weir-harness 1.2.2 → 2.0.0

package/src/lsp/tools.js

@@ -1,12 +1,14 @@
 // The LSP semantic tools: four read-only queries plus `lsp_rename`, the one
 // rewriting tool (cross-file WorkspaceEdit application through the fs version
-// guard). Pure-object definitions with object-rooted schemas; 1-based
-// positions in, structured text out; every LSP failure becomes an ordinary
-// tool error result, never a broken turn.
+// guard, under ONE batch file lease). Pure-object definitions with
+// object-rooted schemas; 1-based positions in, structured text out; every LSP
+// failure becomes an ordinary tool error result, never a broken turn.
 import { familyForLanguageId, languageIdForFile } from './registry.js'
 import { uriToPath } from './uri.js'
 import { applyTextEdits, detectLineEndings, extractChanges, normalizeLineEndings, restoreLineEndings } from './rename.js'
 import { unifiedDiff } from '../hashline-edit/diff.js'
+import { createEditorLease } from '../file-lease/singleton.js'
+import { isLeaseConflict } from '../file-lease/client.js'
 
 const SEVERITY = { 1: 'error', 2: 'warning', 3: 'information', 4: 'hint' }
 
@@ -34,9 +36,105 @@ function asLocationArray(result) {
     .filter(Boolean)
 }
 
-/** Build the five tool definitions for one calling agent's enable. */
-export function createLspTools({ manager, ctx, agent }) {
-  const editLock = ctx.get?.('weirEditLock')
+/**
+ * The sandbox denial marker the host backend raises, by prefix only: every
+ * effective mode ends with its own mode name, and a denial never moved bytes.
+ */
+const SANDBOX_DENIAL_MARKER = '[sandbox: file access denied under'
+
+/** @param {unknown} error @returns {boolean} */
+function isSandboxDenial(error) {
+  return String(/** @type {any} */ (error)?.message ?? '').includes(SANDBOX_DENIAL_MARKER)
+}
+
+/** @param {unknown} error @returns {string} */
+function messageOf(error) {
+  return String(/** @type {any} */ (error)?.message ?? error)
+}
+
+/**
+ * The three-way truth of a failed rename (design D12): which targets are on
+ * disk, which PROVABLY are not, and which cannot be proven either way.
+ *
+ * Only these three failures prove that no byte of a target landed: a refused
+ * claim (nothing ran), the filesystem version guard (the write was rejected
+ * before it moved bytes) and a sandbox denial (the backend refused the
+ * operation). Anything else — an I/O error, an abort, a backend that threw
+ * after a partial write — is UNPROVEN, and claiming it was not written would be
+ * a lie the model would act on.
+ *
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+function isProvablyUnwritten(error) {
+  if (isLeaseConflict(error)) return true
+  const value = /** @type {any} */ (error)
+  if (String(value?.code ?? '').includes('FS_STALE_VERSION')) return true
+  return String(value?.message ?? '').includes('FS_STALE_VERSION') || isSandboxDenial(error)
+}
+
+/**
+ * The honest failure report: three lists and no rollback claim. The identity of
+ * the caller's claim is stated truthfully too — a batch refused before the
+ * claim was granted holds nothing, while a batch that failed mid-write keeps its
+ * leases until the turn ends (design D2/D10).
+ *
+ * @param {{ failure: unknown, remaining: any[], written: any[], entered: boolean }} detail
+ * @returns {Error}
+ */
+function renameFailure({ failure, remaining, written, entered }) {
+  const list = (plans) => `[${plans.map((plan) => JSON.stringify(plan.target.displayPath)).join(', ')}]`
+  const proven = !entered || isProvablyUnwritten(failure)
+  const notWritten = proven ? remaining : []
+  const uncertain = proven ? [] : remaining
+  const failedPath = entered ? JSON.stringify(remaining[0]?.target.displayPath ?? '') : undefined
+  /** @type {Error & { cause?: unknown }} */
+  const error = new Error([
+    failedPath === undefined
+      ? `lsp_rename: the rename was refused before any write: ${messageOf(failure)}`
+      : `lsp_rename: write failed for ${failedPath}: ${messageOf(failure)}`,
+    `filesAlreadyWritten: ${list(written)};`,
+    `filesNotWritten: ${list(notWritten)};`,
+    `filesUncertain: ${list(uncertain)};`,
+    entered
+      ? 'ownership retained (no rollback)'
+      : 'no claim was taken for this batch (no rollback)',
+  ].join('\n'))
+  error.cause = failure
+  return error
+}
+
+/**
+ * The optional `leaseClient` seam on a scope that may not declare it.
+ *
+ * A cordis context THROWS on reading a property it does not inject
+ * ("cannot get property \"leaseClient\" without inject"), so probing it directly
+ * makes the seam a trap: `lsp` injects `tools`/`subprocess`/`fs`, never a lease
+ * client, and every `lsp_rename` would fail at tool construction. An explicit
+ * argument (unit tests, an embedder) always wins; the probe only ever answers
+ * `undefined` when the composition does not carry one.
+ * @param {any} scope
+ * @returns {any}
+ */
+function optionalLeaseClient(scope) {
+  try {
+    return scope?.leaseClient
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Build the five tool definitions for one calling agent's enable.
+ *
+ * `leaseClient` is the injection seam (explicit argument or a carrying ctx),
+ * because this module's caller forwards only `{manager, ctx, agent}`. Nothing
+ * else in the row reads it: no service is published or consumed for leases
+ * (design D11) — the default is the process-wide client, resolved on the first
+ * managed write.
+ */
+export function createLspTools({ manager, ctx, agent, leaseClient }) {
+  const lease = createEditorLease({ leaseClient: leaseClient ?? optionalLeaseClient(ctx), ctx })
   // Optional sandbox policy capture (S23, mirrors hashline-edit): the
   // sandboxed fs backend enforces the session policy only when the caller
   // passes it per call. Absent service (headless test compositions, other
@@ -179,7 +277,7 @@ export function createLspTools({ manager, ctx, agent }) {
     },
     {
       name: 'lsp_rename',
-      description: `Rename the symbol at a 1-based position across the workspace: the language server computes every edit location and the resulting WorkspaceEdit is applied to disk through the filesystem version guard. Every target file is preflighted before anything is written (a bad edit range aborts the call with zero writes); then files are written one by one and a mid-write failure (file changed on disk, sandbox denial, I/O) stops immediately, reporting exactly which files were already written and which were not. The original line-ending style (LF/CRLF) of each file is preserved.`,
+      description: `Rename the symbol at a 1-based position across the workspace: the language server computes every edit location and the resulting WorkspaceEdit is applied to disk through the filesystem version guard, under one file-lease claim covering every preflighted target. Every target file is preflighted before anything is written (a bad edit range aborts the call with zero writes); then files are written one by one and a mid-write failure (file changed on disk, sandbox denial, I/O) stops immediately, reporting exactly which files were already written, which were not written, and which could not be proven either way. Nothing is rolled back. The original line-ending style (LF/CRLF) of each file is preserved.`,
       parameters: {
         type: 'object',
         properties: {
@@ -254,25 +352,39 @@ export function createLspTools({ manager, ctx, agent }) {
           return { text: `lsp_rename: no-op — the server's edits leave every file unchanged; nothing was written.` }
         }
 
-        // Phase 2 — write pass: one atomic replaceIfVersion write per file.
-        // A failure stops the pass immediately and names both file lists.
+        // Phase 2 — write pass under ONE batch claim (design D2): the complete
+        // preflighted target set is acquired atomically before the first byte, so
+        // a conflict anywhere refuses the whole call with nothing written and no
+        // implicit takeover. The claim is NOT released here: it lives until the
+        // turn ends, like every other managed edit claim (D10), so the session's
+        // own later edits of these files cannot conflict with itself.
         const written = []
-        if (editLock) {
-          await editLock.publishBatch(exec, {cwd: resolveCwd, effectivePolicy: policy, args,
-            plans: writePlans.map(plan => ({filePath: plan.filePath, content: plan.after, version: plan.version}))})
-          written.push(...writePlans)
-        } else for (const plan of writePlans) {
-          try {
-            await ctx.fs.writeText(plan.target, plan.after, { kind: 'replaceIfVersion', version: plan.version }, exec.signal, policy)
-            written.push(plan)
-          } catch (error) {
-            const notWritten = writePlans.slice(written.length).map((plan) => plan.target.displayPath)
-            const already = written.map((plan) => plan.target.displayPath)
-            throw new Error(
-              `lsp_rename: write failed for ${plan.target.displayPath}: ${error?.message ?? error}\n` +
-                `Rename partially applied. filesAlreadyWritten: [${already.join(', ')}]; filesNotWritten: [${notWritten.join(', ')}]`,
-            )
-          }
+        let entered = false
+        /** @type {unknown} */
+        let failure = null
+        try {
+          await lease.client().withLeases(
+            lease.ownerOf(exec.agent),
+            plans.map((plan) => plan.target.displayPath),
+            lease.scopeOf(exec.agent, resolveCwd),
+            async () => {
+              entered = true
+              for (const plan of writePlans) {
+                await ctx.fs.writeText(plan.target, plan.after, { kind: 'replaceIfVersion', version: plan.version }, exec.signal, policy)
+                written.push(plan)
+              }
+            },
+          )
+        } catch (error) {
+          failure = error
+        }
+        if (failure !== null) {
+          // The failure report is the whole contract here (design D12): which
+          // files are provably on disk, which provably are not, which cannot be
+          // proven, and never a rollback claim. `written` holds exactly the
+          // files that returned from writeText, so the failing target is the
+          // head of the remaining slice.
+          throw renameFailure({ failure, remaining: writePlans.slice(written.length), written, entered })
         }
 
         const editCount = writePlans.reduce((sum, plan) => sum + plan.edits, 0)
@@ -284,8 +396,6 @@ export function createLspTools({ manager, ctx, agent }) {
       },
     },
   ]
-  // Only a definition built with the captured service is admitted by Edit Lock.
-  if (editLock) for (const tool of tools) if (tool.name === 'lsp_rename') editLock.claim?.(tool)
   return tools
 }
 

package/src/notify/commands.js

@@ -54,7 +54,10 @@ function linux(note, sound) {
   }
 }
 
-/** PowerShell source of the Windows toast; reads title/body from the environment. */
+/**
+ * PowerShell source of the Windows toast; reads title/body from the environment
+ * and reports an OS-level block through stderr plus a non-zero exit.
+ */
 const WINDOWS_SCRIPT = [
   "$ErrorActionPreference = 'Stop'",
   '[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null',
@@ -66,7 +69,17 @@ const WINDOWS_SCRIPT = [
   '$xml.LoadXml("<toast><visual><binding template=\'ToastGeneric\'><text>$title</text><text>$body</text></binding></visual>$audio</toast>")',
   '$toast = [Windows.UI.Notifications.ToastNotification]::new($xml)',
   "$appId = '{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe'",
-  '[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($appId).Show($toast)',
+  // `Show()` has no synchronous failure return, and the asynchronous
+  // `ToastNotification.Failed` event cannot be awaited by a process that exits
+  // right after firing, so `ToastNotifier.Setting` is the synchronous proxy: a
+  // non-`Enabled` value (disabled for the app, the user, by group policy or by
+  // manifest) becomes a non-zero exit whose stderr reaches the warn-once path
+  // instead of vanishing into silence. Explicit variables, not a chained
+  // expression: PowerShell 5.1 chaining behaviour must not be relied on.
+  '$notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($appId)',
+  '$setting = $notifier.Setting',
+  'if ("$setting" -ne \'Enabled\') { [Console]::Error.WriteLine("Windows toast notifications are unavailable: $setting"); exit 3 }',
+  '$notifier.Show($toast)',
 ].join('\n')
 
 /**

package/src/notify/index.js

@@ -30,6 +30,32 @@ const STALE_EVENT_MS = 60_000
 /** Longest parent chain walked to find the session the user actually sees. */
 const MAX_ANCESTORS = 8
 
+/**
+ * Platforms whose page can both DISPLAY a notification and REPORT whether it
+ * appeared, so handing the note to the page first is sound there: macOS and
+ * Linux. Windows is deliberately absent — the page's web `Notification` can
+ * neither display nor report failure there. Electron only shows a toast for an
+ * app that owns a Start Menu shortcut with an AppUserModelID and a
+ * ToastActivatorCLSID (the DSH desktop bundle declares no app identity), so
+ * Chromium drops it with nothing but a debug log; and in a secure context with
+ * permission granted, Blink never fails the constructor and never fires
+ * `error`. The page could therefore only answer `shown`/`pending`, both
+ * terminal, which would suppress the fallback forever. So Windows goes
+ * straight to the platform command, whose AUMID points at an OS-registered
+ * shortcut. The cost: Windows attributes the toast to "Windows PowerShell".
+ */
+export const PAGE_DELIVERY_PLATFORMS = Object.freeze(['darwin', 'linux'])
+
+/**
+ * Whether the page leg can carry a delivery on this platform.
+ *
+ * @param {string} platform - a `process.platform` value
+ * @returns {boolean}
+ */
+export function usesPageDelivery(platform) {
+  return PAGE_DELIVERY_PLATFORMS.includes(platform)
+}
+
 /**
  * Resolve the effective options NOW (the settings service is live: a
  * volatile commit takes effect on the next event, no remount). Unusable
@@ -238,26 +264,38 @@ export function wire(ctx, config, { notifier, channel, now = Date.now, setTimer,
   }
 }
 
-/** @param {any} ctx @param {object} [config] */
-function apply(ctx, config = {}) {
-  const notifier = createNotifier({ logger: ctx.logger })
-  if (!notifier.supported) ctx.logger?.warn?.(`notify: system notifications are not supported on platform "${process.platform}"`)
-  // The page delivers (as DeepSeek Harness); the system command is the fallback.
-  const channel = createWebChannel({ fallback: (note, options) => notifier.send(note, options), logger: ctx.logger })
+/**
+ * @param {any} ctx
+ * @param {object} [config]
+ * @param {{ platform?: string }} [options] - test seam; cordis calls (ctx, config) only
+ */
+function apply(ctx, config = {}, { platform = process.platform } = {}) {
+  const notifier = createNotifier({ platform, logger: ctx.logger })
+  if (!notifier.supported) ctx.logger?.warn?.(`notify: system notifications are not supported on platform "${platform}"`)
+  // The page delivers (as DeepSeek Harness) where it can also confirm; on the
+  // other platforms the system command is the only leg (PAGE_DELIVERY_PLATFORMS).
+  const channel = usesPageDelivery(platform)
+    ? createWebChannel({ fallback: (note, options) => notifier.send(note, options), logger: ctx.logger })
+    : undefined
   const offWire = wire(ctx, config, { notifier, channel })
   // Page endpoints (pull/ack) and the macOS permission panel's endpoints. They
   // register from this row, whose `./notify` subpath already exists, so no new
   // package subpath is needed (S19); services come through ctx.inject (S20).
   const offEndpoints = wireNotifyPermissions(ctx, {
+    platform,
     channel,
-    // The permission panel's test goes through the real path, and shows even
-    // with the window in front (the user is looking at the settings page).
-    sendTest: () => channel.send({ ...TEST_NOTE, tag: tagFor('test', 'test'), renotify: RENOTIFY, sound: true, foreground: 'always' }),
+    // The permission panel's test goes through whichever path the platform
+    // uses, and shows even with the window in front (the user is looking at
+    // the settings page).
+    sendTest: () =>
+      channel
+        ? channel.send({ ...TEST_NOTE, tag: tagFor('test', 'test'), renotify: RENOTIFY, sound: true, foreground: 'always' })
+        : notifier.send(TEST_NOTE, { sound: true }),
   })
   return () => {
     offWire()
     offEndpoints()
-    channel.close()
+    channel?.close()
   }
 }
 

package/src/notify/web-channel.js

@@ -9,8 +9,13 @@
 //
 // Safety contract (spec "待发通知通道对失败与异常页面安全"):
 //   - a note is handed to exactly ONE puller;
-//   - a note is delivered at most once: a page that showed it, or suppressed it
-//     on purpose (window in the foreground), is final — no fallback;
+//   - a note is delivered at most once: a page that showed it, suppressed it on
+//     purpose (window in the foreground), or handed it off without confirmation
+//     (`pending`) is final — no fallback;
+//   - `pending` is final but is NOT confirmation: it means the page could not
+//     tell whether the notification appeared, so it is reported once per cause
+//     through the logger instead of falling back — a silent platform drop would
+//     otherwise be invisible to the user and to the log;
 //   - a note is never lost: no puller, a failed page, or a missing ack all fall
 //     back to the system command;
 //   - nothing here touches a session. Plain ESM, ctx-free; clock and timers are
@@ -25,11 +30,16 @@ export const ACK_TIMEOUT_MS = 4_000
 
 /**
  * What the page may report. `shown`/`pending`/`suppressed` are final (no
- * fallback); everything else falls back.
+ * fallback); everything else falls back. `pending` is final without being
+ * confirmation — the page handed the note off and could not tell whether it
+ * appeared — so it is reported through the logger instead of falling back.
  */
 export const FINAL_RESULTS = Object.freeze(['shown', 'pending', 'suppressed'])
 export const FALLBACK_RESULTS = Object.freeze(['blocked', 'error', 'threw', 'unsupported'])
 
+/** Reported once per channel when a page hands a note off but never confirms it. */
+const UNCONFIRMED = 'the page sent a notification but could not confirm it appeared'
+
 /**
  * @typedef {{ title: string, body: string, urgent: boolean }} Note
  * @typedef {Note & { tag: string, renotify: boolean, sound: boolean, foreground: 'skip' | 'always' }} WebNote
@@ -63,6 +73,15 @@ export function createWebChannel({ fallback, now = Date.now, setTimer, clearTime
   let nextId = 1
   let closed = false
 
+  /** Distinct warnings already emitted (one per cause, like the notifier). @type {Set<string>} */
+  const reported = new Set()
+  /** @param {string} cause */
+  const warnOnce = (cause) => {
+    if (reported.has(cause)) return
+    reported.add(cause)
+    logger?.warn?.(`notify: ${cause}`)
+  }
+
   const hasPuller = () => waiters.length > 0 || now() - lastPullAt < PULLER_FRESH_MS
 
   /** @param {WebNote} note */
@@ -165,6 +184,10 @@ export function createWebChannel({ fallback, now = Date.now, setTimer, clearTime
       inFlight.delete(id)
       stop(entry.timer)
       if (!FINAL_RESULTS.includes(result)) useFallback(entry.note)
+      // `pending` is final (never fall back) but it is not confirmation: the
+      // page handed the note off and could not tell whether it appeared. Say so
+      // once per cause, or a silent platform drop stays invisible.
+      else if (result === 'pending') warnOnce(UNCONFIRMED)
       return true
     },
 

package/src/process/index.js

@@ -39,6 +39,8 @@ export function extraBinDirectories(env = process.env, platform = process.platfo
     // describe, not which separator to spell, so a test on any host can point
     // the seam at a real fixture directory.
     const roaming = env.APPDATA ?? join(home, 'AppData', 'Roaming')
+    const localAppData = env.LOCALAPPDATA ?? join(home, 'AppData', 'Local')
+    const programFiles = env.ProgramFiles ?? 'C:\\Program Files'
     return [
       // npm's own global prefix: the .cmd/.ps1 shims live directly here.
       join(roaming, 'npm'),
@@ -51,6 +53,15 @@ export function extraBinDirectories(env = process.env, platform = process.platfo
       join(home, 'go', 'bin'),
       join(home, 'scoop', 'shims'),
       join(roaming, 'npm', 'node_modules', '.bin'),
+      // LLVM's NSIS installer skips the "add to PATH" step in silent mode, so
+      // these two are the ONLY way a winget-installed clangd resolves (D4).
+      join(programFiles, 'LLVM', 'bin'),
+      join(localAppData, 'Programs', 'LLVM', 'bin'),
+      // WinGet portable packages expose their command aliases here (LuaLS).
+      join(localAppData, 'Microsoft', 'WinGet', 'Links'),
+      // winget.exe itself lives here; a long-running GUI's PATH can predate the
+      // App Installer update, so the directory scan must cover it too.
+      join(localAppData, 'Microsoft', 'WindowsApps'),
     ]
   }
   const nvmBins = []

package/src/settings/index.js

@@ -14,32 +14,14 @@ import { configValue } from './volatile.js'
 import { computeSections } from './sections.js'
 import { wireLspAdmin } from '../lsp/admin.js'
 import { wireEnvAdmin } from './env-admin.js'
-import { createEditLockEvidence, wireEditLockMaintenance } from '../edit-lock/maintenance.js'
-import { managementRootFor } from '../edit-lock/domains.js'
-import { createAudit, AUDIT_TYPES } from '../shared/audit.js'
-
-// Host lifetime, not settings-row lifetime: remounting settings must not forget
-// still-live preset rows. Weak keys isolate hosts and release stopped hosts.
-const evidenceByHost = new WeakMap()
 
 export { Config } from './sections.js'
 
 const name = 'weir-settings'
 const inject = []
 
-// Explicit resolver seam keeps root-discovery tests away from ancestor authorities.
-export function maintenanceRoots(agents, resolveRoot = managementRootFor) {
-  const roots = new Set()
-  for (const agent of agents?.roots?.() ?? []) {
-    const cwd = agent.session?.header?.cwd
-    if (typeof cwd !== 'string') continue
-    try { roots.add(resolveRoot(cwd)) } catch { /* unavailable root */ }
-  }
-  return [...roots]
-}
-/** @param {{ resolveRoot?: typeof managementRootFor }} [dependencies] */
-export function createSettingsPlugin({ resolveRoot = managementRootFor } = {}) {
 // Arrow apply: cordis must retain the returned endpoint disposer, not construct it.
+export function createSettingsPlugin() {
 return (ctx, config = {}) => {
   // The whitelist defaults cache: the defaults file is read once per process,
   // and an explicit reload entry (robashDefaultsReload) clears it. Nothing here
@@ -55,21 +37,9 @@ return (ctx, config = {}) => {
   // Compute eagerly: malformed categoryChains/lspServers/robash lists fail
   // activation loud.
   compute()
-  const host = ctx.root ?? ctx
-  let editLockEvidence = evidenceByHost.get(host)
-  if (!editLockEvidence) {
-    editLockEvidence = createEditLockEvidence()
-    evidenceByHost.set(host, editLockEvidence)
-  }
-  const candidateRoots = () => maintenanceRoots(ctx.get?.('agents'), resolveRoot)
-  const savedEnabled = () => compute().editLock?.enabled === true
-  const audit = createAudit(ctx)
-  let lastEnabled = savedEnabled()
-
   const listeners = new Set()
   // Host-plane service: preset modules read their override section on demand.
   ctx.reflect.provide('weirSettings', {
-    editLockEvidence,
     get(key) {
       return compute()[key]
     },
@@ -97,17 +67,6 @@ return (ctx, config = {}) => {
   observeReloadEntry()
   ctx.on('loader/volatile-update', () => {
     observeReloadEntry()
-    const enabled = savedEnabled()
-    if (enabled !== lastEnabled) {
-      lastEnabled = enabled
-      // Profile intent has no session log. Mirror only when a server-derived
-      // workspace exists; no cwd fallback to the developer's current directory.
-      const data = { kind: enabled ? 'enable-requested' : 'disable-requested', scope: 'profile', appliesAfterRestart: true }
-      let roots = []
-      try { roots = candidateRoots() } catch { /* emit remains available */ }
-      if (roots.length) for (const root of roots) audit(null, AUDIT_TYPES.editLockMaintenance, data, { root })
-      else audit(null, AUDIT_TYPES.editLockMaintenance, data)
-    }
     for (const callback of listeners) callback()
   })
 
@@ -126,11 +85,10 @@ return (ctx, config = {}) => {
   // built-in catalog.
   const offLspAdmin = wireLspAdmin(ctx, () => compute().lsp?.servers)
 
-  const offMaintenance = wireEditLockMaintenance(ctx, { savedEnabled, evidence: editLockEvidence, candidateRoots })
   // Environment facts endpoint (settings-page `when: { env }` rows): same
   // settings-row wiring as the LSP endpoints above (S19).
   const offEnvAdmin = wireEnvAdmin(ctx)
-  return () => { offMaintenance(); offLspAdmin(); offEnvAdmin(); listeners.clear() }
+  return () => { offLspAdmin(); offEnvAdmin(); listeners.clear() }
 }
 }
 const apply = createSettingsPlugin()

package/src/settings/sections.js

@@ -43,17 +43,6 @@ const FIELDS = [
   { key: 'guardSoftThreshold', section: 'contextGuard', field: 'softThreshold', type: 'number', description: 'Soft pressure threshold (live advisory; 0 < soft < hard < 1)' },
   { key: 'guardHardThreshold', section: 'contextGuard', field: 'hardThreshold', type: 'number', description: 'Hard pressure threshold (live maintenance request; not a completion guarantee)' },
   { key: 'hashlineHideStockEdit', section: 'hashlineEdit', field: 'hideStockEdit', type: 'boolean', description: 'Hide the stock edit tool (hash_edit only)', restart: true },
-  { key: 'editLockEnabled', section: 'editLock', field: 'enabled', type: 'boolean', description: 'Edit Lock cross-session file ownership (default on; explicit off applies after restart)', restart: true },
-  // Retention (design D1/D2): one lock batch shares one cumulative allowance, so a
-  // session reads one expiry instead of N countdowns. These keys are policy, not
-  // mechanism: the kernel never sees them, the lifecycle resolves them per call.
-  { key: 'editLockHoldDefaultMinutes', section: 'editLock', field: 'holdDefaultMinutes', type: 'number', description: 'Edit Lock: retention minutes used when a session asks to keep its locks without giving a period (default 30)', page: false },
-  { key: 'editLockHoldSingleMaxMinutes', section: 'editLock', field: 'holdSingleMaxMinutes', type: 'number', description: 'Edit Lock: most minutes one retention request may ask for (default 30)', page: false },
-  { key: 'editLockHoldCumulativeMaxMinutes', section: 'editLock', field: 'holdCumulativeMaxMinutes', type: 'number', description: 'Edit Lock: cumulative retention minutes one batch of locks may use; asks beyond it are refused and only release remains (default 120)', page: false },
-  { key: 'editLockNudgeAttempts', section: 'editLock', field: 'nudgeAttempts', type: 'number', description: 'Edit Lock: how many times a finished turn is continued to ask for still-held locks to be released or retained (default 2)', page: false },
-  { key: 'editLockNudgeFallback', section: 'editLock', field: 'nudgeFallback', type: { union: ['release', 'abnormal'] }, description: 'Edit Lock: disposition of locks still held after those notices are used up; release frees the files for other sessions, abnormal keeps them for the user (default release)', page: false },
-  { key: 'editLockAutoResume', section: 'editLock', field: 'autoResume', type: 'boolean', description: 'Edit Lock: a genuine user message automatically resumes a stopped or administratively revoked session and retries a duplicate-binding failure (default on)' },
-  { key: 'editLockStaleSweep', section: 'editLock', field: 'staleSweep', type: 'boolean', description: 'Edit Lock: a genuine user message silently releases locks whose target file no longer exists (default on; read per message, applies immediately)' },
   { key: 'robashEnabled', section: 'robash', field: 'enabled', type: 'boolean', description: 'Guarded read-only bash for curated agents (master switch)' },
   { key: 'robashAllow', section: 'robash', field: 'allow', type: 'string', list: true, description: 'JSON array of command names to APPEND to the product-default bash allow list (empty adds nothing; the defaults are always in effect)' },
   { key: 'robashGitAllow', section: 'robash', field: 'gitAllow', type: 'string', list: true, description: 'JSON array of git subcommands to APPEND to the product-default git allow list (empty adds nothing; the defaults are always in effect)' },
@@ -72,7 +61,7 @@ const FIELDS = [
   { key: 'worktreeAutoSetup', section: 'worktree', field: 'autoSetup', type: 'boolean', description: 'Install dependencies in a new lane automatically (configured setup, else lockfile-derived)' },
   { key: 'worktreeWatchTimeoutMinutes', section: 'worktree', field: 'watchTimeoutMinutes', type: 'number', description: 'Minutes a lane-state watch (worktree_watch) lives before expiring with one notice (default 360 = 6 hours, minimum 1); frozen per watch at subscribe time' },
   { key: 'worktreeAutoApprove', section: 'worktree', field: 'autoApprove', type: { union: ['manual', 'auto-keep', 'auto-clean'] }, description: 'Worktree auto-approve mode: manual shows every decision card; auto-keep auto-approves merges and abandons, removing the worktree but keeping the branch; auto-clean also deletes the branch. The initial mode for sessions without a /worktree approve override (default auto-clean); a session override wins over this global value' },
-  { key: 'lspServers', section: 'lsp', field: 'servers', type: 'string', description: 'JSON map of custom language servers: family → { command, args?, manifests?, installHint?, install? }' },
+  { key: 'lspServers', section: 'lsp', field: 'servers', type: 'string', description: 'JSON map of custom language servers: family → { command, args?, manifests?, installHint?, platforms?, install? }; a platforms map ({ darwin?, linux?, win32?, default? }) overrides only the fields its row declares for that platform' },
   { key: 'notifyEnabled', section: 'notify', field: 'enabled', type: 'boolean', description: 'System notifications master switch: tell the user when a session needs them or a turn finishes' },
   { key: 'notifyOnComplete', section: 'notify', field: 'onComplete', type: 'boolean', description: 'Notify when a turn finishes (only turns longer than notifyMinTurnSeconds)' },
   { key: 'notifyOnAttention', section: 'notify', field: 'onAttention', type: 'boolean', description: 'Notify when a session needs the user: approval, question, plan review, a failed or stopped turn' },
@@ -98,8 +87,8 @@ export { FIELDS }
 
 /** Product defaults of the flat settings keys, mirrored from the consuming
  * modules' code defaults (intent-gate classifier, delegate supervision,
- * todo driver, context guard, edit-lock retention, robash, lsp, worktree,
- * notify). This is the canonical declaration: the cordis.patch.yml
+ * todo driver, context guard, robash, lsp, worktree, notify). This is the
+ * canonical declaration: the cordis.patch.yml
  * weir-settings row carries the same values so saved profiles resolve
  * them, and the settings page mirrors this table client-side to SHOW the
  * effective default of an unset field (both directions pinned by test).
@@ -121,14 +110,6 @@ export const FIELD_DEFAULTS = Object.freeze({
   guardSoftThreshold: 0.72,
   guardHardThreshold: 0.88,
   hashlineHideStockEdit: true,
-  editLockEnabled: true,
-  editLockHoldDefaultMinutes: 30,
-  editLockHoldSingleMaxMinutes: 30,
-  editLockHoldCumulativeMaxMinutes: 120,
-  editLockNudgeAttempts: 2,
-  editLockNudgeFallback: 'release',
-  editLockAutoResume: true,
-  editLockStaleSweep: true,
   robashEnabled: true,
   lspEnabled: false,
   lspIdleMs: 600000,
@@ -227,19 +208,42 @@ function chainsValidator(key) {
   return validate
 }
 
-/** Parse + validate the lspServers JSON map (bad input fails activation loud). */
+/** True for a JSON object literal (arrays and null are not plain objects). */
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** Parse + validate the lspServers JSON map (bad input fails activation loud).
+ *  A family may declare `platforms: { darwin?, linux?, win32?, default? }`,
+ *  each row shaped like an entry with every field optional; a malformed row
+ *  names the family and field so activation failure is diagnosable (D6). */
 function validateLspServers(raw) {
   const parsed = JSON.parse(raw)
-  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+  if (!isPlainObject(parsed)) {
     throw new Error('weir-settings: lspServers must be a JSON object map')
   }
   for (const [family, entry] of Object.entries(parsed)) {
-    if (!entry || typeof entry !== 'object' || typeof entry.command !== 'string' || entry.command.trim().length === 0) {
+    if (!isPlainObject(entry) || typeof entry.command !== 'string' || entry.command.trim().length === 0) {
       throw new Error(`weir-settings: lspServers.${family} needs a { command } entry`)
     }
     if (entry.args !== undefined && !Array.isArray(entry.args)) {
       throw new Error(`weir-settings: lspServers.${family}.args must be an array`)
     }
+    if (entry.platforms === undefined) continue
+    if (!isPlainObject(entry.platforms)) {
+      throw new Error(`weir-settings: lspServers.${family}.platforms must be a JSON object map`)
+    }
+    for (const [platform, row] of Object.entries(entry.platforms)) {
+      if (!isPlainObject(row)) {
+        throw new Error(`weir-settings: lspServers.${family}.platforms.${platform} must be a JSON object`)
+      }
+      if (row.command !== undefined && (typeof row.command !== 'string' || row.command.trim().length === 0)) {
+        throw new Error(`weir-settings: lspServers.${family}.platforms.${platform}.command must be a non-empty string`)
+      }
+      if (row.args !== undefined && !Array.isArray(row.args)) {
+        throw new Error(`weir-settings: lspServers.${family}.platforms.${platform}.args must be an array`)
+      }
+    }
   }
   return parsed
 }
@@ -337,9 +341,6 @@ export function computeSections(config, { readDefaults } = {}) {
         }
       }
     }
-    // A saved profile row replaces the bundle row wholesale. An omitted key
-    // must still activate protection; a saved false remains an explicit opt-out.
-    if (key === 'editLock' && out.enabled === undefined) out.enabled = FIELD_DEFAULTS.editLockEnabled
     if (key === 'contextGuard') guardOptions(out)
     if (key === 'lsp' && typeof out.servers === 'string' && out.servers.trim().length > 0) {
       out.servers = parseJsonField(validateLspServers, out.servers)

package/src/shared/audit.js

@@ -23,7 +23,6 @@ export const AUDIT_TYPES = Object.freeze({
   compaction: 'compaction',
   supervision: 'supervision',
   worktree: 'worktree',
-  editLockMaintenance: 'edit-lock-maintenance',
   // Session capability manager (tasks 4.2+): one record per durable Apply
   // acceptance or receipt-query recovery; never commit evidence by itself.
   capabilityApply: 'capability-apply',
@@ -48,6 +47,12 @@ export const AUDIT_TYPES = Object.freeze({
   // spawn carrying the composition the child's creation window applies, so a
   // host restart can replay it — the shim itself is runtime-only state.
   delegate: 'delegate',
+  // File-lease degraded managed writes (edit-lock-rebuild D7): one record per
+  // degradation, carrying the kind, the owner (session and lineage), the path
+  // COUNT and the failure reason — never path contents. The lease client owns
+  // the per-process rate limit (one record per window); the emit site adds no
+  // throttle of its own and a failed emit never blocks a write.
+  fileLease: 'file-lease',
 })
 /**
  * Known dynamic sub-event kinds: `<type>/<kind>` events emitted beside a base