@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/src/local-dev/docker-credential-health.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS = void 0;
+exports.inspectDockerCredentialHelpers = inspectDockerCredentialHelpers;
+exports.probeDockerCredentialHelper = probeDockerCredentialHelper;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+exports.DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS = 5_000;
+const remediation = 'If a required image pull fails, repair or unlock its selected Docker credential helper, then run ebk dev doctor --refresh. The optional list probe is advisory; do not delete host credentials, remove helpers, or prune shared builders.';
+/** Check helper liveness through the optional metadata-only list operation. Never
+ * request a password, retain helper output, or modify Docker configuration. */
+async function inspectDockerCredentialHelpers(options = {}) {
+    try {
+        const directory = options.configDirectory ??
+            process.env.DOCKER_CONFIG ??
+            (0, node_path_1.join)((0, node_os_1.homedir)(), '.docker');
+        if (!(0, node_path_1.isAbsolute)(directory))
+            throw new Error('invalid configuration');
+        let file;
+        try {
+            file = (0, node_fs_1.openSync)((0, node_path_1.join)(directory, 'config.json'), 'r');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return {
+                    status: 'ready',
+                    evidence: 'No explicit Docker credential helper is configured.',
+                };
+            throw error;
+        }
+        let config;
+        try {
+            const stat = (0, node_fs_1.fstatSync)(file);
+            if (!stat.isFile() || stat.size > 64 * 1024)
+                throw new Error('invalid configuration');
+            config = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+        }
+        finally {
+            (0, node_fs_1.closeSync)(file);
+        }
+        if (!config || typeof config !== 'object' || Array.isArray(config))
+            throw new Error('invalid configuration');
+        let registryHelpers = {};
+        if (config.credHelpers !== undefined) {
+            if (!config.credHelpers ||
+                typeof config.credHelpers !== 'object' ||
+                Array.isArray(config.credHelpers))
+                throw new Error('invalid configuration');
+            registryHelpers = config.credHelpers;
+        }
+        // Fleet dependency images currently use Docker Hub. Exact registry helpers
+        // override the global store, as Docker does; unrelated logins are untouched.
+        const helpers = (options.registries ?? ['https://index.docker.io/v1/'])
+            .map((registry) => registryHelpers[registry] ?? config.credsStore)
+            .filter((helper) => helper !== undefined && helper !== '');
+        const unique = [...new Set(helpers)];
+        if (unique.length > 16 ||
+            unique.some((helper) => typeof helper !== 'string' ||
+                !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(helper)))
+            throw new Error('invalid configuration');
+        const probe = options.probe ?? probeDockerCredentialHelper;
+        await Promise.all(unique.map((helper) => probe(`docker-credential-${helper}`)));
+        return {
+            status: 'ready',
+            evidence: `${unique.length} selected Docker credential helper(s) responded to the optional list probe; output discarded. Image authentication is checked by Docker when pulling.`,
+        };
+    }
+    catch {
+        return {
+            status: 'unavailable',
+            evidence: 'Docker credential configuration or optional list liveness is unverified. This does not prove required image pulls will fail.',
+            remediation,
+        };
+    }
+}
+function probeDockerCredentialHelper(executable) {
+    return new Promise((resolve, reject) => {
+        // list returns registry/username metadata, not passwords. Even that metadata
+        // is discarded. Never serialize execFile's error (it carries stdout/stderr).
+        const child = (0, node_child_process_1.execFile)(executable, ['list'], {
+            timeout: exports.DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+            maxBuffer: 64 * 1024,
+            windowsHide: true,
+            shell: false,
+        }, (error) => error
+            ? reject(new Error('Docker credential helper unavailable.'))
+            : resolve());
+        child.stdin?.end();
+    });
+}
+//# sourceMappingURL=docker-credential-health.js.map

package/src/local-dev/environment-inspector.d.ts

@@ -1,3 +1,4 @@
+import { type FoundationPreflightReport } from '../foundation/preflight.js';
 import type { LocalDevAdapter } from './contracts.js';
 import { type DevelopmentEnvironmentAssessment, type EnvironmentCheckResult } from './environment-state.js';
 import { LocalDevContractError } from './errors.js';
@@ -61,6 +62,10 @@ export declare const ENVIRONMENT_INSPECTOR_CHECKS: readonly [{
     readonly capabilities: readonly ["containers"];
     readonly id: "docker-compose-v2";
     readonly volatile: true;
+}, {
+    readonly capabilities: readonly ["containers"];
+    readonly id: "docker-credential-helpers";
+    readonly volatile: true;
 }, {
     readonly capabilities: readonly ["aws-foundation"];
     readonly id: "aws-sdk-credentials";
@@ -122,5 +127,7 @@ export declare class EnvironmentDeficientError extends LocalDevContractError {
 }
 export declare function evaluateEnvironmentExecutableVersion(detectedVersion: string, minimumVersion: string, remediation: string): EnvironmentProbeObservation;
 export declare function evaluateDevelopmentFoundationAccount(accountId: string, eventBusArn: string): EnvironmentProbeObservation;
+export declare function evaluateDevelopmentFoundationReport(report: FoundationPreflightReport, accountId: string, context: LocalDevContext): EnvironmentProbeObservation;
+export declare function resolveCurrentAwsAccountId(context: LocalDevContext, abortSignal: AbortSignal): Promise<string>;
 export declare function inspectDevelopmentEnvironment(input: InspectEnvironmentInput, dependencies?: EnvironmentInspectorDependencies): Promise<DevelopmentEnvironmentAssessment>;
 export declare function assertEnvironmentReady(assessment: DevelopmentEnvironmentAssessment): void;

package/src/local-dev/environment-inspector.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnvironmentDeficientError = exports.ENVIRONMENT_INSPECTOR_CHECKS = exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = void 0;
 exports.evaluateEnvironmentExecutableVersion = evaluateEnvironmentExecutableVersion;
 exports.evaluateDevelopmentFoundationAccount = evaluateDevelopmentFoundationAccount;
+exports.evaluateDevelopmentFoundationReport = evaluateDevelopmentFoundationReport;
+exports.resolveCurrentAwsAccountId = resolveCurrentAwsAccountId;
 exports.inspectDevelopmentEnvironment = inspectDevelopmentEnvironment;
 exports.assertEnvironmentReady = assertEnvironmentReady;
 const node_child_process_1 = require("node:child_process");
@@ -22,6 +24,7 @@ const errors_js_1 = require("./errors.js");
 const nx_workspace_js_1 = require("./nx-workspace.js");
 const personal_stage_js_1 = require("./personal-stage.js");
 const tls_js_1 = require("./tls.js");
+const docker_credential_health_js_1 = require("./docker-credential-health.js");
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = 15_000;
 const MAX_AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = 60_000;
@@ -100,6 +103,11 @@ exports.ENVIRONMENT_INSPECTOR_CHECKS = [
         id: 'docker-compose-v2',
         volatile: true,
     },
+    {
+        capabilities: ['containers'],
+        id: 'docker-credential-helpers',
+        volatile: true,
+    },
     {
         capabilities: ['aws-foundation'],
         id: 'aws-sdk-credentials',
@@ -257,11 +265,15 @@ function commandRequirements(command, adapters, force = false) {
             checks['docker-cli'] = 'required';
             checks['docker-engine'] = 'required';
             checks['docker-compose-v2'] = 'required';
+            // Docker's required credential protocol is get/store/erase, not list.
+            // This secret-free liveness probe is diagnostic, never pull authority.
+            checks['docker-credential-helpers'] = 'advisory';
         }
         else {
             checks['docker-cli'] = 'not-required';
             checks['docker-engine'] = 'not-required';
             checks['docker-compose-v2'] = 'not-required';
+            checks['docker-credential-helpers'] = 'not-required';
         }
     }
     else if (command === 'doctor') {
@@ -288,12 +300,14 @@ async function commandVersion(executable, args, timeout = 5_000) {
     });
     return `${result.stdout}${result.stderr}`.trim().split(/\r?\n/, 1)[0] ?? '';
 }
-function commandProbe(executable, args, remediation, minimumVersion) {
+function commandProbe(executable, args, remediation, minimumVersion, versionPattern) {
     return async () => {
         try {
             const version = await commandVersion(executable, args);
             return minimumVersion
-                ? evaluateEnvironmentExecutableVersion(version, minimumVersion, remediation)
+                ? evaluateEnvironmentExecutableVersion(versionPattern
+                    ? (versionPattern.exec(version)?.[1] ?? version)
+                    : version, minimumVersion, remediation)
                 : {
                     detectedVersion: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(version).slice(0, 128),
                     status: 'ready',
@@ -335,6 +349,18 @@ function evaluateDevelopmentFoundationAccount(accountId, eventBusArn) {
         status: 'ready',
     };
 }
+function evaluateDevelopmentFoundationReport(report, accountId, context) {
+    if (!report.ok || !report.discovery) {
+        return {
+            evidence: report.issues.join('; '),
+            remediation: report.state === 'absent'
+                ? `Development Foundation is absent in ${context.region}. Verify workspace ownership and run ebk deploy development --profile=${context.profile} --expectedRoleArn=<approved-development-role>; the governed stage lifecycle deploys Foundation first, then eligible Slices. Retry ebk dev doctor afterward. This is not an IAM denial.`
+                : 'Development Foundation discovery is incomplete or incompatible. Inspect the reported contract issues and reconcile Foundation through its governed upgrade/deploy workflow; do not expand IAM permissions to repair discovery data.',
+            status: 'unavailable',
+        };
+    }
+    return evaluateDevelopmentFoundationAccount(accountId, report.discovery.eventBusArn);
+}
 function createAbortableCredentialRequestHandler(context, abortSignal) {
     const transportClient = new client_sts_1.STSClient({
         region: context.region,
@@ -356,7 +382,8 @@ async function resolveProfileCredentials(context, abortSignal) {
     try {
         return await (0, credential_providers_1.fromIni)({
             clientConfig: {
-                region: context.region,
+                // Credential sources own their Region (notably the SSO session).
+                // Application STS/SSM clients still use the selected deployment Region.
                 requestHandler: transport.requestHandler,
             },
             profile: context.profile,
@@ -418,7 +445,7 @@ const defaultProbes = {
     'personal-stage': async ({ identity }) => (0, personal_stage_js_1.isFrameworkPersonalStage)(identity.stage)
         ? { evidence: identity.stage, status: 'ready' }
         : {
-            remediation: 'Repair operating-system account identity resolution.',
+            remediation: 'Inspect the persisted worktree task identity with ebk dev status; use explicit ebk dev attach only after verifying ownership.',
             status: 'unavailable',
         },
     'private-state-location': async ({ appData }) => {
@@ -448,13 +475,14 @@ const defaultProbes = {
         return required.every(node_fs_1.existsSync)
             ? { status: 'ready' }
             : {
-                remediation: 'Run ebk dev setup, inspect the root, then explicitly run ebk dev setup --trust.',
+                remediation: 'Run ebk dev setup. The generated verify-local-browser target uses browser-scoped trust; system trust is optional and must be explicitly reviewed.',
                 status: 'missing',
             };
     },
     'docker-cli': commandProbe('docker', ['--version'], 'Install Docker with the Docker CLI.'),
     'docker-engine': commandProbe('docker', ['info', '--format', '{{.ServerVersion}}'], 'Start the Docker engine and confirm current-user access.'),
     'docker-compose-v2': commandProbe('docker', ['compose', 'version', '--short'], 'Install or enable Docker Compose v2.'),
+    'docker-credential-helpers': () => (0, docker_credential_health_js_1.inspectDockerCredentialHelpers)(),
     'aws-sdk-credentials': async ({ context }, abortSignal) => {
         try {
             const credentials = await resolveProfileCredentials(context, abortSignal);
@@ -497,14 +525,7 @@ const defaultProbes = {
                     region: context.region,
                     requirement: discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT,
                 });
-                if (!report.ok || !report.discovery) {
-                    return {
-                        evidence: report.issues.join('; '),
-                        remediation: `Grant profile ${context.profile} bounded ssm:GetParameters access to the development Foundation contract in ${context.region}.`,
-                        status: 'unavailable',
-                    };
-                }
-                return evaluateDevelopmentFoundationAccount(accountId, report.discovery.eventBusArn);
+                return evaluateDevelopmentFoundationReport(report, accountId, context);
             }
             finally {
                 reader.destroy();
@@ -513,12 +534,18 @@ const defaultProbes = {
         catch (error) {
             return {
                 evidence: error instanceof Error ? error.message : String(error),
-                remediation: `Grant profile ${context.profile} bounded ssm:GetParameters access to /ebk/development/foundation/* in ${context.region}.`,
+                remediation: [
+                    'AccessDenied',
+                    'AccessDeniedException',
+                    'UnauthorizedOperation',
+                ].includes(error instanceof Error ? error.name : '')
+                    ? `Reconcile profile ${context.profile}'s bounded ssm:GetParameters authority for /ebk/development/foundation/* in ${context.region}; confirm the exact account and role before changing policy.`
+                    : `Verify profile ${context.profile}'s temporary credentials and network access in ${context.region}, then retry ebk dev doctor. An unresolved read is not proof of missing IAM permissions.`,
                 status: 'unavailable',
             };
         }
     },
-    'aws-cli-remediation': commandProbe('aws', ['--version'], 'Install AWS CLI v2 only when the selected SSO profile requires aws sso login remediation.', '2'),
+    'aws-cli-remediation': commandProbe('aws', ['--version'], 'Install AWS CLI v2 only when the selected SSO profile requires aws sso login remediation.', '2', /^aws-cli\/(\d+\.\d+\.\d+)(?:\s|$)/),
 };
 async function resolveCurrentAwsAccountId(context, abortSignal) {
     const credentials = await resolveProfileCredentials(context, abortSignal);

package/src/local-dev/environment-state.js

@@ -392,7 +392,7 @@ function validateDevelopmentEnvironmentAssessment(value) {
         value.catalogVersion !== exports.ENVIRONMENT_REQUIREMENT_CATALOG_VERSION ||
         value.localContextSchemaVersion !== local_context_js_1.LOCAL_DEV_CONTEXT_SCHEMA_VERSION ||
         value.personalStageResolverVersion !== personal_stage_js_1.PERSONAL_STAGE_RESOLVER_VERSION ||
-        value.identitySource !== 'os-account') {
+        value.identitySource !== 'worktree-task') {
         return assessmentError('Development environment assessment has an unsupported schema, catalog, context, or identity version.');
     }
     if (!exports.ENVIRONMENT_ASSESSMENT_STATES.includes(value.state)) {
@@ -413,7 +413,7 @@ function validateDevelopmentEnvironmentAssessment(value) {
         evaluatedProfiles: validateStringArray(value.evaluatedProfiles, 'Environment evaluatedProfiles'),
         fingerprint: (0, contract_validation_js_1.requireBoundedString)(value.fingerprint, 'Environment fingerprint', { pattern: contract_validation_js_1.LOCAL_DEV_SHA256_PATTERN }),
         frameworkVersion: (0, contract_validation_js_1.requireBoundedString)(value.frameworkVersion, 'Environment frameworkVersion', { maximumLength: 128 }),
-        identitySource: 'os-account',
+        identitySource: 'worktree-task',
         localContextDigest: (0, contract_validation_js_1.requireBoundedString)(value.localContextDigest, 'Environment localContextDigest', { pattern: contract_validation_js_1.LOCAL_DEV_SHA256_PATTERN }),
         localContextSchemaVersion: local_context_js_1.LOCAL_DEV_CONTEXT_SCHEMA_VERSION,
         personalStageResolverVersion: personal_stage_js_1.PERSONAL_STAGE_RESOLVER_VERSION,

package/src/local-dev/errors.d.ts

@@ -1,4 +1,4 @@
-export declare const LOCAL_DEV_FAILURE_CLASSIFICATIONS: readonly ["invalid-input", "personal-identity-unavailable", "fleet-in-use", "fleet-ownership-ambiguous", "local-context-missing", "local-context-invalid", "local-context-conflict", "unknown-slice", "invalid-adapter", "slice-active-elsewhere", "slice-claim-ambiguous", "not-running", "invalid-state", "configuration-mismatch", "protocol-mismatch", "environment-deficient", "prerequisite-unavailable", "foundation-unavailable", "operation-conflict", "readiness-timeout", "cleanup-incomplete", "supervisor-unreachable", "stale-state", "stale-state-ambiguous", "log-query-invalid", "internal-error"];
+export declare const LOCAL_DEV_FAILURE_CLASSIFICATIONS: readonly ["invalid-input", "personal-identity-unavailable", "fleet-in-use", "fleet-ownership-ambiguous", "local-context-missing", "local-context-invalid", "local-context-conflict", "unknown-slice", "invalid-adapter", "slice-active-elsewhere", "slice-claim-ambiguous", "not-running", "invalid-state", "configuration-mismatch", "protocol-mismatch", "environment-deficient", "prerequisite-unavailable", "foundation-unavailable", "operation-conflict", "readiness-timeout", "provisioning-timeout", "startup-interrupted", "cleanup-incomplete", "supervisor-unreachable", "stale-state", "stale-state-ambiguous", "log-query-invalid", "internal-error"];
 export type LocalDevFailureClassification = (typeof LOCAL_DEV_FAILURE_CLASSIFICATIONS)[number];
 export declare class LocalDevContractError extends Error {
     readonly classification: LocalDevFailureClassification;

package/src/local-dev/errors.js

@@ -22,6 +22,8 @@ exports.LOCAL_DEV_FAILURE_CLASSIFICATIONS = [
     'foundation-unavailable',
     'operation-conflict',
     'readiness-timeout',
+    'provisioning-timeout',
+    'startup-interrupted',
     'cleanup-incomplete',
     'supervisor-unreachable',
     'stale-state',

package/src/local-dev/fleet-client.js

@@ -46,7 +46,7 @@ function validateOperation(value) {
             ? 'C:\\validation\\.git'
             : '/validation/.git',
         heartbeatAt: '1970-01-01T00:00:00.000Z',
-        identitySource: 'os-account',
+        identitySource: 'worktree-task',
         nxVersion: '23.1.0',
         operations: [value],
         origin: 'https://validation.ebk.localhost',
@@ -143,7 +143,7 @@ class FleetClient {
                 setTimeout(resolvePromise, pollMs);
             });
         }
-        throw new errors_js_1.LocalDevContractError('readiness-timeout', `Fleet operation ${operationId} did not finish within ${timeoutMs}ms.`);
+        throw new errors_js_1.LocalDevContractError('readiness-timeout', `Fleet operation ${operationId} did not finish within ${timeoutMs}ms. The supervised operation may still be running; check ebk dev status and ebk dev logs before retrying.`);
     }
     async shutdown(idempotencyKey = (0, node_crypto_1.randomUUID)()) {
         await this.#request({

package/src/local-dev/fleet-configuration.js

@@ -4,43 +4,75 @@ exports.fleetRouterSource = fleetRouterSource;
 exports.fleetConfigurationFingerprint = fleetConfigurationFingerprint;
 const contract_validation_js_1 = require("./contract-validation.js");
 const deterministic_order_js_1 = require("../deterministic-order.js");
+const create_task_graph_1 = require("nx/src/tasks-runner/create-task-graph");
+const errors_js_1 = require("./errors.js");
 function localTargetTopology(plan) {
+    if (plan.adapters.size === 0)
+        return [];
+    if (!plan.projectGraph) {
+        throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', 'Fleet topology requires the complete inferred Nx project graph. Reload the workspace graph before starting development.');
+    }
+    // Nx normalizes dependsOn objects in place. Never mutate the shared graph.
+    const graph = structuredClone(plan.projectGraph);
+    const topologyError = (message) => {
+        throw new errors_js_1.LocalDevContractError('invalid-adapter', `Fleet Nx target topology is invalid: ${message}`);
+    };
     return [...plan.adapters]
         .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
         .map(([name, adapter]) => {
-        const project = plan.projects[name];
-        const targets = project?.targets ?? {};
+        const project = graph.nodes[name];
+        if (!project)
+            return topologyError(`Project ${name} is missing.`);
         const selected = new Set([adapter.target]);
-        if (adapter.adapterVersion === 2 && adapter.lifecycle) {
+        if (adapter.adapterVersion !== 1 && adapter.lifecycle) {
             selected.add(adapter.lifecycle.cleanupTarget);
         }
-        const pending = [...selected];
-        while (pending.length > 0) {
-            const targetName = pending.pop();
-            const target = targets[targetName];
-            for (const dependency of target?.dependsOn ?? []) {
-                const dependencyName = typeof dependency === 'string'
-                    ? dependency
-                    : dependency &&
-                        typeof dependency === 'object' &&
-                        !Array.isArray(dependency) &&
-                        typeof dependency.target ===
-                            'string'
-                        ? (dependency.target ?? '')
-                        : '';
-                if (dependencyName && !selected.has(dependencyName)) {
-                    selected.add(dependencyName);
-                    pending.push(dependencyName);
-                }
+        for (const target of selected) {
+            if (!project.data.targets?.[target]) {
+                return topologyError(`Selected target ${name}:${target} is missing.`);
             }
         }
+        let tasks;
+        try {
+            tasks = (0, create_task_graph_1.createTaskGraph)(graph, {}, [name], [...selected].sort(deterministic_order_js_1.compareUtf16), undefined, {});
+        }
+        catch (error) {
+            return topologyError(error instanceof Error ? error.message : String(error));
+        }
         return {
             adapter,
             name,
-            projectRoot: project?.root,
-            targets: [...selected]
-                .sort()
-                .map((targetName) => [targetName, targets[targetName]]),
+            projectRoot: project.data.root,
+            targets: Object.keys(tasks.tasks)
+                .sort(deterministic_order_js_1.compareUtf16)
+                .map((id) => {
+                const task = tasks.tasks[id];
+                const owner = graph.nodes[task.target.project];
+                const definition = plan.projectGraph?.nodes[task.target.project]?.data.targets?.[task.target.target];
+                if (!definition)
+                    return topologyError(`Task ${id} is missing.`);
+                for (const edge of graph.dependencies[task.target.project] ?? []) {
+                    if (!graph.nodes[edge.target] &&
+                        !graph.externalNodes?.[edge.target]) {
+                        return topologyError(`Project dependency ${edge.target} of ${id} is missing.`);
+                    }
+                }
+                // Only stable task coordinates and declarations belong in identity;
+                // native task objects also contain execution-time data and undefined
+                // configuration values. Optional coordinates have an explicit null.
+                return {
+                    configuration: task.target.configuration ?? null,
+                    continuousDependencies: [
+                        ...(tasks.continuousDependencies?.[id] ?? []),
+                    ].sort(deterministic_order_js_1.compareUtf16),
+                    definition,
+                    dependencies: [...(tasks.dependencies[id] ?? [])].sort(deterministic_order_js_1.compareUtf16),
+                    id,
+                    project: task.target.project,
+                    projectRoot: owner.data.root,
+                    target: task.target.target,
+                };
+            }),
         };
     });
 }

package/src/local-dev/fleet-inventory.js

@@ -129,14 +129,14 @@ async function inspectFleet(fleetId, options, effects, recoverRunnerCleanup = fa
             state,
         };
     }
-    for (const slice of state.slices.filter(({ selected }) => selected)) {
+    for (const name of (0, fleet_state_js_1.fleetOwnedSliceNames)(state)) {
         let claim;
         try {
-            claim = (0, slice_claim_js_1.inspectSliceClaim)(paths.sliceClaimsDirectory, slice.name, security);
+            claim = (0, slice_claim_js_1.inspectSliceClaim)(paths.sliceClaimsDirectory, name, security);
         }
         catch {
             return {
-                inventory: record(fleetId, 'ambiguous', `Slice claim ${slice.name} is malformed; do not prune.`, state),
+                inventory: record(fleetId, 'ambiguous', `Slice claim ${name} is malformed; do not prune.`, state),
                 state,
             };
         }
@@ -145,9 +145,11 @@ async function inspectFleet(fleetId, options, effects, recoverRunnerCleanup = fa
             claim.sessionGeneration !== state.sessionGeneration ||
             claim.owner.pid !== state.supervisor.pid ||
             claim.owner.processIdentity !== state.supervisor.processIdentity ||
-            claim.owner.startedAt !== state.supervisor.startedAt) {
+            claim.owner.startedAt !== state.supervisor.startedAt ||
+            (!state.slices.some((slice) => slice.name === name && slice.selected) &&
+                !(0, fleet_state_js_1.fleetOwnsStartingSlice)(state, name, claim.acquiredAt))) {
             return {
-                inventory: record(fleetId, 'ambiguous', `Slice claim ${slice.name} does not prove exact generation ownership.`, state),
+                inventory: record(fleetId, 'ambiguous', `Slice claim ${name} does not prove exact generation ownership.`, state),
                 state,
             };
         }
@@ -217,9 +219,10 @@ function claimInventoryRecord(claim, classification, nextAction) {
         slice: claim.slice,
     };
 }
-function ambiguousClaimEntry(slice, message) {
+function ambiguousClaimEntry(slice, message, fleetId) {
     return {
         classification: 'ambiguous',
+        ...(fleetId ? { fleetId } : {}),
         nextAction: message,
         slice: slice.slice(0, 128),
     };
@@ -278,28 +281,54 @@ async function inventorySliceClaims(options, effects = {}) {
         return inspected;
     };
     const results = [];
-    for (const entry of entries) {
+    const claims = [];
+    for (const namespace of entries) {
+        if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(namespace.name) ||
+            !namespace.isDirectory() ||
+            namespace.isSymbolicLink()) {
+            results.push(ambiguousClaimEntry(namespace.name, 'Unsupported Slice-claim namespace; inspect manually and do not prune.', /^[a-z0-9][a-z0-9-]{0,62}$/.test(namespace.name)
+                ? namespace.name
+                : undefined));
+            continue;
+        }
+        const claimDirectory = (0, runtime_paths_js_1.fleetRuntimePaths)(namespace.name, options.appData).sliceClaimsDirectory;
+        try {
+            (0, private_state_js_1.assertPrivatePath)(claimDirectory, 'directory', security);
+            for (const entry of (0, node_fs_1.readdirSync)(claimDirectory, {
+                withFileTypes: true,
+            }).sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name)))
+                claims.push({
+                    entry,
+                    directory: claimDirectory,
+                    fleetId: namespace.name,
+                });
+        }
+        catch {
+            results.push(ambiguousClaimEntry(namespace.name, 'Slice-claim namespace cannot be read safely; inspect manually and do not prune.', namespace.name));
+        }
+    }
+    for (const { entry, directory: claimDirectory, fleetId } of claims) {
         const match = SLICE_CLAIM_FILE_PATTERN.exec(entry.name);
         if (!match || !entry.isFile() || entry.isSymbolicLink()) {
-            results.push(ambiguousClaimEntry(entry.name, 'Unsupported Slice-claim entry; inspect manually and do not prune.'));
+            results.push(ambiguousClaimEntry(entry.name, 'Unsupported Slice-claim entry; inspect manually and do not prune.', fleetId));
             continue;
         }
         const slice = match[1];
         let claim;
         try {
-            const inspected = (0, slice_claim_js_1.inspectSliceClaim)(directory, slice, security);
+            const inspected = (0, slice_claim_js_1.inspectSliceClaim)(claimDirectory, slice, security);
             if (!inspected) {
-                results.push(ambiguousClaimEntry(slice, 'Slice claim changed during inventory; inspect manually and do not prune.'));
+                results.push(ambiguousClaimEntry(slice, 'Slice claim changed during inventory; inspect manually and do not prune.', fleetId));
                 continue;
             }
-            if (inspected.slice !== slice) {
-                results.push(ambiguousClaimEntry(slice, 'Slice-claim filename and record identity disagree; inspect manually and do not prune.'));
+            if (inspected.slice !== slice || inspected.fleetId !== fleetId) {
+                results.push(ambiguousClaimEntry(slice, 'Slice-claim namespace, filename and record identity disagree; inspect manually and do not prune.', fleetId));
                 continue;
             }
             claim = inspected;
         }
         catch {
-            results.push(ambiguousClaimEntry(slice, 'Slice claim is malformed or not current-user private; inspect manually and do not prune.'));
+            results.push(ambiguousClaimEntry(slice, 'Slice claim is malformed or not current-user private; inspect manually and do not prune.', fleetId));
             continue;
         }
         const ownerPaths = (0, runtime_paths_js_1.fleetRuntimePaths)(claim.fleetId, options.appData);
@@ -326,8 +355,9 @@ async function inventorySliceClaims(options, effects = {}) {
             claim.owner.pid !== state.supervisor.pid ||
             claim.owner.processIdentity !== state.supervisor.processIdentity ||
             claim.owner.startedAt !== state.supervisor.startedAt ||
-            !state.slices.some((candidate) => candidate.name === claim.slice && candidate.selected)) {
-            results.push(claimInventoryRecord(claim, 'ambiguous', 'Slice claim does not match selected state owned by the exact Fleet generation; do not prune.'));
+            (!state.slices.some((candidate) => candidate.name === claim.slice && candidate.selected) &&
+                !(0, fleet_state_js_1.fleetOwnsStartingSlice)(state, claim.slice, claim.acquiredAt))) {
+            results.push(claimInventoryRecord(claim, 'ambiguous', 'Slice claim does not match selected or starting state owned by the exact Fleet generation; do not prune.'));
             continue;
         }
         const processProof = inspected.inventory.classification === 'stale'
@@ -424,9 +454,7 @@ async function pruneStaleFleets(options, effects = {}) {
         if (!lock || lock.sessionGeneration !== state.sessionGeneration) {
             return inventoryError(`Fleet ${fleetId} changed during prune revalidation.`);
         }
-        const selected = state.slices
-            .filter(({ selected }) => selected)
-            .map(({ name }) => name);
+        const selected = (0, fleet_state_js_1.fleetOwnedSliceNames)(state);
         const exactClaims = (await inventorySliceClaims(options, effects)).filter(({ fleetId: ownerFleetId }) => ownerFleetId === fleetId);
         if (exactClaims.some(({ classification }) => classification !== 'stale') ||
             selected.some((slice) => !exactClaims.some((claim) => claim.classification === 'stale' && claim.slice === slice))) {

package/src/local-dev/fleet-ipc.d.ts

@@ -25,4 +25,11 @@ export declare class FleetControlServer {
     listen(): Promise<void>;
     close(): Promise<void>;
 }
+/** Control request budget: the supervisor answers between synchronous
+ * identity captures, which are PowerShell queries on Windows (qualification
+ * run 34754338371 timed out at 5 s while the supervisor handled up). */
+export declare const FLEET_CONTROL_REQUEST_TIMEOUT_MS: Readonly<{
+    default: 5000;
+    win32: 30000;
+}>;
 export declare function sendFleetControlRequest(path: string, request: FleetControlRequest, timeoutMs?: number): Promise<FleetControlResponse>;

package/src/local-dev/fleet-ipc.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FleetControlServer = exports.FLEET_CONTROL_RESPONSE_MAX_BYTES = void 0;
+exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS = exports.FleetControlServer = exports.FLEET_CONTROL_RESPONSE_MAX_BYTES = void 0;
 exports.validateFleetControlResponse = validateFleetControlResponse;
 exports.sendFleetControlRequest = sendFleetControlRequest;
 const node_fs_1 = require("node:fs");
@@ -219,7 +219,19 @@ class FleetControlServer {
     }
 }
 exports.FleetControlServer = FleetControlServer;
-async function sendFleetControlRequest(path, request, timeoutMs = 5_000) {
+/** Control request budget: the supervisor answers between synchronous
+ * identity captures, which are PowerShell queries on Windows (qualification
+ * run 34754338371 timed out at 5 s while the supervisor handled up). */
+exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS = Object.freeze({
+    default: 5_000,
+    win32: 30_000,
+});
+function controlRequestTimeout() {
+    return process.platform === 'win32'
+        ? exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS.win32
+        : exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS.default;
+}
+async function sendFleetControlRequest(path, request, timeoutMs = controlRequestTimeout()) {
     const payload = `${(0, contract_validation_js_1.canonicalJson)(request)}\n`;
     if (Buffer.byteLength(payload) > control_contract_js_1.FLEET_CONTROL_REQUEST_MAX_BYTES) {
         throw new errors_js_1.LocalDevContractError('invalid-input', 'Fleet control request exceeds its bounded size.');

package/src/local-dev/fleet-launcher.d.ts

@@ -50,4 +50,10 @@ export interface FleetLauncherDependencies {
 export declare function resolveGitCommonDirectory(workspaceRoot: string): string;
 export declare function prepareFleetLaunch(input: FleetLaunchInput, dependencies?: FleetLauncherDependencies): Promise<PreparedFleetLaunch>;
 export declare function verifyAttachedState(prepared: PreparedFleetLaunch, client: Pick<FleetClient, 'status'>): Promise<void>;
+/** Supervisor readiness budget: startup captures identities through
+ * PowerShell on Windows, several seconds each. */
+export declare const SUPERVISOR_READINESS_TIMEOUT_MS: Readonly<{
+    default: 15000;
+    win32: 60000;
+}>;
 export declare function launchOrAttachFleet(input: FleetLaunchInput, dependencies?: FleetLauncherDependencies): Promise<FleetLaunchResult>;