smol-symphony 0.2.0 → 0.3.0

package/dist/src/shell/interp/tracker-scan.js

@@ -0,0 +1,238 @@
+// Deps-bound tracker IO split out of tracker.ts (kind: adapter): scan/fetch/
+// move/write + the per-effect router. Takes a small context (live config + log)
+// so the factory in tracker.ts stays a thin wiring shell.
+//
+// Fidelity: src/trackers/local.ts (scan/normalize/move) + src/http-disk.ts.
+import { mkdir, readdir, readFile, rename, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { TrackerError } from '../../types/errors.js';
+import { splitFrontMatter } from './tracker-parse.js';
+import { listIssues, readIssue } from './tracker-disk.js';
+import { assertTargetFree, buildNotesBody, durablyCreateExclusive, durablyReplaceInPlace } from './tracker-write.js';
+const warn = (ctx, msg, fields) => ctx.log?.emit('warn', msg, fields);
+function rootOf(ctx) {
+    const r = ctx.config().root;
+    if (!r)
+        throw new TrackerError('local_no_root', 'tracker.root is required');
+    return r;
+}
+// Parse every .md under one declared state dir. Per-file failures skip with a
+// warning so one bad file doesn't poison the scan (faithful to local.ts).
+async function scanStateDir(ctx, dirPath, stateDir, out) {
+    let files;
+    try {
+        files = await readdir(dirPath);
+    }
+    catch {
+        return;
+    }
+    for (const fileName of files) {
+        if (!fileName.endsWith('.md'))
+            continue;
+        const filePath = path.join(dirPath, fileName);
+        try {
+            if (!(await stat(filePath)).isFile())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        let text;
+        try {
+            text = await readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            warn(ctx, 'skipping unreadable issue file', { file: filePath, error: err.message });
+            continue;
+        }
+        try {
+            const { fields, body } = splitFrontMatter(text);
+            out.push({ filePath, identifier: fileName.slice(0, -3), state: stateDir, frontMatter: fields, description: body });
+        }
+        catch (err) {
+            warn(ctx, 'skipping malformed issue file', { file: filePath, error: err.message });
+        }
+    }
+}
+// Scan every declared state dir under `root`; undeclared dirs are warned + skipped.
+async function scanAllAt(ctx, root) {
+    let entries;
+    try {
+        entries = await readdir(root);
+    }
+    catch (err) {
+        // A not-yet-created root is an EMPTY tracker, not an error: a fresh
+        // `scaffold → run` has no issues until the first one is filed (the write path
+        // mkdir's the state dir on create), so the first poll must NOT crash. Mirror
+        // scanStateDir's tolerance of a missing state dir. Any OTHER read failure
+        // (EACCES, ENOTDIR, …) is a real misconfiguration → surface it loudly.
+        if (err.code === 'ENOENT')
+            return [];
+        throw new TrackerError('local_root_read_error', `cannot read tracker.root ${root}: ${err.message}`);
+    }
+    const declared = new Set(Object.keys(ctx.config().states).map((n) => n.toLowerCase()));
+    const out = [];
+    for (const dirEntry of entries) {
+        const dirPath = path.join(root, dirEntry);
+        try {
+            if (!(await stat(dirPath)).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (!declared.has(dirEntry.toLowerCase())) {
+            warn(ctx, 'skipping undeclared state directory', { dir: dirPath });
+            continue;
+        }
+        await scanStateDir(ctx, dirPath, dirEntry, out);
+    }
+    return out;
+}
+/**
+ * The ONE tracker read: scan every declared state dir into raw decoded
+ * front-matter (no filtering, no normalization). Selection/normalization is the
+ * pure core's job — the shell hands it this raw list and lets it filter down
+ * (core/issue/parse.ts:selectCandidateIssues/selectIssuesByIds/...). `root` is
+ * captured here so the orchestrator's atomic candidate-fetch can report it.
+ */
+export async function loadAllIssues(ctx) {
+    const root = rootOf(ctx);
+    return { raw: await scanAllAt(ctx, root), root };
+}
+// Append-notes-then-atomic-rename: write notes into a same-dir tmp+fsync, rename
+// in place, THEN cross-dir rename into the target state. A crash between the two
+// renames leaves notes persisted in the source dir (faithful to local.ts).
+export async function moveIssueToState(ctx, issueId, toState, opts) {
+    const root = opts?.fromRoot ?? rootOf(ctx);
+    // Match resolution (filter-by-id + duplicate disambiguation) is pure core logic
+    // injected through ScanCtx; the shell only does the readdir + the rename IO.
+    const match = ctx.resolveMatch(await scanAllAt(ctx, root), issueId, opts?.fromState);
+    if (match.state.toLowerCase() === toState.toLowerCase()) {
+        return { fromState: match.state, toState: match.state, newPath: match.filePath };
+    }
+    await appendNotes(match, toState, opts);
+    const newPath = path.join(root, toState, path.basename(match.filePath));
+    await mkdir(path.join(root, toState), { recursive: true });
+    await assertTargetFree(newPath);
+    try {
+        await rename(match.filePath, newPath);
+    }
+    catch (err) {
+        throw new TrackerError('local_issue_move_error', `failed to move ${match.filePath} -> ${newPath}: ${err.message}`);
+    }
+    ctx.log?.emit('info', 'issue transitioned', { issue_id: issueId, from_state: match.state, to_state: toState, path: newPath });
+    return { fromState: match.state, toState, newPath };
+}
+async function appendNotes(match, toState, opts) {
+    const notes = typeof opts?.notes === 'string' ? opts.notes : '';
+    if (notes.length === 0)
+        return;
+    let original;
+    try {
+        original = await readFile(match.filePath, 'utf8');
+    }
+    catch (err) {
+        throw new TrackerError('local_issue_notes_read_error', `failed to read ${match.filePath} for notes append: ${err.message}`);
+    }
+    await durablyReplaceInPlace(match.filePath, buildNotesBody(original, match.state, toState, notes, opts?.actor));
+}
+export async function start(ctx) {
+    const root = rootOf(ctx);
+    for (const name of Object.keys(ctx.config().states)) {
+        await mkdir(path.join(root, name), { recursive: true });
+    }
+}
+// Collect every existing identifier (filename stem) across ALL state dirs under
+// `root` — the readdir half of the original `collectExistingIdentifiers`. Counts
+// stems from EVERY state so a `Done/3.md` can't silently shadow a freshly-picked
+// `Holding/3.md`. The pure next-free-numeric pick (core) consumes this set.
+async function collectExistingIdentifiers(ctx, root) {
+    const existing = new Set();
+    for (const raw of await scanAllAt(ctx, root))
+        existing.add(raw.identifier);
+    return existing;
+}
+// write_issue: durable-write a NEW issue file. Every caller is a CREATE path
+// (the HTTP create-issue handler, the MCP propose_issue write) — none is an
+// in-place UPDATE — so an explicit identifier whose target file is already
+// occupied is a collision, NOT a silent overwrite. The serialization
+// (identifier sanitize, YAML front-matter render, body framing) is the PURE
+// core `composeIssueFile`, injected through the ScanCtx.
+//
+// Identifier resolution (both branches scan the EXISTING ids across ALL state
+// dirs so the create-409 contract holds either way):
+//   • effect.identifier PRESENT (HTTP create / triage path) → fed back in
+//     verbatim; composeIssueFile sanitizes it (idempotent) and rejects with
+//     `identifier_exists` when the sanitized id is already taken — that rejection
+//     surfaces here as a `local_issue_target_exists` TrackerError the HTTP layer
+//     maps to 409, instead of `durablyReplaceInPlace` overwriting the live file.
+//   • effect.identifier ABSENT (MCP propose_issue path) → the injected core
+//     `pickNextNumericIdentifier` chooses the next free numeric id over the SAME
+//     existing set. This replaces the old `?? '1'` default that overwrote
+//     `<holding>/1.md` on every proposal.
+export async function writeIssue(ctx, effect) {
+    // Scan once across every state dir: the explicit-identifier branch needs the set
+    // to detect a collision (the create-409 contract); the no-identifier branch needs
+    // it to pick the next free numeric id. (Pre-fix the explicit branch passed an
+    // EMPTY set, so composeIssueFile's collision guard never fired and an occupied
+    // target was silently overwritten via durablyReplaceInPlace.)
+    const existingIdentifiers = await collectExistingIdentifiers(ctx, effect.trackerRoot);
+    const identifierIn = effect.identifier ?? ctx.pickNextNumericIdentifier(existingIdentifiers);
+    const composed = ctx.composeIssueFile({
+        trackerRoot: effect.trackerRoot,
+        state: effect.state,
+        title: effect.title,
+        identifier: identifierIn,
+        ...(effect.description != null ? { description: effect.description } : {}),
+        ...(effect.priority != null ? { priority: effect.priority } : {}),
+        ...(effect.labels !== undefined ? { labels: effect.labels } : {}),
+        ...(effect.blocked_by !== undefined ? { blocked_by: effect.blocked_by } : {}),
+        ...(effect.extraFrontMatter !== undefined ? { extra_front_matter: effect.extraFrontMatter } : {}),
+        existingIdentifiers,
+        nowIso: new Date().toISOString(),
+    });
+    if (!composed.ok) {
+        // An explicit identifier already occupied → honour the create-409 contract:
+        // surface a `local_issue_target_exists` (the same code assertTargetFree uses)
+        // so the HTTP create handler maps it to 409 rather than overwriting the file.
+        if (composed.error.code === 'identifier_exists') {
+            throw new TrackerError('local_issue_target_exists', composed.error.message);
+        }
+        throw new TrackerError('local_issue_write_error', `failed to compose issue file: ${composed.error.message}`);
+    }
+    const { path: filePath, identifier } = composed.result;
+    await mkdir(path.dirname(filePath), { recursive: true });
+    // CREATE via an EXCLUSIVE (O_EXCL) open, NOT an overwriting tmp+rename: the
+    // scan-based collision check above is a TOCTOU window, so two concurrent creates
+    // of the SAME identifier could both pass it. The exclusive create makes the kernel
+    // the arbiter — exactly one wins; the loser's EEXIST surfaces as
+    // `local_issue_target_exists` (→ HTTP 409), with no overwrite/corruption.
+    await durablyCreateExclusive(filePath, composed.result.content);
+    return { kind: 'write_issue', path: filePath, identifier, state: effect.state };
+}
+async function interpretMove(ctx, effect) {
+    const r = await moveIssueToState(ctx, effect.issueId, effect.toState, {
+        fromRoot: effect.fromRoot ?? undefined,
+        fromState: effect.fromState ?? undefined,
+        notes: effect.notes,
+        actor: effect.actor ?? undefined,
+    });
+    return { kind: 'move_state', fromState: r.fromState, toState: r.toState, newPath: r.newPath };
+}
+// Per-effect router (the central interpreter delegates the tracker family).
+export async function interpret(ctx, effect) {
+    switch (effect.kind) {
+        case 'current_root':
+            return { kind: 'tracker_root', root: ctx.config().root };
+        case 'move_state':
+            return interpretMove(ctx, effect);
+        case 'write_issue':
+            return writeIssue(ctx, effect);
+        case 'list_issues_from_disk':
+            return { kind: 'disk_issues', issues: await listIssues(effect.root) };
+        case 'read_issue_from_disk':
+            return { kind: 'disk_issue_detail', detail: await readIssue(effect.root, effect.identifier) };
+    }
+}
+//# sourceMappingURL=tracker-scan.js.map

package/dist/src/shell/interp/tracker-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker-scan.js","sourceRoot":"","sources":["../../../../src/shell/interp/tracker-scan.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,0DAA0D;AAC1D,EAAE;AACF,4EAA4E;AAE5E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAIrH,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACjH,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,OAAe,EAAE,QAAgB,EAAE,GAAmB;IAC9F,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IACzD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3E,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzH,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,+BAA+B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,IAAY;IACjD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC;QACX,oEAAoE;QACpE,8EAA8E;QAC9E,6EAA6E;QAC7E,0EAA0E;QAC1E,uEAAuE;QACvE,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,qCAAqC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5H,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAY;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAKD,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,OAAe,EAAE,OAAe,EAAE,IAAe;IACpG,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,gFAAgF;IAChF,6EAA6E;IAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACxD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC9C,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,kBAAkB,KAAK,CAAC,QAAQ,OAAO,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAC9I,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9H,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAmB,EAAE,OAAe,EAAE,IAA0B;IACzF,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC1D,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,8BAA8B,EAAE,kBAAkB,KAAK,CAAC,QAAQ,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IACvJ,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,KAAK,UAAU,0BAA0B,CAAC,GAAY,EAAE,IAAY;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,qDAAqD;AACrD,0EAA0E;AAC1E,4EAA4E;AAC5E,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,MAAuD;IACpG,iFAAiF;IACjF,kFAAkF;IAClF,8EAA8E;IAC9E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,YAAY,GAChB,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC;QACpC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,YAAY;QACxB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,mBAAmB;QACnB,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,iCAAiC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;IACvD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,4EAA4E;IAC5E,iFAAiF;IACjF,mFAAmF;IACnF,iEAAiE;IACjE,0EAA0E;IAC1E,MAAM,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAY,EAAE,MAAsD;IAC/F,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACxC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;KACjC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,MAAqB;IACjE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,KAAK,YAAY;YACf,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,KAAK,aAAa;YAChB,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/src/shell/interp/tracker-write.js

@@ -0,0 +1,91 @@
+// Durable-write + move primitives split out of tracker.ts (kind: adapter).
+// Stateless (no closure deps). Faithful to src/trackers/local.ts (atomic
+// rename, fsync, notes append). Match resolution (filter-by-id + duplicate
+// disambiguation) is the pure core's job (core/issue/parse.ts:matchingCandidates
+// +resolveMatch), injected into the move path through ScanCtx.
+import { open, rename, stat } from 'node:fs/promises';
+import { TrackerError } from '../../types/errors.js';
+export function buildNotesBody(original, fromState, toState, notes, actor) {
+    const who = actor && actor.length > 0 ? actor : 'unknown';
+    const header = `## ${who} — ${new Date().toISOString()} — ${fromState} → ${toState}`;
+    const sep = original.endsWith('\n\n') ? '' : original.endsWith('\n') ? '\n' : '\n\n';
+    return `${original}${sep}${header}\n\n${notes}\n`;
+}
+// Same-dir tmp+fsync then atomic rename in place. UPDATE semantics: the rename
+// OVERWRITES the target, so this is for in-place edits of an EXISTING file (notes
+// append, move-in-place). New-issue CREATE must use durablyCreateExclusive — its
+// overwriting rename cannot enforce the create-409 contract under concurrency.
+export async function durablyReplaceInPlace(targetPath, contents) {
+    const tmpPath = targetPath + '.tmp';
+    let fh;
+    try {
+        fh = await open(tmpPath, 'w', 0o644);
+        await fh.writeFile(contents, 'utf8');
+        await fh.sync();
+    }
+    catch (err) {
+        try {
+            if (fh)
+                await fh.close();
+        }
+        catch { /* best-effort */ }
+        throw new TrackerError('local_issue_notes_write_error', `failed to write notes tmp file ${tmpPath}: ${err.message}`);
+    }
+    try {
+        await fh.close();
+    }
+    catch { /* on disk + fsync'd; close is not load-bearing */ }
+    try {
+        await rename(tmpPath, targetPath);
+    }
+    catch (err) {
+        throw new TrackerError('local_issue_notes_rename_error', `failed to atomic-rename ${tmpPath} -> ${targetPath}: ${err.message}`);
+    }
+}
+// Durable CREATE of a NEW issue file. The scan-based 409 check in writeIssue is a
+// TOCTOU window — two concurrent creates of the same identifier can both pass it,
+// then a deterministic-tmp+overwriting-rename (durablyReplaceInPlace) would let
+// the second silently clobber the first. Instead open the FINAL path with O_EXCL
+// ('wx'): the kernel guarantees exactly one creator wins; the loser gets EEXIST,
+// which we map to the same `local_issue_target_exists` TrackerError the create-409
+// contract already uses (→ HTTP 409). fsync keeps durability. No tmp+rename: the
+// excl open IS the atomic claim, so there is no shared temp path to race on.
+export async function durablyCreateExclusive(targetPath, contents) {
+    let fh;
+    try {
+        fh = await open(targetPath, 'wx', 0o644);
+    }
+    catch (err) {
+        if (err.code === 'EEXIST') {
+            throw new TrackerError('local_issue_target_exists', `refusing to overwrite existing file at ${targetPath}`);
+        }
+        throw new TrackerError('local_issue_write_error', `failed to create issue file ${targetPath}: ${err.message}`);
+    }
+    try {
+        await fh.writeFile(contents, 'utf8');
+        await fh.sync();
+    }
+    catch (err) {
+        try {
+            await fh.close();
+        }
+        catch { /* best-effort */ }
+        throw new TrackerError('local_issue_write_error', `failed to write issue file ${targetPath}: ${err.message}`);
+    }
+    try {
+        await fh.close();
+    }
+    catch { /* on disk + fsync'd; close is not load-bearing */ }
+}
+export async function assertTargetFree(newPath) {
+    try {
+        await stat(newPath);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return;
+        throw new TrackerError('local_issue_move_error', `failed to stat target ${newPath}: ${err.message}`);
+    }
+    throw new TrackerError('local_issue_target_exists', `refusing to overwrite existing file at ${newPath}`);
+}
+//# sourceMappingURL=tracker-write.js.map

package/dist/src/shell/interp/tracker-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker-write.js","sourceRoot":"","sources":["../../../../src/shell/interp/tracker-write.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,iFAAiF;AACjF,+DAA+D;AAE/D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAa,EAAE,KAAyB;IAC3H,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,SAAS,MAAM,OAAO,EAAE,CAAC;IACrF,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACrF,OAAO,GAAG,QAAQ,GAAG,GAAG,GAAG,MAAM,OAAO,KAAK,IAAI,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IAC9E,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QAAC,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IACpG,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,IAAI,EAAE;gBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC7D,MAAM,IAAI,YAAY,CAAC,+BAA+B,EAAE,kCAAkC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;IACtF,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,gCAAgC,EAAE,2BAA2B,OAAO,OAAO,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;AAC7J,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB,EAAE,QAAgB;IAC/E,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,0CAA0C,UAAU,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,+BAA+B,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,8BAA8B,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5B,OAAO,GAAG,EAAE,CAAC;QACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,yBAAyB,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,0CAA0C,OAAO,EAAE,CAAC,CAAC;AAC3G,CAAC"}

package/dist/src/shell/interp/tracker.js

@@ -0,0 +1,41 @@
+// FCIS rewrite — tracker effect interpreter (kind: adapter).
+//
+// Interprets every `TrackerEffect` variant against the filesystem-backed
+// LocalMarkdownTracker layout `<tracker.root>/<state>/<identifier>.md`:
+//   • current_root — snapshot the live tracker root
+//   • move_state — append-notes-then-atomic-rename across state dirs
+//   • write_issue — render + durable write a new issue file
+//   • list/read_issue_from_disk — the dashboard's direct-disk reads (critic gap)
+// Selection reads (candidates / by-id) go through loadAllIssues + the pure core
+// selectors at the composition root, not through an effect.
+//
+// Fidelity anchors (read-only reference, NOT modified):
+//   • src/trackers/local.ts (LocalMarkdownTracker: scan/normalize/move)
+//   • src/http-disk.ts (listIssuesFromDisk / readIssueFromDisk)
+//
+// This file is the thin wiring shell: it binds the live config + log into a
+// ScanCtx and exposes the adapter surface. The stateless halves (front-matter
+// decode, normalize/coerce, YAML render, durable-write/move primitives, disk
+// dashboard reads) and the deps-bound scan/fetch/move/write IO live in siblings.
+import * as scan from './tracker-scan.js';
+import { listIssues, readIssue } from './tracker-disk.js';
+export function createTrackerAdapter(deps) {
+    const ctx = {
+        config: deps.config,
+        log: deps.log,
+        resolveMatch: deps.resolveMatch,
+        composeIssueFile: deps.composeIssueFile,
+        pickNextNumericIdentifier: deps.pickNextNumericIdentifier,
+    };
+    return {
+        loadAllIssues: () => scan.loadAllIssues(ctx),
+        moveIssueToState: (id, to, opts) => scan.moveIssueToState(ctx, id, to, opts),
+        currentRoot: () => deps.config().root,
+        start: () => scan.start(ctx),
+        listIssues,
+        readIssue,
+        writeIssue: (effect) => scan.writeIssue(ctx, effect),
+        interpret: (effect) => scan.interpret(ctx, effect),
+    };
+}
+//# sourceMappingURL=tracker.js.map

package/dist/src/shell/interp/tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../../../../src/shell/interp/tracker.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,oDAAoD;AACpD,qEAAqE;AACrE,4DAA4D;AAC5D,iFAAiF;AACjF,gFAAgF;AAChF,4DAA4D;AAC5D,EAAE;AACF,wDAAwD;AACxD,wEAAwE;AACxE,gEAAgE;AAChE,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,iFAAiF;AAGjF,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,GAAG,GAAiB;QACxB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;KAC1D,CAAC;IACF,OAAO;QACL,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAC5C,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC;QAC5E,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI;QACrC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5B,UAAU;QACV,SAAS;QACT,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;QACpD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/src/shell/interp/tty.js

@@ -0,0 +1,48 @@
+// FCIS rewrite — shell adapter: interactive TTY (kind: adapter).
+//
+// Backs the scaffold-on-missing-workflow preflight: read one line of operator
+// input, gate on an interactive terminal, and parse the yes/no accept decision.
+//
+// Fidelity anchors (REF main branch src/bin/symphony.ts, read-only):
+//   • promptLine — the readline interface, closed before resolving so the
+//     process can exit cleanly afterwards.
+//   • maybeScaffoldMissingWorkflow — the `!isTTY` gate and the
+//     `'' | 'y' | 'yes'` (trimmed, lower-cased) default-accept parse, kept inline
+//     in the shell exactly as the original did.
+//
+// Shell rule: imports from src/types/** ONLY (this adapter needs none).
+import readline from 'node:readline';
+import process from 'node:process';
+/**
+ * Read a single line from stdin with the given prompt. The readline interface
+ * is closed before resolving so the process can exit cleanly afterwards.
+ * Ported byte-for-byte from REF promptLine.
+ */
+export function promptLine(message) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(message, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/**
+ * True only when BOTH stdin and stdout are attached to an interactive terminal.
+ * The scaffold offer is suppressed otherwise (cron jobs, CI, container
+ * ENTRYPOINTs). Ported from the gate at the top of REF maybeScaffoldMissingWorkflow.
+ */
+export function isInteractive() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+/**
+ * Prompt the operator with a yes/no question and resolve to the accept decision.
+ * Default-accept: bare enter, "y", or "yes" (case-insensitive, trimmed); anything
+ * else rejects. Ported from the parse in REF maybeScaffoldMissingWorkflow. Callers
+ * gate on {@link isInteractive} first, as the original did.
+ */
+export async function promptYesNo(message) {
+    const normalized = (await promptLine(message)).trim().toLowerCase();
+    return normalized === '' || normalized === 'y' || normalized === 'yes';
+}
+//# sourceMappingURL=tty.js.map

package/dist/src/shell/interp/tty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.js","sourceRoot":"","sources":["../../../../src/shell/interp/tty.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,qEAAqE;AACrE,0EAA0E;AAC1E,2CAA2C;AAC3C,+DAA+D;AAC/D,kFAAkF;AAClF,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AAExE,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;YAC9B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,CAAC;AACzE,CAAC"}

package/dist/src/shell/interp/vm.js

@@ -0,0 +1,199 @@
+// FCIS rewrite — VM-substrate adapter (kind: adapter) implementing the VmClient
+// port over `@earendil-works/gondolin`.
+//
+// Thin by design: `createVm` → `VM.create` (host mounts become RealFSProvider /
+// ReadonlyProvider VFS entries), the handle's `exec` → `vm.exec` (piped stdio + an
+// AbortController standing in for the port's `kill()`), `close` → `vm.close`, and
+// `listSessions` / `gc` → Gondolin's session registry. A tiny in-process
+// VmProcessRegistry tracks each live VM's backing qemu host pid so a forced exit
+// can SIGKILL them synchronously before `process.exit` (issue 152): VMs are
+// created in-process so each qemu is a DIRECT CHILD of the orchestrator, and the
+// session registry only records OUR pid — `getHostPid()` is the sole reliable
+// handle on the backing process.
+//
+// Shell rule: imports from src/types/** ONLY (plus the real Gondolin SDK). ZERO
+// decisions live here. NodeNext ESM with .js extensions on relative imports.
+import { mkdir } from 'node:fs/promises';
+import { VM, RealFSProvider, ReadonlyProvider, listSessions as gondolinListSessions, gcSessions, } from '@earendil-works/gondolin';
+/**
+ * Pure: reduce candidate VM host pids (some unknown/null) to the distinct, safe
+ * set to SIGKILL — positive safe integers, never the caller's own pid (which
+ * `process.kill` would aim at the orchestrator) and never `<= 0` (which would
+ * signal a whole process group).
+ */
+function safeKillTargets(hostPids, selfPid) {
+    const out = new Set();
+    for (const pid of hostPids) {
+        if (pid == null || !Number.isSafeInteger(pid) || pid <= 0 || pid === selfPid)
+            continue;
+        out.add(pid);
+    }
+    return [...out];
+}
+class VmProcessRegistry {
+    live = new Set();
+    kill;
+    selfPid;
+    constructor(opts = {}) {
+        this.kill = opts.kill ?? ((pid, signal) => process.kill(pid, signal));
+        this.selfPid = opts.selfPid ?? process.pid;
+    }
+    /**
+     * Register a live VM. Returns a deregister callback to invoke after a clean
+     * `close()` so the set stays bounded. Correctness does NOT depend on it: once a
+     * VM's runner exits, `getHostPid()` returns null and {@link killAll} skips it.
+     */
+    track(vm) {
+        this.live.add(vm);
+        return () => void this.live.delete(vm);
+    }
+    /**
+     * SIGKILL the backing host process of every tracked VM that still has a live
+     * runner pid. Synchronous and bounded (one signal per tracked VM, no IO), so
+     * the forced-shutdown path can call it and `process.exit` immediately. Best
+     * effort: ESRCH / EPERM / etc. are swallowed. Returns the count targeted.
+     */
+    killAll() {
+        const pids = safeKillTargets([...this.live].map((vm) => vm.getHostPid()), this.selfPid);
+        for (const pid of pids) {
+            try {
+                this.kill(pid, 'SIGKILL');
+            }
+            catch {
+                // ESRCH (already gone) / EPERM / etc. — best-effort on the way out.
+            }
+        }
+        return pids.length;
+    }
+}
+// ─── VM handle (one launched Gondolin VM) ──────────────────────────────────
+class GondolinVmHandle {
+    vm;
+    onClose;
+    /**
+     * `onClose` deregisters this VM from the client's process registry after a
+     * clean `close()` (qemu already torn down). Defaults to a no-op so the handle
+     * can be constructed without a registry in tests.
+     */
+    constructor(vm, onClose = () => undefined) {
+        this.vm = vm;
+        this.onClose = onClose;
+    }
+    get id() {
+        return this.vm.id;
+    }
+    exec(opts) {
+        // Gondolin has no `proc.kill()`; aborting the signal passed to `exec` is the
+        // teardown path, so the handle owns the controller.
+        const ac = new AbortController();
+        const proc = this.vm.exec(opts.command, {
+            cwd: opts.workdir ?? undefined,
+            env: opts.env,
+            stdin: true,
+            stdout: 'pipe',
+            stderr: 'pipe',
+            signal: ac.signal,
+        });
+        const { stdout, stderr } = proc;
+        if (!stdout || !stderr) {
+            throw new Error('gondolin exec did not expose piped stdout/stderr');
+        }
+        let killed = false;
+        return {
+            stdin: { write: (chunk) => proc.write(chunk), end: () => proc.end() },
+            stdout,
+            stderr,
+            pid: this.vm.getHostPid() ?? undefined,
+            exit: proc.result.then((r) => ({ code: r.exitCode, signal: r.signal ?? null }), (err) => {
+                // An intentional kill() aborts the AbortController, which makes Gondolin reject
+                // the exec result with Error("exec aborted"). That abort IS the teardown signal,
+                // not a failure — resolve it to a killed sentinel. Otherwise a caller that does
+                // not observe `exit` (the launch agent's exec is a bare process tether: its
+                // lifecycle rides the /acp WebSocket, nothing awaits `exit`) would turn the
+                // teardown abort into an unhandled rejection that crashes the orchestrator.
+                // Genuine (non-kill) errors still reject so observing callers see them.
+                if (killed)
+                    return { code: null, signal: null };
+                throw err;
+            }),
+            kill: () => {
+                if (killed)
+                    return;
+                killed = true;
+                try {
+                    ac.abort();
+                }
+                catch {
+                    // idempotent — already aborted / process gone
+                }
+            },
+        };
+    }
+    async close() {
+        // Deregister only after a clean close. If `close()` throws, the VM stays
+        // tracked so the force-quit backstop (`killAllVms`) can still SIGKILL its
+        // backing qemu — a teardown that failed must not leave an orphan.
+        await this.vm.close();
+        this.onClose();
+    }
+}
+// ─── VM client (the VmClient port) ──────────────────────────────────────────
+export class GondolinVmClient {
+    procRegistry;
+    constructor(opts = {}) {
+        this.procRegistry = new VmProcessRegistry(opts);
+    }
+    async createVm(opts) {
+        const mounts = {};
+        for (const m of opts.mounts) {
+            // Provision symphony-managed RW mount hosts before mounting (issue 209): the mise
+            // download-cache dir may not exist on a fresh host. Idempotent; only flagged
+            // mounts (never the workspace / user volumes) are created.
+            if (m.ensureHostDir)
+                await mkdir(m.host, { recursive: true });
+            const provider = new RealFSProvider(m.host);
+            mounts[m.guest] = m.readonly ? new ReadonlyProvider(provider) : provider;
+        }
+        // The port keeps httpHooks/tcp/dns opaque (`unknown`) to avoid leaking
+        // Gondolin infra types upward; the composition root produces the real shapes
+        // (createHttpHooks / tcp.hosts tunnel) and passes them straight through. The
+        // cast at this single-adapter seam is deliberate and cheap. Per-guest file
+        // staging (creds + launcher) is the dispatcher's job over `exec` AFTER create,
+        // not the createVm port surface — matching the reference gondolin.ts adapter.
+        const options = {
+            sandbox: { imagePath: opts.imagePath },
+            cpus: opts.cpus,
+            memory: `${opts.memMib}M`,
+            // Grow the guest rootfs so the ephemeral mise toolchain install fits (issue 222);
+            // qemu size syntax (e.g. "3G"). Omitted ⇒ the substrate's default rootfs size.
+            ...(opts.rootfsSize ? { rootfs: { size: opts.rootfsSize } } : {}),
+            env: opts.env,
+            vfs: { mounts },
+            httpHooks: opts.httpHooks,
+            tcp: opts.tcp,
+            dns: opts.dns,
+            allowWebSockets: opts.allowWebSockets,
+            sessionLabel: opts.sessionLabel,
+        };
+        const vm = await VM.create(options);
+        return new GondolinVmHandle(vm, this.procRegistry.track(vm));
+    }
+    /** @see VmClient.killAllVms — synchronous, best-effort qemu reap on forced exit. */
+    killAllVms() {
+        return this.procRegistry.killAll();
+    }
+    async listSessions() {
+        const sessions = await gondolinListSessions();
+        return sessions.map((s) => ({
+            id: s.id,
+            pid: s.pid,
+            label: s.label,
+            alive: s.alive,
+            createdAt: s.createdAt,
+        }));
+    }
+    async gc() {
+        return gcSessions();
+    }
+}
+//# sourceMappingURL=vm.js.map