wicked-crew 0.5.0 → 0.7.0

package/dist/api/run-files.js

@@ -0,0 +1,271 @@
+// GET /runs/:id/files + GET /runs/:id/diff machinery (DES-FEEDBACK-002 CREW-1).
+//
+// The studio's in-app file & diff viewer cannot read the daemon host's filesystem, so the daemon
+// serves the bytes — which is exactly why every path is contained FIRST against the same root set
+// `POST /open` validates (`allowedRootsFor` + `isInsideRoot`, open-path.ts), every payload is
+// capped, and git runs through `execCapped` with argv arrays only (never a shell string) and
+// `--no-ext-diff` (a configured external diff driver must never execute here). Both routes are
+// read-only by construction: `fs` reads and `git diff`/`git status` — zero write capability, a
+// strictly smaller threat surface than `/open` handing the path to an OS opener.
+import { promises as fsp } from 'node:fs';
+import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
+/** File-content cap (DES-FEEDBACK-002 §3.3): past this, `content` holds the first 512 KB and
+ *  `truncated: true` — the studio renders a labeled truncation banner, never a silent amputation. */
+export const FILE_CONTENT_CAP_BYTES = 512 * 1024;
+/** Binary sniff window: a NUL byte in the first 8 KB ⇒ `binary: true`, `content: ""` — the studio
+ *  falls back to the external-open affordance rather than rendering mojibake. */
+export const BINARY_SNIFF_BYTES = 8 * 1024;
+/** Diff output cap (§3.3): past this the diff is cut at 1 MB and `truncated: true`. */
+export const DIFF_OUTPUT_CAP_BYTES = 1024 * 1024;
+/** The target exists but is not a regular file (directory, socket, …) — the route's 400, distinct
+ *  from ENOENT's 404. Serving directory listings is explicitly out of scope (§3.3). */
+export class NotARegularFileError extends Error {
+    path;
+    constructor(path) {
+        super(`not a regular file: ${path}`);
+        this.path = path;
+        this.name = 'NotARegularFileError';
+    }
+}
+/**
+ * Read at most `FILE_CONTENT_CAP_BYTES` of `target`. The open-then-fstat order (not stat-then-open)
+ * closes the classic swap race: the size and the bytes come from the SAME open file description.
+ * Callers must have contained `target` already — this function does filesystem work only.
+ */
+export async function readFileCapped(target) {
+    const fh = await fsp.open(target, 'r');
+    try {
+        const st = await fh.stat();
+        if (!st.isFile())
+            throw new NotARegularFileError(target);
+        const size = st.size;
+        const toRead = Math.min(size, FILE_CONTENT_CAP_BYTES);
+        const buf = Buffer.alloc(toRead);
+        let off = 0;
+        while (off < toRead) {
+            const { bytesRead } = await fh.read(buf, off, toRead - off, off);
+            if (bytesRead === 0)
+                break; // file shrank underneath us — serve what exists
+            off += bytesRead;
+        }
+        const got = buf.subarray(0, off);
+        if (got.subarray(0, Math.min(off, BINARY_SNIFF_BYTES)).includes(0)) {
+            return { content: '', size, truncated: false, binary: true };
+        }
+        return { content: got.toString('utf8'), size, truncated: size > FILE_CONTENT_CAP_BYTES, binary: false };
+    }
+    finally {
+        await fh.close();
+    }
+}
+const GIT_TIMEOUT_MS = 10_000;
+// ── Diff base (DES-UX-001 §8.1, CREW-UX-1) ─────────────────────────────────────────────────────
+/** `?base=merge-base` — the one non-ref literal: diff against `git merge-base <default-branch>
+ *  HEAD`, i.e. the run branch's fork point, so committed run work is visible (§8.1). */
+export const MERGE_BASE_LITERAL = 'merge-base';
+/** `base` is not a plain ref — a flag, a path, a revision range, a separator. Rejected BEFORE any
+ *  git process sees it: the query parameter is a diff baseline, never a command surface (§8.1). */
+export class InvalidDiffBaseError extends Error {
+    base;
+    constructor(base) {
+        super('`base` must be a plain git ref (branch, tag, or commit id) — ' +
+            'flags, paths, revision ranges, and separators are rejected');
+        this.base = base;
+        this.name = 'InvalidDiffBaseError';
+    }
+}
+/** `base` is well-formed but does not resolve to a commit inside the run's repo — containment:
+ *  a ref from another repo (or thin air) is a 400, never a git error surfaced as a 500. */
+export class UnresolvableDiffBaseError extends Error {
+    base;
+    constructor(base, detail) {
+        super(`unresolvable \`base\`: ${detail}`);
+        this.base = base;
+        this.name = 'UnresolvableDiffBaseError';
+    }
+}
+/** A plain ref: git's own charset for the safe subset — alphanumeric start (excludes `-flag`,
+ *  `.hidden`, `/abs/path`), then word/dot/slash/dash. `..` (ranges AND traversal), `~`/`^`/`@{}`
+ *  (rev operators), `:`, whitespace, and `;` are all outside the charset or explicitly banned. */
+const PLAIN_REF_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
+export function isPlainRef(base) {
+    return PLAIN_REF_RE.test(base) && !base.includes('..') && !base.endsWith('/');
+}
+/** One contained git read: argv array (never a shell string), capped, cwd-scoped to the run's
+ *  workdir. Returns trimmed stdout, or `null` ONLY when git ran to completion and answered "no"
+ *  (unresolvable ref, no merge base, …) — a plain non-zero exit. Operational failures are never
+ *  `null`: ENOENT (git missing), "not a git repository", a timed-out/killed process (`killed`/
+ *  `signal` set), and output-cap overflow all rethrow, so they surface as the route's 500 rather
+ *  than masquerading as a 400 "unresolvable base" (Copilot, #307). */
+async function gitQuery(workdir, args) {
+    try {
+        const { stdout } = await execCapped('git', args, { timeout: GIT_TIMEOUT_MS, cwd: workdir });
+        return stdout.trim();
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            throw err;
+        if (err instanceof ExecOutputTooLarge)
+            throw err;
+        const proc = err;
+        if (proc.killed === true || (proc.signal !== undefined && proc.signal !== null))
+            throw err;
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.toLowerCase().includes('not a git repository'))
+            throw err;
+        return null;
+    }
+}
+/** SHA shapes rev-parse may emit (SHA-1 today, SHA-256 repos exist). Anything else is treated as
+ *  "did not resolve" — the resolved value is what reaches `git diff`, never the caller's text. */
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/;
+/**
+ * Resolve `?base=` to a commit SHA inside the run's repo, or throw the route's named 400s.
+ * Two accepted spellings (§8.1): the literal `merge-base` → `git merge-base <default-branch>
+ * HEAD`; or a plain ref that `git rev-parse --verify` resolves IN THIS repo. Everything git
+ * ultimately diffs against is the resolved SHA — the raw parameter never reaches `git diff`,
+ * and `--end-of-options` keeps even a validated ref from ever parsing as a flag.
+ */
+async function resolveDiffBase(workdir, base) {
+    if (base === MERGE_BASE_LITERAL) {
+        // Default branch: origin's HEAD when the repo has one, else local main/master.
+        let branch = null;
+        const symref = await gitQuery(workdir, ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD']);
+        if (symref !== null && symref.startsWith('refs/remotes/')) {
+            branch = symref.slice('refs/remotes/'.length);
+        }
+        else {
+            for (const cand of ['main', 'master']) {
+                if ((await gitQuery(workdir, ['rev-parse', '--verify', `refs/heads/${cand}`])) !== null) {
+                    branch = cand;
+                    break;
+                }
+            }
+        }
+        if (branch === null) {
+            throw new UnresolvableDiffBaseError(base, 'no default branch found in this repo to merge-base against');
+        }
+        const sha = await gitQuery(workdir, ['merge-base', '--end-of-options', branch, 'HEAD']);
+        if (sha === null || !COMMIT_SHA_RE.test(sha)) {
+            throw new UnresolvableDiffBaseError(base, `no merge base between ${branch} and HEAD`);
+        }
+        return sha;
+    }
+    if (!isPlainRef(base))
+        throw new InvalidDiffBaseError(base);
+    const sha = await gitQuery(workdir, [
+        'rev-parse',
+        '--verify',
+        '--end-of-options',
+        `${base}^{commit}`,
+    ]);
+    if (sha === null || !COMMIT_SHA_RE.test(sha)) {
+        throw new UnresolvableDiffBaseError(base, `ref does not resolve inside the run's repo: ${base}`);
+    }
+    return sha;
+}
+/** Git's ways of saying "there is nothing here to diff" — a real answer (`diff: ""`), not an
+ *  error. Mirrors the git-history route's tolerance (routes.ts): a workdir that is not a repo, or
+ *  a repo with no commits yet (`HEAD` unresolvable — every file is untracked and the untracked
+ *  pass still runs for the commit-less case). */
+function isEmptyDiffAnswer(msg) {
+    // Case-insensitive on the repo check: `git log` says "fatal: not a git repository" but
+    // `git diff` says "warning: Not a git repository. Use --no-index …" — measured, not assumed.
+    const lower = msg.toLowerCase();
+    return (lower.includes('not a git repository') ||
+        msg.includes('does not have any commits') ||
+        msg.includes("ambiguous argument 'HEAD'") ||
+        msg.includes('unknown revision'));
+}
+/**
+ * The run's worktree diff against `base` (default HEAD) — staged + unstaged in one answer — with
+ * untracked files appended as `git diff --no-index /dev/null <file>` all-addition hunks (§3.3: a
+ * run's *created* files must diff as additions rather than vanish). `relPath`, when given, narrows
+ * both passes to that one file; it is always a single argv element after `--` (the open-path rule
+ * — no shell string is ever composed). The literal `/dev/null` is git's own cross-platform
+ * null-device spelling (git special-cases it, including on Windows).
+ *
+ * `base` (CREW-UX-1, DES-UX-001 §8.1): the literal `merge-base` diffs from the run branch's fork
+ * point off the default branch — committed run work becomes visible; a plain ref diffs from that
+ * ref, resolved inside this repo first (`resolveDiffBase` — the raw parameter never reaches
+ * `git diff`). Throws `InvalidDiffBaseError` / `UnresolvableDiffBaseError` for the route's 400s.
+ */
+export async function worktreeDiff(workdir, relPath, base) {
+    const limit = relPath === undefined ? [] : ['--', relPath];
+    let out = '';
+    // Resolve the baseline BEFORE any diff pass: a bad `base` must 400 without partial output.
+    let baseRev = 'HEAD';
+    if (base !== undefined && base.length > 0) {
+        try {
+            baseRev = await resolveDiffBase(workdir, base);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                throw err; // git missing — 500
+            const msg = err instanceof Error ? err.message : String(err);
+            // The route's standing tolerance: a non-repo workdir answers an empty diff for any
+            // WELL-FORMED base — a malformed base has already thrown InvalidDiffBaseError above,
+            // and that 400 wins over the tolerance (Copilot, #307).
+            if (msg.toLowerCase().includes('not a git repository'))
+                return { diff: '', truncated: false };
+            throw err;
+        }
+    }
+    // Tracked changes (staged + unstaged, plus committed-since-base when a base was resolved):
+    // diff the worktree against the baseline.
+    try {
+        const { stdout } = await execCapped('git', ['diff', '--no-color', '--no-ext-diff', baseRev, ...limit], { timeout: GIT_TIMEOUT_MS, cwd: workdir });
+        out = stdout;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            throw err; // git missing — the route's 500
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.toLowerCase().includes('not a git repository'))
+            return { diff: '', truncated: false };
+        if (!isEmptyDiffAnswer(msg))
+            throw err;
+        // No commits yet: tracked diff is vacuously empty; fall through to the untracked pass.
+    }
+    // Untracked files → all-addition hunks. `-z` (NUL separators, no quoting) + `-uall` (individual
+    // files, never a collapsed `?? dir/` entry that --no-index could not diff).
+    const { stdout: statusOut } = await execCapped('git', ['status', '--porcelain', '-z', '-uall', ...limit], { timeout: GIT_TIMEOUT_MS, cwd: workdir });
+    const untracked = statusOut
+        .split('\0')
+        .filter((entry) => entry.startsWith('?? '))
+        .map((entry) => entry.slice(3));
+    for (const file of untracked) {
+        // Cap is in BYTES; `out.length` counts UTF-16 code units. `>=`: exactly-at-cap is
+        // already done — spawning one more git only to discard its output is waste (Copilot, #305).
+        if (Buffer.byteLength(out, 'utf8') >= DIFF_OUTPUT_CAP_BYTES)
+            break;
+        try {
+            const { stdout } = await execCapped('git', ['diff', '--no-color', '--no-ext-diff', '--no-index', '--', '/dev/null', file], { timeout: GIT_TIMEOUT_MS, cwd: workdir });
+            out += stdout;
+        }
+        catch (err) {
+            // `--no-index` exits 1 WHEN THE FILES DIFFER — which is every hit here. The diff is still
+            // on stdout; only a stdout-less failure is a real error.
+            const stdout = err.stdout;
+            if (typeof stdout === 'string' && stdout.length > 0)
+                out += stdout;
+            else if (err.code === 'ENOENT')
+                throw err;
+            else
+                throw err;
+        }
+    }
+    // Byte-accurate cap (Copilot, #305): `slice` on the string counts UTF-16 code units, which
+    // under-enforces for non-ASCII diffs. Cut on the UTF-8 byte buffer, then back off any
+    // incomplete trailing multibyte sequence — decoding a torn tail yields U+FFFD, which
+    // re-encodes LARGER and would breach the cap by a byte.
+    const outBytes = Buffer.from(out, 'utf8');
+    if (outBytes.byteLength > DIFF_OUTPUT_CAP_BYTES) {
+        let end = DIFF_OUTPUT_CAP_BYTES;
+        while (end > 0 && (outBytes[end] & 0xc0) === 0x80)
+            end--; // land on a sequence boundary
+        return { diff: outBytes.subarray(0, end).toString('utf8'), truncated: true };
+    }
+    return { diff: out, truncated: false };
+}
+//# sourceMappingURL=run-files.js.map

package/dist/api/run-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-files.js","sourceRoot":"","sources":["../../src/api/run-files.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,6FAA6F;AAC7F,+FAA+F;AAC/F,+FAA+F;AAC/F,iFAAiF;AAEjF,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEjE;qGACqG;AACrG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEjD;iFACiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAE3C,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUjD;uFACuF;AACvF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QADlB,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,MAAM,EAAE,CAAC;YACpB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM,CAAC,gDAAgD;YAC9E,GAAG,IAAI,SAAS,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1G,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAQD,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,kGAAkG;AAElG;wFACwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C;mGACmG;AACnG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CACH,+DAA+D;YAC7D,4DAA4D,CAC/D,CAAC;QAJiB,SAAI,GAAJ,IAAI,CAAQ;QAK/B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;2FAC2F;AAC3F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAArB,YAAqB,IAAY,EAAE,MAAc;QAC/C,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QADvB,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;kGAEkG;AAClG,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;sEAKsE;AACtE,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAc;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,IAAI,GAAG,GAAmD,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;YAAE,MAAM,GAAG,CAAC;QAC3F,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,MAAM,GAAG,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;kGACkG;AAClG,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC1D,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,+EAA+E;QAC/E,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAChG,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxF,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CACjC,IAAI,EACJ,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CAAC,IAAI,EAAE,yBAAyB,MAAM,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE;QAClC,WAAW;QACX,UAAU;QACV,kBAAkB;QAClB,GAAG,IAAI,WAAW;KACnB,CAAC,CAAC;IACH,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CAAC,IAAI,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;iDAGiD;AACjD,SAAS,iBAAiB,CAAC,GAAW;IACpC,uFAAuF;IACvF,6FAA6F;IAC7F,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,OAAgB,EAChB,IAAa;IAEb,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,2FAA2F;IAC3F,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC,CAAC,oBAAoB;YACrF,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,mFAAmF;YACnF,qFAAqF;YACrF,wDAAwD;YACxD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,0CAA0C;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CACjC,KAAK,EACL,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAC1D,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,CAC1C,CAAC;QACF,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC,CAAC,gCAAgC;QACjG,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9F,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QACvC,uFAAuF;IACzF,CAAC;IAED,gGAAgG;IAChG,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,UAAU,CAC5C,KAAK,EACL,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAClD,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,SAAS;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,kFAAkF;QAClF,4FAA4F;QAC5F,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,qBAAqB;YAAE,MAAM;QACnE,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CACjC,KAAK,EACL,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAC9E,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,CAC1C,CAAC;YACF,GAAG,IAAI,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0FAA0F;YAC1F,yDAAyD;YACzD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;YACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,IAAI,MAAM,CAAC;iBAC9D,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;;gBAChE,MAAM,GAAG,CAAC;QACjB,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,sFAAsF;IACtF,qFAAqF;IACrF,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAChD,IAAI,GAAG,GAAG,qBAAqB,CAAC;QAChC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,EAAE,CAAC,CAAC,8BAA8B;QACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC"}

package/dist/api/seat-health.d.ts

@@ -0,0 +1,55 @@
+import type { CoreEvent, SeatHealth } from '../core/types.js';
+export type { SeatHealth };
+/** Rolling window for the repeated-acpFallback rule. */
+export declare const FALLBACK_WINDOW_MS: number;
+/** Fallbacks within the window that flip a seat inactive. */
+export declare const FALLBACK_THRESHOLD = 3;
+/**
+ * In-memory per-seat health, folded from live CoreEvents. In-memory ON PURPOSE: health is a
+ * statement about the running platform's ability to reach a CLI right now — a daemon restart
+ * genuinely does not know, and "assume active, let the next failure/probe speak" is the honest
+ * default (and the one the declarative-roster doctrine implies).
+ */
+export declare class SeatHealthTracker {
+    private readonly entries;
+    /** `${session}:${ord}` → cli key. `unitOutputCaptured` carries no seat; this is the correlation. */
+    private readonly assignments;
+    /** cli key → recent failure-fallback timestamps (epoch ms), pruned to the rolling window. */
+    private readonly fallbacks;
+    /** Default `since` for seats that have never changed state. */
+    private readonly startedAt;
+    /** Fold one CoreEvent into the map. Safe on every event type; unknown types are ignored. */
+    ingest(event: CoreEvent): void;
+    /** Flip a seat ACTIVE: message cleared, `since` updated on a genuine transition. */
+    markActive(key: string, atMs?: number): void;
+    /** Flip a seat INACTIVE with the error excerpt; `since` survives while already inactive. */
+    markInactive(key: string, message: string, atMs?: number): void;
+    /** The seat's health — a seat never seen in an event is ACTIVE with no message (the default). */
+    healthFor(key: string): SeatHealth;
+}
+/** The roster slice the probe needs (a `RosterSeat` satisfies it structurally). */
+export interface ProbeSeat {
+    key: string;
+    /** The seat's cheap liveness command, e.g. `["claude", "--version"]`. */
+    version_probe?: unknown;
+    [k: string]: unknown;
+}
+export interface SeatProbeOptions {
+    /** Probe cadence. Default 10 minutes — a recovery path, not a monitor. */
+    intervalMs?: number;
+    /** Per-probe timeout. Default 5s; a probe that hangs counts as still-down. */
+    timeoutMs?: number;
+    /** Injectable prober (tests). Resolve `true` ⇔ the command exited 0. */
+    runProbe?: (argv: string[], timeoutMs: number) => Promise<boolean>;
+    log?: (m: string) => void;
+}
+/**
+ * The low-frequency recovery probe (crew#274 §3): every `intervalMs`, for INACTIVE seats only,
+ * run the seat's `version_probe`; exit 0 flips the seat active with the message cleared. Quota
+ * resets and re-logins are thus detected without operator action. Callers own the guard against
+ * probing in tests (the daemon arms this from `createServer`, env-gated).
+ */
+export declare function startSeatHealthProbe(tracker: SeatHealthTracker, roster: () => ProbeSeat[], opts?: SeatProbeOptions): {
+    stop(): void;
+};
+//# sourceMappingURL=seat-health.d.ts.map

package/dist/api/seat-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-health.d.ts","sourceRoot":"","sources":["../../src/api/seat-health.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9D,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AACjD,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAiCpC;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,oGAAoG;IACpG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IACzD,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IAEtD,4FAA4F;IAC5F,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAoG9B,oFAAoF;IACpF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,IAAI;IAUhD,4FAA4F;IAC5F,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,IAAI;IAWnE,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;CAGnC;AAED,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B;AAcD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,SAAS,EAAE,EACzB,IAAI,GAAE,gBAAqB,GAC1B;IAAE,IAAI,IAAI,IAAI,CAAA;CAAE,CAmDlB"}

package/dist/api/seat-health.js

@@ -0,0 +1,273 @@
+// Seat health (crew#274): runtime health per council seat, folded from the live CoreEvent stream.
+//
+// The operator doctrine this implements (recorded in ~/.config/wicked-council/clis.toml): every
+// CLI seat stays LISTED and ENABLED in config — quota/auth/runtime errors are RUNTIME state the
+// platform detects and DISPLAYS (`inactive` + the error excerpt), never a hand-edited disable.
+// The old pattern left stale disables behind: quotas that had long reset, and an "out of credits"
+// comment masking what had become a `401 Unauthorized` needing a re-login.
+//
+// The fold (one rule per event, shared by every caller — the gate-cache posture):
+//
+// - `stepFailed` marks the seat INACTIVE when the failure is seat-level: `failureKind:
+//   "workerError"` (the CLI process itself failed — crew#277 asks exactly this stamp), or a
+//   `detail` naming the wrapped runner's "(cli `x` exited N)" message, an ACP "timeout waiting",
+//   or an auth/quota string (401/unauthorized/quota/rate-limit/credits). The seat is read from
+//   the detail when it names one, else from the unit's `unitDistributed` assignment.
+// - `acpFallback` is NOT alone inactive — `session_died` falls back to single-shot and the unit
+//   can still succeed — but REPEATED fallback (3+ in 10 minutes) is a seat that cannot hold a
+//   session, and that is. `governance_requires_wrapped` is deliberate routing, not a failure,
+//   and never counts.
+// - `unitOutputCaptured` with `stepStatus: "ok"` marks the assigned seat ACTIVE again and clears
+//   the message (the event carries no seat, so `unitDistributed`/`unitReassigned` are folded
+//   into a per-unit assignment map for the correlation).
+//
+// Recovery without an ok output comes from `startSeatHealthProbe`: every `intervalMs` (default
+// 10 minutes), INACTIVE seats only, run the seat's `version_probe` command with a short timeout;
+// exit 0 flips the seat active. Active seats are never probed — this is a recovery path, not a
+// monitor.
+import { execCapped } from '../core/exec.js';
+/** Rolling window for the repeated-acpFallback rule. */
+export const FALLBACK_WINDOW_MS = 10 * 60 * 1000;
+/** Fallbacks within the window that flip a seat inactive. */
+export const FALLBACK_THRESHOLD = 3;
+/** Health messages are operator-facing chips, not transcripts — bound them hard. */
+const EXCERPT_MAX = 240;
+function excerpt(s) {
+    const flat = s.replace(/\s+/g, ' ').trim();
+    return flat.length <= EXCERPT_MAX ? flat : `${flat.slice(0, EXCERPT_MAX - 1)}…`;
+}
+/** The wrapped runner's seat-naming failure message: "(cli `x` exited N) …" (execute_wrapped.rs). */
+const CLI_IN_DETAIL = /\(cli `([^`]+)` exited /;
+/**
+ * Seat-level failure signatures in a `stepFailed` detail. Deliberately narrow: a unit that failed
+ * its WORK (missing deliverable, gate veto) says nothing about the seat's health, so only strings
+ * that name the CLI process, its transport, or its account state qualify.
+ */
+const SEAT_FAILURE_PATTERNS = [
+    CLI_IN_DETAIL, // non-zero exit, seat named by the runner itself
+    /timeout waiting/i, // ACP "timeout waiting for response id=…" (acp_runner.rs)
+    /\b401\b|\bunauthorized\b/i, // auth: needs a re-login
+    /\bquota\b|rate.?limit|too many requests|\b429\b/i, // quota/rate ceiling
+    /\bout of credits\b|\binsufficient credits\b/i, // account balance
+];
+/** `acpFallback` kinds that are deliberate routing rather than a failure — never counted. */
+const BENIGN_FALLBACK_KINDS = new Set(['governance_requires_wrapped']);
+function str(v) {
+    return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
+/**
+ * In-memory per-seat health, folded from live CoreEvents. In-memory ON PURPOSE: health is a
+ * statement about the running platform's ability to reach a CLI right now — a daemon restart
+ * genuinely does not know, and "assume active, let the next failure/probe speak" is the honest
+ * default (and the one the declarative-roster doctrine implies).
+ */
+export class SeatHealthTracker {
+    entries = new Map();
+    /** `${session}:${ord}` → cli key. `unitOutputCaptured` carries no seat; this is the correlation. */
+    assignments = new Map();
+    /** cli key → recent failure-fallback timestamps (epoch ms), pruned to the rolling window. */
+    fallbacks = new Map();
+    /** Default `since` for seats that have never changed state. */
+    startedAt = new Date().toISOString();
+    /** Fold one CoreEvent into the map. Safe on every event type; unknown types are ignored. */
+    ingest(event) {
+        // Replayed log entries carry the engine's capture-time `ts`; live frames don't, and for
+        // those "now" IS the observation time (the gate-cache's observedAt rule).
+        const at = typeof event.ts === 'number' ? event.ts : Date.now();
+        const session = str(event.session);
+        const ord = typeof event.ord === 'number' ? event.ord : undefined;
+        switch (event.type) {
+            case 'unitDistributed': {
+                const cli = str(event.cli);
+                if (session !== undefined && ord !== undefined && cli !== undefined) {
+                    this.assignments.set(`${session}:${ord}`, cli);
+                }
+                return;
+            }
+            case 'unitReassigned': {
+                // `newCli: null` means the council re-convenes — the follow-up unitDistributed will set
+                // the new seat. DROP the stale assignment meanwhile: leaving it in place would attribute
+                // the interregnum's events to the seat that was just taken off the unit (Copilot, #279).
+                const newCli = str(event.newCli);
+                if (session !== undefined && ord !== undefined && newCli === undefined) {
+                    this.assignments.delete(`${session}:${ord}`);
+                }
+                if (session !== undefined && ord !== undefined && newCli !== undefined) {
+                    this.assignments.set(`${session}:${ord}`, newCli);
+                }
+                return;
+            }
+            case 'unitOutputCaptured': {
+                if (event.stepStatus !== 'ok' || session === undefined || ord === undefined)
+                    return;
+                const seat = this.assignments.get(`${session}:${ord}`);
+                if (seat !== undefined)
+                    this.markActive(seat, at);
+                return;
+            }
+            case 'stepFailed': {
+                const detail = typeof event.detail === 'string' ? event.detail : '';
+                const failureKind = str(event.failureKind);
+                // The detail names the seat when the wrapped runner produced it; otherwise fall back to
+                // the unit's assignment (a workerError detail is the CLI's own output and rarely does).
+                const named = CLI_IN_DETAIL.exec(detail)?.[1];
+                const assigned = session !== undefined && ord !== undefined
+                    ? this.assignments.get(`${session}:${ord}`)
+                    : undefined;
+                const seat = named ?? assigned;
+                if (seat === undefined)
+                    return;
+                const seatLevel = failureKind === 'workerError' || SEAT_FAILURE_PATTERNS.some((re) => re.test(detail));
+                if (seatLevel) {
+                    const msg = excerpt(detail) || `seat failure (${failureKind ?? 'unreported'})`;
+                    this.markInactive(seat, msg, at);
+                }
+                return;
+            }
+            case 'acpFallback': {
+                const cliKey = str(event.cliKey);
+                const fallbackKind = str(event.fallbackKind);
+                if (cliKey === undefined)
+                    return;
+                if (fallbackKind !== undefined && BENIGN_FALLBACK_KINDS.has(fallbackKind))
+                    return;
+                const fresh = (this.fallbacks.get(cliKey) ?? []).filter((t) => at - t < FALLBACK_WINDOW_MS);
+                fresh.push(at);
+                this.fallbacks.set(cliKey, fresh);
+                if (fresh.length >= FALLBACK_THRESHOLD) {
+                    const reason = str(event.reason) ?? fallbackKind ?? 'unknown';
+                    this.markInactive(cliKey, `repeated ACP fallback (${fresh.length} in 10 min): ${reason}`, at);
+                }
+                else {
+                    // One fallback is not inactive (session death falls back and the unit can still work),
+                    // but it IS an observed error — stamp lastErrorAt without flipping the status.
+                    const prev = this.entries.get(cliKey);
+                    this.entries.set(cliKey, {
+                        status: prev?.status ?? 'active',
+                        ...(prev?.message !== undefined ? { message: prev.message } : {}),
+                        since: prev?.since ?? this.startedAt,
+                        lastErrorAt: new Date(at).toISOString(),
+                    });
+                }
+                return;
+            }
+            // A finished run's assignments can never activate/deactivate anyone again — drop them.
+            case 'sessionCompleted':
+            case 'sessionFailed':
+            case 'runCancelled': {
+                if (session === undefined)
+                    return;
+                const prefix = `${session}:`;
+                for (const key of [...this.assignments.keys()]) {
+                    if (key.startsWith(prefix))
+                        this.assignments.delete(key);
+                }
+                return;
+            }
+            default:
+                return;
+        }
+    }
+    /** Flip a seat ACTIVE: message cleared, `since` updated on a genuine transition. */
+    markActive(key, atMs = Date.now()) {
+        const prev = this.entries.get(key);
+        this.entries.set(key, {
+            status: 'active',
+            since: prev?.status === 'active' ? prev.since : new Date(atMs).toISOString(),
+            ...(prev?.lastErrorAt !== undefined ? { lastErrorAt: prev.lastErrorAt } : {}),
+        });
+        this.fallbacks.delete(key); // an ok output resets the repeated-fallback window too
+    }
+    /** Flip a seat INACTIVE with the error excerpt; `since` survives while already inactive. */
+    markInactive(key, message, atMs = Date.now()) {
+        const prev = this.entries.get(key);
+        const iso = new Date(atMs).toISOString();
+        this.entries.set(key, {
+            status: 'inactive',
+            message: excerpt(message),
+            since: prev?.status === 'inactive' ? prev.since : iso,
+            lastErrorAt: iso,
+        });
+    }
+    /** The seat's health — a seat never seen in an event is ACTIVE with no message (the default). */
+    healthFor(key) {
+        return this.entries.get(key) ?? { status: 'active', since: this.startedAt };
+    }
+}
+/** Default prober: run the version command; exit 0 → true, anything else (incl. timeout) → false. */
+async function defaultRunProbe(argv, timeoutMs) {
+    const [file, ...args] = argv;
+    if (file === undefined)
+        return false;
+    try {
+        await execCapped(file, args, { timeout: timeoutMs, maxBuffer: 1024 * 1024 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The low-frequency recovery probe (crew#274 §3): every `intervalMs`, for INACTIVE seats only,
+ * run the seat's `version_probe`; exit 0 flips the seat active with the message cleared. Quota
+ * resets and re-logins are thus detected without operator action. Callers own the guard against
+ * probing in tests (the daemon arms this from `createServer`, env-gated).
+ */
+export function startSeatHealthProbe(tracker, roster, opts = {}) {
+    const intervalMs = opts.intervalMs ?? FALLBACK_WINDOW_MS; // 10 min
+    const timeoutMs = opts.timeoutMs ?? 5_000;
+    const runProbe = opts.runProbe ?? defaultRunProbe;
+    const log = opts.log ?? (() => undefined);
+    let inFlight = false;
+    const tick = async () => {
+        if (inFlight)
+            return; // a slow round must never stack onto the next interval
+        inFlight = true;
+        try {
+            let seats;
+            try {
+                seats = roster();
+            }
+            catch (err) {
+                log(`[seat-health] roster read failed, skipping probe round: ${String(err)}`);
+                return;
+            }
+            for (const seat of seats) {
+                const key = str(seat.key);
+                if (key === undefined)
+                    continue;
+                if (tracker.healthFor(key).status !== 'inactive')
+                    continue; // recovery only
+                const probe = seat.version_probe;
+                const argv = Array.isArray(probe)
+                    ? probe.filter((s) => typeof s === 'string' && s.length > 0)
+                    : [];
+                if (argv.length === 0)
+                    continue; // unprobeable seat: only an ok output can recover it
+                try {
+                    if (await runProbe(argv, timeoutMs)) {
+                        tracker.markActive(key);
+                        log(`[seat-health] '${key}' recovered (version probe exited 0)`);
+                    }
+                }
+                catch {
+                    /* a throwing prober reads as still-down */
+                }
+            }
+        }
+        finally {
+            inFlight = false;
+        }
+    };
+    const handle = setInterval(() => {
+        void tick();
+    }, intervalMs);
+    // Never hold the process open for a probe — the daemon's server lifecycle owns shutdown.
+    handle.unref?.();
+    return {
+        stop() {
+            clearInterval(handle);
+        },
+    };
+}
+//# sourceMappingURL=seat-health.js.map

package/dist/api/seat-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-health.js","sourceRoot":"","sources":["../../src/api/seat-health.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,2EAA2E;AAC3E,EAAE;AACF,kFAAkF;AAClF,EAAE;AACF,uFAAuF;AACvF,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,qFAAqF;AACrF,gGAAgG;AAChG,8FAA8F;AAC9F,8FAA8F;AAC9F,sBAAsB;AACtB,iGAAiG;AACjG,6FAA6F;AAC7F,yDAAyD;AACzD,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,+FAA+F;AAC/F,WAAW;AAGX,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC;AAClF,CAAC;AAED,qGAAqG;AACrG,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,qBAAqB,GAAa;IACtC,aAAa,EAAE,iDAAiD;IAChE,kBAAkB,EAAE,0DAA0D;IAC9E,2BAA2B,EAAE,yBAAyB;IACtD,kDAAkD,EAAE,qBAAqB;IACzE,8CAA8C,EAAE,kBAAkB;CACnE,CAAC;AAEF,6FAA6F;AAC7F,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAEvE,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzD,oGAAoG;IACnF,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzD,6FAA6F;IAC5E,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzD,+DAA+D;IAC9C,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEtD,4FAA4F;IAC5F,MAAM,CAAC,KAAgB;QACrB,wFAAwF;QACxF,0EAA0E;QAC1E,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACpE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,wFAAwF;gBACxF,yFAAyF;gBACzF,yFAAyF;gBACzF,MAAM,MAAM,GAAG,GAAG,CAAE,KAA8B,CAAC,MAAM,CAAC,CAAC;gBAC3D,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACvE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/C,CAAC;gBACD,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACvE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO;gBACpF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;gBACvD,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,WAAW,GAAG,GAAG,CAAE,KAAmC,CAAC,WAAW,CAAC,CAAC;gBAC1E,wFAAwF;gBACxF,wFAAwF;gBACxF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;oBACxC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;oBAC3C,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,IAAI,GAAG,KAAK,IAAI,QAAQ,CAAC;gBAC/B,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO;gBAC/B,MAAM,SAAS,GACb,WAAW,KAAK,aAAa,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvF,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,iBAAiB,WAAW,IAAI,YAAY,GAAG,CAAC;oBAC/E,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,MAAM,GAAG,GAAG,CAAE,KAA8B,CAAC,MAAM,CAAC,CAAC;gBAC3D,MAAM,YAAY,GAAG,GAAG,CAAE,KAAoC,CAAC,YAAY,CAAC,CAAC;gBAC7E,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO;gBACjC,IAAI,YAAY,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC;oBAAE,OAAO;gBAClF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,kBAAkB,CACnC,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,GAAG,CAAE,KAA8B,CAAC,MAAM,CAAC,IAAI,YAAY,IAAI,SAAS,CAAC;oBACxF,IAAI,CAAC,YAAY,CACf,MAAM,EACN,0BAA0B,KAAK,CAAC,MAAM,gBAAgB,MAAM,EAAE,EAC9D,EAAE,CACH,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,uFAAuF;oBACvF,+EAA+E;oBAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;wBACvB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ;wBAChC,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS;wBACpC,WAAW,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YACD,uFAAuF;YACvF,KAAK,kBAAkB,CAAC;YACxB,KAAK,eAAe,CAAC;YACrB,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO;gBAClC,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC;gBAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO;YACT,CAAC;YACD;gBACE,OAAO;QACX,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,UAAU,CAAC,GAAW,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5E,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,uDAAuD;IACrF,CAAC;IAED,4FAA4F;IAC5F,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;YACzB,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG;YACrD,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,iGAAiG;IACjG,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;CACF;AAoBD,qGAAqG;AACrG,KAAK,UAAU,eAAe,CAAC,IAAc,EAAE,SAAiB;IAC9D,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA0B,EAC1B,MAAyB,EACzB,OAAyB,EAAE;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC,SAAS;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,QAAQ;YAAE,OAAO,CAAC,uDAAuD;QAC7E,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,KAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,EAAE,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,2DAA2D,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,GAAG,KAAK,SAAS;oBAAE,SAAS;gBAChC,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,UAAU;oBAAE,SAAS,CAAC,gBAAgB;gBAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC/B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;oBACzE,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS,CAAC,qDAAqD;gBACtF,IAAI,CAAC;oBACH,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;wBACpC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBACxB,GAAG,CAAC,kBAAkB,GAAG,sCAAsC,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,2CAA2C;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,yFAAyF;IACzF,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjB,OAAO;QACL,IAAI;YACF,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}