@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/local-dev/environment-inspector.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnvironmentDeficientError = exports.ENVIRONMENT_INSPECTOR_CHECKS = exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = void 0;
 exports.evaluateEnvironmentExecutableVersion = evaluateEnvironmentExecutableVersion;
 exports.evaluateDevelopmentFoundationAccount = evaluateDevelopmentFoundationAccount;
+exports.evaluateDevelopmentFoundationReport = evaluateDevelopmentFoundationReport;
+exports.resolveCurrentAwsAccountId = resolveCurrentAwsAccountId;
 exports.inspectDevelopmentEnvironment = inspectDevelopmentEnvironment;
 exports.assertEnvironmentReady = assertEnvironmentReady;
 const node_child_process_1 = require("node:child_process");
@@ -22,6 +24,7 @@ const errors_js_1 = require("./errors.js");
 const nx_workspace_js_1 = require("./nx-workspace.js");
 const personal_stage_js_1 = require("./personal-stage.js");
 const tls_js_1 = require("./tls.js");
+const docker_credential_health_js_1 = require("./docker-credential-health.js");
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = 15_000;
 const MAX_AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = 60_000;
@@ -100,6 +103,11 @@ exports.ENVIRONMENT_INSPECTOR_CHECKS = [
         id: 'docker-compose-v2',
         volatile: true,
     },
+    {
+        capabilities: ['containers'],
+        id: 'docker-credential-helpers',
+        volatile: true,
+    },
     {
         capabilities: ['aws-foundation'],
         id: 'aws-sdk-credentials',
@@ -257,11 +265,15 @@ function commandRequirements(command, adapters, force = false) {
             checks['docker-cli'] = 'required';
             checks['docker-engine'] = 'required';
             checks['docker-compose-v2'] = 'required';
+            // Docker's required credential protocol is get/store/erase, not list.
+            // This secret-free liveness probe is diagnostic, never pull authority.
+            checks['docker-credential-helpers'] = 'advisory';
         }
         else {
             checks['docker-cli'] = 'not-required';
             checks['docker-engine'] = 'not-required';
             checks['docker-compose-v2'] = 'not-required';
+            checks['docker-credential-helpers'] = 'not-required';
         }
     }
     else if (command === 'doctor') {
@@ -288,12 +300,14 @@ async function commandVersion(executable, args, timeout = 5_000) {
     });
     return `${result.stdout}${result.stderr}`.trim().split(/\r?\n/, 1)[0] ?? '';
 }
-function commandProbe(executable, args, remediation, minimumVersion) {
+function commandProbe(executable, args, remediation, minimumVersion, versionPattern) {
     return async () => {
         try {
             const version = await commandVersion(executable, args);
             return minimumVersion
-                ? evaluateEnvironmentExecutableVersion(version, minimumVersion, remediation)
+                ? evaluateEnvironmentExecutableVersion(versionPattern
+                    ? (versionPattern.exec(version)?.[1] ?? version)
+                    : version, minimumVersion, remediation)
                 : {
                     detectedVersion: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(version).slice(0, 128),
                     status: 'ready',
@@ -335,6 +349,18 @@ function evaluateDevelopmentFoundationAccount(accountId, eventBusArn) {
         status: 'ready',
     };
 }
+function evaluateDevelopmentFoundationReport(report, accountId, context) {
+    if (!report.ok || !report.discovery) {
+        return {
+            evidence: report.issues.join('; '),
+            remediation: report.state === 'absent'
+                ? `Development Foundation is absent in ${context.region}. Verify workspace ownership and run ebk deploy development --profile=${context.profile} --expectedRoleArn=<approved-development-role>; the governed stage lifecycle deploys Foundation first, then eligible Slices. Retry ebk dev doctor afterward. This is not an IAM denial.`
+                : 'Development Foundation discovery is incomplete or incompatible. Inspect the reported contract issues and reconcile Foundation through its governed upgrade/deploy workflow; do not expand IAM permissions to repair discovery data.',
+            status: 'unavailable',
+        };
+    }
+    return evaluateDevelopmentFoundationAccount(accountId, report.discovery.eventBusArn);
+}
 function createAbortableCredentialRequestHandler(context, abortSignal) {
     const transportClient = new client_sts_1.STSClient({
         region: context.region,
@@ -356,7 +382,8 @@ async function resolveProfileCredentials(context, abortSignal) {
     try {
         return await (0, credential_providers_1.fromIni)({
             clientConfig: {
-                region: context.region,
+                // Credential sources own their Region (notably the SSO session).
+                // Application STS/SSM clients still use the selected deployment Region.
                 requestHandler: transport.requestHandler,
             },
             profile: context.profile,
@@ -418,7 +445,7 @@ const defaultProbes = {
     'personal-stage': async ({ identity }) => (0, personal_stage_js_1.isFrameworkPersonalStage)(identity.stage)
         ? { evidence: identity.stage, status: 'ready' }
         : {
-            remediation: 'Repair operating-system account identity resolution.',
+            remediation: 'Inspect the persisted worktree task identity with ebk dev status; use explicit ebk dev attach only after verifying ownership.',
             status: 'unavailable',
         },
     'private-state-location': async ({ appData }) => {
@@ -448,13 +475,14 @@ const defaultProbes = {
         return required.every(node_fs_1.existsSync)
             ? { status: 'ready' }
             : {
-                remediation: 'Run ebk dev setup, inspect the root, then explicitly run ebk dev setup --trust.',
+                remediation: 'Run ebk dev setup. The generated verify-local-browser target uses browser-scoped trust; system trust is optional and must be explicitly reviewed.',
                 status: 'missing',
             };
     },
     'docker-cli': commandProbe('docker', ['--version'], 'Install Docker with the Docker CLI.'),
     'docker-engine': commandProbe('docker', ['info', '--format', '{{.ServerVersion}}'], 'Start the Docker engine and confirm current-user access.'),
     'docker-compose-v2': commandProbe('docker', ['compose', 'version', '--short'], 'Install or enable Docker Compose v2.'),
+    'docker-credential-helpers': () => (0, docker_credential_health_js_1.inspectDockerCredentialHelpers)(),
     'aws-sdk-credentials': async ({ context }, abortSignal) => {
         try {
             const credentials = await resolveProfileCredentials(context, abortSignal);
@@ -497,14 +525,7 @@ const defaultProbes = {
                     region: context.region,
                     requirement: discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT,
                 });
-                if (!report.ok || !report.discovery) {
-                    return {
-                        evidence: report.issues.join('; '),
-                        remediation: `Grant profile ${context.profile} bounded ssm:GetParameters access to the development Foundation contract in ${context.region}.`,
-                        status: 'unavailable',
-                    };
-                }
-                return evaluateDevelopmentFoundationAccount(accountId, report.discovery.eventBusArn);
+                return evaluateDevelopmentFoundationReport(report, accountId, context);
             }
             finally {
                 reader.destroy();
@@ -513,12 +534,18 @@ const defaultProbes = {
         catch (error) {
             return {
                 evidence: error instanceof Error ? error.message : String(error),
-                remediation: `Grant profile ${context.profile} bounded ssm:GetParameters access to /ebk/development/foundation/* in ${context.region}.`,
+                remediation: [
+                    'AccessDenied',
+                    'AccessDeniedException',
+                    'UnauthorizedOperation',
+                ].includes(error instanceof Error ? error.name : '')
+                    ? `Reconcile profile ${context.profile}'s bounded ssm:GetParameters authority for /ebk/development/foundation/* in ${context.region}; confirm the exact account and role before changing policy.`
+                    : `Verify profile ${context.profile}'s temporary credentials and network access in ${context.region}, then retry ebk dev doctor. An unresolved read is not proof of missing IAM permissions.`,
                 status: 'unavailable',
             };
         }
     },
-    'aws-cli-remediation': commandProbe('aws', ['--version'], 'Install AWS CLI v2 only when the selected SSO profile requires aws sso login remediation.', '2'),
+    'aws-cli-remediation': commandProbe('aws', ['--version'], 'Install AWS CLI v2 only when the selected SSO profile requires aws sso login remediation.', '2', /^aws-cli\/(\d+\.\d+\.\d+)(?:\s|$)/),
 };
 async function resolveCurrentAwsAccountId(context, abortSignal) {
     const credentials = await resolveProfileCredentials(context, abortSignal);

package/src/local-dev/environment-state.js

@@ -392,7 +392,7 @@ function validateDevelopmentEnvironmentAssessment(value) {
         value.catalogVersion !== exports.ENVIRONMENT_REQUIREMENT_CATALOG_VERSION ||
         value.localContextSchemaVersion !== local_context_js_1.LOCAL_DEV_CONTEXT_SCHEMA_VERSION ||
         value.personalStageResolverVersion !== personal_stage_js_1.PERSONAL_STAGE_RESOLVER_VERSION ||
-        value.identitySource !== 'os-account') {
+        value.identitySource !== 'worktree-task') {
         return assessmentError('Development environment assessment has an unsupported schema, catalog, context, or identity version.');
     }
     if (!exports.ENVIRONMENT_ASSESSMENT_STATES.includes(value.state)) {
@@ -413,7 +413,7 @@ function validateDevelopmentEnvironmentAssessment(value) {
         evaluatedProfiles: validateStringArray(value.evaluatedProfiles, 'Environment evaluatedProfiles'),
         fingerprint: (0, contract_validation_js_1.requireBoundedString)(value.fingerprint, 'Environment fingerprint', { pattern: contract_validation_js_1.LOCAL_DEV_SHA256_PATTERN }),
         frameworkVersion: (0, contract_validation_js_1.requireBoundedString)(value.frameworkVersion, 'Environment frameworkVersion', { maximumLength: 128 }),
-        identitySource: 'os-account',
+        identitySource: 'worktree-task',
         localContextDigest: (0, contract_validation_js_1.requireBoundedString)(value.localContextDigest, 'Environment localContextDigest', { pattern: contract_validation_js_1.LOCAL_DEV_SHA256_PATTERN }),
         localContextSchemaVersion: local_context_js_1.LOCAL_DEV_CONTEXT_SCHEMA_VERSION,
         personalStageResolverVersion: personal_stage_js_1.PERSONAL_STAGE_RESOLVER_VERSION,

package/src/local-dev/errors.d.ts

@@ -1,4 +1,4 @@
-export declare const LOCAL_DEV_FAILURE_CLASSIFICATIONS: readonly ["invalid-input", "personal-identity-unavailable", "fleet-in-use", "fleet-ownership-ambiguous", "local-context-missing", "local-context-invalid", "local-context-conflict", "unknown-slice", "invalid-adapter", "slice-active-elsewhere", "slice-claim-ambiguous", "not-running", "invalid-state", "configuration-mismatch", "protocol-mismatch", "environment-deficient", "prerequisite-unavailable", "foundation-unavailable", "operation-conflict", "readiness-timeout", "cleanup-incomplete", "supervisor-unreachable", "stale-state", "stale-state-ambiguous", "log-query-invalid", "internal-error"];
+export declare const LOCAL_DEV_FAILURE_CLASSIFICATIONS: readonly ["invalid-input", "personal-identity-unavailable", "fleet-in-use", "fleet-ownership-ambiguous", "local-context-missing", "local-context-invalid", "local-context-conflict", "unknown-slice", "invalid-adapter", "slice-active-elsewhere", "slice-claim-ambiguous", "not-running", "invalid-state", "configuration-mismatch", "protocol-mismatch", "environment-deficient", "prerequisite-unavailable", "foundation-unavailable", "operation-conflict", "readiness-timeout", "provisioning-timeout", "startup-interrupted", "cleanup-incomplete", "supervisor-unreachable", "stale-state", "stale-state-ambiguous", "log-query-invalid", "internal-error"];
 export type LocalDevFailureClassification = (typeof LOCAL_DEV_FAILURE_CLASSIFICATIONS)[number];
 export declare class LocalDevContractError extends Error {
     readonly classification: LocalDevFailureClassification;

package/src/local-dev/errors.js

@@ -22,6 +22,8 @@ exports.LOCAL_DEV_FAILURE_CLASSIFICATIONS = [
     'foundation-unavailable',
     'operation-conflict',
     'readiness-timeout',
+    'provisioning-timeout',
+    'startup-interrupted',
     'cleanup-incomplete',
     'supervisor-unreachable',
     'stale-state',

package/src/local-dev/fleet-client.js

@@ -46,7 +46,7 @@ function validateOperation(value) {
             ? 'C:\\validation\\.git'
             : '/validation/.git',
         heartbeatAt: '1970-01-01T00:00:00.000Z',
-        identitySource: 'os-account',
+        identitySource: 'worktree-task',
         nxVersion: '23.1.0',
         operations: [value],
         origin: 'https://validation.ebk.localhost',
@@ -143,7 +143,7 @@ class FleetClient {
                 setTimeout(resolvePromise, pollMs);
             });
         }
-        throw new errors_js_1.LocalDevContractError('readiness-timeout', `Fleet operation ${operationId} did not finish within ${timeoutMs}ms.`);
+        throw new errors_js_1.LocalDevContractError('readiness-timeout', `Fleet operation ${operationId} did not finish within ${timeoutMs}ms. The supervised operation may still be running; check ebk dev status and ebk dev logs before retrying.`);
     }
     async shutdown(idempotencyKey = (0, node_crypto_1.randomUUID)()) {
         await this.#request({

package/src/local-dev/fleet-configuration.js

@@ -4,43 +4,75 @@ exports.fleetRouterSource = fleetRouterSource;
 exports.fleetConfigurationFingerprint = fleetConfigurationFingerprint;
 const contract_validation_js_1 = require("./contract-validation.js");
 const deterministic_order_js_1 = require("../deterministic-order.js");
+const create_task_graph_1 = require("nx/src/tasks-runner/create-task-graph");
+const errors_js_1 = require("./errors.js");
 function localTargetTopology(plan) {
+    if (plan.adapters.size === 0)
+        return [];
+    if (!plan.projectGraph) {
+        throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', 'Fleet topology requires the complete inferred Nx project graph. Reload the workspace graph before starting development.');
+    }
+    // Nx normalizes dependsOn objects in place. Never mutate the shared graph.
+    const graph = structuredClone(plan.projectGraph);
+    const topologyError = (message) => {
+        throw new errors_js_1.LocalDevContractError('invalid-adapter', `Fleet Nx target topology is invalid: ${message}`);
+    };
     return [...plan.adapters]
         .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
         .map(([name, adapter]) => {
-        const project = plan.projects[name];
-        const targets = project?.targets ?? {};
+        const project = graph.nodes[name];
+        if (!project)
+            return topologyError(`Project ${name} is missing.`);
         const selected = new Set([adapter.target]);
-        if (adapter.adapterVersion === 2 && adapter.lifecycle) {
+        if (adapter.adapterVersion !== 1 && adapter.lifecycle) {
             selected.add(adapter.lifecycle.cleanupTarget);
         }
-        const pending = [...selected];
-        while (pending.length > 0) {
-            const targetName = pending.pop();
-            const target = targets[targetName];
-            for (const dependency of target?.dependsOn ?? []) {
-                const dependencyName = typeof dependency === 'string'
-                    ? dependency
-                    : dependency &&
-                        typeof dependency === 'object' &&
-                        !Array.isArray(dependency) &&
-                        typeof dependency.target ===
-                            'string'
-                        ? (dependency.target ?? '')
-                        : '';
-                if (dependencyName && !selected.has(dependencyName)) {
-                    selected.add(dependencyName);
-                    pending.push(dependencyName);
-                }
+        for (const target of selected) {
+            if (!project.data.targets?.[target]) {
+                return topologyError(`Selected target ${name}:${target} is missing.`);
             }
         }
+        let tasks;
+        try {
+            tasks = (0, create_task_graph_1.createTaskGraph)(graph, {}, [name], [...selected].sort(deterministic_order_js_1.compareUtf16), undefined, {});
+        }
+        catch (error) {
+            return topologyError(error instanceof Error ? error.message : String(error));
+        }
         return {
             adapter,
             name,
-            projectRoot: project?.root,
-            targets: [...selected]
-                .sort()
-                .map((targetName) => [targetName, targets[targetName]]),
+            projectRoot: project.data.root,
+            targets: Object.keys(tasks.tasks)
+                .sort(deterministic_order_js_1.compareUtf16)
+                .map((id) => {
+                const task = tasks.tasks[id];
+                const owner = graph.nodes[task.target.project];
+                const definition = plan.projectGraph?.nodes[task.target.project]?.data.targets?.[task.target.target];
+                if (!definition)
+                    return topologyError(`Task ${id} is missing.`);
+                for (const edge of graph.dependencies[task.target.project] ?? []) {
+                    if (!graph.nodes[edge.target] &&
+                        !graph.externalNodes?.[edge.target]) {
+                        return topologyError(`Project dependency ${edge.target} of ${id} is missing.`);
+                    }
+                }
+                // Only stable task coordinates and declarations belong in identity;
+                // native task objects also contain execution-time data and undefined
+                // configuration values. Optional coordinates have an explicit null.
+                return {
+                    configuration: task.target.configuration ?? null,
+                    continuousDependencies: [
+                        ...(tasks.continuousDependencies?.[id] ?? []),
+                    ].sort(deterministic_order_js_1.compareUtf16),
+                    definition,
+                    dependencies: [...(tasks.dependencies[id] ?? [])].sort(deterministic_order_js_1.compareUtf16),
+                    id,
+                    project: task.target.project,
+                    projectRoot: owner.data.root,
+                    target: task.target.target,
+                };
+            }),
         };
     });
 }

package/src/local-dev/fleet-inventory.js

@@ -22,6 +22,14 @@ function inventoryError(message) {
 function defaultPing(appData, security, fleetId) {
     return new fleet_client_js_1.FleetClient((0, runtime_paths_js_1.fleetRuntimePaths)(fleetId, appData), security).ping();
 }
+/**
+ * An ambiguous entry is never pruned, but any actor may inspect it read-only.
+ * The message names where it lives and the owner's recovery; it never prints
+ * an absolute path, which would carry the local account name.
+ */
+function inspectReadOnly(subject, location) {
+    return `${subject}; ebk will not prune it. Inspect ${location} in the per-user EBK application-data directory read-only (any actor may). If it is yours and no ebk dev process for it is running, remove that one entry or restore current-user-only ownership, then rerun ebk dev ps; if another user owns it, leave it for them.`;
+}
 function record(fleetId, classification, nextAction, state) {
     return {
         ...(state
@@ -51,7 +59,7 @@ async function inspectFleet(fleetId, options, effects, recoverRunnerCleanup = fa
     }
     catch {
         return {
-            inventory: record(fleetId, 'ambiguous', 'Inspect the malformed private state manually; do not prune.'),
+            inventory: record(fleetId, 'ambiguous', inspectReadOnly('Private Fleet state is malformed', `sessions/${fleetId}`)),
         };
     }
     if (!state || state.fleetId !== fleetId) {
@@ -129,14 +137,14 @@ async function inspectFleet(fleetId, options, effects, recoverRunnerCleanup = fa
             state,
         };
     }
-    for (const slice of state.slices.filter(({ selected }) => selected)) {
+    for (const name of (0, fleet_state_js_1.fleetOwnedSliceNames)(state)) {
         let claim;
         try {
-            claim = (0, slice_claim_js_1.inspectSliceClaim)(paths.sliceClaimsDirectory, slice.name, security);
+            claim = (0, slice_claim_js_1.inspectSliceClaim)(paths.sliceClaimsDirectory, name, security);
         }
         catch {
             return {
-                inventory: record(fleetId, 'ambiguous', `Slice claim ${slice.name} is malformed; do not prune.`, state),
+                inventory: record(fleetId, 'ambiguous', `Slice claim ${name} is malformed; do not prune.`, state),
                 state,
             };
         }
@@ -145,9 +153,11 @@ async function inspectFleet(fleetId, options, effects, recoverRunnerCleanup = fa
             claim.sessionGeneration !== state.sessionGeneration ||
             claim.owner.pid !== state.supervisor.pid ||
             claim.owner.processIdentity !== state.supervisor.processIdentity ||
-            claim.owner.startedAt !== state.supervisor.startedAt) {
+            claim.owner.startedAt !== state.supervisor.startedAt ||
+            (!state.slices.some((slice) => slice.name === name && slice.selected) &&
+                !(0, fleet_state_js_1.fleetOwnsStartingSlice)(state, name, claim.acquiredAt))) {
             return {
-                inventory: record(fleetId, 'ambiguous', `Slice claim ${slice.name} does not prove exact generation ownership.`, state),
+                inventory: record(fleetId, 'ambiguous', `Slice claim ${name} does not prove exact generation ownership.`, state),
                 state,
             };
         }
@@ -195,7 +205,7 @@ async function inventoryFleets(options, effects = {}) {
             results.push({
                 classification: 'ambiguous',
                 fleetId: entry.name.slice(0, 128),
-                nextAction: 'Unsupported session entry; inspect manually and do not prune.',
+                nextAction: inspectReadOnly('Unsupported session entry', 'sessions/'),
                 selectedSlices: [],
             });
             continue;
@@ -217,9 +227,10 @@ function claimInventoryRecord(claim, classification, nextAction) {
         slice: claim.slice,
     };
 }
-function ambiguousClaimEntry(slice, message) {
+function ambiguousClaimEntry(slice, message, fleetId) {
     return {
         classification: 'ambiguous',
+        ...(fleetId ? { fleetId } : {}),
         nextAction: message,
         slice: slice.slice(0, 128),
     };
@@ -256,7 +267,7 @@ async function inventorySliceClaims(options, effects = {}) {
     }
     catch {
         return [
-            ambiguousClaimEntry('slice-claims', 'Slice-claim directory is not current-user private; inspect manually and do not prune.'),
+            ambiguousClaimEntry('slice-claims', inspectReadOnly('Slice-claim directory is not current-user private', 'slice-claims/')),
         ];
     }
     let entries;
@@ -265,7 +276,7 @@ async function inventorySliceClaims(options, effects = {}) {
     }
     catch {
         return [
-            ambiguousClaimEntry('slice-claims', 'Slice-claim directory cannot be read safely; inspect manually and do not prune.'),
+            ambiguousClaimEntry('slice-claims', inspectReadOnly('Slice-claim directory cannot be read safely', 'slice-claims/')),
         ];
     }
     const inspectedFleets = new Map();
@@ -278,28 +289,54 @@ async function inventorySliceClaims(options, effects = {}) {
         return inspected;
     };
     const results = [];
-    for (const entry of entries) {
+    const claims = [];
+    for (const namespace of entries) {
+        if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(namespace.name) ||
+            !namespace.isDirectory() ||
+            namespace.isSymbolicLink()) {
+            results.push(ambiguousClaimEntry(namespace.name, inspectReadOnly('Unsupported Slice-claim namespace', 'slice-claims/'), /^[a-z0-9][a-z0-9-]{0,62}$/.test(namespace.name)
+                ? namespace.name
+                : undefined));
+            continue;
+        }
+        const claimDirectory = (0, runtime_paths_js_1.fleetRuntimePaths)(namespace.name, options.appData).sliceClaimsDirectory;
+        try {
+            (0, private_state_js_1.assertPrivatePath)(claimDirectory, 'directory', security);
+            for (const entry of (0, node_fs_1.readdirSync)(claimDirectory, {
+                withFileTypes: true,
+            }).sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name)))
+                claims.push({
+                    entry,
+                    directory: claimDirectory,
+                    fleetId: namespace.name,
+                });
+        }
+        catch {
+            results.push(ambiguousClaimEntry(namespace.name, inspectReadOnly('Slice-claim namespace cannot be read safely', 'slice-claims/'), namespace.name));
+        }
+    }
+    for (const { entry, directory: claimDirectory, fleetId } of claims) {
         const match = SLICE_CLAIM_FILE_PATTERN.exec(entry.name);
         if (!match || !entry.isFile() || entry.isSymbolicLink()) {
-            results.push(ambiguousClaimEntry(entry.name, 'Unsupported Slice-claim entry; inspect manually and do not prune.'));
+            results.push(ambiguousClaimEntry(entry.name, inspectReadOnly('Unsupported Slice-claim entry', 'slice-claims/'), fleetId));
             continue;
         }
         const slice = match[1];
         let claim;
         try {
-            const inspected = (0, slice_claim_js_1.inspectSliceClaim)(directory, slice, security);
+            const inspected = (0, slice_claim_js_1.inspectSliceClaim)(claimDirectory, slice, security);
             if (!inspected) {
-                results.push(ambiguousClaimEntry(slice, 'Slice claim changed during inventory; inspect manually and do not prune.'));
+                results.push(ambiguousClaimEntry(slice, 'Slice claim changed during inventory; ebk will not prune it. Rerun ebk dev ps; if the change persists, inspect slice-claims/ in the per-user EBK application-data directory read-only.', fleetId));
                 continue;
             }
-            if (inspected.slice !== slice) {
-                results.push(ambiguousClaimEntry(slice, 'Slice-claim filename and record identity disagree; inspect manually and do not prune.'));
+            if (inspected.slice !== slice || inspected.fleetId !== fleetId) {
+                results.push(ambiguousClaimEntry(slice, inspectReadOnly('Slice-claim namespace, filename and record identity disagree', 'slice-claims/'), fleetId));
                 continue;
             }
             claim = inspected;
         }
         catch {
-            results.push(ambiguousClaimEntry(slice, 'Slice claim is malformed or not current-user private; inspect manually and do not prune.'));
+            results.push(ambiguousClaimEntry(slice, inspectReadOnly('Slice claim is malformed or not current-user private', 'slice-claims/'), fleetId));
             continue;
         }
         const ownerPaths = (0, runtime_paths_js_1.fleetRuntimePaths)(claim.fleetId, options.appData);
@@ -326,8 +363,9 @@ async function inventorySliceClaims(options, effects = {}) {
             claim.owner.pid !== state.supervisor.pid ||
             claim.owner.processIdentity !== state.supervisor.processIdentity ||
             claim.owner.startedAt !== state.supervisor.startedAt ||
-            !state.slices.some((candidate) => candidate.name === claim.slice && candidate.selected)) {
-            results.push(claimInventoryRecord(claim, 'ambiguous', 'Slice claim does not match selected state owned by the exact Fleet generation; do not prune.'));
+            (!state.slices.some((candidate) => candidate.name === claim.slice && candidate.selected) &&
+                !(0, fleet_state_js_1.fleetOwnsStartingSlice)(state, claim.slice, claim.acquiredAt))) {
+            results.push(claimInventoryRecord(claim, 'ambiguous', 'Slice claim does not match selected or starting state owned by the exact Fleet generation; do not prune.'));
             continue;
         }
         const processProof = inspected.inventory.classification === 'stale'
@@ -424,9 +462,7 @@ async function pruneStaleFleets(options, effects = {}) {
         if (!lock || lock.sessionGeneration !== state.sessionGeneration) {
             return inventoryError(`Fleet ${fleetId} changed during prune revalidation.`);
         }
-        const selected = state.slices
-            .filter(({ selected }) => selected)
-            .map(({ name }) => name);
+        const selected = (0, fleet_state_js_1.fleetOwnedSliceNames)(state);
         const exactClaims = (await inventorySliceClaims(options, effects)).filter(({ fleetId: ownerFleetId }) => ownerFleetId === fleetId);
         if (exactClaims.some(({ classification }) => classification !== 'stale') ||
             selected.some((slice) => !exactClaims.some((claim) => claim.classification === 'stale' && claim.slice === slice))) {

package/src/local-dev/fleet-ipc.d.ts

@@ -25,4 +25,11 @@ export declare class FleetControlServer {
     listen(): Promise<void>;
     close(): Promise<void>;
 }
+/** Control request budget: the supervisor answers between synchronous
+ * identity captures, which are PowerShell queries on Windows (qualification
+ * run 34754338371 timed out at 5 s while the supervisor handled up). */
+export declare const FLEET_CONTROL_REQUEST_TIMEOUT_MS: Readonly<{
+    default: 5000;
+    win32: 30000;
+}>;
 export declare function sendFleetControlRequest(path: string, request: FleetControlRequest, timeoutMs?: number): Promise<FleetControlResponse>;

package/src/local-dev/fleet-ipc.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FleetControlServer = exports.FLEET_CONTROL_RESPONSE_MAX_BYTES = void 0;
+exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS = exports.FleetControlServer = exports.FLEET_CONTROL_RESPONSE_MAX_BYTES = void 0;
 exports.validateFleetControlResponse = validateFleetControlResponse;
 exports.sendFleetControlRequest = sendFleetControlRequest;
 const node_fs_1 = require("node:fs");
@@ -219,7 +219,19 @@ class FleetControlServer {
     }
 }
 exports.FleetControlServer = FleetControlServer;
-async function sendFleetControlRequest(path, request, timeoutMs = 5_000) {
+/** Control request budget: the supervisor answers between synchronous
+ * identity captures, which are PowerShell queries on Windows (qualification
+ * run 34754338371 timed out at 5 s while the supervisor handled up). */
+exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS = Object.freeze({
+    default: 5_000,
+    win32: 30_000,
+});
+function controlRequestTimeout() {
+    return process.platform === 'win32'
+        ? exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS.win32
+        : exports.FLEET_CONTROL_REQUEST_TIMEOUT_MS.default;
+}
+async function sendFleetControlRequest(path, request, timeoutMs = controlRequestTimeout()) {
     const payload = `${(0, contract_validation_js_1.canonicalJson)(request)}\n`;
     if (Buffer.byteLength(payload) > control_contract_js_1.FLEET_CONTROL_REQUEST_MAX_BYTES) {
         throw new errors_js_1.LocalDevContractError('invalid-input', 'Fleet control request exceeds its bounded size.');

package/src/local-dev/fleet-launcher.d.ts

@@ -50,4 +50,10 @@ export interface FleetLauncherDependencies {
 export declare function resolveGitCommonDirectory(workspaceRoot: string): string;
 export declare function prepareFleetLaunch(input: FleetLaunchInput, dependencies?: FleetLauncherDependencies): Promise<PreparedFleetLaunch>;
 export declare function verifyAttachedState(prepared: PreparedFleetLaunch, client: Pick<FleetClient, 'status'>): Promise<void>;
+/** Supervisor readiness budget: startup captures identities through
+ * PowerShell on Windows, several seconds each. */
+export declare const SUPERVISOR_READINESS_TIMEOUT_MS: Readonly<{
+    default: 15000;
+    win32: 60000;
+}>;
 export declare function launchOrAttachFleet(input: FleetLaunchInput, dependencies?: FleetLauncherDependencies): Promise<FleetLaunchResult>;

package/src/local-dev/fleet-launcher.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPERVISOR_READINESS_TIMEOUT_MS = void 0;
 exports.resolveGitCommonDirectory = resolveGitCommonDirectory;
 exports.prepareFleetLaunch = prepareFleetLaunch;
 exports.verifyAttachedState = verifyAttachedState;
@@ -57,7 +58,7 @@ function workspaceName(plan) {
 }
 async function prepareFleetLaunch(input, dependencies = {}) {
     const workspaceRealpath = (0, node_fs_1.realpathSync)(input.workspaceRoot);
-    const identity = (dependencies.personalStageResolver ?? (0, personal_stage_js_1.createPersonalStageResolver)()).resolve();
+    const identity = (dependencies.personalStageResolver ?? (0, personal_stage_js_1.createPersonalStageResolver)()).resolve(workspaceRealpath);
     const plan = await (dependencies.loadPlan ?? nx_workspace_js_1.loadWorkspaceFleetPlan)();
     const name = workspaceName(plan);
     const fleetId = (0, identity_js_1.createFleetId)({
@@ -126,7 +127,18 @@ function verifyAttachedState(prepared, client) {
         }
     });
 }
-async function waitForSupervisor(prepared, child, security, timeoutMs = 15_000) {
+/** Supervisor readiness budget: startup captures identities through
+ * PowerShell on Windows, several seconds each. */
+exports.SUPERVISOR_READINESS_TIMEOUT_MS = Object.freeze({
+    default: 15_000,
+    win32: 60_000,
+});
+function supervisorReadinessTimeout() {
+    return process.platform === 'win32'
+        ? exports.SUPERVISOR_READINESS_TIMEOUT_MS.win32
+        : exports.SUPERVISOR_READINESS_TIMEOUT_MS.default;
+}
+async function waitForSupervisor(prepared, child, security, timeoutMs = supervisorReadinessTimeout()) {
     const deadline = Date.now() + timeoutMs;
     let lastError;
     let exited;
@@ -218,7 +230,7 @@ function recoverStartupOnlyRequest(prepared, processProbe, security) {
         startup = (0, fleet_startup_js_1.readFleetStartupRequest)(prepared.paths.startup, security);
     }
     catch {
-        return launchError('stale-state-ambiguous', 'Residual Fleet startup authority is malformed; inspect it manually and do not replace it.');
+        return launchError('stale-state-ambiguous', `Residual Fleet startup authority is malformed; ebk will not replace it. Inspect sessions/${prepared.request.fleetId} in the per-user EBK application-data directory read-only (any actor may). If it is yours and no ebk dev process for it is running, remove that startup file, then rerun the command.`);
     }
     if (startup.fleetId !== prepared.request.fleetId ||
         startup.appData !== prepared.request.appData ||
@@ -258,7 +270,7 @@ function recoverStartupOnlyRequest(prepared, processProbe, security) {
         sessionGeneration: startup.sessionGeneration,
     }).slice(0, 16)}.recover`;
     if ((0, node_fs_1.existsSync)(recoveryPath)) {
-        return launchError('stale-state-ambiguous', 'Residual Fleet startup has a prior recovery artifact; inspect it manually.');
+        return launchError('stale-state-ambiguous', `Residual Fleet startup has a prior recovery artifact; ebk will not replace it. Inspect the .recover file in sessions/${prepared.request.fleetId} of the per-user EBK application-data directory read-only (any actor may). If it is yours and no ebk dev process for it is running, remove that artifact, then rerun the command.`);
     }
     try {
         (0, node_fs_1.renameSync)(prepared.paths.startup, recoveryPath);