@fungi.computer/computer 0.1.0 → 0.2.0

package/dist/index.js

@@ -50,6 +50,9 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
+import { boundExecStream } from "./exec-output.js";
+export { createLocalBackendReplayStore } from "./local-backend-replay.js";
+import { computerInternetAccess } from "./internet-access.js";
 import { getWorkspace, SQLiteWorkspaceProvider, Workspace, WorkspaceProxy, WorkspaceServiceProxy, } from "@fungi.computer/cloudflare-computer";
 import { WorkerShellBackend, } from "@fungi.computer/cloudflare-computer/backends/worker-shell";
 import jqCommands from "@fungi.computer/cloudflare-computer/shell/jq";
@@ -58,16 +61,19 @@ import xanCommands from "@fungi.computer/cloudflare-computer/shell/xan";
 import fileCommands from "@fungi.computer/cloudflare-computer/shell/file";
 import { withWorkspaceContainer, } from "@fungi.computer/cloudflare-computer/backends/container";
 import { DurableObject } from "cloudflare:workers";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 import { z } from "zod";
 import { SystemTrustContainerBackend } from "./container-system-trust.js";
 import { computerTransportBackend } from "./transport-backend.js";
 import { PullPendingTracker } from "./pull-pending.js";
-import { ComputerFileConflict, ComputerFileRangeError, ComputerFileTooLargeError, capabilityNameSchema, computerValueSchema, computerCapabilities, computerPortInputSchema, computerPortOutputSchema, computerPortRemovalOutputSchema, computerPortsOutputSchema, computerPortSchema, ComputerPortLimitError, ComputerPortReservedError, computerTerminalPort, isComputerReservedPort, maximumExposedPorts, maximumProcessRecords, execInputSchema, execOutputSchema, computerToolResult, computerExecutionRequestSchema, genericComputerExecutionBudget, mintComputerRequestId, listInputSchema, listOutputSchema, maximumFileBytes, maximumStreamBytes, mkdirInputSchema, mkdirOutputSchema, readInputSchema, readBytesInputSchema, readOutputSchema, replaceInputSchema, writeInputSchema, writeOutputSchema, processIdInputSchema, processKillOutputSchema, processListOutputSchema, processStartInputSchema, processStartToolInputSchema, ComputerProcessNotFoundError, } from "./operation-contract.js";
-import { createWorkspaceFilesPort, readBoundedWorkspaceText } from "./files.js";
+import { ComputerFileConflict, ComputerFileRangeError, ComputerFileTooLargeError, capabilityNameSchema, computerValueSchema, computerCapabilities, computerPortInputSchema, computerPortOutputSchema, computerPortRemovalOutputSchema, computerPortsOutputSchema, computerPortSchema, ComputerPortLimitError, ComputerPortReservedError, computerTerminalPort, isComputerReservedPort, maximumExposedPorts, maximumProcessRecords, execInputSchema, execOutputSchema, computerToolResult, computerExecutionRequestSchema, genericComputerExecutionBudget, mintComputerRequestId, listInputSchema, listOutputSchema, maximumFileBytes, mkdirInputSchema, mkdirOutputSchema, readInputSchema, readBytesInputSchema, readOutputSchema, replaceInputSchema, writeInputSchema, writeOutputSchema, processIdInputSchema, processKillOutputSchema, processListOutputSchema, processStartInputSchema, processStartToolInputSchema, ComputerProcessNotFoundError, } from "@fungi.computer/computer-contract";
+import { createWorkspaceFilesPort, readBoundedWorkspaceText, listWorkspaceFiles, } from "./files.js";
 import { computerExecutionResult } from "./execution-result.js";
 import { ComputerOperationRecord } from "./operation-record.js";
+import { createComputerExecutionLifecycle } from "./execution-lifecycle.js";
 import { applyWorkspacePatch } from "./files-patch.js";
-import { ComputerProcessInventory, drainProcessExit, observeProcess, } from "./process-inventory.js";
+import { ComputerProcessInventory, drainProcessExit, failedObservation, observeProcess, } from "./process-inventory.js";
 import { assertComputerContainersEnabled, computerContainerSleepAfterMs, ComputerContainersPausedError, configureComputerContainer, hostedComputerContainersPaused, } from "./container-policy.js";
 import { OnBoxVmContainerHost, onBoxVmPlacement, } from "./on-box-vm.js";
 import { attachedBackendId, describeAttachedBackend, routeComputerBackend, } from "./computer-backends.js";
@@ -96,23 +102,6 @@ const terminalQuerySchema = z.lazy(() => z.strictObject({
     cols: z.coerce.number().int().min(2).max(500).catch(terminalDefaultCols),
     rows: z.coerce.number().int().min(2).max(300).catch(terminalDefaultRows),
 }));
-function entryType(entry) {
-    if (entry.isFile)
-        return "file";
-    if (entry.isDirectory)
-        return "directory";
-    return "symlink";
-}
-function truncate(value) {
-    const bytes = utf8.encode(value);
-    if (bytes.byteLength <= maximumStreamBytes) {
-        return { value, truncated: false };
-    }
-    return {
-        value: new TextDecoder().decode(bytes.slice(0, maximumStreamBytes)),
-        truncated: true,
-    };
-}
 async function read(workspace, input) {
     const { path } = readInputSchema.parse(input);
     const stat = await workspace.fs.stat(path);
@@ -127,21 +116,7 @@ async function read(workspace, input) {
     });
 }
 async function list(workspace, input) {
-    const { path, limit, offset } = listInputSchema.parse(input);
-    const rows = await workspace.fs.readdir(path, {
-        limit: limit + 1,
-        offset,
-    });
-    return listOutputSchema.parse({
-        path,
-        entries: rows.slice(0, limit).map((entry) => ({
-            name: entry.name,
-            size: entry.size,
-            modifiedAt: entry.mtime,
-            type: entryType(entry),
-        })),
-        nextOffset: rows.length > limit ? offset + limit : null,
-    });
+    return listOutputSchema.parse(await listWorkspaceFiles(workspace, listInputSchema.parse(input)));
 }
 async function mkdir(workspace, input) {
     const { path, recursive } = mkdirInputSchema.parse(input);
@@ -156,7 +131,7 @@ async function write(workspace, input) {
         bytes: utf8.encode(content).byteLength,
     });
 }
-async function exec(workspace, input, backend, signal) {
+async function exec(workspace, input, backend, signal, execution) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
         // The host request has already been decoded under its admitted budget.
@@ -165,15 +140,23 @@ async function exec(workspace, input, backend, signal) {
         const options = cwd === undefined
             ? { encoding: "utf8", timeoutMs, ...backendOption }
             : { encoding: "utf8", timeoutMs, cwd, ...backendOption };
-        const run = __addDisposableResource(env_1, await workspace.runtime.exec(command, options), false);
+        const nativeOptions = {
+            ...options,
+            ...execution?.carriage,
+        };
+        if (execution !== undefined)
+            nativeOptions.id = execution.invocation.id;
+        execution?.dispatch();
+        const run = __addDisposableResource(env_1, await workspace.runtime.exec(command, nativeOptions), false);
+        execution?.opened();
         const result = await computerExecutionResult(run, signal);
         const synchronizationFailure = result.sync.status === "pending"
             ? `Computer command filesystem synchronization failed: ${result.sync.error}`
             : null;
-        const stdout = truncate(result.stdout);
-        const stderr = truncate(synchronizationFailure === null
+        const stdout = boundExecStream(result.stdout, "stdout");
+        const stderr = boundExecStream(synchronizationFailure === null
             ? result.stderr
-            : `${synchronizationFailure}${result.stderr.length === 0 ? "" : `\n${result.stderr}`}`);
+            : `${synchronizationFailure}${result.stderr.length === 0 ? "" : `\n${result.stderr}`}`, "stderr");
         return execOutputSchema.parse({
             status: synchronizationFailure === null ? result.status : "failed",
             exitCode: synchronizationFailure !== null && result.exitCode === 0
@@ -181,7 +164,9 @@ async function exec(workspace, input, backend, signal) {
                 : result.exitCode,
             stdout: stdout.value,
             stderr: stderr.value,
-            truncated: stdout.truncated || stderr.truncated,
+            truncated: stdout.truncation.length + stderr.truncation.length === 0
+                ? false
+                : [...stdout.truncation, ...stderr.truncation],
         });
     }
     catch (e_1) {
@@ -295,7 +280,7 @@ class ContainerComputer extends ContainerComputerBase {
             attachedBackendId(candidate) === backendId);
         if (backend === undefined ||
             computerName !== this.state.id.name ||
-            !(await verifyLocalBackendDial(request, computerName, backend)))
+            !(await verifyLocalBackendDial(request, computerName, backend, this.state.storage)))
             return new Response(null, { status: 404 });
         // A verified plain request lets the machine tell attached from detached.
         if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket")
@@ -323,9 +308,10 @@ class ContainerComputer extends ContainerComputerBase {
      * The hosted backend that terminals, processes and ports use: the first in
      * the default order, or none when only local machines are attached.
      */
-    hostedRoute() {
+    hostedRoute(backend) {
         const route = routeComputerBackend(this.attachedBackends(), () => false, {
             need: "hosted",
+            backend,
         });
         if (route.kind !== "routed" || route.backend.kind === "local")
             return undefined;
@@ -456,9 +442,8 @@ class ContainerComputer extends ContainerComputerBase {
     }
     /**
      * The current Workspace once its mount index is ready and its guest mount
-     * root exists. Every backend mounts `/workspace`, so a host write there
-     * (such as a Workflow step's one-shot Git credential file) must not depend
-     * on a guest having booted first.
+     * root exists. Every backend mounts `/workspace`, so an ordinary host file
+     * write there must not depend on a guest having booted first.
      */
     async readyWorkspace() {
         const workspace = this.workspace();
@@ -496,9 +481,20 @@ class ContainerComputer extends ContainerComputerBase {
 }
 /** One upstream Cloudflare Workspace that advertises and runs its capabilities. */
 export class ComputerDO extends ContainerComputer {
+    constructor(ctx, env) {
+        super(ctx, env);
+        // Reconstruction revokes unfinished exec authority before the first RPC.
+        void this.#executions;
+    }
+    /** Host-admitted settings write; egress reads the current durable value. */
+    internetAccess(enabled) {
+        return computerInternetAccess(this.state.storage.sql, enabled);
+    }
     #binaryFileTail = Promise.resolve(undefined);
     #operationRecord;
     #processRecord;
+    #executionRecord;
+    #processStarts = new Map();
     #terminalSync;
     get #processes() {
         this.#processRecord ??= new ComputerProcessInventory(this.state.storage, () => Date.now());
@@ -508,6 +504,128 @@ export class ComputerDO extends ContainerComputer {
         this.#operationRecord ??= new ComputerOperationRecord(this.state.storage, () => Date.now());
         return this.#operationRecord;
     }
+    /** Ordinary Computers have no credential host; resource hosts override it. */
+    executionHooks() {
+        return undefined;
+    }
+    get #executions() {
+        if (this.#executionRecord === undefined) {
+            // Initialize the existing retention owners before their dependent table.
+            void this.#operations;
+            void this.#processes;
+            const executions = createComputerExecutionLifecycle(this.state.storage);
+            this.#executionRecord = executions;
+            for (const interrupted of executions.reconstructed) {
+                if (interrupted.invocation.kind === "process") {
+                    // An opening process never crossed the synchronous SDK fence.
+                    const { id } = processIdInputSchema.parse({
+                        id: interrupted.invocation.id,
+                    });
+                    this.#processes.release(id);
+                }
+                this.state.waitUntil(Promise.resolve().then(() => this.#deliverExecutionClose(interrupted, "reconstructed")));
+            }
+        }
+        return this.#executionRecord;
+    }
+    async #deliverExecutionClose(record, reason, hooks) {
+        try {
+            await (hooks ?? this.executionHooks())?.close(record.invocation, record.context, reason);
+        }
+        catch (cause) {
+            // A host error may contain credential-bearing transport data.
+            Effect.runSync(Effect.logError("Computer host execution close is unavailable", Redacted.make(cause)));
+        }
+    }
+    async #closeExecution(id, reason, hooks) {
+        const record = this.#executions.close(id, reason);
+        if (record !== undefined)
+            await this.#deliverExecutionClose(record, reason, hooks);
+    }
+    /**
+     * Admission observes the actual native subscriber, never App completion,
+     * output silence, an accepted signal or this isolate's warm state.
+     */
+    async executionIsLive(invocationId) {
+        const record = this.#executions.get(invocationId);
+        if (record === undefined ||
+            record.phase === "closed" ||
+            record.phase === "opening" ||
+            (record.phase === "open" && !record.nativeOpened) ||
+            (record.phase === "dispatching" &&
+                (record.invocation.kind !== "process" ||
+                    this.#processStarts.has(invocationId))))
+            return false;
+        let route;
+        try {
+            const selected = this.hostedRoute(record.backend);
+            if (selected === undefined)
+                throw new ComputerBackendUnavailableError("no_backend");
+            route = selected;
+        }
+        catch {
+            await this.#closeExecution(invocationId, "unknown");
+            return false;
+        }
+        let workspace;
+        try {
+            if (!(await this.containerRunning(route.backing))) {
+                if (record.nativeOpened)
+                    await this.#closeExecution(invocationId, "native_exit");
+                return false;
+            }
+            workspace = await this.readyWorkspace();
+        }
+        catch {
+            return false;
+        }
+        const runtime = processRuntime(workspace, route.id);
+        let observed;
+        let archivedExit = false;
+        try {
+            const env_2 = { stack: [], error: void 0, hasError: false };
+            try {
+                // Hold both handles unread. A live execution admits only one subscriber;
+                // two successful gets therefore prove archived native completion.
+                const first = __addDisposableResource(env_2, await runtime.getExec(invocationId, { resume: "tail" }), false);
+                void first;
+                const second = __addDisposableResource(env_2, await runtime.getExec(invocationId, { resume: "tail" }), false);
+                void second;
+                archivedExit = true;
+                observed = { state: "exited", exitCode: null, sync: "unknown" };
+            }
+            catch (e_2) {
+                env_2.error = e_2;
+                env_2.hasError = true;
+            }
+            finally {
+                __disposeResources(env_2);
+            }
+        }
+        catch (cause) {
+            observed = failedObservation(cause instanceof Error ? cause : undefined);
+        }
+        if (observed.state === "running") {
+            this.#executions.opened(invocationId);
+            return this.#executions.get(invocationId)?.phase === "open";
+        }
+        if (observed.state === "exited" && (record.nativeOpened || archivedExit))
+            await this.#closeExecution(invocationId, "native_exit");
+        return false;
+    }
+    /** Caller-driven renewal only; a Git HTTP liveness check never renews. */
+    async #renewExecution(invocationId) {
+        const record = this.#executions.get(invocationId);
+        if (record === undefined || !(await this.executionIsLive(invocationId)))
+            return;
+        try {
+            await this.executionHooks()?.renew(record.invocation, record.context);
+        }
+        catch (cause) {
+            await this.#closeExecution(invocationId, "unknown");
+            Effect.runSync(Effect.logError("Computer host execution renewal is unavailable", Redacted.make(cause)));
+        }
+    }
     #ensureExposedPorts() {
         void this.#processes;
     }
@@ -843,7 +961,7 @@ export class ComputerDO extends ContainerComputer {
         return await this.callAfterAcceptance(capabilityId, input, () => undefined);
     }
     /** Resource hosts may accept authority once the Workspace is ready to dispatch. */
-    async callAfterAcceptance(capabilityId, input, accept) {
+    async callAfterAcceptance(capabilityId, input, accept, executionContext) {
         const selected = capabilityNameSchema.parse(capabilityId);
         if (selected === "bash" || selected === "exec") {
             accept();
@@ -851,11 +969,11 @@ export class ComputerDO extends ContainerComputer {
             return computerToolResult(await this.executeOperationAfterAcceptance({
                 ...execInputSchema.parse(input),
                 requestId: mintComputerRequestId(),
-            }, () => undefined, selected));
+            }, () => undefined, selected, undefined, undefined, executionContext));
         }
         switch (selected) {
             case "start_process":
-                return await this.startProcessAfterAcceptance(input, accept);
+                return await this.startProcessAfterAcceptance(input, accept, executionContext);
             case "list_processes":
                 return await this.listProcessesAfterAcceptance(accept);
             case "kill_process":
@@ -888,15 +1006,22 @@ export class ComputerDO extends ContainerComputer {
      * Execute a host request once, after the host accepts current authority.
      * `exec` runs on the Workspace's built-in Worker shell unless it names an
      * attached backend; `bash` always runs on an attached backend, the named one
-     * or the first available in the default order.
+     * or the first available in the default order. Host-only `hosted` execution
+     * excludes local backends, including an explicitly named local backend.
      */
-    async executeOperationAfterAcceptance(input, accept, kind, budget = genericComputerExecutionBudget, signal) {
+    async executeOperationAfterAcceptance(input, accept, kind, budget = genericComputerExecutionBudget, signal, executionContext) {
         const { requestId, ...command } = computerExecutionRequestSchema(budget).parse(input);
         const route = kind === "exec" && command.backend === undefined
             ? undefined
-            : this.routeBackend(command.backend, "exec");
+            : this.routeBackend(command.backend, kind === "hosted" ? "hosted" : "exec");
+        if (executionContext !== undefined) {
+            if (route === undefined)
+                throw new Error("Host execution requires a hosted native backend");
+            // Keep the selected backend; never redirect credential-bearing work from
+            // a local backend to a different hosted one.
+            this.routeBackend(route.id, "hosted");
+        }
         const run = async () => {
-            const workspace = await this.readyWorkspace();
             const inputHash = await sha256(JSON.stringify({
                 kind,
                 command: command.command,
@@ -907,16 +1032,61 @@ export class ComputerDO extends ContainerComputer {
             const operations = this.#operations;
             signal?.throwIfAborted();
             const recorded = operations.admit(requestId, inputHash, accept);
-            if (recorded !== undefined)
+            if (recorded !== undefined) {
+                if (executionContext !== undefined)
+                    await this.#renewExecution(`exec:${requestId}`);
                 return recorded;
+            }
             operations.markRunning(requestId);
+            let hooks;
+            const invocation = {
+                id: `exec:${requestId}`,
+                kind: "exec",
+            };
+            let completed = false;
             try {
-                operations.settle(requestId, await exec(workspace, command, route?.id, signal));
+                const workspace = await this.readyWorkspace();
+                hooks =
+                    executionContext === undefined ? undefined : this.executionHooks();
+                let execution;
+                if (executionContext !== undefined) {
+                    if (hooks === undefined || route === undefined)
+                        throw new Error("Computer host execution is unavailable");
+                    this.#executions.begin(invocation, route.id, executionContext);
+                    // The host's last awaited authority fence follows NEW admission.
+                    const carriage = await hooks.open(invocation, executionContext);
+                    execution = {
+                        invocation,
+                        carriage,
+                        dispatch: () => {
+                            signal?.throwIfAborted();
+                            this.#executions.dispatch(invocation.id);
+                        },
+                        opened: () => {
+                            this.#executions.opened(invocation.id);
+                        },
+                    };
+                }
+                const output = await exec(workspace, command, route?.id, signal, execution);
+                completed = true;
+                operations.settle(requestId, output);
             }
             catch (cause) {
-                operations.settleUnknown(requestId, cause instanceof Error
-                    ? `${cause.name}: ${cause.message}`
-                    : "Computer execution rejected without an Error");
+                operations.settleUnknown(requestId, executionContext !== undefined
+                    ? "Computer hosted execution outcome is unavailable"
+                    : cause instanceof Error
+                        ? `${cause.name}: ${cause.message}`
+                        : "Computer execution rejected without an Error");
+            }
+            finally {
+                if (hooks !== undefined && executionContext !== undefined) {
+                    const phase = this.#executions.get(invocation.id)?.phase;
+                    await this.#closeExecution(invocation.id, completed
+                        ? "native_exit"
+                        : phase === "dispatching" || phase === "open"
+                            ? "unknown"
+                            : "refused_start", hooks);
+                }
             }
             return operations.status(requestId, () => undefined);
         };
@@ -937,22 +1107,33 @@ export class ComputerDO extends ContainerComputer {
         return await this.startProcessAfterAcceptance(input, () => undefined);
     }
     /** The host accepts authority when the running slot is reserved. */
-    async startProcessAfterAcceptance(input, accept) {
+    async startProcessAfterAcceptance(input, accept, executionContext) {
         const start = processStartInputSchema.parse(input);
         const { command, cwd } = start;
         const inputHash = await sha256(JSON.stringify({ command, cwd: cwd ?? null, port: start.port ?? null }));
         const replay = this.#processes.replay(start, inputHash, accept);
-        if (replay !== undefined)
-            return replay;
+        if (replay !== undefined) {
+            if (executionContext !== undefined)
+                await this.#renewExecution(replay.id);
+            return this.#processReceipt(replay, executionContext !== undefined);
+        }
         if (start.port !== undefined && isComputerReservedPort(start.port))
             throw new ComputerPortReservedError(start.port);
         const backend = this.requireHostedRoute().id;
         const workspace = await this.readyWorkspace();
         const admission = this.#processes.admit(start, inputHash, accept);
-        if (!admission.created)
-            return admission.process;
+        if (!admission.created) {
+            if (executionContext !== undefined)
+                await this.#renewExecution(admission.process.id);
+            return this.#processReceipt(admission.process, executionContext !== undefined);
+        }
         const admitted = admission.process;
         const id = admitted.id;
+        const invocation = { id, kind: "process" };
+        const control = { cancelled: false };
+        this.#processStarts.set(id, control);
+        let hooks;
+        let dispatched = false;
         let run;
         try {
             // timeoutMs 0 disables computerd's default 320 s command deadline.
@@ -964,9 +1145,38 @@ export class ComputerDO extends ContainerComputer {
             };
             if (cwd !== undefined)
                 options.cwd = cwd;
-            run = await workspace.runtime.exec(command, options);
+            if (executionContext !== undefined) {
+                hooks = this.executionHooks();
+                if (hooks === undefined)
+                    throw new Error("Computer host execution is unavailable");
+                this.#executions.begin(invocation, backend, executionContext);
+                const carriage = await hooks.open(invocation, executionContext);
+                if (carriage.env !== undefined)
+                    options.env = carriage.env;
+                if (carriage.stdin !== undefined)
+                    options.stdin = carriage.stdin;
+            }
+            // No awaited work belongs between this fence and the SDK invocation.
+            if (control.cancelled)
+                throw new Error("Computer process start was cancelled");
+            if (executionContext !== undefined)
+                this.#executions.dispatch(id);
+            dispatched = true;
+            control.dispatch = workspace.runtime.exec(command, options);
+            run = await control.dispatch;
+            if (executionContext !== undefined)
+                this.#executions.opened(id);
         }
         catch (error) {
+            if (executionContext !== undefined) {
+                await this.#closeExecution(id, dispatched ? "unknown" : "refused_start", hooks);
+                if (!dispatched) {
+                    this.#processes.release(id);
+                    throw error;
+                }
+                // A failed dispatch reply is not proof that native spawn failed.
+                return this.#settle(id, { state: "uncertain" });
+            }
             // A transport failure after dispatch may still have started it.
             const observed = await observeProcess(processRuntime(workspace, backend), id);
             if (observed.state === "exited" && observed.exitCode === null) {
@@ -975,9 +1185,20 @@ export class ComputerDO extends ContainerComputer {
             }
             return this.#settle(id, observed);
         }
+        finally {
+            this.#processStarts.delete(id);
+        }
         this.state.waitUntil(this.#watchProcess(id, run));
         return admitted;
     }
+    #processReceipt(process, requiresContext = false) {
+        const execution = this.#executions.get(process.id);
+        return process.state === "running" &&
+            (execution?.phase === "closed" ||
+                (requiresContext && execution === undefined))
+            ? { ...process, state: "uncertain" }
+            : process;
+    }
     /** List this Computer's processes, reconciling live ones with computerd. */
     async listProcesses() {
         return await this.listProcessesAfterAcceptance(() => undefined);
@@ -990,28 +1211,55 @@ export class ComputerDO extends ContainerComputer {
             return processListOutputSchema.parse({
                 processes: rows.slice(0, maximumProcessRecords),
             });
-        const hosted = this.hostedRoute();
-        if (hosted === undefined ||
-            !(await this.containerRunning(hosted.backing))) {
-            // No container means none of its processes survived; do not wake it.
-            for (const row of running)
-                this.#processes.exited(row.id, null);
-            return processListOutputSchema.parse({
-                processes: this.#processes.list().slice(0, maximumProcessRecords),
-            });
-        }
-        const workspace = await this.readyWorkspace();
-        const runtime = processRuntime(workspace, hosted.id);
-        const observed = new Map(await Promise.all(running.map(async (row) => [
-            row.id,
-            this.#settle(row.id, await observeProcess(runtime, row.id)),
-        ])));
+        const observed = new Map(await Promise.all(running.map(async (row) => [row.id, await this.#observeOwnedProcess(row)])));
         return processListOutputSchema.parse({
             processes: rows
                 .slice(0, maximumProcessRecords)
                 .map((row) => observed.get(row.id) ?? row),
         });
     }
+    async #observeOwnedProcess(row) {
+        // A reservation or unresolved SDK preparation is not a native exit.
+        if (this.#processStarts.has(row.id))
+            return { ...row, state: "uncertain" };
+        const execution = this.#executions.get(row.id);
+        let hosted = this.hostedRoute();
+        if (execution !== undefined) {
+            try {
+                hosted = this.hostedRoute(execution.backend);
+                if (hosted === undefined)
+                    throw new ComputerBackendUnavailableError("no_backend");
+            }
+            catch {
+                await this.#closeExecution(row.id, "unknown");
+                return { ...row, state: "uncertain" };
+            }
+        }
+        if (hosted === undefined ||
+            !(await this.containerRunning(hosted.backing))) {
+            // Never wake a stopped backend. Absence before a known native handle
+            // cannot settle a dispatch whose reply was lost.
+            if (execution !== undefined && !execution.nativeOpened)
+                return { ...row, state: "uncertain" };
+            return this.#settle(row.id, {
+                state: "exited",
+                exitCode: null,
+                sync: "unknown",
+            });
+        }
+        const workspace = await this.readyWorkspace();
+        const observed = await observeProcess(processRuntime(workspace, hosted.id), row.id);
+        if (execution !== undefined &&
+            !execution.nativeOpened &&
+            observed.state === "exited" &&
+            observed.exitCode === null &&
+            observed.sync === "unknown")
+            return { ...row, state: "uncertain" };
+        const process = this.#settle(row.id, observed);
+        if (observed.state === "running")
+            await this.#renewExecution(row.id);
+        return process;
+    }
     /** Send SIGTERM to one running process; its exit is recorded when observed. */
     async killProcess(input) {
         return await this.killProcessAfterAcceptance(input, () => undefined);
@@ -1024,10 +1272,61 @@ export class ComputerDO extends ContainerComputer {
             throw new ComputerProcessNotFoundError(id);
         if (row.state !== "running")
             return processKillOutputSchema.parse({ process: row, signalled: false });
-        const hosted = this.hostedRoute();
+        const pending = this.#processStarts.get(id);
+        if (pending !== undefined) {
+            pending.cancelled = true;
+            const dispatch = pending.dispatch;
+            if (dispatch === undefined) {
+                await this.#closeExecution(id, "refused_start");
+                this.#processes.release(id);
+                return processKillOutputSchema.parse({
+                    process: this.#processes.get(id),
+                    signalled: false,
+                });
+            }
+            // Preparation can still be in flight. Await its actual native handle,
+            // then signal that same invocation; never infer exit from acceptance.
+            pending.signal ??= (async () => {
+                try {
+                    const native = await dispatch;
+                    await native.kill("SIGTERM");
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            })();
+            const signalled = await pending.signal;
+            return processKillOutputSchema.parse({
+                process: this.#processReceipt(this.#processes.get(id) ?? row),
+                signalled,
+            });
+        }
+        const execution = this.#executions.get(id);
+        let hosted = this.hostedRoute();
+        if (execution !== undefined) {
+            try {
+                hosted = this.hostedRoute(execution.backend);
+                if (hosted === undefined)
+                    throw new ComputerBackendUnavailableError("no_backend");
+            }
+            catch {
+                await this.#closeExecution(id, "unknown");
+                return processKillOutputSchema.parse({
+                    process: { ...row, state: "uncertain" },
+                    signalled: false,
+                });
+            }
+        }
         if (hosted === undefined || !(await this.containerRunning(hosted.backing)))
             return processKillOutputSchema.parse({
-                process: this.#processes.exited(id, null),
+                process: execution !== undefined && !execution.nativeOpened
+                    ? { ...row, state: "uncertain" }
+                    : this.#settle(id, {
+                        state: "exited",
+                        exitCode: null,
+                        sync: "unknown",
+                    }),
                 signalled: false,
             });
         const workspace = await this.readyWorkspace();
@@ -1038,14 +1337,21 @@ export class ComputerDO extends ContainerComputer {
             });
         }
         catch (cause) {
-            console.error("Computer runtime operation failed", cause);
-            const observed = await observeProcess(processRuntime(workspace, hosted.id), id);
+            if (execution === undefined)
+                console.error("Computer runtime operation failed", cause);
+            else
+                console.error("Computer hosted process signal was not confirmed");
             return processKillOutputSchema.parse({
-                process: this.#settle(id, observed),
+                process: execution === undefined
+                    ? this.#settle(id, await observeProcess(processRuntime(workspace, hosted.id), id))
+                    : await this.#observeOwnedProcess(row),
                 signalled: false,
             });
         }
-        return processKillOutputSchema.parse({ process: row, signalled: true });
+        return processKillOutputSchema.parse({
+            process: this.#processReceipt(this.#processes.get(id) ?? row),
+            signalled: true,
+        });
     }
     /**
      * A "pending" verdict's background continuation keeps the host alive
@@ -1063,7 +1369,11 @@ export class ComputerDO extends ContainerComputer {
         if (observed.state === "exited") {
             if (observed.settleLater !== undefined)
                 this.#watchResync(id, observed.settleLater);
-            return this.#processes.exited(id, observed.exitCode, observed.sync);
+            const process = this.#processes.exited(id, observed.exitCode, observed.sync);
+            const execution = this.#executions.close(id, "native_exit");
+            if (execution !== undefined)
+                this.state.waitUntil(this.#deliverExecutionClose(execution, "native_exit"));
+            return process;
         }
         const row = this.#processes.get(id);
         if (row === undefined)
@@ -1082,13 +1392,21 @@ export class ComputerDO extends ContainerComputer {
         try {
             const settled = await drainProcessExit(run);
             if (settled !== undefined) {
-                if (settled.settleLater !== undefined)
-                    this.#watchResync(id, settled.settleLater);
-                this.#processes.exited(id, settled.exitCode, settled.sync);
+                this.#settle(id, {
+                    state: "exited",
+                    ...settled,
+                });
             }
+            else
+                await this.#closeExecution(id, "unknown");
         }
         catch (cause) {
-            console.error("Computer runtime operation failed", cause);
+            if (this.#executions.get(id) === undefined)
+                console.error("Computer runtime operation failed", cause);
+            else {
+                await this.#closeExecution(id, "unknown");
+                console.error("Computer hosted process observation is unavailable");
+            }
             // The stream broke (eviction, transport); list reconciles later.
         }
     }
@@ -1116,10 +1434,10 @@ export class ComputerDO extends ContainerComputer {
         if (hosted === undefined)
             return Response.json({ error: "Computer container is unavailable" }, { status: 502 });
         try {
-            const env_2 = { stack: [], error: void 0, hasError: false };
+            const env_3 = { stack: [], error: void 0, hasError: false };
             try {
                 const workspace = await this.readyWorkspace();
-                const readiness = __addDisposableResource(env_2, await workspace.runtime.exec("true", {
+                const readiness = __addDisposableResource(env_3, await workspace.runtime.exec("true", {
                     backend: hosted.id,
                     encoding: "utf8",
                     timeoutMs: 10_000,
@@ -1129,12 +1447,12 @@ export class ComputerDO extends ContainerComputer {
                     return Response.json({ error: "Computer container is unavailable" }, { status: 502 });
                 }
             }
-            catch (e_2) {
-                env_2.error = e_2;
-                env_2.hasError = true;
+            catch (e_3) {
+                env_3.error = e_3;
+                env_3.hasError = true;
             }
             finally {
-                __disposeResources(env_2);
+                __disposeResources(env_3);
             }
         }
         catch (cause) {
@@ -1201,24 +1519,24 @@ export class ComputerDO extends ContainerComputer {
 // Runtime backends reach the authoritative Workspace through these loopback
 // entrypoints. The consuming Worker must re-export both from its main module.
 export { WorkspaceProxy, WorkspaceServiceProxy };
-export { OnBoxVmContainerHost, onBoxVmPlacement, onBoxVmIngress, } from "./on-box-vm.js";
+export { OnBoxVmContainerHost, OnBoxVmTimeoutError, onBoxVmPlacement, onBoxVmIngress, } from "./on-box-vm.js";
 export { computerContainerSleepAfterMs } from "./container-policy.js";
 export * from "./computer-backends.js";
 export { LocalBackendOfflineError, localBackendAudience, localBackendDialPath, verifyLocalBackendDial, } from "./local-backend.js";
 /** Keep each native Workspace lease inside the operation that uses it. */
 export function createComputerFilesPort(computer) {
     async function withFiles(operation) {
-        const env_3 = { stack: [], error: void 0, hasError: false };
+        const env_4 = { stack: [], error: void 0, hasError: false };
         try {
-            const workspace = __addDisposableResource(env_3, await getWorkspace(computer), false);
+            const workspace = __addDisposableResource(env_4, await getWorkspace(computer), false);
             return await operation(createWorkspaceFilesPort(workspace, computer));
         }
-        catch (e_3) {
-            env_3.error = e_3;
-            env_3.hasError = true;
+        catch (e_4) {
+            env_4.error = e_4;
+            env_4.hasError = true;
         }
         finally {
-            __disposeResources(env_3);
+            __disposeResources(env_4);
         }
     }
     return {
@@ -1233,5 +1551,4 @@ export function createComputerFilesPort(computer) {
     };
 }
 export { createWorkspaceFilesPort } from "./files.js";
-export * from "./operation-contract.js";
 export { ComputerOperationConflictError, ComputerOperationLimitError, ComputerRequestInvalidError, } from "./operation-record.js";