@farmslot/agent-runtime 0.9.0 → 0.11.0

package/dist/native/manager.js

@@ -1,22 +1,30 @@
 import { execFile } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { closeSync, constants, fsyncSync, openSync, readdirSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, constants, existsSync, fsyncSync, openSync, readdirSync, writeFileSync, } from 'node:fs';
 import { access, realpath, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { delimiter, dirname, isAbsolute, join } from 'node:path';
+import { basename, delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { promisify } from 'node:util';
-import { claudeNativeAdapter } from './claude.js';
-import { codexNativeAdapter } from './codex.js';
-import { privateDirectory, readJournal } from './storage.js';
+import { assertNativeProfileCurrent, nativeProfileEnvironment, requireNativeProfile, } from './account-profiles.js';
+import { nativeRunnerDefinitions as adapters } from './registry.js';
+import { hostReviewSandboxAvailable, reviewProcessSandbox } from './review-sandbox.js';
+import { durableWrite, privateDirectory, readJournal, readJson } from './storage.js';
+import { NativeWorkerHistory } from './worker-history.js';
+import { nativeWorkerEnvironment, nativeWorkerLaunchDigest, validateNativeWorkerFilesystemPolicy, } from './worker-launch.js';
 const exec = promisify(execFile);
-const adapters = {
-    codex: { adapter: codexNativeAdapter, binary: 'codex' },
-    claude: { adapter: claudeNativeAdapter, binary: 'claude' },
-};
-export async function resolveNativeExecutable(binary, cwd) {
+export async function resolveNativeExecutable(binary, cwd, environment = process.env) {
     let executable;
-    for (const directory of (process.env.PATH ?? '').split(delimiter)) {
-        const candidate = join(directory, binary);
+    const requested = binary.startsWith('~/')
+        ? join(environment.HOME ?? homedir(), binary.slice(2))
+        : binary;
+    const candidates = isAbsolute(requested)
+        ? [requested]
+        : requested.includes('/')
+            ? [resolve(cwd, requested)]
+            : (environment.PATH ?? '')
+                .split(delimiter)
+                .map((directory) => resolve(cwd, directory, requested));
+    for (const candidate of candidates) {
         try {
             await access(candidate, constants.X_OK);
         }
@@ -25,39 +33,74 @@ export async function resolveNativeExecutable(binary, cwd) {
                 continue;
             throw error;
         }
-        executable = candidate;
+        if (candidate.includes('/.asdf/shims/')) {
+            try {
+                const resolved = await exec('asdf', ['which', basename(binary)], {
+                    cwd,
+                    timeout: 10_000,
+                    env: environment,
+                });
+                executable = resolved.stdout.trim();
+            }
+            catch (error) {
+                // Fresh worktrees may not select the shim's runtime. For a PATH lookup,
+                // continue to another installed executable; explicit paths remain exact.
+                if (error.code === 1 &&
+                    !isAbsolute(requested) &&
+                    !requested.includes('/'))
+                    continue;
+                throw error;
+            }
+        }
+        else
+            executable = candidate;
         break;
     }
     if (!executable)
         throw new Error(`Install and log into the native ${binary} runner first`);
-    if (executable.includes('/.asdf/shims/')) {
-        const resolved = await exec('asdf', ['which', binary], { cwd, timeout: 10_000 });
-        executable = resolved.stdout.trim();
-    }
     executable = await realpath(executable);
     const result = await exec(executable, ['--version'], {
         cwd,
         timeout: 10_000,
-        env: nativeEnvironment(executable),
+        env: nativeEnvironment(executable, environment),
     });
     const version = result.stdout.trim();
     if (!version)
         throw new Error('Native executable did not provide version metadata');
     return { executable, version };
 }
-function executionContext() {
+function executionContext(workerLaunch, runner, profile) {
+    const environment = profile
+        ? nativeProfileEnvironment(profile, workerLaunch ? nativeWorkerEnvironment(workerLaunch) : process.env)
+        : process.env;
     return {
-        home: homedir(),
-        codexHome: process.env.CODEX_HOME ?? '',
-        claudeConfigDir: process.env.CLAUDE_CONFIG_DIR ?? '',
+        home: profile ? (environment.HOME ?? homedir()) : homedir(),
+        codexHome: environment.CODEX_HOME ?? '',
+        claudeConfigDir: environment.CLAUDE_CONFIG_DIR ?? '',
+        ...(runner === 'cursor'
+            ? {
+                cursorConfigDir: environment.CURSOR_CONFIG_DIR ?? '',
+                cursorDataDir: environment.CURSOR_DATA_DIR ?? '',
+                xdgConfigHome: environment.XDG_CONFIG_HOME ?? '',
+            }
+            : {}),
+        ...(runner === 'grok' ? { grokHome: environment.GROK_HOME ?? '' } : {}),
+        ...(workerLaunch ? { workerLaunchDigest: nativeWorkerLaunchDigest(workerLaunch) } : {}),
+        ...(profile
+            ? {
+                profileId: profile.id,
+                profileDirectory: profile.directory,
+                profileAccountContextId: profile.accountContextId,
+            }
+            : {}),
     };
 }
-function nativeEnvironment(executable) {
+function nativeEnvironment(executable, base = process.env) {
     // Native configuration may reference environment credentials. Inherit it in-process only;
     // never persist or send it over IPC. Remove parent Claude invocation context.
     const env = {
-        ...process.env,
-        PATH: `${dirname(executable)}${delimiter}${process.env.PATH ?? ''}`,
+        ...base,
+        PATH: `${dirname(executable)}${delimiter}${base.PATH ?? ''}`,
     };
     delete env.CLAUDECODE;
     return env;
@@ -81,7 +124,9 @@ export class NativeSessionManager {
             let pending = [];
             const commands = new Map();
             const events = [];
+            const workerHistory = new NativeWorkerHistory();
             for (const entry of entries) {
+                workerHistory.observe(entry);
                 info = entry.info ?? info;
                 context = entry.context ?? context;
                 pending = entry.pending ?? pending;
@@ -95,6 +140,7 @@ export class NativeSessionManager {
             if (info.executionNodeId !== executionNodeId)
                 throw new Error('Native journal belongs to another execution node');
             const record = {
+                workerHistory,
                 info,
                 context,
                 commands,
@@ -157,29 +203,53 @@ export class NativeSessionManager {
         for (const command of commands)
             previous.commands.set(command.commandId, JSON.stringify(command));
         this.persisted.set(record, { info, context, pending, commands: previous.commands });
+        record.workerHistory.observe(entry);
     }
-    create(owner, params) {
-        return this.start(owner, params);
+    create(owner, params, workerLaunch) {
+        return this.start(owner, params, undefined, workerLaunch);
     }
-    async ensure(owner, params) {
+    async ensure(owner, params, workerLaunch) {
         if (typeof params.sessionId !== 'string' ||
             !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(params.sessionId))
             throw new Error('Reserved sessionId must be a lowercase UUID');
         if ('resumeSessionId' in params && params.resumeSessionId !== undefined)
             throw new Error('Reserved sessionId is for initial creation, not resume');
-        return this.start(owner, params, params.sessionId);
+        return this.start(owner, params, params.sessionId, workerLaunch);
     }
-    async start(ownerPrincipalId, params, reservedId) {
+    resumeWorker(owner, params, launch) {
+        const assertCurrent = () => {
+            this.assertWorkerLease(owner, params.sessionId, params.generation, launch.leaseId, true);
+            const record = this.owned(owner, params.sessionId);
+            if (record.info.nativeSessionId !== params.resumeSessionId)
+                throw new Error('Worker recovery must preserve its recorded session identity');
+            if (existsSync(this.resumeCancellationPath(params.sessionId, launch.leaseId, params.commandId)))
+                throw new Error('Native worker recovery operation was cancelled before launch');
+        };
+        return this.start(owner, params, undefined, launch, assertCurrent, params.relocation);
+    }
+    async start(ownerPrincipalId, params, reservedId, workerLaunch, assertResumeCurrent, relocation) {
+        assertResumeCurrent?.();
+        const profile = params.profileId
+            ? requireNativeProfile(params.profileId, params.runner)
+            : undefined;
+        if (profile && params.accountContextId !== profile.accountContextId)
+            throw new Error('Native account profile changed; select its current account binding');
         if (params.executionNodeId !== undefined && params.executionNodeId !== this.executionNodeId)
             throw new Error('Native session targets another execution node');
         if (reservedId !== undefined) {
-            const existing = this.existingCreation(ownerPrincipalId, params, reservedId);
+            const existing = this.existingCreation(ownerPrincipalId, params, reservedId, workerLaunch);
             if (existing)
                 return this.createdSession(existing);
+            if (workerLaunch)
+                this.assertWorkerNotCancelled(reservedId);
         }
         const transport = adapters[params.runner];
         if (!transport)
             throw new Error(`Runner has no native transport: ${params.runner}`);
+        if (workerLaunch && !transport.supportsWorkers)
+            throw new Error('Native worker execution is not supported for this runner');
+        if (workerLaunch?.filesystemPolicy && !transport.supportsReadOnlyWorkspace)
+            throw new Error('Native runner cannot enforce a read-only source workspace');
         if (!isAbsolute(params.cwd) || !(await stat(params.cwd)).isDirectory())
             throw new Error('Native cwd must be an existing absolute directory');
         let previous;
@@ -198,27 +268,89 @@ export class NativeSessionManager {
                 throw new Error('Close the current native input owner before resuming');
             if (previous.info.processPid && !previous.info.processStopped)
                 throw new Error('Native process cleanup is unconfirmed; recovery is blocked');
-            if (JSON.stringify(previous.context) !== JSON.stringify(executionContext()))
+            if (previous.context.workerLaunchDigest && !workerLaunch)
+                throw new Error('Worker recovery requires its recorded launch configuration');
+            if (previous.info.workerLeaseId !== workerLaunch?.leaseId)
+                throw new Error('Worker recovery must preserve its task lease');
+            if (JSON.stringify(previous.context) !==
+                JSON.stringify(executionContext(workerLaunch, params.runner, profile)))
                 throw new Error('Resume must preserve the native account execution context');
-            if (previous.info.cwd !== params.cwd)
+            if (relocation) {
+                if (!assertResumeCurrent ||
+                    relocation.fromCwd !== previous.info.cwd ||
+                    !previous.info.capabilities.resumeAcrossWorkspaces)
+                    throw new Error('Native relocation requires the exact previous workspace and a portable saved session');
+                const roots = await Promise.all([previous.info.cwd, params.cwd].map(async (cwd) => {
+                    const result = await exec('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd, timeout: 10_000 });
+                    return realpath(result.stdout.trim());
+                }));
+                if (roots[0] !== roots[1])
+                    throw new Error('Native relocation requires sibling worktrees of the same repository');
+                const unavailable = transport.adapter.workspaceResumeUnavailableReason?.(previous.info.version);
+                if (unavailable)
+                    throw new Error(unavailable);
+            }
+            else if (previous.info.cwd !== params.cwd)
                 throw new Error('Resume must preserve the recorded working directory');
             mode = params.mode ?? previous.info.mode;
         }
         if (!transport.adapter.capabilities.modes.includes(mode))
             throw new Error('Native runner does not support this interaction mode');
-        const resolved = await resolveNativeExecutable(transport.binary, params.cwd);
+        const baseEnvironment = workerLaunch ? nativeWorkerEnvironment(workerLaunch) : process.env;
+        const environment = profile
+            ? nativeProfileEnvironment(profile, baseEnvironment)
+            : baseEnvironment;
+        const resolved = await resolveNativeExecutable(workerLaunch?.executable ?? transport.binary, params.cwd, environment);
         const unavailable = transport.adapter.resumeUnavailableReason?.(resolved.version);
         if (params.resumeSessionId && unavailable)
             throw new Error(unavailable);
+        let filesystemPolicy = workerLaunch?.filesystemPolicy;
+        if (filesystemPolicy) {
+            const unsupported = transport.adapter.filesystemPolicyUnavailableReason?.(resolved.version);
+            if (unsupported ||
+                (!transport.adapter.filesystemPolicyUnavailableReason && !hostReviewSandboxAvailable()))
+                throw new Error(unsupported ?? 'Native runner cannot enforce filesystem policy');
+            filesystemPolicy = validateNativeWorkerFilesystemPolicy({
+                readOnlyRoots: await Promise.all([...filesystemPolicy.readOnlyRoots, this.root].map((root) => realpath(root))),
+                writableRoots: await Promise.all(filesystemPolicy.writableRoots.map((root) => realpath(root))),
+            });
+            if (!filesystemPolicy.readOnlyRoots.includes(await realpath(params.cwd)))
+                throw new Error('Native worker cwd must be an explicit read-only source root');
+            if (!transport.adapter.filesystemPolicyUnavailableReason &&
+                existsSync(join(params.cwd, '.git'))) {
+                const gitDirectory = await exec('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd: params.cwd, timeout: 10000 });
+                filesystemPolicy.readOnlyRoots.push(await realpath(gitDirectory.stdout.trim()));
+            }
+            if (workerLaunch?.safetyTier !== 'sandboxed')
+                throw new Error('Read-only native workers require sandboxed execution');
+        }
+        const hostProtection = filesystemPolicy && !transport.adapter.filesystemPolicyUnavailableReason
+            ? await reviewProcessSandbox(filesystemPolicy, transport.reviewRuntimeRoots?.(environment) ?? [])
+            : undefined;
+        if (relocation) {
+            const unavailable = transport.adapter.workspaceResumeUnavailableReason?.(resolved.version);
+            if (unavailable)
+                throw new Error(unavailable);
+        }
         // Validation above awaits filesystem/process probes. Recheck synchronously before reservation.
-        const existing = this.existingCreation(ownerPrincipalId, params, reservedId);
+        assertResumeCurrent?.();
+        if (profile)
+            assertNativeProfileCurrent(profile);
+        const existing = this.existingCreation(ownerPrincipalId, params, reservedId, workerLaunch);
         if (existing)
             return this.createdSession(existing);
+        if (reservedId && workerLaunch)
+            this.assertWorkerNotCancelled(reservedId);
         // Reserve before starting the child, so simultaneous resume calls cannot create two input owners.
         if (params.resumeSessionId &&
             [...this.sessions.values()].some((record) => record.info.nativeSessionId === params.resumeSessionId &&
                 !['closed', 'failed'].includes(record.info.state)))
             throw new Error('Native session already has an input owner');
+        const effort = workerLaunch
+            ? workerLaunch.effort
+            : previous
+                ? previous.info.effort
+                : transport.defaultEffort;
         const info = {
             id: previous?.info.id ?? reservedId ?? randomUUID(),
             generation: randomUUID(),
@@ -227,23 +359,35 @@ export class NativeSessionManager {
             nativeSessionId: params.resumeSessionId ?? '',
             ownerPrincipalId,
             executionNodeId: this.executionNodeId,
-            accountContextId: this.executionNodeId === 'local'
-                ? `native-local:${ownerPrincipalId}`
-                : `native-node:${JSON.stringify([this.executionNodeId, ownerPrincipalId])}`,
+            accountContextId: profile?.accountContextId ??
+                (this.executionNodeId === 'local'
+                    ? `native-local:${ownerPrincipalId}`
+                    : `native-node:${JSON.stringify([this.executionNodeId, ownerPrincipalId])}`),
+            ...(profile ? { profileId: profile.id } : {}),
             cwd: params.cwd,
             ...resolved,
             model: params.model ?? previous?.info.model,
             mode,
             accountMode: 'native',
+            ...(effort ? { effort } : {}),
+            ...(workerLaunch ? { workerManaged: true, workerLeaseId: workerLaunch.leaseId } : {}),
             state: 'starting',
-            capabilities: { ...transport.adapter.capabilities },
+            capabilities: {
+                ...transport.adapter.capabilities,
+                resumeAcrossWorkspaces: transport.adapter.capabilities.resumeAcrossWorkspaces === true &&
+                    // A source policy pins exact paths in the launch digest. Relocation must
+                    // not silently rewrite its grants while resuming the saved conversation.
+                    !workerLaunch?.filesystemPolicy &&
+                    !transport.adapter.workspaceResumeUnavailableReason?.(resolved.version),
+            },
         };
         const record = {
+            workerHistory: previous?.workerHistory ?? new NativeWorkerHistory(),
             info,
             events: previous?.events ?? [],
             commands: previous?.commands ?? new Map(),
             pendingRequests: new Map(),
-            context: executionContext(),
+            context: executionContext(workerLaunch, params.runner, profile),
             sending: false,
         };
         this.sessions.set(info.id, record);
@@ -262,10 +406,13 @@ export class NativeSessionManager {
             throw error;
         }
         try {
+            record.startupAbort = new AbortController();
             record.startup = transport.adapter.start({
                 ...params,
+                signal: record.startupAbort.signal,
                 mode,
                 model: info.model,
+                effort,
                 onSpawn: (pid, identity) => {
                     info.processPid = pid;
                     info.processIdentity = identity;
@@ -273,12 +420,22 @@ export class NativeSessionManager {
                     this.persist(record);
                 },
                 executable: resolved.executable,
-                env: nativeEnvironment(resolved.executable),
+                env: nativeEnvironment(resolved.executable, {
+                    ...environment,
+                    ...(hostProtection ? { TMPDIR: hostProtection.temporaryDirectory } : {}),
+                }),
+                processSandbox: hostProtection?.sandbox,
+                ...(workerLaunch
+                    ? { effort: workerLaunch.effort, safetyTier: workerLaunch.safetyTier, filesystemPolicy }
+                    : {}),
             }, (event) => this.append(record, event));
             record.adapter = await record.startup;
             info.nativeSessionId = record.adapter.nativeSessionId;
             if (record.adapter.capabilities)
-                info.capabilities = { ...record.adapter.capabilities };
+                info.capabilities = {
+                    ...record.adapter.capabilities,
+                    resumeAcrossWorkspaces: info.capabilities.resumeAcrossWorkspaces,
+                };
             if (info.state === 'starting')
                 info.state = 'idle';
             this.persist(record);
@@ -290,29 +447,179 @@ export class NativeSessionManager {
             throw error;
         }
     }
-    existingCreation(owner, params, reservedId) {
+    existingCreation(owner, params, reservedId, workerLaunch) {
         const record = reservedId ? this.sessions.get(reservedId) : undefined;
         if (!record)
             return undefined;
         if (record.info.ownerPrincipalId !== owner)
             throw new Error('Reserved sessionId belongs to another owner');
-        for (const field of ['runner', 'cwd', 'model', 'mode']) {
+        if (record.info.workerLeaseId !== workerLaunch?.leaseId)
+            throw new Error('Reserved sessionId belongs to another worker task lease');
+        for (const field of ['runner', 'cwd', 'model', 'mode', 'profileId']) {
             const requested = field === 'mode' ? (params.mode ?? 'default') : params[field];
             if (record.info[field] !== requested)
                 throw new Error(`Reserved sessionId launch configuration differs: ${field}`);
         }
-        if (JSON.stringify(record.context) !== JSON.stringify(executionContext()))
+        if (record.context.workerLaunchDigest !==
+            (workerLaunch ? nativeWorkerLaunchDigest(workerLaunch) : undefined))
+            throw new Error('Reserved sessionId launch configuration differs: worker launch configuration');
+        const profile = params.profileId
+            ? requireNativeProfile(params.profileId, params.runner)
+            : undefined;
+        if (JSON.stringify(record.context) !==
+            JSON.stringify(executionContext(workerLaunch, params.runner, profile)))
             throw new Error('Reserved sessionId launch configuration differs: account execution context');
         return record;
     }
     async createdSession(record) {
         if (record.reservationError)
             throw record.reservationError;
+        if (record.workerLeaseError)
+            throw record.workerLeaseError;
         if (record.info.state === 'starting' && record.startup)
             await record.startup;
         // Failed/closed reservations remain explicit. A retry cannot create a replacement process.
         return this.snapshot(record);
     }
+    assertWorkerLease(owner, id, generation, leaseId, closing = false) {
+        const record = this.owned(owner, id);
+        if (record.info.generation !== generation || record.info.workerLeaseId !== leaseId)
+            throw new Error('Native worker generation or task lease changed');
+        if (record.workerLeaseError && !closing)
+            throw record.workerLeaseError;
+    }
+    async closeWorker(owner, id, generation, leaseId) {
+        this.assertWorkerLease(owner, id, generation, leaseId, true);
+        const record = this.owned(owner, id);
+        await this.close(owner, id);
+        return this.snapshot(record);
+    }
+    assertWorkerNotCancelled(id) {
+        if (existsSync(join(this.root, 'cancelled-workers', `${id}.json`)))
+            throw new Error('Native worker reservation was cancelled before launch');
+    }
+    resumeCancellationPath(id, leaseId, commandId) {
+        if (!commandId.trim())
+            throw new Error('Native recovery command ID is required');
+        const key = createHash('sha256')
+            .update(JSON.stringify([id, leaseId, commandId]))
+            .digest('hex');
+        return join(this.root, 'cancelled-resumes', `${key}.json`);
+    }
+    async cancelWorker(owner, id, leaseId, generation, sourceLeaseId, resumeCommandId) {
+        if (![id, leaseId].every((value) => /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(value)))
+            throw new Error('Native worker reservation and lease must be lowercase UUIDs');
+        const root = join(this.root, 'cancelled-workers');
+        privateDirectory(root);
+        const markerPath = join(root, `${id}.json`);
+        const marker = existsSync(markerPath)
+            ? readJson(markerPath)
+            : undefined;
+        const record = this.sessions.get(id);
+        if (resumeCommandId !== undefined) {
+            if (!generation)
+                throw new Error('Native recovery cancellation requires its source generation');
+            if (!record ||
+                record.info.ownerPrincipalId !== owner ||
+                record.info.workerLeaseId !== leaseId)
+                throw new Error('Native recovery cancellation ownership changed');
+            // Keep every operation fence. A later explicit recovery uses a different ID,
+            // but must never make an older delayed request launchable again.
+            privateDirectory(join(this.root, 'cancelled-resumes'));
+            durableWrite(this.resumeCancellationPath(id, leaseId, resumeCommandId), { owner });
+            if (record.info.generation !== generation)
+                return {
+                    cancelled: false,
+                    reason: 'generation-changed',
+                    sessionId: id,
+                    leaseId,
+                    generation: record.info.generation,
+                };
+        }
+        if (sourceLeaseId !== undefined) {
+            if (!generation ||
+                !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(sourceLeaseId) ||
+                sourceLeaseId === leaseId)
+                throw new Error('Native handoff cancellation requires an exact source lease and generation');
+            if (record?.info.workerLeaseId === sourceLeaseId) {
+                if (record.info.ownerPrincipalId !== owner || record.info.generation !== generation)
+                    throw new Error('Native handoff cancellation ownership changed');
+                // Claim the reserved successor lease before stopping. A delayed transfer to
+                // that lease now observes the same closed record; stale source commands fail.
+                record.workerHistory.assertNewLease(leaseId);
+                record.info.workerLeaseId = leaseId;
+                try {
+                    this.persist(record);
+                }
+                catch (error) {
+                    record.workerLeaseError = error;
+                    throw error;
+                }
+            }
+        }
+        if (marker &&
+            (marker.owner !== owner ||
+                (marker.leaseId !== leaseId && record?.info.workerLeaseId !== leaseId)))
+            throw new Error('Native worker cancellation belongs to another owner or task lease');
+        // A replay of an earlier cancel cannot stop an explicitly resumed generation.
+        if (marker?.leaseId === leaseId &&
+            record &&
+            record.info.generation !== (generation ?? marker.generation))
+            return {
+                cancelled: true,
+                sessionId: id,
+                leaseId,
+                generation: generation ?? marker.generation,
+            };
+        if (record) {
+            if (record.info.ownerPrincipalId !== owner ||
+                record.info.workerLeaseId !== leaseId ||
+                (generation !== undefined && record.info.generation !== generation))
+                throw new Error('Native worker cancellation ownership changed');
+        }
+        else if (generation && !marker) {
+            throw new Error('Known native worker session is unavailable; stop cannot be confirmed');
+        }
+        const cancelledGeneration = record?.info.generation ?? generation ?? marker?.generation;
+        // This durable tombstone also catches ensure calls still awaiting executable probes.
+        durableWrite(markerPath, { owner, leaseId, generation: cancelledGeneration });
+        if (record)
+            await this.close(owner, id);
+        return {
+            cancelled: true,
+            sessionId: id,
+            leaseId,
+            generation: cancelledGeneration,
+            ...(record ? { session: this.snapshot(record) } : {}),
+        };
+    }
+    transferWorker(owner, id, generation, leaseId, launch) {
+        const record = this.owned(owner, id);
+        if (record.workerLeaseError)
+            throw record.workerLeaseError;
+        if (record.info.generation !== generation ||
+            record.context.workerLaunchDigest !== nativeWorkerLaunchDigest(launch))
+            throw new Error('Native worker handoff must preserve generation and launch configuration');
+        if (record.info.workerLeaseId === launch.leaseId)
+            return this.snapshot(record);
+        this.assertWorkerLease(owner, id, generation, leaseId);
+        const stopped = ['closed', 'failed'].includes(record.info.state) &&
+            record.info.processStopped &&
+            Boolean(record.info.nativeSessionId);
+        if ((record.info.state !== 'idle' && !stopped) || record.sending || record.pendingRequests.size)
+            throw new Error('Native worker handoff requires an idle session or a confirmed stopped session with no pending requests');
+        record.workerHistory.assertNewLease(launch.leaseId);
+        record.info.workerLeaseId = launch.leaseId;
+        try {
+            this.persist(record);
+        }
+        catch (error) {
+            // The write may have landed. Neither lease may submit more worker input until recovery.
+            record.workerLeaseError = error;
+            throw error;
+        }
+        return this.snapshot(record);
+    }
     append(record, event) {
         const enriched = {
             ...event,
@@ -420,8 +727,27 @@ export class NativeSessionManager {
             pendingRequests: [...record.pendingRequests.values()],
         };
     }
+    readWorker(owner, id, leaseId, after, limit) {
+        const record = this.owned(owner, id);
+        if (record.workerLeaseError)
+            throw record.workerLeaseError;
+        const result = record.workerHistory.read(leaseId, record.events, [...record.pendingRequests.values()], after, limit);
+        return { ...result, session: this.snapshot({ info: result.session }) };
+    }
+    assertAccountCurrent(record) {
+        if (!record.info.profileId)
+            return;
+        assertNativeProfileCurrent({
+            id: record.info.profileId,
+            runner: record.info.runner,
+            directory: record.context.profileDirectory,
+            accountContextId: record.info.accountContextId,
+            state: 'active',
+        });
+    }
     async send(owner, id, commandId, text) {
         const record = this.owned(owner, id);
+        this.assertAccountCurrent(record);
         const existing = record.commands.get(commandId);
         if (existing) {
             if (existing.text !== text)
@@ -472,6 +798,7 @@ export class NativeSessionManager {
     }
     async respond(owner, id, requestId, response) {
         const record = this.owned(owner, id);
+        this.assertAccountCurrent(record);
         const pending = record.pendingRequests.get(requestId);
         if (!record.adapter || !pending || pending.generation !== record.info.generation)
             throw new Error('Native request is stale or belongs to another session');
@@ -501,6 +828,19 @@ export class NativeSessionManager {
         }
         record.info.state = 'closing';
         this.persist(record);
+        if (!record.adapter && record.startup) {
+            record.startupAbort?.abort();
+            try {
+                await record.startup;
+            }
+            catch (error) {
+                // Startup rejection is expected after cancellation only when the process
+                // adapter has independently confirmed that its entire owned tree stopped.
+                if (record.info.processStopped && ['closed', 'failed'].includes(record.info.state))
+                    return;
+                throw error;
+            }
+        }
         const adapter = record.adapter ?? (await record.startup);
         await adapter?.close();
         if (!['closed', 'failed'].includes(this.owned(owner, id).info.state))