skydive-cli 0.5.0 → 0.6.0-beta.100

package/dist/js/{daemon-Do1jU2UF.mjs → daemon-B8c3Z1Te.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { i as isRecord, n as isNewerBuild, r as portalDaemonBuild, t as PortalClient } from "./client--k9cjfkX.mjs";
+import { a as portalDaemonBuild, i as isNewerBuild, n as PortalClient, o as isRecord } from "./client-HdxGBXPK.mjs";
 import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import os from "node:os";
 import path from "node:path";
+import { access, appendFile, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
-import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 
 //#region ../portal-daemon/src/local-protocol.ts
 /**
@@ -66,6 +66,18 @@ function canonicalPortalAppUrl(appUrl) {
 	if (host === "skydive.com" || host === "www.skydive.com" || host === "api.skydive.com") return "https://api.skydive.com";
 	return trimmed;
 }
+/** Prefix every Windows named pipe lives under (the pipe filesystem root). */
+const WINDOWS_PIPE_PREFIX = "\\\\.\\pipe\\";
+/**
+* Whether a daemon control-socket path is a Windows named pipe rather than a
+* Unix-domain-socket FILE. Pipes have no on-disk file: they cannot be
+* `stat`ed, `unlink`ed, or purged by a tmp cleaner, and the OS frees the name
+* the moment the owning server closes — so every file-based lifecycle step
+* (stale-file cleanup, the socket-ownership watch) must be skipped for them.
+*/
+function isNamedPipePath(socketPath) {
+	return socketPath.startsWith(WINDOWS_PIPE_PREFIX);
+}
 /**
 * Per-user, per-app daemon socket + state paths. Scoped by OS user and a hash
 * of the CANONICAL appUrl so two logins or two deployments (prod vs a PR
@@ -73,17 +85,42 @@ function canonicalPortalAppUrl(appUrl) {
 * every alias of one deployment (see {@link canonicalPortalAppUrl}) shares
 * one. Kept under the OS temp dir because Unix socket paths are
 * length-limited (~104 bytes on macOS).
+*
+* On Windows a `node:net` server cannot listen on a filesystem path at all —
+* binding the tmp-dir path fails with EACCES and the daemon dies silently
+* (ANY-7285's Windows facet) — so the socket is a named pipe under
+* `\\.\pipe\`, keyed by the same (user, appUrl-hash) pair. State and log
+* files stay under the temp dir on every platform.
+*
+* Darwin `sockaddr_un.sun_path` is 104 bytes including NUL (103 usable).
+* `os.tmpdir()` on macOS is `$TMPDIR` (`/var/folders/<id>/T`, often ~50
+* chars). Adding `skydive-portal-<user>-<hash>/daemon.sock` overruns that
+* cap: bind() fails, the sidecar handshake still reports the long path, and
+* connect() returns ENOENT (or Go's "path must be shorter than SUN_LEN").
+* Stay in `os.tmpdir()` (do not relocate to `/tmp`) and shorten the leaf
+* when the composed path would blow the cap. Windows named pipes have no
+* sun_path, so they keep the long leaf.
 */
-function daemonPaths(appUrl) {
-	const user = safeSegment(os.userInfo().username || "user");
-	const app = createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12);
-	const dir = path.join(os.tmpdir(), `skydive-portal-${user}-${app}`);
-	return {
+const SUN_PATH_MAX = 103;
+function daemonPaths(appUrl, platform = process.platform) {
+	const parent = os.tmpdir();
+	const key = `skydive-portal-${safeSegment(os.userInfo().username || "user")}-${createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12)}`;
+	const dir = path.join(parent, key);
+	const paths = {
 		dir,
-		socketPath: path.join(dir, "daemon.sock"),
+		socketPath: platform === "win32" ? `${WINDOWS_PIPE_PREFIX}${key}` : path.join(dir, "daemon.sock"),
 		statePath: path.join(dir, "state.json"),
 		logPath: path.join(dir, "daemon.log")
 	};
+	if (platform === "win32" || Buffer.byteLength(paths.socketPath) <= SUN_PATH_MAX) return paths;
+	const short = createHash("sha256").update(`${os.userInfo().username || "user"}\0${canonicalPortalAppUrl(appUrl)}`).digest("hex").slice(0, 12);
+	const shortDir = path.join(parent, `skydive-p-${short}`);
+	return {
+		dir: shortDir,
+		socketPath: path.join(shortDir, "d.sock"),
+		statePath: path.join(shortDir, "state.json"),
+		logPath: path.join(shortDir, "daemon.log")
+	};
 }
 function safeSegment(value) {
 	return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 24) || "user";
@@ -336,6 +373,24 @@ function parseDaemonMessage(line) {
 /** Grace period after the last client detaches before the daemon exits. */
 const IDLE_SHUTDOWN_MS = 3e4;
 /**
+* Cadence of the socket-ownership watch (see checkSocketOwnership). The
+* singleton is enforced ONLY through the socket path, so this bounds how long
+* a daemon can keep dialing after losing the path — the window in which a
+* spawner can create a duplicate dialer. The server-side connect flap guard
+* caps the damage inside that window.
+*/
+const SOCKET_WATCH_TICK_MS = 3e4;
+/**
+* Grace window after a server stand-down: the check fires the instant the
+* close lands, but the WINNER's socket bind may still be in flight — a check
+* run at t=0 can see our own still-good socket, conclude we are the owner, and
+* redial into the supersede war the stand-down exists to end. On a
+* stand-down-triggered check, wait this out once and re-stat before
+* concluding ownership. The periodic watch tick runs grace-free (nothing just
+* displaced us there).
+*/
+const STAND_DOWN_GRACE_MS = 1500;
+/**
 * Upper bound an incumbent daemon waits, during a graceful handoff, for the
 * successor to dial out and claim presence before giving up and releasing the
 * slot itself. Comfortably above a normal successor boot + WS dial (a few
@@ -358,17 +413,26 @@ var PortalDaemon = class {
 	handingOff = false;
 	sessionToken = null;
 	deviceToken = null;
-	constructor(appUrl) {
+	socketWatch = null;
+	socketId = null;
+	socketCheckRunning = false;
+	socketWatchTickMs;
+	standDownGraceMs;
+	exit;
+	constructor(appUrl, options) {
 		this.appUrl = canonicalPortalAppUrl(appUrl);
 		this.paths = daemonPaths(this.appUrl);
 		this.fallbackCwd = process.env.HOME ?? process.cwd();
+		this.socketWatchTickMs = options?.socketWatchTickMs ?? SOCKET_WATCH_TICK_MS;
+		this.standDownGraceMs = options?.standDownGraceMs ?? STAND_DOWN_GRACE_MS;
+		this.exit = options?.exit ?? (() => process.exit(0));
 	}
 	/** Start listening. Rejects if the socket is already held by another daemon. */
 	async listen() {
 		await mkdir(this.paths.dir, { recursive: true });
 		await this.loadState();
 		await this.clearStaleSocket();
-		return new Promise((resolve, reject) => {
+		await new Promise((resolve, reject) => {
 			const server = createServer((socket) => this.onClientConnect(socket));
 			server.on("error", reject);
 			server.listen(this.paths.socketPath, () => {
@@ -377,8 +441,128 @@ var PortalDaemon = class {
 				resolve();
 			});
 		});
+		if (!isNamedPipePath(this.paths.socketPath)) {
+			await this.recordSocketIdentity();
+			this.startSocketWatch();
+		}
+	}
+	/**
+	* Remember which socket FILE we bound (dev+ino), so the watch can tell "our
+	* file is still there" from "someone re-created the path" — the path alone
+	* can't: a duplicate daemon's fresh socket lives at the identical path.
+	*/
+	async recordSocketIdentity() {
+		const s = await stat(this.paths.socketPath);
+		this.socketId = {
+			dev: s.dev,
+			ino: s.ino
+		};
+	}
+	/**
+	* The singleton is enforced ONLY through the socket path — status, stop, and
+	* newest-build takeover all reach a daemon by connecting to it. If the file
+	* vanishes under us (the OS tmp cleaner purges /var/folders temp items that
+	* haven't been touched in days; the daemon holds the bound fd and never
+	* notices), this daemon keeps its portal connection and its attached clients
+	* but becomes unreachable and unmanageable: every new `skydive` spawn finds
+	* no socket and starts a DUPLICATE daemon, and the two fight a supersede war
+	* over the machine's presence slot (the 2026-08-25 flap loop). So the daemon
+	* re-verifies its claim on a timer: re-bind if the path is free, stand down
+	* if another daemon beat us to it.
+	*/
+	startSocketWatch() {
+		this.socketWatch = setInterval(() => {
+			this.runOwnershipCheck();
+		}, this.socketWatchTickMs);
+		this.socketWatch.unref();
+	}
+	/** One socket-ownership pass, shared by the watch timer (grace-free) and the
+	* client's 'stand-down' state (with grace — see STAND_DOWN_GRACE_MS).
+	*/
+	runOwnershipCheck(graceMs = 0) {
+		if (this.socketCheckRunning) return;
+		this.socketCheckRunning = true;
+		this.checkSocketOwnership(graceMs).catch((error) => this.logError("socket ownership check failed", error)).finally(() => {
+			this.socketCheckRunning = false;
+		});
+	}
+	stopSocketWatch() {
+		if (this.socketWatch) {
+			clearInterval(this.socketWatch);
+			this.socketWatch = null;
+		}
+	}
+	async checkSocketOwnership(graceMs = 0) {
+		if (!this.server || this.handingOff) return;
+		const current = await stat(this.paths.socketPath).catch(() => null);
+		if (current && this.socketId && current.dev === this.socketId.dev && current.ino === this.socketId.ino) {
+			if (graceMs > 0) {
+				await new Promise((r) => setTimeout(r, graceMs));
+				const recheck = await stat(this.paths.socketPath).catch(() => null);
+				const socketId = this.socketId;
+				if (recheck && socketId && !(recheck.dev === socketId.dev && recheck.ino === socketId.ino)) {
+					this.logInfo("control socket taken over during stand-down grace; standing down");
+					this.standDown();
+					return;
+				}
+			}
+			return;
+		}
+		if (current) {
+			this.logInfo("control socket path is owned by another daemon; standing down");
+			this.standDown();
+			return;
+		}
+		try {
+			await this.rebindSocket();
+			this.logInfo("control socket file vanished (tmp cleaner?); re-bound");
+		} catch (error) {
+			this.logError("control socket re-bind failed; standing down", error);
+			this.standDown();
+		}
+	}
+	/**
+	* Re-create the socket file at our path. The old server object keeps serving
+	* its ESTABLISHED connections (close() only stops accepting), so attached
+	* clients ride through the swap; only the listener moves to the new file.
+	*/
+	async rebindSocket() {
+		const old = this.server;
+		this.server = null;
+		old?.close();
+		await mkdir(this.paths.dir, { recursive: true });
+		await new Promise((resolve, reject) => {
+			const server = createServer((socket) => this.onClientConnect(socket));
+			server.on("error", reject);
+			server.listen(this.paths.socketPath, () => {
+				this.server = server;
+				resolve();
+			});
+		});
+		await this.recordSocketIdentity();
+	}
+	/**
+	* This daemon lost the singleton claim: tear everything down and exit.
+	* Attached clients see their control socket close and re-attach through the
+	* path — reaching whichever daemon owns it now (or spawning a fresh one) —
+	* so the machine converges on a single dialer instead of a supersede war.
+	*/
+	standDown() {
+		this.stopSocketWatch();
+		for (const conn of this.conns) try {
+			conn.socket.destroy();
+		} catch (_error) {}
+		this.conns.clear();
+		this.client?.dispose();
+		this.server?.close();
+		this.server = null;
+		this.exit();
 	}
 	async clearStaleSocket() {
+		if (isNamedPipePath(this.paths.socketPath)) {
+			if (await isDaemonListening(this.paths.socketPath)) throw new Error("daemon already running");
+			return;
+		}
 		if (!await pathExists(this.paths.socketPath)) return;
 		if (await new Promise((resolve) => {
 			const probe = connect(this.paths.socketPath);
@@ -494,13 +678,23 @@ var PortalDaemon = class {
 			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
 			persistedMachineName: this.persistedMachineName,
 			onMachineName: (name, source) => this.onMachineName(name, source),
-			onState: (state) => {
-				this.lastState = state;
-				this.broadcastState();
-			}
+			onState: (state) => this.handleClientState(state)
 		});
 	}
 	/**
+	* Client state transition. A server stand-down ('stand-down' status — the
+	* superseded/flap-cooldown close, distinguishable from an ordinary close
+	* through the status) runs the ownership check NOW with grace, so a
+	* duplicate that already lost the control socket yields within one server
+	* round trip instead of waiting for the next watch tick and fighting
+	* (supersede war).
+	*/
+	handleClientState(state) {
+		if (state.status === "stand-down") this.runOwnershipCheck(this.standDownGraceMs);
+		this.lastState = state;
+		this.broadcastState();
+	}
+	/**
 	* The identity resolved on connect. Persist the name so a later scutil
 	* failure reuses it instead of adopting the volatile hostname, and log the
 	* source — a `hostname-fallback` after we'd previously registered under
@@ -560,15 +754,17 @@ var PortalDaemon = class {
 	/** Close the listener without exiting the process (tests own the process). */
 	stopForTest() {
 		this.clearIdleTimer();
+		this.stopSocketWatch();
 		this.client?.dispose();
 		this.server?.close();
 		this.server = null;
 	}
 	shutdown() {
 		if (this.conns.size > 0) return;
+		this.stopSocketWatch();
 		this.client?.dispose();
 		this.server?.close();
-		process.exit(0);
+		this.exit();
 	}
 	/** Snapshot for a `status` control request. */
 	statusResult() {
@@ -580,7 +776,7 @@ var PortalDaemon = class {
 			appUrl: this.appUrl,
 			build: portalDaemonBuild(),
 			portal: {
-				status: portal?.status ?? "off",
+				status: portal?.status === "stand-down" ? "connecting" : portal?.status ?? "off",
 				machineName: portal?.machineName ?? "",
 				friendlyName: portal?.friendlyName ?? "",
 				error: portal?.error ?? null,
@@ -597,13 +793,7 @@ var PortalDaemon = class {
 	* their live exec/tunnel relays), drops the portal connection, and exits.
 	*/
 	forceShutdown() {
-		for (const conn of this.conns) try {
-			conn.socket.destroy();
-		} catch (_error) {}
-		this.conns.clear();
-		this.client?.dispose();
-		this.server?.close();
-		process.exit(0);
+		this.standDown();
 	}
 	/**
 	* Graceful takeover step-down (a newer daemon is replacing us). Unlike
@@ -624,6 +814,7 @@ var PortalDaemon = class {
 	async gracefulHandoffShutdown() {
 		if (this.handingOff) return;
 		this.handingOff = true;
+		this.stopSocketWatch();
 		for (const conn of this.conns) try {
 			conn.socket.destroy();
 		} catch (_error) {}
@@ -634,7 +825,7 @@ var PortalDaemon = class {
 			await this.client.beginHandoff(HANDOFF_MAX_WAIT_MS);
 			this.client.dispose();
 		}
-		process.exit(0);
+		this.exit();
 	}
 	async loadState() {
 		try {
@@ -678,13 +869,19 @@ var PortalDaemon = class {
 * drains attached clients, who reconnect within ~500ms) and spawn from this
 * binary. Both spawners apply the same rule, so a host converges on the
 * newest installed build with at most one bounce.
+*
+* Returns whether a daemon is actually listening when it's done. A spawned
+* daemon that never binds (its process died on startup — e.g. the Windows
+* EACCES bind failure this used to swallow) resolves `false` so callers can
+* SAY so, instead of silently handing the caller a socket nobody serves and
+* leaving the reconnect loop to spin forever with no visible error.
 */
 async function ensureDaemonRunning(appUrl) {
 	const { socketPath } = daemonPaths(appUrl);
 	if (await isDaemonListening(socketPath)) {
 		const status = await queryDaemonStatus(appUrl);
-		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
-		if (await stopDaemonForHandoff(appUrl) === "failed") return;
+		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return true;
+		if (await stopDaemonForHandoff(appUrl) === "failed") return true;
 	}
 	const entry = process.argv[1];
 	const args = entry ? [
@@ -698,9 +895,10 @@ async function ensureDaemonRunning(appUrl) {
 		env: process.env
 	}).unref();
 	for (let i = 0; i < 50; i += 1) {
-		if (await isDaemonListening(socketPath)) return;
+		if (await isDaemonListening(socketPath)) return true;
 		await sleep(100);
 	}
+	return false;
 }
 /**
 * Entry the CLI calls when launched with PORTAL_DAEMON_FLAG: become the daemon.
@@ -718,10 +916,10 @@ function runPortalDaemon(argv) {
 * CLI's re-exec entry above and the standalone `main.ts` entry.
 */
 function startPortalDaemon(appUrl) {
-	return new PortalDaemon(appUrl).listen();
+	return new PortalDaemon(appUrl, null).listen();
 }
 async function isDaemonListening(socketPath) {
-	if (!await pathExists(socketPath)) return false;
+	if (!isNamedPipePath(socketPath) && !await pathExists(socketPath)) return false;
 	return new Promise((resolve) => {
 		const probe = connect(socketPath);
 		probe.on("connect", () => {
@@ -848,7 +1046,7 @@ async function stopDaemon(appUrl) {
 function stateMessage(state, declined) {
 	return {
 		t: "state",
-		status: state.status,
+		status: state.status === "stand-down" ? "connecting" : state.status,
 		machineName: state.machineName,
 		friendlyName: state.friendlyName,
 		error: state.error,

package/dist/js/daemon-client-5ZIZn3qg.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-HdxGBXPK.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import "./daemon-B8c3Z1Te.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-xaS4xE-L.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client-Dvad009G.mjs → daemon-client-xaS4xE-L.mjs}

@@ -1,14 +1,21 @@
 #!/usr/bin/env node
-import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-Do1jU2UF.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-B8c3Z1Te.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
 //#region ../portal-daemon/src/daemon-client.ts
+/** Reconnect delay when an established daemon connection drops. */
+const RECONNECT_DELAY_MS = 500;
+/** Base delay between daemon SPAWN retries (doubles per consecutive failure). */
+const START_RETRY_BASE_MS = 2e3;
+/** Consecutive failed spawns before start() stops respawning. */
+const MAX_START_ATTEMPTS = 3;
 var PortalDaemonClient = class {
 	sessionId = randomUUID();
 	socket = null;
 	disposed = false;
 	reconnectTimer = null;
+	startFailures = 0;
 	lastBind = null;
 	fallbackCwd = null;
 	wantEnabled = false;
@@ -21,7 +28,21 @@ var PortalDaemonClient = class {
 	/** Spawn the daemon if needed and attach. Idempotent. */
 	async start() {
 		if (this.disposed) return;
-		await ensureDaemonRunning(this.opts.appUrl);
+		if (!await ensureDaemonRunning(this.opts.appUrl)) {
+			this.startFailures += 1;
+			const exhausted = this.startFailures >= MAX_START_ATTEMPTS;
+			this.opts.onState({
+				status: "error",
+				machineName: "",
+				friendlyName: "",
+				error: exhausted ? "portal daemon failed to start repeatedly; toggle sharing to retry" : "portal daemon failed to start (control socket never came up)",
+				grantedAgentIds: [],
+				declinedAgentIds: []
+			});
+			if (!exhausted) this.scheduleReconnect(START_RETRY_BASE_MS * 2 ** (this.startFailures - 1));
+			return;
+		}
+		this.startFailures = 0;
 		this.connect();
 	}
 	connect() {
@@ -74,12 +95,12 @@ var PortalDaemonClient = class {
 		socket.on("close", onClose);
 		socket.on("error", onClose);
 	}
-	scheduleReconnect() {
+	scheduleReconnect(delayMs = RECONNECT_DELAY_MS) {
 		if (this.disposed || this.reconnectTimer) return;
 		this.reconnectTimer = setTimeout(() => {
 			this.reconnectTimer = null;
 			this.start();
-		}, 500);
+		}, delayMs);
 		this.reconnectTimer.unref();
 	}
 	onMessage(msg) {
@@ -109,6 +130,10 @@ var PortalDaemonClient = class {
 	/** Turn machine sharing on (the daemon connects the portal). */
 	enable() {
 		this.wantEnabled = true;
+		if (this.startFailures >= MAX_START_ATTEMPTS) {
+			this.startFailures = 0;
+			this.start();
+		}
 		this.send({ t: "enable" });
 	}
 	/** Turn machine sharing off. */

package/dist/js/{install-CtAVvERm.mjs → install-ZUWt-WGX.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { c as version$1 } from "./rest-B9__Zsuk.mjs";
-import { w as getConfigPath } from "./print-D_UEjdSw.mjs";
+import { c as version$1 } from "./rest-YroXUA7G.mjs";
+import { D as getConfigPath } from "./print-B_jFXZ1W.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";
@@ -1547,6 +1547,51 @@ function formatMb(bytes) {
 	return `${(bytes / MB).toFixed(1)} MB`;
 }
 
+//#endregion
+//#region src/chat/tui/autowrap.ts
+/**
+* Why the TUI turns the terminal's autowrap off for its lifetime.
+*
+* OpenTUI's incremental cell-diff emitter positions every run with an
+* absolute cursor move — it never relies on the terminal to advance the
+* cursor — but it leaves the terminal's autowrap (DECAWM) enabled. When a
+* run reaches the last column, the host terminal wraps its cursor to column
+* 1 of the next row and paints the run's tail there, into cells owned by a
+* different element. The diff buffer then records the *intended* cells, so
+* those stray bytes are never repainted and unrelated text smears together
+* until a full repaint (a resize). Filed upstream with a repro and root
+* cause: https://github.com/anomalyco/opentui/issues/1187 — unfixed there,
+* the consumer-side fix (verified in numux#115) is to disable DECAWM while
+* the renderer runs. Pane content still wraps, inside OpenTUI's own grid.
+*/
+const AUTOWRAP_OFF = "\x1B[?7l";
+const AUTOWRAP_ON = "\x1B[?7h";
+/** Escape hatch: if any surface turns out to depend on host autowrap. */
+const keepAutowrap = () => Boolean(process.env["SKYDIVE_TUI_AUTOWRAP"]);
+let disabledBy = false;
+/**
+* Disable host autowrap so the diff emitter's runs can never wrap onto the
+* next row. No-op when stdout is not a terminal (piped output, tests) and
+* under `SKYDIVE_TUI_AUTOWRAP`.
+*/
+function disableTerminalAutowrap(stdout = process.stdout) {
+	if (!stdout.isTTY || keepAutowrap() || disabledBy) return;
+	disabledBy = true;
+	stdout.write(AUTOWRAP_OFF);
+}
+/**
+* Restore host autowrap. The terminal mode is a property of the host, so
+* every teardown path must run this even when the renderer cannot finish
+* its own teardown: the renderer's `onDestroy` hook covers renderer-driven
+* exits, and the forced-fallback reset in `hard-exit.ts` carries the
+* restore for a teardown that never got there. Idempotent.
+*/
+function restoreTerminalAutowrap(stdout = process.stdout) {
+	if (!disabledBy) return;
+	disabledBy = false;
+	stdout.write(AUTOWRAP_ON);
+}
+
 //#endregion
 //#region src/crash/install.ts
 let installed = false;
@@ -1566,6 +1611,7 @@ function installCrashHandler(opts = {}) {
 	if (installed) return;
 	installed = true;
 	process.on("uncaughtException", (error) => {
+		restoreTerminalAutowrap();
 		const memory = safeMemory();
 		printFatalNotice(writeCrashReport(buildCrashReport({
 			reason: "uncaughtException",
@@ -1594,4 +1640,4 @@ function printFatalNotice(file, memory) {
 }
 
 //#endregion
-export { installAgentAlias as A, resolveWorkspaceId as B, themeVersion as C, machineOsFromPlatform as D, buildImportSeedPrompt as E, detectShell as F, ensureActiveOrganization as I, getActiveWorkspaceId as L, takenAliasNames as M, SUPPORTED_SHELLS as N, aliasActivationHint as O, defaultInstallEnv as P, getSessionIdentity as R, themeModeFromColorFgBg as S, themesForMode as T, setActiveWorkspace as V, monoTheme as _, WORDMARK as a, themeForMode as b, getAutomaticLogsDir as c, profilingEnabled as d, record as f, findTheme as g, applyTheme as h, MARK_CELLS as i, slugifyAliasName as j, dedupeAliasName as k, maybeStartProfiling as l, DEFAULT_THEME_ID as m, buildCrashReport as n, brandHelpArt as o, writeArtifact as p, writeCrashReport as r, splashFitsWidth as s, installCrashHandler as t, profileDir as u, noColorRequested as v, themes as w, themeMode as x, theme as y, listWorkspaces as z };
+export { aliasActivationHint as A, getSessionIdentity as B, themeMode as C, themesForMode as D, themes as E, SUPPORTED_SHELLS as F, resolveWorkspaceId as H, defaultInstallEnv as I, detectShell as L, installAgentAlias as M, slugifyAliasName as N, buildImportSeedPrompt as O, takenAliasNames as P, ensureActiveOrganization as R, themeForMode as S, themeVersion as T, setActiveWorkspace as U, listWorkspaces as V, applyTheme as _, writeCrashReport as a, noColorRequested as b, brandHelpArt as c, maybeStartProfiling as d, profileDir as f, DEFAULT_THEME_ID as g, writeArtifact as h, buildCrashReport as i, dedupeAliasName as j, machineOsFromPlatform as k, splashFitsWidth as l, record as m, disableTerminalAutowrap as n, MARK_CELLS as o, profilingEnabled as p, restoreTerminalAutowrap as r, WORDMARK as s, installCrashHandler as t, getAutomaticLogsDir as u, findTheme as v, themeModeFromColorFgBg as w, theme as x, monoTheme as y, getActiveWorkspaceId as z };