@khorsheed/dsh-ankh-guard 0.4.1 → 0.4.3

package/lib/types/cli.js

@@ -2203,6 +2203,12 @@ export async function runCli(argv, io) {
                     if (key.startsWith('WD_'))
                         delete startEnv[key];
                 }
+                // NODE_PATH/NODE_OPTIONS go too: from a tool-wrapped caller (tsx pins
+                // NODE_PATH to its own pnpm store) they hijack the instance's module
+                // resolution onto that checkout's workspace — the watchdog's
+                // launch_instance scrubs them for the same reason (3080, 2026-10-12).
+                delete startEnv.NODE_PATH;
+                delete startEnv.NODE_OPTIONS;
                 const child = spawn(start, {
                     shell: true, detached: true, stdio: 'ignore',
                     env: testChildEnv('restart-instance-root', startEnv, { port, tempRoot: stateDir }),
@@ -2453,6 +2459,12 @@ export async function runCli(argv, io) {
                 if (key.startsWith('WD_'))
                     delete supervisorBaseEnv[key];
             }
+            // NODE_PATH/NODE_OPTIONS must not reach the watchdog either: it forwards
+            // its environment to every instance it launches, and a tool-wrapped
+            // caller (tsx pins NODE_PATH to its own pnpm store) would otherwise
+            // hijack instance module resolution onto that checkout (3080, 2026-10-12).
+            delete supervisorBaseEnv.NODE_PATH;
+            delete supervisorBaseEnv.NODE_OPTIONS;
             const env = {
                 ...supervisorBaseEnv,
                 WD_PORT: String(spec.port),

package/lib/types/client/index.js

@@ -155,6 +155,8 @@ export function apply(_ctx) {
     let timer;
     let pending = consumeFallbackFragment() ?? readPending();
     let cap;
+    /** Consecutive failed ACKs for the current pending handoff. */
+    let ackFailures = 0;
     let errorRetryMs = ERROR_RETRY_MIN_MS;
     let firstFailureAt;
     let request;
@@ -231,6 +233,29 @@ export function apply(_ctx) {
                         return;
                     }
                 }
+                else {
+                    // A failed ACK can be permanent: the cutover settled without this tab
+                    // (operator restore, handoff off, a wedged supervisor) and the server
+                    // keeps answering 409 'waiting'/'stale' for a dead cutoverId — the
+                    // veil would otherwise stay up forever (observed 2026-09-30). Every
+                    // few failures, spend one poll: 'idle' proves nothing is in flight,
+                    // so the pending handoff is dead — drop it and let the ordinary
+                    // poll loop remove the veil on the next tick.
+                    ackFailures += 1;
+                    if (ackFailures >= 8) {
+                        ackFailures = 0;
+                        const probe = await post({
+                            version: 1, operation: 'poll', capability: cap ??= capability(),
+                        }, current.signal);
+                        if (stale())
+                            return;
+                        if (probe.ok && (await probe.json()).state === 'idle') {
+                            sessionStorage.removeItem(PENDING_KEY);
+                            sessionStorage.removeItem(CAPABILITY_KEY);
+                            pending = null;
+                        }
+                    }
+                }
                 errorRetryMs = ERROR_RETRY_MIN_MS;
                 firstFailureAt = undefined;
                 schedule(ACTIVE_RETRY_MS);
@@ -261,9 +286,9 @@ export function apply(_ctx) {
                 sessionStorage.setItem(BOOT_ID_KEY, result.bootId);
             if (result.state === 'idle') {
                 document.getElementById('ankh-guard-browser-handoff')?.remove();
-                // The server holds idle polls, providing event-like wakeup without a
-                // permanent fixed-frequency request loop.
-                schedule();
+                // Healthy servers hold idle polls. Keep a floor for older servers or
+                // terminal states that answer immediately, so they cannot create a spin.
+                schedule(ACTIVE_RETRY_MS);
                 return;
             }
             if (result.state === 'waiting')
@@ -287,6 +312,7 @@ export function apply(_ctx) {
                 };
                 pending = nextPending;
                 writePending(nextPending);
+                ackFailures = 0;
                 waitingOverlay();
                 location.reload();
                 return;
@@ -307,6 +333,7 @@ export function apply(_ctx) {
                 };
                 pending = nextPending;
                 writePending(nextPending);
+                ackFailures = 0;
                 waitingOverlay();
                 // The bearer remains a local variable for the shortest possible time.
                 location.replace(launch.href);

package/lib/types/defaults.js

@@ -1,6 +1,6 @@
 /**
- * Default state/repo directory resolution, shared by the cordis plugin, the
- * CLI, and the invariant companion so all three agree on where a credential
+ * Default state/repo directory resolution, shared by the cordis plugin and
+ * the CLI so both agree on where a credential
  * lives. The state file must survive a restart, so it anchors to DSH_HOME (or
  * the checkout) rather than any process-lifetime directory.
  */

package/lib/types/index.js

@@ -128,7 +128,7 @@ function registerRestartSkill(ctx, stateDir) {
             description,
             content,
             source: 'runtime',
-            provider: 'ankh-guard',
+            provider: '@khorsheed/dsh-ankh-guard',
         }));
         writeSkillRegistration(stateDir, { registered: true, at: Date.now() });
     }

package/lib/types/state.js

@@ -5,8 +5,8 @@
  * was recorded on and to a freshness window — and answers `verify()` against
  * the CURRENT head and wall clock. A later fully gated boot may promote that
  * credential into a deployment proof whose exact runtime fingerprint can be
- * reused by the same-launch restart path. Framework-free: the cordis plugin,
- * the CLI, and the invariant companion all share this module.
+ * reused by the same-launch restart path. Framework-free: the cordis plugin
+ * and the CLI share this module.
  */
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { stateFile } from "./state-files.js";
@@ -94,8 +94,8 @@ export function loadState(stateDir) {
 export function saveState(stateDir, state) {
     mkdirSync(stateDir, { recursive: true });
     // Atomic via tmp + rename: a crash mid-write must never leave a truncated
-    // state file — a malformed one throws in loadState and fails the host's
-    // boot invariant, i.e. the guard's own state would take the host down.
+    // state file — a malformed one throws in loadState the next time the gate
+    // reads it, i.e. the guard's own state would fail every later verify.
     const file = stateFilePath(stateDir);
     const tmp = `${file}.${process.pid}.tmp`;
     writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@khorsheed/dsh-ankh-guard",
   "description": "Hard gate for self-modification restarts: a green-build credential bound to the git HEAD, checked before any restart of the running instance",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -13,10 +13,6 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
-    "./invariant": {
-      "types": "./lib/types/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
     "./cli": {
       "types": "./lib/types/cli.d.ts",
       "default": "./lib/cli.js"
@@ -42,16 +38,18 @@
     "CHANGELOG.md"
   ],
   "license": "MIT",
+  "engines": {
+    "dsh": ">=0.1.5-rc.1 <0.3.0-0"
+  },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-agent-preset-registry": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.6 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-agent-preset-registry": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "peerDependenciesMeta": {
@@ -90,8 +88,8 @@
     },
     "compat": {
       "minHost": "0.1.5-rc.1",
-      "notes": "0.1.5-rc.1 full-line boot-verified 2026-09-25 (42 packages including capture) through the three compat layers: preset-registry dual-name probe, dual-shape typert codecs, and typert faces carrying zod@4; 0.1.7-rc.2 is the 3080 production-verified line; composition-preflight runs via the standalone preflight-runner and degrades to a notice when no live harness checkout resolves; original-tab browser handoff feature-probes optional WebServer/connection auth seams; reversible state quarantine was exercised in a live 0.1.1-rc.2 to 0.1.2-alpha.4 cutover; since 0.4.0 the preflight verdict also fails on any agent preset the registry marks broken — preset rows mount on standing scopes beside the profile tree, so a clean-booting profile whose presets cannot serve sessions (picker 加载失败, resume never-started) no longer passes the gate",
-      "verifiedHost": "0.1.7-rc.2"
+      "notes": "0.1.5-rc.1 full-line boot-verified 2026-09-25 (42 packages including capture) through the three compat layers: preset-registry dual-name probe, dual-shape typert codecs, and typert faces carrying zod@4; 0.2.0-rc.2 is the 3080 production-verified line (watchdog-supervised gated restarts PASS — readiness, ownership window, canary, deployment proof on the 0.2.0-rc.2 release head 639ed01539 — since 2026-10-09); composition-preflight runs via the standalone preflight-runner and degrades to a notice when no live harness checkout resolves; original-tab browser handoff feature-probes optional WebServer/connection auth seams; reversible state quarantine was exercised in a live 0.1.1-rc.2 to 0.1.2-alpha.4 cutover; since 0.4.0 the preflight verdict also fails on any agent preset the registry marks broken — preset rows mount on standing scopes beside the profile tree, so a clean-booting profile whose presets cannot serve sessions (picker 加载失败, resume never-started) no longer passes the gate",
+      "verifiedHost": "0.2.1-rc.1"
     }
   }
 }

package/scripts/dsh-watchdog.sh

@@ -182,6 +182,14 @@ launch_instance() {
     if [ -n "$launch_harness_root" ]; then export DSH_HARNESS="$launch_harness_root"; fi
     cd "$launch_home/home" 2>/dev/null || cd /tmp || exit 1
     for v in $(env | sed -n 's/^\(WD_[^=]*\)=.*/\1/p'); do unset "$v"; done
+    # NODE_PATH/NODE_OPTIONS get the same scrub: launched from a tool-wrapped
+    # shell (tsx sets NODE_PATH to its own pnpm store), the instance's module
+    # resolution would be hijacked onto that checkout's workspace — bundle
+    # patches then resolve to the REPO's packages instead of the profile's
+    # installed ones, and the composition silently serves whatever the repo
+    # checkout happens to hold (3080, 2026-10-12: presets resolved to the main
+    # checkout's workspace copy, hiding the newly deployed preset rows).
+    unset NODE_PATH NODE_OPTIONS
     sh -c "$start_cmd"
   )
 }

package/lib/invariant.js

@@ -1,40 +0,0 @@
-import { i as resolveStateDir } from "./defaults-CduvOcGq.js";
-import { n as loadState, o as stateFilePath } from "./state-CZMypGkB.js";
-import { existsSync } from "node:fs";
-//#region lib/types/invariant.js
-/**
-* Package-owned invariant companion for `@khorsheed/dsh-ankh-guard`.
-* @module @khorsheed/dsh-ankh-guard/invariant
-*/
-const PACKAGE_NAME = "@khorsheed/dsh-ankh-guard";
-/** Cordis companion plugin name. */
-const name = "ankh-guard-invariant";
-/** Service required before the companion can reserve package ownership. */
-const inject = ["invariants"];
-/**
-* Owned-data check: the package's state file, when present at the default
-* location, must parse as a well-formed guard state. A malformed file would
-* make the gate unreadable — the credential's revision/recordedAt shape is
-* this package's own contract, so corruption fails loud at load instead of at
-* the moment a restart needs the gate.
-* @param _ctx - host context (unused; the check reads only the state file).
-* @param fail - invariant failure reporter.
-*/
-const install = (_ctx, fail) => {
-	const stateDir = resolveStateDir(void 0);
-	const file = stateFilePath(stateDir);
-	if (!existsSync(file)) return;
-	try {
-		loadState(stateDir);
-	} catch (error) {
-		fail(`state file ${file} is malformed: ${String(error)}`);
-	}
-};
-/**
-* Register this package's invariant companion.
-* @param ctx - Cordis context carrying the invariant service.
-* @returns The installed registration's disposer after setup succeeds.
-*/
-const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//#endregion
-export { apply, inject, install, name };

package/lib/state-CZMypGkB.js

@@ -1,323 +0,0 @@
-import { c as appendTestLifecycleEvent } from "./test-seam-dwvaKjRp.js";
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-//#region lib/types/state-files.js
-/**
-* The guard's state-directory protocol: every file that lives in the state
-* dir, named exactly once. Five writers in three languages (this package's
-* TS, the watchdog's bash, the schedule-exit exit agent's inline JS, and the
-* two supervisor installers) read and write these — a literal drifting in
-* any one of them splits the protocol silently (three review rounds of path
-* bugs came from exactly that). The bash sides are pinned by
-* tests/state-files.spec.ts, which asserts every state-dir literal in the
-* watchdog and both installers appears here, and that no script re-derives
-* the directory from the home.
-*/
-/** Every state-directory file name, keyed by role. */
-const STATE_FILES = {
-	/** The guard's credential/checkpoint/audit state (state.ts). */
-	guard: "self-restart-guard.json",
-	/** Watchdog-stamped last deployment-proven revision. */
-	lastGoodBoot: "last-good-boot.json",
-	/** schedule-exit → watchdog: an intentional restart, run the canary. */
-	restartRequested: "restart-requested.json",
-	/** The exit agent's restart outcome record (the report's source). */
-	lastRestart: "last-restart.json",
-	/** The SIGTERM snapshot of interrupted sessions. */
-	interruptedSessions: "interrupted-sessions.json",
-	/** The supervising watchdog's pidfile. */
-	watchdogPid: "watchdog.pid",
-	/** Cross-session mutual exclusion for the restart verb. */
-	restartLock: "restart.lock",
-	/** The detached restart driver's log. */
-	restartLog: "restart.log",
-	/** Marker: exit the watchdog without respawn. */
-	watchdogStop: "watchdog-stop",
-	/** Marker: the watchdog gave up; a crash page holds the port. */
-	watchdogGaveUp: "watchdog-gave-up",
-	/** The current boot attempt's captured output. */
-	bootAttemptLog: "boot-attempt.log",
-	/** The watchdog's own log. */
-	watchdogLog: "watchdog.log",
-	/** The watchdog's stderr, captured separately by the supervisor installers. */
-	watchdogStderrLog: "watchdog.stderr.log",
-	/** The exit agent's log. */
-	scheduleExitLog: "schedule-exit.log",
-	/** How the current instance was launched (recorded by the plugin at apply). */
-	instanceLaunch: "instance-launch.json",
-	/** The atomically selected full launch configuration (stable or in cutover). */
-	launchSpec: "launch-spec.json",
-	/** Redacted durable receipt for the latest launch-configuration cutover. */
-	launchCutover: "launch-cutover.json",
-	/** Legacy combined operator-control marker, retained for rolling upgrades. */
-	cutoverControl: "launch-cutover-control.json",
-	/** Operator → watchdog: abort according to the pre-approved recovery policy. */
-	cutoverAbort: "launch-cutover-abort.json",
-	/** Monotonic stronger operator action: explicitly restore the previous spec. */
-	cutoverRestorePrevious: "launch-cutover-restore-previous.json",
-	/** Original browser-tab registry: per-tab capability hashes only; retained through terminal recovery. */
-	browserHandoffRequest: "browser-handoff-request.json",
-	/** Browser → watchdog acknowledgement for one proven final process. */
-	browserHandoffAck: "browser-handoff-ack.json",
-	/** Whether the restart-protocol skill registered at apply (and why not). */
-	skillRegistration: "skill-registration.json",
-	/** Directory: the healthy-boot snapshot of the profile composition inputs. */
-	lastGoodComposition: "last-good-composition",
-	/** Directory prefix: a failing composition backed up before rollback restores over it. */
-	compositionBackup: "composition-backup-"
-};
-/** Absolute path of a state file inside a state directory. */
-function stateFile(stateDir, role) {
-	return join(stateDir, STATE_FILES[role]);
-}
-/**
-* The last deployment-proven revision, stamped by the watchdog on every
-* healthy boot, or undefined. Lives here rather than in the credential core:
-* the stamp is written by the watchdog and proves the deployment composed and
-* came up — a green credential only ever proves build+test passed.
-* @param stateDir - state directory.
-* @returns the stamped revision, or undefined.
-*/
-function lastGoodBootRevision(stateDir) {
-	try {
-		const stamp = JSON.parse(readFileSync(stateFile(stateDir, "lastGoodBoot"), "utf8"));
-		return typeof stamp.revision === "string" && stamp.revision !== "" ? stamp.revision : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* Whether the pid named by this raw pid/lock-file content is alive. Empty
-* content reads as NO holder: Number('') is 0 and kill(0, 0) probes our own
-* process group (always succeeds), which once read as "alive" and refused
-* every restart forever — the bug that had to be fixed in two copies of this
-* logic before it was consolidated here.
-*/
-function pidAlive(raw) {
-	const pid = Number(raw);
-	if (raw === "" || !Number.isInteger(pid) || pid <= 0) return false;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** The live pid named by a pid/lock file (as the raw string), or null when absent/stale. */
-function livePidIn(file) {
-	try {
-		const raw = readFileSync(file, "utf8").trim();
-		return pidAlive(raw) ? raw : null;
-	} catch {
-		return null;
-	}
-}
-/** The live supervising watchdog's pid, or null when none is (pidfile + kill 0). */
-function liveWatchdogPid(stateDir) {
-	const raw = livePidIn(stateFile(stateDir, "watchdogPid"));
-	const pid = raw === null ? null : Number(raw);
-	appendTestLifecycleEvent("watchdog-liveness-probe", {
-		pid: pid ?? 0,
-		live: pid !== null
-	}, "parent-observer");
-	return pid;
-}
-//#endregion
-//#region lib/types/state.js
-/**
-* Pure credential/checkpoint state core for the self-restart guard.
-*
-* The guard records one "green build" credential — bound to the git HEAD it
-* was recorded on and to a freshness window — and answers `verify()` against
-* the CURRENT head and wall clock. A later fully gated boot may promote that
-* credential into a deployment proof whose exact runtime fingerprint can be
-* reused by the same-launch restart path. Framework-free: the cordis plugin,
-* the CLI, and the invariant companion all share this module.
-*/
-/** Absolute path of the state file inside a state directory. */
-function stateFilePath(stateDir) {
-	return stateFile(stateDir, "guard");
-}
-/** A fresh, credential-less state. */
-function emptyState() {
-	return { audit: [] };
-}
-function isCredential(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const c = value;
-	return typeof c.scope === "string" && typeof c.revision === "string" && typeof c.recordedAt === "number" && typeof c.command === "string";
-}
-function isCheckpoint(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const c = value;
-	return typeof c.revision === "string" && typeof c.recordedAt === "number" && typeof c.message === "string";
-}
-function isSha256(value) {
-	return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
-}
-function isProvenDeployment(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const proof = value;
-	const credential = proof.credential;
-	const fingerprint = proof.fingerprint;
-	return proof.version === 1 && typeof proof.provenAt === "number" && credential !== void 0 && typeof credential.revision === "string" && credential.revision !== "" && typeof credential.recordedAt === "number" && typeof credential.scope === "string" && isSha256(credential.commandSha256) && fingerprint?.version === 1 && typeof fingerprint.credentialRevision === "string" && fingerprint.credentialRevision !== "" && typeof fingerprint.harnessRevision === "string" && fingerprint.harnessRevision !== "" && isSha256(fingerprint.launchSpecSha256) && isSha256(fingerprint.profileSha256) && isSha256(fingerprint.hostRuntimeSha256) && isSha256(proof.fingerprintSha256);
-}
-function isAuditEntry(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const e = value;
-	return (e.action === "record" || e.action === "clear" || e.action === "checkpoint" || e.action === "prove-deployment") && typeof e.ts === "number" && typeof e.detail === "string";
-}
-/**
-* Read the state file; an absent file is an empty state, a malformed one is a
-* loud misconfiguration error (never silently ignored).
-* @param stateDir - directory holding the state file.
-* @returns the parsed state.
-*/
-function loadState(stateDir) {
-	try {
-		const raw = readFileSync(stateFilePath(stateDir), "utf8");
-		const parsed = JSON.parse(raw);
-		if (parsed === null || typeof parsed !== "object") return emptyState();
-		const state = { audit: Array.isArray(parsed.audit) ? parsed.audit.filter(isAuditEntry) : [] };
-		if (isCredential(parsed.credential)) state.credential = parsed.credential;
-		if (isProvenDeployment(parsed.provenDeployment)) state.provenDeployment = parsed.provenDeployment;
-		if (isCheckpoint(parsed.checkpoint)) state.checkpoint = parsed.checkpoint;
-		return state;
-	} catch (error) {
-		if (error?.code === "ENOENT") return emptyState();
-		throw new Error(`ankh-guard: unreadable state file ${stateFilePath(stateDir)}: ${String(error)}`);
-	}
-}
-/** Persist a state (creates the directory as needed). */
-function saveState(stateDir, state) {
-	mkdirSync(stateDir, { recursive: true });
-	const file = stateFilePath(stateDir);
-	const tmp = `${file}.${process.pid}.tmp`;
-	writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);
-	renameSync(tmp, file);
-}
-function withAudit(state, entry) {
-	return {
-		...state,
-		audit: [...state.audit, entry].slice(-50)
-	};
-}
-/**
-* Record a green-build credential bound to {@link RecordInput.revision}.
-* @param stateDir - state directory.
-* @param input - scope, the git HEAD, and the command that went green.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @returns the persisted state.
-*/
-function recordCredential(stateDir, input, now) {
-	const credential = {
-		...input,
-		recordedAt: now
-	};
-	const { provenDeployment: _oldProof, ...withoutOldProof } = withAudit(loadState(stateDir), {
-		action: "record",
-		ts: now,
-		detail: `${input.scope} @ ${input.revision}`
-	});
-	const updated = {
-		...withoutOldProof,
-		credential
-	};
-	saveState(stateDir, updated);
-	return updated;
-}
-/**
-* Drop the credential (checkpoint and audit survive).
-* @param stateDir - state directory.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @returns the persisted state.
-*/
-function clearCredential(stateDir, now) {
-	const audited = withAudit(loadState(stateDir), {
-		action: "clear",
-		ts: now,
-		detail: "credential cleared"
-	});
-	const updated = { audit: audited.audit };
-	if (audited.checkpoint !== void 0) updated.checkpoint = audited.checkpoint;
-	saveState(stateDir, updated);
-	return updated;
-}
-/** Persist a deployment proof after the watchdog has completed its canary. */
-function setProvenDeployment(stateDir, proof, now) {
-	const updated = {
-		...withAudit(loadState(stateDir), {
-			action: "prove-deployment",
-			ts: now,
-			detail: `${proof.credential.revision} ${proof.fingerprintSha256.slice(0, 16)}`
-		}),
-		provenDeployment: proof
-	};
-	saveState(stateDir, updated);
-	return updated;
-}
-/**
-* Persist a pre-batch checkpoint commit reference.
-* @param stateDir - state directory.
-* @param input - the checkpoint commit SHA and its message.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @returns the persisted state.
-*/
-function setCheckpoint(stateDir, input, now) {
-	const checkpoint = {
-		...input,
-		recordedAt: now
-	};
-	const updated = {
-		...withAudit(loadState(stateDir), {
-			action: "checkpoint",
-			ts: now,
-			detail: `${input.revision} ${input.message}`
-		}),
-		checkpoint
-	};
-	saveState(stateDir, updated);
-	return updated;
-}
-/**
-* Answer the gate: a credential is valid only when present, recorded on the
-* CURRENT revision, and younger than {@link maxAgeMinutes}.
-* @param state - the loaded state.
-* @param currentRevision - the git HEAD of the checkout, or null when unavailable.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @param maxAgeMinutes - freshness window.
-* @param workingTreeClean - whether staged, unstaged, and untracked inputs are absent.
-* @returns ok plus a human reason either way.
-*/
-function verifyCredential(state, currentRevision, now, maxAgeMinutes, workingTreeClean = true) {
-	const credential = state.credential;
-	if (credential === void 0) return {
-		ok: false,
-		reason: "no green-build credential recorded"
-	};
-	if (currentRevision === null) return {
-		ok: false,
-		reason: "current git HEAD unavailable (not inside a git repository?)"
-	};
-	if (!workingTreeClean) return {
-		ok: false,
-		reason: "working tree is dirty (staged, unstaged, or untracked changes exist) — commit or remove them, then rebuild and re-record"
-	};
-	if (credential.revision !== currentRevision) return {
-		ok: false,
-		reason: `green credential is bound to revision ${credential.revision}, but current HEAD is ${currentRevision} — the tree changed since it was recorded; rebuild and re-record`
-	};
-	const ageMs = now - credential.recordedAt;
-	const maxMs = maxAgeMinutes * 6e4;
-	if (ageMs > maxMs) return {
-		ok: false,
-		reason: `green credential is stale (${Math.round(ageMs / 6e4)} min old, limit ${maxAgeMinutes} min) — rebuild and re-record`
-	};
-	const leftMs = Math.max(0, maxMs - ageMs);
-	return {
-		ok: true,
-		reason: `green credential valid (${credential.scope} @ ${credential.revision}, ${Math.round(leftMs / 6e4)} min left)`
-	};
-}
-//#endregion
-export { setProvenDeployment as a, lastGoodBootRevision as c, pidAlive as d, stateFile as f, setCheckpoint as i, livePidIn as l, loadState as n, stateFilePath as o, recordCredential as r, verifyCredential as s, clearCredential as t, liveWatchdogPid as u };

package/lib/types/invariant.d.ts

@@ -1,27 +0,0 @@
-/**
- * Package-owned invariant companion for `@khorsheed/dsh-ankh-guard`.
- * @module @khorsheed/dsh-ankh-guard/invariant
- */
-import type { Context } from '@deepseek-ai/cordis';
-import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants';
-/** Cordis companion plugin name. */
-export declare const name = "ankh-guard-invariant";
-/** Service required before the companion can reserve package ownership. */
-export declare const inject: string[];
-/**
- * Owned-data check: the package's state file, when present at the default
- * location, must parse as a well-formed guard state. A malformed file would
- * make the gate unreadable — the credential's revision/recordedAt shape is
- * this package's own contract, so corruption fails loud at load instead of at
- * the moment a restart needs the gate.
- * @param _ctx - host context (unused; the check reads only the state file).
- * @param fail - invariant failure reporter.
- */
-export declare const install: InvariantInstaller;
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns The installed registration's disposer after setup succeeds.
- */
-export declare const apply: (ctx: Context) => Promise<() => void>;
-//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -1,41 +0,0 @@
-/**
- * Package-owned invariant companion for `@khorsheed/dsh-ankh-guard`.
- * @module @khorsheed/dsh-ankh-guard/invariant
- */
-/* jscpd:ignore-start */
-import { existsSync } from 'node:fs';
-import { resolveStateDir } from "./defaults.js";
-import { loadState, stateFilePath } from "./state.js";
-const PACKAGE_NAME = '@khorsheed/dsh-ankh-guard';
-/** Cordis companion plugin name. */
-export const name = 'ankh-guard-invariant';
-/** Service required before the companion can reserve package ownership. */
-export const inject = ['invariants'];
-/**
- * Owned-data check: the package's state file, when present at the default
- * location, must parse as a well-formed guard state. A malformed file would
- * make the gate unreadable — the credential's revision/recordedAt shape is
- * this package's own contract, so corruption fails loud at load instead of at
- * the moment a restart needs the gate.
- * @param _ctx - host context (unused; the check reads only the state file).
- * @param fail - invariant failure reporter.
- */
-export const install = (_ctx, fail) => {
-    const stateDir = resolveStateDir(undefined);
-    const file = stateFilePath(stateDir);
-    if (!existsSync(file))
-        return;
-    try {
-        loadState(stateDir);
-    }
-    catch (error) {
-        fail(`state file ${file} is malformed: ${String(error)}`);
-    }
-};
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns The installed registration's disposer after setup succeeds.
- */
-export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-/* jscpd:ignore-end */