rovecode 0.3.3 → 0.4.0-beta.2

package/src/core/verify.ts

@@ -1,236 +0,0 @@
-/** What check this project runs before the agent's work counts as done — decided without ever guessing.
- *
- *  Berkay (2026-09-06): the CLI should govern its own work and catch its own mistakes before saying done. The
- *  loop's gate (core/verify-gate.ts, nimbus-99) runs a command after the last edit; THIS module decides which one,
- *  and it is the half that can do damage: a gate that runs the wrong command once — `npm test` that deploys,
- *  wipes a database, or takes twenty minutes — is turned off forever. Two measurements shaped it (nimbus-6f, same
- *  night): in Berkay's real projects (plain HTML/CSS/JS, no package.json) there is nothing to run at all, so
- *  "none" is the MAIN path and its text is what a person reads; and in a TypeScript project a type-check caught
- *  the same three constructed mistakes as the full suite in a tenth of the time (10 s against 170 s here). So:
- *
- *  1. Configuration first. `verify` in .rovecode/settings.json (project) or ~/.rovecode/settings.json (user),
- *     a command string or a list, project winning like every other key. This is the one source that needs
- *     no inference, and the ONLY way a test suite becomes the gate. `false` turns the gate off on purpose and
- *     stops the inference below as well.
- *  2. Inference second, aimed at the FAST check, and only where both the name and the shape are recognised:
- *     - package.json `typecheck` whose body is tsc; `lint` whose body is eslint, biome or oxlint. Name alone is
- *       not enough (a `lint` script may do anything); the body has to be a runner known to run unattended and end.
- *     - package.json `check`, only when neither of those was taken, and only when its body compiles or lints
- *       without running tests: a `check` that runs the suite is the thorough gate, and the thorough gate is
- *       configured, never inferred — the refusal names it and how to opt in.
- *     - Cargo.toml → `cargo check`; go.mod → `go vet ./...`; a ruff-configured Python project → `ruff check .`.
- *     - A `test` script, `cargo test`, `pytest`, Makefile targets: never inferred, always listed with the reason.
- *  3. Everything seen and NOT inferred goes into `refused`, in words specific enough that a person reads the
- *     line and either agrees or sets the key. "Nothing" is a good answer; "could not infer" is not.
- *
- *  The seam for the runner is `commands: string[]` it does not interpret, so per-file targeting ("tsc --noEmit"
- *  plus the tests that import the changed files) can be added here later without touching anything downstream.
- *  Pure apart from reading the files named above; never throws; never runs anything. */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { loadSettingsScoped, settingsPath } from "./settings.ts";
-
-export interface VerifyPlan {
-  /** where the commands came from; "none" = the gate has nothing to run */
-  source: "settings" | "inferred" | "none";
-  /** the shell commands the gate runs, in order, uninterpreted; empty when source is "none" */
-  commands: string[];
-  /** one sentence: the file and key or script the answer came from, or why there is none */
-  reason: string;
-  /** what was seen and deliberately not inferred, each with its reason — the argument for trusting the gate */
-  refused: string[];
-}
-
-export interface VerifyDeps {
-  exists?: (p: string) => boolean;
-  read?: (p: string) => string;
-}
-
-/** words in a `check` script's body that mean it is not a check */
-const DANGEROUS = /\b(deploy|publish|release|push|migrate|drop|rm\s+-rf|docker|kubectl|terraform|curl|wget|ssh|scp|rsync)\b/i;
-/** a body that keeps running until killed — never a gate */
-const WATCH = /(^|\s)(--watch(=\S*)?|-w|--watchAll)(\s|$)|\bnodemon\b|\bvitest\s*$/;
-/** a body that runs a test suite — the thorough gate, configured only */
-const RUNS_TESTS = /\b(bun test|vitest|jest|mocha|node --test|playwright test|cypress run|ava|tap|uvu)\b/;
-/** runners whose bare invocation runs once, unattended, and exits */
-const TYPECHECK_RUNNER = /^(bunx |npx |pnpm exec |yarn )?(tsc|vue-tsc|svelte-check)(\s|$)/;
-const LINT_RUNNER = /^(bunx |npx |pnpm exec |yarn )?(eslint|biome (check|lint)|oxlint)(\s|$)/;
-
-/** the package manager the lockfile says this project uses; npm when none says */
-function packageRunner(cwd: string, exists: (p: string) => boolean): { run: string; from: string } {
-  if (exists(join(cwd, "bun.lock")) || exists(join(cwd, "bun.lockb"))) return { run: "bun run", from: "bun.lock" };
-  if (exists(join(cwd, "pnpm-lock.yaml"))) return { run: "pnpm run", from: "pnpm-lock.yaml" };
-  if (exists(join(cwd, "yarn.lock"))) return { run: "yarn", from: "yarn.lock" };
-  if (exists(join(cwd, "package-lock.json"))) return { run: "npm run", from: "package-lock.json" };
-  return { run: "npm run", from: "no lockfile (npm assumed)" };
-}
-
-export const NONE_REASON = "nothing configured and nothing fast and safe to infer — set verify in .rovecode/settings.json (a command, or a list) to turn the gate on";
-export const NOTHING_HERE = "no package.json, Cargo.toml, go.mod or pyproject.toml here, so there is no compiler, linter or test runner to run; for a plain HTML/CSS/JS site that is the normal answer, and the gate stays off";
-
-/** Resolve this project's verify command(s). */
-export function resolveVerify(cwd: string, deps: VerifyDeps = {}): VerifyPlan {
-  const exists = deps.exists ?? existsSync;
-  const read = deps.read ?? ((p: string) => readFileSync(p, "utf8"));
-
-  // 1. configuration
-  // loadSettingsScoped already applied the trust gate: an UNTRUSTED project file's `verify` is not here (core/settings.ts
-  // COMMAND_KEYS) — a cloned repo does not choose the command this gate runs. `verify: false` is honoured from any file.
-  const scoped = loadSettingsScoped(cwd);
-  const settings = { ...scoped.user, ...scoped.project };
-  if (settings.verify === false) {
-    return { source: "none", commands: [], reason: "settings.json verify: false — the gate is off by choice, nothing is inferred", refused: [] };
-  }
-  if (settings.verify !== undefined) {
-    const commands = Array.isArray(settings.verify) ? settings.verify : [settings.verify];
-    const where = scoped.project.verify !== undefined ? scoped.projectPath : settingsPath("user", cwd);
-    return { source: "settings", commands, reason: `${where} verify`, refused: [] };
-  }
-
-  // 2. inference
-  const commands: string[] = [];
-  const from: string[] = [];
-  const refused: string[] = [];
-
-  const pkgPath = join(cwd, "package.json");
-  if (exists(pkgPath)) {
-    let scripts: Record<string, string> = {};
-    let ok = true;
-    try {
-      const raw = JSON.parse(read(pkgPath)) as { scripts?: unknown };
-      const s = raw.scripts;
-      if (s !== undefined && (typeof s !== "object" || s === null || Array.isArray(s))) { refused.push('package.json: "scripts" is not an object — nothing inferred from it'); ok = false; }
-      else if (s) for (const [k, v] of Object.entries(s as Record<string, unknown>)) if (typeof v === "string") scripts[k] = v;
-    } catch { refused.push("package.json is not valid JSON — nothing inferred from it"); ok = false; scripts = {}; }
-    if (ok) {
-      const pm = packageRunner(cwd, exists);
-      const body = (name: string): string => scripts[name]!.trim();
-      const optIn = (name: string) => `set \`"verify": "${pm.run} ${name}"\` in .rovecode/settings.json`;
-
-      // the fast checks: a recognised runner, or a refusal that quotes the body
-      const take = (name: string, runner: RegExp, what: string, known: string): void => {
-        if (scripts[name] === undefined) return;
-        const b = body(name);
-        if (WATCH.test(b)) { refused.push(`package.json script "${name}" runs \`${b}\`: a watch mode never exits, so it cannot gate a run`); return; }
-        if (!runner.test(b)) { refused.push(`package.json script "${name}" runs \`${b}\`: not a ${what} this gate knows runs unattended and ends (${known}) — ${optIn(name)} to run it anyway`); return; }
-        commands.push(`${pm.run} ${name}`); from.push(`package.json script "${name}" (${pm.from})`);
-      };
-      take("typecheck", TYPECHECK_RUNNER, "type-checker", "tsc, vue-tsc, svelte-check");
-      take("lint", LINT_RUNNER, "linter", "eslint, biome check, oxlint");
-
-      // `check`: the convention means "verify, change nothing" — taken as the fallback fast check when it only
-      // compiles or lints; refused, with the cost named, when it runs the suite or does anything a check must not
-      if (scripts.check !== undefined) {
-        const b = body("check");
-        const bad = DANGEROUS.exec(b);
-        const tests = RUNS_TESTS.exec(b);
-        if (bad) refused.push(`package.json script "check" runs \`${b}\`: it names \`${bad[1]}\`, which a check must not do — ${optIn("check")} if that is really what you want the gate to run`);
-        else if (WATCH.test(b)) refused.push(`package.json script "check" runs \`${b}\`: a watch mode never exits, so it cannot gate a run`);
-        else if (tests) refused.push(`package.json script "check" runs \`${b}\`: it runs the test suite (\`${tests[1]}\`), which is minutes here rather than seconds; the thorough gate is configured, never inferred — ${optIn("check")} if that cost is right for this project`);
-        else if (commands.length > 0) refused.push(`package.json script "check" runs \`${b}\`: a faster script already covers it (${from.map((f) => f.split(" (")[0]).join(", ")}) — ${optIn("check")} to run it instead`);
-        else { commands.push(`${pm.run} check`); from.push(`package.json script "check" (${pm.from})`); }
-      }
-
-      // `test`: never inferred — the name promises nothing about the body, and a suite is the slow gate
-      if (scripts.test !== undefined) {
-        const b = body("test");
-        refused.push(`package.json script "test" runs \`${b}\`: a test suite is never inferred, only configured (the fast gate is a type-check; a suite can take minutes and may need services) — ${optIn("test")} if it is quick enough here`);
-      }
-      if (commands.length === 0 && refused.length === 0) refused.push('package.json has no "typecheck", "lint", "check" or "test" script — name one, or set verify in .rovecode/settings.json');
-    }
-  }
-
-  if (exists(join(cwd, "Cargo.toml"))) {
-    commands.push("cargo check"); from.push("Cargo.toml");
-    refused.push("`cargo test` is not inferred: it runs the crate's tests, which may be slow or need services — set verify to run it");
-  }
-  if (exists(join(cwd, "go.mod"))) {
-    commands.push("go vet ./..."); from.push("go.mod");
-    refused.push("`go test ./...` is not inferred: it runs the module's tests — set verify to run it");
-  }
-  const pyproject = join(cwd, "pyproject.toml");
-  if (exists(pyproject) || exists(join(cwd, "ruff.toml"))) {
-    const ruffToml = exists(join(cwd, "ruff.toml"));
-    let ruff = ruffToml;
-    if (!ruff && exists(pyproject)) { try { ruff = /^\[tool\.ruff(\.|\])/m.test(read(pyproject)); } catch { /* unreadable: no ruff */ } }
-    if (ruff) { commands.push("ruff check ."); from.push(ruffToml ? "ruff.toml" : "pyproject.toml [tool.ruff]"); }
-    else refused.push("pyproject.toml without a [tool.ruff] section: no linter is configured that this gate knows — set verify (for example `ruff check .` or `pytest -q`) to run one");
-    refused.push("`pytest` is not inferred: it runs the project's tests — set verify to run it");
-  }
-  if (exists(join(cwd, "Makefile")) || exists(join(cwd, "makefile"))) {
-    refused.push("a Makefile is here, but make targets are never inferred (a target can do anything) — set verify to `make check` or the target you mean");
-  }
-
-  if (commands.length > 0) {
-    return { source: "inferred", commands, reason: `inferred from ${from.join(", ")}`, refused };
-  }
-  if (refused.length === 0) return { source: "none", commands: [], reason: NOTHING_HERE, refused: [] };
-  return { source: "none", commands: [], reason: NONE_REASON, refused };
-}
-
-
-/** the commands as one label — the SAME words in the doctor row and in the loop's `verify` RunEvent ("running
- *  bun run check  &&  bun test"), so a person sees one name for one thing */
-export function verifyLabel(plan: VerifyPlan): string {
-  return plan.commands.join("  &&  ");
-}
-
-/** one line for `rovecode doctor` and the settings docs */
-export function describeVerify(plan: VerifyPlan): string {
-  if (plan.source === "none") return `none — ${plan.reason}`;
-  return `${verifyLabel(plan)} — ${plan.reason}`;
-}
-
-/** what the gate does NOT see, said wherever the gate is described (doctor, README): the loop counts edits made
- *  through `edit` and `write`; a run that changed files only through `bash` has no counted write, so it is not
- *  verified. Owned here so the doctor row and the docs cannot drift apart. */
-export const VERIFY_BLIND_SPOT = "runs after edits made with `edit` or `write`; a run that changed files only through `bash` is not counted, so it is not verified";
-
-// ---- cost: a check's duration is the fact that makes the doctor row honest ("bun run check, 170 s last time").
-// The resolver never runs anything, so it cannot measure; the gate can, and records here after each run. Project-local
-// because the same command costs different amounts in different repos; one small file, one entry per command.
-
-export const VERIFY_TIMING_FILE = join(".rovecode", "verify-timing.json");
-type Timings = Record<string, { ms: number; at: string }>;
-
-function readTimings(cwd: string): Timings {
-  try {
-    const raw = JSON.parse(readFileSync(join(cwd, VERIFY_TIMING_FILE), "utf8")) as unknown;
-    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
-    const out: Timings = {};
-    for (const [k, v] of Object.entries(raw as Record<string, unknown>)) {
-      if (v && typeof v === "object" && typeof (v as { ms?: unknown }).ms === "number" && typeof (v as { at?: unknown }).at === "string") out[k] = v as { ms: number; at: string };
-    }
-    return out;
-  } catch { return {}; }
-}
-
-/** for the gate: remember how long `command` took in this project. Never throws (a timing is not worth a crash). */
-export function recordVerifyTiming(cwd: string, command: string, ms: number, now: Date = new Date()): void {
-  try {
-    const t = readTimings(cwd);
-    t[command] = { ms: Math.max(0, Math.round(ms)), at: now.toISOString() };
-    mkdirSync(join(cwd, ".rovecode"), { recursive: true });
-    writeFileSync(join(cwd, VERIFY_TIMING_FILE), JSON.stringify(t, null, 2) + "\n");
-  } catch { /* a timing is not worth a crash */ }
-}
-
-/** the last measured duration of `command` here, or undefined when it has not run yet */
-export function lastVerifyTiming(cwd: string, command: string): number | undefined {
-  return readTimings(cwd)[command]?.ms;
-}
-
-/** "3 s" / "170 s" / "2 min 50 s" — the cost as a person says it */
-export function formatDuration(ms: number): string {
-  const s = Math.round(ms / 1000);
-  if (s < 1) return "under a second";
-  if (s < 120) return `${s} s`;
-  const m = Math.floor(s / 60), r = s % 60;
-  return r === 0 ? `${m} min` : `${m} min ${r} s`;
-}
-
-/** the label with each command's last cost when known: "bun run typecheck (9 s)  &&  bun test (not run yet)" */
-export function verifyLabelWithCost(cwd: string, plan: VerifyPlan): string {
-  return plan.commands.map((c) => { const ms = lastVerifyTiming(cwd, c); return ms === undefined ? `${c} (not run here yet)` : `${c} (${formatDuration(ms)} last time)`; }).join("  &&  ");
-}

package/src/core/voice.ts

@@ -1,158 +0,0 @@
-/** rovecode's voice — the one place user-facing wording lives: mode labels, the no-model recipe, the
- *  welcome card, the panels' empty-state hints. First person, short plain sentences, one idea per
- *  line, no emoji; the ◆ glyph marks rovecode's own lines; a problem always ends with the next step.
- *  Pure strings and string builders: every surface (CLI, REPL, TUI, server, ACP) reads from here so a
- *  wording change lands everywhere at once. */
-
-/** the permission modes as the screen names them; the flags/commands keep their names (--yolo, /yolo, ROVECODE_YOLO) */
-export const MODE_ASK = "ask first";
-export const MODE_AUTO = "auto (never asks)";
-export const MODE_ACCEPT = "accept edits";
-
-/** "ask first" | "auto (never asks)" — the status/notes label for the yolo flag */
-export function modeLabel(yolo: boolean): string { return yolo ? MODE_AUTO : MODE_ASK; }
-/** compact form for footers and status bars: "ask first" | "auto" */
-export function modeLabelShort(yolo: boolean): string { return yolo ? "auto" : MODE_ASK; }
-/** what each mode means, in one sentence */
-export function modeMeaning(yolo: boolean): string {
-  return yolo ? "I won't stop to ask before writes or shell commands" : "I ask before I write or run anything";
-}
-
-/** the marker every problem message ends with */
-export const NEXT = "→ next:";
-export const next = (text: string): string => `${NEXT} ${text}`;
-
-/** The no-model recipe — three lines, `rovecode setup` first. `where` picks the commands that exist
- *  on that surface; the first line is stable ("no provider configured") for callers that match it. */
-export function noModelHint(where: "cli" | "tui" = "cli"): string {
-  const setup = where === "tui" ? "/setup" : "rovecode setup";
-  const alt = where === "tui"
-    ? "/provider add <id> <baseUrl> · /provider key <id> <secret>"
-    : "rovecode provider add <id> <baseUrl>, then rovecode auth set <id>";
-  return [
-    "no provider configured — no model to think with yet.",
-    `  ${next(setup)}   (pick a provider, paste the key hidden, one test call)`,
-    `  or: ${alt} · or set ROVECODE_BASE_URL + ROVECODE_API_KEY`,
-  ].join("\n");
-}
-
-/** `rovecode run` with nothing configured answers from a scripted mock; this is what it says. */
-export const MOCK_PROVIDER_TEXT =
-  `Rovecode mock provider: no model is connected, so this is a canned reply. ${next("rovecode setup")} (or rovecode provider add <id> <baseUrl> + rovecode auth set <id>, or set ROVECODE_BASE_URL and ROVECODE_API_KEY)`;
-
-export interface WelcomeOpts {
-  /** the session's provider/model when one is connected; null = nothing configured */
-  connected: { provider: string; model: string } | null;
-  cwd: string;
-  yolo: boolean;
-  /** plan/act; act is the default and is not mentioned */
-  mode?: "plan" | "act";
-  /** the running version, so "which rovecode is this" never needs a second command */
-  version?: string;
-  /** what this session actually loaded. Zeroes are omitted rather than printed: a line reading
-   *  "0 skills · 0 plugins · 0 MCP servers" is three facts nobody asked for, while "19 skills · 2 MCP
-   *  servers" is the answer to "did my install take". */
-  loaded?: { skills?: number; plugins?: number; mcp?: number };
-  /** the one-line update notice, when there is one; see core/update-check.ts */
-  update?: string | null;
-  /** columns available; under BANNER_COLS the wordmark is dropped rather than wrapped (default 80) */
-  width?: number;
-}
-
-/** ROVECODE in half-block letters, two rows. Berkay picked this over a boxed header and a plain block
- *  (2026-09-06). It is 31 columns wide, so it fits a narrow split, and it only appears when the card
- *  knows the version — a banner with nothing to say under it is decoration. */
-const WORDMARK = ["█▀█ █▀█ █ █ █▀▀ █▀▀ █▀█ █▀▄ █▀▀", "█▀▄ █▄█ ▀▄▀ █▄▄ █▄▄ █▄█ █▄▀ █▄▄"] as const;
-const BANNER_COLS = 46;
-
-/** "19 skills · 3 plugins · 2 MCP servers", counting only what is there. Null when nothing loaded,
- *  because the absence of the line says that better than the line saying zero three times. */
-export function loadedLine(loaded: WelcomeOpts["loaded"]): string | null {
-  if (!loaded) return null;
-  const plural = (n: number, one: string) => `${n} ${one}${n === 1 ? "" : "s"}`;
-  const bits: string[] = [];
-  if (loaded.skills) bits.push(plural(loaded.skills, "skill"));
-  if (loaded.plugins) bits.push(plural(loaded.plugins, "plugin"));
-  if (loaded.mcp) bits.push(plural(loaded.mcp, "MCP server"));
-  return bits.length > 0 ? bits.join(" · ") : null;
-}
-
-/** The card a fresh session opens with (the messages panel's first note). */
-export function welcomeCard(o: WelcomeOpts): string {
-  const where = `${o.cwd} · ${modeLabelShort(o.yolo)}${o.mode === "plan" ? " · plan mode (read-only)" : ""}`;
-  const version = o.version ? ` ${o.version}` : "";
-  // the two optional footers, in the order a reader wants them: what this session has, then what it
-  // could have. Both drop out entirely when there is nothing to say — see loadedLine and updateLine.
-  const tail = [loadedLine(o.loaded), where, o.update ?? null].filter((l): l is string => l !== null);
-  // The banner form: the wordmark, then one line per fact. It needs a version (there is nothing to put
-  // beside the mark otherwise) and room (under BANNER_COLS the mark would wrap into noise), and it falls
-  // back to exactly the prose card below — which is what a resumed or narrow session still sees.
-  if (o.version !== undefined && (o.width ?? 80) >= BANNER_COLS) {
-    const model = o.connected === null ? null
-      : o.connected.model.length > 0 ? `${o.connected.provider}/${o.connected.model}` : o.connected.provider;
-    const loaded = loadedLine(o.loaded);
-    return [
-      `  ${WORDMARK[0]}`,
-      `  ${WORDMARK[1]}  ${o.version}`,
-      "",
-      model === null ? "  no model connected yet — /setup fixes that in about a minute"
-        : `  ${[model, loaded].filter((s) => s !== null).join(" · ")}`,
-      `  ${where}`,
-      ...(model === null ? [] : [`  I read first, then ${o.yolo ? "work without asking" : "ask before I write or run anything"}. /help lists commands by topic.`]),
-      ...(o.update ? [`  ${o.update}`] : []),
-    ].join("\n");
-  }
-  if (o.connected === null) {
-    return [
-      `◆ rovecode${version} here. No model connected yet, so I can't think.`,
-      "/setup fixes that in about a minute.",
-      ...tail,
-    ].join("\n");
-  }
-  const model = o.connected.model.length > 0 ? `${o.connected.provider}/${o.connected.model}` : o.connected.provider;
-  return [
-    `◆ rovecode${version} here. Connected to ${model}.`,
-    `Tell me what you want done; I read first, then ${o.yolo ? "work without asking" : "ask before I write or run anything"}.`,
-    "/help lists commands by topic.",
-    ...tail,
-  ].join("\n");
-}
-
-/** one-liner for a resumed session (its transcript is the card) */
-export function resumedLine(id: string, cwd: string, yolo: boolean): string {
-  return `◆ back in session ${id.slice(0, 8)} · ${cwd} · ${modeLabelShort(yolo)}`;
-}
-
-/** the /effort note. Says what the level costs, because that is the part that surprises people:
- *  thinking tokens are billed as output and they arrive before any answer does. */
-export function effortNote(level: string, receives?: string): string {
-  const head = level === "off" ? "thinking: off — I answer straight away."
-    : level === "auto" ? "thinking: auto — the model decides how much to reason; I send no dial."
-    : `thinking: ${level} — I reason before answering. It costs output tokens and delays the first word.`;
-  // the second line is the truth on the wire (providers/thinking.ts thinkingLine): the level is one word,
-  // what this model's endpoint actually receives for it is another, and a model without a reasoning mode
-  // receives nothing at all — the person should not have to guess which
-  return receives ? `${head}\n  ${receives}` : head;
-}
-
-/** the /yolo toggle's note */
-export function modeSwitchNote(yolo: boolean): string {
-  return `mode: ${modeLabel(yolo)} — ${modeMeaning(yolo)}`;
-}
-
-/** the /accept-edits toggle's note. Says the boundary out loud: this is not auto mode, and the two
- *  things it does NOT cover are the two that can leave the repository. */
-export function acceptEditsNote(on: boolean): string {
-  return on
-    ? `mode: ${MODE_ACCEPT} — I write inside this folder without asking. Shell commands, subagents, network and any write outside it still ask, and deny rules still hold.`
-    : `mode: ${MODE_ASK} — I ask before every write again.`;
-}
-
-// ---------- panel empty states (one dim line each; a second line only when the panel has room) ----------
-
-export const EMPTY = {
-  code: "nothing open — when I read a file it shows here",
-  files: ["no files yet", "they appear as I read them"] as const,
-  plan: ["no plan yet", "my steps show up here"] as const,
-  usage: "0 so far",
-} as const;

package/src/core/win-job.ts

@@ -1,183 +0,0 @@
-/** Windows process-TREE kill via a kernel Job Object (port #21 HIGH-1).
- *
- *  `taskkill /T` walks LIVE parent links. msys2 (Git bash) implements a
- *  Cygwin→Cygwin exec by handing the pid to the new image and exiting the
- *  forked stub, so the external command actually running inside a compound
- *  (`a; sleep N; b`), nested (`bash -c '…'`) or backgrounded (`x & y & wait`)
- *  shape has a DEAD Win32 parent and the walk never reaches it. Measured
- *  through bunRunner on the reference box with an msys `sleep` child: 3/3
- *  leaks + 3/3 runner hangs per shape (the orphan kept stdout open); only a
- *  bare `sleep N`, exec'd without a fork, died. A native child (bun.exe) stays
- *  reachable, which is why the shipped test passed. A Job Object records
- *  membership at CreateProcess time and inherits it down the tree, so
- *  TerminateJobObject kills every descendant regardless of parent links.
- *
- *  Per-spawn lifecycle (executor.ts bunRunner):
- *    createWinJob() → assign(launcherPid)   right after Bun.spawn
- *    abort  → terminate()                    TerminateJobObject, then close
- *    settle → release()                      a run that completed on its own:
- *             drop the close-kill limit, then close — a child the command
- *             deliberately left behind (`server > log 2>&1 &`) survives, as
- *             it does on POSIX and did before this port. While the command is
- *             in flight the limit stays armed, so an rovecode crash takes the
- *             tree with it (the OS closes the handle).
- *  assign() also sweeps the launcher's already-visible descendants by a
- *  Toolhelp32 parent-chain walk: a child forked in the spawn→assign window is
- *  not a member by inheritance (under load that window can span a scheduler
- *  quantum). Residual: a Cygwin stub that already exec'd AND exited inside
- *  that window leaves its child unreachable by any parent walk. The sweep
- *  costs one process snapshot (~15ms with ~300 processes on the loaded
- *  reference box).
- *  Fail-safe: non-win32, no bun:ffi, or any kernel32 call failing → null; the
- *  caller keeps `taskkill /T /F` alone and reports treeKill "taskkill-only".
- *  Nested jobs (Windows 8+) let this work when rovecode itself already runs
- *  inside a job (terminals and IDEs do that): the launcher is then in both. */
-
-import { dlopen, FFIType, ptr } from "bun:ffi";
-
-const JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x2000;
-const JobObjectExtendedLimitInformation = 9;
-/** sizeof(JOBOBJECT_EXTENDED_LIMIT_INFORMATION) on x64; LimitFlags sits at
- *  BasicLimitInformation offset 16 (after two LARGE_INTEGERs). */
-const EXTENDED_LIMIT_SIZE = 144;
-const LIMIT_FLAGS_OFFSET = 16;
-const PROCESS_SET_QUOTA_AND_TERMINATE = 0x0101;
-const TH32CS_SNAPPROCESS = 0x2;
-/** sizeof(PROCESSENTRY32W) on x64; th32ProcessID at 8, th32ParentProcessID at 32. */
-const PE32_SIZE = 568;
-const PE32_PID = 8;
-const PE32_PPID = 32;
-
-type Handle = number;
-
-interface Kernel32 {
-  CreateJobObjectW(attrs: null, name: null): Handle | null;
-  SetInformationJobObject(job: Handle, cls: number, info: number, len: number): number;
-  AssignProcessToJobObject(job: Handle, proc: Handle): number;
-  TerminateJobObject(job: Handle, exitCode: number): number;
-  OpenProcess(access: number, inherit: number, pid: number): Handle | null;
-  CloseHandle(h: Handle): number;
-  CreateToolhelp32Snapshot(flags: number, pid: number): Handle | null;
-  Process32FirstW(snap: Handle, entry: number): number;
-  Process32NextW(snap: Handle, entry: number): number;
-}
-
-let library: { symbols: unknown } | null | undefined; // undefined = not tried yet
-let override: boolean | null = null;
-
-function kernel32(): Kernel32 | null {
-  if (library === undefined) {
-    library = null;
-    if (process.platform === "win32") {
-      try {
-        library = dlopen("kernel32.dll", {
-          CreateJobObjectW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
-          SetInformationJobObject: { args: [FFIType.ptr, FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
-          AssignProcessToJobObject: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-          TerminateJobObject: { args: [FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
-          OpenProcess: { args: [FFIType.u32, FFIType.i32, FFIType.u32], returns: FFIType.ptr },
-          CloseHandle: { args: [FFIType.ptr], returns: FFIType.i32 },
-          CreateToolhelp32Snapshot: { args: [FFIType.u32, FFIType.u32], returns: FFIType.ptr },
-          Process32FirstW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-          Process32NextW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-        });
-      } catch { library = null; }
-    }
-  }
-  return library ? (library.symbols as Kernel32) : null;
-}
-
-/** A kernel HANDLE is a small positive value: NULL arrives as null and
- *  INVALID_HANDLE_VALUE (-1) fits this range in no representation. */
-const isHandle = (h: unknown): h is Handle => typeof h === "number" && h > 0 && h <= 0xffff_ffff;
-
-/** Whether the real Job Object path is usable here (status surfaces, tests). */
-export function winJobsAvailable(): boolean { return override ?? kernel32() !== null; }
-
-/** Test seam: `false` forces the fail-safe path (the box-without-kernel32
- *  shape — callers fall back to taskkill-only); `null` restores detection. */
-export function overrideWinJobs(available: boolean | null): void { override = available; }
-
-export interface WinJob {
-  /** Put `pid` and its currently visible descendants in the job. false →
-   *  nothing is a member (caller must fall back); the job is closed. */
-  assign(pid: number): boolean;
-  /** Abort: kill every member now, then close. Idempotent. */
-  terminate(): void;
-  /** Normal settle: clear the close-kill limit, then close — members that
-   *  outlived the command keep running. No-op after terminate(). */
-  release(): void;
-}
-
-/** One job per spawn, armed with KILL_ON_JOB_CLOSE. null = unavailable. */
-export function createWinJob(): WinJob | null {
-  if (override === false) return null;
-  const k = kernel32();
-  if (!k) return null;
-  const job = k.CreateJobObjectW(null, null);
-  if (!isHandle(job)) return null;
-  const limits = new Uint8Array(EXTENDED_LIMIT_SIZE);
-  new DataView(limits.buffer).setUint32(LIMIT_FLAGS_OFFSET, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, true);
-  if (!k.SetInformationJobObject(job, JobObjectExtendedLimitInformation, ptr(limits), EXTENDED_LIMIT_SIZE)) {
-    k.CloseHandle(job);
-    return null;
-  }
-  let handle: Handle | null = job;
-  const close = (): void => { if (handle !== null) { k.CloseHandle(handle); handle = null; } };
-  const assignOne = (pid: number): boolean => {
-    if (handle === null) return false;
-    const p = k.OpenProcess(PROCESS_SET_QUOTA_AND_TERMINATE, 0, pid);
-    if (!isHandle(p)) return false;
-    try { return k.AssignProcessToJobObject(handle, p) !== 0; } finally { k.CloseHandle(p); }
-  };
-  return {
-    assign(pid) {
-      if (!assignOne(pid)) { close(); return false; }
-      // belt-and-braces for the spawn→assign window; already-member or
-      // already-exited descendants simply fail to assign, which is fine
-      for (const d of descendants(k, pid)) assignOne(d);
-      return true;
-    },
-    terminate() {
-      if (handle === null) return;
-      k.TerminateJobObject(handle, 1);
-      close();
-    },
-    release() {
-      if (handle === null) return;
-      k.SetInformationJobObject(handle, JobObjectExtendedLimitInformation, ptr(new Uint8Array(EXTENDED_LIMIT_SIZE)), EXTENDED_LIMIT_SIZE);
-      close();
-    },
-  };
-}
-
-/** Live descendants of `root` by parent-pid chain (one Toolhelp32 snapshot).
- *  pids recycle, so a stale parent link could form a cycle: visited-set walk. */
-function descendants(k: Kernel32, root: number): number[] {
-  const snap = k.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
-  if (!isHandle(snap)) return [];
-  const children = new Map<number, number[]>();
-  try {
-    const entry = new Uint8Array(PE32_SIZE);
-    const view = new DataView(entry.buffer);
-    view.setUint32(0, PE32_SIZE, true); // dwSize must be set before Process32FirstW
-    if (!k.Process32FirstW(snap, ptr(entry))) return [];
-    do {
-      const pid = view.getUint32(PE32_PID, true);
-      const ppid = view.getUint32(PE32_PPID, true);
-      const list = children.get(ppid);
-      if (list) list.push(pid); else children.set(ppid, [pid]);
-    } while (k.Process32NextW(snap, ptr(entry)));
-  } finally {
-    k.CloseHandle(snap);
-  }
-  const seen = new Set<number>([root]);
-  const out: number[] = [];
-  const stack = [root];
-  while (stack.length > 0) {
-    for (const c of children.get(stack.pop()!) ?? []) {
-      if (!seen.has(c)) { seen.add(c); out.push(c); stack.push(c); }
-    }
-  }
-  return out;
-}