@farmslot/agent-runtime 0.9.0 → 0.11.0

package/dist/native/cursor-model.test.js

@@ -0,0 +1,40 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { configureCursorModel } from './cursor-model.js';
+for (const [alias, model, parameter, value] of [
+    ['cursor-grok-4.6-xhigh', 'grok-4.6', 'effort', 'xhigh'],
+    ['composer-2.5-fast', 'composer-2.5', 'fast', 'true'],
+    ['claude-opus-5-thinking-high', 'claude-opus-5', 'thinking', 'true'],
+    ['claude-4.6-opus-high-thinking', 'claude-opus-4-6', 'effort', 'high'],
+    ['gpt-5.6-sol[reasoning=high]', 'gpt-5.6-sol', 'reasoning', 'high'],
+    ['auto', 'auto-smart', 'model', 'auto-smart'],
+])
+    test(`Cursor confirms the native selection for ${alias}`, async () => {
+        const option = (id, values, category = '') => ({
+            id,
+            category,
+            currentValue: values[0],
+            options: values.map((value) => ({ value })),
+        });
+        const choices = [
+            option('model', [model]),
+            option('thinking', ['false', 'true'], 'thought_level'),
+            option('effort', ['medium', 'high', 'xhigh'], 'thought_level'),
+            option('reasoning', ['medium', 'high'], 'thought_level'),
+            option('fast', ['false', 'true']),
+        ];
+        await configureCursorModel('session', { configOptions: choices }, alias, async (method, params) => {
+            assert.equal(method, 'session/set_config_option');
+            assert.equal(params.sessionId, 'session');
+            const selected = choices.find((choice) => choice.id === params.configId);
+            assert(selected.options.some((option) => option.value === params.value));
+            selected.currentValue = String(params.value);
+            return { configOptions: structuredClone(choices) };
+        });
+        assert.equal(choices.find((choice) => choice.id === 'model').currentValue, model);
+        assert.equal(choices.find((choice) => choice.id === parameter).currentValue, value);
+    });
+test('Cursor refuses a model switch that the native API did not confirm', async () => {
+    await assert.rejects(configureCursorModel('session', { configOptions: [{ id: 'model', options: [{ value: 'requested' }] }] }, 'requested', async () => ({ configOptions: [{ id: 'model', currentValue: 'other' }] })), /did not select/);
+});
+//# sourceMappingURL=cursor-model.test.js.map

package/dist/native/cursor-model.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-model.test.js","sourceRoot":"","sources":["../../src/native/cursor-model.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI;IAC7C,CAAC,uBAAuB,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC;IACxD,CAAC,mBAAmB,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC;IACrD,CAAC,6BAA6B,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC;IACpE,CAAC,+BAA+B,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC;IACtE,CAAC,6BAA6B,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC;IACnE,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC;CAC9C;IACC,IAAI,CAAC,4CAA4C,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,MAAgB,EAAE,QAAQ,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,EAAE;YACF,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YACvB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG;YACd,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC;YACtD,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC;YAC9D,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC;YACxD,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;SAClC,CAAC;QACF,MAAM,oBAAoB,CACxB,SAAS,EACT,EAAE,aAAa,EAAE,OAAO,EAAE,EAC1B,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAE,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,EAAE,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,CAAC,CACF,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,OAAO,CAAE,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAE,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AAEL,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,MAAM,CAAC,OAAO,CAClB,oBAAoB,CAClB,SAAS,EACT,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,EACvE,WAAW,EACX,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC1E,EACD,gBAAgB,CACjB,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/native/cursor.d.ts

@@ -0,0 +1,2 @@
+export declare const cursorNativeAdapter: import("./types.js").NativeAdapter;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/native/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/native/cursor.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,mBAAmB,oCAwB9B,CAAC"}

package/dist/native/cursor.js

@@ -0,0 +1,30 @@
+import { createAcpAdapter } from './acp.js';
+import { cursorRequest } from './acp-requests.js';
+import { configureCursorModel } from './cursor-model.js';
+export const cursorNativeAdapter = createAcpAdapter({
+    authMethod: 'cursor_login',
+    clientCapabilities: { _meta: { parameterizedModelPicker: true } },
+    configureModel: configureCursorModel,
+    defaultModeId: 'agent',
+    args(options) {
+        if (options.effort)
+            throw new Error('Cursor effort must be configured in the native model ID');
+        return [
+            ...(options.filesystemPolicy
+                ? [
+                    '--trust',
+                    '--sandbox',
+                    'enabled',
+                    ...options.filesystemPolicy.writableRoots.flatMap((root) => ['--add-dir', root]),
+                ]
+                : []),
+            ...(options.processSandbox || (options.safetyTier && options.safetyTier !== 'sandboxed')
+                ? ['--force']
+                : []),
+            'acp',
+        ];
+    },
+    modes: ['default'],
+    extensionRequest: cursorRequest,
+});
+//# sourceMappingURL=cursor.js.map

package/dist/native/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/native/cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAClD,UAAU,EAAE,cAAc;IAC1B,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE;IACjE,cAAc,EAAE,oBAAoB;IACpC,aAAa,EAAE,OAAO;IACtB,IAAI,CAAC,OAAO;QACV,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC/F,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,gBAAgB;gBAC1B,CAAC,CAAC;oBACE,SAAS;oBACT,WAAW;oBACX,SAAS;oBACT,GAAG,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;iBACjF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC;gBACtF,CAAC,CAAC,CAAC,SAAS,CAAC;gBACb,CAAC,CAAC,EAAE,CAAC;YACP,KAAK;SACN,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,gBAAgB,EAAE,aAAa;CAChC,CAAC,CAAC"}

package/dist/native/durability.test.js

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict';
-import { spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import fs, { appendFileSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
@@ -12,6 +12,7 @@ import { NativeSessionClient } from './client.js';
 import { decodeRequest, requestHost, socketDirectory } from './ipc.js';
 import { NativeSessionManager } from './manager.js';
 import { alive, appendDurable, matchesProcess, privateDirectory, readJson } from './storage.js';
+import { decodeNativeWorkerLaunch } from './worker-launch.js';
 const fixture = `#!/usr/bin/env node
 if (process.argv.includes('--version')) { console.log('fixture 1'); process.exit(0); }
 const fs = require('node:fs');
@@ -21,10 +22,12 @@ require('node:readline').createInterface({input:process.stdin}).on('line', line
  const m = JSON.parse(line);
  if(m.method==='initialize') send({id:m.id,result:{}});
  if(m.method==='thread/start'||m.method==='thread/resume') {
+  fs.writeFileSync('native-start.json',JSON.stringify({params:m.params,env:{probe:process.env.NATIVE_WORKER_PROBE,omc:process.env.DISABLE_OMC,omx:process.env.DISABLE_OMX}}),{mode:0o600});
   thread=m.params.threadId || 'thread-'+process.pid;
   send({id:m.id,result:{thread:{id:thread}}});
  }
  if(m.method==='turn/start') {
+  fs.writeFileSync('native-turn.json',JSON.stringify(m.params),{mode:0o600});
   const text=m.params.input[0].text; turn='turn-'+m.id;
   fs.appendFileSync('inputs',text+'\\n');
   if(text==='unknown') { process.exit(23); }
@@ -70,6 +73,95 @@ function setup() {
         },
     };
 }
+for (const mode of ['startup', 'periodic', 'persistent']) {
+    test(`supervisor ${mode} census failure stops its host and preserves cleanup truth`, async () => {
+        const fixture = setup();
+        const client = new NativeSessionClient(fixture.root);
+        const config = join(fixture.cwd, 'census-fault.json');
+        const previousOptions = process.env.NODE_OPTIONS;
+        const previousFault = process.env.FARMSLOT_NATIVE_CENSUS_FAULT;
+        const preload = new URL('../../../../scripts/runner-validation/fixtures/native-census-fault.mjs', import.meta.url).href;
+        process.env.NODE_OPTIONS = `${previousOptions ?? ''} --import=${preload}`.trim();
+        process.env.FARMSLOT_NATIVE_CENSUS_FAULT = config;
+        writeFileSync(config, JSON.stringify({ root: fixture.root, armed: mode === 'startup' }), {
+            mode: 0o600,
+        });
+        writeFileSync(join(fixture.cwd, 'codex'), readFileSync(join(fixture.cwd, 'codex'), 'utf8').replace('},600);', '},60000);'));
+        let descendant;
+        let descendantStart;
+        try {
+            if (mode === 'startup') {
+                await assert.rejects(client.create('owner', { runner: 'codex', cwd: fixture.cwd }), /Native host unavailable/);
+                const host = readJson(join(fixture.root, 'host.json'));
+                const worker = readJson(join(fixture.root, 'worker.json'));
+                assert.equal(alive(host.pid), false);
+                assert.equal(alive(worker.pid), false);
+                assert.equal(readJson(join(fixture.root, 'cleanup.json')).state, 'complete');
+                const retry = await client.create('owner', { runner: 'codex', cwd: fixture.cwd });
+                await client.close('owner', retry.id);
+            }
+            else {
+                const session = await client.create('owner', { runner: 'codex', cwd: fixture.cwd });
+                const host = readJson(join(fixture.root, 'host.json'));
+                await client.send('owner', session.id, 'census', 'crash');
+                await until(() => existsSync(join(fixture.cwd, 'descendant')));
+                descendant = Number(readFileSync(join(fixture.cwd, 'descendant'), 'utf8'));
+                descendantStart = execFileSync('ps', ['-p', String(descendant), '-o', 'lstart='], {
+                    encoding: 'utf8',
+                }).trim();
+                writeFileSync(config, JSON.stringify({ root: fixture.root, armed: false, observePid: descendant }));
+                await until(() => existsSync(`${config}.observed`));
+                writeFileSync(config, JSON.stringify({ root: fixture.root, armed: true, persistent: mode === 'persistent' }));
+                await until(() => existsSync(`${config}.fired`) && !alive(host.pid) && !alive(session.hostPid));
+                await until(() => !alive(session.processPid));
+                const cleanup = readJson(join(fixture.root, 'cleanup.json'));
+                assert.equal(cleanup.state, mode === 'persistent' ? 'unknown' : 'complete');
+                assert.match(cleanup.error ?? '', /census timeout/);
+                assert.equal(existsSync(join(fixture.cwd, 'effects')), false);
+                if (mode === 'persistent') {
+                    assert.ok(cleanup.observedProcesses?.some((entry) => entry.pid === descendant));
+                    await assert.rejects(client.list('owner'), /Native host unavailable/);
+                }
+                else {
+                    assert.equal(alive(descendant), false);
+                    const recovered = await client.read('owner', session.id);
+                    assert.equal(recovered.session.state, 'failed');
+                    assert.equal(recovered.session.processStopped, true);
+                }
+            }
+        }
+        finally {
+            rmSync(config, { force: true });
+            const hostFile = join(fixture.root, 'host.json');
+            if (existsSync(hostFile)) {
+                const host = readJson(hostFile);
+                if (alive(host.pid)) {
+                    process.kill(host.pid, 'SIGTERM');
+                    await until(() => !alive(host.pid));
+                }
+            }
+            if (descendant && alive(descendant)) {
+                const ownedDescendant = descendant;
+                const current = execFileSync('ps', ['-p', String(ownedDescendant), '-o', 'lstart='], {
+                    encoding: 'utf8',
+                }).trim();
+                assert.equal(current, descendantStart, 'Fixture descendant PID was reused');
+                process.kill(ownedDescendant, 'SIGKILL');
+                await until(() => !alive(ownedDescendant));
+            }
+            if (previousOptions === undefined)
+                delete process.env.NODE_OPTIONS;
+            else
+                process.env.NODE_OPTIONS = previousOptions;
+            if (previousFault === undefined)
+                delete process.env.FARMSLOT_NATIVE_CENSUS_FAULT;
+            else
+                process.env.FARMSLOT_NATIVE_CENSUS_FAULT = previousFault;
+            rmSync(socketDirectory(fixture.root), { recursive: true, force: true });
+            fixture.restore();
+        }
+    });
+}
 test('reserved native creation is concurrent-safe and survives journal reload without relaunch', async () => {
     const fixture = setup();
     const manager = new NativeSessionManager(fixture.root);
@@ -172,6 +264,336 @@ test('an uncertain reservation fsync remains failed after retry and journal relo
         fixture.restore();
     }
 });
+test('worker launch keeps environment private and transfers only an idle task lease', async () => {
+    const fixture = setup();
+    const manager = new NativeSessionManager(fixture.root);
+    const secret = `private-environment-${randomUUID()}`;
+    const launch = {
+        leaseId: randomUUID(),
+        executable: './codex',
+        effort: 'high',
+        safetyTier: 'full-auto',
+        environment: { set: { NATIVE_WORKER_PROBE: secret }, unset: [] },
+    };
+    const params = { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd };
+    try {
+        assert.throws(() => decodeNativeWorkerLaunch({ ...launch, futurePermissionFlag: true }), /Unsupported/);
+        const session = await manager.ensure('owner', params, launch);
+        assert.equal(session.workerManaged, true);
+        assert.equal(session.workerLeaseId, launch.leaseId);
+        const started = readJson(join(fixture.cwd, 'native-start.json'));
+        assert.deepEqual(started.env, { probe: secret, omc: '1', omx: '1' });
+        assert.equal(started.params.approvalPolicy, 'never');
+        assert.equal(started.params.sandbox, 'workspace-write');
+        const next = { ...launch, leaseId: randomUUID() };
+        await manager.send('owner', session.id, randomUUID(), 'approval');
+        assert.equal(readJson(join(fixture.cwd, 'native-turn.json')).effort, 'high');
+        await until(() => manager.read('owner', session.id).pendingRequests.length > 0);
+        assert.throws(() => manager.transferWorker('owner', session.id, session.generation, launch.leaseId, next), /idle session/);
+        await manager.respond('owner', session.id, manager.read('owner', session.id).pendingRequests[0].request.id, { decision: 'deny' });
+        await until(() => manager.read('owner', session.id).session.state === 'idle');
+        assert.throws(() => manager.transferWorker('owner', session.id, session.generation, launch.leaseId, {
+            ...next,
+            safetyTier: 'dangerous',
+        }), /preserve generation and launch configuration/);
+        const handedOff = manager.transferWorker('owner', session.id, session.generation, launch.leaseId, next);
+        assert.equal(handedOff.workerLeaseId, next.leaseId);
+        assert.equal(handedOff.processPid, session.processPid);
+        assert.equal(manager.transferWorker('owner', session.id, session.generation, launch.leaseId, next)
+            .workerLeaseId, next.leaseId);
+        assert.throws(() => manager.assertWorkerLease('owner', session.id, session.generation, launch.leaseId), /task lease changed/);
+        await assert.rejects(manager.ensure('owner', params, launch), /another worker task lease/);
+        manager.assertWorkerLease('owner', session.id, session.generation, next.leaseId);
+        assert.equal((await manager.ensure('owner', params, next)).processPid, session.processPid);
+        assert.equal(readFileSync(join(fixture.root, `${session.id}.journal`), 'utf8').includes(secret), false);
+        await manager.close('owner', session.id);
+        await assert.rejects(manager.create('owner', {
+            runner: 'codex',
+            cwd: fixture.cwd,
+            resumeSessionId: session.nativeSessionId,
+        }), /Worker recovery requires/);
+    }
+    finally {
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
+test('uncertain worker lease persistence refuses input until explicit close and recovery', async (t) => {
+    const fixture = setup();
+    const manager = new NativeSessionManager(fixture.root);
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'sandboxed',
+        environment: { set: {}, unset: [] },
+    };
+    const params = { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd };
+    const session = await manager.ensure('owner', params, launch);
+    const next = { ...launch, leaseId: randomUUID() };
+    const fault = t.mock.method(fs, 'fsyncSync', () => {
+        throw new Error('Lease flush failed');
+    });
+    syncBuiltinESMExports();
+    try {
+        assert.throws(() => manager.transferWorker('owner', session.id, session.generation, launch.leaseId, next), /Lease flush failed/);
+        fault.mock.restore();
+        syncBuiltinESMExports();
+        assert.throws(() => manager.assertWorkerLease('owner', session.id, session.generation, next.leaseId), /Lease flush failed/);
+        assert.throws(() => manager.transferWorker('owner', session.id, session.generation, launch.leaseId, next), /Lease flush failed/);
+        await assert.rejects(manager.ensure('owner', params, next), /Lease flush failed/);
+        manager.assertWorkerLease('owner', session.id, session.generation, next.leaseId, true);
+        await manager.close('owner', session.id);
+        const reloaded = new NativeSessionManager(fixture.root);
+        const closed = await reloaded.ensure('owner', params, next);
+        assert.equal(closed.state, 'closed');
+        assert.equal(closed.workerLeaseId, next.leaseId);
+    }
+    finally {
+        fault.mock.restore();
+        syncBuiltinESMExports();
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
+test('cancelling an initial worker reservation prevents a delayed launch and survives reload', async () => {
+    const fixture = setup();
+    const manager = new NativeSessionManager(fixture.root);
+    const params = { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd };
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'sandboxed',
+        environment: { set: {}, unset: [] },
+    };
+    const pending = manager.ensure('owner', params, launch);
+    try {
+        assert.equal((await manager.cancelWorker('owner', params.sessionId, launch.leaseId)).cancelled, true);
+        await assert.rejects(pending, /cancelled before launch/);
+        assert.equal(existsSync(join(fixture.cwd, 'native-start.json')), false);
+        assert.equal(manager.list('owner').length, 0);
+        const reloaded = new NativeSessionManager(fixture.root);
+        await assert.rejects(reloaded.ensure('owner', params, launch), /cancelled before launch/);
+        await assert.rejects(reloaded.cancelWorker('other', params.sessionId, launch.leaseId), /another owner/);
+    }
+    finally {
+        await Promise.allSettled([pending]);
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
+test('cancelling a reserved handoff fences a delayed transfer and preserves later task leases', async () => {
+    const fixture = setup();
+    const manager = new NativeSessionManager(fixture.root);
+    const params = { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd };
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'full-auto',
+        environment: { set: {}, unset: [] },
+    };
+    const successor = { ...launch, leaseId: randomUUID() };
+    try {
+        const session = await manager.ensure('owner', params, launch);
+        await assert.rejects(manager.cancelWorker('other', session.id, successor.leaseId, session.generation, launch.leaseId), /ownership changed/);
+        assert.equal(manager.read('owner', session.id).session.workerLeaseId, launch.leaseId);
+        const cancel = manager.cancelWorker('owner', session.id, successor.leaseId, session.generation, launch.leaseId);
+        const delayed = manager.transferWorker('owner', session.id, session.generation, launch.leaseId, successor);
+        assert.equal(delayed.workerLeaseId, successor.leaseId);
+        const stopped = await cancel;
+        assert.equal(stopped.session?.processStopped, true);
+        assert.equal(stopped.session?.state, 'closed');
+        const retried = await manager.ensure('owner', params, successor);
+        assert.equal(retried.state, 'closed');
+        assert.equal(retried.processPid, session.processPid);
+        assert.equal((await new NativeSessionManager(fixture.root).ensure('owner', params, successor)).state, 'closed');
+        const resumed = await manager.create('owner', { ...params, resumeSessionId: session.nativeSessionId }, successor);
+        const later = { ...successor, leaseId: randomUUID() };
+        manager.transferWorker('owner', session.id, resumed.generation, successor.leaseId, later);
+        await assert.rejects(manager.cancelWorker('owner', session.id, successor.leaseId, resumed.generation, launch.leaseId), /ownership changed/);
+        assert.equal(manager.read('owner', session.id).session.workerLeaseId, later.leaseId);
+        assert.ok(alive(resumed.processPid));
+    }
+    finally {
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
+test('cancelled recovery IDs survive reload while a new explicit recovery remains available', async () => {
+    const fixture = setup();
+    let manager = new NativeSessionManager(fixture.root);
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'sandboxed',
+        environment: { set: {}, unset: [] },
+    };
+    try {
+        const first = await manager.ensure('owner', { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd }, launch);
+        await manager.closeWorker('owner', first.id, first.generation, launch.leaseId);
+        const params = {
+            sessionId: first.id,
+            generation: first.generation,
+            runner: 'codex',
+            cwd: fixture.cwd,
+            resumeSessionId: first.nativeSessionId,
+        };
+        const cancelledIds = [randomUUID(), randomUUID()];
+        for (const commandId of cancelledIds)
+            await manager.cancelWorker('owner', first.id, launch.leaseId, first.generation, undefined, commandId);
+        manager = new NativeSessionManager(fixture.root);
+        for (const commandId of cancelledIds)
+            await assert.rejects(manager.resumeWorker('owner', { ...params, commandId }, launch), /operation was cancelled/);
+        const resumed = await manager.resumeWorker('owner', { ...params, commandId: randomUUID() }, launch);
+        assert.notEqual(resumed.generation, first.generation);
+        for (const commandId of cancelledIds) {
+            await manager.cancelWorker('owner', first.id, launch.leaseId, first.generation, undefined, commandId);
+            assert.equal(manager.read('owner', first.id).session.generation, resumed.generation);
+            assert.ok(alive(resumed.processPid));
+        }
+    }
+    finally {
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
+for (const race of ['cancel', 'transfer']) {
+    test(`worker resume rechecks ${race} after its asynchronous executable probe`, async () => {
+        const fixture = setup();
+        const manager = new NativeSessionManager(fixture.root);
+        const launch = {
+            leaseId: randomUUID(),
+            executable: join(fixture.cwd, 'codex'),
+            safetyTier: 'sandboxed',
+            environment: { set: {}, unset: [] },
+        };
+        let pending;
+        try {
+            const first = await manager.ensure('owner', { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd }, launch);
+            await manager.closeWorker('owner', first.id, first.generation, launch.leaseId);
+            const startReceipt = readFileSync(join(fixture.cwd, 'native-start.json'), 'utf8');
+            const binary = readFileSync(launch.executable, 'utf8');
+            writeFileSync(launch.executable, binary.replace("if (process.argv.includes('--version')) {", `if (process.argv.includes('--version')) {
+        const probeFs = require('node:fs');
+        probeFs.writeFileSync('version-entered', '');
+        while (!probeFs.existsSync('version-release')) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      `));
+            const commandId = randomUUID();
+            pending = manager.resumeWorker('owner', {
+                sessionId: first.id,
+                generation: first.generation,
+                runner: 'codex',
+                cwd: fixture.cwd,
+                resumeSessionId: first.nativeSessionId,
+                commandId,
+            }, launch);
+            const rejected = assert.rejects(pending, race === 'cancel' ? /operation was cancelled/ : /lease changed/);
+            await until(() => existsSync(join(fixture.cwd, 'version-entered')));
+            if (race === 'cancel')
+                await manager.cancelWorker('owner', first.id, launch.leaseId, first.generation, undefined, commandId);
+            else
+                manager.transferWorker('owner', first.id, first.generation, launch.leaseId, {
+                    ...launch,
+                    leaseId: randomUUID(),
+                });
+            writeFileSync(join(fixture.cwd, 'version-release'), '');
+            await rejected;
+            const after = manager.read('owner', first.id).session;
+            assert.equal(after.generation, first.generation);
+            assert.equal(after.processStopped, true);
+            assert.equal(readFileSync(join(fixture.cwd, 'native-start.json'), 'utf8'), startReceipt);
+        }
+        finally {
+            writeFileSync(join(fixture.cwd, 'version-release'), '');
+            if (pending)
+                await Promise.allSettled([pending]);
+            for (const session of manager.list('owner'))
+                await manager.close('owner', session.id);
+            fixture.restore();
+        }
+    });
+}
+test('replayed worker cancellation cannot stop an explicitly resumed generation', async () => {
+    const fixture = setup();
+    const manager = new NativeSessionManager(fixture.root);
+    const params = { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd };
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'sandboxed',
+        environment: { set: {}, unset: [] },
+    };
+    try {
+        const first = await manager.ensure('owner', params, launch);
+        await manager.cancelWorker('owner', first.id, launch.leaseId);
+        const resumed = await manager.create('owner', { ...params, resumeSessionId: first.nativeSessionId }, launch);
+        assert.notEqual(resumed.generation, first.generation);
+        for (const generation of [undefined, first.generation]) {
+            const replay = await manager.cancelWorker('owner', first.id, launch.leaseId, generation);
+            assert.equal(replay.generation, first.generation);
+            assert.equal(manager.read('owner', first.id).session.state, 'idle');
+            assert.ok(alive(resumed.processPid));
+        }
+        const closed = await manager.cancelWorker('owner', first.id, launch.leaseId, resumed.generation);
+        assert.equal(closed.session?.state, 'closed');
+        assert.equal(closed.session?.processStopped, true);
+    }
+    finally {
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
+test('worker host rejects public input and accepts only leased commands and permission replies', async () => {
+    const fixture = setup();
+    const client = new NativeSessionClient(fixture.root);
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'sandboxed',
+        environment: { set: {}, unset: [] },
+    };
+    try {
+        const session = await client.ensureWorker('owner', { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd }, launch);
+        const target = {
+            sessionId: session.id,
+            generation: session.generation,
+            leaseId: launch.leaseId,
+        };
+        await assert.rejects(client.send('owner', session.id, 'unleased', 'approval'), /requires its run context/);
+        await assert.rejects(client.interrupt('owner', session.id), /requires its run context/);
+        await assert.rejects(client.close('owner', session.id), /requires its run context/);
+        await assert.rejects(client.sendWorker('owner', { ...target, leaseId: randomUUID() }, 'stale', 'approval'), /lease changed/);
+        assert.equal(existsSync(join(fixture.cwd, 'inputs')), false);
+        await client.sendWorker('owner', target, 'leased-approval', 'approval');
+        await until(async () => (await client.read('owner', session.id)).pendingRequests.length === 1);
+        const pending = (await client.read('owner', session.id)).pendingRequests[0].request.id;
+        await assert.rejects(client.respond('owner', session.id, pending, { decision: 'approve' }), /requires its run context/);
+        await assert.rejects(client.respondWorker('owner', { ...target, generation: randomUUID() }, pending, {
+            decision: 'approve',
+        }), /generation.*changed/);
+        assert.equal((await client.read('owner', session.id)).pendingRequests.length, 1);
+        await client.respondWorker('owner', target, pending, { decision: 'deny' });
+        await until(async () => (await client.read('owner', session.id)).session.state === 'idle');
+        assert.equal((await client.closeWorker('owner', target)).processStopped, true);
+    }
+    finally {
+        const file = join(fixture.root, 'host.json');
+        if (existsSync(file)) {
+            const host = readJson(file);
+            if (alive(host.pid)) {
+                process.kill(host.pid, 'SIGTERM');
+                await until(() => !alive(host.pid));
+            }
+        }
+        rmSync(socketDirectory(fixture.root), { recursive: true, force: true });
+        fixture.restore();
+    }
+});
 test('old native hosts retain ordinary reads but refuse ensured creation before IPC', async () => {
     const fixture = setup();
     const socketRoot = socketDirectory(fixture.root);
@@ -198,6 +620,12 @@ test('old native hosts retain ordinary reads but refuse ensured creation before
         assert.deepEqual(await client.list('owner'), []);
         await assert.rejects(client.ensure('owner', { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd }), /host upgrade required/);
         assert.deepEqual(requests, ['list']);
+        await assert.rejects(client.ensureWorker('owner', { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd }, {
+            leaseId: randomUUID(),
+            safetyTier: 'sandboxed',
+            environment: { set: {}, unset: [] },
+        }), /host upgrade required for worker launch/);
+        assert.deepEqual(requests, ['list']);
     }
     finally {
         await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
@@ -513,4 +941,36 @@ test('unregistered host cannot bind and exits if its supervisor disappears', asy
         rmSync(root, { recursive: true, force: true });
     }
 });
+test('a stopped worker transfers its lease before resuming the saved conversation', async () => {
+    const fixture = setup();
+    const manager = new NativeSessionManager(fixture.root);
+    const params = { sessionId: randomUUID(), runner: 'codex', cwd: fixture.cwd };
+    const launch = {
+        leaseId: randomUUID(),
+        executable: join(fixture.cwd, 'codex'),
+        safetyTier: 'full-auto',
+        environment: { set: {}, unset: [] },
+    };
+    const successor = { ...launch, leaseId: randomUUID() };
+    try {
+        const first = await manager.ensure('owner', params, launch);
+        await manager.cancelWorker('owner', first.id, launch.leaseId, first.generation);
+        const transferred = manager.transferWorker('owner', first.id, first.generation, launch.leaseId, successor);
+        assert.equal(transferred.processStopped, true);
+        assert.equal(transferred.generation, first.generation);
+        assert.equal(transferred.workerLeaseId, successor.leaseId);
+        assert.throws(() => manager.assertWorkerLease('owner', first.id, first.generation, launch.leaseId), /lease changed/);
+        const resumed = await manager.create('owner', { ...params, resumeSessionId: first.nativeSessionId }, successor);
+        assert.equal(resumed.nativeSessionId, first.nativeSessionId);
+        assert.notEqual(resumed.generation, first.generation);
+        await manager.cancelWorker('owner', first.id, launch.leaseId, first.generation);
+        assert.ok(alive(resumed.processPid));
+        assert.equal(manager.read('owner', first.id).session.workerLeaseId, successor.leaseId);
+    }
+    finally {
+        for (const session of manager.list('owner'))
+            await manager.close('owner', session.id);
+        fixture.restore();
+    }
+});
 //# sourceMappingURL=durability.test.js.map