@gajae-code/coding-agent 0.11.10 → 0.12.0

package/src/gjc-runtime/gc-render.ts

@@ -12,6 +12,7 @@ const STORE_HEADINGS: Record<GcStore, string> = {
 	file_locks: "Config file-locks",
 	tmux_sessions: "Tmux sessions",
 	registry_entries: "Harness-root registry entries",
+	local_roots: "Session local roots",
 };
 
 function actionLabel(record: GcRecord): string {

package/src/gjc-runtime/gc-runtime.ts

@@ -19,7 +19,13 @@ import { UnsupportedStateVersionError } from "../sdk/broker/state-version";
 
 import { buildGcReportText } from "./gc-render";
 
-export type GcStore = "harness_leases" | "team_workers" | "file_locks" | "tmux_sessions" | "registry_entries";
+export type GcStore =
+	| "harness_leases"
+	| "team_workers"
+	| "file_locks"
+	| "tmux_sessions"
+	| "registry_entries"
+	| "local_roots";
 
 export const GC_STORES: readonly GcStore[] = [
 	"harness_leases",
@@ -27,6 +33,7 @@ export const GC_STORES: readonly GcStore[] = [
 	"file_locks",
 	"tmux_sessions",
 	"registry_entries",
+	"local_roots",
 ] as const;
 
 /** Why a probed pid is kept instead of treated as dead. */
@@ -452,11 +459,13 @@ export async function defaultGcAdapters(): Promise<GcStoreAdapter[]> {
 		{ fileLocksGcAdapter },
 		{ teamWorkersGcAdapter },
 		{ tmuxSessionsGcAdapter },
+		{ localRootsGcAdapter },
 	] = await Promise.all([
 		import("../harness-control-plane/gc-adapter"),
 		import("../config/file-lock-gc"),
 		import("./team-gc"),
 		import("./tmux-gc"),
+		import("../internal-urls/local-root-gc"),
 	]);
 	return [
 		harnessLeasesGcAdapter,
@@ -464,5 +473,6 @@ export async function defaultGcAdapters(): Promise<GcStoreAdapter[]> {
 		fileLocksGcAdapter,
 		tmuxSessionsGcAdapter,
 		registryEntriesGcAdapter,
+		localRootsGcAdapter,
 	];
 }

package/src/gjc-runtime/linux-proc.ts

@@ -1,26 +1,30 @@
 /**
- * Shared helpers for reading Linux `/proc/<pid>/stat` process start time.
+ * Shared helpers for reading Linux `/proc/<pid>/stat` process identity fields.
  *
  * The `comm` field (field 2, wrapped in parentheses) may itself contain spaces
  * and parentheses, so the only robust anchor is the *last* `)` in the stat
  * string. Field 22 (the process start time in clock ticks since boot) is the
- * 20th whitespace-separated token after that closing paren (index 19).
- *
- * Every caller previously parsed this format independently, with subtly
- * different failure handling. This module fails closed: any malformed input
- * (missing `)`, non-numeric field 22, unreadable `/proc` file, non-Linux
- * platform) yields `null` rather than an inconsistent sentinel.
+ * 20th whitespace-separated token after that closing paren (index 19). Field 7
+ * (`tty_nr`) is the 5th token after the closing paren (index 4).
  */
 
 import * as nodeFsSync from "node:fs";
 import * as nodeFs from "node:fs/promises";
 
-/**
- * Parse field 22 (process start time, in clock ticks since boot) from one
- * `/proc/<pid>/stat` record. Returns the raw numeric token, or `null` when the
- * record shape is malformed or field 22 is absent/non-numeric.
- */
-export function parseLinuxProcStartTime(stat: string | null | undefined): string | null {
+export interface LinuxProcStatIdentity {
+	startTime: string;
+	ttyDevice: string;
+}
+
+export type LinuxProcPidProbeResult =
+	| ({ kind: "live" } & LinuxProcStatIdentity)
+	| { kind: "absent" }
+	| {
+			kind: "unverifiable";
+			reason: "unsupported_platform" | "invalid_pid" | "permission_denied" | "read_error" | "malformed_stat";
+	  };
+
+function parseLinuxProcIdentity(stat: string | null | undefined): LinuxProcStatIdentity | null {
 	if (!stat || stat.includes("\0") || stat.includes("\r")) return null;
 	const record = stat.endsWith("\n") ? stat.slice(0, -1) : stat;
 	if (!record || record.includes("\n")) return null;
@@ -32,40 +36,70 @@ export function parseLinuxProcStartTime(stat: string | null | undefined): string
 	const suffix = record.slice(close + 1);
 	if (!/^[ \t]+/.test(suffix)) return null;
 	const fields = suffix.trim().split(/[ \t]+/);
-	if (fields.length < 20 || !/^[RSDTtXZPI]$/.test(fields[0])) return null;
-
+	if (fields.length < 20 || !/^[A-Za-z]$/.test(fields[0])) return null;
+	const ttyDevice = fields[4];
 	const startTime = fields[19];
-	return /^\d+$/.test(startTime) ? startTime : null;
+	if (!ttyDevice || !/^-?\d+$/.test(ttyDevice) || !/^\d+$/.test(startTime)) return null;
+	return { startTime, ttyDevice };
 }
 
-/**
- * Read `/proc/<pid>/stat` synchronously and return the parsed start time.
- * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
- */
-export function readLinuxProcStartTimeSync(pid: number): string | null {
-	if (process.platform !== "linux") return null;
-	if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+function classifyProcReadError(error: unknown): Extract<LinuxProcPidProbeResult, { kind: "absent" | "unverifiable" }> {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	if (code === "ENOENT" || code === "ESRCH") return { kind: "absent" };
+	if (code === "EACCES" || code === "EPERM") return { kind: "unverifiable", reason: "permission_denied" };
+	return { kind: "unverifiable", reason: "read_error" };
+}
+
+/** Parse field 22 (start time) from a `/proc/<pid>/stat` record. */
+export function parseLinuxProcStartTime(stat: string | null | undefined): string | null {
+	return parseLinuxProcIdentity(stat)?.startTime ?? null;
+}
+
+/** Parse field 7 (`tty_nr`) from a `/proc/<pid>/stat` record. */
+export function parseLinuxProcTtyDevice(stat: string | null | undefined): string | null {
+	return parseLinuxProcIdentity(stat)?.ttyDevice ?? null;
+}
+
+export function probeLinuxProcPidSync(pid: number): LinuxProcPidProbeResult {
+	if (!Number.isSafeInteger(pid) || pid <= 0) return { kind: "unverifiable", reason: "invalid_pid" };
+	if (process.platform !== "linux") return { kind: "unverifiable", reason: "unsupported_platform" };
 	let stat: string;
 	try {
 		stat = nodeFsSync.readFileSync(`/proc/${pid}/stat`, "utf8");
-	} catch {
-		return null;
+	} catch (error) {
+		return classifyProcReadError(error);
 	}
-	return parseLinuxProcStartTime(stat);
+	const identity = parseLinuxProcIdentity(stat);
+	return identity ? { kind: "live", ...identity } : { kind: "unverifiable", reason: "malformed_stat" };
 }
 
-/**
- * Read `/proc/<pid>/stat` asynchronously and return the parsed start time.
- * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
- */
-export async function readLinuxProcStartTime(pid: number): Promise<string | null> {
-	if (process.platform !== "linux") return null;
-	if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+export async function probeLinuxProcPid(pid: number): Promise<LinuxProcPidProbeResult> {
+	if (!Number.isSafeInteger(pid) || pid <= 0) return { kind: "unverifiable", reason: "invalid_pid" };
+	if (process.platform !== "linux") return { kind: "unverifiable", reason: "unsupported_platform" };
 	let stat: string;
 	try {
 		stat = await nodeFs.readFile(`/proc/${pid}/stat`, "utf8");
-	} catch {
-		return null;
+	} catch (error) {
+		return classifyProcReadError(error);
 	}
-	return parseLinuxProcStartTime(stat);
+	const identity = parseLinuxProcIdentity(stat);
+	return identity ? { kind: "live", ...identity } : { kind: "unverifiable", reason: "malformed_stat" };
+}
+
+/**
+ * Read `/proc/<pid>/stat` synchronously and return the parsed start time.
+ * Returns `null` when the probe is absent or unverifiable.
+ */
+export function readLinuxProcStartTimeSync(pid: number): string | null {
+	const probe = probeLinuxProcPidSync(pid);
+	return probe.kind === "live" ? probe.startTime : null;
+}
+
+/**
+ * Read `/proc/<pid>/stat` asynchronously and return the parsed start time.
+ * Returns `null` when the probe is absent or unverifiable.
+ */
+export async function readLinuxProcStartTime(pid: number): Promise<string | null> {
+	const probe = await probeLinuxProcPid(pid);
+	return probe.kind === "live" ? probe.startTime : null;
 }

package/src/gjc-runtime/memory-guard-owner-claims.ts

@@ -0,0 +1,389 @@
+import { Database } from "bun:sqlite";
+import * as fs from "node:fs/promises";
+import { type LinuxProcPidProbeResult, probeLinuxProcPid } from "./linux-proc";
+import { assertSafePathComponent } from "./session-layout";
+import { memoryGuardClaimPaths } from "./tmux-owner-isolation";
+
+const MEMORY_GUARD_CLAIM_RESOURCES = ["writer", "tty"] as const;
+const MEMORY_GUARD_SQLITE_BUSY_TIMEOUT_MS = 5_000;
+type MemoryGuardClaimResource = (typeof MEMORY_GUARD_CLAIM_RESOURCES)[number];
+
+export interface MemoryGuardClaimOwner {
+	sessionId: string;
+	generation: string;
+	runId: string;
+	childToken: string;
+	pid: number;
+	processStartTime: string;
+	ttyDevice: string;
+}
+
+export interface MemoryGuardClaimsLease {
+	writerEpoch: number;
+	ttyEpoch: number;
+	owner: MemoryGuardClaimOwner;
+	claimStorePath: string;
+}
+
+const issuedMemoryGuardClaimsLeases = new WeakSet<MemoryGuardClaimsLease>();
+
+function issueMemoryGuardClaimsLease(lease: MemoryGuardClaimsLease): MemoryGuardClaimsLease {
+	const owner = Object.freeze({ ...lease.owner });
+	const issued = Object.freeze({ ...lease, owner });
+	issuedMemoryGuardClaimsLeases.add(issued);
+	return issued;
+}
+
+export function isMemoryGuardClaimsLease(value: unknown): value is MemoryGuardClaimsLease {
+	return (
+		typeof value === "object" && value !== null && issuedMemoryGuardClaimsLeases.has(value as MemoryGuardClaimsLease)
+	);
+}
+export function isMemoryGuardClaimsLeaseForStateDir(value: unknown, stateDir: string): value is MemoryGuardClaimsLease {
+	return (
+		isMemoryGuardClaimsLease(value) &&
+		value.claimStorePath === memoryGuardClaimPaths(stateDir, value.owner.sessionId).databaseFile
+	);
+}
+
+export type MemoryGuardClaimsReleasedProof = MemoryGuardClaimsLease;
+
+interface PersistedMemoryGuardClaimRow {
+	resource: MemoryGuardClaimResource;
+	epoch: number;
+	session_id: string;
+	generation: string;
+	run_id: string;
+	child_token: string;
+	pid: number;
+	process_start_time: string;
+	tty_device: string;
+	acquired_at: string;
+}
+
+export interface MemoryGuardOwnerClaimsDeps {
+	probePid(pid: number): Promise<LinuxProcPidProbeResult>;
+	now(): string;
+}
+
+const defaultDeps: MemoryGuardOwnerClaimsDeps = {
+	probePid,
+	now: () => new Date().toISOString(),
+};
+
+function probePid(pid: number): Promise<LinuxProcPidProbeResult> {
+	return probeLinuxProcPid(pid);
+}
+
+function assertClaimOwner(owner: MemoryGuardClaimOwner): void {
+	for (const [value, label] of [
+		[owner.sessionId, "memory guard session id"],
+		[owner.generation, "memory guard generation"],
+		[owner.runId, "memory guard run id"],
+		[owner.childToken, "memory guard child token"],
+	] as const) {
+		assertSafePathComponent(value, label);
+	}
+	if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) throw new Error("memory_guard_claim_invalid_pid");
+	if (!/^\d+$/.test(owner.processStartTime)) throw new Error("memory_guard_claim_invalid_process_start_time");
+	if (!/^-?\d+$/.test(owner.ttyDevice)) throw new Error("memory_guard_claim_invalid_tty_device");
+}
+
+async function prepareClaimDirectory(root: string): Promise<void> {
+	await fs.mkdir(root, { recursive: true, mode: 0o700 });
+	await fs.chmod(root, 0o700);
+}
+
+async function enforceDatabaseModes(databaseFile: string): Promise<void> {
+	for (const file of [databaseFile, `${databaseFile}-wal`, `${databaseFile}-shm`]) {
+		await fs.chmod(file, 0o600).catch(() => undefined);
+	}
+}
+
+function configureClaimsDatabase(database: Database): void {
+	database.exec("PRAGMA journal_mode = WAL");
+	database.exec("PRAGMA synchronous = FULL");
+	database.exec(`PRAGMA busy_timeout = ${MEMORY_GUARD_SQLITE_BUSY_TIMEOUT_MS}`);
+	database.exec(`
+		CREATE TABLE IF NOT EXISTS meta(
+			key TEXT PRIMARY KEY,
+			value TEXT NOT NULL
+		);
+		INSERT OR IGNORE INTO meta(key, value) VALUES ('epoch', '0');
+		CREATE TABLE IF NOT EXISTS claims(
+			resource TEXT PRIMARY KEY CHECK(resource IN ('writer', 'tty')),
+			epoch INTEGER NOT NULL,
+			session_id TEXT NOT NULL,
+			generation TEXT NOT NULL,
+			run_id TEXT NOT NULL,
+			child_token TEXT NOT NULL,
+			pid INTEGER NOT NULL,
+			process_start_time TEXT NOT NULL,
+			tty_device TEXT NOT NULL,
+			acquired_at TEXT NOT NULL
+		);
+	`);
+}
+
+async function openClaimsDatabase(
+	stateDir: string,
+	sessionId: string,
+): Promise<{ database: Database; databaseFile: string }> {
+	assertSafePathComponent(sessionId, "memory guard session id");
+	const paths = memoryGuardClaimPaths(stateDir, sessionId);
+	await prepareClaimDirectory(paths.root);
+	const database = new Database(paths.databaseFile, { create: true });
+	configureClaimsDatabase(database);
+	await enforceDatabaseModes(paths.databaseFile);
+	return { database, databaseFile: paths.databaseFile };
+}
+
+function readEpoch(database: Database): number {
+	const row = database.prepare("SELECT value FROM meta WHERE key = 'epoch'").get() as { value: string } | null;
+	if (!row || !/^\d+$/.test(row.value)) throw new Error("memory_guard_claim_epoch_invalid");
+	const value = Number(row.value);
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error("memory_guard_claim_epoch_invalid");
+	return value;
+}
+
+function allocateEpoch(database: Database): number {
+	const next = readEpoch(database) + 1;
+	if (!Number.isSafeInteger(next) || next <= 0) throw new Error("memory_guard_claim_epoch_overflow");
+	database.prepare("UPDATE meta SET value = ? WHERE key = 'epoch'").run(String(next));
+	return next;
+}
+
+function readClaimRows(database: Database): PersistedMemoryGuardClaimRow[] {
+	const rows = database
+		.prepare(
+			"SELECT resource, epoch, session_id, generation, run_id, child_token, pid, process_start_time, tty_device, acquired_at FROM claims ORDER BY resource ASC",
+		)
+		.all() as PersistedMemoryGuardClaimRow[];
+	for (const row of rows) {
+		if (!MEMORY_GUARD_CLAIM_RESOURCES.includes(row.resource)) throw new Error("memory_guard_claim_resource_invalid");
+		if (!Number.isSafeInteger(row.epoch) || row.epoch <= 0) throw new Error("memory_guard_claim_epoch_invalid");
+	}
+	return rows;
+}
+
+async function assertLiveOwner(owner: MemoryGuardClaimOwner, deps: MemoryGuardOwnerClaimsDeps): Promise<void> {
+	const probe = await deps.probePid(owner.pid);
+	if (probe.kind !== "live")
+		throw new Error(
+			`memory_guard_claim_owner_unverifiable:${probe.kind === "unverifiable" ? probe.reason : "absent"}`,
+		);
+	if (probe.startTime !== owner.processStartTime) throw new Error("memory_guard_claim_owner_start_time_mismatch");
+	if (probe.ttyDevice !== owner.ttyDevice) throw new Error("memory_guard_claim_owner_tty_mismatch");
+}
+
+async function classifyExistingRow(
+	row: PersistedMemoryGuardClaimRow,
+	deps: MemoryGuardOwnerClaimsDeps,
+): Promise<"live" | "reclaim"> {
+	const probe = await deps.probePid(row.pid);
+	if (probe.kind === "absent") return "reclaim";
+	if (probe.kind === "live") return probe.startTime === row.process_start_time ? "live" : "reclaim";
+	throw new Error(`memory_guard_claim_existing_owner_unverifiable:${probe.reason}`);
+}
+
+function claimRowsEqual(left: PersistedMemoryGuardClaimRow[], right: PersistedMemoryGuardClaimRow[]): boolean {
+	return JSON.stringify(left) === JSON.stringify(right);
+}
+
+async function inspectExistingRows(
+	rows: PersistedMemoryGuardClaimRow[],
+	deps: MemoryGuardOwnerClaimsDeps,
+	liveError: (resource: MemoryGuardClaimResource) => Error,
+): Promise<void> {
+	for (const row of rows) {
+		const state = await classifyExistingRow(row, deps);
+		if (state === "live") throw liveError(row.resource);
+	}
+}
+
+function insertClaimRow(
+	database: Database,
+	resource: MemoryGuardClaimResource,
+	epoch: number,
+	owner: MemoryGuardClaimOwner,
+	acquiredAt: string,
+): void {
+	database
+		.prepare(
+			"INSERT INTO claims(resource, epoch, session_id, generation, run_id, child_token, pid, process_start_time, tty_device, acquired_at) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+		)
+		.run(
+			resource,
+			epoch,
+			owner.sessionId,
+			owner.generation,
+			owner.runId,
+			owner.childToken,
+			owner.pid,
+			owner.processStartTime,
+			owner.ttyDevice,
+			acquiredAt,
+		);
+}
+
+function deleteExactClaimRow(
+	database: Database,
+	resource: MemoryGuardClaimResource,
+	epoch: number,
+	owner: MemoryGuardClaimOwner,
+): number {
+	return database
+		.prepare(
+			"DELETE FROM claims WHERE resource = ? AND epoch = ? AND session_id = ? AND generation = ? AND run_id = ? AND child_token = ? AND pid = ? AND process_start_time = ? AND tty_device = ?",
+		)
+		.run(
+			resource,
+			epoch,
+			owner.sessionId,
+			owner.generation,
+			owner.runId,
+			owner.childToken,
+			owner.pid,
+			owner.processStartTime,
+			owner.ttyDevice,
+		).changes;
+}
+
+function rollbackQuietly(database: Database): void {
+	try {
+		database.exec("ROLLBACK");
+	} catch {
+		return;
+	}
+}
+
+export function memoryGuardClaimsDatabaseFile(stateDir: string, sessionId: string): string {
+	return memoryGuardClaimPaths(stateDir, sessionId).databaseFile;
+}
+
+export async function acquireMemoryGuardClaims(
+	stateDir: string,
+	owner: MemoryGuardClaimOwner,
+	deps: MemoryGuardOwnerClaimsDeps = defaultDeps,
+): Promise<MemoryGuardClaimsLease> {
+	assertClaimOwner(owner);
+	await assertLiveOwner(owner, deps);
+	const { database, databaseFile } = await openClaimsDatabase(stateDir, owner.sessionId);
+	try {
+		for (let attempt = 0; attempt < 3; attempt += 1) {
+			const inspectedRows = readClaimRows(database);
+			await inspectExistingRows(
+				inspectedRows,
+				deps,
+				resource => new Error(`memory_guard_claim_live_contention:${resource}`),
+			);
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				if (!claimRowsEqual(inspectedRows, readClaimRows(database))) {
+					database.exec("ROLLBACK");
+					continue;
+				}
+				database.exec("DELETE FROM claims");
+				const acquiredAt = deps.now();
+				const writerEpoch = allocateEpoch(database);
+				insertClaimRow(database, "writer", writerEpoch, owner, acquiredAt);
+				const ttyEpoch = allocateEpoch(database);
+				insertClaimRow(database, "tty", ttyEpoch, owner, acquiredAt);
+				database.exec("COMMIT");
+				await enforceDatabaseModes(databaseFile);
+				return issueMemoryGuardClaimsLease({ writerEpoch, ttyEpoch, owner, claimStorePath: databaseFile });
+			} catch (error) {
+				rollbackQuietly(database);
+				throw error;
+			}
+		}
+		throw new Error("memory_guard_claim_rows_changed");
+	} finally {
+		database.close();
+	}
+}
+
+export async function releaseMemoryGuardClaims(stateDir: string, claim: MemoryGuardClaimsLease): Promise<void> {
+	if (!issuedMemoryGuardClaimsLeases.has(claim)) throw new Error("memory_guard_claim_lease_invalid");
+	assertClaimOwner(claim.owner);
+	const expectedDatabaseFile = memoryGuardClaimPaths(stateDir, claim.owner.sessionId).databaseFile;
+	if (claim.claimStorePath !== expectedDatabaseFile) throw new Error("memory_guard_claim_store_mismatch");
+	const { database } = await openClaimsDatabase(stateDir, claim.owner.sessionId);
+	try {
+		database.exec("BEGIN IMMEDIATE");
+		const writerChanges = deleteExactClaimRow(database, "writer", claim.writerEpoch, claim.owner);
+		const ttyChanges = deleteExactClaimRow(database, "tty", claim.ttyEpoch, claim.owner);
+		if (writerChanges !== 1 || ttyChanges !== 1) throw new Error("memory_guard_claim_release_mismatch");
+		database.exec("COMMIT");
+		issuedMemoryGuardClaimsLeases.delete(claim);
+	} catch (error) {
+		rollbackQuietly(database);
+		throw error;
+	} finally {
+		database.close();
+	}
+}
+
+export async function probeMemoryGuardClaimsReleased(
+	stateDir: string,
+	owner: MemoryGuardClaimOwner,
+	deps: MemoryGuardOwnerClaimsDeps = defaultDeps,
+): Promise<MemoryGuardClaimsReleasedProof> {
+	assertClaimOwner(owner);
+	await assertLiveOwner(owner, deps);
+	const { database, databaseFile } = await openClaimsDatabase(stateDir, owner.sessionId);
+	try {
+		for (let attempt = 0; attempt < 3; attempt += 1) {
+			const inspectedRows = readClaimRows(database);
+			await inspectExistingRows(
+				inspectedRows,
+				deps,
+				resource => new Error(`memory_guard_claims_still_live:${resource}`),
+			);
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				if (!claimRowsEqual(inspectedRows, readClaimRows(database))) {
+					database.exec("ROLLBACK");
+					continue;
+				}
+				database.exec("DELETE FROM claims");
+				const acquiredAt = deps.now();
+				const writerEpoch = allocateEpoch(database);
+				insertClaimRow(database, "writer", writerEpoch, owner, acquiredAt);
+				const ttyEpoch = allocateEpoch(database);
+				insertClaimRow(database, "tty", ttyEpoch, owner, acquiredAt);
+				database.exec("COMMIT");
+				await enforceDatabaseModes(databaseFile);
+				const proof = issueMemoryGuardClaimsLease({ writerEpoch, ttyEpoch, owner, claimStorePath: databaseFile });
+				await releaseMemoryGuardClaims(stateDir, proof);
+				return proof;
+			} catch (error) {
+				rollbackQuietly(database);
+				throw error;
+			}
+		}
+		throw new Error("memory_guard_claim_rows_changed");
+	} finally {
+		database.close();
+	}
+}
+
+export interface PersistedMemoryGuardClaimsSnapshot {
+	epoch: number;
+	claims: PersistedMemoryGuardClaimRow[];
+}
+
+export async function readMemoryGuardClaimsForTest(
+	stateDir: string,
+	sessionId: string,
+): Promise<PersistedMemoryGuardClaimsSnapshot> {
+	const { database } = await openClaimsDatabase(stateDir, sessionId);
+	try {
+		return {
+			epoch: readEpoch(database),
+			claims: readClaimRows(database),
+		};
+	} finally {
+		database.close();
+	}
+}