@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/sdk/broker/hop.ts

@@ -0,0 +1,286 @@
+import * as childProcess from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as process from "node:process";
+import type * as stream from "node:stream";
+import type { Process } from "@gajae-code/natives";
+import { nativeProcessBindings } from "@gajae-code/utils/native-process";
+import type { BrokerHopMessage } from "./ensure";
+
+/** Handoff protocol frames written to the trampoline's stdin. */
+export const BROKER_HANDOFF_ACKNOWLEDGEMENT = "GJC_BROKER_HANDOFF_ACK\n";
+export const BROKER_HANDOFF_COMMIT = "GJC_BROKER_HANDOFF_COMMIT\n";
+export const BROKER_HANDOFF_ABORT = "GJC_BROKER_HANDOFF_ABORT\n";
+/**
+ * Backstop for a retained trampoline whose parent never sends a decision. It must
+ * outlive the parent's own broker discovery deadline (which is derived from the
+ * publication budget and can double across a guarded retry), otherwise the
+ * trampoline reaps the broker first and the parent misreports its own discovery
+ * timeout as an "exited before discovery" startup failure.
+ */
+export const BROKER_HANDOFF_DECISION_TIMEOUT_MS = 120_000;
+
+/**
+ * Windows broker hop: spawns the real broker with detached:true and reports its pid.
+ *
+ * The hop is needed because a broker spawned with detached:true IS still killed when the
+ * parent process tree is terminated (e.g., by taskkill /T /F on Windows). Using an
+ * intermediate hop process that exits after spawning the real broker allows the broker
+ * to survive, because the hop's parent (the initiating client) can be killed without
+ * affecting the broker (the hop's pid is no longer valid).
+ *
+ * Invoked by gjc internals only. Usage:
+ *   gjc internal broker-hop <json-encoded-args>
+ *
+ * Exits with code 0 after writing the broker pid/incarnation to stdout and
+ * receiving the parent's acknowledgement. If stdin closes first, it terminates
+ * the pinned broker and exits with code 1.
+ */
+
+export async function runBrokerHopFromArgv(argv: string[]): Promise<void> {
+	if (argv.length !== 1) fail("broker hop requires exactly one argument");
+	let message: BrokerHopMessage;
+	try {
+		message = JSON.parse(argv[0]) as BrokerHopMessage;
+	} catch (error) {
+		fail(`broker hop JSON parse error: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!message.command?.file || !Array.isArray(message.command.args)) fail("broker hop message missing command");
+	try {
+		// stderr is opened here by path: a parent fd number is meaningless in this process.
+		const stderr = message.stderrLogPath ? fs.openSync(message.stderrLogPath, "a") : "ignore";
+		// The broker inherits this process's environment, which the parent set to the
+		// broker environment; it is never carried on the command line.
+		const child = childProcess.spawn(message.command.file, message.command.args, {
+			detached: true,
+			windowsHide: true,
+			stdio: ["ignore", "ignore", stderr],
+			env: process.env,
+			...(message.cwd ? { cwd: message.cwd } : {}),
+		});
+		if (typeof stderr === "number") fs.closeSync(stderr);
+		const spawned = Promise.withResolvers<void>();
+		child.once("spawn", spawned.resolve);
+		child.once("error", spawned.reject);
+		await spawned.promise;
+		const pid = child.pid;
+		if (pid === undefined) fail("broker hop spawn succeeded but child pid unavailable");
+		const childReference = getSpawnedChildReference(pid);
+		if (!childReference) {
+			const cleanup = await terminateUnverifiableWindowsChild(child);
+			fail(`broker process identity could not be bound to the spawned child; ${cleanup}`);
+		}
+		const handoff = await writeBrokerHopReply(child, childReference, pid, writeBrokerHopStdout, () =>
+			waitForBrokerHandoffAcknowledgement(process.stdin),
+		);
+		if (handoff.kind === "failed") fail(handoff.reason);
+		process.exit(0);
+	} catch (error) {
+		fail(`broker hop spawn failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+
+type BrokerHopWriteCallback = (error?: Error | null) => void;
+type BrokerHopWriter = (chunk: string, callback: BrokerHopWriteCallback) => void;
+type BrokerHopAcknowledger = () => Promise<boolean>;
+
+async function writeBrokerHopReply(
+	child: childProcess.ChildProcess,
+	reference: Process,
+	pid: number,
+	write: BrokerHopWriter,
+	waitForAcknowledgement: BrokerHopAcknowledger,
+): Promise<{ kind: "written" } | { kind: "failed"; reason: string }> {
+	const completion = Promise.withResolvers<void>();
+	const acknowledgementPromise = waitForAcknowledgement();
+	let settled = false;
+	const settle = (error?: Error | null): void => {
+		if (settled) return;
+		settled = true;
+		if (error) completion.reject(error);
+		else completion.resolve();
+	};
+	try {
+		write(`${JSON.stringify({ pid, incarnation: reference.incarnation })}\n`, settle);
+	} catch (error) {
+		settle(error instanceof Error ? error : new Error(String(error)));
+	}
+	try {
+		await completion.promise;
+	} catch (error) {
+		const writeError = error instanceof Error ? error : new Error(String(error));
+		const cleanup = await terminateBrokerAfterFailedHandoff(reference);
+		return {
+			kind: "failed",
+			reason: `broker hop handoff failed for pid ${pid}: ${cleanup}; ${writeError.message}`,
+		};
+	}
+	let acknowledged = false;
+	let acknowledgementError: string | undefined;
+	try {
+		acknowledged = await acknowledgementPromise;
+	} catch (error) {
+		acknowledgementError = error instanceof Error ? error.message : String(error);
+	}
+	if (!acknowledged) {
+		const cleanup = await terminateBrokerAfterFailedHandoff(reference);
+		return {
+			kind: "failed",
+			reason: `broker hop handoff was not acknowledged for pid ${pid}: ${cleanup}${acknowledgementError ? `; ${acknowledgementError}` : ""}`,
+		};
+	}
+	child.unref();
+	return { kind: "written" };
+}
+
+export function writeBrokerHopReplyForTest(
+	child: childProcess.ChildProcess,
+	reference: Process,
+	pid: number,
+	write: BrokerHopWriter,
+	waitForAcknowledgement: BrokerHopAcknowledger = async () => true,
+): Promise<{ kind: "written" } | { kind: "failed"; reason: string }> {
+	return writeBrokerHopReply(child, reference, pid, write, waitForAcknowledgement);
+}
+
+export function waitForBrokerHandoffAcknowledgement(input: stream.Readable): Promise<boolean> {
+	const acknowledgment = Promise.withResolvers<boolean>();
+	let received = "";
+	let settled = false;
+	const finish = (accepted: boolean): void => {
+		if (settled) return;
+		settled = true;
+		input.removeListener("data", onData);
+		input.removeListener("end", onEnd);
+		input.removeListener("close", onEnd);
+		input.removeListener("error", onEnd);
+		acknowledgment.resolve(accepted);
+	};
+	const onData = (chunk: Buffer | string): void => {
+		received += chunk.toString();
+		if (received.length > BROKER_HANDOFF_ACKNOWLEDGEMENT.length) {
+			finish(false);
+			return;
+		}
+		if (received.includes("\n")) finish(received === BROKER_HANDOFF_ACKNOWLEDGEMENT);
+	};
+	const onEnd = (): void => finish(false);
+	input.on("data", onData);
+	input.once("end", onEnd);
+	input.once("close", onEnd);
+	input.once("error", onEnd);
+	input.resume();
+	return acknowledgment.promise;
+}
+
+/** Wait for a validated identity ACK followed by the parent's publication decision. */
+export function waitForBrokerHandoffDecision(
+	input: stream.Readable,
+	timeoutMs = BROKER_HANDOFF_DECISION_TIMEOUT_MS,
+): Promise<"commit" | "abort"> {
+	const decision = Promise.withResolvers<"commit" | "abort">();
+	let received = "";
+	let settled = false;
+	const finish = (value: "commit" | "abort"): void => {
+		if (settled) return;
+		settled = true;
+		clearTimeout(timer);
+		input.removeListener("data", onData);
+		input.removeListener("end", onEnd);
+		input.removeListener("close", onEnd);
+		input.removeListener("error", onEnd);
+		decision.resolve(value);
+	};
+	const onData = (chunk: Buffer | string): void => {
+		received += chunk.toString();
+		if (received.length > BROKER_HANDOFF_ACKNOWLEDGEMENT.length + BROKER_HANDOFF_COMMIT.length) {
+			finish("abort");
+			return;
+		}
+		if (received.length < BROKER_HANDOFF_ACKNOWLEDGEMENT.length) {
+			if (!BROKER_HANDOFF_ACKNOWLEDGEMENT.startsWith(received)) finish("abort");
+			return;
+		}
+		if (!received.startsWith(BROKER_HANDOFF_ACKNOWLEDGEMENT)) {
+			finish("abort");
+			return;
+		}
+		const action = received.slice(BROKER_HANDOFF_ACKNOWLEDGEMENT.length);
+		if (action === BROKER_HANDOFF_COMMIT) finish("commit");
+		else if (action === BROKER_HANDOFF_ABORT) finish("abort");
+		else if (!BROKER_HANDOFF_COMMIT.startsWith(action) && !BROKER_HANDOFF_ABORT.startsWith(action)) finish("abort");
+	};
+	const onEnd = (): void => finish("abort");
+	const timer = setTimeout(() => finish("abort"), timeoutMs);
+	input.on("data", onData);
+	input.once("end", onEnd);
+	input.once("close", onEnd);
+	input.once("error", onEnd);
+	input.resume();
+	return decision.promise;
+}
+
+const writeBrokerHopStdout: BrokerHopWriter = (chunk, callback): void => {
+	const onError = (error: Error): void => {
+		process.stdout.removeListener("error", onError);
+		callback(error);
+	};
+	process.stdout.once("error", onError);
+	try {
+		process.stdout.write(chunk, error => {
+			process.stdout.removeListener("error", onError);
+			callback(error);
+		});
+	} catch (error) {
+		process.stdout.removeListener("error", onError);
+		callback(error instanceof Error ? error : new Error(String(error)));
+	}
+};
+
+/** Pin only the still-running direct child so a reused PID cannot be adopted. */
+function getSpawnedChildReference(pid: number): Process | undefined {
+	try {
+		const reference = nativeProcessBindings().Process.fromPid(pid);
+		if (!reference || reference.pid !== pid || reference.ppid !== process.pid || reference.status() !== "running")
+			return undefined;
+		return reference;
+	} catch {
+		return undefined;
+	}
+}
+
+async function terminateUnverifiableWindowsChild(child: childProcess.ChildProcess): Promise<string> {
+	if (process.platform !== "win32") return "no signal was sent without a verified process identity";
+	if (child.exitCode !== null || child.signalCode !== null) return "the spawned child already exited";
+	const exited = Promise.withResolvers<void>();
+	child.once("exit", exited.resolve);
+	child.once("close", exited.resolve);
+	child.on("error", () => {});
+	try {
+		child.kill("SIGKILL");
+	} catch {
+		// The process handle remains exact; inspect its exit state below.
+	}
+	await Promise.race([exited.promise, Bun.sleep(500)]);
+	return child.exitCode !== null || child.signalCode !== null
+		? "the exact spawned child was terminated"
+		: "termination of the exact spawned child was not confirmed";
+}
+
+async function terminateBrokerAfterFailedHandoff(reference: Process): Promise<string> {
+	let cleanup: string;
+	try {
+		if (reference.status() === "running") reference.signalRoot(os.constants.signals.SIGKILL);
+		const exited = await reference.waitForExit({ timeoutMs: 500 });
+		cleanup =
+			exited || reference.status() !== "running" ? "broker terminated" : "broker termination was not confirmed";
+	} catch (error) {
+		cleanup = `broker termination failed: ${error instanceof Error ? error.message : String(error)}`;
+	}
+	return cleanup;
+}
+
+function fail(message: string): never {
+	process.stderr.write(`gjc: ${message}\n`);
+	process.exit(1);
+}

package/src/sdk/broker/lifecycle-ledger.ts

@@ -130,6 +130,10 @@ type BoundedSourceRead =
 
 const terminal = (s: LifecycleState) => s === "terminal_ok" || s === "terminal_error";
 const final = (s: LifecycleState) => terminal(s) || s === "terminal_uncertain";
+const recordedSessionIds = (entry: LifecycleLedgerEntry): string[] =>
+	[entry.intendedSessionId, entry.resultSessionId].filter(
+		(sessionId): sessionId is string => typeof sessionId === "string" && sessionId.length > 0,
+	);
 export interface LifecycleLedgerLimits {
 	maxBytes?: number;
 	maxLineBytes?: number;
@@ -795,27 +799,47 @@ export class LifecycleLedger {
 		return [...this.#byIdentity.values()].findLast(entry => entry.operationKey === operationKey);
 	}
 	/**
-	 * Live or uncertain legacy rows predate the operation/key index. Their opaque
-	 * identities cannot establish that a different target is safe, so callers
-	 * must reject rather than create a second admission. A fresh session.create
-	 * may ignore completed terminal legacy rows so old successful operations do
-	 * not block coordinator startup. Other operations retain the legacy fence
-	 * because target-bound legacy identities cannot prove key uniqueness. For
-	 * target-bound terminal creates, the opaque legacy identity also cannot reveal
-	 * the original caller key, so this exception retires that legacy key history;
-	 * exact key-only legacy creates are still rejected by the earlier lookup.
+	 * Live legacy rows predate the operation/key index. Their opaque identities
+	 * cannot establish that a different target is safe, so callers must reject
+	 * rather than create a second admission. A fresh session.create may ignore
+	 * final legacy rows: exact legacy identities are still resolved before this
+	 * check, and uncertain rows retain their session-scoped fences.
+	 *
+	 * A session-targeted request passes `sessionTarget` to ignore terminal legacy
+	 * rows that record only other sessions, unless the row is the caller's key
+	 * reused across targets (`keyReuseIdentities`). Terminal rows recording the
+	 * target or no session, uncertain rows, and live rows keep the fence because
+	 * they cannot prove the requested target is unrelated.
 	 */
 	hasLegacyIdentity(
 		excludedIdentities?: ReadonlySet<string>,
-		options: { ignoreTerminalRows?: boolean } = {},
+		options: {
+			ignoreFinalRows?: boolean;
+			sessionTarget?: { sessionId: string; keyReuseIdentities: ReadonlySet<string> };
+		} = {},
 	): boolean {
+		const target = options.sessionTarget;
+		const unrelatedTerminal = (entry: LifecycleLedgerEntry): boolean => {
+			if (!target || !terminal(entry.state) || target.keyReuseIdentities.has(entry.identity)) return false;
+			const sessionIds = recordedSessionIds(entry);
+			return sessionIds.length > 0 && !sessionIds.includes(target.sessionId);
+		};
 		return [...this.#byIdentity.values()].some(
 			entry =>
 				entry.operationKey === undefined &&
-				!(options.ignoreTerminalRows && terminal(entry.state)) &&
+				!(options.ignoreFinalRows && final(entry.state)) &&
+				!unrelatedTerminal(entry) &&
 				!excludedIdentities?.has(entry.identity),
 		);
 	}
+	/** Sessions recorded by terminal legacy rows, for deriving key-reuse identities. */
+	terminalLegacySessionIds(): Set<string> {
+		const sessionIds = new Set<string>();
+		for (const entry of this.#byIdentity.values())
+			if (entry.operationKey === undefined && terminal(entry.state))
+				for (const sessionId of recordedSessionIds(entry)) sessionIds.add(sessionId);
+		return sessionIds;
+	}
 	async migrateIdentity(
 		from: string,
 		to: string,
@@ -944,6 +968,9 @@ export class LifecycleLedger {
 		return this.#mutate(async () => {
 			const previous = this.#byIdentity.get(identity);
 			if (!previous) throw new Error("Unknown lifecycle identity");
+			// Match replay validation: proven terminal records admit no successor.
+			// A late failure must not append a row that will be quarantined on reopen.
+			if (terminal(previous.state)) return previous;
 			const next = {
 				...previous,
 				...fields,

package/src/sdk/broker/lifecycle.ts

@@ -951,6 +951,14 @@ type SessionLaunch = {
 	modelId?: string;
 	modelPreset?: string;
 	mcpServers?: SessionLifecycleMcpServer[];
+	/**
+	 * Per-session environment for the hosted session (#6735). Applied to the
+	 * session host's spawn environment (and therefore inherited by its Bash
+	 * executor) on top of the broker's own environment, after `unsetEnv` has
+	 * removed inherited names. Broker-reserved `GJC_*` names are rejected.
+	 */
+	env?: Record<string, string>;
+	unsetEnv?: string[];
 	/** Coordinator namespace dir; broker computes the state file path from launch.id (#2549). */
 	coordinatorStateDir?: string;
 	coordinatorSessionId?: string;
@@ -963,6 +971,85 @@ type SessionLaunch = {
 };
 
 const CREDENTIAL_NAME_PATTERN = /(?:token|secret|password|credential|api[_-]?key|auth|cookie)/iu;
+const SESSION_ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const SESSION_ENV_MAX_ENTRIES = 256;
+const SESSION_ENV_MAX_VALUE_LENGTH = 131_072;
+
+function isSessionEnvName(name: unknown): name is string {
+	return (
+		typeof name === "string" &&
+		name.length <= 256 &&
+		SESSION_ENV_NAME_PATTERN.test(name) &&
+		// GJC_* carries broker-issued launch authority (request, effect marker,
+		// state root, coordinator correlation); a caller must not shadow it.
+		!name.toUpperCase().startsWith("GJC_")
+	);
+}
+
+const sessionEnvKey = (name: string): string => (process.platform === "win32" ? name.toUpperCase() : name);
+
+/**
+ * Validates the optional per-session `env`/`unsetEnv` pair (#6735). Returns
+ * null when either is malformed so the caller fails the launch closed.
+ */
+export function lifecycleSessionEnv(input: {
+	env?: unknown;
+	unsetEnv?: unknown;
+}): { env?: Record<string, string>; unsetEnv?: string[] } | null {
+	let env: Record<string, string> | undefined;
+	if (input.env !== undefined) {
+		if (input.env === null || typeof input.env !== "object" || Array.isArray(input.env)) return null;
+		const entries = Object.entries(input.env as Record<string, unknown>);
+		if (entries.length > SESSION_ENV_MAX_ENTRIES) return null;
+		const seen = new Set<string>();
+		for (const [name, value] of entries) {
+			if (
+				!isSessionEnvName(name) ||
+				typeof value !== "string" ||
+				value.length > SESSION_ENV_MAX_VALUE_LENGTH ||
+				value.includes("\0") ||
+				seen.has(sessionEnvKey(name))
+			)
+				return null;
+			seen.add(sessionEnvKey(name));
+		}
+		env = Object.fromEntries(entries) as Record<string, string>;
+	}
+	let unsetEnv: string[] | undefined;
+	if (input.unsetEnv !== undefined) {
+		if (!Array.isArray(input.unsetEnv) || input.unsetEnv.length > SESSION_ENV_MAX_ENTRIES) return null;
+		const keys = new Set<string>();
+		for (const name of input.unsetEnv) {
+			if (!isSessionEnvName(name) || keys.has(sessionEnvKey(name))) return null;
+			keys.add(sessionEnvKey(name));
+		}
+		// Setting and unsetting the same name is contradictory, not a precedence question.
+		if (env && Object.keys(env).some(name => keys.has(sessionEnvKey(name)))) return null;
+		unsetEnv = [...(input.unsetEnv as string[])];
+	}
+	return { ...(env ? { env } : {}), ...(unsetEnv ? { unsetEnv } : {}) };
+}
+
+/**
+ * Composes the inherited part of a lifecycle session host's environment:
+ * drops the process-local master capability, every `unsetEnv` name, and any
+ * inherited name an explicit per-session `env` entry replaces (case-folded on
+ * Windows so `Path` and `PATH` never both reach the child), then layers the
+ * per-session `env` on top. Broker-issued `GJC_*` keys are applied after this.
+ */
+export function lifecycleSessionHostBaseEnv(
+	inherited: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>,
+	launch: { env?: Readonly<Record<string, string>>; unsetEnv?: readonly string[] },
+): Record<string, string> {
+	const removed = new Set([...(launch.unsetEnv ?? []), ...Object.keys(launch.env ?? {})].map(sessionEnvKey));
+	// Valid names like `__proto__` must remain own environment entries.
+	const base = Object.create(null) as Record<string, string>;
+	for (const [name, value] of Object.entries(inherited)) {
+		if (name === "GJC_MASTER_CAPABILITY" || typeof value !== "string" || removed.has(sessionEnvKey(name))) continue;
+		base[name] = value;
+	}
+	return { ...base, ...launch.env };
+}
 
 function lifecycleLaunchKnownSecrets(launch: SessionLaunch): string[] {
 	const secrets = [
@@ -985,6 +1072,9 @@ function lifecycleLaunchKnownSecrets(launch: SessionLaunch): string[] {
 				.filter(([name, value]) => value && CREDENTIAL_NAME_PATTERN.test(name))
 				.map(([, value]) => value);
 		}),
+		...Object.entries(launch.env ?? {})
+			.filter(([name, value]) => value && CREDENTIAL_NAME_PATTERN.test(name))
+			.map(([, value]) => value),
 	];
 	return [...new Set(secrets.filter(secret => typeof secret === "string" && secret.length > 0))];
 }
@@ -5998,6 +6088,12 @@ async function launchInput(
 	if (input.mcpServers !== undefined && !isSessionLifecycleMcpServers(input.mcpServers))
 		return fail("invalid_input", "mcpServers must contain unique valid stdio, HTTP, or SSE server definitions.");
 	const mcpServers = input.mcpServers as SessionLifecycleMcpServer[] | undefined;
+	const sessionEnv = lifecycleSessionEnv(input);
+	if (!sessionEnv)
+		return fail(
+			"invalid_input",
+			"env must map valid non-GJC_ variable names to strings, and unsetEnv must list distinct valid names not also set in env.",
+		);
 
 	/**
 	 * Prepared readiness is an explicit creation-only intent. Only the two exact
@@ -6047,6 +6143,7 @@ async function launchInput(
 			modelId,
 			modelPreset,
 			mcpServers,
+			...sessionEnv,
 			worktree,
 			worktreePlan,
 			...(readiness ? { readiness } : {}),
@@ -6070,6 +6167,7 @@ async function launchInput(
 			sessionIdentity: saved.identity,
 			modelPreset,
 			mcpServers,
+			...sessionEnv,
 			worktree,
 			worktreePlan,
 			...(coordinatorStateDir ? { coordinatorStateDir } : {}),
@@ -6104,6 +6202,7 @@ async function launchInput(
 		modelId,
 		modelPreset,
 		mcpServers,
+		...sessionEnv,
 		worktree,
 		worktreePlan,
 		...(coordinatorStateDir ? { coordinatorStateDir } : {}),
@@ -7160,12 +7259,9 @@ async function executeLifecycleResponse(
 					stdio: ["ignore", "ignore", childStderrSink?.drainer.stdin ?? "ignore"],
 					env: {
 						// Master capability is process-local to direct Bash children and must
-						// never cross a broker lifecycle launch boundary.
-						...Object.fromEntries(
-							Object.entries("kind" in cmd ? cmd.env : process.env).filter(
-								([key]) => key !== "GJC_MASTER_CAPABILITY",
-							),
-						),
+						// never cross a broker lifecycle launch boundary. Per-session env
+						// (#6735) is layered here, below the broker-issued GJC_* keys.
+						...lifecycleSessionHostBaseEnv("kind" in cmd ? cmd.env : process.env, launch),
 						GJC_AGENT_DIR: broker.settings.agentDir,
 						GJC_CODING_AGENT_DIR: broker.settings.agentDir,
 						GJC_SESSION_ID: launch.id,

package/src/sdk/broker/lock-host-identity.ts

@@ -0,0 +1,29 @@
+import path from "node:path";
+import { loadInstallationHostId, loadLegacyInstallationHostId } from "../../config/machine-identity";
+
+export interface BrokerLockHostIdentity {
+	ownerHostId: string;
+	previousOwnerHostIds: readonly string[];
+}
+
+const brokerLockHostIdentityPromises = new Map<string, Promise<BrokerLockHostIdentity>>();
+
+export async function brokerLockHostIdentity(agentDir: string): Promise<BrokerLockHostIdentity> {
+	const coordinationRoot = path.resolve(agentDir, "sdk");
+	const pending =
+		brokerLockHostIdentityPromises.get(coordinationRoot) ??
+		Promise.all([loadInstallationHostId({ configRootDir: coordinationRoot }), loadLegacyInstallationHostId()]).then(
+			([ownerHostId, legacyHostId]) => ({
+				ownerHostId,
+				previousOwnerHostIds: legacyHostId === ownerHostId ? [] : [legacyHostId],
+			}),
+		);
+	brokerLockHostIdentityPromises.set(coordinationRoot, pending);
+	try {
+		return await pending;
+	} catch (error) {
+		if (brokerLockHostIdentityPromises.get(coordinationRoot) === pending)
+			brokerLockHostIdentityPromises.delete(coordinationRoot);
+		throw error;
+	}
+}