@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/sdk/broker/hop.ts

@@ -0,0 +1,274 @@
+import * as childProcess from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as process from "node:process";
+import type * as stream from "node:stream";
+import type { Process } from "@gajae-code/natives";
+import { nativeProcessBindings } from "@gajae-code/utils/native-process";
+import type { BrokerHopMessage } from "./ensure";
+
+export const BROKER_HANDOFF_ACKNOWLEDGEMENT = "GJC_BROKER_HANDOFF_ACK\n";
+export const BROKER_HANDOFF_COMMIT = "GJC_BROKER_HANDOFF_COMMIT\n";
+export const BROKER_HANDOFF_ABORT = "GJC_BROKER_HANDOFF_ABORT\n";
+
+/**
+ * Windows broker hop: spawns the real broker with detached:true and reports its pid.
+ *
+ * The hop is needed because a broker spawned with detached:true IS still killed when the
+ * parent process tree is terminated (e.g., by taskkill /T /F on Windows). Using an
+ * intermediate hop process that exits after spawning the real broker allows the broker
+ * to survive, because the hop's parent (the initiating client) can be killed without
+ * affecting the broker (the hop's pid is no longer valid).
+ *
+ * Invoked by gjc internals only. Usage:
+ *   gjc internal broker-hop <json-encoded-args>
+ *
+ * Exits with code 0 after writing the broker pid/incarnation to stdout and
+ * receiving the parent's acknowledgement. If stdin closes first, it terminates
+ * the pinned broker and exits with code 1.
+ */
+
+export async function runBrokerHopFromArgv(argv: string[]): Promise<void> {
+	if (argv.length !== 1) fail("broker hop requires exactly one argument");
+	let message: BrokerHopMessage;
+	try {
+		message = JSON.parse(argv[0]) as BrokerHopMessage;
+	} catch (error) {
+		fail(`broker hop JSON parse error: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!message.command?.file || !Array.isArray(message.command.args)) fail("broker hop message missing command");
+	try {
+		// stderr is opened here by path: a parent fd number is meaningless in this process.
+		const stderr = message.stderrLogPath ? fs.openSync(message.stderrLogPath, "a") : "ignore";
+		// The broker inherits this process's environment, which the parent set to the
+		// broker environment; it is never carried on the command line.
+		const child = childProcess.spawn(message.command.file, message.command.args, {
+			detached: true,
+			windowsHide: true,
+			stdio: ["ignore", "ignore", stderr],
+			env: process.env,
+			...(message.cwd ? { cwd: message.cwd } : {}),
+		});
+		if (typeof stderr === "number") fs.closeSync(stderr);
+		const spawned = Promise.withResolvers<void>();
+		child.once("spawn", spawned.resolve);
+		child.once("error", spawned.reject);
+		await spawned.promise;
+		const pid = child.pid;
+		if (pid === undefined) fail("broker hop spawn succeeded but child pid unavailable");
+		const childReference = getSpawnedChildReference(pid);
+		if (!childReference) {
+			const cleanup = await terminateUnverifiableWindowsChild(child);
+			fail(`broker process identity could not be bound to the spawned child; ${cleanup}`);
+		}
+		const handoff = await writeBrokerHopReply(child, childReference, pid, writeBrokerHopStdout, () =>
+			waitForBrokerHandoffAcknowledgement(process.stdin),
+		);
+		if (handoff.kind === "failed") fail(handoff.reason);
+		process.exit(0);
+	} catch (error) {
+		fail(`broker hop spawn failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+
+type BrokerHopWriteCallback = (error?: Error | null) => void;
+type BrokerHopWriter = (chunk: string, callback: BrokerHopWriteCallback) => void;
+type BrokerHopAcknowledger = () => Promise<boolean>;
+
+async function writeBrokerHopReply(
+	child: childProcess.ChildProcess,
+	reference: Process,
+	pid: number,
+	write: BrokerHopWriter,
+	waitForAcknowledgement: BrokerHopAcknowledger,
+): Promise<{ kind: "written" } | { kind: "failed"; reason: string }> {
+	const completion = Promise.withResolvers<void>();
+	const acknowledgementPromise = waitForAcknowledgement();
+	let settled = false;
+	const settle = (error?: Error | null): void => {
+		if (settled) return;
+		settled = true;
+		if (error) completion.reject(error);
+		else completion.resolve();
+	};
+	try {
+		write(`${JSON.stringify({ pid, incarnation: reference.incarnation })}\n`, settle);
+	} catch (error) {
+		settle(error instanceof Error ? error : new Error(String(error)));
+	}
+	try {
+		await completion.promise;
+	} catch (error) {
+		const writeError = error instanceof Error ? error : new Error(String(error));
+		const cleanup = await terminateBrokerAfterFailedHandoff(reference);
+		return {
+			kind: "failed",
+			reason: `broker hop handoff failed for pid ${pid}: ${cleanup}; ${writeError.message}`,
+		};
+	}
+	let acknowledged = false;
+	let acknowledgementError: string | undefined;
+	try {
+		acknowledged = await acknowledgementPromise;
+	} catch (error) {
+		acknowledgementError = error instanceof Error ? error.message : String(error);
+	}
+	if (!acknowledged) {
+		const cleanup = await terminateBrokerAfterFailedHandoff(reference);
+		return {
+			kind: "failed",
+			reason: `broker hop handoff was not acknowledged for pid ${pid}: ${cleanup}${acknowledgementError ? `; ${acknowledgementError}` : ""}`,
+		};
+	}
+	child.unref();
+	return { kind: "written" };
+}
+
+export function writeBrokerHopReplyForTest(
+	child: childProcess.ChildProcess,
+	reference: Process,
+	pid: number,
+	write: BrokerHopWriter,
+	waitForAcknowledgement: BrokerHopAcknowledger = async () => true,
+): Promise<{ kind: "written" } | { kind: "failed"; reason: string }> {
+	return writeBrokerHopReply(child, reference, pid, write, waitForAcknowledgement);
+}
+
+export function waitForBrokerHandoffAcknowledgement(input: stream.Readable): Promise<boolean> {
+	const acknowledgment = Promise.withResolvers<boolean>();
+	let received = "";
+	let settled = false;
+	const finish = (accepted: boolean): void => {
+		if (settled) return;
+		settled = true;
+		input.removeListener("data", onData);
+		input.removeListener("end", onEnd);
+		input.removeListener("close", onEnd);
+		input.removeListener("error", onEnd);
+		acknowledgment.resolve(accepted);
+	};
+	const onData = (chunk: Buffer | string): void => {
+		received += chunk.toString();
+		if (received.length > BROKER_HANDOFF_ACKNOWLEDGEMENT.length) {
+			finish(false);
+			return;
+		}
+		if (received.includes("\n")) finish(received === BROKER_HANDOFF_ACKNOWLEDGEMENT);
+	};
+	const onEnd = (): void => finish(false);
+	input.on("data", onData);
+	input.once("end", onEnd);
+	input.once("close", onEnd);
+	input.once("error", onEnd);
+	input.resume();
+	return acknowledgment.promise;
+}
+
+/** Wait for a validated identity ACK followed by the parent's publication decision. */
+export function waitForBrokerHandoffDecision(input: stream.Readable, timeoutMs = 30_000): Promise<"commit" | "abort"> {
+	const decision = Promise.withResolvers<"commit" | "abort">();
+	let received = "";
+	let settled = false;
+	const finish = (value: "commit" | "abort"): void => {
+		if (settled) return;
+		settled = true;
+		clearTimeout(timer);
+		input.removeListener("data", onData);
+		input.removeListener("end", onEnd);
+		input.removeListener("close", onEnd);
+		input.removeListener("error", onEnd);
+		decision.resolve(value);
+	};
+	const onData = (chunk: Buffer | string): void => {
+		received += chunk.toString();
+		if (received.length > BROKER_HANDOFF_ACKNOWLEDGEMENT.length + BROKER_HANDOFF_COMMIT.length) {
+			finish("abort");
+			return;
+		}
+		if (received.length < BROKER_HANDOFF_ACKNOWLEDGEMENT.length) {
+			if (!BROKER_HANDOFF_ACKNOWLEDGEMENT.startsWith(received)) finish("abort");
+			return;
+		}
+		if (!received.startsWith(BROKER_HANDOFF_ACKNOWLEDGEMENT)) {
+			finish("abort");
+			return;
+		}
+		const action = received.slice(BROKER_HANDOFF_ACKNOWLEDGEMENT.length);
+		if (action === BROKER_HANDOFF_COMMIT) finish("commit");
+		else if (action === BROKER_HANDOFF_ABORT) finish("abort");
+		else if (!BROKER_HANDOFF_COMMIT.startsWith(action) && !BROKER_HANDOFF_ABORT.startsWith(action)) finish("abort");
+	};
+	const onEnd = (): void => finish("abort");
+	const timer = setTimeout(() => finish("abort"), timeoutMs);
+	input.on("data", onData);
+	input.once("end", onEnd);
+	input.once("close", onEnd);
+	input.once("error", onEnd);
+	input.resume();
+	return decision.promise;
+}
+
+const writeBrokerHopStdout: BrokerHopWriter = (chunk, callback): void => {
+	const onError = (error: Error): void => {
+		process.stdout.removeListener("error", onError);
+		callback(error);
+	};
+	process.stdout.once("error", onError);
+	try {
+		process.stdout.write(chunk, error => {
+			process.stdout.removeListener("error", onError);
+			callback(error);
+		});
+	} catch (error) {
+		process.stdout.removeListener("error", onError);
+		callback(error instanceof Error ? error : new Error(String(error)));
+	}
+};
+
+/** Pin only the still-running direct child so a reused PID cannot be adopted. */
+function getSpawnedChildReference(pid: number): Process | undefined {
+	try {
+		const reference = nativeProcessBindings().Process.fromPid(pid);
+		if (!reference || reference.pid !== pid || reference.ppid !== process.pid || reference.status() !== "running")
+			return undefined;
+		return reference;
+	} catch {
+		return undefined;
+	}
+}
+
+async function terminateUnverifiableWindowsChild(child: childProcess.ChildProcess): Promise<string> {
+	if (process.platform !== "win32") return "no signal was sent without a verified process identity";
+	if (child.exitCode !== null || child.signalCode !== null) return "the spawned child already exited";
+	const exited = Promise.withResolvers<void>();
+	child.once("exit", exited.resolve);
+	child.once("close", exited.resolve);
+	child.on("error", () => {});
+	try {
+		child.kill("SIGKILL");
+	} catch {
+		// The process handle remains exact; inspect its exit state below.
+	}
+	await Promise.race([exited.promise, Bun.sleep(500)]);
+	return child.exitCode !== null || child.signalCode !== null
+		? "the exact spawned child was terminated"
+		: "termination of the exact spawned child was not confirmed";
+}
+
+async function terminateBrokerAfterFailedHandoff(reference: Process): Promise<string> {
+	let cleanup: string;
+	try {
+		if (reference.status() === "running") reference.signalRoot(os.constants.signals.SIGKILL);
+		const exited = await reference.waitForExit({ timeoutMs: 500 });
+		cleanup =
+			exited || reference.status() !== "running" ? "broker terminated" : "broker termination was not confirmed";
+	} catch (error) {
+		cleanup = `broker termination failed: ${error instanceof Error ? error.message : String(error)}`;
+	}
+	return cleanup;
+}
+
+function fail(message: string): never {
+	process.stderr.write(`gjc: ${message}\n`);
+	process.exit(1);
+}

package/src/sdk/broker/lifecycle-ledger.ts

@@ -130,6 +130,10 @@ type BoundedSourceRead =
 
 const terminal = (s: LifecycleState) => s === "terminal_ok" || s === "terminal_error";
 const final = (s: LifecycleState) => terminal(s) || s === "terminal_uncertain";
+const recordedSessionIds = (entry: LifecycleLedgerEntry): string[] =>
+	[entry.intendedSessionId, entry.resultSessionId].filter(
+		(sessionId): sessionId is string => typeof sessionId === "string" && sessionId.length > 0,
+	);
 export interface LifecycleLedgerLimits {
 	maxBytes?: number;
 	maxLineBytes?: number;
@@ -795,27 +799,47 @@ export class LifecycleLedger {
 		return [...this.#byIdentity.values()].findLast(entry => entry.operationKey === operationKey);
 	}
 	/**
-	 * Live or uncertain legacy rows predate the operation/key index. Their opaque
-	 * identities cannot establish that a different target is safe, so callers
-	 * must reject rather than create a second admission. A fresh session.create
-	 * may ignore completed terminal legacy rows so old successful operations do
-	 * not block coordinator startup. Other operations retain the legacy fence
-	 * because target-bound legacy identities cannot prove key uniqueness. For
-	 * target-bound terminal creates, the opaque legacy identity also cannot reveal
-	 * the original caller key, so this exception retires that legacy key history;
-	 * exact key-only legacy creates are still rejected by the earlier lookup.
+	 * Live legacy rows predate the operation/key index. Their opaque identities
+	 * cannot establish that a different target is safe, so callers must reject
+	 * rather than create a second admission. A fresh session.create may ignore
+	 * final legacy rows: exact legacy identities are still resolved before this
+	 * check, and uncertain rows retain their session-scoped fences.
+	 *
+	 * A session-targeted request passes `sessionTarget` to ignore terminal legacy
+	 * rows that record only other sessions, unless the row is the caller's key
+	 * reused across targets (`keyReuseIdentities`). Terminal rows recording the
+	 * target or no session, uncertain rows, and live rows keep the fence because
+	 * they cannot prove the requested target is unrelated.
 	 */
 	hasLegacyIdentity(
 		excludedIdentities?: ReadonlySet<string>,
-		options: { ignoreTerminalRows?: boolean } = {},
+		options: {
+			ignoreFinalRows?: boolean;
+			sessionTarget?: { sessionId: string; keyReuseIdentities: ReadonlySet<string> };
+		} = {},
 	): boolean {
+		const target = options.sessionTarget;
+		const unrelatedTerminal = (entry: LifecycleLedgerEntry): boolean => {
+			if (!target || !terminal(entry.state) || target.keyReuseIdentities.has(entry.identity)) return false;
+			const sessionIds = recordedSessionIds(entry);
+			return sessionIds.length > 0 && !sessionIds.includes(target.sessionId);
+		};
 		return [...this.#byIdentity.values()].some(
 			entry =>
 				entry.operationKey === undefined &&
-				!(options.ignoreTerminalRows && terminal(entry.state)) &&
+				!(options.ignoreFinalRows && final(entry.state)) &&
+				!unrelatedTerminal(entry) &&
 				!excludedIdentities?.has(entry.identity),
 		);
 	}
+	/** Sessions recorded by terminal legacy rows, for deriving key-reuse identities. */
+	terminalLegacySessionIds(): Set<string> {
+		const sessionIds = new Set<string>();
+		for (const entry of this.#byIdentity.values())
+			if (entry.operationKey === undefined && terminal(entry.state))
+				for (const sessionId of recordedSessionIds(entry)) sessionIds.add(sessionId);
+		return sessionIds;
+	}
 	async migrateIdentity(
 		from: string,
 		to: string,

package/src/sdk/broker/lock-host-identity.ts

@@ -0,0 +1,29 @@
+import path from "node:path";
+import { loadInstallationHostId, loadLegacyInstallationHostId } from "../../config/machine-identity";
+
+export interface BrokerLockHostIdentity {
+	ownerHostId: string;
+	previousOwnerHostIds: readonly string[];
+}
+
+const brokerLockHostIdentityPromises = new Map<string, Promise<BrokerLockHostIdentity>>();
+
+export async function brokerLockHostIdentity(agentDir: string): Promise<BrokerLockHostIdentity> {
+	const coordinationRoot = path.resolve(agentDir, "sdk");
+	const pending =
+		brokerLockHostIdentityPromises.get(coordinationRoot) ??
+		Promise.all([loadInstallationHostId({ configRootDir: coordinationRoot }), loadLegacyInstallationHostId()]).then(
+			([ownerHostId, legacyHostId]) => ({
+				ownerHostId,
+				previousOwnerHostIds: legacyHostId === ownerHostId ? [] : [legacyHostId],
+			}),
+		);
+	brokerLockHostIdentityPromises.set(coordinationRoot, pending);
+	try {
+		return await pending;
+	} catch (error) {
+		if (brokerLockHostIdentityPromises.get(coordinationRoot) === pending)
+			brokerLockHostIdentityPromises.delete(coordinationRoot);
+		throw error;
+	}
+}

package/src/sdk/broker/session-index.ts

@@ -3,7 +3,12 @@ import * as fs from "node:fs/promises";
 import path from "node:path";
 import { logger, resolveEquivalentPath } from "@gajae-code/utils";
 import { nativeProcessBindings } from "@gajae-code/utils/native-process";
-import { type FileLockOptions, isFileLockAcquireTimeout, withFileLock } from "../../config/file-lock";
+import {
+	FILE_LOCK_ORPHAN_TRANSITION_ADOPTION_AGE_MS,
+	type FileLockOptions,
+	isFileLockAcquireTimeout,
+	withFileLock,
+} from "../../config/file-lock";
 import { repo } from "../../utils/git";
 import { endpointIncarnation } from "./endpoint-authority";
 import { processIncarnation } from "./process-incarnation";
@@ -574,6 +579,7 @@ function projectIdentity(
 	ambiguous: boolean,
 	now: number,
 	probedIncarnations?: ReadonlyMap<string, string | undefined>,
+	skipOsProcessProbes = false,
 ): IndexedSession {
 	const { latest, heartbeat } = state;
 	const terminal = isTerminalEvent(latest);
@@ -582,7 +588,7 @@ function projectIdentity(
 		latest.hostUnregisteredReason === "process_exited" || latest.hostUnregisteredReason === "detached_idle"
 			? latest.hostUnregisteredReason
 			: undefined;
-	const pidAlive = alive(latest.pid);
+	const pidAlive = !skipOsProcessProbes && alive(latest.pid);
 	// Liveness evidence is host-written: a checkpointed heartbeat, or the
 	// `host_registered` event the host appended itself. Counting registration
 	// closes the up-to-one-interval window where a just-registered session
@@ -602,7 +608,7 @@ function projectIdentity(
 	// costing a powershell.exe spawn per stale registration on Windows.
 	const probeKey = `${latest.sessionId}\u0000${latest.endpointGeneration}\u0000${latest.pid}`;
 	const currentIncarnation =
-		recordedIncarnation === undefined || !pidAlive
+		skipOsProcessProbes || recordedIncarnation === undefined || !pidAlive
 			? undefined
 			: probedIncarnations !== undefined
 				? probedIncarnations.get(probeKey)
@@ -654,7 +660,9 @@ function reduceEvents(
 	agentDir: string,
 	probedIncarnations?: ReadonlyMap<string, string | undefined>,
 	sessionIds?: ReadonlySet<string>,
+	options: { readonly skipOsProcessProbes?: boolean } = {},
 ): SessionIndexProjection {
+	const skipOsProcessProbes = options.skipOsProcessProbes === true;
 	// Resolved once: the fence-row check runs per root, and only this side of the
 	// comparison is ours to normalize.
 	const agentDirIdentity = resolveEquivalentPath(agentDir);
@@ -741,7 +749,8 @@ function reduceEvents(
 		const fencing = fencingRoots.get(sessionId);
 		const unresolved = unresolvedRoots.get(sessionId);
 		const ambiguous = (fencing?.size ?? 0) > 1;
-		for (const state of states) identities.push(projectIdentity(state, ambiguous, now, probedIncarnations));
+		for (const state of states)
+			identities.push(projectIdentity(state, ambiguous, now, probedIncarnations, skipOsProcessProbes));
 		const defaultAuthority = preferredIdentity(states);
 		if (defaultAuthority === undefined || defaultAuthority.latest.type === "session_deleted") continue;
 		let authority = defaultAuthority;
@@ -754,14 +763,42 @@ function reduceEvents(
 			const survivingAuthority = onlyRoot ? preferredIdentity(onlyRoot) : undefined;
 			if (survivingAuthority !== undefined) authority = survivingAuthority;
 		}
-		sessions.push(projectIdentity(authority, ambiguous, now, probedIncarnations));
+		sessions.push(projectIdentity(authority, ambiguous, now, probedIncarnations, skipOsProcessProbes));
 	}
 	return { identities, sessions };
 }
 
 // Global launch bursts may queue behind legitimate long index transactions. Keep
 // this bounded at one minute while the shared lock's exact dead-owner recovery runs.
-const SESSION_INDEX_LOCK_OPTIONS = { retries: 600, retryDelayMs: 100 } as const;
+const SESSION_INDEX_LOCK_OPTIONS = {
+	retries: 600,
+	retryDelayMs: 100,
+	orphanTransitionAgeMs: FILE_LOCK_ORPHAN_TRANSITION_ADOPTION_AGE_MS,
+} as const;
+// Leave one retry interval beyond the transition's safe-adoption age so a fresh
+// ownerless transition can be reclaimed during ordinary startup.
+const SESSION_INDEX_STARTUP_LOCK_WAIT_MS =
+	FILE_LOCK_ORPHAN_TRANSITION_ADOPTION_AGE_MS + SESSION_INDEX_LOCK_OPTIONS.retryDelayMs * 2;
+
+/** Bound ordinary bootstrap waits; authorized doctor successors may use the full prepared window. */
+export function sessionIndexStartupLockOptions(
+	deadline: number,
+	signal?: AbortSignal,
+	policy: "ordinary" | "authorized-successor" = "ordinary",
+): FileLockOptions {
+	const boundedDeadline =
+		policy === "authorized-successor"
+			? deadline
+			: Math.min(deadline, performance.now() + SESSION_INDEX_STARTUP_LOCK_WAIT_MS);
+	return {
+		...SESSION_INDEX_LOCK_OPTIONS,
+		retries: Math.min(
+			SESSION_INDEX_LOCK_OPTIONS.retries,
+			Math.max(1, Math.ceil((boundedDeadline - performance.now()) / SESSION_INDEX_LOCK_OPTIONS.retryDelayMs)),
+		),
+		...(signal === undefined ? {} : { signal }),
+	};
+}
 
 /**
  * Observation window for one locked index transaction (#4544). This never times
@@ -1183,7 +1220,7 @@ export class SessionIndex {
 		});
 		return promise;
 	}
-	async open(): Promise<this> {
+	async open(options: FileLockOptions = SESSION_INDEX_LOCK_OPTIONS): Promise<this> {
 		const indexPath = path.resolve(logFor(this.#agentDir));
 		let group = SessionIndex.#openGroups.get(indexPath);
 		if (!group || group.closed) {
@@ -1193,7 +1230,7 @@ export class SessionIndex {
 		}
 		await group.promise;
 		await SessionIndex.#enqueue(indexPath, () =>
-			withSessionIndexLock("replay", this.#agentDir, () => this.#replayUnderLock()),
+			withSessionIndexLock("replay", this.#agentDir, () => this.#replayUnderLock(), options),
 		);
 		return this;
 	}
@@ -2455,14 +2492,25 @@ export class SessionIndex {
 			// revalidation that never probes the OS under the lock: the next pass
 			// re-probes from scratch.
 			const probed = new Map<string, string | undefined>();
-			for (const row of reduceEvents(this.#events, now, this.#agentDir).sessions) {
+			// This projection is only used to select structurally eligible rows; its
+			// `live` field is not consumed here. Skip OS probes during projection so
+			// the deadline-aware loop below performs only the required observations.
+			const candidates = reduceEvents(this.#events, now, this.#agentDir, undefined, undefined, {
+				skipOsProcessProbes: true,
+			}).sessions;
+			if (signal.aborted || performance.now() >= deadline) return 0;
+			for (const row of candidates) {
+				if (signal.aborted || performance.now() >= deadline) return 0;
 				if (!isSessionAuthorityEligible(row) || row.terminal || row.terminalUncertain) continue;
 				if (row.lastHeartbeatAt !== undefined && now - row.lastHeartbeatAt < SESSION_HEARTBEAT_INTERVAL_MS)
 					continue;
-				if (!alive(row.pid)) continue;
 				const recordedIncarnation = row.hostIncarnation ?? row.processIncarnation;
 				if (recordedIncarnation === undefined) continue;
-				probed.set(`${row.sessionId}\u0000${row.endpointGeneration}\u0000${row.pid}`, processIncarnation(row.pid));
+				if (!alive(row.pid)) continue;
+				if (signal.aborted || performance.now() >= deadline) return 0;
+				const currentIncarnation = processIncarnation(row.pid);
+				if (signal.aborted || performance.now() >= deadline) return 0;
+				probed.set(`${row.sessionId}\u0000${row.endpointGeneration}\u0000${row.pid}`, currentIncarnation);
 			}
 			const probedAt = performance.now();
 			if (signal.aborted || probedAt >= deadline) return 0;
@@ -2492,7 +2540,9 @@ export class SessionIndex {
 					if (performance.now() - probedAt > SESSION_INDEX_REPLAY_FRESHNESS_MS) return STALE_OBSERVATION;
 					if (this.#corruptSuffix) return 0;
 					const events: SessionIndexEvent[] = [];
-					const rows = reduceEvents(this.#events, now, this.#agentDir, probed).sessions;
+					const rows = reduceEvents(this.#events, now, this.#agentDir, probed, undefined, {
+						skipOsProcessProbes: true,
+					}).sessions;
 					for (const row of rows) {
 						if (!isSessionAuthorityEligible(row) || row.terminal || row.terminalUncertain) continue;
 						if (row.lastHeartbeatAt !== undefined && now - row.lastHeartbeatAt < SESSION_HEARTBEAT_INTERVAL_MS)

package/src/sdk/bus/chat-command-policy.ts

@@ -1,11 +1,15 @@
-import { validateAdapterSecretFields } from "../protocol/adapter-validation";
+import {
+	type AdapterValidationError,
+	validateAdapterControl,
+	validateAdapterSecretFields,
+} from "../protocol/adapter-validation";
 import { type Adapter, OPERATIONS, type Operation, type OperationKind } from "../protocol/operation-registry";
 
 export type ChatTransport = Extract<Adapter, "telegram" | "discord" | "slack">;
 export type ChatOperationDisposition = "allowed" | "unsupported_on_chat";
 
 export interface ChatCommandError {
-	code: "unsupported_on_chat" | "secret_input_forbidden";
+	code: "unsupported_on_chat" | "secret_input_forbidden" | "ultrafast_tier_forbidden" | AdapterValidationError["code"];
 	message: string;
 }
 
@@ -57,12 +61,21 @@ export function authorizeChatOperation(transport: ChatTransport, request: ChatOp
 		candidate => candidate.kind === request.kind && candidate.sdkId === request.operation,
 	);
 	if (!operation) return unsupported();
-	if (validateAdapterSecretFields(operation.sdkId, (request.input ?? {}) as Record<string, unknown>)) {
+	const secretValidation = validateAdapterSecretFields(
+		operation.sdkId,
+		(request.input ?? {}) as Record<string, unknown>,
+	);
+	if (secretValidation?.code === "secret_field_forbidden") {
 		return {
 			ok: false,
 			error: { code: "secret_input_forbidden", message: "Secret configuration input is forbidden on chat." },
 		};
 	}
+	if (secretValidation) return { ok: false, error: secretValidation };
+	if (operation.kind === "control") {
+		const invalid = validateAdapterControl(operation.sdkId, (request.input ?? {}) as Record<string, unknown>);
+		if (invalid) return { ok: false, error: invalid };
+	}
 	return CHAT_OPERATION_POLICY[transport][operation.id] === "allowed" ? { ok: true } : unsupported();
 }