presubmit 0.1.0

package/dist/apps/server/src/shell-evaluator-settings.js

@@ -0,0 +1,53 @@
+import { mkdirSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { safetyPrompt } from '../../../packages/agent-pi/src/shell-safety.js';
+import { parseShellEvaluatorSettings, } from '../../../packages/protocol/src/shell-evaluator.js';
+function read(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { version: '0', providers: {} };
+        throw error;
+    }
+}
+export function evaluatorState(authPath, provider, models = []) {
+    const saved = read(authPath + '.shell-evaluator');
+    return {
+        version: saved.version,
+        provider,
+        models: models.filter((model) => model.id.startsWith(`${provider}/`)),
+        settings: saved.providers[provider] ?? {},
+        defaultPrompt: safetyPrompt,
+        environmentModel: process.env.PRESUBMIT_SAFETY_MODEL || undefined,
+    };
+}
+export function saveEvaluator(authPath, provider, models, input) {
+    const path = authPath + '.shell-evaluator';
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const lock = path + '.lock';
+    try {
+        mkdirSync(lock);
+    }
+    catch {
+        throw new Error('Evaluator settings are being saved elsewhere. Reload and retry.');
+    }
+    const temp = path + '.' + randomUUID();
+    try {
+        const saved = read(path);
+        if (input.version !== saved.version || input.provider !== provider)
+            throw new Error('Evaluator settings or provider changed. Reload before saving.');
+        const settings = parseShellEvaluatorSettings(input.settings, models.filter((model) => model.id.startsWith(`${provider}/`)));
+        saved.providers[provider] = settings;
+        saved.version = randomUUID();
+        writeFileSync(temp, JSON.stringify(saved), { mode: 0o600 });
+        renameSync(temp, path);
+        return evaluatorState(authPath, provider, models);
+    }
+    finally {
+        rmSync(temp, { force: true });
+        rmSync(lock, { recursive: true, force: true });
+    }
+}

package/dist/apps/server/src/store.js

@@ -0,0 +1,203 @@
+import { activitySummary } from '../../../packages/protocol/src/activity-summary.js';
+import { timed } from './diagnostics.js';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { ReplySearchIndex } from './reply-search.js';
+export class Store {
+    directory;
+    db;
+    replySearch;
+    sessionEventsCache;
+    summaries = new Map();
+    summaryBytes = 0;
+    constructor(directory) {
+        this.directory = directory;
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        this.db = new DatabaseSync(join(directory, 'state.sqlite'));
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON;
+      CREATE TABLE IF NOT EXISTS records(key TEXT PRIMARY KEY,value TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS events(seq INTEGER PRIMARY KEY AUTOINCREMENT,payload TEXT NOT NULL);
+      CREATE INDEX IF NOT EXISTS events_tool_identity ON events(json_extract(payload, '$.runId'), json_extract(payload, '$.data.toolCallId'), seq) WHERE json_extract(payload, '$.type') IN ('tool_start','tool_update','tool_end');
+      CREATE TABLE IF NOT EXISTS documents(id TEXT PRIMARY KEY,bytes BLOB NOT NULL);
+      CREATE TABLE IF NOT EXISTS commands(id TEXT PRIMARY KEY,response TEXT NOT NULL);`);
+        this.replySearch = new ReplySearchIndex(this.db);
+    }
+    get(key) {
+        const r = this.db.prepare('SELECT value FROM records WHERE key=?').get(key);
+        return r ? JSON.parse(r.value) : undefined;
+    }
+    put(key, value) {
+        const encoded = timed('store.encode', () => JSON.stringify(value));
+        timed('store.write', () => this.db.prepare('INSERT OR REPLACE INTO records VALUES(?,?)').run(key, encoded));
+    }
+    transaction(fn) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = fn();
+            this.db.exec('COMMIT');
+            return result;
+        }
+        catch (e) {
+            this.db.exec('ROLLBACK');
+            this.sessionEventsCache = undefined;
+            this.summaries.clear();
+            this.summaryBytes = 0;
+            throw e;
+        }
+    }
+    event(event) {
+        const data = { ...event, createdAt: new Date().toISOString() };
+        const r = this.db.prepare('INSERT INTO events(payload) VALUES(?)').run(JSON.stringify(data));
+        this.sessionEventsCache = undefined;
+        return { ...data, seq: Number(r.lastInsertRowid) };
+    }
+    events(after = 0, limit = 300) {
+        return this.db
+            .prepare('SELECT seq,payload FROM events WHERE seq>? ORDER BY seq ASC LIMIT ?')
+            .all(after, limit).map((r) => ({ ...JSON.parse(r.payload), seq: r.seq }));
+    }
+    recentEvents(limit = 300) {
+        return timed('store.recentEvents', () => this.db
+            .prepare('SELECT seq,payload FROM events ORDER BY seq DESC LIMIT ?')
+            .all(limit)
+            .reverse()
+            .map((r) => ({ ...JSON.parse(r.payload), seq: r.seq })));
+    }
+    summaryEvents(after = 0, limit = 500, recent = false) {
+        return timed('store.summaryEvents', () => {
+            const rows = this.db
+                .prepare(recent
+                ? 'SELECT seq,payload FROM events ORDER BY seq DESC LIMIT ?'
+                : 'SELECT seq,payload FROM events WHERE seq>? ORDER BY seq ASC LIMIT ?')
+                .all(...(recent ? [limit] : [after, limit]));
+            if (recent)
+                rows.reverse();
+            return rows.map((row) => {
+                let event = this.summaries.get(row.seq)?.event;
+                if (!event) {
+                    event = activitySummary({ ...JSON.parse(row.payload), seq: row.seq });
+                    const size = JSON.stringify(event).length * 2;
+                    if (size <= 4 * 1024 * 1024) {
+                        this.summaries.set(row.seq, { event, size });
+                        this.summaryBytes += size;
+                        while (this.summaries.size > 1000 || this.summaryBytes > 4 * 1024 * 1024) {
+                            const first = this.summaries.keys().next().value;
+                            this.summaryBytes -= this.summaries.get(first).size;
+                            this.summaries.delete(first);
+                        }
+                    }
+                }
+                return event;
+            });
+        });
+    }
+    toolOutput(runId, toolCallId) {
+        return timed('store.toolOutput', () => {
+            const query = `SELECT seq,payload FROM events WHERE json_extract(payload, '$.runId')=?
+      AND json_extract(payload, '$.data.toolCallId')=? AND json_extract(payload, '$.type') IN ('tool_start','tool_update','tool_end')`;
+            const latest = this.db
+                .prepare(query + ' ORDER BY seq DESC LIMIT 1')
+                .get(runId, toolCallId);
+            if (!latest)
+                return;
+            const first = this.db.prepare(query + ' ORDER BY seq ASC LIMIT 1').get(runId, toolCallId);
+            const initial = JSON.parse(first.payload);
+            const current = JSON.parse(latest.payload);
+            return {
+                ...current,
+                seq: latest.seq,
+                data: {
+                    ...initial.data,
+                    ...current.data,
+                    args: current.data?.args ?? initial.data?.args,
+                },
+            };
+        });
+    }
+    /** Keep only the latest timestamp, displayable activity, and unread activity for session lists. */
+    sessionEvents() {
+        if (this.sessionEventsCache)
+            return this.sessionEventsCache;
+        const latest = this.recentEvents(1)[0];
+        if (!latest)
+            return (this.sessionEventsCache = []);
+        let display = latest.text && latest.type !== 'command' ? latest : undefined;
+        if (!display) {
+            // Match the full snapshot's 500-event window without decoding every tool payload in JS.
+            const row = this.db
+                .prepare(`SELECT seq,payload FROM (SELECT seq,payload FROM events ORDER BY seq DESC LIMIT 500)
+           WHERE json_extract(payload, '$.type') != 'command'
+             AND COALESCE(json_extract(payload, '$.text'), '') != ''
+           ORDER BY seq DESC LIMIT 1`)
+                .get();
+            if (row)
+                display = { ...JSON.parse(row.payload), seq: row.seq };
+        }
+        let activity = latest.type !== 'workspace_changed' ? latest : undefined;
+        if (!activity) {
+            // Watcher invalidations refresh Files/Changes, not unread state. Search past the
+            // snapshot window so a run's activity is not lost after many background refreshes.
+            const row = this.db
+                .prepare(`SELECT seq,payload FROM events
+           WHERE json_extract(payload, '$.type') != 'workspace_changed'
+           ORDER BY seq DESC LIMIT 1`)
+                .get();
+            if (row)
+                activity = { ...JSON.parse(row.payload), seq: row.seq };
+        }
+        const compact = ({ seq, type, text, createdAt }) => ({
+            seq,
+            type,
+            text: text?.slice(0, 180),
+            createdAt,
+        });
+        const events = new Map();
+        // The unread cursor may outlive the display window; do not resurrect old preview text.
+        if (activity)
+            events.set(activity.seq, { ...compact(activity), text: undefined });
+        for (const event of [display, latest])
+            if (event)
+                events.set(event.seq, compact(event));
+        return (this.sessionEventsCache = [...events.values()].sort((a, b) => a.seq - b.seq));
+    }
+    document(id) {
+        return this.db.prepare('SELECT bytes FROM documents WHERE id=?').get(id)?.bytes;
+    }
+    saveDocument(id, bytes) {
+        this.db.prepare('INSERT OR REPLACE INTO documents VALUES(?,?)').run(id, bytes);
+    }
+    response(id) {
+        const r = this.db.prepare('SELECT response FROM commands WHERE id=?').get(id);
+        return r ? JSON.parse(r.response) : undefined;
+    }
+    saveResponse(id, response) {
+        this.db.prepare('INSERT INTO commands VALUES(?,?)').run(id, JSON.stringify(response));
+    }
+    initial(workspace) {
+        const saved = this.get('state');
+        if (saved)
+            return {
+                ...saved,
+                permissionMode: saved.permissionMode === 'auto' ? 'auto' : 'ask',
+                permissionVersion: saved.permissionVersion ?? 0,
+            };
+        return {
+            workspace,
+            sessionId: randomUUID(),
+            generation: randomUUID(),
+            runs: [],
+            events: [],
+            approvals: [],
+            reviews: [],
+            configured: false,
+            permissionMode: 'ask',
+            permissionVersion: 0,
+            recoveredDrafts: [],
+        };
+    }
+    close() {
+        this.db.close();
+    }
+}

package/dist/apps/server/src/tailscale-process.js

@@ -0,0 +1,115 @@
+import { execFile, fork } from 'node:child_process';
+import { access, constants } from 'node:fs/promises';
+import { delimiter, isAbsolute, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** No shell, provider credentials, or inherited Node hooks. */
+export function tailscaleEnvironment() {
+    const env = { TAILSCALE_BE_CLI: '1' };
+    for (const key of ['PATH', 'HOME', 'USER', 'LOGNAME', 'TMPDIR', 'TMP', 'TEMP', 'SystemRoot'])
+        if (process.env[key] !== undefined)
+            env[key] = process.env[key];
+    return env;
+}
+async function findCli() {
+    const candidates = (process.env.PATH ?? '')
+        .split(delimiter)
+        .filter((path) => isAbsolute(path))
+        .map((path) => join(path, process.platform === 'win32' ? 'tailscale.exe' : 'tailscale'));
+    if (process.platform === 'darwin')
+        candidates.push('/Applications/Tailscale.app/Contents/MacOS/Tailscale');
+    for (const path of candidates) {
+        try {
+            await access(path, constants.X_OK);
+            return path;
+        }
+        catch {
+            /* Try the next installed CLI. */
+        }
+    }
+    throw new Error('Tailscale CLI was not found. Install Tailscale and enable its CLI integration.');
+}
+export function createTailscaleDriver() {
+    let command;
+    const cli = async () => (command ??= await findCli());
+    return {
+        async read(args, signal) {
+            const executable = await cli();
+            return new Promise((resolve, reject) => {
+                execFile(executable, args, {
+                    env: tailscaleEnvironment(),
+                    encoding: 'utf8',
+                    timeout: 5000,
+                    maxBuffer: 1024 * 1024,
+                    signal,
+                }, (error, stdout) => {
+                    if (error) {
+                        reject(new Error('Could not read Tailscale status. Check that Tailscale is running and the CLI is permitted to access it.'));
+                        return;
+                    }
+                    try {
+                        resolve(JSON.parse(stdout));
+                    }
+                    catch {
+                        reject(new Error('Tailscale returned an unreadable status. Check its CLI integration.'));
+                    }
+                });
+            });
+        },
+        async start(port, target) {
+            return startServeProcess(await cli(), port, target);
+        },
+    };
+}
+/** Exported for lifecycle fixtures using a disposable fake CLI, never a real tailnet. */
+export function startServeProcess(command, port, target) {
+    const worker = new URL(import.meta.url.endsWith('.ts') ? './tailscale-serve-worker.ts' : './tailscale-serve-worker.js', import.meta.url);
+    const child = fork(fileURLToPath(worker), [command, port, target], {
+        env: tailscaleEnvironment(),
+        execArgv: worker.pathname.endsWith('.ts') ? ['--import', import.meta.resolve('tsx')] : [],
+        stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+        // A fallback group kill also cleans up the CLI if the supervisor itself gets stuck.
+        detached: process.platform !== 'win32',
+    });
+    let alive = true;
+    const exited = new Promise((resolve) => {
+        child.once('exit', () => {
+            alive = false;
+            resolve();
+        });
+        child.once('error', () => {
+            alive = false;
+            resolve();
+        });
+    });
+    let closing;
+    return {
+        get alive() {
+            return alive;
+        },
+        close() {
+            return (closing ??= (async () => {
+                if (!alive)
+                    return;
+                // Disconnect is also used for intentional shutdown: it works before the
+                // supervisor has finished importing, unlike an early SIGTERM.
+                if (child.connected)
+                    child.disconnect();
+                const timer = setTimeout(() => {
+                    if (!alive || !child.pid)
+                        return;
+                    try {
+                        if (process.platform !== 'win32')
+                            process.kill(-child.pid, 'SIGKILL');
+                        else
+                            child.kill('SIGKILL');
+                    }
+                    catch {
+                        /* Already exited. */
+                    }
+                }, 4000);
+                await exited;
+                clearTimeout(timer);
+            })());
+        },
+    };
+}

package/dist/apps/server/src/tailscale-serve-worker.js

@@ -0,0 +1,33 @@
+import { spawn } from 'node:child_process';
+// This supervisor owns only a foreground Serve command. Its IPC connection ties the
+// command's lifetime to Presubmit, including when Presubmit is killed unexpectedly.
+const [command, port, target] = process.argv.slice(2);
+if (!process.send || !command || !port || !target)
+    throw new Error('Missing Serve worker options');
+let stopping = false;
+let kill;
+let child;
+function stop() {
+    if (stopping)
+        return;
+    stopping = true;
+    if (!child?.pid)
+        process.exit(0);
+    child.kill('SIGINT');
+    kill = setTimeout(() => child?.kill('SIGKILL'), 2000);
+}
+process.once('disconnect', stop);
+process.once('SIGTERM', stop);
+process.once('SIGINT', stop);
+process.once('exit', () => child?.kill('SIGKILL'));
+if (!process.connected)
+    process.exit(0);
+child = spawn(command, ['serve', '--https=' + port, target], {
+    env: process.env,
+    stdio: 'ignore',
+});
+child.once('error', () => process.exit(1));
+child.once('exit', (code) => {
+    clearTimeout(kill);
+    process.exit(stopping ? 0 : (code ?? 1));
+});

package/dist/apps/server/src/tailscale-serve.js

@@ -0,0 +1,276 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { tailscaleOrigin } from './browser-access.js';
+import { createTailscaleDriver, } from './tailscale-process.js';
+function record(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Tailscale returned an unsupported configuration. Inspect it with tailscale serve status.');
+    return value;
+}
+function optionalRecord(value) {
+    return value == null ? {} : record(value);
+}
+/** Inspect the device listener only; named Tailscale Services have separate addresses. */
+export function serveMapping(value, remote, local) {
+    const url = new URL(remote);
+    const port = url.port || '443';
+    const host = `${url.hostname}:${port}`;
+    let matches = 0;
+    let conflict = false;
+    function inspect(value, depth) {
+        if (depth > 1)
+            throw new Error('Unsupported nested Tailscale Serve configuration.');
+        const config = record(value);
+        const tcp = optionalRecord(config.TCP);
+        const web = optionalRecord(config.Web);
+        const funnel = optionalRecord(config.AllowFunnel);
+        if (Object.entries(funnel).some(([key, enabled]) => key.endsWith(':' + port) && enabled !== false))
+            conflict = true;
+        const webEntries = Object.entries(web).filter(([key]) => key.endsWith(':' + port));
+        if (tcp[port] !== undefined || webEntries.length) {
+            const listener = optionalRecord(tcp[port]);
+            const handlers = optionalRecord(optionalRecord(web[host]).Handlers);
+            const root = optionalRecord(handlers['/']);
+            if (Object.keys(listener).length === 1 &&
+                listener.HTTPS === true &&
+                webEntries.length === 1 &&
+                webEntries[0][0] === host &&
+                Object.keys(handlers).length === 1 &&
+                Object.keys(root).length === 1 &&
+                (root.Proxy === local || root.Proxy === local + '/'))
+                matches++;
+            else
+                conflict = true;
+        }
+        for (const child of Object.values(optionalRecord(config.Foreground)))
+            inspect(child, depth + 1);
+    }
+    if (value !== null)
+        inspect(value, 0);
+    return conflict || matches > 1 ? 'conflict' : matches === 1 ? 'matching' : 'free';
+}
+export function servePreference(value) {
+    try {
+        const saved = record(value);
+        if (typeof saved.origin !== 'string' || typeof saved.autoStart !== 'boolean')
+            return;
+        return { origin: tailscaleOrigin(saved.origin), autoStart: saved.autoStart };
+    }
+    catch {
+        return;
+    }
+}
+export class TailscaleServe {
+    options;
+    remote;
+    detectedOrigin;
+    driver;
+    lifetime = new AbortController();
+    process;
+    operation;
+    read;
+    checkedAt = 0;
+    closed = false;
+    lastError = '';
+    state;
+    constructor(options) {
+        this.options = options;
+        this.remote = options.remote ? tailscaleOrigin(options.remote) : undefined;
+        const local = new URL(options.local);
+        if (local.protocol !== 'http:' ||
+            local.hostname !== '127.0.0.1' ||
+            local.origin !== options.local)
+            throw new Error('Serve requires the actual loopback server origin.');
+        this.driver = options.driver ?? createTailscaleDriver();
+        this.state = {
+            tailscaleOrigin: this.remote ?? null,
+            phase: 'stopped',
+            autoStart: options.preference?.autoStart === true && options.preference.origin === this.remote,
+            message: 'Tailscale Serve is stopped.',
+        };
+    }
+    update(phase, message) {
+        this.state = { ...this.state, phase, message };
+        return { ...this.state };
+    }
+    async inspect(signal) {
+        this.detectedOrigin = undefined;
+        const [rawStatus, config] = await Promise.all([
+            this.driver.read(['status', '--json', '--peers=false'], signal),
+            this.driver.read(['serve', 'status', '--json'], signal),
+        ]);
+        const status = record(rawStatus);
+        if (status.BackendState !== 'Running' || optionalRecord(status.Self).Online === false)
+            return this.update('blocked', 'Connect and sign in to Tailscale on the host computer, then retry.');
+        const dnsName = optionalRecord(status.Self).DNSName;
+        if (typeof dnsName !== 'string' || !dnsName.endsWith('.'))
+            return this.update('blocked', 'This Tailscale device has no full DNS name. Enable MagicDNS in Tailscale’s DNS settings, then retry.');
+        const discovered = tailscaleOrigin('https://' + dnsName.slice(0, -1));
+        const remote = this.remote ?? discovered;
+        const host = new URL(remote).hostname;
+        if (dnsName !== host + '.')
+            return this.update('blocked', 'The saved Tailscale address does not match this device. Restart Presubmit with --tailscale and its current address.');
+        this.detectedOrigin = remote;
+        const mapping = serveMapping(config, remote, this.options.local);
+        if (mapping === 'conflict')
+            return this.update('blocked', 'This HTTPS port has another Serve or Funnel configuration. Stop that configuration yourself or restart Presubmit with a different HTTPS port.');
+        if (mapping === 'matching')
+            return this.update(!this.remote ? 'stopped' : this.process?.alive ? 'running' : 'external', !this.remote
+                ? 'Serve already points here. Choose Start Serve to enable this device’s address in Presubmit.'
+                : this.process?.alive
+                    ? 'Serve is running. Presubmit will stop it when this host closes.'
+                    : 'Serve already points to Presubmit and is managed outside this app.');
+        if (!Array.isArray(status.CertDomains) || !status.CertDomains.includes(host))
+            return this.update('blocked', 'Enable HTTPS certificates in Tailscale’s DNS settings, then retry. Funnel is not needed.');
+        if (this.lastError)
+            return this.update('error', this.lastError);
+        return this.update('stopped', this.remote
+            ? 'Tailscale Serve is stopped.'
+            : 'Ready to connect. Start Serve to use this computer’s Tailscale address.');
+    }
+    configure() {
+        const origin = this.remote ?? this.detectedOrigin;
+        if (!origin)
+            throw new Error('Could not find this computer’s Tailscale address.');
+        this.options.save({ origin, autoStart: this.state.autoStart });
+        this.options.configure?.(origin);
+        this.remote = origin;
+        this.state = { ...this.state, tailscaleOrigin: origin };
+        return origin;
+    }
+    async status(force = false) {
+        if (this.closed || this.operation)
+            return { ...this.state };
+        if (!force && Date.now() - this.checkedAt < 3000)
+            return { ...this.state };
+        return (this.read ??= this.inspect(this.lifetime.signal)
+            .catch((error) => this.update('error', error instanceof Error ? error.message : 'Could not check Tailscale.'))
+            .finally(() => {
+            this.checkedAt = Date.now();
+            this.read = undefined;
+        }));
+    }
+    async setAutoStart(enabled) {
+        if (this.closed)
+            throw new Error('Server is stopping.');
+        const previous = this.operation;
+        const operation = (async () => {
+            await previous;
+            await this.read;
+            this.lifetime.signal.throwIfAborted();
+            if (!this.remote) {
+                this.lastError = '';
+                const current = await this.inspect(this.lifetime.signal);
+                if (current.phase !== 'stopped')
+                    return current;
+            }
+            this.lifetime.signal.throwIfAborted();
+            const origin = this.configure();
+            this.options.save({ origin, autoStart: enabled });
+            this.state = { ...this.state, autoStart: enabled };
+            return { ...this.state };
+        })().catch((error) => this.update('error', error instanceof Error ? error.message : 'Could not save startup preference.'));
+        this.operation = operation;
+        try {
+            return await operation;
+        }
+        finally {
+            if (this.operation === operation)
+                this.operation = undefined;
+            this.checkedAt = 0;
+        }
+    }
+    restore() {
+        if (this.state.autoStart)
+            void this.start();
+    }
+    start() {
+        if (this.closed)
+            return Promise.resolve({ ...this.state });
+        if (this.operation)
+            return this.operation;
+        const operation = this.startImpl().finally(() => {
+            if (this.operation === operation)
+                this.operation = undefined;
+            this.checkedAt = 0;
+        });
+        this.operation = operation;
+        return operation;
+    }
+    async startImpl() {
+        try {
+            await this.read;
+            this.lastError = '';
+            const signal = AbortSignal.any([
+                this.lifetime.signal,
+                AbortSignal.timeout(this.options.startupTimeoutMs ?? 15_000),
+            ]);
+            const before = await this.inspect(signal);
+            if (before.phase !== 'stopped' && before.phase !== 'external' && before.phase !== 'running')
+                return before;
+            signal.throwIfAborted();
+            const remote = this.configure();
+            // Enabling an address can reuse an existing mapping without owning or replacing it.
+            const configured = await this.inspect(signal);
+            if (configured.phase !== 'stopped')
+                return configured;
+            signal.throwIfAborted();
+            // Never use --bg, reset, off, or Funnel. Only our foreground session is owned.
+            await this.process?.close();
+            this.update('starting', 'Starting Tailscale Serve…');
+            this.process = await this.driver.start(new URL(remote).port || '443', this.options.local);
+            for (;;) {
+                signal.throwIfAborted();
+                if (!this.process.alive)
+                    throw new Error('Tailscale Serve exited. Check CLI permissions and HTTPS setup on the host, then retry.');
+                const current = await this.inspect(signal);
+                if (current.phase === 'running')
+                    return current;
+                if (current.phase === 'blocked')
+                    throw new Error(current.message);
+                this.update('starting', 'Starting Tailscale Serve…');
+                await delay(250, undefined, { signal });
+            }
+        }
+        catch (error) {
+            await this.process?.close();
+            this.process = undefined;
+            this.lastError = this.closed
+                ? 'Presubmit is stopping.'
+                : error instanceof Error && error.name !== 'TimeoutError' && error.name !== 'AbortError'
+                    ? error.message
+                    : 'Serve did not become ready. Check Tailscale and HTTPS setup on the host, then retry.';
+            return this.update('error', this.lastError);
+        }
+    }
+    async stop() {
+        if (this.closed)
+            return { ...this.state };
+        const previous = this.operation;
+        const operation = (async () => {
+            await previous;
+            await this.read;
+            await this.process?.close();
+            this.process = undefined;
+            this.lastError = '';
+            // An external Serve mapping is never stopped or adopted.
+            return this.inspect(this.lifetime.signal).catch((error) => this.update('error', error instanceof Error ? error.message : 'Could not check Tailscale.'));
+        })();
+        this.operation = operation;
+        try {
+            return await operation;
+        }
+        finally {
+            if (this.operation === operation)
+                this.operation = undefined;
+            this.checkedAt = 0;
+        }
+    }
+    async close() {
+        this.closed = true;
+        this.lifetime.abort();
+        await this.operation;
+        await this.read;
+        await this.process?.close();
+        this.process = undefined;
+    }
+}