@comput/pi-intercom 0.5.1 → 0.6.1

package/README.md

@@ -25,6 +25,8 @@ The value is the loop: **delegate → report back → evaluate → decide the ne
 > **0.4.1:** The terminal monitor replaces the browser dashboard. Public worker reports and the read-only JSON worker-status tool keep coordinator decisions separate from observed activity.
 >
 > **0.5.1:** manually closed workers remain registered and sort last as disconnected in the monitor. Optional JSON health checks and guarded resume preserve the distinction between connectivity and saved session identity.
+>
+> **0.6.1:** Linux Herdr background save-handoff-and-close workflow, with saved public summaries in config and monitor/JSON details. Empty rosters no longer open a monitor; coordinator session/tab names are preserved.
 
 For potential next steps, see [Improvement topics](references/roadmap.md). These are proposals for discussion, not implemented features or release commitments.
 
@@ -64,7 +66,7 @@ Open Pi inside a Herdr workspace at the project root you want to coordinate, or
 
 ### Know the boundaries
 
-- **Stop/close tools are disabled.** Close workers explicitly in their terminals. Pi 0.84.4's cancellation behavior leaves retry continuations alive; newer versions are not assumed safe without verification. See the [cancellation blocker](references/implementation-blocker.md).
+- **Graceful stop remains disabled.** Pi 0.84.4's cancellation behavior leaves retry continuations alive; newer versions are not assumed safe without verification. The Linux Herdr `close_worker` in 0.6.1 has a different contract: request/save a handoff, await final settlement, then attempt an identity-checked external pane close. It does not use Pi abort/shutdown or promise all descendants terminate. Manual closure remains available. See the [cancellation blocker](references/implementation-blocker.md).
 - **No silent recovery.** Intercom does not automatically retry messages, replace workers, switch launchers, commit changes, or roll them back.
 - **Local, not remote.** Messaging binds to loopback. Local processes are trusted; this is not an authenticated service for untrusted clients.
 
@@ -94,7 +96,7 @@ Replace the final path with your checkout's absolute path (use a Windows path on
 
 Run Pi `/reload` (or start a new interactive session) after installing or changing source; reload workers too when changing their extension code. A standalone monitor already running in its pane needs an explicit restart to load rebuilt display code. Linux supports messaging, configuration, the terminal monitor, and Herdr worker launch/resume. Launch the coordinator inside a Herdr workspace; `herdr`, `sh`, and `pi` must be on PATH in worker panes. Workers run a quoted POSIX shell command in the returned pane, with the coordinator's actual extension path. Project trust remains required.
 
-Linux `multiplexer: none` is explicitly unsupported: no terminal guessing, headless fallback, or automatic cleanup. Stop/close remain disabled on both platforms. Automated Linux tests cover shell argument preservation and adapter/HTTP behavior. A live source-loaded Linux Herdr smoke test launched two workers: both registered, loaded their configured names/responsibilities, and acknowledged coordinator messages through Intercom. This verifies launch and round-trip messaging, not resume or cancellation.
+Linux `multiplexer: none` is explicitly unsupported: no terminal guessing, headless fallback, or automatic cleanup. Graceful stop remains disabled on both platforms; external pane closure is Linux Herdr only. Automated Linux tests cover shell argument preservation and adapter/HTTP behavior. A live source-loaded Linux Herdr smoke test launched two workers: both registered, loaded their configured names/responsibilities, and acknowledged coordinator messages through Intercom. This verifies launch and round-trip messaging, not resume or cancellation.
 
 ### Startup and launchers
 
@@ -115,7 +117,7 @@ Existing workers restore responsibility by session ID, bind their saved port or,
 
 ## Tools and permissions
 
-Every tool rereads current config and checks the live Pi session ID. Names are case-insensitive for lookup/uniqueness; display capitalization is preserved. `Coordinator` is reserved.
+Every tool rereads current config and checks the live Pi session ID. Names are case-insensitive for lookup/uniqueness; display capitalization is preserved. `Coordinator` is reserved for internal configuration/routing. The coordinator's existing Pi session name and Herdr tab title are preserved; only worker sessions are synchronized to their configured names.
 
 | Tool | Arguments | Permission / effect |
 |---|---|---|
@@ -128,12 +130,14 @@ Every tool rereads current config and checks the live Pi session ID. Names are c
 | `intercom_request_status` | `to` (worker name) | Coordinator; independent extension report |
 | `intercom_report_status` | None | Workers including anonymous; shared report function, never registration |
 | `intercom_report_work` | `status`, `summary?` | Configured, responsibility-loaded workers; save a public report and notify coordinator, never approve/complete work |
-| `intercom_stop_worker`, `intercom_close_worker` | `to` (worker name) | Coordinator role checked, then **unsupported-host error**, no side effects |
+| `intercom_stop_worker` | `to` | Unsupported graceful cancellation; no side effects |
+| `intercom_close_worker` | `to` | Linux Herdr coordinator; request background handoff/save/settle/pane-close job, retain registration |
+| `intercom_report_handoff` | `jobId`, `summary` | Requested worker only; save concise public handoff, then finish the turn and wait |
 | `intercom_resume_worker` | `to`, `confirmClosed` | Coordinator; user-confirmed old-session closure, saved session/launcher/directory, guarded launch |
 | `intercom_remove_worker` | `to` (worker name) | Coordinator; config entry only, no shutdown/session deletion |
 | `intercom_set_multiplexer` | `multiplexer`: `herdr` or `none` | Coordinator; future launches only |
 
-**Removal precondition:** explicitly close a running worker before removing its entry. Since remote close is disabled, arrange explicit user closure in its terminal first. Intercom does not infer liveness from saved IDs/ports and cannot certify closure. No hidden probing or force-kill is performed.
+**Removal precondition:** close a running worker before removing its entry. Removal forgets the registration; it is not how to park a worker for later resume. Active/uncertain close jobs fence removal and other lifecycle/work operations. Saved IDs/ports alone do not prove closure; no force-kill fallback occurs.
 
 Anonymous `send`/`list` and all coordinator operations fail explicitly. Anonymous registration and status remain available. A dedicated repeat-registration operation and broader anonymous permissions remain **unresolved contract TODOs**, not silently added tools. If initial registration fails, the worker remains reachable and reports the error locally. Explicit user Pi `/reload` restarts this extension and repeats startup registration; status is not a substitute and there is no automatic retry.
 
@@ -168,7 +172,9 @@ HTTP binds **127.0.0.1 only**. `POST /intercom` accepts UTF-8 JSON, at most 64 K
 {"version":1,"kind":"message","from":"sender-session-id","to":"expected-recipient-session-id","payload":{"message":"explicit message"}}
 ```
 
-Kinds: `message`, `report` (`status`, `summary`; configured worker → coordinator only), `registration` (`port`, `projectDirectory`), `status` (`port`, `busy`), `request_status`, `reload`, `stop`, `close` (empty control payload). Sender session identity is the envelope `from`; registration/status agent notifications include an explicit `sessionId` field. Agent messages require configured sender and recipient; controls require the current coordinator's sender ID and a worker recipient. Registration/unknown status are intentional exceptions to configured-sender checks, accepted only by coordinator. All receivers verify expected recipient ID, protecting against stale ports reaching another session. Local processes are trusted: this is role validation, **not authentication**. No remote networking/proxies/redirects or credentials.
+Handoff wire kinds (0.6.1): `close_prepare`, `close_identity`, `close_request`, `handoff_report`, `close_ready`, `close_commit`. These require configured roles, matching job/runtime identity and bounded validated payloads. Pane/process identity is ephemeral protocol data, never stored in public config or summaries.
+
+Other kinds: `message`, `report` (`status`, `summary`; configured worker → coordinator only), `registration` (`port`, `projectDirectory`), `status` (`port`, `busy`), `request_status`, `reload`, `stop`, `close` (empty control payload). Sender session identity is the envelope `from`; registration/status agent notifications include an explicit `sessionId` field. Agent messages require configured sender and recipient; controls require the current coordinator's sender ID and a worker recipient. Registration/unknown status are intentional exceptions to configured-sender checks, accepted only by coordinator. All receivers verify expected recipient ID, protecting against stale ports reaching another session. Local processes are trusted: this is role validation, **not authentication**. No remote networking/proxies/redirects or credentials.
 
 `202 {"accepted":true}` means Intercom extension receipt/dispatch, **not guaranteed Pi input acceptance, queueing, or model completion**. In Pi 0.84.4, `sendUserMessage` can reject during manual compaction after Intercom has acknowledged receipt: its void extension API reports the asynchronous rejection only as a local host error. Intercom has no delivery queue or retry to repair this gap; inspect the recipient's local error and arrange an explicit resend after compaction if needed. Replacing it with `sendMessage` is not a safe workaround because that path can start a concurrent run. Invalid/unsupported requests return an error; excessive bodies return 413. Request-status sends its report separately after accepting control. Starting in 0.2.1, Intercom always supplies `deliverAs: 'steer'`: Pi starts normally when idle and steers when busy. This avoids the idle-snapshot-to-busy race that caused “Agent is already processing” errors; it does not fix manual-compaction rejection. It does not hard-interrupt an executing tool. Each send resolves the recipient again from config; 5-second receipt deadline, **no retries**. Timeout means unknown outcome, not proof of nondelivery. No durable inbox, deduplication or replay log in V1.
 
@@ -178,9 +184,9 @@ Tool text output is bounded to 50 KiB/2000 lines. The full saved roster remains
 
 ## Standalone terminal status monitor
 
-The coordinator automatically checks for its monitor pane on startup inside Herdr. If missing, it creates a small pane **above the coordinator**, preserving coordinator focus. This is a standalone Node/pi-tui program, **not another Pi instance**. The old inline widget implementation has been removed. Source installations must run `npm run build` before reloading Pi; published packages include the compiled `dist/monitor.js` entry.
+When at least one worker is registered, the coordinator automatically checks for its monitor pane on startup inside Herdr. If missing, it creates a small pane **above the coordinator**, preserving coordinator focus. With no workers, it does not create/check the monitor. Configuring the first worker triggers the check; disconnected saved workers still count. This does not automatically close an already-existing monitor when the final worker is removed. This is a standalone Node/pi-tui program, **not another Pi instance**. The old inline widget implementation has been removed. Source installations must run `npm run build` before reloading Pi; published packages include the compiled `dist/monitor.js` entry.
 
-The table uses aligned **Worker | Connection | Report | Activity | Seen | Last activity** columns (activity age/detail give way first on narrow panes). Report is explicitly worker-authored and separate from host activity. Activity is the last reported `working`, `thinking`, `idle`, `closed`, or `unknown` state. Seen marks evidence older than 60 seconds with `(old)`; this is not a live connection indicator. Last activity uses fixed public labels such as Reading files, Running command or Writing response and can persist after the worker settles. Recent working/thinking/idle observations use restrained colors; old evidence remains neutral and explicitly marked. `NO_COLOR` disables styling. No read-only banner or busy/idle count summary is shown. It reads the bounded config/log snapshot and performs read-only loopback health checks, then refreshes roughly three seconds after completion, without worker prompts or model calls. Checks are bounded by 750 ms per endpoint, a four-second batch budget, 16 concurrent requests and 256 workers; no overlapping batches or retries. Closing the monitor aborts checks. Only observed activity is shown, not inferred assignments/completion. Evidence over 60 seconds old is stale; missing evidence is unknown. The number of worker rows adapts to the pane height, with an omitted count when needed. The display is clipped to pane dimensions. In the monitor pane, use **↑/↓** to select a worker and **Enter** to toggle its details (configured responsibility and observed status). Selection follows the worker across roster reorder and scrolls the visible window. **Escape** closes details first, then quits; **q** or **Ctrl+C** always quits only the display process, never agents or their panes.
+The table uses aligned **Worker | Connection | Report | Activity | Seen | Last activity** columns (activity age/detail give way first on narrow panes). Report is explicitly worker-authored and separate from host activity. Activity is the last reported `working`, `thinking`, `idle`, `closed`, or `unknown` state. Seen marks evidence older than 60 seconds with `(old)`; this is not a live connection indicator. Last activity uses fixed public labels such as Reading files, Running command or Writing response and can persist after the worker settles. Recent working/thinking/idle observations use restrained colors; old evidence remains neutral and explicitly marked. `NO_COLOR` disables styling. Version 0.5.2 adds a small footer label for the Intercom package version loaded by the monitor at startup; restart the monitor after updating to load the new version. Narrow panes use a compact version label and preserve the quit hint. No read-only banner or busy/idle count summary is shown. It reads the bounded config/log snapshot and performs read-only loopback health checks, then refreshes roughly three seconds after completion, without worker prompts or model calls. Checks are bounded by 750 ms per endpoint, a four-second batch budget, 16 concurrent requests and 256 workers; no overlapping batches or retries. Closing the monitor aborts checks. Only observed activity is shown, not inferred assignments/completion. Evidence over 60 seconds old is stale; missing evidence is unknown. The number of worker rows adapts to the pane height, with an omitted count when needed. The display is clipped to pane dimensions. In the monitor pane, use **↑/↓** to select a worker and **Enter** to toggle its details (configured responsibility and observed status). Selection follows the worker across roster reorder and scrolls the visible window. **Escape** closes details first, then quits; **q** or **Ctrl+C** always quits only the display process, never agents or their panes.
 
 Detailed phase reports require reloading participating Pi sessions. `thinking` is emitted only when the provider supplies thinking events; missing thinking events do not imply that no reasoning occurred. Streaming content, reasoning text, command arguments and tool outputs are never read or logged for status. Repeated streaming events are deduplicated; concurrent tools are tracked without recording their arguments. Legacy busy observations display as working without invented detail. No task completion is inferred from settlement.
 
@@ -196,7 +202,24 @@ Connection is separate from historical activity and public reports. A recent mat
 
 After the user confirms the previous session is closed, call `intercom_resume_worker({ to: "Builder", confirmClosed: true })`. It launches the **same saved Pi session**, restores configured identity/responsibility, and does not automatically start an old assignment. A matching connected endpoint blocks resume. Concurrent/submitted/uncertain attempts are fenced locally until a subsequent configured worker status arrives. On uncertain launch with no status, inspect the actual worker process; only after verifying closure should you reload the coordinator and consider an explicit retry. The fence is not persistent or a cross-process uniqueness guarantee. Resume failures do not remove/replace saved identity.
 
-`intercom_remove_worker` is only for forgetting the saved registration, not parking a worker. Automatic stop/close remains disabled. Reload coordinator/workers and restart the standalone monitor to use the new health protocol/UI; these additions require 0.5.1.
+`intercom_remove_worker` is only for forgetting the saved registration, not parking a worker. Graceful stop remains disabled; see the background close workflow below. Reload coordinator/workers and restart the standalone monitor to use the new health protocol/UI; these additions require 0.5.1.
+
+### Background save-and-close (0.6.1)
+
+On supported **Linux + Herdr**, `intercom_close_worker({to:"Builder"})` returns a persisted job ID/state promptly. It does not hold the coordinator model turn open waiting for the worker. The extension performs these steps in the background:
+
+1. Obtain and independently verify the worker's current pane, session header, terminal identity and Linux PID/start identity. Never infer ownership from a title/name alone.
+2. Ask that worker to call `intercom_report_handoff({jobId,summary})` with a concise public summary (up to 4000 characters): completed work, unfinished items, blockers, validation and relevant project files. No credentials, private reasoning, raw tool output or private session paths.
+3. Save `Agent.handoff` and `Agent.closeJob` atomically in config; only then acknowledge the worker's report tool. No pane closes at this step.
+4. Wait for a successful matching tool result in the current branch and the worker's final `agent_settled` notification. New input/activity invalidates readiness.
+5. Persist closing intent, recheck pane identity, and make a final nonce-bound worker settlement challenge immediately before issuing one exact `herdr pane close` command.
+6. Observe pane absence and the original worker process's exit. Record `closed` only when both are verified; otherwise retain an explicit failure/uncertainty state. Name, responsibility, session ID and saved handoff remain registered.
+
+The latest handoff/job are visible in `intercom_list`, bounded `intercom_worker_status` JSON and monitor details—even while the worker is disconnected. A handoff is worker-authored context, not acceptance of its findings. Config may be source-controlled: keep these summaries non-secret.
+
+Jobs have a 120-second deadline and at most 16 simultaneous coordinator jobs. Unsupported hosts, missing identity, missing summary, save failure or absent final settlement never authorize a pane close. Old workers must reload the updated extension first. Active/uncertain jobs fence new Intercom work and conflicting lifecycle/config changes. On coordinator reload, pending jobs become interrupted and closing intent becomes uncertain; no job is automatically replayed. An uncertain persisted job requires explicit operator inspection/recovery of config before a new close/resume/removal—do not erase its fence or retry blindly.
+
+**Scope of guarantees:** this is external pane closure, not graceful Pi cancellation. Herdr's pane-ID-only API has no atomic compare-and-close operation; independent local/Telegram input or pane replacement can still race the final check. No guarantee covers escaped child processes or transcript fsync/power-loss durability. Windows/non-Herdr close is unsupported. A disposable ordinary Node process was verified to exit on pane closure in local Linux Herdr 0.9.1; that is not a full live Pi handoff/history test. No existing project worker was closed during validation.
 
 ### JSON worker status for agents and chat integrations
 
@@ -256,6 +279,24 @@ The workflow validates on Windows and Linux, then publishes with provenance from
 
 Published versions are immutable. For a new release, bump package and lockfile versions, commit/push, then publish a matching GitHub release. Manual dispatch publishes the selected ref and is **not a dry run**; the release-tag check only applies when a release tag is present. Do not dispatch publishing for an already published version. CI validates pushes to `main` and pull requests separately without publishing.
 
+### 0.6.1 Background handoff-and-close and quiet startup
+
+- First npm release of these features: the preserved 0.6.0 GitHub tag failed Windows validation and was not published to npm.
+- Windows config publication handles transient `EPERM` replacement failures with bounded filesystem-only attempts and lifecycle/deadline checks before each attempt. Worker close commands, messages and jobs are never retried by this safeguard. Persistent contention can still prevent publication; an unpersisted terminal close outcome retains the existing intent/fence for operator inspection and reload recovery.
+
+- Explicit Linux Herdr close jobs request and save a public worker handoff, await final settlement, then attempt one identity-checked pane close in the background. Worker registration, responsibility and session ID remain saved.
+- Persist latest handoff and close-job status in config; show them in monitor details and JSON worker status. Correlation, deadlines, lifecycle guards and uncertainty fences prevent automatic replay.
+- Empty rosters do not open/check the monitor; configuring the first worker triggers setup. Disconnected saved workers still count.
+- Preserve the coordinator's existing Pi session name and Herdr tab title; worker naming remains synchronized.
+- Validation includes typecheck, workflow/platform regression tests and isolated package installation. An isolated ordinary-process pane-close check passed on Linux Herdr 0.9.1; full live Pi handoff/history and Windows pane termination are not claimed.
+- Upgrade coordinator/workers and restart the monitor. Close is Linux Herdr only, not graceful Pi abort or an all-descendants termination guarantee. Config-root discovery and connectivity polling architecture are unchanged.
+
+### 0.5.2 Monitor version footer
+
+- Display the monitor's loaded Intercom package version at the bottom-right, with a compact label on narrow panes and preserved quit hints.
+- Read validated version metadata from the monitor's own package once at startup, not from the working directory. Restart the monitor after updating to load the new version.
+- Add footer geometry, metadata validation and installed-package version checks. Local typecheck, 135 tests and isolated package-install validation passed.
+
 ### 0.5.1 Retained disconnected workers
 
 The 0.5.0 release did not publish to npm because an occupied-port fallback exposed duplicate listener counting in test instrumentation. 0.5.1 fixes the test hook and forces that fallback deterministically, without changing production listener behavior. The 0.5.0 tag is unchanged.
@@ -338,5 +379,5 @@ The release/session evidence reported during the 0.1.2 validation establishes th
 - Windows visible terminal/Pi process startup. Success only proves terminal creation, **not Pi readiness**; startup failures remain visible in that terminal. No live readiness handshake was added.
 - Actual persisted-session lookup and resumed worker startup; never-used session failure.
 - Cross-process/network-drive atomicity and Windows ACL/sharing failures (same-process temp-filesystem races are tested).
-- Stop/close remain disabled on all hosts until a verified cancellation API covers retries, compaction continuations and queues. No workaround or weakened guarantee.
+- Graceful stop remains disabled until a verified cancellation API covers retries, compaction continuations and queues. The Linux Herdr pane-close workflow is a separately authorized best-effort contract, not a claim that graceful cancellation was fixed.
 - Explicit repeat-registration tool and broad anonymous permissions require a contract decision. Duplicate-session locks, takeover, durable logging, non-Herdr Linux launchers and macOS support are deferred.

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import { type Handoff, type CloseJob } from './handoff.js';
 export interface Agent {
     sessionId: string;
     name: string;
@@ -7,6 +8,8 @@ export interface Agent {
     /** Legacy browser dashboard field, accepted for migration only; removed at coordinator startup. */
     dashboardPort?: number;
     projectDirectory: string;
+    handoff?: Handoff;
+    closeJob?: CloseJob;
 }
 export interface Config {
     version: 1;
@@ -24,16 +27,25 @@ export declare const coordinator: (c: Config) => Agent;
 export declare function named(c: Config, name: string): Agent;
 export declare function requireCoordinator(c: Config, id: string): Agent;
 export declare function directory(root: string, requested: string): Promise<string>;
+export interface ConfigStoreOptions {
+    /** Publication seams for deterministic platform/race tests. */
+    platform?: NodeJS.Platform;
+    rename?: (from: string, to: string) => Promise<void>;
+    delay?: (milliseconds: number) => Promise<void>;
+    now?: () => number;
+}
 export declare class ConfigStore {
     readonly root: string;
+    private readonly options;
     readonly file: string;
     private tail;
-    constructor(root: string);
+    constructor(root: string, options?: ConfigStoreOptions);
     read(): Promise<Config>;
     static discover(cwd: string): Promise<ConfigStore | undefined>;
     protected openTemporary(file: string): Promise<import("fs/promises").FileHandle>;
     private temporary;
     initialize(id: string, boundPort: number, assertValid?: () => void): Promise<boolean>;
+    private publish;
     update(id: string, mutate: (config: Config) => void | Promise<void>, assertValid?: () => void): Promise<Config>;
     configure(id: string, values: Omit<Agent, 'coordinator'>, assertValid?: () => void): Promise<Config>;
 }

package/dist/config.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, realpath, rename, unlink, open, link, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { fencedClose, validateHandoff, validateCloseJob } from './handoff.js';
 export const DEFAULT_DESCRIPTION = 'Coordinate workers, delegate work, and manage shared configuration.';
 export const key = (name) => name.toLowerCase();
 export function fail(message) { throw new Error(`PiIntercom: ${message}`); }
@@ -32,6 +33,16 @@ export function validateConfig(value) {
             fail('invalid name');
         port(a.port);
         relativeDirectory(a.projectDirectory);
+        if (a.handoff !== undefined) {
+            if (a.coordinator)
+                fail('handoff is worker-only');
+            validateHandoff(a.handoff);
+        }
+        if (a.closeJob !== undefined) {
+            if (a.coordinator)
+                fail('closeJob is worker-only');
+            validateCloseJob(a.closeJob);
+        }
         if (a.dashboardPort !== undefined) {
             if (!a.coordinator)
                 fail('dashboardPort is coordinator-only');
@@ -67,12 +78,16 @@ export async function directory(root, requested) {
         fail('projectDirectory is not a directory');
     return rel.split(path.sep).join('/') || '.';
 }
+const RENAME_DELAYS = [10, 20, 40, 80];
+const RENAME_BUDGET_MS = 250;
 export class ConfigStore {
     root;
+    options;
     file;
     tail = Promise.resolve();
-    constructor(root) {
+    constructor(root, options = {}) {
         this.root = root;
+        this.options = options;
         this.file = path.join(root, '.pi-intercom', 'config.json');
     }
     async read() {
@@ -141,6 +156,35 @@ export class ConfigStore {
             throw error;
         }
     }
+    async publish(temp, assertValid) {
+        const replace = this.options.rename ?? rename;
+        const now = this.options.now ?? (() => performance.now());
+        const delay = this.options.delay ?? (milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds)));
+        const started = now();
+        let originalError;
+        for (let attempt = 0;; attempt++) {
+            // Windows readers can briefly deny replace-rename. Retry only publication
+            // of this already synced/closed temp, never the mutation or any OS action
+            // outside config persistence. The elapsed budget bounds retry initiation,
+            // not the duration of an already-submitted OS rename.
+            assertValid();
+            if (attempt > 0 && now() - started >= RENAME_BUDGET_MS)
+                throw originalError;
+            try {
+                await replace(temp, this.file);
+                return;
+            }
+            catch (error) {
+                if ((this.options.platform ?? process.platform) !== 'win32' || error.code !== 'EPERM')
+                    throw error;
+                originalError ??= error;
+                const backoff = RENAME_DELAYS[attempt];
+                if (backoff === undefined || now() - started + backoff >= RENAME_BUDGET_MS)
+                    throw originalError;
+                await delay(backoff);
+            }
+        }
+    }
     async update(id, mutate, assertValid = () => { }) {
         const operation = this.tail.then(async () => {
             assertValid();
@@ -152,9 +196,9 @@ export class ConfigStore {
             validateConfig(c);
             const temp = await this.temporary(c);
             try {
-                // Last check before publication; an already submitted OS rename cannot be undone.
-                assertValid();
-                await rename(temp, this.file);
+                // Every publication attempt checks the lifecycle/deadline guard; an
+                // already submitted OS rename still cannot be undone.
+                await this.publish(temp, assertValid);
             }
             catch (error) {
                 await unlink(temp).catch(() => { });
@@ -174,8 +218,16 @@ export class ConfigStore {
             const index = c.agents.findIndex(old => old.sessionId === a.sessionId);
             if (index < 0)
                 c.agents.push(a);
-            else
+            else {
+                const old = c.agents[index];
+                if (fencedClose(old.closeJob))
+                    fail('worker close is active or uncertain; configuration is fenced');
+                if (old.handoff)
+                    a.handoff = old.handoff;
+                if (old.closeJob)
+                    a.closeJob = old.closeJob;
                 c.agents[index] = a;
+            }
         }, assertValid);
     }
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qEAAqE,CAAC;AACzG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACxD,MAAM,UAAU,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;AACzH,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK;QAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;AAChK,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,CAAC,GAAG,KAAe,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3I,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,EAAE,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC;AAC7E,MAAM,UAAU,KAAK,CAAC,CAAS,EAAE,IAAY;IAC3C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,EAAU;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;AACtE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IAC7D,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACnK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AACD,MAAM,OAAO,WAAW;IAGD;IAFZ,IAAI,CAAS;IACd,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;IAClG,KAAK,CAAC,IAAI;QACR,2EAA2E;QAC3E,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAW;QAC/B,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YAAC,EAAE,GAAG,MAAM,CAAC;QACpF,CAAC;IACH,CAAC;IACS,aAAa,CAAC,IAAY,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,SAAS,CAAC,MAAc;QACpC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,SAAiB,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChF,0EAA0E;QAC1E,+EAA+E;QAC/E,WAAW,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvN,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACpC,OAAO,CAAC,EAAE,CAAC;gBACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,KAAK,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACtE,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAgD,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,kFAAkF;gBAClF,WAAW,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YACpE,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAkC,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;YAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAClG,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9J,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,KAAK,GAAG,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAA+B,MAAM,cAAc,CAAC;AAe3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,qEAAqE,CAAC;AACzG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACxD,MAAM,UAAU,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;AACzH,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK;QAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;AAChK,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,CAAC,GAAG,KAAe,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3I,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,EAAE,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QACnH,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC;AAC7E,MAAM,UAAU,KAAK,CAAC,CAAS,EAAE,IAAY;IAC3C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,EAAU;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;AACtE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IAC7D,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACnK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAQD,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU,CAAC;AAChD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,OAAO,WAAW;IAGD;IAA+B;IAF3C,IAAI,CAAS;IACd,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YAAqB,IAAY,EAAmB,UAA8B,EAAE;QAA/D,SAAI,GAAJ,IAAI,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAyB;QAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;IACrJ,KAAK,CAAC,IAAI;QACR,2EAA2E;QAC3E,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAW;QAC/B,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YAAC,EAAE,GAAG,MAAM,CAAC;QACpF,CAAC;IACH,CAAC;IACS,aAAa,CAAC,IAAY,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,SAAS,CAAC,MAAc;QACpC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,SAAiB,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChF,0EAA0E;QAC1E,+EAA+E;QAC/E,WAAW,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvN,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACpC,OAAO,CAAC,EAAE,CAAC;gBACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,KAAK,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACtE,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,WAAuB;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACtH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,IAAI,aAAsB,CAAC;QAC3B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,sDAAsD;YACtD,WAAW,EAAE,CAAC;YACd,IAAI,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,IAAI,gBAAgB;gBAAE,MAAM,aAAa,CAAC;YAC5E,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAC9H,aAAa,KAAK,KAAK,CAAC;gBACxB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,OAAO,GAAG,OAAO,IAAI,gBAAgB;oBAAE,MAAM,aAAa,CAAC;gBAChG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAgD,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,oEAAoE;gBACpE,sDAAsD;gBACtD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YACpE,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAkC,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;YAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAClG,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9J,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,KAAK,GAAG,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC3B,CAAC;gBACJ,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBACpG,IAAI,GAAG,CAAC,OAAO;oBAAE,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;gBACzC,IAAI,GAAG,CAAC,QAAQ;oBAAE,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/handoff.d.ts

@@ -0,0 +1,87 @@
+import type { Agent, Config } from './config.js';
+export interface WorkerPaneIdentity {
+    workspaceId: string;
+    paneId: string;
+    terminalId: string;
+    sessionId: string;
+    sessionFile: string;
+    pid: number;
+    processStart: string;
+}
+export interface CloseProvider {
+    getIdentity(): Promise<WorkerPaneIdentity>;
+    inspect(identity: WorkerPaneIdentity, expectedSessionId: string, assertCurrent: () => void): Promise<void>;
+    close(identity: WorkerPaneIdentity, expectedSessionId: string, assertCurrent: () => void, beforeSubmit: () => Promise<void>): Promise<{
+        paneClosed: boolean;
+        workerExited: boolean;
+    }>;
+}
+export type CloseReason = 'timeout' | 'interrupted' | 'delivery_failed' | 'identity_failed' | 'save_failed' | 'worker_changed' | 'worker_busy' | 'commit_rejected' | 'close_unverified' | 'close_failed';
+export type CloseState = 'requested' | 'awaiting_handoff' | 'awaiting_settlement' | 'ready' | 'closing' | 'closed' | 'failed' | 'timed_out' | 'interrupted' | 'uncertain';
+export interface Handoff {
+    version: 1;
+    summary: string;
+    updatedAt: string;
+    jobId: string;
+}
+export interface CloseJob {
+    jobId: string;
+    state: CloseState;
+    createdAt: string;
+    updatedAt: string;
+    deadlineAt: string;
+    reason?: CloseReason;
+}
+export type HandoffKind = 'close_prepare' | 'close_identity' | 'close_request' | 'handoff_report' | 'close_ready' | 'close_commit';
+export declare const HANDOFF_KINDS: readonly string[];
+export declare const pendingClose: (job?: CloseJob) => boolean;
+export declare const fencedClose: (job?: CloseJob) => boolean;
+export declare function validateIdentity(value: unknown): asserts value is WorkerPaneIdentity;
+export declare function validateHandoff(value: unknown): asserts value is Handoff;
+export declare function validateCloseJob(value: unknown): asserts value is CloseJob;
+export declare function validateHandoffPayload(kind: string, p: Record<string, unknown>): void;
+interface Context {
+    state(): Promise<{
+        id: string;
+        config: Config;
+        me?: Agent;
+    }>;
+    assertCurrent(): void;
+    update(mutate: (config: Config) => void, guard?: () => void): Promise<void>;
+    send(sessionId: string, kind: HandoffKind, payload: Record<string, unknown>): Promise<void>;
+    deliver(message: string): void;
+    busy(): boolean;
+    provider?: CloseProvider;
+    timeoutMs?: number;
+}
+/** Extension-owned asynchronous protocol. No host abort, shutdown, automatic retries or guessed pane targets. */
+export declare class HandoffWorkflow {
+    private readonly ctx;
+    private readonly instanceId;
+    private jobs;
+    private worker?;
+    private epoch;
+    private disposed;
+    private readonly timeout;
+    constructor(ctx: Context);
+    private valid;
+    private background;
+    dispose(): void;
+    recover(): Promise<void>;
+    private assertJob;
+    private target;
+    private transition;
+    private finish;
+    request(target: Agent): Promise<CloseJob>;
+    workerStarted(): void;
+    workerSettled(successfulToolCallIds: ReadonlySet<string>): void;
+    private assertWorker;
+    get workerClosing(): boolean;
+    isClosing(sessionId: string): boolean;
+    report(jobId: unknown, summary: unknown, toolCallId?: string): Promise<{
+        saved: true;
+        closure: 'awaiting_turn_settlement';
+    }>;
+    receive(kind: HandoffKind, from: string, payload: Record<string, unknown>): Promise<void>;
+}
+export {};