fix: pin node-pty 1.2.0-beta.15 again, and test the pin (#159)

core/README.md

@@ -277,7 +277,10 @@ resolve: { dedupe: ['react', 'react-dom'] }, optimizeDeps: { exclude: ['prism-te
 
 `react`, `node-pty` and `@xterm/*` must stay at compatible versions in both apps
 so npm keeps ONE copy of each; the core is verified against Prism Terminal's
-lockfile but ships against Prism's.
+lockfile but ships against Prism's. Both apps pin `node-pty` to EXACTLY
+`1.2.0-beta.15` (1.1.0's quit crash, #127/#159). The core's peer names that
+build (`^1.1.0 || 1.2.0-beta.15`): a bare `^1.1.0` matches no prerelease, so npm
+refused the pin in Prism.
 
 ## Releasing the core
 

core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-term-core",
-  "version": "0.28.1",
+  "version": "0.28.2",
   "description": "What Prism Terminal and Prism share: the terminal (pty, shells, agent detection and indicator, themes, links, the panel, dictation) and the update chip with its window. TypeScript source, compiled by the host.",
   "license": "MIT",
   "private": true,
@@ -40,7 +40,7 @@
     "@xterm/addon-unicode11": "^0.9.0",
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/xterm": "^6.0.0",
-    "node-pty": "^1.1.0",
+    "node-pty": "^1.1.0 || 1.2.0-beta.15",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   }

docs/regression-rules.md

@@ -49,6 +49,8 @@ one-liner in `CLAUDE.md` only if it is among the most important.
   `ThreadSafeFunction::CallJS` -> abort). So every kill goes through `killPty` and `will-quit` holds
   the quit on `shellsGone` (3 s cap). It waits for the agent's `exitCode`, set by the native callback,
   not the exit EVENT, which lags 1-2.7 s for a pwsh killed mid-start (a warm shell). `quitManyShells`.
+  The pin was LOST once (#159, 2026-10-10): an icon PR's merge put `^1.1.0` back and the dialog
+  returned for the owner. `src/main/nodePtyPin.test.ts` now fails on any build without the pin.
 - <a id="title-bar-style-hidden"></a>**`titleBarStyle: 'hidden'`, never `frame: false`**: DWM will not composite acrylic behind a
   frameless window.
 - <a id="material-before-colour"></a>**Material before colour** (`material.ts`, measured on Electron 43): `setBackgroundMaterial('none')`

package.json

@@ -1,7 +1,7 @@
 {
   "name": "prism-terminal",
   "productName": "Prism Terminal",
-  "version": "0.35.1",
+  "version": "0.35.2",
   "description": "A tabbed Windows terminal for AI CLIs.",
   "main": "./out/main/index.js",
   "author": "Max",
@@ -29,7 +29,7 @@
     "@xterm/addon-unicode11": "^0.9.0",
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/xterm": "^6.0.0",
-    "node-pty": "^1.1.0",
+    "node-pty": "1.2.0-beta.15",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },
@@ -57,6 +57,6 @@
     "vitest": "^3.2.7"
   },
   "allowScripts": {
-    "node-pty@1.1.0": true
+    "node-pty@1.2.0-beta.15": true
   }
 }

src/main/nodePtyPin.test.ts

@@ -0,0 +1,35 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+// #127/#128 pinned node-pty to 1.2.0-beta.15: 1.1.0's exit threads race on an
+// unlocked vector and its prebuild asserts ("Assertion failed! remove_pty_baton"),
+// a modal dialog that holds the app open. #130 (an icon PR) put ^1.1.0 back in a
+// merge and nothing noticed until the owner saw the dialog again (#159). The
+// quit e2e only catches the race sometimes; this catches the pin every run.
+const PIN = '1.2.0-beta.15'
+const root = join(__dirname, '..', '..')
+interface Pkg {
+  dependencies: Record<string, string>
+  peerDependencies: Record<string, string>
+  packages: Record<string, { version: string }>
+}
+const json = (f: string): Pkg => JSON.parse(readFileSync(join(root, f), 'utf8')) as Pkg
+
+describe('node-pty pin (#159)', () => {
+  it('package.json asks for exactly the pinned build', () => {
+    const pkg = json('package.json')
+    expect(pkg.dependencies['node-pty']).toBe(PIN)
+    expect(JSON.stringify(pkg)).not.toContain('node-pty@1.1.0')
+  })
+
+  // A `^1.1.0` peer matches no prerelease, so Prism's npm refused the pin. It
+  // still allows 1.1.0 so Prism's core bump installs before Prism's own pin lands.
+  it('the core lets its hosts take the pinned build', () => {
+    expect(json('core/package.json').peerDependencies['node-pty'].split(' || ')).toContain(PIN)
+  })
+
+  it('the lockfile resolves it', () => {
+    expect(json('package-lock.json').packages['node_modules/node-pty'].version).toBe(PIN)
+  })
+})