@agentshouse/kit 0.1.0-alpha.2 → 0.1.0-alpha.21

package/src/house.js

@@ -1,6 +1,9 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { chmod, mkdir, readFile, rm } from "node:fs/promises";
+import { connect, createServer } from "node:net";
+import { dirname, join } from "node:path";
 import { assertAcquiredCommandAdapter } from "./adapter.js";
+import { readFrames, writeFrame } from "./channel.js";
 import {
   assistantDraftsPath,
   assistantTextPath,
@@ -26,6 +29,7 @@ import {
   MCP_PROTOCOL_VERSION,
   WORKER_RUN_TOKEN_MARGIN_MS,
   runOutcomePath,
+  runRequestPath,
   secretInputPath,
   SECRET_VALUE_MAX,
   sessionInteractionsPath,
@@ -35,6 +39,10 @@ import { declarationReader } from "./declaration.js";
 import { houseRefusal, KitRefusal, throwHouseAnswer } from "./refusal.js";
 
 const LEASE = /^ahl_[A-Za-z0-9_-]+$/;
+const RESIDENT = "Resident";
+const LEASE_ACTIVE = "environment_control_lease_active";
+const UPGRADE_REQUIRED = "kit_upgrade_required";
+const UPDATE_DRAINING = "kit_update_draining";
 const ASSISTANT_DRAFT_STATES = ["streamed", "unsupported"];
 const ITEM_OUTCOMES = ["accepted", "duplicate", "rejected"];
 
@@ -49,6 +57,10 @@ async function readCredential(directory) {
   return stored;
 }
 
+function latchRefusal(answer, dependencies) {
+  if (answer?.error?.code === UPGRADE_REQUIRED) dependencies.contractRefused?.();
+}
+
 async function houseAnswer(house, path, init, dependencies, signal) {
   const fetcher = dependencies.fetch ?? fetch;
   let response;
@@ -66,6 +78,7 @@ async function houseAnswer(house, path, init, dependencies, signal) {
   } catch {
     answer = null;
   }
+  latchRefusal(answer, dependencies);
   throwHouseAnswer(response.status, answer, path);
   if (answer === null) throw new KitRefusal("kit_house_unavailable", path);
   return answer;
@@ -105,7 +118,245 @@ function heldLease(answer) {
   return { lease: answer.lease, expiresAt: Date.parse(answer.expires_at) };
 }
 
+function residentSocket(directory) {
+  return join(directory, "run", "resident.sock");
+}
+
+export function updateDrain(directory) {
+  return join(directory, "state", "update-drain");
+}
+
+export function refuseDrained(directory) {
+  if (existsSync(updateDrain(directory))) throw new KitRefusal(UPDATE_DRAINING);
+}
+
+function residentAnswer(status, code) {
+  const body = Buffer.from(JSON.stringify({ error: { code } })).toString("base64");
+  return { status, type: "application/json", body };
+}
+
+function newWork(path) {
+  return path === "/kit/telegram/updates" || (path.endsWith("/acquire") && path !== "/kit/commands/acquire");
+}
+
+async function residentRelay(session, request, signal, draining) {
+  const path = typeof request.path === "string" ? request.path : "";
+  if (!path.startsWith("/kit/") || path.startsWith("/kit/lease")) {
+    return residentAnswer(403, "kit_resident_route_refused");
+  }
+  if (draining && newWork(path)) {
+    return residentAnswer(409, UPDATE_DRAINING);
+  }
+  let authorization;
+  try {
+    authorization = await heldControl(session, signal);
+  } catch (error) {
+    return residentAnswer(error.status ?? 401, error.code ?? "kit_lease_rejected");
+  }
+  try {
+    const response = await (session.dependencies.fetch ?? fetch)(`${session.house}${path}`, {
+      method: request.method,
+      headers: { ...request.headers, authorization },
+      body: request.text ?? (request.bytes === undefined ? undefined : Buffer.from(request.bytes, "base64")),
+      signal,
+    });
+    const body = Buffer.from(await response.arrayBuffer());
+    if (response.status === 409) latchRefusal(JSON.parse(body.toString("utf8")), session.dependencies);
+    return {
+      status: response.status,
+      type: response.headers.get("content-type"),
+      body: body.length === 0 ? null : body.toString("base64"),
+    };
+  } catch {
+    return residentAnswer(503, "kit_house_unavailable");
+  }
+}
+
+export async function serveResident(session, directory, signal, drain, push) {
+  const socket = residentSocket(directory);
+  await mkdir(dirname(socket), { recursive: true, mode: 0o700 });
+  await rm(socket, { force: true });
+  const connections = new Set();
+  let holder = null;
+  let draining = false;
+  function answerDrain(connection) {
+    draining = true;
+    drain(holder !== null).then(
+      (answer) => {
+        if (!connection.destroyed) writeFrame(connection, answer);
+        connection.end();
+      },
+      () => connection.destroy(),
+    );
+    return false;
+  }
+  function hold(connection) {
+    if (holder !== null || draining || existsSync(updateDrain(directory))) {
+      writeFrame(connection, { refused: draining || holder === null ? UPDATE_DRAINING : LEASE_ACTIVE });
+      connection.end();
+      return false;
+    }
+    holder = connection;
+    renewControl(session, signal).then(
+      () => writeFrame(connection, { held: true }),
+      (error) => {
+        writeFrame(connection, { refused: error.code ?? "kit_lease_rejected" });
+        connection.end();
+      },
+    );
+    return true;
+  }
+  const server = createServer((connection) => {
+    connections.add(connection);
+    connection.on("error", () => connection.destroy());
+    const relayed = new Map();
+    let held = null;
+    connection.on("close", () => {
+      connections.delete(connection);
+      if (holder === connection) holder = null;
+      for (const cancelled of relayed.values()) cancelled.abort();
+    });
+    readFrames(connection, {
+      onFrame: (request) => {
+        if (held === null) {
+          held = request.drain === true ? answerDrain(connection) : hold(connection);
+          return;
+        }
+        if (!held) return;
+        if (request.cancel === true) {
+          relayed.get(request.id)?.abort();
+          return;
+        }
+        const cancelled = new AbortController();
+        relayed.set(request.id, cancelled);
+        const relaySignal = AbortSignal.any([signal, cancelled.signal]);
+        const answered =
+          request.push === undefined
+            ? residentRelay(session, request, relaySignal, draining)
+            : push(request.push, relaySignal).then((pushed) => ({ pushed }));
+        void answered.then((answer) => {
+          relayed.delete(request.id);
+          if (!connection.destroyed) writeFrame(connection, { id: request.id, ...answer });
+        });
+      },
+      onRefusal: () => connection.destroy(),
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socket, resolve);
+  });
+  await chmod(socket, 0o600);
+  return {
+    serving: () => holder !== null,
+    async close() {
+      for (const connection of connections) connection.destroy();
+      await new Promise((resolve) => server.close(resolve));
+      await rm(socket, { force: true });
+    },
+  };
+}
+
+export function requestDrain(directory) {
+  const connection = connect(residentSocket(directory));
+  return new Promise((resolve, reject) => {
+    const unavailable = () => reject(new KitRefusal("kit_resident_unavailable"));
+    connection.on("error", unavailable);
+    connection.on("close", unavailable);
+    readFrames(connection, {
+      onFrame: (answer) => {
+        resolve(answer);
+        connection.end();
+      },
+      onRefusal: () => connection.destroy(),
+    });
+    writeFrame(connection, { drain: true });
+  });
+}
+
+async function residentDelegation(directory, fetcher) {
+  const connection = connect(residentSocket(directory));
+  const pending = new Map();
+  let greet;
+  const greeting = new Promise((resolve) => {
+    greet = resolve;
+  });
+  const unavailable = () => residentAnswer(503, "kit_resident_unavailable");
+  function settle(id, answer) {
+    pending.get(id)?.(answer);
+    pending.delete(id);
+    if (pending.size === 0) connection.unref();
+  }
+  connection.on("error", () => connection.destroy());
+  connection.on("close", () => {
+    greet(null);
+    for (const id of [...pending.keys()]) settle(id, unavailable());
+  });
+  readFrames(connection, {
+    onFrame: (frame) => (frame.id === undefined ? greet(frame) : settle(frame.id, frame)),
+    onRefusal: () => connection.destroy(),
+  });
+  writeFrame(connection, { hold: true });
+  const held = await greeting;
+  if (held === null) return null;
+  if (held.held !== true) {
+    connection.destroy();
+    throw new KitRefusal(held.refused);
+  }
+  connection.unref();
+  let next = 0;
+  function exchange(frame, signal) {
+    signal?.throwIfAborted();
+    if (connection.destroyed) return Promise.resolve(unavailable());
+    return new Promise((resolve, reject) => {
+      const id = (next += 1);
+      const cancel = () => {
+        pending.delete(id);
+        settle(id);
+        if (!connection.destroyed) writeFrame(connection, { id, cancel: true });
+        reject(signal.reason);
+      };
+      signal?.addEventListener("abort", cancel, { once: true });
+      pending.set(id, (answer) => {
+        signal?.removeEventListener("abort", cancel);
+        resolve(answer);
+      });
+      connection.ref();
+      writeFrame(connection, { id, ...frame });
+    });
+  }
+  async function push(request, signal) {
+    const answer = await exchange({ push: request }, signal);
+    if (answer.pushed === undefined) throw new KitRefusal("kit_resident_unavailable");
+    return answer.pushed;
+  }
+  async function delegated(url, init = {}) {
+    const { authorization, ...headers } = init.headers ?? {};
+    if (authorization !== RESIDENT) return fetcher(url, init);
+    const address = new URL(url);
+    const answer = await exchange(
+      {
+        method: init.method ?? "GET",
+        path: `${address.pathname}${address.search}`,
+        headers,
+        ...(typeof init.body === "string"
+          ? { text: init.body }
+          : init.body === undefined
+            ? {}
+            : { bytes: Buffer.from(init.body).toString("base64") }),
+      },
+      init.signal,
+    );
+    return new Response(answer.body === null ? null : Buffer.from(answer.body, "base64"), {
+      status: answer.status,
+      headers: answer.type === null ? {} : { "content-type": answer.type },
+    });
+  }
+  return { connection, fetch: delegated, push };
+}
+
 export async function openSession(options, dependencies = {}) {
+  if (options.resident !== true) refuseDrained(options.directory);
   const session = {
     house: options.house,
     dependencies,
@@ -114,27 +365,40 @@ export async function openSession(options, dependencies = {}) {
     expiresAt: 0,
     signal: options.signal,
   };
+  const resident =
+    options.acquire === true || options.resident === true
+      ? null
+      : await residentDelegation(options.directory, dependencies.fetch ?? fetch);
+  if (resident !== null) {
+    session.resident = resident.connection;
+    session.push = resident.push;
+    session.dependencies = { ...dependencies, fetch: resident.fetch };
+    return session;
+  }
+  session.dependencies = {
+    ...dependencies,
+    contractRefused: () => {
+      session.refused = true;
+    },
+  };
   const credential = await readCredential(options.directory);
-  Object.assign(
-    session,
-    heldLease(
-      await houseRequest(
-        session.house,
-        `Bearer ${credential}`,
-        "/kit/lease",
-        {},
-        session.dependencies,
-        session.signal,
-      ),
-    ),
-  );
+  const answer = await houseRequest(
+    session.house,
+    `Bearer ${credential}`,
+    "/kit/lease",
+    {},
+    session.dependencies,
+    session.signal,
+  ).catch((error) => {
+    if (options.resident === true && session.refused) return null;
+    throw error;
+  });
+  if (answer !== null) Object.assign(session, heldLease(answer));
   return session;
 }
 
-export async function heldControl(session, signal = session.signal) {
-  if (session.expiresAt - session.now().getTime() > LEASE_RENEWAL_MARGIN_MS) {
-    return `Bearer ${session.lease}`;
-  }
+async function renewControl(session, signal) {
+  if (session.refused) throw new KitRefusal(UPGRADE_REQUIRED);
   Object.assign(
     session,
     heldLease(
@@ -148,10 +412,18 @@ export async function heldControl(session, signal = session.signal) {
       ),
     ),
   );
+}
+
+export async function heldControl(session, signal = session.signal) {
+  if (session.resident !== undefined) return RESIDENT;
+  if (session.refused) throw new KitRefusal(UPGRADE_REQUIRED);
+  if (session.expiresAt - session.now().getTime() <= LEASE_RENEWAL_MARGIN_MS) {
+    await renewControl(session, signal);
+  }
   return `Bearer ${session.lease}`;
 }
 
-function controlSleep(milliseconds, signal) {
+export function controlSleep(milliseconds, signal) {
   return new Promise((resolve, reject) => {
     if (signal.aborted) {
       reject(new KitRefusal("kit_command_cancelled"));
@@ -195,9 +467,11 @@ export function mutatingCall(classification) {
 }
 
 export async function releaseControl(session, options = {}) {
+  session.resident?.end();
   if (session.lease === null) return;
   const held = session.lease;
   try {
+    if (session.refused) throw new KitRefusal(UPGRADE_REQUIRED);
     await houseRequest(
       session.house,
       `Bearer ${held}`,
@@ -229,6 +503,7 @@ export async function maintainControl(session, operation, signal, { release = tr
     signal?.addEventListener("abort", cancelOperation, { once: true });
   });
   const renewal = (async () => {
+    if (session.resident !== undefined) return;
     const sleep = session.dependencies.controlSleep ?? controlSleep;
     while (!stopped) {
       const delay = Math.max(
@@ -245,7 +520,7 @@ export async function maintainControl(session, operation, signal, { release = tr
           throw new KitRefusal("kit_lease_rejected");
         }
       } catch (error) {
-        if (stopped) return;
+        if (stopped || session.refused) return;
         rejectFailure(error);
         maintenance.abort();
         return;
@@ -253,20 +528,14 @@ export async function maintainControl(session, operation, signal, { release = tr
     }
   })();
   const running = Promise.resolve().then(() => operation(operationSignal));
-  let ended = false;
   try {
-    const answer = await Promise.race([running, failure, cancellation]);
-    ended = true;
-    return answer;
-  } catch (error) {
-    ended = error instanceof KitRefusal && error.code === "kit_command_cancelled";
-    throw error;
+    return await Promise.race([running, failure, cancellation]);
   } finally {
     stopped = true;
     maintenance.abort();
     signal?.removeEventListener("abort", cancelOperation);
     await Promise.all([renewal, running.catch(() => undefined)]);
-    if (ended && release) await releaseControl(session);
+    if (release) await releaseControl(session);
   }
 }
 
@@ -479,6 +748,7 @@ export async function reportLogin(session, login, outcome, signal = session.sign
 }
 
 const envelope = declarationReader("kit_acquire_rejected");
+const input = declarationReader("kit_run_input_unreadable");
 
 function acquiredRoute(value, declaration) {
   const route = envelope.plain(value, declaration);
@@ -496,79 +766,82 @@ function acquiredRoute(value, declaration) {
 
 function conversationText(value, declaration) {
   if (value === null) return null;
-  if (typeof value !== "string" || value.length > 4096) envelope.refuse(declaration);
+  if (typeof value !== "string" || value.length > 4096) input.refuse(declaration);
   return value;
 }
 
 function conversationMessage(value, declaration) {
-  const message = envelope.plain(value, declaration);
+  const message = input.plain(value, declaration);
   const text = conversationText(message.text, `${declaration}.text`);
   const caption = conversationText(message.caption, `${declaration}.caption`);
-  if (!Array.isArray(message.files)) envelope.refuse(`${declaration}.files`);
+  if (!Array.isArray(message.files)) input.refuse(`${declaration}.files`);
   const files = message.files.map((value, index) => {
     const name = `${declaration}.files[${index}]`;
-    const file = envelope.plain(value, name);
+    const file = input.plain(value, name);
     if (file.bytes !== null && (!Number.isSafeInteger(file.bytes) || file.bytes < 0)) {
-      envelope.refuse(`${name}.bytes`);
+      input.refuse(`${name}.bytes`);
     }
     return {
-      path: envelope.text(file.path, `${name}.path`, 2048),
-      media_kind: envelope.text(file.media_kind, `${name}.media_kind`, 128),
-      media_type: file.media_type === null ? null : envelope.text(file.media_type, `${name}.media_type`, 255),
+      path: input.text(file.path, `${name}.path`, 2048),
+      media_kind: input.text(file.media_kind, `${name}.media_kind`, 128),
+      media_type: file.media_type === null ? null : input.text(file.media_type, `${name}.media_type`, 255),
       bytes: file.bytes,
     };
   });
-  if (!text && !caption && files.length === 0) envelope.refuse(declaration);
+  if (!text && !caption && files.length === 0) input.refuse(declaration);
   return {
-    message_id: envelope.text(message.message_id, `${declaration}.message_id`, 128),
+    message_id: input.text(message.message_id, `${declaration}.message_id`, 128),
     text, caption, files,
   };
 }
 
-function acquiredRequest(acquired, declaration) {
-  if (acquired.kind === "conversation") {
-    if (acquired.origin !== "user") envelope.refuse(`${declaration}.origin`);
-    const conversation = envelope.plain(acquired.conversation, `${declaration}.conversation`);
-    const turn = envelope.plain(conversation.turn, `${declaration}.conversation.turn`);
+function runRequest(answer) {
+  const request = input.plain(answer, "request");
+  if (request.kind === "conversation") {
+    if (request.origin !== "user") input.refuse("request.origin");
+    const turn = input.plain(request.turn, "request.turn");
     return {
+      kind: "conversation",
       origin: "user",
-      conversation: {
-        turn: {
-          id: envelope.text(turn.id, `${declaration}.conversation.turn.id`, 128),
-          sequence: envelope.positiveCount(turn.sequence, `${declaration}.conversation.turn.sequence`),
-          messages: envelope.filled(turn.messages, `${declaration}.conversation.turn.messages`)
-            .map((message, index) => conversationMessage(message, `${declaration}.conversation.turn.messages[${index}]`)),
-        },
+      turn: {
+        id: input.text(turn.id, "request.turn.id", 128),
+        sequence: input.positiveCount(turn.sequence, "request.turn.sequence"),
+        messages: input.filled(turn.messages, "request.turn.messages")
+          .map((message, index) => conversationMessage(message, `request.turn.messages[${index}]`)),
       },
     };
   }
-  if (acquired.kind !== "routine") envelope.refuse(`${declaration}.kind`);
-  const request = envelope.plain(acquired.request, `${declaration}.request`);
-  const routine = envelope.plain(acquired.routine, `${declaration}.routine`);
+  if (request.kind !== "routine") input.refuse("request.kind");
+  const routine = input.plain(request.routine, "request.routine");
+  if (typeof request.payload !== "string" || Array.from(request.payload).length > 20_000) input.refuse("request.payload");
+  if (!Array.isArray(request.references)) input.refuse("request.references");
   return {
-    origin: envelope.text(acquired.origin, `${declaration}.origin`, 32),
+    kind: "routine",
+    origin: input.text(request.origin, "request.origin", 32),
     routine: {
-      name: envelope.text(routine.name, `${declaration}.routine.name`, 256),
-      version: envelope.positiveCount(routine.version, `${declaration}.routine.version`),
+      name: input.text(routine.name, "request.routine.name", 256),
+      version: input.positiveCount(routine.version, "request.routine.version"),
     },
-    payload: envelope.plain(request.payload, `${declaration}.request.payload`),
-    requested_by: envelope.text(
-      request.requested_by,
-      `${declaration}.request.requested_by`,
-      128,
-    ),
-    requested_at: envelope.text(
-      request.requested_at,
-      `${declaration}.request.requested_at`,
-      64,
-    ),
-    deliver_at:
-      request.deliver_at === null
-        ? null
-        : envelope.text(request.deliver_at, `${declaration}.request.deliver_at`, 64),
+    instruction: input.text(request.instruction, "request.instruction", 256 * 1024),
+    payload: request.payload,
+    references: request.references.map((reference, index) => input.plain(reference, `request.references[${index}]`)),
+    requested_by: input.text(request.requested_by, "request.requested_by", 128),
+    requested_at: input.text(request.requested_at, "request.requested_at", 64),
+    deliver_at: request.deliver_at === null ? null : input.text(request.deliver_at, "request.deliver_at", 64),
   };
 }
 
+export async function readRunRequest(session, run, token, signal = session.signal) {
+  return runRequest(await houseRequest(
+    session.house,
+    `Bearer ${token}`,
+    runRequestPath(run),
+    {},
+    session.dependencies,
+    signal,
+  ));
+}
+
 function acquiredAssignment(value, declaration) {
   const acquired = envelope.plain(value, declaration);
   const bridge = envelope.plain(acquired.session, `${declaration}.session`);
@@ -597,7 +870,6 @@ function acquiredAssignment(value, declaration) {
       token: envelope.text(bridge.bridge_token, `${declaration}.session.bridge_token`, 512),
       expiresAt: Date.parse(expiresAt),
     },
-    request: acquiredRequest(acquired, declaration),
   };
 }
 

package/src/inbound.js

@@ -134,13 +134,9 @@ export async function reconcileInbound(directory, session) {
 }
 
 export async function localRequest(directory, run, request) {
-  const turn = request?.conversation?.turn ?? (request?.kind === "conversation" ? request.turn : null);
-  if (turn === null || turn === undefined) return request;
+  if (request.kind !== "conversation") return request;
   const result = structuredClone(request);
-  const localTurn = result.conversation?.turn ?? result.turn;
-  if (!Array.isArray(localTurn.messages)) throw new KitRefusal("kit_run_input_unreadable");
-  for (const message of localTurn.messages) {
-    if (!Array.isArray(message.files)) throw new KitRefusal("kit_run_input_unreadable");
+  for (const message of result.turn.messages) {
     for (const file of message.files) {
       const parts = typeof file.path === "string" ? file.path.split("/") : [];
       if (parts.length !== 4 || parts[0] !== ROOT || parts[1] !== run || !UUID.test(parts[1]) || !UUID.test(parts[2]) || !segment(parts[3])) {
@@ -161,15 +157,3 @@ export async function localRequest(directory, run, request) {
   }
   return result;
 }
-
-export async function localReply(directory, run, frame, reply) {
-  if (frame.method !== "tools/call" || frame.params?.name !== "session_get_request" || reply.error || reply.result?.isError) return reply;
-  const result = structuredClone(reply);
-  for (const item of result.result?.content ?? []) {
-    if (item.type !== "text") continue;
-    let input;
-    try { input = JSON.parse(item.text); } catch { throw new KitRefusal("kit_run_input_unreadable"); }
-    item.text = JSON.stringify(await localRequest(directory, run, input));
-  }
-  return result;
-}

package/src/kit-work-stream.js

@@ -0,0 +1,88 @@
+import { setTimeout as delay } from "node:timers/promises";
+import WebSocket from "ws";
+import { KIT_CONTRACT_VERSION } from "./contract.js";
+import { heldControl } from "./house.js";
+import { KitRefusal } from "./refusal.js";
+
+const PROTOCOL = "house.kit.stream.1";
+const WATCHED_SUBJECTS = ["agents", "working_copy"];
+
+function streamAddress(house) {
+  const url = new URL("/kit/stream", house);
+  if (url.protocol === "https:") url.protocol = "wss:";
+  else if (url.protocol === "http:") url.protocol = "ws:";
+  else throw new KitRefusal("kit_house_unavailable", "/kit/stream");
+  return url;
+}
+
+async function connected(session, signal, available, dependencies) {
+  const authorization = await heldControl(session, signal);
+  return new Promise((resolve, reject) => {
+    const Socket = dependencies.workSocket ?? WebSocket;
+    const socket = new Socket(streamAddress(session.house), PROTOCOL, {
+      headers: { authorization, "x-house-kit-version": KIT_CONTRACT_VERSION },
+      handshakeTimeout: 10_000,
+      maxPayload: 4096,
+      perMessageDeflate: false,
+    });
+    let finished = false;
+    const finish = (error = null) => {
+      if (finished) return;
+      finished = true;
+      signal.removeEventListener("abort", stop);
+      if (error === null) resolve();
+      else reject(error);
+    };
+    const stop = () => {
+      socket.terminate();
+      finish();
+    };
+    signal.addEventListener("abort", stop, { once: true });
+    socket.on("open", () => available(null));
+    socket.on("message", (data) => {
+      let frame;
+      try {
+        frame = JSON.parse(data.toString());
+      } catch {
+        return;
+      }
+      if (frame?.type === "work_available" && WATCHED_SUBJECTS.includes(frame.subject)) {
+        available(frame.subject);
+      }
+    });
+    socket.on("unexpected-response", (_request, response) => {
+      response.resume();
+      if (response.statusCode === 409) session.dependencies.contractRefused?.();
+      const refusal =
+        response.statusCode === 409 ? new KitRefusal("kit_upgrade_required") : null;
+      socket.terminate();
+      finish(refusal);
+    });
+    socket.on("error", () => {
+      socket.terminate();
+      finish();
+    });
+    socket.on("close", () => finish());
+    if (signal.aborted) stop();
+  });
+}
+
+export async function watchKitWork(session, signal, available, dependencies = {}) {
+  let retryMs = 500;
+  while (!signal.aborted) {
+    const began = Date.now();
+    try {
+      await connected(session, signal, available, dependencies);
+    } catch (error) {
+      if (error instanceof KitRefusal && error.code === "kit_upgrade_required") throw error;
+      if (signal.aborted) return;
+    }
+    if (signal.aborted) return;
+    retryMs = Date.now() - began >= 30_000 ? 1000 : Math.min(retryMs * 2, 30_000);
+    try {
+      await delay(dependencies.workReconnectMs ?? retryMs, undefined, { signal });
+    } catch (error) {
+      if (!signal.aborted) throw error;
+    }
+  }
+}