtimeへ自動更新する" >&2
-    node "$scripts_dir/$script" "$proj" --stop || {
-      echo "${name}-bridge: 旧版bridgeを停止できないため更新を中止する" >&2
-      exit 1
-    }
-  fi
-  if ! "$force" && grep -q 'WRITE_DENIED' "$log" 2>/dev/null; then echo "${name}-bridge: 前回はWRITE_DENIEDで終了。--forceを指定すること" >&2; exit 1; fi
-fi
-# shellcheck disable=SC1091
-. "$(dirname "$0")/tmux-at.bash"
-sock=$(node "$(dirname "$0")/tmux-socket.mjs")
-room=$(node -e 'process.stdout.write(require(process.argv[1]).room)' "$team/setup-state.json")
-session="peertable-${name}-${room}"
-# **session が在るだけでは常駐が生きている証拠にならない**（中の node だけ死んで殻が残る）。
-# pid/進捗の生存確認を通れずここへ来たsessionは、Windowsでlogを開いたままの可能性がある。
-# log切詰めより先に畳み、EBUSYを発生させない。
-tmux_at kill-session -t "$session" 2>/dev/null || true
-# **死んだ記録をここで消す。** 残すと下の loop が前回の `ready_at` を読んで、
-# 新しい bridge が1バイトも動いていない段階で success を返す——「起動していないのに
-# 起動したと言う」＝この supervisor が塞ぐはずの穴そのものになる。
-rm -f "$record"
-if ! node -e 'import { writeFileSync } from "node:fs"; writeFileSync(process.argv[1], "")' "$log"; then
-  echo "${name}-bridge: log を切り詰められないので追記する" >&2
-  : >> "$log" || true
-fi
-# **手渡された env を常駐へ渡す。** 新しい session が継ぐのは tmux *server* の環境であって
-# 呼び出し元 client の環境ではないので、素で起こすと `PEERTABLE_TMUX_SOCKET` の手渡しが黙って消え、
-# 常駐が別の socket（本番の既定）を観測しにいく（2026-08-11 実測）。決定73 と同じ形の裏返しである。
-# **秘密値はコマンドラインへ載せない。** `env PEERTABLE_POST_TOKEN=… node …` の形は
-# tmux のsession起動コマンドと ps の両方に平文で残る（2026-08-30 実測）。トークンは
-# 0600 の credential file へ落とし、常駐へはそのパスだけを渡す（bridge 側の
-# resolvePostToken が PEERTABLE_CREDENTIAL_FILE → ~/.config/peertable.env の順で読む）
-if [ -n "${PEERTABLE_POST_TOKEN:-}" ] && [ -z "${PEERTABLE_CREDENTIAL_FILE:-}" ]; then
-  cred_dir="$proj/.team/credentials"
-  mkdir -p "$cred_dir" && chmod 700 "$cred_dir"
-  ( umask 177; printf '%s\n' "$PEERTABLE_POST_TOKEN" > "$cred_dir/bridge.token" )
-  PEERTABLE_CREDENTIAL_FILE="$cred_dir/bridge.token"
-  export PEERTABLE_CREDENTIAL_FILE
-fi
-env_prefix=""
-for v in PEERTABLE_TMUX_SOCKET PEERTABLE_CREDENTIAL_FILE PEERTABLE_URL PEERTABLE_PARENT_NAME; do
-  eval "val=\${$v:-}"
-  [ -n "$val" ] && env_prefix="$env_prefix $v=$(printf '%q' "$val")"
-done
-if [ "$(node -p 'process.platform')" = "win32" ]; then
-  # psmuxが起動する正規shellはPowerShell 7。POSIXの`env`とMSYS pathを文字列のまま
-  # 渡すとnodeへ到達する前に終了するため、Windows nodeに各pathをargvとして変換させ、
-  # PowerShell EncodedCommandを一箇所で組み立てる。
-  win_command=$(node "$scripts_dir/platform/windows/build-bridge-command.mjs" \
-    "$scripts_dir/$script" "$proj" "$log" "$@")
-  tmux_at new-session -d -s "$session" "$win_command"
-else
-  tmux_at new-session -d -s "$session" "env${env_prefix} node $(dirname "$0")/$script $(printf '%q ' "$proj" "$@") >> $(printf '%q' "$log") 2>&1"
-fi
-for _ in $(seq 1 30); do
-  if [ -f "$record" ] && node -e 'process.exit(require(process.argv[1]).ready_at?0:1)' "$record"; then
-    # **末尾は本物の改行にする。** `"\\n"` と書くと JS がリテラルの `\`+`n` を足し、
-    # record が JSON として壊れる——`--stop` も次回起動も `JSON.parse` で落ちて、
-    # 「止められない・建て直せない常駐」ができる（2026-08-11 実測）。一時 file→rename で原子的に。
-    node -e 'const fs=require("fs");const p=process.argv[1],version=process.argv[2],digest=process.argv[3],a=process.argv.slice(4);
-      const t=`${p}.${process.pid}.tmp`;
-      fs.writeFileSync(t,JSON.stringify({...JSON.parse(fs.readFileSync(p,"utf8")),peertable_version:version,peertable_runtime_digest:digest,args:a})+"\n");
-      fs.renameSync(t,p)' "$record" "$peertable_version" "$peertable_runtime_digest" "$@"
-    exit 0
-  fi
-  sleep .5
-done
-echo "${name}-bridge: ready_at を待てなかった。ログ末尾:" >&2
-tail -n 20 "$log" >&2 || true
-exit 1
+exec node "$(dirname "$0")/ensure-bridge.mjs" "$@"

package/skill/scripts/ensure-codex-room-mcp.mjs

@@ -77,7 +77,7 @@ function expectedBlock(addedNewline) {
     '[mcp_servers.room]',
     'command = "node"',
     `args = [${JSON.stringify(client)}]`,
-    'env_vars = ["TMUX", "TMUX_PANE"]',
+    'env_vars = ["AITERM_SESSION_ID"]',
     '[mcp_servers.room.env]',
     ...explicitEnv,
     endMarker,

package/skill/scripts/ensure-project-runtime.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// 3bridgeを順に起動・更新し、実際のready記録まで確認する。
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { setTimeout as delay } from 'node:timers/promises'
+import { AitermClient } from './aiterm-client.mjs'
+import { bridgeRecordLive } from './bridge-record-live.mjs'
+import { packageRoot } from './install-skill.mjs'
+import { projectPath, readSetup, readJson, runScript, fail } from './project-scaffold.mjs'
+import { runtimeLaunchCommand } from './runtime-launch-command.mjs'
+
+export const bridgeKinds = Object.freeze(['alarm', 'seat-status', 'wakeup'])
+export const bridgeSession = (project, room, kind) => `peertable-${kind}-${room}-${createHash('sha256').update(project).digest('hex').slice(0, 8)}`
+
+export async function ensureBridge(projectArg, kind, { root = packageRoot, env = process.env, aiterm, args = [], force = false } = {}) {
+  if (!bridgeKinds.includes(kind)) fail('ENSURE_BRIDGE_KIND_INVALID', kind)
+  const project = projectPath(projectArg)
+  const state = readSetup(project)
+  const team = join(project, '.team')
+  const recordPath = join(team, `${kind}-bridge.json`), log = join(team, `${kind}-bridge.log`)
+  const script = `${kind}-bridge.mjs`
+  const version = readJson(join(root, 'package.json')).version
+  const digest = runScript('runtime-digest.mjs', [], { root })
+  const previous = existsSync(recordPath) ? readJson(recordPath) : null
+  if (bridgeRecordLive(previous) && previous.peertable_version === version && previous.peertable_runtime_digest === digest)
+    return { kind, status: 'current', session_id: previous.aiterm_session_id ?? null }
+  const ownClient = !aiterm
+  aiterm ??= new AitermClient({ env })
+  try {
+    if (previous && bridgeRecordLive(previous)) runScript(script, [project, '--stop'], { root, env })
+    const session = previous?.aiterm_session_id ?? (previous ? `peertable-${kind}-${state.room}` : bridgeSession(project, state.room, kind))
+    await aiterm.structured('pty_close', { session_id: session }, 'aiterm.pty-close-result.v1')
+    if (existsSync(recordPath)) unlinkSync(recordPath)
+    writeFileSync(log, '')
+    const launchEnv = { ...env }
+    if (launchEnv.PEERTABLE_POST_TOKEN && !launchEnv.PEERTABLE_CREDENTIAL_FILE) {
+      const credentials = join(team, 'credentials')
+      mkdirSync(credentials, { recursive: true, mode: 0o700 })
+      launchEnv.PEERTABLE_CREDENTIAL_FILE = join(credentials, 'bridge.token')
+      writeFileSync(launchEnv.PEERTABLE_CREDENTIAL_FILE, `${launchEnv.PEERTABLE_POST_TOKEN}\n`, { mode: 0o600 })
+    }
+    if (!launchEnv.PEERTABLE_CREDENTIAL_FILE) {
+      launchEnv.PEERTABLE_CREDENTIAL_FILE = runScript('seat-credential.mjs', ['prepare', project, state.room, 'runtime'], { env: launchEnv })
+    }
+    const effectiveArgs = args.length ? args : previous?.args ?? []
+    await aiterm.call('pty_open', { name: session })
+    await aiterm.structured('pty_send', { session_id: session, text: runtimeLaunchCommand({
+      executable: process.execPath, script: join(root, 'skill', 'scripts', script), project,
+      args: effectiveArgs, log, env: launchEnv,
+    }) }, 'aiterm.pty-send-result.v1')
+    const deadline = Date.now() + 15_000
+    while (Date.now() < deadline) {
+      const record = existsSync(recordPath) ? readJson(recordPath) : null
+      if (record?.ready_at && bridgeRecordLive(record)) {
+        const temporary = `${recordPath}.${process.pid}.tmp`
+        writeFileSync(temporary, `${JSON.stringify({ ...record, peertable_version: version, peertable_runtime_digest: digest,
+          args: effectiveArgs, aiterm_session_id: session })}\n`)
+        renameSync(temporary, recordPath)
+        return { kind, status: previous ? 'updated' : 'started', session_id: session }
+      }
+      await delay(200)
+    }
+    fail('PEERTABLE_RUNTIME_NOT_READY', `${kind}のready記録を確認できません。${log}`)
+  } finally {
+    if (ownClient) await aiterm.close()
+  }
+}
+
+export async function ensureProjectRuntime(project, options = {}) {
+  const aiterm = options.aiterm ?? new AitermClient({ env: options.env })
+  try {
+    const bridges = []
+    for (const kind of bridgeKinds) bridges.push(await ensureBridge(project, kind, { ...options, aiterm }))
+    return { schema: 'peertable.runtime-result.v1', status: 'ready', bridges }
+  } finally {
+    if (!options.aiterm) await aiterm.close()
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { console.log(JSON.stringify(await ensureProjectRuntime(process.argv[2], { force: process.argv.includes('--force') }))) }
+  catch (error) { console.error(`${error.code ?? 'PEERTABLE_RUNTIME_FAILED'}: ${error.message}`); process.exitCode = 1 }
+}

package/skill/scripts/ensure-project-runtime.sh

@@ -1,13 +1,4 @@
 #!/bin/bash
-# 円卓runtimeを一回の呼出しで現行Peertable版へ収束させる正規入口。
+# 全OS共通の公開API実装へ渡す旧入口。
 set -euo pipefail
-
-proj="${1:-}"
-[ -n "$proj" ] || { echo "usage: ensure-project-runtime.sh <project_dir>" >&2; exit 2; }
-scripts=$(cd "$(dirname "$0")" && pwd -P)
-
-for kind in alarm seat-status wakeup; do
-  "$scripts/ensure-bridge.sh" "$proj" "$kind"
-done
-
-echo "peertable runtime ready: alarm / seat-status / wakeup"
+exec node "$(dirname "$0")/ensure-project-runtime.mjs" "$@"

package/skill/scripts/ensure-project-runtime.test.mjs

@@ -0,0 +1,40 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { ensureBridge } from './ensure-project-runtime.mjs'
+
+test('新規runtimeは指定した資格元からファイルを準備して公開PTYへ渡す', async t => {
+  const project = realpathSync(mkdtempSync(join(tmpdir(), 'peertable-runtime-credential-')))
+  t.after(() => rmSync(project, { recursive: true, force: true }))
+  const team = join(project, '.team')
+  mkdirSync(team)
+  writeFileSync(join(team, 'setup-state.json'), JSON.stringify({ room: 'fixture', server_url: 'http://localhost', mode: 'standalone' }))
+  const source = join(project, 'source.env')
+  writeFileSync(source, 'PEERTABLE_POST_TOKEN=fixture-credential-123\n', { mode: 0o600 })
+  const env = { ...process.env, PEERTABLE_TOKEN_SOURCE_FILE: source }
+  delete env.PEERTABLE_POST_TOKEN
+  delete env.PEERTABLE_CREDENTIAL_FILE
+  let sent = false
+  const aiterm = {
+    call: async tool => { assert.equal(tool, 'pty_open') },
+    structured: async (tool, args) => {
+      if (tool === 'pty_close') return {}
+      assert.equal(tool, 'pty_send')
+      const credentials = join(team, 'credentials')
+      const files = readdirSync(credentials)
+      assert.equal(files.length, 1)
+      assert.equal(readFileSync(join(credentials, files[0]), 'utf8'), 'fixture-credential-123\n')
+      assert.ok(args.text.includes(files[0]))
+      assert.ok(args.text.includes('PEERTABLE_CREDENTIAL_FILE'))
+      assert.ok(!args.text.includes('fixture-credential-123'))
+      const stamp = new Date().toISOString()
+      writeFileSync(join(team, 'alarm-bridge.json'), JSON.stringify({ pid: process.pid, ready_at: stamp, last_progress_at: stamp }))
+      sent = true
+      return {}
+    },
+  }
+  assert.equal((await ensureBridge(project, 'alarm', { aiterm, env })).status, 'started')
+  assert.equal(sent, true)
+})