@abelxiaoxing/cadence 2.0.14 → 2.0.16

package/src/service-host.mjs

@@ -612,6 +612,7 @@ var ERROR_CODES = [
   "quarantine",
   "capacity",
   "unavailable",
+  "registry-locked",
   "auth-unavailable",
   "recording-exhausted",
   "receipt-inconclusive"
@@ -5352,7 +5353,7 @@ function sdkNetworkEnvironment(ambient, scoped) {
 
 // src/service/coordination.ts
 import { randomBytes as randomBytes2, randomUUID as randomUUID4 } from "node:crypto";
-import { opendirSync, realpathSync as realpathSync3 } from "node:fs";
+import { opendirSync } from "node:fs";
 import { hostname as hostname2 } from "node:os";
 import { dirname as dirname5, isAbsolute as isAbsolute4, join as join6, relative as relative3, sep as sep3 } from "node:path";
 var registrationKeys = [
@@ -5444,6 +5445,21 @@ function names(path, allowed) {
     dir.closeSync();
   }
 }
+function decodeRegistryLock(snapshot) {
+  const o = closed(json(snapshot), ["schema", "token", "pid", "host"]);
+  return {
+    schema: literal(o.schema, "cadence-service-registry-lock/1"),
+    token: decodeId(o.token),
+    pid: integer(o.pid, 1, 2147483647),
+    host: text(o.host, 255, true)
+  };
+}
+var registryNames = [
+  "format.json",
+  "roots.json",
+  "registry.lock",
+  "recovery-v1"
+];
 function recoveryOwnerStatus(pid, host) {
   if (host !== hostname2())
     return "ambiguous";
@@ -5473,19 +5489,25 @@ function recoveryDigest(registry, selected) {
 }
 
 class ServiceCoordination {
-  store;
+  project;
   files;
-  directory;
   registryDirectory;
   stateHome;
   constructor(workspace, stateHome) {
-    this.store = new TaskStore(resolveWorkspace(workspace).root, stateHome);
-    const namespace = dirname5(this.store.privateRoot);
+    this.project = workspace === null ? undefined : new TaskStore(resolveWorkspace(workspace).root, stateHome);
+    this.stateHome = this.project ? dirname5(dirname5(this.project.privateRoot)) : canonicalAmbientRoot(stateHome ?? defaultStateHome());
+    const namespace = join6(this.stateHome, "cadence-assistant-v1");
     this.files = new PrivateFiles(namespace);
-    this.stateHome = dirname5(namespace);
-    this.directory = join6(this.store.privateRoot, "service-v1");
     this.registryDirectory = join6(namespace, "service-registry-v1");
   }
+  get store() {
+    if (!this.project)
+      throw new ContractError("forbidden");
+    return this.project;
+  }
+  get directory() {
+    return join6(this.store.privateRoot, "service-v1");
+  }
   path(name) {
     return join6(this.directory, name);
   }
@@ -5495,11 +5517,7 @@ class ServiceCoordination {
   registry() {
     if (!this.files.directory(this.registryDirectory))
       return;
-    names(this.registryDirectory, [
-      "format.json",
-      "roots.json",
-      "registry.lock"
-    ]);
+    names(this.registryDirectory, registryNames);
     const format = this.files.read(this.registryPath("format.json"));
     const snapshot = this.files.read(this.registryPath("roots.json"), REGISTRY_BYTES);
     if (!format || !snapshot)
@@ -5510,7 +5528,7 @@ class ServiceCoordination {
     const o = closed(json(snapshot, REGISTRY_BYTES), ["schema", "entries"]);
     const entries = list(o.entries, REGISTRY_ENTRIES, decodeReservation);
     for (const [i, row] of entries.entries()) {
-      if (row.stateHome !== this.stateHome || realpathSync3(row.root) !== row.root)
+      if (row.stateHome !== this.stateHome || canonicalAmbientRoot(row.root) !== row.root)
         refused();
       if (entries.slice(0, i).some((other) => rootsOverlap(row.root, other.root) || row.endpoint === other.endpoint))
         refused();
@@ -5524,10 +5542,10 @@ class ServiceCoordination {
       }
     };
   }
-  assertNamespace(walks) {
-    if (!this.files.directory(this.directory, false, walks))
+  assertNamespace(walks, directory = this.directory) {
+    if (!this.files.directory(directory, false, walks))
       refused();
-    names(this.directory, [
+    names(directory, [
       "format.json",
       "config.json",
       "registration.json",
@@ -5539,15 +5557,16 @@ class ServiceCoordination {
       "history-v2",
       "conversations-v1"
     ]);
-    this.files.directory(join6(this.directory, "history-v2"), false, walks);
+    this.files.directory(join6(directory, "history-v2"), false, walks);
   }
-  selected() {
+  selected(directory = this.directory, root = this.store.root, stoppedOnly = false) {
     const walks = new DirectoryWalks;
-    if (!this.files.directory(this.directory, false, walks))
+    if (!this.files.directory(directory, false, walks))
       return;
-    this.assertNamespace(walks);
-    const manifest = this.files.read(this.path("format.json"), undefined, walks);
-    const config = this.files.read(this.path("config.json"), undefined, walks);
+    this.assertNamespace(walks, directory);
+    const path = (name) => join6(directory, name);
+    const manifest = this.files.read(path("format.json"), undefined, walks);
+    const config = this.files.read(path("config.json"), undefined, walks);
     if (!manifest || !config)
       refused();
     const f = closed(json(manifest), [
@@ -5557,20 +5576,22 @@ class ServiceCoordination {
       "configIdentity"
     ]);
     literal(f.schema, "cadence-service-format/1");
-    literal(f.root, this.store.root);
+    literal(f.root, root);
     literal(f.stateHome, this.stateHome);
     literal(f.configIdentity, config.identity);
     const c = decodeOwnerConfig(json(config));
-    const hostConfig = this.files.read(this.path("host-config.json"), undefined, walks);
+    const hostConfig = this.files.read(path("host-config.json"), undefined, walks);
     if (hostConfig && hostConfig.identity !== c.policyIdentity)
       refused();
-    const registration = this.files.read(this.path("registration.json"), undefined, walks);
-    const owner = this.files.read(this.path("owner.lock"), undefined, walks);
-    const capability = this.files.read(this.path("local-capability.json"), undefined, walks);
-    const checkout = this.files.read(this.store.lockPath, 8192, walks);
+    const registration = this.files.read(path("registration.json"), undefined, walks);
+    const owner = this.files.read(path("owner.lock"), undefined, walks);
+    const capability = this.files.read(path("local-capability.json"), undefined, walks);
+    const checkout = this.files.read(join6(dirname5(directory), "checkout.lock"), 8192, walks);
     const value = registration ? decodeRegistration(json(registration)) : undefined;
-    if (value && (value.root !== this.store.root || value.stateHome !== this.stateHome || value.configIdentity !== config.identity || !endpointMatches(c.endpoint, value.endpoint)))
+    if (value && (value.root !== root || value.stateHome !== this.stateHome || value.configIdentity !== config.identity || !endpointMatches(c.endpoint, value.endpoint)))
       refused();
+    if (stoppedOnly && (checkout || value && value.phase !== "stopped"))
+      throw new ContractError("quarantine");
     if (value && value.phase !== "stopped") {
       if (!owner || !checkout || !capability)
         refused();
@@ -5650,18 +5671,21 @@ class ServiceCoordination {
   }
   withRegistry(operation) {
     this.files.directory(this.registryDirectory, true);
-    names(this.registryDirectory, [
-      "format.json",
-      "roots.json",
-      "registry.lock"
-    ]);
+    names(this.registryDirectory, registryNames);
     const lockPath = this.registryPath("registry.lock");
-    const lock = this.files.create(lockPath, encoded({
-      schema: "cadence-service-registry-lock/1",
-      token: randomUUID4(),
-      pid: process.pid,
-      host: hostname2()
-    }));
+    let lock;
+    try {
+      lock = this.files.create(lockPath, encoded({
+        schema: "cadence-service-registry-lock/1",
+        token: randomUUID4(),
+        pid: process.pid,
+        host: hostname2()
+      }));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "EEXIST")
+        throw new ContractError("registry-locked");
+      throw error;
+    }
     let dirty = false;
     try {
       let format = this.files.read(this.registryPath("format.json"));
@@ -5685,11 +5709,7 @@ class ServiceCoordination {
       }, () => {
         this.files.assert(lockPath, lock);
         this.files.assert(this.registryPath("format.json"), format);
-        names(this.registryDirectory, [
-          "format.json",
-          "roots.json",
-          "registry.lock"
-        ]);
+        names(this.registryDirectory, registryNames);
       });
       this.files.remove(lockPath, lock);
       return result;
@@ -5700,6 +5720,7 @@ class ServiceCoordination {
     }
   }
   acquire(input, resolvedEndpoint = input.endpoint, initializeNew, reselectExisting) {
+    this.store;
     const config = decodeOwnerConfig(input);
     const bound = endpoint(resolvedEndpoint);
     if (!endpointMatches(config.endpoint, bound))
@@ -5821,6 +5842,154 @@ class ServiceCoordination {
       });
     });
   }
+  registryLockDiagnostic() {
+    try {
+      const lock = this.files.read(this.registryPath("registry.lock"));
+      if (!lock)
+        return;
+      const value = decodeRegistryLock(lock);
+      return {
+        reason: "registry-locked",
+        owner: recoveryOwnerStatus(value.pid, value.host)
+      };
+    } catch {
+      return { reason: "registry-locked", owner: "unreadable" };
+    }
+  }
+  registryRecoveryState() {
+    const lock = this.files.read(this.registryPath("registry.lock"));
+    if (!lock)
+      throw new ContractError("conflict");
+    const value = decodeRegistryLock(lock);
+    names(this.registryDirectory, registryNames);
+    const format = this.files.read(this.registryPath("format.json"));
+    const roots = this.files.read(this.registryPath("roots.json"), REGISTRY_BYTES);
+    const registry = !format && !roots ? undefined : this.registry();
+    const entries = registry?.value.entries ?? [];
+    const protectedRoots = new Set(entries.map((row) => hash2(row.root)));
+    const proofs = [];
+    const directory = opendirSync(this.files.namespace);
+    try {
+      let count = 0;
+      for (let entry = directory.readSync();entry; entry = directory.readSync()) {
+        if (++count > 1024)
+          throw new ContractError("capacity");
+        if (!/^[a-f0-9]{64}$/.test(entry.name) || protectedRoots.has(entry.name))
+          continue;
+        const service = join6(this.files.namespace, entry.name, "service-v1");
+        if (!this.files.directory(service))
+          continue;
+        const manifest = this.files.read(join6(service, "format.json"));
+        if (!manifest)
+          refused();
+        const f = closed(json(manifest), [
+          "schema",
+          "root",
+          "stateHome",
+          "configIdentity"
+        ]);
+        const root = pathValue(f.root);
+        if (hash2(root) !== entry.name)
+          refused();
+        const selected = this.selected(service, root, true);
+        if (!selected)
+          throw new ContractError("quarantine");
+        proofs.push([
+          entry.name,
+          ...[
+            selected.manifest,
+            selected.config,
+            selected.hostConfig,
+            selected.registration
+          ].map((file) => file ? [file.identity, file.stamp] : null)
+        ]);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    proofs.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b), "en"));
+    const stateDigest = hash2(encoded([
+      lock.identity,
+      lock.stamp,
+      format ? [format.identity, format.stamp] : null,
+      roots ? [roots.identity, roots.stamp] : null,
+      proofs
+    ]));
+    const epoch = hash2(encoded([lock.identity, lock.stamp]));
+    const archive = this.registryPath(join6("recovery-v1", epoch));
+    const attempts = [];
+    let previousResolver = null;
+    if (this.files.directory(archive)) {
+      names(archive, Array.from({ length: 128 }, (_, n) => `${n}.json`));
+      for (let n = 0;n < 128; n++) {
+        const attempt = this.files.read(join6(archive, `${n}.json`), 32768);
+        if (!attempt) {
+          names(archive, attempts.map((_, i) => `${i}.json`));
+          break;
+        }
+        const o = closed(json(attempt, 32768), [
+          "schema",
+          "lock",
+          "pid",
+          "host",
+          "digest"
+        ]);
+        literal(o.schema, "cadence-registry-recovery/1");
+        literal(o.lock, lock.bytes.toString("utf8"));
+        decodeHash(o.digest);
+        previousResolver = recoveryOwnerStatus(integer(o.pid, 1, 2147483647), text(o.host, 255, true));
+        attempts.push(attempt);
+      }
+    }
+    const inspection = {
+      scope: "global-registry",
+      epoch,
+      coordinationDigest: hash2(encoded([stateDigest, attempts.map((a) => [a.identity, a.stamp])])),
+      owner: recoveryOwnerStatus(value.pid, value.host),
+      process: { pid: value.pid, host: value.host },
+      reservations: entries.length,
+      previousResolver,
+      resolution: "local-interactive-only"
+    };
+    return { lock, archive, attempts, stateDigest, inspection };
+  }
+  inspectRegistryRecovery() {
+    return this.registryRecoveryState().inspection;
+  }
+  resolveRegistryRecovery(expected, assertAuthority) {
+    assertAuthority();
+    const state = this.registryRecoveryState();
+    if (encoded(state.inspection) !== encoded(expected))
+      throw new ContractError("conflict");
+    if (expected.owner !== "absent" || expected.previousResolver !== null && expected.previousResolver !== "absent")
+      throw new ContractError("quarantine");
+    if (state.attempts.length >= 128)
+      throw new ContractError("capacity");
+    assertAuthority();
+    const receiptPath = join6(state.archive, `${state.attempts.length}.json`);
+    const receipt = this.files.create(receiptPath, encoded({
+      schema: "cadence-registry-recovery/1",
+      lock: state.lock.bytes.toString("utf8"),
+      pid: process.pid,
+      host: hostname2(),
+      digest: expected.coordinationDigest
+    }), 32768);
+    assertAuthority();
+    const current = this.registryRecoveryState();
+    if (current.stateDigest !== state.stateDigest || current.inspection.owner !== "absent" || current.attempts.length !== state.attempts.length + 1)
+      throw new ContractError("conflict");
+    for (const [n, attempt] of state.attempts.entries())
+      this.files.assert(join6(state.archive, `${n}.json`), attempt, 32768);
+    this.files.assert(receiptPath, receipt, 32768);
+    assertAuthority();
+    this.files.remove(this.registryPath("registry.lock"), state.lock);
+    return {
+      status: "resolved",
+      scope: "global-registry",
+      recoveryId: expected.epoch,
+      notice: "registry-only-project-fences-preserved"
+    };
+  }
   prepareRecoveryRelease(expected, assertAuthority) {
     assertAuthority();
     if (this.recoverySnapshot().digest !== expected)
@@ -5973,6 +6142,7 @@ class OwnerLease {
 // src/service/gateway-store.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID5 } from "node:crypto";
 import { opendirSync as opendirSync2 } from "node:fs";
+import { hostname as hostname3 } from "node:os";
 import { join as join7, resolve as resolve3 } from "node:path";
 
 // src/service/contracts/gateway.ts
@@ -6016,6 +6186,8 @@ function decodeGatewayProject(value) {
   return project;
 }
 function registration(value) {
+  const hasHost = !!value && typeof value === "object" && Object.hasOwn(value, "host");
+  const hasRecovery = !!value && typeof value === "object" && Object.hasOwn(value, "recovery");
   const o = closed(value, [
     "schema",
     "epoch",
@@ -6024,8 +6196,22 @@ function registration(value) {
     "capability",
     "selection",
     "pid",
-    "phase"
+    "phase",
+    ...hasHost ? ["host"] : [],
+    ...hasRecovery ? ["recovery"] : []
   ]);
+  let recovery;
+  if (hasRecovery) {
+    const r = closed(o.recovery, ["receipt", "sha256", "stamp"]);
+    const receipt = text(r.receipt, 128, true);
+    if (!/^recovery-v1\/[a-f0-9]{64}\/(?:0|[1-9][0-9]{0,2})\.json$/.test(receipt))
+      throw new ContractError("corrupt-selected");
+    recovery = {
+      receipt,
+      sha256: decodeHash(r.sha256),
+      stamp: text(r.stamp, 512, true)
+    };
+  }
   const endpoint2 = text(o.endpoint, 128, true), capability = text(o.capability, 43, true);
   if (!/^http:\/\/(?:127\.0\.0\.1|\[::1\]):[1-9][0-9]{0,4}$/.test(endpoint2) || !/^[A-Za-z0-9_-]{43}$/.test(capability))
     throw new ContractError("corrupt-selected");
@@ -6036,7 +6222,9 @@ function registration(value) {
     endpoint: endpoint2,
     capability,
     selection: decodeHash(o.selection),
-    pid: integer(o.pid, 1),
+    pid: integer(o.pid, 1, 2147483647),
+    ...hasHost ? { host: text(o.host, 255, true) } : {},
+    ...recovery ? { recovery } : {},
     phase: oneOf(o.phase, ["alive", "stopping", "stopped", "quarantined"])
   };
 }
@@ -6096,6 +6284,8 @@ class GatewayStore {
     const previous = this.read();
     if (previous && previous.phase !== "stopped")
       throw new ContractError("quarantine");
+    if (previous?.recovery)
+      this.associatedProjects();
     this.lock = this.files.create(this.path("gateway.lock"), encoded({ epoch: randomUUID5() }));
     const source = { serverConfig: this.serverConfig, token };
     if (!previous)
@@ -6115,6 +6305,8 @@ class GatewayStore {
       capability: randomBytes3(32).toString("base64url"),
       selection: hash2(inputBytes),
       pid: process.pid,
+      host: hostname3(),
+      ...previous?.recovery ? { recovery: previous.recovery } : {},
       phase: "alive"
     };
     this.selected = this.selected ? this.files.replace(this.path("gateway.json"), this.selected, encoded(this.value)) : this.files.create(this.path("gateway.json"), encoded(this.value));
@@ -6158,6 +6350,21 @@ class GatewayStore {
     }
     return out;
   }
+  associatedProjects() {
+    const projects = this.projects(), recovery = this.read()?.recovery;
+    if (!recovery)
+      return projects;
+    const receipt = this.files.read(this.path(recovery.receipt), 65536);
+    if (!receipt || receipt.identity !== recovery.sha256 || receipt.stamp !== recovery.stamp)
+      throw new ContractError("corrupt-selected");
+    const value = json(receipt, 65536);
+    literal(value.schema, "cadence-workbench-recovery/1");
+    const retired = list(value.retiredProjects, 128, (entry) => {
+      const row = closed(entry, ["id", "stamp"]);
+      return { id: decodeHash(row.id), stamp: text(row.stamp, 512, true) };
+    });
+    return projects.filter((project) => !retired.some((row) => row.id === project.id && row.stamp === this.files.read(this.path(`projects/${project.id}.json`))?.stamp));
+  }
   saveProject(project) {
     this.assert();
     const p = decodeGatewayProject(project), path = this.path(`projects/${p.id}.json`), before = this.files.read(path);
@@ -6173,205 +6380,10 @@ class GatewayStore {
   }
 }
 
-// src/service/runtime.ts
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute5, join as join8, resolve as resolve4 } from "node:path";
-var STARTUP_INPUT_BYTES = 16 * 1024;
-function absolute(value) {
-  const result = text(value, 4096, true);
-  if (!isAbsolute5(result))
-    throw new ContractError("invalid");
-  return result;
-}
-function decodeHostConfig(value) {
-  const o = closed(value, [
-    "schema",
-    "http",
-    "cwd",
-    "agentDir",
-    "tokenSource",
-    "tokenFile"
-  ]);
-  const tokenSource = oneOf(o.tokenSource, [
-    "generated",
-    "environment",
-    "file",
-    "config"
-  ]);
-  const tokenFile = o.tokenFile === null ? null : absolute(o.tokenFile);
-  if ((tokenSource === "file" || tokenSource === "config") !== !!tokenFile)
-    throw new ContractError("invalid");
-  return {
-    schema: literal(o.schema, "cadence-service-host/1"),
-    http: decodeHttpPolicy(o.http),
-    cwd: absolute(o.cwd),
-    agentDir: absolute(o.agentDir),
-    tokenSource,
-    tokenFile
-  };
-}
-function reselectable(old, next) {
-  const kept = (c) => encoded({
-    ...c,
-    http: { ...c.http, port: 0 },
-    tokenSource: null,
-    tokenFile: null
-  });
-  return next.tokenSource === "config" && kept(old) === kept(next);
-}
-function readHostConfig(c) {
-  const owner = c.configuration();
-  if (!owner)
-    return;
-  const snapshot = c.files.read(c.path("host-config.json"));
-  if (!snapshot)
-    throw new ContractError("corrupt-selected");
-  const config = decodeHostConfig(json(snapshot));
-  if (!config.http.port || owner.endpoint !== localOrigin(config.http, config.http.port) || owner.policyIdentity !== hash2(encoded(config)))
-    throw new ContractError("conflict");
-  return config;
-}
-function hostEnvironment(ambient) {
-  let route;
-  const facts = networkSnapshot(ambient);
-  try {
-    if (facts.NODE_OPTIONS.present)
-      throw new Error;
-    route = sdkNetworkEnvironment(facts, networkSnapshot(undefined));
-  } catch {
-    throw new ContractError("unsupported-context");
-  }
-  const result = Object.create(null);
-  for (const key of Object.keys(ambient)) {
-    const d = Object.getOwnPropertyDescriptor(ambient, key);
-    if (!d || !("value" in d) || typeof d.value !== "string")
-      throw new ContractError("invalid");
-    if (/^(?:CADENCE_|PI_|ABEL_|TRELLIS_|GIT_)/i.test(key) || networkKeys.some((name) => name === key))
-      continue;
-    result[key] = d.value;
-  }
-  if (route.redactionLiterals.length) {
-    result.HTTP_PROXY = route.env.HTTP_PROXY;
-    result.HTTPS_PROXY = route.env.HTTPS_PROXY;
-    result.NODE_USE_ENV_PROXY = "1";
-  }
-  result.PI_OFFLINE = "1";
-  result.NO_COLOR = "1";
-  if (!sameNetwork(facts, networkSnapshot(ambient)))
-    throw new ContractError("stale");
-  return result;
-}
-function selectStart(options, ambient) {
-  const workspace = resolveWorkspace(options.workspace), c = new ServiceCoordination(workspace.root, options.stateHome);
-  const old = readHostConfig(c);
-  const env = Object.getOwnPropertyDescriptor(ambient, "CADENCE_WEB_TOKEN");
-  if (env && (!("value" in env) || typeof env.value !== "string"))
-    throw new ContractError("invalid");
-  let fromFile;
-  if (options.config) {
-    const path = resolve4(options.config), f = new PrivateFiles(dirname6(path));
-    const bytes = f.read(path);
-    if (!bytes)
-      throw new ContractError("corrupt-selected");
-    fromFile = decodeHostConfig(json(bytes));
-  }
-  const base = old ?? fromFile ?? decodeHostConfig({
-    schema: "cadence-service-host/1",
-    cwd: workspace.cwd,
-    http: {
-      schema: "cadence-service-http/1",
-      host: options.host ?? "127.0.0.1",
-      port: options.port ?? 17423,
-      proxy: null
-    },
-    agentDir: resolve4(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join8(ambient.HOME ?? ambient.USERPROFILE ?? homedir2(), ".pi", "agent")),
-    tokenSource: options.tokenFile ? "file" : env ? "environment" : "generated",
-    tokenFile: options.tokenFile ? resolve4(options.tokenFile) : null
-  });
-  const server = options.serverConfig !== undefined ? resolve4(options.serverConfig) : old?.tokenSource === "config" ? old.tokenFile : null;
-  let selected = base;
-  if (server) {
-    if (options.tokenFile !== undefined)
-      throw new ContractError("conflict");
-    const { port } = readServerConfig(server).config;
-    selected = decodeHostConfig({
-      ...base,
-      http: { ...base.http, port },
-      tokenSource: "config",
-      tokenFile: server
-    });
-  }
-  if (fromFile && encoded(fromFile) !== encoded(selected) || options.port !== undefined && options.port !== selected.http.port || options.host !== undefined && options.host !== selected.http.host || options.agentDir !== undefined && resolve4(options.agentDir) !== selected.agentDir || options.tokenFile !== undefined && resolve4(options.tokenFile) !== selected.tokenFile || env && selected.tokenSource !== "environment" || selected.tokenSource === "environment" && !env || resolveWorkspace(selected.cwd).root !== workspace.root)
-    throw new ContractError("conflict");
-  return {
-    workspace: workspace.root,
-    stateHome: c.stateHome,
-    config: selected,
-    environmentToken: env?.value ?? null
-  };
-}
-function decodeHostInput(value) {
-  const o = closed(value, [
-    "workspace",
-    "stateHome",
-    "config",
-    "environmentToken"
-  ]);
-  const config = decodeHostConfig(o.config);
-  const environmentToken = o.environmentToken === null ? null : text(o.environmentToken, 1024, true);
-  if (config.tokenSource === "environment" !== (environmentToken !== null))
-    throw new ContractError("invalid");
-  return {
-    workspace: absolute(o.workspace),
-    stateHome: absolute(o.stateHome),
-    config,
-    environmentToken
-  };
-}
-var STARTUP_STAGES = [
-  "package",
-  "pi-agent-directory",
-  "pi-auth",
-  "pi-models",
-  "pi-runtime",
-  "service"
-];
-
-class StartupRefusal extends ContractError {
-  stage;
-  quarantined;
-  constructor(code2, stage, quarantined = false) {
-    super(code2);
-    this.stage = stage;
-    this.quarantined = quarantined;
-  }
-}
-function startupReport(error) {
-  if (error instanceof StartupRefusal)
-    return {
-      status: error.quarantined ? "quarantined" : "refused",
-      error: error.code,
-      stage: error.stage
-    };
-  return {
-    status: "refused",
-    error: error instanceof ContractError ? error.code : "unavailable",
-    stage: "service"
-  };
-}
-function decodeStartupReport(value) {
-  const o = closed(value, ["status", "error", "stage"]);
-  return {
-    status: oneOf(o.status, ["refused", "quarantined"]),
-    error: oneOf(o.error, ERROR_CODES),
-    stage: oneOf(o.stage, STARTUP_STAGES)
-  };
-}
-
 // src/history/recovery.ts
 import { createHash as createHash8, randomUUID as randomUUID7 } from "node:crypto";
 import { lstatSync as lstatSync7, opendirSync as opendirSync4 } from "node:fs";
-import { join as join10, relative as relative4 } from "node:path";
+import { join as join9, relative as relative4 } from "node:path";
 
 // src/service/recovery.ts
 async function inspectRecovery(coordination, history) {
@@ -6403,7 +6415,7 @@ import {
   statfsSync
 } from "node:fs";
 import { open } from "node:fs/promises";
-import { dirname as dirname8, join as join9 } from "node:path";
+import { dirname as dirname7, join as join8 } from "node:path";
 
 // src/history/admission.ts
 function decodeRunAdmission(value) {
@@ -6432,13 +6444,13 @@ import {
   openSync as openSync3,
   readSync as readSync3
 } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 function bad() {
   throw new ContractError("corrupt-selected");
 }
 var stamp2 = (s) => [s.dev, s.ino, s.size, s.mode, s.uid, s.nlink, s.ctimeMs, s.mtimeMs].join(":");
 function selected(files, path, read, walks) {
-  if (!files.files.directory(dirname7(path), false, walks))
+  if (!files.files.directory(dirname6(path), false, walks))
     bad();
   const before = lstatSync5(path);
   if (!before.isFile() || before.nlink !== 1 || process.platform !== "win32" && (before.mode & 63 || process.getuid && before.uid !== process.getuid()))
@@ -6972,7 +6984,7 @@ async function retryStalled(read) {
     } catch (error) {
       if (!(error instanceof StalledQuantum) || retry >= STALL_RETRIES)
         throw error;
-      await new Promise((resolve5) => setImmediate(resolve5));
+      await new Promise((resolve4) => setImmediate(resolve4));
     }
   }
 }
@@ -6993,14 +7005,14 @@ class HistoryFiles {
     this.coordination = coordination;
     this.format = format;
     this.formatSnapshot = formatSnapshot;
-    this.directory = join9(coordination.directory, "history-v2");
+    this.directory = join8(coordination.directory, "history-v2");
     this.files = coordination.files;
   }
   static open(coordination) {
-    const dir = join9(coordination.directory, "history-v2");
+    const dir = join8(coordination.directory, "history-v2");
     if (!coordination.files.directory(dir))
       return;
-    const file = coordination.files.read(join9(dir, "format.json"));
+    const file = coordination.files.read(join8(dir, "format.json"));
     if (!file)
       corrupt();
     const format = decodeFormat(json(file));
@@ -7016,7 +7028,7 @@ class HistoryFiles {
       existing.assertWritable();
       return existing;
     }
-    const dir = join9(c.directory, "history-v2");
+    const dir = join8(c.directory, "history-v2");
     const format = {
       schema: FORMAT,
       storeId: randomUUID6(),
@@ -7026,19 +7038,19 @@ class HistoryFiles {
     c.files.directory(dir, true);
     for (const name of ["commands", "ledger", "runs", "indexes"]) {
       lease.assert();
-      c.files.directory(join9(dir, name), true);
+      c.files.directory(join8(dir, name), true);
     }
     lease.assert();
-    const keyPath = join9(dir, "read-proof-key.json");
+    const keyPath = join8(dir, "read-proof-key.json");
     c.files.create(keyPath, encoded({
       schema: "cadence-history-read-key/1",
       storeId: format.storeId,
       key: randomBytes4(32).toString("base64url")
     }));
     lease.assert();
-    const snapshot = c.files.create(join9(dir, "format.json"), encoded(format));
+    const snapshot = c.files.create(join8(dir, "format.json"), encoded(format));
     const result = new HistoryFiles(c, format, snapshot);
-    result.syncParents(join9(dir, "format.json"));
+    result.syncParents(join8(dir, "format.json"));
     result.assertWritable();
     return result;
   }
@@ -7073,7 +7085,7 @@ class HistoryFiles {
       throw new ContractError("quarantine");
   }
   assertFormat() {
-    this.files.assert(join9(this.directory, "format.json"), this.formatSnapshot);
+    this.files.assert(join8(this.directory, "format.json"), this.formatSnapshot);
   }
   readProofMaterial(budget) {
     if (this.format.schema !== FORMAT)
@@ -7082,7 +7094,7 @@ class HistoryFiles {
       this.assertReadFormat(budget);
     else
       this.assertFormat();
-    const selected2 = this.readBudgeted(join9(this.directory, "read-proof-key.json"), 512, budget);
+    const selected2 = this.readBudgeted(join8(this.directory, "read-proof-key.json"), 512, budget);
     if (!selected2 || this.proofSnapshot && (selected2.identity !== this.proofSnapshot.identity || selected2.stamp !== this.proofSnapshot.stamp))
       corrupt();
     try {
@@ -7110,17 +7122,17 @@ class HistoryFiles {
       return;
     }
     this.assertFormat();
-    assertIncarnation(this, join9(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
+    assertIncarnation(this, join8(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
   }
   segmentPath(segment) {
-    return join9(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
+    return join8(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
   }
   artifactPath(ref) {
-    return join9(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
+    return join8(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
   }
   admissionPath(runId) {
     decodeId(runId);
-    return join9(this.directory, "runs", runId, "admission.json");
+    return join8(this.directory, "runs", runId, "admission.json");
   }
   writeAdmission(lease, input) {
     lease.assert();
@@ -7146,7 +7158,7 @@ class HistoryFiles {
   readCommand(commandId, budget) {
     decodeId(commandId);
     this.assertReadFormat(budget);
-    return this.readBudgeted(join9(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
+    return this.readBudgeted(join8(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
   }
   readAdmission(runId, identity, budget) {
     return this.readAdmissionIdentity(runId, hash2(canonicalJson(identity)), budget);
@@ -7167,7 +7179,7 @@ class HistoryFiles {
   syncParents(file) {
     if (process.platform === "win32")
       return;
-    for (let path = dirname8(file);; path = dirname8(path)) {
+    for (let path = dirname7(file);; path = dirname7(path)) {
       if (!this.files.directory(path))
         corrupt();
       const fd = openSync4(path, constants4.O_RDONLY | constants4.O_DIRECTORY);
@@ -7178,13 +7190,13 @@ class HistoryFiles {
       }
       if (path === this.coordination.directory)
         break;
-      if (path === dirname8(path))
+      if (path === dirname7(path))
         corrupt();
     }
   }
   assertReadFormat(budget) {
     budget.reserve(this.formatSnapshot.bytes.length);
-    this.files.assert(join9(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
+    this.files.assert(join8(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
   }
   assertPublished(segment, end, seq) {
     const fence = publicationFences.get(this.directory);
@@ -7222,7 +7234,7 @@ class HistoryFiles {
       const dir = opendirSync3(path);
       try {
         for (let e = dir.readSync();e; e = dir.readSync()) {
-          const p = join9(path, e.name), st = lstatSync6(p);
+          const p = join8(path, e.name), st = lstatSync6(p);
           if (st.isDirectory())
             bytes += walk(p, depth + 1);
           else {
@@ -7257,7 +7269,7 @@ class HistoryFiles {
     state.bytes = 0;
     state.identity = null;
     let count = 0;
-    const ledger = join9(this.directory, "ledger");
+    const ledger = join8(this.directory, "ledger");
     if (!this.files.directory(ledger))
       corrupt();
     const dir = opendirSync3(ledger);
@@ -7574,7 +7586,7 @@ class HistoryFiles {
   checkpoint(lease, state) {
     lease.assert();
     this.assertWritable();
-    const path = join9(this.directory, "checkpoint.json"), old = this.files.read(path);
+    const path = join8(this.directory, "checkpoint.json"), old = this.files.read(path);
     const body = encoded({
       schema: "cadence-history-checkpoint/2",
       storeId: this.format.storeId,
@@ -8181,7 +8193,7 @@ function digestHistory(files, exclude) {
       dir.closeSync();
     }
     for (const name of names2.sort()) {
-      const selected2 = join10(path, name);
+      const selected2 = join9(path, name);
       if (selected2 === exclude)
         continue;
       const rel = relative4(files.directory, selected2);
@@ -8369,6 +8381,201 @@ class HistoryRecovery {
   }
 }
 
+// src/service/runtime.ts
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join10, resolve as resolve4 } from "node:path";
+var STARTUP_INPUT_BYTES = 16 * 1024;
+function absolute(value) {
+  const result = text(value, 4096, true);
+  if (!isAbsolute5(result))
+    throw new ContractError("invalid");
+  return result;
+}
+function decodeHostConfig(value) {
+  const o = closed(value, [
+    "schema",
+    "http",
+    "cwd",
+    "agentDir",
+    "tokenSource",
+    "tokenFile"
+  ]);
+  const tokenSource = oneOf(o.tokenSource, [
+    "generated",
+    "environment",
+    "file",
+    "config"
+  ]);
+  const tokenFile = o.tokenFile === null ? null : absolute(o.tokenFile);
+  if ((tokenSource === "file" || tokenSource === "config") !== !!tokenFile)
+    throw new ContractError("invalid");
+  return {
+    schema: literal(o.schema, "cadence-service-host/1"),
+    http: decodeHttpPolicy(o.http),
+    cwd: absolute(o.cwd),
+    agentDir: absolute(o.agentDir),
+    tokenSource,
+    tokenFile
+  };
+}
+function reselectable(old, next) {
+  const kept = (c) => encoded({
+    ...c,
+    http: { ...c.http, port: 0 },
+    tokenSource: null,
+    tokenFile: null
+  });
+  return next.tokenSource === "config" && kept(old) === kept(next);
+}
+function readHostConfig(c) {
+  const owner = c.configuration();
+  if (!owner)
+    return;
+  const snapshot = c.files.read(c.path("host-config.json"));
+  if (!snapshot)
+    throw new ContractError("corrupt-selected");
+  const config = decodeHostConfig(json(snapshot));
+  if (!config.http.port || owner.endpoint !== localOrigin(config.http, config.http.port) || owner.policyIdentity !== hash2(encoded(config)))
+    throw new ContractError("conflict");
+  return config;
+}
+function hostEnvironment(ambient) {
+  let route;
+  const facts = networkSnapshot(ambient);
+  try {
+    if (facts.NODE_OPTIONS.present)
+      throw new Error;
+    route = sdkNetworkEnvironment(facts, networkSnapshot(undefined));
+  } catch {
+    throw new ContractError("unsupported-context");
+  }
+  const result = Object.create(null);
+  for (const key of Object.keys(ambient)) {
+    const d = Object.getOwnPropertyDescriptor(ambient, key);
+    if (!d || !("value" in d) || typeof d.value !== "string")
+      throw new ContractError("invalid");
+    if (/^(?:CADENCE_|PI_|ABEL_|TRELLIS_|GIT_)/i.test(key) || networkKeys.some((name) => name === key))
+      continue;
+    result[key] = d.value;
+  }
+  if (route.redactionLiterals.length) {
+    result.HTTP_PROXY = route.env.HTTP_PROXY;
+    result.HTTPS_PROXY = route.env.HTTPS_PROXY;
+    result.NODE_USE_ENV_PROXY = "1";
+  }
+  result.PI_OFFLINE = "1";
+  result.NO_COLOR = "1";
+  if (!sameNetwork(facts, networkSnapshot(ambient)))
+    throw new ContractError("stale");
+  return result;
+}
+function selectStart(options, ambient) {
+  const workspace = resolveWorkspace(options.workspace), c = new ServiceCoordination(workspace.root, options.stateHome);
+  const old = readHostConfig(c);
+  const env = Object.getOwnPropertyDescriptor(ambient, "CADENCE_WEB_TOKEN");
+  if (env && (!("value" in env) || typeof env.value !== "string"))
+    throw new ContractError("invalid");
+  let fromFile;
+  if (options.config) {
+    const path = resolve4(options.config), f = new PrivateFiles(dirname8(path));
+    const bytes = f.read(path);
+    if (!bytes)
+      throw new ContractError("corrupt-selected");
+    fromFile = decodeHostConfig(json(bytes));
+  }
+  const base = old ?? fromFile ?? decodeHostConfig({
+    schema: "cadence-service-host/1",
+    cwd: workspace.cwd,
+    http: {
+      schema: "cadence-service-http/1",
+      host: options.host ?? "127.0.0.1",
+      port: options.port ?? 17423,
+      proxy: null
+    },
+    agentDir: resolve4(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join10(ambient.HOME ?? ambient.USERPROFILE ?? homedir2(), ".pi", "agent")),
+    tokenSource: options.tokenFile ? "file" : env ? "environment" : "generated",
+    tokenFile: options.tokenFile ? resolve4(options.tokenFile) : null
+  });
+  const server = options.serverConfig !== undefined ? resolve4(options.serverConfig) : old?.tokenSource === "config" ? old.tokenFile : null;
+  let selected2 = base;
+  if (server) {
+    if (options.tokenFile !== undefined)
+      throw new ContractError("conflict");
+    const { port } = readServerConfig(server).config;
+    selected2 = decodeHostConfig({
+      ...base,
+      http: { ...base.http, port },
+      tokenSource: "config",
+      tokenFile: server
+    });
+  }
+  if (fromFile && encoded(fromFile) !== encoded(selected2) || options.port !== undefined && options.port !== selected2.http.port || options.host !== undefined && options.host !== selected2.http.host || options.agentDir !== undefined && resolve4(options.agentDir) !== selected2.agentDir || options.tokenFile !== undefined && resolve4(options.tokenFile) !== selected2.tokenFile || env && selected2.tokenSource !== "environment" || selected2.tokenSource === "environment" && !env || resolveWorkspace(selected2.cwd).root !== workspace.root)
+    throw new ContractError("conflict");
+  return {
+    workspace: workspace.root,
+    stateHome: c.stateHome,
+    config: selected2,
+    environmentToken: env?.value ?? null
+  };
+}
+function decodeHostInput(value) {
+  const o = closed(value, [
+    "workspace",
+    "stateHome",
+    "config",
+    "environmentToken"
+  ]);
+  const config = decodeHostConfig(o.config);
+  const environmentToken = o.environmentToken === null ? null : text(o.environmentToken, 1024, true);
+  if (config.tokenSource === "environment" !== (environmentToken !== null))
+    throw new ContractError("invalid");
+  return {
+    workspace: absolute(o.workspace),
+    stateHome: absolute(o.stateHome),
+    config,
+    environmentToken
+  };
+}
+var STARTUP_STAGES = [
+  "package",
+  "pi-agent-directory",
+  "pi-auth",
+  "pi-models",
+  "pi-runtime",
+  "service"
+];
+
+class StartupRefusal extends ContractError {
+  stage;
+  quarantined;
+  constructor(code2, stage, quarantined = false) {
+    super(code2);
+    this.stage = stage;
+    this.quarantined = quarantined;
+  }
+}
+function startupReport(error) {
+  if (error instanceof StartupRefusal)
+    return {
+      status: error.quarantined ? "quarantined" : "refused",
+      error: error.code,
+      stage: error.stage
+    };
+  return {
+    status: "refused",
+    error: error instanceof ContractError ? error.code : "unavailable",
+    stage: "service"
+  };
+}
+function decodeStartupReport(value) {
+  const o = closed(value, ["status", "error", "stage"]);
+  return {
+    status: oneOf(o.status, ["refused", "quarantined"]),
+    error: oneOf(o.error, ERROR_CODES),
+    stage: oneOf(o.stage, STARTUP_STAGES)
+  };
+}
+
 // src/service/cli.ts
 function nativeCall(c, operation, reveal = false, controlBody) {
   const access = c.localAccess();
@@ -8433,6 +8640,13 @@ function nativeCall(c, operation, reveal = false, controlBody) {
 }
 var pause = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function serviceStatus(c, diagnose = false) {
+  const registryLock = c.registryLockDiagnostic?.();
+  if (registryLock)
+    return {
+      status: "unavailable",
+      ...registryLock,
+      recovery: "cadence recover inspect --workspace <project> [--state-home <state-home>]"
+    };
   const observed = c.inspect();
   if (observed.status === "absent" || observed.status === "stopped")
     return observed;
@@ -8456,7 +8670,12 @@ async function stopService(c) {
   }
   const deadline = performance.now() + LIMITS.stopWaitMs;
   while (performance.now() < deadline) {
-    const observed = c.inspect();
+    let observed;
+    try {
+      observed = c.inspect();
+    } catch {
+      observed = { status: "unavailable" };
+    }
     if ("epoch" in observed && observed.epoch === epoch && observed.status === "stopped")
       return { status: "stopped", epoch };
     if (observed.status === "quarantined")
@@ -8470,11 +8689,24 @@ async function stopService(c) {
 function failedStatus(result) {
   return !!(result && typeof result === "object" && ("status" in result) && ["unconfirmed", "unavailable", "quarantined", "refused"].includes(String(result.status)));
 }
+function managementExitCode(result, foreground = false) {
+  if (foreground) {
+    try {
+      decodeStartupReport(result);
+      return 78;
+    } catch {}
+  }
+  return 1;
+}
 function serverConfigHint(error) {
   return `Cadence changed nothing: ${error.path} ${error.reason}.
 Fix it and run the command again; the file holds the WebUI port and token as ${PORT_KEY}=<1-65535> and ${TOKEN_KEY}=<at least 32 characters>, one line each.
 `;
 }
+function registryGuidance(workspace, stateHome) {
+  return `The shared registry lock blocks project access in this state home. No automatic lock deletion. Inspect locally: cadence recover inspect --workspace ${JSON.stringify(workspace)} --state-home ${JSON.stringify(stateHome)}; eligible dead locks require cadence recover resolve in a local terminal.
+`;
+}
 function startupGuidance(result, input) {
   let report;
   try {
@@ -8482,6 +8714,8 @@ function startupGuidance(result, input) {
   } catch {
     return "";
   }
+  if (report.error === "registry-locked")
+    return registryGuidance(input.workspace, input.stateHome);
   const agent = input.config.agentDir;
   const inspect = `Inspect: cadence-service diagnose|recover inspect --workspace ${JSON.stringify(input.workspace)}
 `;
@@ -8509,6 +8743,15 @@ ${inspect}` : "";
 async function startService(options, foreground, hostUrl) {
   const network = networkSnapshot(process.env);
   const env = hostEnvironment(process.env);
+  const c = new ServiceCoordination(options.workspace, options.stateHome);
+  if (c.registryLockDiagnostic()) {
+    process.stderr.write(registryGuidance(c.store.root, c.stateHome));
+    return {
+      status: "refused",
+      error: "registry-locked",
+      stage: "service"
+    };
+  }
   let input;
   try {
     input = decodeHostInput(selectStart(options, process.env));
@@ -8521,7 +8764,6 @@ async function startService(options, foreground, hostUrl) {
 `;
   if (Buffer.byteLength(serialized) > STARTUP_INPUT_BYTES)
     throw new ContractError("oversize");
-  const c = new ServiceCoordination(input.workspace, input.stateHome);
   const existing = await serviceStatus(c);
   if (existing && typeof existing === "object" && "status" in existing && existing.status === "alive") {
     const running = readHostConfig(c);
@@ -8618,6 +8860,8 @@ async function launchHost(input, c, foreground, hostUrl, cwd, env, network) {
     process.stdout.write(`${JSON.stringify(result)}
 `);
     await closure;
+    if (failedStatus(result))
+      process.exitCode = managementExitCode(result, true);
     return null;
   }
   return result;
@@ -8632,8 +8876,8 @@ async function privateLink(workspace, stateHome, config) {
 }
 class ProjectOpenRefusal extends ContractError {
   noOwner;
-  constructor(noOwner) {
-    super("unavailable");
+  constructor(noOwner, code2 = "unavailable") {
+    super(code2);
     this.noOwner = noOwner;
   }
 }
@@ -8642,6 +8886,8 @@ async function openProjectDirectory(workspace, stateHome, agentDir, hostUrl) {
     throw new ContractError("forbidden");
   effectiveWorkspace(workspace, stateHome);
   const c = new ServiceCoordination(workspace, stateHome);
+  if (c.registryLockDiagnostic())
+    throw new ProjectOpenRefusal(true, "registry-locked");
   const kept = readHostConfig(c);
   const options = {
     workspace,
@@ -8650,7 +8896,7 @@ async function openProjectDirectory(workspace, stateHome, agentDir, hostUrl) {
   };
   const result = await startService(options, false, hostUrl);
   if (!result || typeof result !== "object" || !("status" in result) || result.status !== "alive")
-    throw new ProjectOpenRefusal(!!result && typeof result === "object" && "status" in result && result.status === "refused" && c.inspect().status === "absent");
+    throw new ProjectOpenRefusal(!!result && typeof result === "object" && "status" in result && result.status === "refused" && (("error" in result) && result.error === "registry-locked" || c.inspect().status === "absent"), result && typeof result === "object" && "error" in result && result.error === "registry-locked" ? "registry-locked" : "unavailable");
   const link = await privateLink(c.store.root, stateHome);
   if (!link)
     throw new ContractError("unavailable");
@@ -9524,7 +9770,7 @@ import {
   opendirSync as opendirSync5,
   openSync as openSync5,
   readSync as readSync4,
-  realpathSync as realpathSync4
+  realpathSync as realpathSync3
 } from "node:fs";
 import { dirname as dirname10, isAbsolute as isAbsolute6, join as join12, relative as relative5, resolve as resolve6, sep as sep4 } from "node:path";
 
@@ -9899,7 +10145,7 @@ class WorkbenchFiles {
   excluded;
   constructor(root, excluded, secrets) {
     this.secrets = secrets;
-    this.root = realpathSync4(root);
+    this.root = realpathSync3(root);
     this.excluded = excluded.flatMap((path) => [
       resolve6(path),
       canonicalAmbientRoot(path)
@@ -9915,7 +10161,7 @@ class WorkbenchFiles {
   directory(path) {
     if (!isAbsolute6(path) || !safeDirectory(path))
       throw new ContractError("invalid");
-    const canonical = realpathSync4(path);
+    const canonical = realpathSync3(path);
     this.allowed(canonical);
     return canonical;
   }
@@ -10028,7 +10274,7 @@ async function createGateway(value, hostUrl, source) {
   const input = decodeGatewayInput(value), store = new GatewayStore(input.serverConfig, input.stateHome);
   const web = loadWebAssets(source?.webDirectory);
   const build2 = {
-    contractHash: "9c917c085d034e08764de359cee49aea748c395a63ed629fe67d149b97850fa1",
+    contractHash: "944f3b53bd5b7f1d3f30868e0947d900e356ae9a2bcfb9f591edd988b3d5eb3a",
     assets: {
       sourceHash: web.manifest.sourceHash,
       contractHash: web.manifest.contractHash,
@@ -10193,7 +10439,7 @@ Content-Length: 0\r
     return result;
   }
   function binding(id) {
-    const project = store.projects().find((p) => p.id === id);
+    const project = store.associatedProjects().find((p) => p.id === id);
     if (!project)
       throw new ContractError("unavailable");
     const c = new ServiceCoordination(project.path, input.stateHome), local = c.localAccess();
@@ -10236,7 +10482,7 @@ Content-Length: 0\r
       const originals = await Promise.allSettled([...opens.values()].map((o) => o.result));
       const uncertainOpening = originals.some((r) => r.status === "rejected" && !(r.reason instanceof ProjectOpenRefusal && r.reason.noOwner));
       const retired = await Promise.allSettled([...retirements]);
-      const targets = store.projects();
+      const targets = store.associatedProjects();
       await joinProjectStops(targets, async (p) => {
         const c = new ServiceCoordination(p.path, input.stateHome), observed = await serviceStatus(c);
         const status = observed && typeof observed === "object" && "status" in observed ? observed.status : "unavailable";
@@ -17132,7 +17378,7 @@ import {
   constants as constants6,
   fsyncSync as fsyncSync4,
   openSync as openSync6,
-  realpathSync as realpathSync5
+  realpathSync as realpathSync4
 } from "node:fs";
 import { dirname as dirname12, isAbsolute as isAbsolute7, join as join16, relative as relative6, sep as sep5 } from "node:path";
 function summary(text2, maximum, runId) {
@@ -17183,7 +17429,7 @@ function publicationRecord(store, reader, intent, link, run, request3, expected,
   else {
     if (action.kind !== "create" || !request3.cwd || store.list().length >= 1000)
       bad11();
-    const cwd = realpathSync5(request3.cwd), within = relative6(store.root, cwd);
+    const cwd = realpathSync4(request3.cwd), within = relative6(store.root, cwd);
     if (isAbsolute7(within) || within === ".." || within.startsWith(`..${sep5}`))
       bad11();
     record2 = {
@@ -19261,7 +19507,7 @@ class OwnerModelChoice {
 }
 
 // src/service/model-config.ts
-import { lstatSync as lstatSync11, realpathSync as realpathSync6 } from "node:fs";
+import { lstatSync as lstatSync11, realpathSync as realpathSync5 } from "node:fs";
 import { dirname as dirname13, isAbsolute as isAbsolute8, join as join18, resolve as resolve7 } from "node:path";
 var CONFIG_BYTES2 = 1024 * 1024;
 var ENTRY_LIMIT = 256;
@@ -19335,7 +19581,7 @@ function piSource(agentDir, home, cwd, env) {
   if (selected2 === "~" || selected2.startsWith("~/"))
     selected2 = home + selected2.slice(1);
   selected2 = resolve7(cwd, selected2);
-  const directory = join18(realpathSync6(dirname13(selected2)), selected2.slice(dirname13(selected2).length + 1));
+  const directory = join18(realpathSync5(dirname13(selected2)), selected2.slice(dirname13(selected2).length + 1));
   if (!lstatSync11(directory).isDirectory() || lstatSync11(directory).isSymbolicLink())
     refuse2();
   const files = new PrivateFiles(directory, false);
@@ -20773,7 +21019,7 @@ class ServiceOwner {
 
 // src/service/task-actions.ts
 import { randomUUID as randomUUID18 } from "node:crypto";
-import { realpathSync as realpathSync7 } from "node:fs";
+import { realpathSync as realpathSync6 } from "node:fs";
 
 // src/task-diff.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -23947,9 +24193,9 @@ class TaskActions {
       selection: structuredClone(options.selection),
       ownerSecrets: [...options.ownerSecrets]
     };
-    this.cwd = realpathSync7(options.cwd);
+    this.cwd = realpathSync6(options.cwd);
     const config = readHostConfig(options.host.coordination);
-    if (!config || realpathSync7(config.cwd) !== this.cwd)
+    if (!config || realpathSync6(config.cwd) !== this.cwd)
       throw new ContractError("unsupported-context");
     this.launchCwd = config.cwd;
     this.checkEnvironment = options.host.checkEnvironment;
@@ -24073,7 +24319,7 @@ class TaskActions {
     if (this.closed || this.options.host.owner.state !== "idle" || this.options.host.writer.quarantined)
       throw new ContractError("quarantine");
     this.options.host.owner.lease.assert();
-    if (!this.sources.current() || realpathSync7(this.cwd) !== this.cwd || realpathSync7(this.launchCwd) !== this.cwd || this.options.host.checkEnvironment !== this.checkEnvironment)
+    if (!this.sources.current() || realpathSync6(this.cwd) !== this.cwd || realpathSync6(this.launchCwd) !== this.cwd || this.options.host.checkEnvironment !== this.checkEnvironment)
       throw new ContractError("stale");
   }
   choiceSnapshot() {
@@ -24189,7 +24435,7 @@ class TaskActions {
     const access = this.currentAccess();
     const committedSeq = snapshot ?? h.writer.committedSeq;
     const selected2 = taskId ? h.coordination.store.loadSnapshot(taskId) : null;
-    if (selected2 && realpathSync7(selected2.record.cwd) !== this.cwd)
+    if (selected2 && realpathSync6(selected2.record.cwd) !== this.cwd)
       throw new ContractError("unsupported-context");
     const secrets = this.viewSecrets();
     const roles = this.sources.roles.map(({ role: role2, sha256 }) => ({
@@ -24695,7 +24941,7 @@ class TaskActions {
         this.assertChoice(expected);
         held.assertHeld();
         const actual = h.coordination.store.loadSnapshot(task.id), want = published ?? task;
-        if (!actual || actual.identity !== want.identity || actual.record.revision !== want.revision || realpathSync7(actual.record.cwd) !== this.cwd || this.generation !== expected.checkoutGeneration || h.writer.controlRevision(task.id) !== expected.controlRev + 1 || this.scheduler.activeTask(task.id))
+        if (!actual || actual.identity !== want.identity || actual.record.revision !== want.revision || realpathSync6(actual.record.cwd) !== this.cwd || this.generation !== expected.checkoutGeneration || h.writer.controlRevision(task.id) !== expected.controlRev + 1 || this.scheduler.activeTask(task.id))
           throw new ContractError("stale");
         const changes2 = captureChanges(h.coordination.store.root);
         if (changes2.fingerprint !== expected.observation.identity || changes2.complete !== expected.observation.complete)
@@ -24880,7 +25126,7 @@ import { join as join23 } from "node:path";
 
 // src/service/conversations.ts
 import { randomUUID as randomUUID19 } from "node:crypto";
-import { lstatSync as lstatSync13, opendirSync as opendirSync7, realpathSync as realpathSync8, statfsSync as statfsSync2 } from "node:fs";
+import { lstatSync as lstatSync13, opendirSync as opendirSync7, realpathSync as realpathSync7, statfsSync as statfsSync2 } from "node:fs";
 import { dirname as dirname14, join as join22 } from "node:path";
 var TURN_BYTES = 384 * 1024;
 var META_BYTES = 64 * 1024;
@@ -25001,7 +25247,7 @@ class Conversations {
   constructor(o) {
     this.o = o;
     this.root = join22(o.coordination.directory, "conversations-v1");
-    this.cwd = realpathSync8(o.cwd);
+    this.cwd = realpathSync7(o.cwd);
   }
   currentDirectory() {
     const current2 = resolveWorkspace(this.o.cwd);
@@ -25661,7 +25907,7 @@ function refuseAt(stage, step) {
   }
 }
 async function createServiceHost(value, sourceBuild) {
-  const embedded = "9c917c085d034e08764de359cee49aea748c395a63ed629fe67d149b97850fa1";
+  const embedded = "944f3b53bd5b7f1d3f30868e0947d900e356ae9a2bcfb9f591edd988b3d5eb3a";
   if (embedded && sourceBuild)
     throw new ContractError("unsupported-context");
   const contractHash = decodeHash(embedded ?? sourceBuild?.contractHash);