@cotal-ai/workspace 0.39.1 → 0.41.0

package/dist/pid.d.ts

@@ -92,4 +92,152 @@ export declare function readProcessCommand(pid: number): ProcessCommand;
  * direction is the safe one and is chosen deliberately.
  */
 export declare function commandIsCotalSupervisor(command: string): boolean;
+/**
+ * A process identity record, as a pidfile's CONTENT. The pid alone is not a stable identity on any
+ * OS: PIDs are recycled (aggressively on Windows, eventually on POSIX), and a teardown that signals
+ * a recorded pid therefore signals "whatever holds that number now". The record pins the pid to the
+ * process START that claimed it, which is the strongest identity a fresh process can establish
+ * without holding a kernel capability (#969 design shape (a)): the start time of a pid is fixed for
+ * the life of that pid and changes the moment the number is reused.
+ *
+ * FORMAT: two whitespace-separated fields, `pid` and `token`. The token is opaque here (see
+ * {@link ProcessStartTokenReader} for what produces it); a record carrying only a pid is a LEGACY
+ * record (pre-identity build) and every consumer must treat it as such, loud.
+ */
+export type ProcessIdentityRecord = {
+    pid: number;
+    token: string;
+};
+/** What a pidfile's content resolves to. `legacy` is a bare pid (a pre-identity build's record);
+ *  `husk` is an empty pre-protocol file; `unattributable` is anything parsePid rejects — the same
+ *  three-valued rule the rest of this module applies, so "cannot read the record" is never folded
+ *  into "nothing recorded". */
+export type ReadRecord = {
+    kind: "record";
+    record: ProcessIdentityRecord;
+} | {
+    kind: "legacy";
+    pid: number;
+} | {
+    kind: "husk";
+} | {
+    kind: "unattributable";
+    raw: string;
+};
+export declare function parseRecord(raw: string): ReadRecord;
+/** Serialize a record. Exactly the inverse of {@link parseRecord}; writing is centralized so a
+ *  future format change is one edit, not a fifth copy of `String(pid)`. */
+export declare function formatRecord(record: ProcessIdentityRecord): string;
+/**
+ * The creation-identity token of a live pid: on Linux `/proc/<pid>/stat` field 22 (starttime —
+ * ticks since boot, fixed for the life of the pid); on macOS/BSD `ps -o lstart=`; on Windows
+ * `undefined`, because no cheap STABLE token exists there (see the Windows note in
+ * `advisory-lock.ts`'s `processStartToken` for why a `ps` on PATH is worse than none). A pid whose
+ * token is `undefined` can still be recorded — the record then carries no start pin, and teardown
+ * warns that it is proceeding without the identity check.
+ */
+export type ProcessStartTokenReader = (pid: number) => string | undefined;
+/** The start token for a pid THIS PROCESS is about to record. Prefer the reader passed by the
+ *  caller (tests inject divergence), fall back to the same `/proc`/`ps` read the advisory lock
+ *  uses, so the token written at launch and the token compared at teardown come from ONE
+ *  implementation. `undefined` (Windows, or a ps-less host) records a pid-only LEGACY record —
+ *  visible as such to every reader, never silently. */
+export declare function identityRecord(pid: number, tokenAt?: ProcessStartTokenReader): ProcessIdentityRecord | {
+    pid: number;
+};
+/** The start-token reader shared with the advisory lock, so launch and teardown agree on the token
+ *  for the same live pid. Imported here rather than reimplemented: two token readers that drift
+ *  would make the SAME process look like a stranger at teardown. */
+import { processStartToken as defaultStartToken } from "./advisory-lock.js";
+export { defaultStartToken };
+/** The verdict of {@link assertRecordIdentity}: does the live process behind `pid` still carry the
+ *  start this record pinned? `unreadable` is deliberately NOT a variant: the reader signature
+ *  returns `undefined` for "cannot look" and that folds into `unpinned` (refuse). This differs from
+ *  a legacy record with no pin at all: legacy records warn and proceed for upgrade compatibility,
+ *  while a pin that exists but cannot be checked is preserved rather than silently weakened. */
+export type IdentityVerdict = {
+    kind: "match";
+} | {
+    kind: "mismatch";
+    liveToken: string;
+} | {
+    kind: "gone";
+} | {
+    kind: "unpinned";
+};
+/**
+ * THE identity check a teardown must pass before signalling (#969). This is the "open, verify,
+ * terminate" step: verify BEFORE any signal. A record pins a start token; if the pid's CURRENT
+ * start differs, the pid was REUSED and the live process is a stranger — refuse, never signal.
+ *
+ * FAILS CLOSED ON THE CHECK ITSELF: `gone` (the pid is ESRCH-dead; the record is stale and
+ * clearable) and `unpinned` (no token could be established for a live pid - a platform that
+ * cannot pin, or the process died between the token read and the liveness probe) are both
+ * distinct from `match`, and it is the CALLER's rule which of them may clear a record. Only
+ * `gone` is ever a safe clear here, because only ESRCH-equivalent evidence proves the recorded
+ * process itself gone.
+ */
+export declare function assertRecordIdentity(record: ProcessIdentityRecord, tokenAt?: ProcessStartTokenReader): IdentityVerdict;
+/** One shared refusal message, so every teardown names the same rule in the same words (#969
+ *  acceptance: manager, delivery, auth and broker teardown use the SAME identity rule). */
+export declare function identityRefusal(label: string, path: string, record: ProcessIdentityRecord, live: string): Error;
+/** Warning for the one deliberately reduced-guarantee path: a live pre-pin record. Upgrades must be
+ * able to stop the stack that was launched by the previous version. The next launch writes a pin,
+ * after which mismatch and torn-pin protection applies in full. */
+export declare function identityLegacyWarning(label: string, pidfilePath: string): string;
+/**
+ * The pidfile format stays a BARE PID. Every reader of `.cotal/*.pid` across the tree - status,
+ * clean, meshes, the web dashboard, smoke suites, and any operator script - keeps working, and a
+ * bare-pid pidfile remains a LEGACY record this change must handle with a loud warning, not break. The creation
+ * identity therefore lives in a SIBLING file `<pidfile>.identity` (the `manager.delivery-aware`
+ * marker pattern), holding the {@link formatRecord} two-field pin. Missing sibling = legacy record;
+ * present-but-garbled = torn write, refuse; pid mismatch inside the sibling = torn pairing, refuse.
+ */
+export declare function identityPinPath(pidfilePath: string): string;
+/** Write the sibling pin for a pid this launch just spawned. Called AFTER the pidfile write, with
+ *  the same pid, so a reader that sees a pidfile with no pin yet is reading either a legacy record
+ *  or a launch mid-pairing - both are visible below, never silent. `undefined` token (Windows,
+ *  ps-less host) writes NO pin, which is the honest legacy shape for that platform rather than a
+ *  pin that cannot be checked. */
+export declare function writeIdentityPin(pidfilePath: string, pid: number, tokenAt?: ProcessStartTokenReader): void;
+/** What {@link verifyIdentityPin} found for one pidfile. */
+export type PinVerdict = {
+    kind: "legacy";
+} | {
+    kind: "match";
+} | {
+    kind: "gone";
+} | {
+    kind: "mismatch";
+    record: ProcessIdentityRecord;
+    liveToken: string;
+} | {
+    kind: "torn-pin";
+    raw: string;
+} | {
+    kind: "torn-pairing";
+    pinPid: number;
+} | {
+    kind: "unpinned";
+};
+/**
+ * THE open-verify step every teardown runs BEFORE signalling (#969). Read the pidfile's bare pid,
+ * then the sibling pin, and adjudicate the pairing:
+ *   - legacy              -> the caller warns and signals for upgrade compatibility
+ *   - match               -> safe to signal; the process behind the pid is the recorded one
+ *   - gone                -> ESRCH-proven dead; the caller may clear the record
+ *   - mismatch            -> PID REUSE: the pid now fronts a DIFFERENT start; NEVER signal
+ *   - torn-pin/torn-pairing/unpinned -> cannot establish identity on a live pid; refuse, preserve
+ *
+ * The pidfile argument is the SIBLING'S base path (the pidfile itself), and the bare pid is read
+ * from it here so the pairing check cannot drift from however the caller read the pid.
+ */
+export declare function verifyIdentityPin(pidfilePath: string, tokenAt?: ProcessStartTokenReader): PinVerdict;
+/** Remove the sibling pin together with a pidfile whose process is PROVEN gone. Never called on a
+ *  refused stop: the preserved record keeps its pin so the next attempt re-adjudicates. */
+export declare function removeIdentityPin(pidfilePath: string): void;
+/** The loud torn/unpinned refusal, in the same shape as {@link identityRefusal}: name the component,
+ *  the file, what was found, and the operator's next step. Legacy records do not reach this helper:
+ *  callers emit {@link identityLegacyWarning} and proceed. */
+export declare function identityUncertaintyRefusal(label: string, pidfilePath: string, verdict: PinVerdict): Error;
 //# sourceMappingURL=pid.d.ts.map

package/dist/pid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pid.d.ts","sourceRoot":"","sources":["../src/pid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;;wCAGwC;AACxC,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;;sDAQsD;AACtD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAIxF;AAED;;;;;;;2BAO2B;AAC3B;;;mGAGmG;AACnG,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAOvE;AAWD;;gBAEgB;AAChB,MAAM,MAAM,cAAc;AACxB,gDAAgD;AAC9C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACtC,iGAAiG;GAC/F;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,oFAAoF;GAClF;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;6CAE6C;AAC7C,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAkB9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjE"}
+{"version":3,"file":"pid.d.ts","sourceRoot":"","sources":["../src/pid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;;wCAGwC;AACxC,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;;sDAQsD;AACtD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAIxF;AAED;;;;;;;2BAO2B;AAC3B;;;mGAGmG;AACnG,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAOvE;AAWD;;gBAEgB;AAChB,MAAM,MAAM,cAAc;AACxB,gDAAgD;AAC9C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACtC,iGAAiG;GAC/F;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,oFAAoF;GAClF;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;6CAE6C;AAC7C,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAkB9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjE;AAID;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;+BAG+B;AAC/B,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1K,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAanD;AAED;2EAC2E;AAC3E,wBAAgB,YAAY,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAE1E;;;;uDAIuD;AACvD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA2C,GAAG,qBAAqB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAGzI;AAED;;oEAEoE;AACpE,OAAO,EAAE,iBAAiB,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;gGAIgG;AAChG,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,GAAE,uBAA2C,GAAG,eAAe,CAWzI;AAED;2FAC2F;AAC3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAK/G;AAED;;mEAEmE;AACnE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhF;AAID;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;kCAIkC;AAClC,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA2C,GAAG,IAAI,CAI7H;AAED,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA2C,GAAG,UAAU,CA8BvH;AAED;2FAC2F;AAC3F,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;8DAE8D;AAC9D,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,KAAK,CAqBzG"}

package/dist/pid.js

@@ -18,7 +18,7 @@
  * module they may depend on, never a core export.
  */
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync, rmSync, writeFileSync } from "node:fs";
 /** A Node/POSIX-signalable pid: a positive INTEGER within the signed 32-bit range `process.kill`
  *  accepts (it throws `ERR_INVALID_ARG_TYPE`/`ERR_OUT_OF_RANGE` outside it). Anything else -
  *  fractional, non-numeric, non-positive, oversized - is undefined: UNATTRIBUTABLE, never a pid to
@@ -102,4 +102,171 @@ export function readProcessCommand(pid) {
 export function commandIsCotalSupervisor(command) {
     return /(^|\s)supervise(\s|$)/.test(command);
 }
+export function parseRecord(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === "")
+        return { kind: "husk" };
+    // FIELD SPLIT, not a substring: the token may itself contain digits (it is a timestamp), so
+    // anything other than exactly two fields cannot name both a pid and its start.
+    const fields = trimmed.split(/\s+/);
+    if (fields.length === 1) {
+        const pid = parsePid(fields[0]);
+        return pid === undefined ? { kind: "unattributable", raw: trimmed } : { kind: "legacy", pid };
+    }
+    if (fields.length === 2 && parsePid(fields[0]) !== undefined && fields[1] !== "")
+        return { kind: "record", record: { pid: parsePid(fields[0]), token: fields[1] } };
+    return { kind: "unattributable", raw: trimmed };
+}
+/** Serialize a record. Exactly the inverse of {@link parseRecord}; writing is centralized so a
+ *  future format change is one edit, not a fifth copy of `String(pid)`. */
+export function formatRecord(record) {
+    return `${record.pid} ${record.token}`;
+}
+/** The start token for a pid THIS PROCESS is about to record. Prefer the reader passed by the
+ *  caller (tests inject divergence), fall back to the same `/proc`/`ps` read the advisory lock
+ *  uses, so the token written at launch and the token compared at teardown come from ONE
+ *  implementation. `undefined` (Windows, or a ps-less host) records a pid-only LEGACY record —
+ *  visible as such to every reader, never silently. */
+export function identityRecord(pid, tokenAt = defaultStartToken) {
+    const token = tokenAt(pid);
+    return token === undefined ? { pid } : { pid, token };
+}
+/** The start-token reader shared with the advisory lock, so launch and teardown agree on the token
+ *  for the same live pid. Imported here rather than reimplemented: two token readers that drift
+ *  would make the SAME process look like a stranger at teardown. */
+import { processStartToken as defaultStartToken } from "./advisory-lock.js";
+export { defaultStartToken };
+/**
+ * THE identity check a teardown must pass before signalling (#969). This is the "open, verify,
+ * terminate" step: verify BEFORE any signal. A record pins a start token; if the pid's CURRENT
+ * start differs, the pid was REUSED and the live process is a stranger — refuse, never signal.
+ *
+ * FAILS CLOSED ON THE CHECK ITSELF: `gone` (the pid is ESRCH-dead; the record is stale and
+ * clearable) and `unpinned` (no token could be established for a live pid - a platform that
+ * cannot pin, or the process died between the token read and the liveness probe) are both
+ * distinct from `match`, and it is the CALLER's rule which of them may clear a record. Only
+ * `gone` is ever a safe clear here, because only ESRCH-equivalent evidence proves the recorded
+ * process itself gone.
+ */
+export function assertRecordIdentity(record, tokenAt = defaultStartToken) {
+    const live = tokenAt(record.pid);
+    if (live === undefined) {
+        // Distinguish "cannot look" from "looked and it is gone": the token readers return undefined
+        // BOTH when the platform cannot answer and when the process does not exist, and those must not
+        // share a verdict — a platform that cannot pin must refuse, a dead pid may be cleared.
+        const liveness = probeLiveness(record.pid);
+        if (liveness === "dead")
+            return { kind: "gone" };
+        return { kind: "unpinned" };
+    }
+    return live === record.token ? { kind: "match" } : { kind: "mismatch", liveToken: live };
+}
+/** One shared refusal message, so every teardown names the same rule in the same words (#969
+ *  acceptance: manager, delivery, auth and broker teardown use the SAME identity rule). */
+export function identityRefusal(label, path, record, live) {
+    return new Error(`refusing to stop ${label} (pid ${record.pid}) at ${path}: the pid has been reused (recorded start ${record.token}, the live process started ${live}). Signalling it would kill an unrelated process. The record is preserved.\n` +
+        `NEXT: inspect pid ${record.pid} with \`ps -p ${record.pid}\`. If that process should be stopped, stop it, then rerun this command; once the pid is dead the stale record clears automatically.`);
+}
+/** Warning for the one deliberately reduced-guarantee path: a live pre-pin record. Upgrades must be
+ * able to stop the stack that was launched by the previous version. The next launch writes a pin,
+ * after which mismatch and torn-pin protection applies in full. */
+export function identityLegacyWarning(label, pidfilePath) {
+    return `! ${label} at ${pidfilePath} predates process identity pinning; signalling it without an identity check. A relaunch will pin the process identity.`;
+}
+// ---- THE SIBLING IDENTITY PIN: launch writes it, teardown verifies it (#969) ---------------------
+/**
+ * The pidfile format stays a BARE PID. Every reader of `.cotal/*.pid` across the tree - status,
+ * clean, meshes, the web dashboard, smoke suites, and any operator script - keeps working, and a
+ * bare-pid pidfile remains a LEGACY record this change must handle with a loud warning, not break. The creation
+ * identity therefore lives in a SIBLING file `<pidfile>.identity` (the `manager.delivery-aware`
+ * marker pattern), holding the {@link formatRecord} two-field pin. Missing sibling = legacy record;
+ * present-but-garbled = torn write, refuse; pid mismatch inside the sibling = torn pairing, refuse.
+ */
+export function identityPinPath(pidfilePath) {
+    return `${pidfilePath}.identity`;
+}
+/** Write the sibling pin for a pid this launch just spawned. Called AFTER the pidfile write, with
+ *  the same pid, so a reader that sees a pidfile with no pin yet is reading either a legacy record
+ *  or a launch mid-pairing - both are visible below, never silent. `undefined` token (Windows,
+ *  ps-less host) writes NO pin, which is the honest legacy shape for that platform rather than a
+ *  pin that cannot be checked. */
+export function writeIdentityPin(pidfilePath, pid, tokenAt = defaultStartToken) {
+    const rec = identityRecord(pid, tokenAt);
+    if (!("token" in rec))
+        return; // platform cannot pin: leave the legacy bare-pid shape, loud
+    writeFileSync(identityPinPath(pidfilePath), formatRecord(rec));
+}
+/**
+ * THE open-verify step every teardown runs BEFORE signalling (#969). Read the pidfile's bare pid,
+ * then the sibling pin, and adjudicate the pairing:
+ *   - legacy              -> the caller warns and signals for upgrade compatibility
+ *   - match               -> safe to signal; the process behind the pid is the recorded one
+ *   - gone                -> ESRCH-proven dead; the caller may clear the record
+ *   - mismatch            -> PID REUSE: the pid now fronts a DIFFERENT start; NEVER signal
+ *   - torn-pin/torn-pairing/unpinned -> cannot establish identity on a live pid; refuse, preserve
+ *
+ * The pidfile argument is the SIBLING'S base path (the pidfile itself), and the bare pid is read
+ * from it here so the pairing check cannot drift from however the caller read the pid.
+ */
+export function verifyIdentityPin(pidfilePath, tokenAt = defaultStartToken) {
+    let rawPid;
+    try {
+        rawPid = readFileSync(pidfilePath, "utf8");
+    }
+    catch {
+        return { kind: "legacy" }; // no pidfile at all: nothing is pinned; callers treat as absent
+    }
+    const pidRead = parsePid(rawPid);
+    if (pidRead === undefined)
+        return { kind: "legacy" }; // husk/unattributable: existing callers own it
+    let rawPin;
+    try {
+        rawPin = readFileSync(identityPinPath(pidfilePath), "utf8");
+    }
+    catch {
+        // No pin: a LEGACY record. A live one warns and is signalable for upgrade compatibility; a pid
+        // that is ESRCH-dead needs no identity proof, so it reports `gone` and the caller clears the
+        // stale record. kill(pid, 0) only: this probe signals nothing.
+        return probeLiveness(pidRead) === "dead" ? { kind: "gone" } : { kind: "legacy" };
+    }
+    // The TORN shapes below refuse when the pid is live or unknown - identity cannot be proven.
+    // When the pid is ESRCH-dead there is nothing to signal, so the record is clearable whatever
+    // state the pin is in: a torn pin must not wedge the cleanup of a process that no longer exists.
+    const dead = probeLiveness(pidRead) === "dead";
+    const parsed = parseRecord(rawPin);
+    if (parsed.kind !== "record")
+        return dead ? { kind: "gone" } : { kind: "torn-pin", raw: parsed.kind === "unattributable" ? parsed.raw : "" };
+    if (parsed.record.pid !== pidRead)
+        return dead ? { kind: "gone" } : { kind: "torn-pairing", pinPid: parsed.record.pid };
+    const verdict = assertRecordIdentity(parsed.record, tokenAt);
+    if (verdict.kind === "match")
+        return { kind: "match" };
+    if (verdict.kind === "gone")
+        return { kind: "gone" };
+    if (verdict.kind === "mismatch")
+        return { kind: "mismatch", record: parsed.record, liveToken: verdict.liveToken };
+    return { kind: "unpinned" };
+}
+/** Remove the sibling pin together with a pidfile whose process is PROVEN gone. Never called on a
+ *  refused stop: the preserved record keeps its pin so the next attempt re-adjudicates. */
+export function removeIdentityPin(pidfilePath) {
+    rmSync(identityPinPath(pidfilePath), { force: true });
+}
+/** The loud torn/unpinned refusal, in the same shape as {@link identityRefusal}: name the component,
+ *  the file, what was found, and the operator's next step. Legacy records do not reach this helper:
+ *  callers emit {@link identityLegacyWarning} and proceed. */
+export function identityUncertaintyRefusal(label, pidfilePath, verdict) {
+    const pin = identityPinPath(pidfilePath);
+    if (verdict.kind === "torn-pin")
+        return new Error(`refusing to stop ${label} at ${pidfilePath}: its identity pin ${pin} holds unattributable content ${JSON.stringify(verdict.raw)} - a torn or tampered write. The record is preserved.\n` +
+            `NEXT: inspect the recorded process with \`ps\`. If it should be stopped, stop it, then rerun this command; once the pid is dead the stale record clears automatically.`);
+    if (verdict.kind === "torn-pairing")
+        return new Error(`refusing to stop ${label} at ${pidfilePath}: its identity pin ${pin} names pid ${verdict.pinPid}, not the pidfile's pid. The record is preserved.\n` +
+            `NEXT: inspect the recorded process with \`ps\`. If it should be stopped, stop it, then rerun this command; once the pid is dead the stale record clears automatically.`);
+    if (verdict.kind === "unpinned")
+        return new Error(`refusing to stop ${label} at ${pidfilePath}: its process is live but no creation identity could be established for it, so target identity cannot be proven. The record is preserved.\n` +
+            `NEXT: stop the process, then rerun this command; once the pid is dead the stale record clears automatically.`);
+    return new Error(`refusing to stop ${label} at ${pidfilePath}: the identity state is unsupported (${verdict.kind}). The record is preserved.\n` +
+        `NEXT: stop the process, then rerun this command; once the pid is dead the stale record clears automatically.`);
+}
 //# sourceMappingURL=pid.js.map

package/dist/pid.js.map

@@ -1 +1 @@
-{"version":3,"file":"pid.js","sourceRoot":"","sources":["../src/pid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;wCAGwC;AACxC,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;;;sDAQsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,CAAC,kCAAkC;IACxE,OAAO,SAAS,CAAC,CAAC,6EAA6E;AACjG,CAAC;AAgBD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,iBAAiB,CAAE,CAA2B,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AA2BD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC;IACxG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,6FAA6F;YAC7F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/G,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;YAC/C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,GAAG,aAAa,IAAI,IAAK,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC3E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,qCAAqC;IAClF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"pid.js","sourceRoot":"","sources":["../src/pid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE9D;;;wCAGwC;AACxC,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;;;sDAQsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,CAAC,kCAAkC;IACxE,OAAO,SAAS,CAAC,CAAC,6EAA6E;AACjG,CAAC;AAgBD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,iBAAiB,CAAE,CAA2B,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AA2BD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC;IACxG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,6FAA6F;YAC7F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/G,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;YAC/C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,GAAG,aAAa,IAAI,IAAK,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC3E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,qCAAqC;IAClF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAwBD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5C,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACjC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;QAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtF,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAYD;;;;uDAIuD;AACvD,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,UAAmC,iBAAiB;IAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAED;;oEAEoE;AACpE,OAAO,EAAE,iBAAiB,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAa7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B,EAAE,UAAmC,iBAAiB;IACtH,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,6FAA6F;QAC7F,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3F,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAY,EAAE,MAA6B,EAAE,IAAY;IACtG,OAAO,IAAI,KAAK,CACd,oBAAoB,KAAK,SAAS,MAAM,CAAC,GAAG,QAAQ,IAAI,6CAA6C,MAAM,CAAC,KAAK,8BAA8B,IAAI,8EAA8E;QACjO,qBAAqB,MAAM,CAAC,GAAG,iBAAiB,MAAM,CAAC,GAAG,sIAAsI,CACjM,CAAC;AACJ,CAAC;AAED;;mEAEmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,WAAmB;IACtE,OAAO,KAAK,KAAK,OAAO,WAAW,wHAAwH,CAAC;AAC9J,CAAC;AAED,qGAAqG;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,OAAO,GAAG,WAAW,WAAW,CAAC;AACnC,CAAC;AAED;;;;kCAIkC;AAClC,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,GAAW,EAAE,UAAmC,iBAAiB;IACrH,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC;QAAE,OAAO,CAAC,6DAA6D;IAC5F,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,UAAmC,iBAAiB;IACzG,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,gEAAgE;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,+CAA+C;IACrG,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,6FAA6F;QAC7F,+DAA+D;QAC/D,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnF,CAAC;IACD,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7I,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACxH,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAClH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,WAAmB,EAAE,OAAmB;IAChG,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAC7B,OAAO,IAAI,KAAK,CACd,oBAAoB,KAAK,OAAO,WAAW,sBAAsB,GAAG,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,yDAAyD;YACzL,wKAAwK,CACzK,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QACjC,OAAO,IAAI,KAAK,CACd,oBAAoB,KAAK,OAAO,WAAW,sBAAsB,GAAG,cAAc,OAAO,CAAC,MAAM,qDAAqD;YACrJ,wKAAwK,CACzK,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAC7B,OAAO,IAAI,KAAK,CACd,oBAAoB,KAAK,OAAO,WAAW,6IAA6I;YACxL,8GAA8G,CAC/G,CAAC;IACJ,OAAO,IAAI,KAAK,CACd,oBAAoB,KAAK,OAAO,WAAW,wCAAwC,OAAO,CAAC,IAAI,+BAA+B;QAC9H,8GAA8G,CAC/G,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/workspace",
   "description": "Cotal machine-local workstation layer: the ~/.cotal mesh registry, target resolution, preflight, on-disk auth-path I/O, and the command-copy renderer — operator concerns over a local checkout, kept separate from the wire protocol in @cotal-ai/core.",
-  "version": "0.39.1",
+  "version": "0.41.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.39.1"
+    "@cotal-ai/core": "0.41.0"
   },
   "files": [
     "dist"