@logicseek/hello-cc 0.1.8 → 1.0.0

package/lib/web/http.mjs

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { timingSafeEqual } from 'node:crypto';
 import { CliError } from '../shared/errors.mjs';
 
 function readRequestBody(req, limit = 1024 * 1024) {
@@ -19,13 +20,39 @@ function readRequestBody(req, limit = 1024 * 1024) {
 export async function readJsonRequest(req) {
   const body = await readRequestBody(req);
   if (!body.trim()) return {};
-  return JSON.parse(body);
+  try {
+    return JSON.parse(body);
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      throw new CliError('BAD_REQUEST', 'Invalid JSON request body');
+    }
+    throw err;
+  }
+}
+
+export function contentSecurityPolicy(nonce) {
+  const value = String(nonce || '');
+  if (!/^[A-Za-z0-9_-]{16,}$/.test(value)) {
+    throw new CliError('BAD_ARGS', 'A valid CSP nonce is required');
+  }
+  return "default-src 'self'; " +
+    `script-src 'self' 'nonce-${value}'; ` +
+    "style-src 'self' 'unsafe-inline'; " +
+    "img-src 'self' data:; " +
+    "connect-src 'self' ws: wss:; " +
+    "object-src 'none'; base-uri 'none'; frame-ancestors 'none'";
 }
 
-export function sendHttp(res, status, contentType, body) {
+export function sendHttp(res, status, contentType, body, options = {}) {
   res.writeHead(status, {
     'Content-Type': contentType,
-    'Cache-Control': 'no-store'
+    'Cache-Control': 'no-store',
+    'Referrer-Policy': 'no-referrer',
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Content-Security-Policy': options.nonce
+      ? contentSecurityPolicy(options.nonce)
+      : "frame-ancestors 'none'"
   });
   res.end(body);
 }
@@ -39,7 +66,11 @@ export function sendFile(res, filePath, contentType) {
     const body = fs.readFileSync(filePath);
     res.writeHead(200, {
       'Content-Type': contentType,
-      'Cache-Control': 'no-store'
+      'Cache-Control': 'no-store',
+      'Referrer-Policy': 'no-referrer',
+      'X-Content-Type-Options': 'nosniff',
+      'X-Frame-Options': 'DENY',
+      'Content-Security-Policy': "frame-ancestors 'none'"
     });
     res.end(body);
   } catch {
@@ -47,9 +78,114 @@ export function sendFile(res, filePath, contentType) {
   }
 }
 
+export function isLoopbackRemote(req) {
+  const addr = req?.socket?.remoteAddress || '';
+  return addr === '::1' || addr.startsWith('127.') || addr.startsWith('::ffff:127.');
+}
+
+export function tokenMatches(provided, expected) {
+  if (!provided || !expected || provided.length !== expected.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+  } catch {
+    return false;
+  }
+}
+
+function firstForwardedValue(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  return String(raw || '').split(',')[0].trim();
+}
+
+// PROXY-2: browsers omit the default port in the Origin serialization while the
+// Host header may carry it; normalize both sides to hostname + effective port.
+function normalizedOriginAuthority(hostValue, protocol) {
+  const raw = String(hostValue || '');
+  if (!raw || raw !== raw.trim()) return null;
+  try {
+    const parsed = new URL(`${protocol}//${raw}`);
+    if (parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash) return null;
+    return {
+      hostname: parsed.hostname.toLowerCase(),
+      port: parsed.port || (protocol === 'https:' ? '443' : '80')
+    };
+  } catch {
+    return null;
+  }
+}
+
+function normalizedProxyOrigin(value) {
+  try {
+    const parsed = new URL(String(value || ''));
+    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password ||
+        parsed.pathname !== '/' || parsed.search || parsed.hash) return null;
+    const authority = normalizedOriginAuthority(parsed.host, parsed.protocol);
+    return authority ? { protocol: parsed.protocol, authority } : null;
+  } catch {
+    return null;
+  }
+}
+
+function trustedProxyOrigin(req, options) {
+  if (!options?.trustProxy || !isLoopbackRemote(req)) return null;
+  const expected = normalizedProxyOrigin(options.proxyOrigin);
+  if (!expected) return null;
+  const forwardedProto = firstForwardedValue(req?.headers?.['x-forwarded-proto']).toLowerCase();
+  const forwardedHost = firstForwardedValue(req?.headers?.['x-forwarded-host']);
+  if (`${forwardedProto}:` !== expected.protocol) return null;
+  const authority = normalizedOriginAuthority(forwardedHost, expected.protocol);
+  if (!authority || authority.hostname !== expected.authority.hostname ||
+      authority.port !== expected.authority.port) return null;
+  return expected;
+}
+
+export function requestMatchesProxyOrigin(req, options = {}) {
+  return Boolean(trustedProxyOrigin(req, options));
+}
+
+export function requestIsSecure(req, options = {}) {
+  const trustProxy = options === true || options?.trustProxy === true;
+  if (trustProxy) return trustedProxyOrigin(req, options)?.protocol === 'https:';
+  return Boolean(req?.socket?.encrypted);
+}
+
+export function requestOriginMatches(req, options = {}) {
+  const trustProxy = options === true || options?.trustProxy === true;
+  const origin = req?.headers?.origin || '';
+  const proxyOrigin = trustProxy ? trustedProxyOrigin(req, options) : null;
+  if (trustProxy && !proxyOrigin) return false;
+  const host = trustProxy ? new URL(options.proxyOrigin).host : req?.headers?.host || '';
+  if (!origin || !host) return false;
+  try {
+    const parsed = new URL(origin);
+    const expectedProtocol = proxyOrigin?.protocol || (req?.socket?.encrypted ? 'https:' : 'http:');
+    if (parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash) return false;
+    const originAuthority = {
+      hostname: parsed.hostname.toLowerCase(),
+      port: parsed.port || (expectedProtocol === 'https:' ? '443' : '80')
+    };
+    const hostAuthority = normalizedOriginAuthority(host, expectedProtocol);
+    return parsed.protocol === expectedProtocol &&
+      hostAuthority !== null &&
+      originAuthority.hostname === hostAuthority.hostname && originAuthority.port === hostAuthority.port;
+  } catch {
+    return false;
+  }
+}
+
 export function authOk(url, req, token) {
-  if (!token) return true;
-  const queryToken = url.searchParams.get('token');
+  // No token configured: only trust loopback clients. A tokenless runtime is
+  // refused on non-loopback binds at startup, so this is defense-in-depth.
+  if (!token) return isLoopbackRemote(req);
+  // v1-token-query-csrf-bypass: the query token is accepted ONLY on the cookie
+  // exchange paths (the console page and the login endpoint). Everywhere else
+  // — including all API routes and the WS upgrade — a leaked ?token= URL must
+  // not authenticate writes, so a captured console URL cannot be replayed
+  // cross-site. API clients authenticate with Authorization: Bearer.
+  const pathname = url.pathname || '';
+  const allowQueryToken = pathname === '/' || pathname === '/login';
+  const queryToken = allowQueryToken ? (url.searchParams.get('token') || '') : '';
   const auth = req.headers.authorization || '';
-  return queryToken === token || auth === `Bearer ${token}`;
+  const bearer = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+  return tokenMatches(queryToken, token) || tokenMatches(bearer, token);
 }

package/lib/web/liveness-reaper.mjs

@@ -0,0 +1,145 @@
+// Clock-aware liveness reaper, extracted from lib/web/runtime-main.mjs.
+// Backstop for peers that died without an exit signal: wall-vs-monotonic
+// drift detection, per-project stale candidates, and evidence-checked
+// mutation through the shared clock-safety observer.
+
+import path from 'node:path';
+import fs from 'node:fs';
+import { performance } from 'node:perf_hooks';
+import { CLOCK_GRACE_SEC, classifyClockDrift, clockGraceSuppressed, readClockGraceUntil } from '../shared/clock-grace.mjs';
+import { peerEvidenceAllowsReap } from '../core/peers/evidence.mjs';
+
+export function createLivenessReaper(deps) {
+  const {
+    ctx, projectContexts, sessions,
+    sessionsForProject, connectWebProject,
+    now, addEvent,
+    peerEvidenceFromDb, mutatePeerWithEvidence, observeClockSafetyOrThrow,
+    UNKNOWN_EVIDENCE_GRACE_SEC, redactedLogText, sameResolvedPath
+  } = deps;
+
+
+  // ── Liveness reaper ───────────────────────────────────────────────────────
+  // Backstop for peers that died without an exit signal (kill -9, crash, a
+  // provider Stop hook that never fired). Confirmed-dead owners are reaped
+  // immediately; unknown evidence must remain stale through the shared grace.
+  // This only detaches DB state and never authorizes tmux destruction.
+  let reaperInFlight = false;
+  // Compare wall time with a monotonic clock so an event-loop stall or machine
+  // sleep does not look like a wall-clock step. Only their drift is safety
+  // relevant; on a jump, the shared observer evaluates current owner evidence.
+  let lastClockProbe = { wallMs: Date.now(), monotonicMs: performance.now() };
+  function detectClockJump() {
+    const current = { wallMs: Date.now(), monotonicMs: performance.now() };
+    const wallDeltaMs = current.wallMs - lastClockProbe.wallMs;
+    const monotonicDeltaMs = current.monotonicMs - lastClockProbe.monotonicMs;
+    lastClockProbe = current;
+    const jump = classifyClockDrift({ wallDeltaMs, monotonicDeltaMs });
+    if (jump) {
+      console.error(redactedLogText(`[${new Date().toISOString()}] wall-clock ${jump.kind} drift detected (${jump.driftMs >= 0 ? '+' : ''}${Math.round(jump.driftMs / 1000)}s); evaluating ownership evidence with a ${CLOCK_GRACE_SEC}s unknown-evidence grace window`));
+    }
+    return jump;
+  }
+
+  function runtimeProjectContexts() {
+    const contexts = new Map([[path.resolve(ctx.root), ctx]]);
+    for (const projectCtx of projectContexts.values()) {
+      if (!sameResolvedPath(projectCtx.root, ctx.root)) {
+        try {
+          if (!fs.statSync(projectCtx.root).isDirectory() || !fs.statSync(projectCtx.dbPath).isFile()) continue;
+        } catch {
+          continue;
+        }
+      }
+      contexts.set(path.resolve(projectCtx.root), projectCtx);
+    }
+    return [...contexts.values()];
+  }
+
+  function runClockAwareReaper() {
+    if (reaperInFlight) return;
+    reaperInFlight = true;
+    try {
+      // Probe exactly once per scheduler tick. A clock jump is machine-wide;
+      // each project feeds that signal and its own evidence snapshot through
+      // the shared observer rather than maintaining runtime-only grace state.
+      const jump = detectClockJump();
+      for (const projectCtx of runtimeProjectContexts()) {
+        let db = null;
+        try {
+          db = connectWebProject(projectCtx, { migrateRegistered: false, create: false });
+          const t = now();
+          const managedPeerIds = new Set();
+          for (const session of sessionsForProject(projectCtx)) {
+            if (session.status !== 'running') continue;
+            const managedId = session.peerId || session.id;
+            if (managedId && peerEvidenceFromDb(db, projectCtx, managedId).state === 'live') {
+              managedPeerIds.add(managedId);
+            }
+          }
+          const rows = db.prepare(`
+            SELECT p.id, p.status, p.pid, p.pid_start_token, p.pid_command_hash, p.last_seen_at,
+                   b.transport, b.runtime_target
+            FROM peers p
+            LEFT JOIN peer_bindings b ON b.peer = p.id
+            WHERE p.status IN ('running', 'working', 'busy')
+              AND p.last_seen_at < ?
+          `).all(t - UNKNOWN_EVIDENCE_GRACE_SEC);
+          const candidates = rows.map((row) => {
+            const evidence = peerEvidenceFromDb(db, projectCtx, row.id);
+            return {
+              boundary: Number(row.last_seen_at) + UNKNOWN_EVIDENCE_GRACE_SEC,
+              evidence: evidence.state,
+              owner: row.id
+            };
+          });
+          observeClockSafetyOrThrow(db, {
+            operation: 'ownership',
+            candidates,
+            nowSec: t,
+            clockJump: jump
+          });
+          // Unknown evidence is the only reason a jump opens blanket grace.
+          // Probes above completed before the observer's write transaction.
+          if (clockGraceSuppressed(t, readClockGraceUntil(db))) continue;
+          for (const row of rows) {
+            if (managedPeerIds.has(row.id)) continue;
+            mutatePeerWithEvidence(db, projectCtx, row.id, (subject, evidence) => {
+              db.prepare('UPDATE peers SET status = ? WHERE id = ?').run('exited', row.id);
+              db.prepare('UPDATE peer_bindings SET runtime_target = NULL, updated_at = ? WHERE peer = ?').run(t, row.id);
+              try {
+                addEvent(db, 'peer.reaped', 'web-runtime', null, {
+                  peer: row.id,
+                  pid: subject.peer.pid,
+                  reason: evidence.reason
+                });
+              } catch {}
+            }, {
+              acceptEvidence: (currentEvidence, subject) => peerEvidenceAllowsReap(currentEvidence, {
+                nowSec: now(),
+                lastSeenAt: Number(subject.peer.last_seen_at),
+                staleAfterSec: UNKNOWN_EVIDENCE_GRACE_SEC,
+                graceUntil: readClockGraceUntil(db)
+              }),
+              beforeMutate: ({ subject, evidence: currentEvidence }) => peerEvidenceAllowsReap(currentEvidence, {
+                nowSec: now(),
+                lastSeenAt: Number(subject.peer.last_seen_at),
+                staleAfterSec: UNKNOWN_EVIDENCE_GRACE_SEC,
+                graceUntil: readClockGraceUntil(db)
+              })
+            });
+          }
+        } catch (err) {
+          console.error(redactedLogText(`[${new Date().toISOString()}] liveness reaper failed for ${projectCtx.root}: ${err?.message || err}`));
+        } finally {
+          try { db?.close(); } catch {}
+        }
+      }
+    } finally {
+      reaperInFlight = false;
+    }
+  }
+  const reaperPoller = setInterval(runClockAwareReaper, 30000);
+
+  return { reaperPoller, runtimeProjectContexts, runClockAwareReaper, detectClockJump };
+}

package/lib/web/peer-actions.mjs

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import process from 'node:process';
-import { intOpt, required } from '../cli-args.mjs';
+import { intOpt, positiveSafeIntOpt, required } from '../cli-args.mjs';
 import { CliError } from '../shared/errors.mjs';
 import {
   lockLabel,
@@ -9,6 +9,19 @@ import {
   scopedLockResource
 } from '../core/coordination/locks.mjs';
 import { normalizeStateResources } from '../ui/state-render.mjs';
+import {
+  clockGraceSuppressed
+} from '../shared/clock-grace.mjs';
+import {
+  captureLockAcquireSubject,
+  captureLockRenewalSubject,
+  clockCandidatesFromLocks,
+  observeLockOwnerEvidence,
+  sameLockAcquireSubject
+} from '../core/coordination/lock-evidence.mjs';
+import { runOptimisticEvidenceMutation } from '../core/coordination/optimistic-evidence.mjs';
+import { clockSafetyUnavailable } from '../core/coordination/clock-safety.mjs';
+import { leaseDeadline, renewOwnedLocks } from '../core/coordination/lease-renewal.mjs';
 
 const DEFAULT_ACTIVE_PEER_TTL = 600;
 const DEFAULT_LOCK_TTL = 900;
@@ -36,6 +49,12 @@ export function createWebPeerActions(deps = {}) {
   const defaultLockTtl = Number(deps.defaultLockTtl ?? DEFAULT_LOCK_TTL);
   const detectBranch = requireFn(deps.detectBranch, 'detectBranch');
   const now = typeof deps.now === 'function' ? deps.now : defaultNow;
+  const observeClockSafetyInTransaction = requireFn(
+    deps.observeClockSafetyInTransaction,
+    'observeClockSafetyInTransaction'
+  );
+  const observePeerEvidence = typeof deps.observePeerEvidence === 'function' ? deps.observePeerEvidence : null;
+  const peerEvidenceFromDb = requireFn(deps.peerEvidenceFromDb, 'peerEvidenceFromDb');
   const positiveIntOpt = requireFn(deps.positiveIntOpt, 'positiveIntOpt');
   const queryInbox = requireFn(deps.queryInbox, 'queryInbox');
   const statusSnapshot = requireFn(deps.statusSnapshot, 'statusSnapshot');
@@ -45,6 +64,18 @@ export function createWebPeerActions(deps = {}) {
   const tx = requireFn(deps.tx, 'tx');
   const upsertPeer = requireFn(deps.upsertPeer, 'upsertPeer');
 
+  function prepareClockObservation(db, subject, evidenceByOwner) {
+    try {
+      return observeClockSafetyInTransaction(db, {
+        operation: 'ownership',
+        candidates: clockCandidatesFromLocks(subject, evidenceByOwner),
+        nowSec: subject.observedAt
+      });
+    } catch (error) {
+      throw clockSafetyUnavailable(error);
+    }
+  }
+
   function webMutationPeer(peer, input = {}) {
     const actorPeer = String(input.actorPeer || input.actor_peer || '').trim();
     if (!actorPeer) {
@@ -93,19 +124,53 @@ export function createWebPeerActions(deps = {}) {
 
   function webPeerHeartbeat(projectCtx, peer, input = {}) {
     webMutationPeer(peer, input);
-    const ttl = intOpt(input, 'ttl', defaultLockTtl);
+    const ttlOverride = input.ttl === undefined
+      ? null
+      : positiveSafeIntOpt(input, 'ttl', defaultLockTtl);
     const status = input.status || null;
     const renewLocks = input['renew-locks'] !== false && input.renew_locks !== false;
-    const db = connect(projectCtx);
     const t = now();
+    if (ttlOverride !== null) leaseDeadline(t, ttlOverride);
+    const db = connect(projectCtx);
     let renewed = 0;
     try {
       touchPeer(db, peer, status);
       if (renewLocks) {
-        renewed = db.prepare(`
-          UPDATE locks SET expires_at = ?
-          WHERE owner = ? AND expires_at > ?
-        `).run(t + ttl, peer, t).changes;
+        try {
+          renewed = runOptimisticEvidenceMutation(db, {
+            capture: (subjectDb) => {
+              try {
+                return captureLockRenewalSubject(subjectDb, { owner: peer, now: t });
+              } catch (error) {
+                throw clockSafetyUnavailable(error);
+              }
+            },
+            observe: (subject) => new Map([[
+              peer,
+              subject.peer
+                ? (observePeerEvidence
+                    ? observePeerEvidence(projectCtx, subject.peer, subject.binding)
+                    : peerEvidenceFromDb(db, projectCtx, peer))
+                : { state: 'unknown', reason: 'peer_missing' }
+            ]]),
+            same: (left, right) => JSON.stringify(left) === JSON.stringify(right),
+            beforeMutate: (subject, evidenceByOwner) =>
+              prepareClockObservation(db, subject, evidenceByOwner),
+            changedMessage: `Lock subjects changed while renewing locks for ${peer}; retry`,
+            mutate: (subject, evidenceByOwner) => {
+              const evidenceLive = evidenceByOwner.get(peer)?.state === 'live';
+              return renewOwnedLocks(db, {
+                owner: peer,
+                nowSec: t,
+                ttlOverride,
+                includeExpired: evidenceLive
+              });
+            }
+          });
+        } catch (error) {
+          if (error instanceof CliError) throw error;
+          throw clockSafetyUnavailable(error);
+        }
       }
       addEvent(db, 'peer.heartbeat', peer, null, webAuditPayload(peer, input, { status, renewed }));
     } finally {
@@ -149,12 +214,20 @@ export function createWebPeerActions(deps = {}) {
     const id = intOpt(input, 'id', intOpt({ id: input.task }, 'id'));
     if (!id) throw new CliError('BAD_REQUEST', 'task id required');
     const reason = required(input, 'reason');
-    const policy = input.policy || 'any';
+    const policy = input.force ? 'any' : (input.policy || 'blocked-or-stale');
     const staleAfter = positiveIntOpt(input, 'stale-after', intOpt(input, 'stale_after', activePeerTtl), { max: 86400 * 30 });
     const db = connect(projectCtx);
     try {
       touchPeer(db, peer, 'working');
-      const task = takeOverTaskForPeer(db, peer, id, { reason, policy, staleAfter, source: 'web' });
+      const task = takeOverTaskForPeer(db, peer, id, {
+        reason,
+        policy,
+        staleAfter,
+        source: 'web',
+        ownerEvidenceFor: (owner, _row, ownerRow, binding) => observePeerEvidence
+          ? observePeerEvidence(projectCtx, ownerRow, binding)
+          : peerEvidenceFromDb(db, projectCtx, owner)
+      });
       return { peer, task, summary: `took over task #${task.id}: ${task.title}` };
     } finally {
       db.close();
@@ -164,46 +237,82 @@ export function createWebPeerActions(deps = {}) {
   function webPeerLockAcquire(projectCtx, peer, input = {}) {
     webMutationPeer(peer, input);
     const requested = scopedLockResource(required(input, 'resource'), input.scope);
-    const ttl = intOpt(input, 'ttl', defaultLockTtl);
+    const ttl = positiveSafeIntOpt(input, 'ttl', defaultLockTtl);
     const taskId = intOpt(input, 'task', intOpt(input, 'task_id', null));
     const reason = input.reason || '';
+    const acquisitionNow = now();
+    leaseDeadline(acquisitionNow, ttl);
     const db = connect(projectCtx);
     try {
       touchPeer(db, peer, 'working');
-      const lock = tx(db, () => {
-        const t = now();
+      const outcome = runOptimisticEvidenceMutation(db, {
+        capture: (subjectDb) => {
+          try {
+            return captureLockAcquireSubject(subjectDb, {
+              taskId,
+              requested,
+              now: acquisitionNow
+            });
+          } catch (error) {
+            throw clockSafetyUnavailable(error);
+          }
+        },
+        observe: (subject) => observeLockOwnerEvidence(subject, (row, binding) => observePeerEvidence
+          ? observePeerEvidence(projectCtx, row, binding)
+          : peerEvidenceFromDb(db, projectCtx, row.id)),
+        same: sameLockAcquireSubject,
+        beforeMutate: (subject, evidenceByOwner) =>
+          prepareClockObservation(db, subject, evidenceByOwner),
+        changedMessage: `Lock subjects changed while acquiring ${lockLabel(requested)}; retry`,
+        mutate: (subject, evidenceByOwner, clockObservation) => {
+        const t = subject.observedAt;
         if (taskId) {
-          const task = db.prepare('SELECT * FROM tasks WHERE id = ?').get(taskId);
+          const task = subject.task;
           if (!task) throw new CliError('NOT_FOUND', `Task #${taskId} does not exist`);
           assertTaskOwnerForMutation(db, peer, task, 'lock-acquire');
         }
-        const activeLocks = db.prepare('SELECT * FROM locks WHERE expires_at > ?').all(t);
-        const conflict = activeLocks.find((row) => locksConflict(row, requested) && row.owner !== peer);
+        // During clock grace, retained lock rows still conflict — but NOT
+        // EXPIRED locks of verified-dead owners (CS-04): a dead owner's expired
+        // lock must not block acquisition while the GC that would delete the row
+        // is itself deferred by the same grace window.
+        const graceActive = clockGraceSuppressed(t, clockObservation.graceUntil);
+        const conflict = subject.locks.find((row) => {
+          if (row.owner === peer || !locksConflict(row, requested)) return false;
+          const ownerEvidence = evidenceByOwner.get(row.owner)?.state;
+          if (graceActive && Number(row.expires_at) <= t && ownerEvidence === 'dead') return false;
+          return graceActive || Number(row.expires_at) > t || ownerEvidence === 'live';
+        });
         if (conflict) {
-          throw new CliError('LOCK_HELD', `Resource ${lockLabel(requested)} conflicts with lock ${lockLabel(conflict)} held by ${conflict.owner}`, {
+          return { error: new CliError('LOCK_HELD', `Resource ${lockLabel(requested)} conflicts with lock ${lockLabel(conflict)} held by ${conflict.owner}`, {
             resource: requested.base_resource,
             scope: requested.scope,
             lock_resource: conflict.resource,
             lock_scope: lockScope(conflict),
             owner: conflict.owner,
             expires_at: iso(conflict.expires_at)
-          });
+          }) };
         }
-        const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
+        const existing = subject.locks.find((row) => row.resource === requested.resource) || null;
+        const expiresAt = leaseDeadline(t, ttl);
         db.prepare(`
-          INSERT INTO locks(resource, base_resource, scope, owner, task_id, reason, expires_at, created_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+          INSERT INTO locks(resource, base_resource, scope, owner, task_id, reason, expires_at, created_at, ttl_sec)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
           ON CONFLICT(resource) DO UPDATE SET
             base_resource = excluded.base_resource,
             scope = excluded.scope,
             owner = excluded.owner,
             task_id = excluded.task_id,
             reason = excluded.reason,
-            expires_at = excluded.expires_at
-        `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, t + ttl, existing ? existing.created_at : t);
+            expires_at = excluded.expires_at,
+            created_at = excluded.created_at,
+            ttl_sec = excluded.ttl_sec
+        `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, expiresAt, t, ttl);
         addEvent(db, 'lock.acquired', peer, taskId, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null }));
-        return db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
+        return { lock: db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource) };
+        }
       });
+      if (outcome.error) throw outcome.error;
+      const lock = outcome.lock;
       return { peer, lock, summary: `locked ${lockLabel(lock)} by ${lock.owner} until ${iso(lock.expires_at)}` };
     } finally {
       db.close();