@bjorntech/key-ferry 0.1.13 → 0.1.17

package/dist/varlock/manager.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { access, mkdtemp, realpath, rm, stat, lstat } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -6,6 +7,7 @@ import { Duration, Effect, Layer, Scope, Semaphore } from "effect";
 import { ProjectKeyFerryManager, VarlockError, } from "../contracts.js";
 import { Process, ProcessLive, } from "../services/process.js";
 import { classifyStderr } from "./diagnostics.js";
+import { removeOwnershipRecord, appendProxyLedgerEntry, reapStaleOwnershipRecords, writeOwnershipRecord, ownershipFileOps, ownershipDirectory, } from "./ownership.js";
 import { decodeSessionList, findOwnedSession, sanitizeSessionStatus, selectPlaceholderEnvironment, validateProxyWiring, } from "./protocol.js";
 const DEFAULT_COMMAND = ["varlock"];
 const DEFAULT_START_TIMEOUT = 30_000;
@@ -14,8 +16,15 @@ const DEFAULT_REFRESH_TIMEOUT = 30_000;
 const DEFAULT_POLL_INTERVAL = 100;
 const MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 const MAX_TIMEOUT = 10 * 60_000;
+const DEFAULT_HEALTH_CHECK_INTERVAL = 1_000;
 const defaultFileOps = { mkdtemp, realpath, rm };
-const safeError = (code, retryable) => new VarlockError({ code, retryable, message: `Varlock ${code.replaceAll("_", " ")}` });
+const safeError = (code, retryable) => new VarlockError({
+    code,
+    retryable,
+    message: code === "ownership_unavailable"
+        ? "Key Ferry ownership directory is unavailable"
+        : `Varlock ${code.replaceAll("_", " ")}`,
+});
 const fromProcessError = (error, code) => new VarlockError({
     code,
     retryable: error.code === "timeout" || error.code === "spawn-failed" || error.code === "io",
@@ -31,37 +40,64 @@ function adapterOptions(options) {
     const raw = options.adapter ?? {};
     const command = raw.command === undefined ? [...DEFAULT_COMMAND] : raw.command;
     const environmentKeys = raw.environmentKeys;
-    if (!Array.isArray(command) ||
-        command.length === 0 ||
-        command.length > 32 ||
-        command.some((v) => typeof v !== "string" || v.length === 0 || v.length > 1024 || v.includes("\0"))) {
+    const [validCommand, validEnvironmentKeys] = validateAdapterArrays(command, environmentKeys);
+    const ownershipDirectory = raw.ownershipDirectory;
+    validateOwnershipDirectory(ownershipDirectory);
+    return {
+        command: [...validCommand],
+        environmentKeys: [...validEnvironmentKeys],
+        startupTimeoutMs: adapterNumber(raw, "startupTimeoutMs", DEFAULT_START_TIMEOUT, 100, MAX_TIMEOUT),
+        commandTimeoutMs: adapterNumber(raw, "commandTimeoutMs", DEFAULT_COMMAND_TIMEOUT, 100, MAX_TIMEOUT),
+        reloadTimeoutMs: adapterNumber(raw, "reloadTimeoutMs", DEFAULT_REFRESH_TIMEOUT, 100, MAX_TIMEOUT),
+        pollIntervalMs: adapterNumber(raw, "pollIntervalMs", DEFAULT_POLL_INTERVAL, 10, 10_000),
+        requireStrictEgress: readStrictEgress(raw.requireStrictEgress),
+        ...(ownershipDirectory === undefined ? {} : { ownershipDirectory }),
+        healthCheckIntervalMs: adapterNumber(raw, "healthCheckIntervalMs", DEFAULT_HEALTH_CHECK_INTERVAL, 100, MAX_TIMEOUT),
+        ...readLifecycleLogger(raw),
+    };
+}
+function validateAdapterArrays(command, environmentKeys) {
+    if (!validCommandArray(command) || !validEnvironmentKeyArray(environmentKeys))
         throw safeError("invalid_config", false);
-    }
-    if (!Array.isArray(environmentKeys) ||
-        environmentKeys.length > 128 ||
-        environmentKeys.some((v) => typeof v !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(v) || v.length > 256)) {
+    return [command, environmentKeys];
+}
+function validateOwnershipDirectory(value) {
+    if (value !== undefined && (typeof value !== "string" || value.length === 0))
         throw safeError("invalid_config", false);
-    }
-    const numberOption = (name, fallback, min, max) => {
-        const value = raw[name];
-        if (value === undefined)
-            return fallback;
-        if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min || value > max)
-            throw safeError("invalid_config", false);
-        return value;
-    };
-    const strict = raw.requireStrictEgress;
-    if (strict !== undefined && typeof strict !== "boolean")
+}
+function adapterNumber(raw, name, fallback, min, max) {
+    const value = raw[name];
+    if (value === undefined)
+        return fallback;
+    if (!validAdapterNumber(value, min, max))
         throw safeError("invalid_config", false);
-    return {
-        command: [...command],
-        environmentKeys: [...environmentKeys],
-        startupTimeoutMs: numberOption("startupTimeoutMs", DEFAULT_START_TIMEOUT, 100, MAX_TIMEOUT),
-        commandTimeoutMs: numberOption("commandTimeoutMs", DEFAULT_COMMAND_TIMEOUT, 100, MAX_TIMEOUT),
-        reloadTimeoutMs: numberOption("reloadTimeoutMs", DEFAULT_REFRESH_TIMEOUT, 100, MAX_TIMEOUT),
-        pollIntervalMs: numberOption("pollIntervalMs", DEFAULT_POLL_INTERVAL, 10, 10_000),
-        requireStrictEgress: strict ?? true,
-    };
+    return value;
+}
+function validAdapterNumber(value, min, max) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= min && value <= max;
+}
+function readLifecycleLogger(raw) {
+    return typeof raw.lifecycleLogger === "function"
+        ? {
+            lifecycleLogger: raw.lifecycleLogger,
+        }
+        : {};
+}
+function validCommandArray(value) {
+    return (Array.isArray(value) &&
+        value.length > 0 &&
+        value.length <= 32 &&
+        value.every((v) => typeof v === "string" && v.length > 0 && v.length <= 1024 && !v.includes("\0")));
+}
+function validEnvironmentKeyArray(value) {
+    return (Array.isArray(value) &&
+        value.length <= 128 &&
+        value.every((v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(v) && v.length <= 256));
+}
+function readStrictEgress(value) {
+    if (value !== undefined && typeof value !== "boolean")
+        throw safeError("invalid_config", false);
+    return value ?? true;
 }
 function safeProjectDirectory(value) {
     if (typeof value !== "string" ||
@@ -102,32 +138,48 @@ function parseEnvironmentOutput(raw) {
     return result;
 }
 function statusSnapshot(state, projectDirectory) {
-    let endpoint;
-    if (state.session) {
-        try {
-            endpoint = validateProxyWiring(state.session.env).proxyUrl;
-        }
-        catch {
-            endpoint = undefined;
-        }
-    }
     return {
         phase: state.phase,
         projectDirectory: projectDirectory,
         generation: state.generation,
+        ...statusOptionalFields(state),
+    };
+}
+function statusOptionalFields(state) {
+    return {
         ...(state.process ? { pid: state.process.pid } : {}),
-        ...(endpoint ? { endpoint } : {}),
+        ...(state.session ? { sessionId: state.session.uuid, proxySessionId: state.session.uuid } : {}),
+        ...statusEndpointField(state),
         ...(state.lastRefreshAt ? { lastRefreshAt: state.lastRefreshAt } : {}),
         ...(state.error ? { error: state.error } : {}),
     };
 }
+function statusEndpointField(state) {
+    if (!state.session)
+        return {};
+    try {
+        return { endpoint: validateProxyWiring(state.session.env).proxyUrl };
+    }
+    catch {
+        return {};
+    }
+}
 function commandParts(options, args) {
-    return { executable: options.command[0], args: [...options.command.slice(1), ...args] };
+    return {
+        executable: options.command[0],
+        args: [...options.command.slice(1), ...args],
+    };
 }
 function runCommand(process, options, cwd, args, timeoutMs, environment) {
     const parts = commandParts(options, args);
     return process
-        .run({ ...parts, cwd, env: environment, maxBytes: MAX_OUTPUT_BYTES, timeoutMs })
+        .run({
+        ...parts,
+        cwd,
+        env: environment,
+        maxBytes: MAX_OUTPUT_BYTES,
+        timeoutMs,
+    })
         .pipe(Effect.mapError((error) => fromProcessError(error, error.code === "timeout" ? "timeout" : "unavailable")), Effect.map(({ stdout, stderr }) => ({ stdout, stderr })));
 }
 function candidatesForOwner(records, pid, cwd) {
@@ -143,7 +195,17 @@ function prepareStart(state, healthCheck, snapshot) {
         return Effect.fail(safeError("disposed", false));
     if (!state.process || !state.session)
         return Effect.succeed(undefined);
-    return healthCheck().pipe(Effect.map(() => (state.phase === "ready" ? snapshot() : undefined)));
+    return healthCheck(true).pipe(Effect.flatMap(() => prepareExistingStart(state, snapshot)));
+}
+function prepareExistingStart(state, snapshot) {
+    if (!state.process || !state.session)
+        return Effect.succeed(undefined);
+    if (state.phase === "ready")
+        return Effect.succeed(snapshot());
+    return Effect.fail(startFailure(state.error));
+}
+function startFailure(error) {
+    return error ?? safeError("not_ready", true);
 }
 function requireRefreshSession(state) {
     if (!state.process || !state.session)
@@ -187,13 +249,10 @@ function validateRefreshCapability(state, session, requireStrictEgress, healthCh
         }
     });
 }
-function validateStartupEgress(state, requireStrictEgress, session, handle) {
+function validateStartupEgress(state, requireStrictEgress, session, _handle) {
     if (!requireStrictEgress || session.egressMode === "strict")
         return Effect.void;
-    const error = safeError("invalid_config", false);
-    return handle.stop.pipe(Effect.catch(() => Effect.void), Effect.tap(() => Effect.sync(() => {
-        state.process = undefined;
-    })), Effect.flatMap(() => Effect.fail(error)));
+    return Effect.fail(safeError("invalid_config", false));
 }
 function assertRegularCertificate(pathInfo) {
     if (!pathInfo.isFile() || pathInfo.isSymbolicLink())
@@ -210,6 +269,9 @@ function assertOwnedCertificate(cert) {
         (Number(cert.mode) & 0o022) !== 0)
         throw new Error("certificate ownership or permissions invalid");
 }
+function healthCheckDue(force, lastHealthCheckAt, intervalMs) {
+    return force || Date.now() - lastHealthCheckAt >= intervalMs;
+}
 function rejectUnavailableEnvironment(state) {
     if (state.phase === "failed" || state.phase === "degraded")
         return Effect.fail(safeError("not_ready", true));
@@ -223,6 +285,8 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
         // released, rather than being released at the end of ensureStarted.
         const managerScope = yield* Scope.Scope;
         const config = adapterOptions(options);
+        // Stale cleanup is bounded, idempotent, and never gates MCP startup.
+        yield* Effect.promise(() => reapStaleOwnershipRecords(config.command, ownershipFileOps(config.ownershipDirectory ?? ownershipDirectory()))).pipe(Effect.forkDetach, Effect.asVoid);
         const requestedCwd = safeProjectDirectory(options.projectDirectory);
         const cwd = yield* Effect.tryPromise({
             try: async () => {
@@ -244,25 +308,136 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
         let certDirectoryReal;
         const ownedCertDirectories = new Set();
         const lock = yield* Semaphore.make(1);
-        const state = { phase: "stopped", generation: 0, disposed: false };
+        const state = {
+            phase: "stopped",
+            generation: 0,
+            disposed: false,
+        };
+        let ownershipHash = createHash("sha256").update(cwd).digest("hex");
+        const processStartTime = (pid, swallow = false) => processService.startTime
+            ? Effect.runPromise(processService.startTime(pid)).catch((error) => {
+                if (swallow)
+                    return undefined;
+                throw error;
+            })
+            : Promise.resolve(undefined);
+        const ownershipRecord = (session, pid, _command) => Effect.tryPromise({
+            try: async () => {
+                const starterStartTime = await processStartTime(pid);
+                await writeOwnershipRecord({
+                    brokerKeyHash: (ownershipHash = createHash("sha256")
+                        .update(`${cwd}\0${session.uuid}`)
+                        .digest("hex")),
+                    version: 2,
+                    sessionUuid: session.uuid,
+                    starterPid: pid,
+                    ...(starterStartTime ? { starterStartTime } : {}),
+                    cwd,
+                    created: new Date().toISOString(),
+                }, ownershipFileOps(config.ownershipDirectory ?? ownershipDirectory()));
+                const proxyStartTime = await processStartTime(session.ownerPid, true);
+                await appendProxyLedgerEntry({
+                    version: 1,
+                    sessionUuid: session.uuid,
+                    proxyPid: session.ownerPid,
+                    ...(proxyStartTime ? { proxyStartTime } : {}),
+                    ownerPid: pid,
+                    ...(starterStartTime ? { ownerStartTime: starterStartTime } : {}),
+                    cwd,
+                    created: new Date().toISOString(),
+                }, ownershipFileOps(config.ownershipDirectory ?? ownershipDirectory()));
+            },
+            catch: () => safeError("ownership_unavailable", false),
+        });
         const clearCapability = (phase, error) => {
             state.phase = phase;
             state.environment = undefined;
-            state.session = undefined;
             state.error = error;
             state.generation += 1;
         };
-        const healthCheck = () => {
-            if (!state.process)
+        let lastHealthCheckAt = 0;
+        let healthCheckInFlight;
+        const healthCheck = (force = false) => {
+            if (!state.process || !state.session)
                 return Effect.void;
-            return state.process.health.pipe(Effect.flatMap((health) => {
-                if (health.running)
-                    return Effect.void;
-                clearCapability("degraded", safeError("unavailable", true));
+            if (healthCheckInFlight)
+                return healthCheckInFlight;
+            if (!healthCheckDue(force, lastHealthCheckAt, config.healthCheckIntervalMs))
                 return Effect.void;
-            }));
+            lastHealthCheckAt = Date.now();
+            const old = state.session;
+            const oldHandle = state.process;
+            const check = runCommand(processService, config, cwd, ["proxy", "status", "--format", "json"], config.commandTimeoutMs, ambientEnvironment).pipe(
+            // A failed status query is unknown, not evidence that the proxy died.
+            Effect.flatMap(({ stdout }) => Effect.try({
+                try: () => decodeSessionList(stdout),
+                catch: () => undefined,
+            })), Effect.flatMap((records) => {
+                if (!records)
+                    return Effect.void;
+                return oldHandle.health.pipe(Effect.flatMap((health) => {
+                    const failedStarter = !health.running &&
+                        health.exit !== undefined &&
+                        (health.exit.code !== 0 || health.exit.signal !== null);
+                    const active = records.some((item) => item.uuid === old.uuid && item.endedAt === undefined);
+                    if (active && !failedStarter)
+                        return Effect.void;
+                    return stopCapturedSession(old).pipe(Effect.tap((stopped) => oldHandle.stop.pipe(Effect.catch(() => Effect.void)).pipe(Effect.andThen(Effect.sync(() => {
+                        if (stopped) {
+                            state.process = undefined;
+                            clearCapability("degraded", safeError("unavailable", true));
+                        }
+                        else {
+                            state.phase = "degraded";
+                            state.error = safeError("unavailable", true);
+                        }
+                    })))), Effect.asVoid);
+                }));
+            }), Effect.catch(() => Effect.void));
+            healthCheckInFlight = check.pipe(Effect.ensuring(Effect.sync(() => (healthCheckInFlight = undefined))));
+            return healthCheckInFlight;
         };
         const status = Effect.suspend(() => healthCheck()).pipe(Effect.asVoid, Effect.map(() => statusSnapshot(state, cwd)));
+        // `proxy start` is a daemon command: the CLI process we spawn may hand
+        // the listener to a longer-lived session process. Always use Varlock's
+        // session protocol first, then reap our owned process group as a bounded
+        // fallback. The command is deliberately best-effort during teardown.
+        const stopProxy = (session) => session
+            ? runCommand(processService, config, cwd, ["proxy", "stop", "--session", session.uuid], config.commandTimeoutMs, ambientEnvironment).pipe(Effect.flatMap(() => {
+                const verify = (attempt) => runCommand(processService, config, cwd, ["proxy", "status", "--format", "json"], config.commandTimeoutMs, ambientEnvironment).pipe(Effect.flatMap(({ stdout }) => {
+                    try {
+                        if (!decodeSessionList(stdout).some((item) => item.uuid === session.uuid && item.endedAt === undefined))
+                            return Effect.succeed(true);
+                    }
+                    catch {
+                        // A malformed/failed status is inconclusive.
+                    }
+                    return attempt < 3
+                        ? Effect.sleep(Duration.millis(config.pollIntervalMs)).pipe(Effect.andThen(verify(attempt + 1)))
+                        : Effect.succeed(false);
+                }), Effect.catch(() => Effect.succeed(false)));
+                return verify(1);
+            }), Effect.catch(() => Effect.sync(() => {
+                config.lifecycleLogger?.({
+                    event: "stop-failed",
+                    proxySessionId: session.uuid,
+                });
+                return false;
+            })))
+            : Effect.succeed(true);
+        const stopCapturedSession = (session = state.session) => stopProxy(session).pipe(Effect.tap((stopped) => stopped
+            ? Effect.tryPromise({
+                try: () => removeOwnershipRecord(ownershipHash, ownershipFileOps(config.ownershipDirectory ?? ownershipDirectory())),
+                catch: () => undefined,
+            }).pipe(Effect.catch(() => Effect.void), Effect.andThen(Effect.sync(() => {
+                if (state.session?.uuid === session?.uuid)
+                    state.session = undefined;
+            })))
+            : Effect.void));
+        const cleanupUncapturedSessions = (handle) => runCommand(processService, config, cwd, ["proxy", "status", "--format", "json"], config.commandTimeoutMs, ambientEnvironment).pipe(Effect.flatMap(({ stdout }) => Effect.try({
+            try: () => decodeSessionList(stdout),
+            catch: () => [],
+        })), Effect.flatMap((records) => Effect.forEach(records.filter((record) => record.ownerPid === handle.pid && record.cwd === cwd), (record) => stopProxy(record), { discard: true })), Effect.catch(() => Effect.void));
         const waitForSession = (handle) => {
             const deadline = Date.now() + config.startupTimeoutMs;
             const poll = () => Effect.gen(function* () {
@@ -338,10 +513,11 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
             return { directory, canonical };
         }));
         const interruptedStartCleanup = (handle, directory) => Effect.uninterruptible(Effect.gen(function* () {
-            if (handle)
+            yield* stopCapturedSession();
+            if (handle) {
                 yield* handle.stop.pipe(Effect.catch(() => Effect.void));
+            }
             state.process = undefined;
-            state.session = undefined;
             state.environment = undefined;
             clearCapability("failed", safeError("timeout", true));
             if (directory) {
@@ -352,6 +528,28 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
                 yield* removeOwnedDirectory(directory);
             }
         }));
+        const recoverStartFailure = (error, cleanupDirectory) => Effect.gen(function* () {
+            if (error.code !== "disposed")
+                updateFailure(error);
+            yield* cleanupFailedStart(cleanupDirectory);
+            const failure = error;
+            return yield* Effect.fail(failure);
+        });
+        const updateFailure = (failure) => {
+            if (state.phase === "failed" && state.session)
+                state.error = failure;
+            else
+                clearCapability("failed", failure);
+        };
+        const cleanupFailedStart = (directory) => directory && !state.session
+            ? Effect.gen(function* () {
+                if (certDirectory === directory) {
+                    certDirectory = undefined;
+                    certDirectoryReal = undefined;
+                }
+                yield* removeOwnedDirectory(directory);
+            })
+            : Effect.void;
         const startInternal = () => {
             let acquired;
             let cleanupDirectory;
@@ -376,26 +574,52 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
                         certDirectory,
                     ]);
                     const handle = yield* Effect.provideService(processService
-                        .spawn({ ...parts, cwd, env: ambientEnvironment, terminateGraceMs: 500 })
+                        .spawn({
+                        ...parts,
+                        cwd,
+                        // Varlock versions that expose inherited metadata in
+                        // `proxy status` can use this to identify recordless
+                        // proxies. Older versions simply ignore the variable.
+                        env: { ...ambientEnvironment, KEY_FERRY_PROXY_MARKER: "key-ferry" },
+                        terminateGraceMs: 500,
+                    })
                         .pipe(Effect.mapError((error) => fromProcessError(error, "start_failed"))), Scope.Scope, managerScope);
                     acquired = handle;
                     state.process = handle;
-                    const result = yield* waitForSession(handle).pipe(Effect.flatMap((session) => readEnvironment(session).pipe(Effect.map((environment) => ({ session, environment })))), Effect.catch((error) => Effect.gen(function* () {
+                    let startedSession;
+                    const result = yield* waitForSession(handle).pipe(Effect.flatMap((session) => Effect.gen(function* () {
+                        startedSession = session;
+                        // Capture is the ownership boundary: publish before any
+                        // environment or policy work can fail.
+                        state.session = session;
+                        yield* ownershipRecord(session, handle.pid, [config.command[0], ...parts.args]);
+                        const environment = yield* readEnvironment(session);
+                        yield* validateStartupEgress(state, config.requireStrictEgress, session, handle);
+                        return { session, environment };
+                    })), Effect.catch((error) => Effect.gen(function* () {
+                        const captured = startedSession;
+                        let stopped = true;
+                        if (captured) {
+                            stopped = yield* stopCapturedSession(captured);
+                        }
+                        else
+                            yield* cleanupUncapturedSessions(handle);
                         yield* handle.stop.pipe(Effect.catch(() => Effect.void));
-                        state.process = undefined;
+                        if (stopped) {
+                            state.process = undefined;
+                        }
+                        else {
+                            state.phase = "failed";
+                            state.error = error;
+                        }
                         return yield* Effect.fail(error);
                     })));
-                    yield* validateStartupEgress(state, config.requireStrictEgress, result.session, handle);
                     state.session = result.session;
                     state.environment = result.environment;
                     state.phase = "ready";
                     state.error = undefined;
                     return statusSnapshot(state, cwd);
-                }).pipe(Effect.catch((error) => Effect.gen(function* () {
-                    if (error.code !== "disposed")
-                        clearCapability("failed", error);
-                    return yield* Effect.fail(error);
-                })), Effect.onInterrupt(() => interruptedStartCleanup(acquired, cleanupDirectory)));
+                }).pipe(Effect.catch((error) => recoverStartFailure(error, cleanupDirectory)), Effect.onInterrupt(() => interruptedStartCleanup(acquired, cleanupDirectory)));
             });
             // Do not attach ownership cleanup until preflight has completed: a
             // cancelled health check must not tear down a process owned by an
@@ -414,7 +638,10 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
             }
             if (!state.environment)
                 return yield* Effect.fail(safeError("not_ready", true));
-            return { status: statusSnapshot(state, cwd), environment: state.environment };
+            return {
+                status: statusSnapshot(state, cwd),
+                environment: state.environment,
+            };
         }));
         const environmentEffect = exclusive(Effect.gen(function* () {
             yield* healthCheck();
@@ -427,7 +654,11 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
             return state.environment;
         }));
         const refreshInternal = Effect.gen(function* () {
-            yield* ensureRefreshReadiness({ state, healthCheck, start: startInternal });
+            yield* ensureRefreshReadiness({
+                state,
+                healthCheck,
+                start: startInternal,
+            });
             const session = yield* requireRefreshSession(state);
             const reload = runCommand(processService, config, cwd, ["proxy", "reload", "--session", session.uuid], config.reloadTimeoutMs, ambientEnvironment).pipe(Effect.mapError((error) => new VarlockError({
                 ...error,
@@ -449,8 +680,10 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
         }).pipe(Effect.catch((error) => Effect.gen(function* () {
             if (error.code !== "disposed") {
                 const handle = state.process;
-                if (handle)
+                yield* stopCapturedSession();
+                if (handle) {
                     yield* handle.stop.pipe(Effect.catch(() => Effect.void));
+                }
                 state.process = undefined;
                 clearCapability("failed", error.code === "refresh_failed" ? error : safeError("refresh_failed", true));
             }
@@ -465,15 +698,18 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
             return { status, environment: state.environment };
         }));
         const dispose = lock.withPermit(Effect.gen(function* () {
-            if (state.disposed)
+            if (state.disposed && !state.session)
                 return;
             state.disposed = true;
             state.phase = "stopping";
             const handle = state.process;
+            const stopped = yield* stopCapturedSession();
+            if (!stopped)
+                return;
             state.environment = undefined;
-            state.session = undefined;
-            if (handle)
+            if (handle) {
                 yield* handle.stop.pipe(Effect.catch(() => Effect.void));
+            }
             state.process = undefined;
             state.phase = "stopped";
             state.generation += 1;
@@ -488,7 +724,9 @@ export function makeProjectKeyFerryManager(options, processLayer = ProcessLive,
             dispose,
             withExclusive: (effect) => lock.withPermit(effect),
         };
-        yield* Effect.addFinalizer(() => Effect.forEach([...ownedCertDirectories], removeOwnedDirectory, { discard: true }));
+        yield* Effect.addFinalizer(() => Effect.forEach([...ownedCertDirectories], removeOwnedDirectory, {
+            discard: true,
+        }));
         // Finalizers run in reverse registration order, so stop the sidecar
         // before removing the directory that contains its CA.
         yield* Effect.addFinalizer(() => dispose);