rvlib-shipkit 1.4.0 → 1.6.0

package/src/trace/tracer.ts

@@ -0,0 +1,282 @@
+// TRACING A TASK: the interposer built once per machine and version, the env a
+// traced spawn carries, and the traceable copies of the binaries macOS would
+// otherwise run blind.
+//
+// Why a copy works: dyld ignores DYLD_INSERT_LIBRARIES in a binary signed with
+// the hardened runtime or library validation (Microsoft's native tsc, Xcode's
+// git), and SIP drops it for everything under /usr and /bin. An ad hoc signed
+// COPY of the same bytes is neither, so it runs traced. It sits beside the
+// original, because a tool finds its own files next to itself (tsc's lib
+// files), or for git in a prefix of links to the original's dirs. The system
+// shells cannot be copied: they are arm64e, which macOS runs only when Apple
+// signed them, so a script that needs /bin/sh stays untraced and says so.
+//
+// The tracer only AUDITS (core/trace-audit.ts): no verdict depends on a trace.
+// It is on wherever it can run (Apple silicon macOS and a C compiler). A
+// machine opts out with `sk trace-audit --disable`, which the daemon's health
+// pass sees, and one run with SHIPKIT_TRACE=0.
+import { createHash } from 'crypto'
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'fs'
+import { homedir, tmpdir } from 'os'
+import { basename, dirname, join } from 'path'
+import { machineDelete, machineGet, machineSet } from '../core/machine-db.ts'
+
+/** the env var that turns tracing on (1) or off (0) for one run, over the
+ *  machine's setting */
+export const TRACE_ENV = 'SHIPKIT_TRACE'
+
+/** the machine setting `sk trace-audit --disable` writes (false) */
+export const TRACE_SETTING = 'trace.enabled'
+
+let settingMemo: { at: number; on: boolean } | null = null
+/** whether this machine left tracing on, asked at most every few seconds:
+ *  the composer asks it for every repo */
+export function traceEnabledHere(now = Date.now()): boolean {
+    if (settingMemo != null && now - settingMemo.at < 5_000) return settingMemo.on
+    settingMemo = { at: now, on: machineGet<boolean>(TRACE_SETTING) !== false }
+    return settingMemo.on
+}
+
+/** turn tracing back on for this machine (the default), or off */
+export function setTraceEnabled(on: boolean): void {
+    if (on) machineDelete(TRACE_SETTING)
+    else machineSet(TRACE_SETTING, false)
+    settingMemo = null
+}
+
+const SOURCE = join(import.meta.dir, 'interpose.c')
+
+/** where the built interposer and the traceable copies live */
+export const traceCache = (): string => process.env['SHIPKIT_TRACE_CACHE'] ?? join(homedir(), '.cache', 'shipkit', 'trace')
+
+/** why this machine cannot trace, null when it can. Cheap: no build */
+export function traceUnavailable(env: Record<string, string | undefined> = process.env): string | null {
+    const on = env[TRACE_ENV] === '1' || (env[TRACE_ENV] !== '0' && traceEnabledHere())
+    if (!on) return env[TRACE_ENV] === '0' ? 'tracing is off for this run (SHIPKIT_TRACE=0)' : 'tracing is off on this machine: sk trace-audit --enable turns it back on'
+    if (process.platform !== 'darwin' || process.arch !== 'arm64') return 'tracing runs on Apple silicon macOS only'
+    if (compiler() == null) return 'no C compiler to build the tracer (xcode-select --install)'
+    return null
+}
+
+const compiler = (): string | null => (existsSync('/usr/bin/clang') ? '/usr/bin/clang' : Bun.which('clang'))
+
+let built: { path: string } | { reason: string } | null = null
+
+/** the interposer for this source, built on first use. A build that fails is
+ *  a reason, never a throw: the task then runs untraced and is not kept */
+export function tracerLib(env: Record<string, string | undefined> = process.env): { path: string } | { reason: string } {
+    // the switch is asked every time: only the build is remembered
+    const off = traceUnavailable(env)
+    if (off != null) return { reason: off }
+    if (built != null) return built
+    let src: Buffer
+    try { src = readFileSync(SOURCE) } catch (e) { return (built = { reason: `the tracer source is missing: ${(e as Error).message}` }) }
+    const id = createHash('sha256').update(src).digest('hex').slice(0, 16)
+    const out = join(traceCache(), `interpose-${id}.dylib`)
+    if (existsSync(out)) return (built = { path: out })
+    mkdirSync(traceCache(), { recursive: true })
+    // built beside its final name and renamed in, so a parallel gate never
+    // loads a half-written library
+    const tmp = `${out}.${process.pid}.tmp`
+    const r = Bun.spawnSync([compiler()!, '-dynamiclib', '-O2', '-arch', 'arm64', '-arch', 'arm64e', '-Wno-deprecated-declarations', '-o', tmp, SOURCE], { stdout: 'pipe', stderr: 'pipe' })
+    if (r.exitCode !== 0) {
+        rmSync(tmp, { force: true })
+        return (built = { reason: `the tracer did not build: ${r.stderr.toString().trim().split('\n')[0] ?? `exit ${r.exitCode}`}` })
+    }
+    renameSync(tmp, out)
+    return (built = { path: out })
+}
+
+/** the remap file the interposer reads: original path, copy, and the size and
+ *  mtime the copy was made from, so a replaced original is never swapped */
+const remapFile = (): string => join(traceCache(), 'remap.tsv')
+
+type Remap = { from: string; to: string; size: number; mtime: number; env: string }
+
+function readRemaps(): Remap[] {
+    try {
+        return readFileSync(remapFile(), 'utf8').split('\n').filter((l) => l !== '' && !l.startsWith('#')).map((l) => {
+            const [from, to, size, mtime, env] = l.split('\t')
+            return { from: from!, to: to!, size: Number(size), mtime: Number(mtime), env: env ?? '' }
+        })
+    } catch {
+        return []
+    }
+}
+
+function writeRemaps(rows: Remap[]): void {
+    mkdirSync(traceCache(), { recursive: true })
+    const tmp = `${remapFile()}.${process.pid}.tmp`
+    writeFileSync(tmp, rows.map((r) => [r.from, r.to, r.size, r.mtime, r.env].join('\t')).join('\n') + '\n')
+    renameSync(tmp, remapFile())
+}
+
+const fresh = (r: Remap): boolean => {
+    try {
+        const s = statSync(r.from)
+        return s.size === r.size && Math.floor(s.mtimeMs / 1000) === r.mtime && existsSync(r.to)
+    } catch {
+        return false
+    }
+}
+
+function upsert(rows: Remap[], from: string, to: string, env = ''): Remap[] {
+    const s = statSync(from)
+    return [...rows.filter((r) => r.from !== from), { from, to, size: s.size, mtime: Math.floor(s.mtimeMs / 1000), env }]
+}
+
+/** an ad hoc signed copy of `bin` at `to`: the same bytes, no hardened runtime */
+function signedCopy(bin: string, to: string): string | null {
+    mkdirSync(dirname(to), { recursive: true })
+    const tmp = `${to}.${process.pid}.tmp`
+    try {
+        copyFileSync(bin, tmp)
+        chmodSync(tmp, 0o755)
+        const r = Bun.spawnSync(['/usr/bin/codesign', '-f', '-s', '-', tmp], { stdout: 'pipe', stderr: 'pipe' })
+        if (r.exitCode !== 0) { rmSync(tmp, { force: true }); return `codesign refused it: ${r.stderr.toString().trim().split('\n').at(-1)}` }
+        renameSync(tmp, to)
+        return null
+    } catch (e) {
+        rmSync(tmp, { force: true })
+        return (e as Error).message
+    }
+}
+
+/** /usr/bin/git is a shim into Xcode's git, and both are blind. The copy
+ *  lives in a prefix whose other dirs link to Xcode's, so it finds its
+ *  exec-path, templates and system config exactly where the original does */
+function gitRemap(rows: Remap[]): Remap[] {
+    if (!existsSync('/usr/bin/git')) return rows
+    const found = Bun.spawnSync(['/usr/bin/xcrun', '-f', 'git'], { stdout: 'pipe', stderr: 'pipe' })
+    const dev = found.exitCode === 0 ? found.stdout.toString().trim() : ''
+    if (dev === '' || !existsSync(dev)) return rows
+    const s = statSync(dev)
+    const prefix = join(traceCache(), `git-${createHash('sha256').update(`${dev}\0${s.size}\0${s.mtimeMs}`).digest('hex').slice(0, 12)}`)
+    const copy = join(prefix, 'usr', 'bin', 'git')
+    if (!existsSync(copy)) {
+        const devUsr = dirname(dirname(dev))
+        mkdirSync(join(prefix, 'usr'), { recursive: true })
+        for (const d of readdirSync(devUsr)) if (d !== 'bin' && !existsSync(join(prefix, 'usr', d))) symlinkSync(join(devUsr, d), join(prefix, 'usr', d))
+        if (signedCopy(dev, copy) != null) return rows
+    }
+    return upsert(upsert(rows, '/usr/bin/git', copy), dev, copy)
+}
+
+/** the remap file for this run, with every entry still describing its
+ *  original. Rebuilt when one went stale (a `bun install` replaced a copy) */
+export function remaps(): string {
+    let rows = readRemaps()
+    const git = rows.find((r) => r.from === '/usr/bin/git')
+    if (git == null || !fresh(git)) rows = gitRemap(rows)
+    const kept = rows.filter(fresh)
+    if (kept.length !== rows.length || !existsSync(remapFile())) writeRemaps(kept)
+    return remapFile()
+}
+
+/** SIP paths, where no copy runs traced */
+const PROTECTED = /^\/(usr\/(bin|sbin|libexec|lib)|bin|sbin|System)\//
+
+/** a binary that ran blind, made traceable for the next run when it can be:
+ *  a hardened binary a repo installed. Returns what happened, in words, for
+ *  the line that says the answer was not kept */
+export function learnBlind(paths: string[]): string | null {
+    const said: string[] = []
+    let rows = readRemaps()
+    for (const p of paths) {
+        if (PROTECTED.test(p)) { said.push(`macOS lets no tool trace ${p}`); continue }
+        let head: Buffer
+        try { head = readFileSync(p).subarray(0, 256) } catch { continue }
+        if (head.subarray(0, 2).toString() === '#!') {
+            const interp = head.toString().slice(2).split('\n')[0]!.trim().split(/\s+/)[0] ?? ''
+            said.push(`${basename(p)} runs through ${interp}${PROTECTED.test(interp) ? ', which macOS lets no tool trace' : ''}`)
+            continue
+        }
+        const magic = head.readUInt32BE(0)
+        if (![0xcffaedfe, 0xcafebabe, 0xfeedfacf].includes(magic)) continue
+        // a copy goes beside the original, so only into an install the repo
+        // owns, and only for a binary whose signature is what blinds it
+        const sign = Bun.spawnSync(['/usr/bin/codesign', '-dv', p], { stdout: 'pipe', stderr: 'pipe' }).stderr.toString()
+        if (!p.includes('/node_modules/') || !/flags=0x[0-9a-f]+\((?:[^)]*)(runtime|library-validation)/.test(sign)) { said.push(`${p} runs untraced and cannot be made traceable`); continue }
+        const copy = join(dirname(p), `.${basename(p)}.shipkit-traced`)
+        const failed = signedCopy(p, copy)
+        if (failed != null) { said.push(`${p} cannot be copied: ${failed}`); continue }
+        rows = upsert(rows, p, copy)
+        said.push(`a traceable copy of ${basename(p)} is ready for the next run`)
+    }
+    writeRemaps(rows)
+    return said.length === 0 ? null : said.join('; ')
+}
+
+/** a plain script: commands, arguments, quotes, `&&`, `||`, `;` and `|`.
+ *  Bun's shell runs exactly that the way sh does, in process, so a traced
+ *  task keeps its trace; anything else is left to the system shell */
+export function plainScript(body: string): boolean {
+    if (!/^[\w\s@%+=:,./'"&|;-]*$/.test(body)) return false
+    // an unclosed quote runs the rest of the line into one word
+    if ((body.match(/'/g) ?? []).length % 2 === 1 || (body.match(/"/g) ?? []).length % 2 === 1) return false
+    const words = body.split(/[\s&|;]+/).filter((w) => w !== '')
+    const shellOnly = new Set(['export', 'set', 'source', '.', 'eval', 'exec', 'trap', 'if', 'then', 'else', 'fi', 'for', 'do', 'done', 'while', 'case', 'esac', 'function', 'unset', 'shift', 'read'])
+    return !words.some((w) => shellOnly.has(w))
+}
+
+/** what a traced task actually runs, where its trace goes, and the env that
+ *  traces it, or why it cannot be traced. `bun run <script>` runs a plain
+ *  script through bun's shell, the only one macOS lets a trace into */
+export function tracedCommand(cmd: string[], cwd: string, env: Record<string, string | undefined> = process.env): { cmd: string[]; dir: string; env: Record<string, string>; note: string | null } | { reason: string } {
+    const lib = tracerLib(env)
+    if ('reason' in lib) return lib
+    // the copies first: the root command may be one of the binaries they stand for
+    const remap = remaps()
+    let run = rootCommand(cmd)
+    let note: string | null = null
+    if (cmd.length === 3 && basename(cmd[0]!) === 'bun' && cmd[1] === 'run') {
+        let body: string | null = null
+        try { body = (JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf8')) as { scripts?: Record<string, string> }).scripts?.[cmd[2]!] ?? null } catch { body = null }
+        if (body != null && plainScript(body)) run = [cmd[0]!, 'run', '--shell=bun', cmd[2]!]
+        else if (body != null) note = `its script \`${cmd[2]}\` uses shell syntax only /bin/sh runs`
+    }
+    return { cmd: run, ...traceSpawn(lib.path, remap), note }
+}
+
+/** the task's own command, spawned the way the interposer spawns a child:
+ *  the gate itself runs untraced, so nobody else rewrites a
+ *  `#!/usr/bin/env node` launcher (a floor slot's `node_modules/.bin/tsc`)
+ *  or swaps a hardened binary for its traceable copy */
+export function rootCommand(cmd: string[]): string[] {
+    if (cmd.length === 0) return cmd
+    const first = cmd[0]!
+    const path = first.includes('/') ? first : Bun.which(first) ?? first
+    let head = ''
+    try { head = readFileSync(path).subarray(0, 512).toString() } catch { return cmd }
+    if (head.startsWith('#!')) {
+        const [interp, prog, ...rest] = head.slice(2).split('\n')[0]!.trim().split(/\s+/)
+        if (interp === '/usr/bin/env' && prog != null && !prog.startsWith('-') && rest.length === 0) {
+            const resolved = Bun.which(prog)
+            if (resolved != null) return [resolved, path, ...cmd.slice(1)]
+        }
+        return cmd
+    }
+    const copy = readRemaps().find((r) => r.from === path && fresh(r))
+    return copy == null ? cmd : [copy.to, ...cmd.slice(1)]
+}
+
+/** a fresh dir for one traced spawn, and the env that traces it. A gate
+ *  running inside a traced task keeps the outer dir, so both see the run */
+export function traceSpawn(lib: string, remap: string = remaps()): { dir: string; env: Record<string, string> } {
+    const dir = mkdtempSync(join(tmpdir(), 'shipkit-trace-'))
+    const outer = process.env['SHIPKIT_TRACE_DIR']
+    const inserted = process.env['DYLD_INSERT_LIBRARIES']
+    return {
+        dir,
+        env: {
+            SHIPKIT_TRACE_DIR: outer == null || outer === '' ? dir : `${outer}:${dir}`,
+            DYLD_INSERT_LIBRARIES: inserted == null || inserted === '' ? lib : inserted.split(':').includes(lib) ? inserted : `${lib}:${inserted}`,
+            SHIPKIT_TRACE_REMAP: remap,
+        },
+    }
+}
+
+/** a trace dir goes once it is read */
+export function dropTrace(dir: string): void {
+    try { if (lstatSync(dir).isDirectory()) rmSync(dir, { recursive: true, force: true }) } catch { /* gone either way */ }
+}

package/src/serve/hub-app/processes-svc.ts

@@ -1,63 +0,0 @@
-// the repo's declared processes (serve.processes) as the hub supervises them,
-// polled while its repo is the one shown. A repo that declares none never
-// polls again after the first answer.
-import { makeAutoObservable, observableRef, runInAction } from 'mobx'
-import type { ProcessView } from '../repo-processes.ts'
-import type { RepoSt } from './repo-st.ts'
-
-export const PROCESSES_POLL_MS = 2_000
-
-export class ProcessesSvc {
-    list: ProcessView[] = []
-    error = ''
-    private timer: ReturnType<typeof setTimeout> | null = null
-    /** bumped by stop, so a chain that left before it dies at its next await */
-    private gen = 0
-    private polling = false
-
-    constructor(private st: RepoSt) {
-        makeAutoObservable<this, 'st' | 'timer' | 'gen' | 'polling'>(this, { st: false, timer: false, gen: false, polling: false, list: observableRef })
-    }
-
-    start(): void {
-        if (this.polling) return
-        this.polling = true
-        const gen = ++this.gen
-        const tick = async (): Promise<void> => {
-            await this.load()
-            if (gen === this.gen && this.list.length > 0) this.timer = setTimeout(() => void tick(), PROCESSES_POLL_MS)
-        }
-        void tick()
-    }
-
-    stop(): void {
-        this.polling = false
-        this.gen++
-        if (this.timer != null) clearTimeout(this.timer)
-        this.timer = null
-    }
-
-    async load(): Promise<void> {
-        try {
-            const r = await fetch(this.st.url('/api/processes.json'))
-            if (!r.ok) throw new Error(`${r.status} ${await r.text()}`)
-            const j = (await r.json()) as { processes: ProcessView[] }
-            runInAction(() => {
-                this.list = j.processes
-                this.error = ''
-            })
-        } catch (e) {
-            runInAction(() => { this.error = `processes: ${(e as Error).message}` })
-        }
-    }
-
-    async act(id: string, act: 'start' | 'stop' | 'restart'): Promise<void> {
-        try {
-            const r = await fetch(this.st.url('/api/processes/act'), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id, act }) })
-            if (!r.ok) throw new Error(await r.text())
-            await this.load()
-        } catch (e) {
-            runInAction(() => { this.error = `${act} ${id}: ${(e as Error).message}` })
-        }
-    }
-}

package/src/serve/hub-app/repo-sections.tsx

@@ -1,61 +0,0 @@
-// A repo page's sections: the pages reached for most, one line each at the top
-// of the left pane, over the tree, drawn the way the project list draws its
-// lines (an icon, a label, a count where it says something, its ⌥ shortcut at
-// the end, keys.ts), the current one lit. A page this repo does not have is
-// not a line. The lines come from what the page already holds (the kept
-// screen on a reload), so none arrives late and moves the tree.
-import { observer } from 'mobx-react-lite'
-import { RUNS_ID } from '../../collections/collection-types.ts'
-import { Icon, ICON } from './icons.tsx'
-import { sectionKeyLabel, type SectionId } from './keys.ts'
-import type { RepoSt } from './repo-st.ts'
-import { openWikis, WIKIS } from './wikis-view.tsx'
-
-export type RepoSection = {
-    id: SectionId
-    label: string
-    title: string
-    /** null when a number would say nothing */
-    count: number | null
-    tone: 'red' | 'warn' | null
-    on: boolean
-    go: () => void
-}
-
-const counted = (n: number, tone: 'red' | 'warn'): Pick<RepoSection, 'count' | 'tone'> => (n === 0 ? { count: null, tone: null } : { count: n, tone })
-
-export function repoSections(app: RepoSt): RepoSection[] {
-    const has = (col: string): boolean => app.cols.colMeta.some((c) => c.id === col)
-    const sel = app.sel
-    const onCol = (col: string): boolean => (sel?.t === 'col' && sel.id === col) || (sel?.t === 'item' && sel.col === col)
-    const res = app.cols.resources
-    const reds = (col: string): number => res.filter((r) => r.collection === col && r.state === 'red').length
-    const none = { count: null, tone: null }
-    const out: RepoSection[] = []
-    if (has('checks')) out.push({ id: 'checks', label: 'checks', title: 'every check the gate and the health pass run, one page each', ...counted(reds('checks'), 'red'), on: onCol('checks'), go: () => app.showCol('checks') })
-    // a page, never a resource: every hub keeps a run record
-    out.push({ id: 'runs', label: 'runs', title: 'every run on record, the slowest checks and the longest runs', ...none, on: onCol('runs'), go: () => app.cols.select('runs', RUNS_ID) })
-    if (has('asks')) {
-        const open = res.filter((r) => r.collection === 'asks' && r.type === 'ask' && r.slot !== 'done').length
-        out.push({ id: 'asks', label: 'asks', title: 'what waits on a human', ...counted(open, 'warn'), on: onCol('asks'), go: () => app.showCol('asks') })
-    }
-    if (has('tests')) out.push({ id: 'tests', label: 'tests', title: 'every test file, slowest first, then each test check', ...counted(reds('tests'), 'red'), on: sel?.t === 'tests' || onCol('tests'), go: () => app.showTests(null) })
-    const firstCat = app.media.assets[0]?.cat ?? app.cols.cachedCat ?? undefined
-    if (firstCat != null) out.push({ id: 'media', label: 'media', title: 'the assets, in the atelier', ...none, on: sel?.t === 'asset' || sel?.t === 'cat', go: () => app.showCat(firstCat) })
-    if (has(WIKIS)) out.push({ id: 'wikis', label: 'wikis', title: 'every wiki this repo mounts, as a link graph', ...none, on: onCol(WIKIS), go: () => openWikis(app) })
-    if (app.home.machine != null) out.push({ id: 'admin', label: 'admin', title: 'reload the hub, keep the repo active, archive it', ...none, on: sel?.t === 'admin', go: () => app.showAdmin() })
-    return out
-}
-
-export const Sections = observer(({ app }: { app: RepoSt }) => (
-    <nav className="rsecs" aria-label="sections">
-        {repoSections(app).map((s) => (
-            <button key={s.id} className={`rsec${s.on ? ' cur' : ''}`} aria-current={s.on ? 'page' : undefined} title={`${s.title} (${sectionKeyLabel(s.id)})`} onClick={s.go}>
-                <Icon d={ICON[s.id]} />
-                <span className="rsecl">{s.label}</span>
-                {s.count == null ? null : <b className={`rsecn n${s.tone}`}>{s.count}</b>}
-                <kbd className="pjkey">{sectionKeyLabel(s.id)}</kbd>
-            </button>
-        ))}
-    </nav>
-))

package/src/serve/repo-processes.ts

@@ -1,89 +0,0 @@
-// the long running processes a repo declares in `serve.processes` (a dev
-// server, a watcher), supervised by its hub with the same supervisor the home
-// uses for resources. Each runs detached with a pid record in the machine db
-// (named by its path under .shipkit/tmp, where an older copy kept a pid file),
-// so a hub restart in place adopts it, and only a real stop of the hub stops it.
-import { join, resolve } from 'path'
-import { Proc, realDeps, tailLines, type ProcView, type SuperviseDeps } from '../home/supervise.ts'
-import type { ProcessDecl } from '../repo-config.ts'
-import { LAYOUT } from '../core/layout.ts'
-
-export type ProcessView = ProcView & { url: string | null; auto: boolean; cmd: string; tail: string[] }
-
-export const processDir = (root: string): string => join(root, LAYOUT.tmp, 'processes')
-
-const probeUrl = async (url: string): Promise<boolean> => {
-    try {
-        // any answer means it serves: a dev server may 404 its root
-        await fetch(url, { signal: AbortSignal.timeout(1_500) })
-        return true
-    } catch {
-        return false
-    }
-}
-
-export class RepoProcesses {
-    private procs: { decl: ProcessDecl; proc: Proc }[]
-
-    constructor(root: string, decls: ProcessDecl[], o: { deps?: SuperviseDeps; probe?: (url: string) => Promise<boolean> } = {}) {
-        const dir = processDir(root)
-        this.procs = decls.map((decl) => ({
-            decl,
-            proc: new Proc({
-                id: decl.id,
-                cmd: decl.cmd,
-                cwd: resolve(root, decl.cwd ?? '.'),
-                log: join(dir, `${decl.id}.log`),
-                pidKey: join(dir, `${decl.id}.pid`),
-                probe: decl.url == null ? undefined : () => (o.probe ?? probeUrl)(decl.url!),
-            }, o.deps ?? realDeps),
-        }))
-    }
-
-    /** the auto ones start with the hub; an adopted one is left as it runs */
-    async startAuto(): Promise<void> {
-        await Promise.all(this.procs.filter((p) => p.decl.auto === true && p.proc.pid == null).map((p) => p.proc.ensure()))
-    }
-
-    act(id: string, act: 'start' | 'stop' | 'restart'): ProcessView | null {
-        const p = this.procs.find((x) => x.decl.id === id)
-        if (p == null) return null
-        if (act === 'stop' || act === 'restart') p.proc.stop()
-        if (act === 'start') void p.proc.ensure()
-        if (act === 'restart') this.restartWhenGone(p.proc)
-        return this.view(p)
-    }
-
-    private restartWhenGone(proc: Proc): void {
-        const wait = async (): Promise<void> => {
-            for (let i = 0; i < 40 && proc.status === 'stopping'; i++) {
-                await Bun.sleep(250)
-                await proc.tick()
-            }
-            proc.start()
-        }
-        void wait()
-    }
-
-    async tick(): Promise<void> {
-        await Promise.all(this.procs.map((p) => p.proc.tick()))
-    }
-
-    /** a real stop of the hub: every process it started stops with it */
-    stopAll(): void {
-        for (const p of this.procs) if (p.proc.pid != null) p.proc.stop()
-    }
-
-    private view(p: { decl: ProcessDecl; proc: Proc }): ProcessView {
-        const v = p.proc.view()
-        return { ...v, url: p.decl.url ?? null, auto: p.decl.auto === true, cmd: p.decl.cmd.join(' '), tail: v.status === 'up' ? [] : tailLines(p.proc.spec.log, 20) }
-    }
-
-    views(): ProcessView[] {
-        return this.procs.map((p) => this.view(p))
-    }
-
-    get size(): number {
-        return this.procs.length
-    }
-}