@mcpjam/inspector 3.12.4 → 3.12.5

package/dist/server/{chunk-5T6DFO27.js → chunk-QA6VJT6A.js}

@@ -37,7 +37,7 @@ function resolveEnvironment() {
   }
   return "dev";
 }
-var BAKED_VERSION = "3.12.4";
+var BAKED_VERSION = "3.12.5";
 function blankToNull(value) {
   return value === void 0 || value.trim() === "" ? null : value;
 }
@@ -367,91 +367,6 @@ function emit(eventName, base, payload, options) {
 }
 process.on("beforeExit", () => logger.flush());
 
-// server/utils/harness/local/runtime-install.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { createReadStream, createWriteStream } from "fs";
-import {
-  mkdir as mkdir3,
-  readdir as readdir4,
-  readFile as readFile5,
-  rename as rename2,
-  rm as rm3,
-  stat as stat4,
-  writeFile as writeFile3
-} from "fs/promises";
-import { homedir } from "os";
-import { basename, join as join5 } from "path";
-import { pipeline } from "stream/promises";
-import { Readable } from "stream";
-import { x as extractTar } from "tar";
-
-// server/utils/harness/local/pack-digests.generated.ts
-var PACK_TREE_DIGESTS = {
-  "claude-code": {},
-  codex: {}
-};
-var PACK_RECORDS = {
-  "claude-code": {},
-  codex: {}
-};
-var EXPECTED_PACK_VERSION = "";
-
-// server/utils/harness/local/pack-signing-key.ts
-import { createPublicKey, verify as edVerify } from "crypto";
-var PACK_SIGNING_KEYS = [
-  {
-    // Generated 2026-09-02. The private half went straight into the CI secret
-    // `LOCAL_HARNESS_PACK_SIGNING_KEY` and exists nowhere else — there is no
-    // copy to lose, and recovery is rotation, not restore.
-    keyId: "pack-2026-09",
-    publicKeyPem: `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAjaZXzr+4k5pJEuzIy5JUU858ksLJgjZv9b9jxmNhV6A=
------END PUBLIC KEY-----
-`
-  }
-];
-function verifyPackManifestSignature(manifestBytes, signatureBase64, keys = PACK_SIGNING_KEYS) {
-  if (keys.length === 0) {
-    return {
-      ok: false,
-      reason: "no-keys",
-      message: "this Inspector build carries no runtime pack signing key, so it cannot verify that a downloaded pack came from MCPJam. Packs are installable from a local path for development only."
-    };
-  }
-  let signature;
-  try {
-    signature = Buffer.from(signatureBase64.trim(), "base64");
-    if (signature.length === 0) throw new Error("empty");
-  } catch {
-    return {
-      ok: false,
-      reason: "malformed",
-      message: "the pack manifest signature is not valid base64"
-    };
-  }
-  for (const key of keys) {
-    try {
-      const publicKey = createPublicKey(key.publicKeyPem);
-      if (edVerify(null, manifestBytes, publicKey, signature)) {
-        return { ok: true, keyId: key.keyId };
-      }
-    } catch {
-      continue;
-    }
-  }
-  return {
-    ok: false,
-    reason: "bad-signature",
-    message: "the runtime pack manifest is not signed by any key this Inspector trusts, so the pack is refused"
-  };
-}
-
-// server/utils/harness/local/runtime-identity.ts
-import { createHash } from "crypto";
-import { execFile as execFile2 } from "child_process";
-import { readdir as readdir2, readFile as readFile2, realpath, stat } from "fs/promises";
-import { dirname, isAbsolute, join as join2, normalize, relative, sep } from "path";
-
 // server/utils/harness/local/targets.ts
 var LOCAL_PACK_TARGETS = /* @__PURE__ */ new Set([
   "darwin-arm64",
@@ -464,7 +379,7 @@ function localPackTarget(platform = process.platform, arch = process.arch) {
   const key = `${platform}-${arch}`;
   return LOCAL_PACK_TARGETS.has(key) ? key : null;
 }
-var LOCAL_HARNESS_POLICY_VERSION = "local-harness-policy-2026-09-01";
+var LOCAL_HARNESS_POLICY_VERSION = "local-harness-policy-2026-09-28";
 var LOCAL_ISOLATION_POLICY_VERSION = "local-isolation-policy-2026-09-01";
 function currentLocalPlatform(platform = process.platform) {
   if (platform === "darwin" || platform === "linux" || platform === "win32") {
@@ -473,446 +388,909 @@ function currentLocalPlatform(platform = process.platform) {
   return null;
 }
 
-// server/utils/harness/local/process-identity.ts
-import { execFile, spawn } from "child_process";
-import { readdir, readFile } from "fs/promises";
+// server/utils/harness/local/runtime-lifecycle.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  mkdir as mkdir2,
+  readdir,
+  readFile as readFile2,
+  rename,
+  rm as rm2,
+  stat as stat2,
+  writeFile as writeFile2
+} from "fs/promises";
+import { join as join2 } from "path";
+
+// server/utils/harness/local/local-state-lock.ts
+import { randomUUID } from "crypto";
+import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
 import { join } from "path";
-var PS_TIMEOUT_MS = 3e3;
-function parseLinuxProcStat(raw) {
-  const close = raw.lastIndexOf(")");
-  if (close === -1) return null;
-  const fields = raw.slice(close + 2).split(" ");
-  const state = fields[0];
-  const starttime = fields[19];
-  if (!state || !/^[A-Za-z]$/.test(state)) return null;
-  if (!starttime || !/^\d+$/.test(starttime)) return null;
-  return { state, starttime };
-}
-function isDeadState(state) {
-  return state === "Z" || state === "X" || state === "x";
+var DEFAULT_STALE_MS = 3e4;
+var DEFAULT_POLL_MS = 25;
+var DEFAULT_TIMEOUT_MS = 45e3;
+async function readLockBody(file) {
+  try {
+    const parsed = JSON.parse(await readFile(file, "utf8"));
+    if (!parsed || typeof parsed !== "object") return null;
+    const body = parsed;
+    if (typeof body.pid !== "number" || !Number.isInteger(body.pid) || body.pid <= 0 || typeof body.nonce !== "string" || body.nonce.length === 0) {
+      return null;
+    }
+    return { pid: body.pid, nonce: body.nonce, at: Number(body.at) || 0 };
+  } catch {
+    return null;
+  }
 }
-async function probeLinux(pid) {
-  let raw;
+function lockHolderProvablyGone(body) {
+  if (body === null || body.pid === process.pid) return false;
   try {
-    raw = await readFile(`/proc/${pid}/stat`, "utf8");
+    process.kill(body.pid, 0);
+    return false;
   } catch (error) {
-    const code = error.code;
-    if (code === "ENOENT" || code === "ESRCH") return { state: "gone" };
-    return {
-      state: "unknown",
-      reason: `/proc read failed (${code ?? "unknown"})`
-    };
-  }
-  const parsed = parseLinuxProcStat(raw);
-  if (parsed === null) {
-    return { state: "unknown", reason: "unparseable /proc stat line" };
+    return error.code === "ESRCH";
   }
-  if (isDeadState(parsed.state)) return { state: "gone" };
-  return { state: "alive", identity: `linux:${parsed.starttime}` };
-}
-function parseDarwinPsLine(raw) {
-  const line = raw.trim();
-  if (line.length === 0) return null;
-  const match = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+([\s\S]+)$/.exec(line);
-  if (match === null) return null;
-  const state = match[1];
-  const lstart = [match[2], match[3], match[4], match[5], match[6]].join(" ");
-  const command = match[7];
-  return { state, lstart, command };
 }
-async function probeDarwin(pid) {
-  const result = await new Promise((resolve) => {
-    execFile(
-      "/bin/ps",
-      ["-o", "state=,lstart=,command=", "-p", String(pid)],
-      {
-        timeout: PS_TIMEOUT_MS,
-        maxBuffer: 16 * 1024,
-        encoding: "utf8",
-        env: {}
-      },
-      (error, out) => {
-        if (!error) {
-          resolve({ ok: true, stdout: typeof out === "string" ? out : "" });
-          return;
+function createLocalStateMutationLock(options) {
+  let mutationChain = Promise.resolve();
+  const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const acquire = async () => {
+    const root = options.rootDir();
+    const file = join(root, options.lockFileName);
+    await mkdir(root, { recursive: true, mode: 448 });
+    const nonce = randomUUID();
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      try {
+        await writeFile(
+          file,
+          JSON.stringify({ pid: process.pid, nonce, at: Date.now() }),
+          { flag: "wx", mode: 384 }
+        );
+        return async () => {
+          const held = await readLockBody(file);
+          if (held?.nonce !== nonce) {
+            logger.warn(
+              `[local-harness] ${options.resourceLabel} lock was taken over; not releasing`
+            );
+            return;
+          }
+          await rm(file, { force: true }).catch(() => {
+          });
+        };
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        const body = await readLockBody(file);
+        const age = await stat(file).then(
+          (info) => Date.now() - info.mtimeMs,
+          () => 0
+        );
+        const holderGone = lockHolderProvablyGone(body);
+        const unattributable = body === null && age > staleMs;
+        if (holderGone || unattributable) {
+          logger.warn(
+            `[local-harness] breaking an abandoned ${options.resourceLabel} lock`,
+            { age, holderGone, unattributable }
+          );
+          await rm(file, { force: true }).catch(() => {
+          });
+          continue;
         }
-        const err = error;
-        resolve({
-          ok: false,
-          // `ps` exits 1 when no process matches — that IS an answer. A kill
-          // (timeout) or a spawn failure is not.
-          exitCode: typeof err.code === "number" ? err.code : null,
-          reason: err.killed ? "ps timed out" : `ps failed (${String(err.code ?? "unknown")})`
-        });
+        if (Date.now() > deadline) {
+          throw new Error(
+            `timed out waiting for the local harness ${options.resourceLabel} lock` + (body === null ? "" : ` (held by pid ${body.pid})`) + ". Its holder could not be proven gone, and taking it over would admit concurrent state writers."
+          );
+        }
+        await new Promise(
+          (resolvePromise) => setTimeout(resolvePromise, pollMs)
+        );
+      }
+    }
+  };
+  return (operation) => {
+    const guarded = async () => {
+      const release = await acquire();
+      try {
+        return await operation();
+      } finally {
+        await release();
       }
+    };
+    const run = mutationChain.then(guarded, guarded);
+    mutationChain = run.then(
+      () => void 0,
+      () => void 0
     );
-  });
-  if (!result.ok) {
-    if (result.exitCode === 1) return { state: "gone" };
-    return { state: "unknown", reason: result.reason };
-  }
-  const parsed = parseDarwinPsLine(result.stdout);
-  if (parsed === null) {
-    return result.stdout.trim().length === 0 ? { state: "gone" } : { state: "unknown", reason: "unparseable ps output" };
-  }
-  if (isDeadState(parsed.state.charAt(0))) return { state: "gone" };
-  return {
-    state: "alive",
-    identity: `darwin:${parsed.lstart}|${parsed.command}`
+    return run;
   };
 }
-var WIN32_PROBE_TIMEOUT_MS = 15e3;
-function win32SystemRoot() {
-  return process.env.SYSTEMROOT ?? process.env.WINDIR ?? "C:\\Windows";
-}
-function win32PowerShellPath() {
-  return join(
-    win32SystemRoot(),
-    "System32",
-    "WindowsPowerShell",
-    "v1.0",
-    "powershell.exe"
-  );
+
+// server/utils/harness/local/runtime-lifecycle.ts
+var OPERATION_FILE = ".mcpjam-operation.json";
+var USE_DIR = ".mcpjam-inuse";
+var STAGING_PREFIX = ".mcpjam-tmp-";
+var STAGING_OWNER_FILE = ".mcpjam-staging-owner.json";
+function operationKeyString(key) {
+  return [
+    key.runtimeRoot,
+    key.harnessId,
+    key.target,
+    key.packVersion,
+    key.treeDigest
+  ].join("\0");
 }
-function parseWin32ProbeLine(raw) {
-  const line = raw.trim();
-  const match = /^(\d+)\|(.+)$/.exec(line);
-  if (match === null) return null;
-  return { fileTime: match[1], name: match[2] };
+function installRootOf(key) {
+  return join2(key.runtimeRoot, key.target);
 }
-async function probeWin32(pid) {
+var locksByRoot = /* @__PURE__ */ new Map();
+function lockFor(key) {
+  const root = installRootOf(key);
+  let lock = locksByRoot.get(root);
+  if (lock === void 0) {
+    lock = createLocalStateMutationLock({
+      rootDir: () => root,
+      lockFileName: ".mcpjam-runtime-lifecycle.lock",
+      resourceLabel: "runtime lifecycle",
+      // Short by construction: every critical section here is a read, a
+      // compare and an atomic write. A caller waiting longer than this is
+      // waiting on something that is not doing that.
+      timeoutMs: 15e3
+    });
+    locksByRoot.set(root, lock);
+  }
+  return lock;
+}
+function ownerProvablyGone(record) {
+  if (record.ownerPid === process.pid) {
+    return record.ownerStartedAt !== processStartedAt();
+  }
   try {
-    process.kill(pid, 0);
+    process.kill(record.ownerPid, 0);
+    return false;
   } catch (error) {
-    const code = error.code;
-    if (code === "ESRCH") return { state: "gone" };
-    if (code !== "EPERM") {
-      return {
-        state: "unknown",
-        reason: `kill(0) failed (${code ?? "unknown"})`
-      };
-    }
+    return error.code === "ESRCH";
   }
-  const script = [
-    `$p = Get-Process -Id ${pid} -ErrorAction SilentlyContinue`,
-    "if ($null -eq $p) { exit 1 }",
-    "try { $t = $p.StartTime.ToFileTimeUtc() } catch { exit 3 }",
-    "Write-Output ('{0}|{1}' -f $t, $p.ProcessName)"
-  ].join("; ");
-  const result = await new Promise((resolve) => {
-    let settled = false;
-    let timer;
-    const done = (value) => {
-      if (settled) return;
-      settled = true;
-      if (timer !== void 0) clearTimeout(timer);
-      resolve(value);
-    };
-    let child;
-    try {
-      child = spawn(
-        win32PowerShellPath(),
-        [
-          "-NoProfile",
-          "-NonInteractive",
-          "-InputFormat",
-          "None",
-          "-ExecutionPolicy",
-          "Bypass",
-          "-Command",
-          script
-        ],
-        { stdio: ["ignore", "pipe", "pipe"], env: process.env, windowsHide: true }
-      );
-    } catch (error) {
-      done({
-        ok: false,
-        exitCode: null,
-        reason: `PowerShell failed to start (${String(
-          error.code ?? "unknown"
-        )})`
-      });
-      return;
+}
+var cachedStartedAt = null;
+function processStartedAt() {
+  if (cachedStartedAt === null) {
+    cachedStartedAt = Math.floor((Date.now() - process.uptime() * 1e3) / 1e3);
+  }
+  return cachedStartedAt;
+}
+async function writeJsonAtomic(file, value) {
+  const tmp = `${file}.${process.pid}.${randomUUID2()}.tmp`;
+  await writeFile2(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  await rename(tmp, file);
+}
+async function readJson(file) {
+  try {
+    return JSON.parse(await readFile2(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function readRuntimeOperation(key) {
+  const file = join2(installRootOf(key), OPERATION_FILE);
+  const record = await readJson(file);
+  if (record === null) return null;
+  if (record.packVersion !== key.packVersion || record.treeDigest !== key.treeDigest || record.harnessId !== key.harnessId) {
+    return null;
+  }
+  const terminal = record.state === "ready" || record.state === "failed" || record.state === "interrupted";
+  if (terminal || !ownerProvablyGone(record)) return record;
+  return lockFor(key)(async () => {
+    const fresh = await readJson(file);
+    if (fresh === null) return null;
+    if (fresh.attemptId !== record.attemptId) return fresh;
+    if (fresh.state === "ready" || fresh.state === "failed" || fresh.state === "interrupted") {
+      return fresh;
     }
-    let stdout = "";
-    child.stdout?.setEncoding("utf8");
-    child.stdout?.on("data", (chunk) => {
-      if (stdout.length < 16 * 1024) stdout += chunk;
+    if (!ownerProvablyGone(fresh)) return fresh;
+    const reconciled = {
+      ...fresh,
+      state: "interrupted",
+      message: "the Inspector that started this install is no longer running, so the attempt was abandoned partway through",
+      updatedAt: Date.now()
+    };
+    await writeJsonAtomic(file, reconciled);
+    logger.info("[local-harness] recovered an interrupted install attempt", {
+      attemptId: reconciled.attemptId,
+      packVersion: reconciled.packVersion
     });
-    child.stderr?.resume();
-    timer = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
+    return reconciled;
+  });
+}
+async function beginInstallAttempt(key) {
+  const root = installRootOf(key);
+  await mkdir2(root, { recursive: true, mode: 448 });
+  const file = join2(root, OPERATION_FILE);
+  return lockFor(key)(async () => {
+    const existing = await readJson(file);
+    if (existing !== null && existing.packVersion === key.packVersion && existing.treeDigest === key.treeDigest && existing.harnessId === key.harnessId) {
+      const live = existing.state !== "ready" && existing.state !== "failed" && existing.state !== "interrupted";
+      if (live && !ownerProvablyGone(existing)) {
+        return { kind: "joined", record: existing };
       }
-      done({ ok: false, exitCode: null, reason: "Get-Process timed out" });
-    }, WIN32_PROBE_TIMEOUT_MS);
-    child.on(
-      "error",
-      (error) => done({
-        ok: false,
-        exitCode: null,
-        reason: `PowerShell failed (${String(error.code ?? "unknown")})`
-      })
-    );
-    child.on("close", (code) => {
-      if (code === 0) done({ ok: true, stdout });
-      else done({ ok: false, exitCode: code, reason: `Get-Process exited ${code}` });
+    }
+    const record = {
+      attemptId: `att_${randomUUID2()}`,
+      ownerPid: process.pid,
+      ownerStartedAt: processStartedAt(),
+      harnessId: key.harnessId,
+      target: key.target,
+      packVersion: key.packVersion,
+      treeDigest: key.treeDigest,
+      state: "reserved",
+      startedAt: Date.now(),
+      updatedAt: Date.now()
+    };
+    await writeJsonAtomic(file, record);
+    return { kind: "started", record };
+  });
+}
+async function updateInstallAttempt(key, attemptId, patch) {
+  const file = join2(installRootOf(key), OPERATION_FILE);
+  return lockFor(key)(async () => {
+    const existing = await readJson(file);
+    if (existing === null || existing.attemptId !== attemptId) return false;
+    await writeJsonAtomic(file, {
+      ...existing,
+      ...patch,
+      updatedAt: Date.now()
     });
+    return true;
   });
-  if (!result.ok) {
-    if (result.exitCode === 1) return { state: "gone" };
-    return { state: "unknown", reason: result.reason };
-  }
-  const parsed = parseWin32ProbeLine(result.stdout);
-  if (parsed === null) {
-    return { state: "unknown", reason: "unparseable Get-Process output" };
-  }
+}
+async function attemptStillOwns(key, attemptId) {
+  const record = await readJson(
+    join2(installRootOf(key), OPERATION_FILE)
+  );
+  return record?.attemptId === attemptId;
+}
+async function reserveRuntimeUse(args) {
+  const dir = join2(installRootOf(args.key), USE_DIR);
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  const file = join2(dir, `${process.pid}-${randomUUID2()}.json`);
+  const record = {
+    pid: process.pid,
+    startedAt: processStartedAt(),
+    runtimeRoot: args.runtimeRoot,
+    at: Date.now(),
+    ...args.label ? { label: args.label } : {}
+  };
+  await writeJsonAtomic(file, record);
+  let released = false;
   return {
-    state: "alive",
-    identity: `win32:${parsed.fileTime}|${parsed.name}`
+    release: async () => {
+      if (released) return;
+      released = true;
+      await rm2(file, { force: true }).catch(() => {
+      });
+    }
   };
 }
-async function probeProcess(pid, platform = process.platform) {
-  if (!Number.isInteger(pid) || pid <= 0) {
-    return { state: "unknown", reason: "implausible pid" };
+async function runtimeUseState(args) {
+  const dir = join2(installRootOf(args.key), USE_DIR);
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return { busy: false, holders: [] };
   }
-  if (platform === "linux") return probeLinux(pid);
-  if (platform === "darwin") return probeDarwin(pid);
-  if (platform === "win32") return probeWin32(pid);
-  return { state: "unknown", reason: `no liveness primitive on ${platform}` };
-}
-async function readProcessBirthIdentity(pid, platform = process.platform) {
-  const probe = await probeProcess(pid, platform);
-  return probe.state === "alive" ? probe.identity : null;
-}
-function supportsOwnershipProof(platform = process.platform) {
-  if (platform === "linux" || platform === "darwin") return true;
-  if (platform === "win32") return windowsJobLauncherVerified;
-  return false;
-}
-var windowsJobLauncherVerified = false;
-function setWindowsJobLauncherVerified(verified) {
-  windowsJobLauncherVerified = verified;
-}
-function sameBirthIdentity(recorded, current) {
-  if (recorded === current) return true;
-  const r = /^darwin:([^|]+)\|([\s\S]*)$/.exec(recorded);
-  const c = /^darwin:([^|]+)\|([\s\S]*)$/.exec(current);
-  if (r === null || c === null) return false;
-  return r[1] === c[1] && /^\([^()]+\)$/.test(c[2]);
-}
-async function listGroupMembers(pgid, platform = process.platform) {
-  let pids = [];
-  if (platform === "darwin") {
-    const out = await new Promise((resolve) => {
-      execFile(
-        "/bin/ps",
-        ["-o", "pid=,state=", "-g", String(pgid)],
-        { timeout: PS_TIMEOUT_MS, maxBuffer: 64 * 1024, encoding: "utf8", env: {} },
-        (error, stdout) => resolve(error ? error.code === 1 ? "" : null : String(stdout))
-      );
-    });
-    if (out === null) return null;
-    pids = out.split("\n").map((l) => l.trim().split(/\s+/)).filter((f) => f.length >= 2 && /^\d+$/.test(f[0]) && !isDeadState(f[1].charAt(0))).map((f) => Number(f[0]));
-  } else if (platform === "linux") {
-    let entries;
-    try {
-      entries = await readdir("/proc");
-    } catch {
-      return null;
-    }
-    for (const entry of entries) {
-      if (!/^\d+$/.test(entry)) continue;
-      let raw;
-      try {
-        raw = await readFile(`/proc/${entry}/stat`, "utf8");
-      } catch {
-        continue;
-      }
-      const parsed = parseProcStatGroup(raw);
-      if (parsed !== null && parsed.pgrp === pgid && !isDeadState(parsed.state.charAt(0))) pids.push(Number(entry));
-    }
-  } else {
-    return null;
-  }
-  const members = [];
-  for (const pid of pids) {
-    if (pid === pgid) continue;
-    const identity = await readProcessBirthIdentity(pid, platform);
-    if (identity !== null) members.push({ pid, identity });
-  }
-  return members;
-}
-async function terminateOwnedProcess(args) {
-  const platform = args.platform ?? process.platform;
-  const initial = await probeProcess(args.pid, platform);
-  if (initial.state === "gone") return "already-gone";
-  if (initial.state === "unknown") return "unknown";
-  if (!sameBirthIdentity(args.identity, initial.identity)) return "not-owned";
-  const waitGone = async (ms) => {
-    const until = Date.now() + ms;
-    while (Date.now() < until) {
-      const p = await probeProcess(args.pid, platform);
-      if (p.state === "gone") return true;
-      await new Promise((r) => setTimeout(r, 50));
+  const holders = [];
+  for (const entry of entries) {
+    if (!entry.endsWith(".json")) continue;
+    const file = join2(dir, entry);
+    const record = await readJson(file);
+    if (record === null) {
+      continue;
     }
-    return false;
-  };
-  try {
-    process.kill(args.pid, "SIGTERM");
-  } catch {
-    return "already-gone";
-  }
-  if (await waitGone(args.graceMs)) return "graceful";
-  const again = await probeProcess(args.pid, platform);
-  if (again.state === "gone") return "graceful";
-  if (again.state === "unknown") return "unknown";
-  if (!sameBirthIdentity(args.identity, again.identity)) return "not-owned";
-  try {
-    process.kill(args.pid, "SIGKILL");
-  } catch {
-    return "graceful";
-  }
-  return await waitGone(500) ? "forced" : "escaped";
-}
-async function probeProcessGroup(pid, platform = process.platform) {
-  if (!Number.isInteger(pid) || pid <= 0) return "unknown";
-  if (platform === "linux") return probeLinuxGroup(pid);
-  if (platform === "darwin") return probeDarwinGroup(pid);
-  if (platform === "win32") {
-    const root = await probeProcess(pid, platform);
-    if (root.state === "gone") return "empty";
-    if (root.state === "alive") return "live";
-    return "unknown";
-  }
-  return "unknown";
-}
-async function readProcessGroupId(pid, platform = process.platform) {
-  if (!Number.isInteger(pid) || pid <= 0) return null;
-  if (platform === "linux") {
-    try {
-      const raw = await readFile(`/proc/${pid}/stat`, "utf8");
-      return parseProcStatGroup(raw)?.pgrp ?? null;
-    } catch {
-      return null;
+    if (record.runtimeRoot !== args.runtimeRoot) continue;
+    if (ownerProvablyGone({ ownerPid: record.pid, ownerStartedAt: record.startedAt })) {
+      await rm2(file, { force: true }).catch(() => {
+      });
+      continue;
     }
+    holders.push(record.pid);
   }
-  if (platform === "darwin") {
-    return new Promise((resolvePromise) => {
-      execFile(
-        "/bin/ps",
-        ["-o", "pgid=", "-p", String(pid)],
-        {
-          timeout: PS_TIMEOUT_MS,
-          maxBuffer: 4 * 1024,
-          encoding: "utf8",
-          env: {}
-        },
-        (error, stdout) => {
-          if (error) {
-            resolvePromise(null);
-            return;
-          }
-          const parsed = Number(String(stdout).trim());
-          resolvePromise(Number.isInteger(parsed) && parsed > 0 ? parsed : null);
-        }
-      );
-    });
-  }
-  return null;
+  return { busy: holders.length > 0, holders };
 }
-function parseProcStatGroup(raw) {
-  const close = raw.lastIndexOf(")");
-  if (close === -1) return null;
-  const fields = raw.slice(close + 1).trim().split(/\s+/);
-  const state = fields[0];
-  const pgrp = Number(fields[2]);
-  if (state === void 0 || !Number.isInteger(pgrp)) return null;
-  return { state, pgrp };
+async function claimStagingDirectory(args) {
+  await writeJsonAtomic(join2(args.staging, STAGING_OWNER_FILE), {
+    pid: process.pid,
+    startedAt: processStartedAt(),
+    attemptId: args.attemptId,
+    at: Date.now()
+  });
 }
-async function probeLinuxGroup(pgid) {
+async function sweepAbandonedStaging(key) {
+  const root = installRootOf(key);
   let entries;
   try {
-    entries = await readdir("/proc");
+    entries = await readdir(root);
   } catch {
-    return "unknown";
+    return { removed: 0, left: 0 };
   }
-  let blind = false;
+  let removed = 0;
+  let left = 0;
   for (const entry of entries) {
-    if (!/^\d+$/.test(entry)) continue;
-    let raw;
-    try {
-      raw = await readFile(`/proc/${entry}/stat`, "utf8");
-    } catch (error) {
-      const code = error.code;
-      if (code !== "ENOENT" && code !== "ESRCH") blind = true;
+    if (!entry.startsWith(STAGING_PREFIX)) continue;
+    const path = join2(root, entry);
+    const owner = await readJson(join2(path, STAGING_OWNER_FILE));
+    if (owner === null) {
+      left += 1;
       continue;
     }
-    const parsed = parseProcStatGroup(raw);
-    if (parsed === null) {
-      blind = true;
+    if (!ownerProvablyGone({ ownerPid: owner.pid, ownerStartedAt: owner.startedAt })) {
+      left += 1;
       continue;
     }
-    if (parsed.pgrp !== pgid) continue;
-    if (!isDeadState(parsed.state.charAt(0))) return "live";
+    await rm2(path, { recursive: true, force: true }).catch(() => {
+    });
+    removed += 1;
   }
-  return blind ? "unknown" : "empty";
+  if (removed > 0 || left > 0) {
+    logger.debug("[local-harness] staging sweep", { removed, left });
+  }
+  return { removed, left };
 }
-async function probeDarwinGroup(pgid) {
-  const result = await new Promise((resolve) => {
-    execFile(
-      "/bin/ps",
-      ["-o", "state=", "-g", String(pgid)],
-      {
-        timeout: PS_TIMEOUT_MS,
-        maxBuffer: 64 * 1024,
-        encoding: "utf8",
-        env: {}
-      },
-      (error, out) => {
-        if (!error) {
-          resolve({ ok: true, stdout: typeof out === "string" ? out : "" });
-          return;
-        }
-        const err = error;
-        resolve({ ok: false, empty: err.killed !== true && err.code === 1 });
-      }
+async function recoverInterruptedActivation(args) {
+  const previous = `${args.versionRoot}${PREVIOUS_SUFFIX}`;
+  const hasPrevious = await stat2(previous).then(
+    (info) => info.isDirectory(),
+    () => false
+  );
+  if (!hasPrevious) return false;
+  return lockFor(args.key)(async () => {
+    const current = await stat2(args.versionRoot).then(
+      (info) => info.isDirectory(),
+      () => false
     );
-  });
-  if (!result.ok) return result.empty ? "empty" : "unknown";
-  const states = result.stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
-  if (states.some((state) => !isDeadState(state.charAt(0)))) return "live";
-  return "empty";
-}
-function signalProcessGroup(pid, signal, platform = process.platform) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    if (platform === "win32") {
-      process.kill(pid, signal);
-      return true;
+    if (current) {
+      await rm2(previous, { recursive: true, force: true }).catch(() => {
+      });
+      return false;
     }
-    process.kill(-pid, signal);
+    await rename(previous, args.versionRoot);
+    logger.warn("[local-harness] restored a runtime after an interrupted activation", {
+      packVersion: args.key.packVersion
+    });
     return true;
-  } catch (error) {
-    if (error.code === "ESRCH") return true;
-    return false;
-  }
+  });
 }
-async function terminateOwnedProcessGroup(args) {
-  const platform = args.platform ?? process.platform;
-  const pollMs = args.pollMs ?? 50;
-  const settleGroup = async (goneOutcome, anchored) => {
-    const probeGroup = args.probeGroup ?? probeProcessGroup;
-    const before = await probeGroup(args.pid, platform);
-    if (before === "empty") return { outcome: goneOutcome };
-    if (before === "unknown") {
-      return {
-        outcome: "unknown",
-        reason: "the process group could not be enumerated, so a survivor could be neither ruled out nor signalled without risking a reused group id"
-      };
-    }
-    if (!anchored) {
+var PREVIOUS_SUFFIX = ".mcpjam-previous";
+function withRuntimeLifecycleLock(key, operation) {
+  return lockFor(key)(operation);
+}
+
+// server/utils/harness/local/runtime-install.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { createReadStream, createWriteStream } from "fs";
+import {
+  mkdir as mkdir3,
+  readdir as readdir4,
+  readFile as readFile5,
+  rename as rename2,
+  rm as rm3,
+  stat as stat4,
+  writeFile as writeFile3
+} from "fs/promises";
+import { homedir } from "os";
+import { basename, join as join5 } from "path";
+import { pipeline } from "stream/promises";
+import { Readable } from "stream";
+import { x as extractTar } from "tar";
+
+// server/utils/harness/local/pack-digests.generated.ts
+var PACK_TREE_DIGESTS = {
+  "claude-code": {},
+  codex: {}
+};
+var PACK_RECORDS = {
+  "claude-code": {},
+  codex: {}
+};
+var EXPECTED_PACK_VERSION = "";
+
+// server/utils/harness/local/pack-signing-key.ts
+import { createPublicKey, verify as edVerify } from "crypto";
+var PACK_SIGNING_KEYS = [
+  {
+    // Rotated before the first pack publication on 2026-09-28. The private
+    // key was uploaded directly to the protected release environment; no
+    // file or repository-level secret retains it. Recovery is rotation.
+    keyId: "pack-2026-09-28",
+    publicKeyPem: `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA/8fkvTTgyzjmmlLmN4veODTVpexBi4Ib6SGVq8xmyTs=
+-----END PUBLIC KEY-----
+`
+  }
+];
+function verifyPackManifestSignature(manifestBytes, signatureBase64, keys = PACK_SIGNING_KEYS) {
+  if (keys.length === 0) {
+    return {
+      ok: false,
+      reason: "no-keys",
+      message: "this Inspector build carries no runtime pack signing key, so it cannot verify that a downloaded pack came from MCPJam. Packs are installable from a local path for development only."
+    };
+  }
+  let signature;
+  try {
+    signature = Buffer.from(signatureBase64.trim(), "base64");
+    if (signature.length === 0) throw new Error("empty");
+  } catch {
+    return {
+      ok: false,
+      reason: "malformed",
+      message: "the pack manifest signature is not valid base64"
+    };
+  }
+  for (const key of keys) {
+    try {
+      const publicKey = createPublicKey(key.publicKeyPem);
+      if (edVerify(null, manifestBytes, publicKey, signature)) {
+        return { ok: true, keyId: key.keyId };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return {
+    ok: false,
+    reason: "bad-signature",
+    message: "the runtime pack manifest is not signed by any key this Inspector trusts, so the pack is refused"
+  };
+}
+
+// server/utils/harness/local/runtime-identity.ts
+import { createHash } from "crypto";
+import { execFile as execFile2 } from "child_process";
+import { readdir as readdir3, readFile as readFile4, realpath, stat as stat3 } from "fs/promises";
+import { dirname, isAbsolute, join as join4, normalize, relative, sep } from "path";
+
+// server/utils/harness/local/process-identity.ts
+import { execFile, spawn } from "child_process";
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
+var PS_TIMEOUT_MS = 3e3;
+function parseLinuxProcStat(raw) {
+  const close = raw.lastIndexOf(")");
+  if (close === -1) return null;
+  const fields = raw.slice(close + 2).split(" ");
+  const state = fields[0];
+  const starttime = fields[19];
+  if (!state || !/^[A-Za-z]$/.test(state)) return null;
+  if (!starttime || !/^\d+$/.test(starttime)) return null;
+  return { state, starttime };
+}
+function isDeadState(state) {
+  return state === "Z" || state === "X" || state === "x";
+}
+async function probeLinux(pid) {
+  let raw;
+  try {
+    raw = await readFile3(`/proc/${pid}/stat`, "utf8");
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ESRCH") return { state: "gone" };
+    return {
+      state: "unknown",
+      reason: `/proc read failed (${code ?? "unknown"})`
+    };
+  }
+  const parsed = parseLinuxProcStat(raw);
+  if (parsed === null) {
+    return { state: "unknown", reason: "unparseable /proc stat line" };
+  }
+  if (isDeadState(parsed.state)) return { state: "gone" };
+  return { state: "alive", identity: `linux:${parsed.starttime}` };
+}
+function parseDarwinPsLine(raw) {
+  const line = raw.trim();
+  if (line.length === 0) return null;
+  const match = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+([\s\S]+)$/.exec(line);
+  if (match === null) return null;
+  const state = match[1];
+  const lstart = [match[2], match[3], match[4], match[5], match[6]].join(" ");
+  const command = match[7];
+  return { state, lstart, command };
+}
+async function probeDarwin(pid) {
+  const result = await new Promise((resolve) => {
+    execFile(
+      "/bin/ps",
+      ["-o", "state=,lstart=,command=", "-p", String(pid)],
+      {
+        timeout: PS_TIMEOUT_MS,
+        maxBuffer: 16 * 1024,
+        encoding: "utf8",
+        env: {}
+      },
+      (error, out) => {
+        if (!error) {
+          resolve({ ok: true, stdout: typeof out === "string" ? out : "" });
+          return;
+        }
+        const err = error;
+        resolve({
+          ok: false,
+          // `ps` exits 1 when no process matches — that IS an answer. A kill
+          // (timeout) or a spawn failure is not.
+          exitCode: typeof err.code === "number" ? err.code : null,
+          reason: err.killed ? "ps timed out" : `ps failed (${String(err.code ?? "unknown")})`
+        });
+      }
+    );
+  });
+  if (!result.ok) {
+    if (result.exitCode === 1) return { state: "gone" };
+    return { state: "unknown", reason: result.reason };
+  }
+  const parsed = parseDarwinPsLine(result.stdout);
+  if (parsed === null) {
+    return result.stdout.trim().length === 0 ? { state: "gone" } : { state: "unknown", reason: "unparseable ps output" };
+  }
+  if (isDeadState(parsed.state.charAt(0))) return { state: "gone" };
+  return {
+    state: "alive",
+    identity: `darwin:${parsed.lstart}|${parsed.command}`
+  };
+}
+var WIN32_PROBE_TIMEOUT_MS = 15e3;
+function win32SystemRoot() {
+  return process.env.SYSTEMROOT ?? process.env.WINDIR ?? "C:\\Windows";
+}
+function win32PowerShellPath() {
+  return join3(
+    win32SystemRoot(),
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe"
+  );
+}
+function parseWin32ProbeLine(raw) {
+  const line = raw.trim();
+  const match = /^(\d+)\|(.+)$/.exec(line);
+  if (match === null) return null;
+  return { fileTime: match[1], name: match[2] };
+}
+async function probeWin32(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") return { state: "gone" };
+    if (code !== "EPERM") {
+      return {
+        state: "unknown",
+        reason: `kill(0) failed (${code ?? "unknown"})`
+      };
+    }
+  }
+  const script = [
+    `$p = Get-Process -Id ${pid} -ErrorAction SilentlyContinue`,
+    "if ($null -eq $p) { exit 1 }",
+    "try { $t = $p.StartTime.ToFileTimeUtc() } catch { exit 3 }",
+    "Write-Output ('{0}|{1}' -f $t, $p.ProcessName)"
+  ].join("; ");
+  const result = await new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      resolve(value);
+    };
+    let child;
+    try {
+      child = spawn(
+        win32PowerShellPath(),
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-InputFormat",
+          "None",
+          "-ExecutionPolicy",
+          "Bypass",
+          "-Command",
+          script
+        ],
+        { stdio: ["ignore", "pipe", "pipe"], env: process.env, windowsHide: true }
+      );
+    } catch (error) {
+      done({
+        ok: false,
+        exitCode: null,
+        reason: `PowerShell failed to start (${String(
+          error.code ?? "unknown"
+        )})`
+      });
+      return;
+    }
+    let stdout = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < 16 * 1024) stdout += chunk;
+    });
+    child.stderr?.resume();
+    timer = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      done({ ok: false, exitCode: null, reason: "Get-Process timed out" });
+    }, WIN32_PROBE_TIMEOUT_MS);
+    child.on(
+      "error",
+      (error) => done({
+        ok: false,
+        exitCode: null,
+        reason: `PowerShell failed (${String(error.code ?? "unknown")})`
+      })
+    );
+    child.on("close", (code) => {
+      if (code === 0) done({ ok: true, stdout });
+      else done({ ok: false, exitCode: code, reason: `Get-Process exited ${code}` });
+    });
+  });
+  if (!result.ok) {
+    if (result.exitCode === 1) return { state: "gone" };
+    return { state: "unknown", reason: result.reason };
+  }
+  const parsed = parseWin32ProbeLine(result.stdout);
+  if (parsed === null) {
+    return { state: "unknown", reason: "unparseable Get-Process output" };
+  }
+  return {
+    state: "alive",
+    identity: `win32:${parsed.fileTime}|${parsed.name}`
+  };
+}
+async function probeProcess(pid, platform = process.platform) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return { state: "unknown", reason: "implausible pid" };
+  }
+  if (platform === "linux") return probeLinux(pid);
+  if (platform === "darwin") return probeDarwin(pid);
+  if (platform === "win32") return probeWin32(pid);
+  return { state: "unknown", reason: `no liveness primitive on ${platform}` };
+}
+async function readProcessBirthIdentity(pid, platform = process.platform) {
+  const probe = await probeProcess(pid, platform);
+  return probe.state === "alive" ? probe.identity : null;
+}
+function supportsOwnershipProof(platform = process.platform) {
+  if (platform === "linux" || platform === "darwin") return true;
+  if (platform === "win32") return windowsJobLauncherVerified;
+  return false;
+}
+var windowsJobLauncherVerified = false;
+function setWindowsJobLauncherVerified(verified) {
+  windowsJobLauncherVerified = verified;
+}
+function sameBirthIdentity(recorded, current) {
+  if (recorded === current) return true;
+  const r = /^darwin:([^|]+)\|([\s\S]*)$/.exec(recorded);
+  const c = /^darwin:([^|]+)\|([\s\S]*)$/.exec(current);
+  if (r === null || c === null) return false;
+  return r[1] === c[1] && /^\([^()]+\)$/.test(c[2]);
+}
+async function listGroupMembers(pgid, platform = process.platform) {
+  let pids = [];
+  if (platform === "darwin") {
+    const out = await new Promise((resolve) => {
+      execFile(
+        "/bin/ps",
+        ["-o", "pid=,state=", "-g", String(pgid)],
+        { timeout: PS_TIMEOUT_MS, maxBuffer: 64 * 1024, encoding: "utf8", env: {} },
+        (error, stdout) => resolve(error ? error.code === 1 ? "" : null : String(stdout))
+      );
+    });
+    if (out === null) return null;
+    pids = out.split("\n").map((l) => l.trim().split(/\s+/)).filter((f) => f.length >= 2 && /^\d+$/.test(f[0]) && !isDeadState(f[1].charAt(0))).map((f) => Number(f[0]));
+  } else if (platform === "linux") {
+    let entries;
+    try {
+      entries = await readdir2("/proc");
+    } catch {
+      return null;
+    }
+    for (const entry of entries) {
+      if (!/^\d+$/.test(entry)) continue;
+      let raw;
+      try {
+        raw = await readFile3(`/proc/${entry}/stat`, "utf8");
+      } catch {
+        continue;
+      }
+      const parsed = parseProcStatGroup(raw);
+      if (parsed !== null && parsed.pgrp === pgid && !isDeadState(parsed.state.charAt(0))) pids.push(Number(entry));
+    }
+  } else {
+    return null;
+  }
+  const members = [];
+  for (const pid of pids) {
+    if (pid === pgid) continue;
+    const identity = await readProcessBirthIdentity(pid, platform);
+    if (identity !== null) members.push({ pid, identity });
+  }
+  return members;
+}
+async function terminateOwnedProcess(args) {
+  const platform = args.platform ?? process.platform;
+  const initial = await probeProcess(args.pid, platform);
+  if (initial.state === "gone") return "already-gone";
+  if (initial.state === "unknown") return "unknown";
+  if (!sameBirthIdentity(args.identity, initial.identity)) return "not-owned";
+  const waitGone = async (ms) => {
+    const until = Date.now() + ms;
+    while (Date.now() < until) {
+      const p = await probeProcess(args.pid, platform);
+      if (p.state === "gone") return true;
+      await new Promise((r) => setTimeout(r, 50));
+    }
+    return false;
+  };
+  try {
+    process.kill(args.pid, "SIGTERM");
+  } catch {
+    return "already-gone";
+  }
+  if (await waitGone(args.graceMs)) return "graceful";
+  const again = await probeProcess(args.pid, platform);
+  if (again.state === "gone") return "graceful";
+  if (again.state === "unknown") return "unknown";
+  if (!sameBirthIdentity(args.identity, again.identity)) return "not-owned";
+  try {
+    process.kill(args.pid, "SIGKILL");
+  } catch {
+    return "graceful";
+  }
+  return await waitGone(500) ? "forced" : "escaped";
+}
+async function probeProcessGroup(pid, platform = process.platform) {
+  if (!Number.isInteger(pid) || pid <= 0) return "unknown";
+  if (platform === "linux") return probeLinuxGroup(pid);
+  if (platform === "darwin") return probeDarwinGroup(pid);
+  if (platform === "win32") {
+    const root = await probeProcess(pid, platform);
+    if (root.state === "gone") return "empty";
+    if (root.state === "alive") return "live";
+    return "unknown";
+  }
+  return "unknown";
+}
+async function readProcessGroupId(pid, platform = process.platform) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (platform === "linux") {
+    try {
+      const raw = await readFile3(`/proc/${pid}/stat`, "utf8");
+      return parseProcStatGroup(raw)?.pgrp ?? null;
+    } catch {
+      return null;
+    }
+  }
+  if (platform === "darwin") {
+    return new Promise((resolvePromise) => {
+      execFile(
+        "/bin/ps",
+        ["-o", "pgid=", "-p", String(pid)],
+        {
+          timeout: PS_TIMEOUT_MS,
+          maxBuffer: 4 * 1024,
+          encoding: "utf8",
+          env: {}
+        },
+        (error, stdout) => {
+          if (error) {
+            resolvePromise(null);
+            return;
+          }
+          const parsed = Number(String(stdout).trim());
+          resolvePromise(Number.isInteger(parsed) && parsed > 0 ? parsed : null);
+        }
+      );
+    });
+  }
+  return null;
+}
+function parseProcStatGroup(raw) {
+  const close = raw.lastIndexOf(")");
+  if (close === -1) return null;
+  const fields = raw.slice(close + 1).trim().split(/\s+/);
+  const state = fields[0];
+  const pgrp = Number(fields[2]);
+  if (state === void 0 || !Number.isInteger(pgrp)) return null;
+  return { state, pgrp };
+}
+async function probeLinuxGroup(pgid) {
+  let entries;
+  try {
+    entries = await readdir2("/proc");
+  } catch {
+    return "unknown";
+  }
+  let blind = false;
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry)) continue;
+    let raw;
+    try {
+      raw = await readFile3(`/proc/${entry}/stat`, "utf8");
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ESRCH") blind = true;
+      continue;
+    }
+    const parsed = parseProcStatGroup(raw);
+    if (parsed === null) {
+      blind = true;
+      continue;
+    }
+    if (parsed.pgrp !== pgid) continue;
+    if (!isDeadState(parsed.state.charAt(0))) return "live";
+  }
+  return blind ? "unknown" : "empty";
+}
+async function probeDarwinGroup(pgid) {
+  const result = await new Promise((resolve) => {
+    execFile(
+      "/bin/ps",
+      ["-o", "state=", "-g", String(pgid)],
+      {
+        timeout: PS_TIMEOUT_MS,
+        maxBuffer: 64 * 1024,
+        encoding: "utf8",
+        env: {}
+      },
+      (error, out) => {
+        if (!error) {
+          resolve({ ok: true, stdout: typeof out === "string" ? out : "" });
+          return;
+        }
+        const err = error;
+        resolve({ ok: false, empty: err.killed !== true && err.code === 1 });
+      }
+    );
+  });
+  if (!result.ok) return result.empty ? "empty" : "unknown";
+  const states = result.stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  if (states.some((state) => !isDeadState(state.charAt(0)))) return "live";
+  return "empty";
+}
+function signalProcessGroup(pid, signal, platform = process.platform) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    if (platform === "win32") {
+      process.kill(pid, signal);
+      return true;
+    }
+    process.kill(-pid, signal);
+    return true;
+  } catch (error) {
+    if (error.code === "ESRCH") return true;
+    return false;
+  }
+}
+async function terminateOwnedProcessGroup(args) {
+  const platform = args.platform ?? process.platform;
+  const pollMs = args.pollMs ?? 50;
+  const settleGroup = async (goneOutcome, anchored) => {
+    const probeGroup = args.probeGroup ?? probeProcessGroup;
+    const before = await probeGroup(args.pid, platform);
+    if (before === "empty") return { outcome: goneOutcome };
+    if (before === "unknown") {
+      return {
+        outcome: "unknown",
+        reason: "the process group could not be enumerated, so a survivor could be neither ruled out nor signalled without risking a reused group id"
+      };
+    }
+    if (!anchored) {
       return {
         outcome: "unknown",
         reason: "a live process group carries this id, but the root was already gone when the stop began, so the group cannot be tied to this tree"
@@ -985,10 +1363,10 @@ async function digestTreeWithSnapshot(root) {
   let files = 0;
   let bytes = 0;
   const walk = async (dir) => {
-    const entries = await readdir2(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const entry of entries) {
-      const full = join2(dir, entry.name);
+      const full = join4(dir, entry.name);
       const rel = relative(root, full).split(sep).join("/");
       if (entry.isSymbolicLink()) {
         throw new Error(
@@ -1010,12 +1388,12 @@ async function digestTreeWithSnapshot(root) {
           "managed runtime bundle exceeds the file-count ceiling"
         );
       }
-      const info = await stat(full);
+      const info = await stat3(full);
       bytes += info.size;
       if (bytes > MAX_BUNDLE_BYTES) {
         throw new Error("managed runtime bundle exceeds the size ceiling");
       }
-      const content = await readFile2(full);
+      const content = await readFile4(full);
       const executable = (info.mode & 73) !== 0 ? "1" : "0";
       const contentDigest = createHash("sha256").update(content).digest();
       hash.update(`f\0${rel}\0${executable}\0${info.size}\0`);
@@ -1126,11 +1504,11 @@ async function resolveManagedBundle(args) {
     };
   }
   const policy = manifest.runtime;
-  const root = join2(runtimeRoot, policy.bundleName);
+  const root = join4(runtimeRoot, policy.bundleName);
   let canonicalRoot;
   try {
     canonicalRoot = await realpath(root);
-    const info = await stat(canonicalRoot);
+    const info = await stat3(canonicalRoot);
     if (!info.isDirectory()) throw new Error("not a directory");
   } catch {
     return {
@@ -1170,7 +1548,7 @@ async function resolveManagedBundle(args) {
   }
   const digest = verification.digest;
   const insideBundle = async (relativePath, label, requireExecutable) => {
-    const full = join2(canonicalRoot, relativePath);
+    const full = join4(canonicalRoot, relativePath);
     if (!normalize(full).startsWith(canonicalRoot + sep)) {
       return {
         ok: false,
@@ -1178,7 +1556,7 @@ async function resolveManagedBundle(args) {
       };
     }
     try {
-      const info = await stat(full);
+      const info = await stat3(full);
       if (!info.isFile()) throw new Error("not a file");
       if (requireExecutable && platform !== "win32" && (info.mode & 73) === 0) {
         throw new Error("not executable");
@@ -1309,7 +1687,7 @@ async function firstUntrustedAncestor(path, platform) {
   for (; ; ) {
     let info;
     try {
-      info = await stat(dir);
+      info = await stat3(dir);
     } catch {
       return dir;
     }
@@ -1343,7 +1721,7 @@ async function resolveSystemInstall(opts) {
   const rejections = [];
   for (const dir of searchPaths) {
     for (const name of policy.executableNames) {
-      const candidate = join2(dir, name);
+      const candidate = join4(dir, name);
       let canonical;
       try {
         canonical = await realpath(candidate);
@@ -1361,7 +1739,7 @@ async function resolveSystemInstall(opts) {
       }
       let info;
       try {
-        info = await stat(canonical);
+        info = await stat3(canonical);
       } catch {
         continue;
       }
@@ -1431,7 +1809,7 @@ async function resolveSystemInstall(opts) {
         });
         continue;
       }
-      const content = await readFile2(canonical);
+      const content = await readFile4(canonical);
       const digest = `sha256:${createHash("sha256").update(content).digest("hex")}`;
       accepted.push({
         runtimeId: runtimeIdOf([
@@ -1481,9 +1859,9 @@ async function detectSnapshotDrift(snapshot) {
   const recorded = new Map(snapshot.entries.map((e) => [e.path, e]));
   let seen = 0;
   const walk = async (dir) => {
-    const entries = await readdir2(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join2(dir, entry.name);
+      const full = join4(dir, entry.name);
       const rel = relative(snapshot.root, full).split(sep).join("/");
       if (entry.isSymbolicLink()) return `a symlink appeared at ${rel}`;
       if (entry.isDirectory()) {
@@ -1495,12 +1873,12 @@ async function detectSnapshotDrift(snapshot) {
       const expected = recorded.get(rel);
       if (expected === void 0) return `an unexpected file appeared at ${rel}`;
       seen += 1;
-      const info = await stat(full);
+      const info = await stat3(full);
       if (info.size !== expected.size || info.mtimeMs !== expected.mtimeMs || info.ctimeMs !== expected.ctimeMs || Number(info.ino) !== expected.ino || info.mode !== expected.mode) {
         return `${rel} was modified`;
       }
       if (isRehashedOnRevalidate(rel)) {
-        const content = await readFile2(full);
+        const content = await readFile4(full);
         const fileDigest = createHash("sha256").update(content).digest("hex");
         if (fileDigest !== snapshot.executableDigests[rel]) {
           return `${rel} was rewritten in place`;
@@ -1547,7 +1925,7 @@ async function revalidateRuntime(runtime) {
         message: reverified.reason === "digest-mismatch" ? `the ${runtime.harnessId} runtime bundle changed after consent was granted (${drift}; expected ${runtime.digest}, found ${reverified.digest})` : `the ${runtime.harnessId} runtime could not be re-verified: ${reverified.message}`
       };
     }
-    const content = await readFile2(runtime.launcherPath);
+    const content = await readFile4(runtime.launcherPath);
     const digest = `sha256:${createHash("sha256").update(content).digest("hex")}`;
     if (digest !== runtime.digest) {
       return {
@@ -1593,10 +1971,8 @@ var LOCAL_HARNESS_MANIFEST = {
     supportsBuiltinToolApprovals: true,
     permissionProfileMapping: {
       "read-only": "allow-reads",
-      "workspace-edits": "allow-edits"
-      // `unrestricted` is deliberately absent: Claude Code CAN surface
-      // approvals, so there is no reason to offer a profile that switches them
-      // off on a host.
+      "workspace-edits": "allow-edits",
+      unrestricted: "allow-all"
     },
     // Native eligibility is per platform. macOS and Linux have POSIX process
     // groups, which is what whole-tree cleanup is built on there.
@@ -1654,477 +2030,99 @@ var LOCAL_HARNESS_MANIFEST = {
     lifecycleConformanceVersion: "",
     adapterBootstrapDir: ".harness-bootstrap/codex",
     adapterBootstrapFiles: ["package.json", "pnpm-lock.yaml", "bridge.mjs"],
-    bridgeBundleDigest: `sha256:${"0".repeat(64)}`
-  }
-};
-function localPermissionModeFor(harnessId, permissionProfile, targetKind) {
-  const manifests = LOCAL_HARNESS_MANIFEST;
-  const manifest = Object.prototype.hasOwnProperty.call(manifests, harnessId) ? manifests[harnessId] : void 0;
-  if (manifest === void 0) return null;
-  if (permissionProfile === "unrestricted" && targetKind === "local-native") {
-    return null;
-  }
-  return manifest.permissionProfileMapping[permissionProfile] ?? null;
-}
-function resolveLocalCompatibility(query, manifests = LOCAL_HARNESS_MANIFEST) {
-  const manifest = Object.prototype.hasOwnProperty.call(
-    manifests,
-    query.harnessId
-  ) ? manifests[query.harnessId] : void 0;
-  if (!manifest) {
-    return {
-      ok: false,
-      status: "harness-not-supported",
-      message: `${query.harnessId} has no reviewed local compatibility manifest. Run it hosted, or add a manifest entry with conformance evidence.`
-    };
-  }
-  if (query.installedAdapterVersion !== manifest.adapterVersion) {
-    return {
-      ok: false,
-      status: "adapter-version-mismatch",
-      message: `${query.harnessId} adapter ${query.installedAdapterVersion ?? "(version not supplied)"} is installed but the local manifest was reviewed against ${manifest.adapterVersion}. An adapter upgrade can change the command shapes the local provider translates, so it must be re-reviewed before local execution is enabled.`
-    };
-  }
-  if (manifest.lifecycleConformanceVersion === "") {
-    return {
-      ok: false,
-      status: "conformance-missing",
-      message: `${query.harnessId} has no recorded lifecycle conformance evidence. Local execution stays disabled until the conformance suite has been run for this harness/runtime/platform/mode tuple and its version is recorded in the manifest.`
-    };
-  }
-  if (query.platform === null) {
-    return {
-      ok: false,
-      status: "platform-not-supported",
-      // NOT "run the harness hosted instead". A requested-local turn has Send
-      // disabled in this state (`localHarnessBlocksSend`), so nothing falls
-      // back — and on a local Inspector with no cloud data plane there is no
-      // hosted target to switch to either, which makes the instruction
-      // unactionable exactly where it is most likely to be read.
-      message: `local execution is not supported on this platform.`
-    };
-  }
-  if (query.targetKind === "local-native") {
-    if (!manifest.nativePlatforms.includes(query.platform)) {
-      const reason = manifest.nativePlatforms.length === 0 ? `${query.harnessId} is not eligible for native mode on any platform: its adapter cannot surface tool approvals, so native execution would give it the OS user's full authority with no approval gate. Use hosted, or a verified isolation backend.` : `${query.harnessId} native mode is not supported on ${query.platform} (supported: ${manifest.nativePlatforms.join(", ")}).`;
-      return {
-        ok: false,
-        status: "native-not-eligible",
-        message: reason
-      };
-    }
-  } else {
-    if (query.backend === void 0) {
-      return {
-        ok: false,
-        status: "backend-not-verified",
-        message: "an isolated target must name its isolation backend."
-      };
-    }
-    const verifiedHere = manifest.isolatedBackends[query.platform] ?? [];
-    if (!verifiedHere.includes(query.backend)) {
-      return {
-        ok: false,
-        status: "backend-not-verified",
-        message: `isolation backend ${query.backend} has not passed conformance for ${query.harnessId} on ${query.platform}. Isolated mode never falls back to native \u2014 run hosted until the backend is verified for this platform.`
-      };
-    }
-  }
-  const permissionMode = manifest.permissionProfileMapping[query.permissionProfile];
-  if (permissionMode === void 0) {
-    const offered = Object.keys(manifest.permissionProfileMapping);
-    return {
-      ok: false,
-      status: "permission-profile-not-supported",
-      message: `${query.harnessId} does not offer the ${query.permissionProfile} permission profile locally` + (offered.length ? ` (offered: ${offered.join(", ")}).` : `; it has no locally offered profile at all.`)
-    };
-  }
-  if (query.permissionProfile === "unrestricted" && query.targetKind === "local-native") {
-    return {
-      ok: false,
-      status: "permission-profile-not-supported",
-      message: `the unrestricted profile requires a verified isolation backend. Native mode has no host containment, so an unrestricted turn there would run with the OS user's full authority.`
-    };
-  }
-  return { ok: true, manifest, permissionMode };
-}
-
-// server/utils/harness/local/runtime-lifecycle.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import {
-  mkdir as mkdir2,
-  readdir as readdir3,
-  readFile as readFile4,
-  rename,
-  rm as rm2,
-  stat as stat3,
-  writeFile as writeFile2
-} from "fs/promises";
-import { join as join4 } from "path";
-
-// server/utils/harness/local/local-state-lock.ts
-import { randomUUID } from "crypto";
-import { mkdir, readFile as readFile3, rm, stat as stat2, writeFile } from "fs/promises";
-import { join as join3 } from "path";
-var DEFAULT_STALE_MS = 3e4;
-var DEFAULT_POLL_MS = 25;
-var DEFAULT_TIMEOUT_MS = 45e3;
-async function readLockBody(file) {
-  try {
-    const parsed = JSON.parse(await readFile3(file, "utf8"));
-    if (!parsed || typeof parsed !== "object") return null;
-    const body = parsed;
-    if (typeof body.pid !== "number" || !Number.isInteger(body.pid) || body.pid <= 0 || typeof body.nonce !== "string" || body.nonce.length === 0) {
-      return null;
-    }
-    return { pid: body.pid, nonce: body.nonce, at: Number(body.at) || 0 };
-  } catch {
-    return null;
-  }
-}
-function lockHolderProvablyGone(body) {
-  if (body === null || body.pid === process.pid) return false;
-  try {
-    process.kill(body.pid, 0);
-    return false;
-  } catch (error) {
-    return error.code === "ESRCH";
-  }
-}
-function createLocalStateMutationLock(options) {
-  let mutationChain = Promise.resolve();
-  const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
-  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const acquire = async () => {
-    const root = options.rootDir();
-    const file = join3(root, options.lockFileName);
-    await mkdir(root, { recursive: true, mode: 448 });
-    const nonce = randomUUID();
-    const deadline = Date.now() + timeoutMs;
-    for (; ; ) {
-      try {
-        await writeFile(
-          file,
-          JSON.stringify({ pid: process.pid, nonce, at: Date.now() }),
-          { flag: "wx", mode: 384 }
-        );
-        return async () => {
-          const held = await readLockBody(file);
-          if (held?.nonce !== nonce) {
-            logger.warn(
-              `[local-harness] ${options.resourceLabel} lock was taken over; not releasing`
-            );
-            return;
-          }
-          await rm(file, { force: true }).catch(() => {
-          });
-        };
-      } catch (error) {
-        if (error.code !== "EEXIST") throw error;
-        const body = await readLockBody(file);
-        const age = await stat2(file).then(
-          (info) => Date.now() - info.mtimeMs,
-          () => 0
-        );
-        const holderGone = lockHolderProvablyGone(body);
-        const unattributable = body === null && age > staleMs;
-        if (holderGone || unattributable) {
-          logger.warn(
-            `[local-harness] breaking an abandoned ${options.resourceLabel} lock`,
-            { age, holderGone, unattributable }
-          );
-          await rm(file, { force: true }).catch(() => {
-          });
-          continue;
-        }
-        if (Date.now() > deadline) {
-          throw new Error(
-            `timed out waiting for the local harness ${options.resourceLabel} lock` + (body === null ? "" : ` (held by pid ${body.pid})`) + ". Its holder could not be proven gone, and taking it over would admit concurrent state writers."
-          );
-        }
-        await new Promise(
-          (resolvePromise) => setTimeout(resolvePromise, pollMs)
-        );
-      }
-    }
-  };
-  return (operation) => {
-    const guarded = async () => {
-      const release = await acquire();
-      try {
-        return await operation();
-      } finally {
-        await release();
-      }
-    };
-    const run = mutationChain.then(guarded, guarded);
-    mutationChain = run.then(
-      () => void 0,
-      () => void 0
-    );
-    return run;
-  };
-}
-
-// server/utils/harness/local/runtime-lifecycle.ts
-var OPERATION_FILE = ".mcpjam-operation.json";
-var USE_DIR = ".mcpjam-inuse";
-var STAGING_PREFIX = ".mcpjam-tmp-";
-var STAGING_OWNER_FILE = ".mcpjam-staging-owner.json";
-function operationKeyString(key) {
-  return [
-    key.runtimeRoot,
-    key.harnessId,
-    key.target,
-    key.packVersion,
-    key.treeDigest
-  ].join("\0");
-}
-function installRootOf(key) {
-  return join4(key.runtimeRoot, key.target);
-}
-var locksByRoot = /* @__PURE__ */ new Map();
-function lockFor(key) {
-  const root = installRootOf(key);
-  let lock = locksByRoot.get(root);
-  if (lock === void 0) {
-    lock = createLocalStateMutationLock({
-      rootDir: () => root,
-      lockFileName: ".mcpjam-runtime-lifecycle.lock",
-      resourceLabel: "runtime lifecycle",
-      // Short by construction: every critical section here is a read, a
-      // compare and an atomic write. A caller waiting longer than this is
-      // waiting on something that is not doing that.
-      timeoutMs: 15e3
-    });
-    locksByRoot.set(root, lock);
-  }
-  return lock;
-}
-function ownerProvablyGone(record) {
-  if (record.ownerPid === process.pid) {
-    return record.ownerStartedAt !== processStartedAt();
-  }
-  try {
-    process.kill(record.ownerPid, 0);
-    return false;
-  } catch (error) {
-    return error.code === "ESRCH";
-  }
-}
-var cachedStartedAt = null;
-function processStartedAt() {
-  if (cachedStartedAt === null) {
-    cachedStartedAt = Math.floor((Date.now() - process.uptime() * 1e3) / 1e3);
+    bridgeBundleDigest: `sha256:${"0".repeat(64)}`
   }
-  return cachedStartedAt;
-}
-async function writeJsonAtomic(file, value) {
-  const tmp = `${file}.${process.pid}.${randomUUID2()}.tmp`;
-  await writeFile2(tmp, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-  await rename(tmp, file);
-}
-async function readJson(file) {
-  try {
-    return JSON.parse(await readFile4(file, "utf8"));
-  } catch {
+};
+function localPermissionModeFor(harnessId, permissionProfile, targetKind, scope = "attended") {
+  const manifests = LOCAL_HARNESS_MANIFEST;
+  const manifest = Object.prototype.hasOwnProperty.call(manifests, harnessId) ? manifests[harnessId] : void 0;
+  if (manifest === void 0) return null;
+  if (permissionProfile === "unrestricted" && targetKind === "local-native" && scope !== "unattended") {
     return null;
   }
+  return manifest.permissionProfileMapping[permissionProfile] ?? null;
 }
-async function readRuntimeOperation(key) {
-  const file = join4(installRootOf(key), OPERATION_FILE);
-  const record = await readJson(file);
-  if (record === null) return null;
-  if (record.packVersion !== key.packVersion || record.treeDigest !== key.treeDigest || record.harnessId !== key.harnessId) {
-    return null;
-  }
-  const terminal = record.state === "ready" || record.state === "failed" || record.state === "interrupted";
-  if (terminal || !ownerProvablyGone(record)) return record;
-  return lockFor(key)(async () => {
-    const fresh = await readJson(file);
-    if (fresh === null) return null;
-    if (fresh.attemptId !== record.attemptId) return fresh;
-    if (fresh.state === "ready" || fresh.state === "failed" || fresh.state === "interrupted") {
-      return fresh;
-    }
-    if (!ownerProvablyGone(fresh)) return fresh;
-    const reconciled = {
-      ...fresh,
-      state: "interrupted",
-      message: "the Inspector that started this install is no longer running, so the attempt was abandoned partway through",
-      updatedAt: Date.now()
+function resolveLocalCompatibility(query, manifests = LOCAL_HARNESS_MANIFEST) {
+  const manifest = Object.prototype.hasOwnProperty.call(
+    manifests,
+    query.harnessId
+  ) ? manifests[query.harnessId] : void 0;
+  if (!manifest) {
+    return {
+      ok: false,
+      status: "harness-not-supported",
+      message: `${query.harnessId} has no reviewed local compatibility manifest. Run it hosted, or add a manifest entry with conformance evidence.`
     };
-    await writeJsonAtomic(file, reconciled);
-    logger.info("[local-harness] recovered an interrupted install attempt", {
-      attemptId: reconciled.attemptId,
-      packVersion: reconciled.packVersion
-    });
-    return reconciled;
-  });
-}
-async function beginInstallAttempt(key) {
-  const root = installRootOf(key);
-  await mkdir2(root, { recursive: true, mode: 448 });
-  const file = join4(root, OPERATION_FILE);
-  return lockFor(key)(async () => {
-    const existing = await readJson(file);
-    if (existing !== null && existing.packVersion === key.packVersion && existing.treeDigest === key.treeDigest && existing.harnessId === key.harnessId) {
-      const live = existing.state !== "ready" && existing.state !== "failed" && existing.state !== "interrupted";
-      if (live && !ownerProvablyGone(existing)) {
-        return { kind: "joined", record: existing };
-      }
-    }
-    const record = {
-      attemptId: `att_${randomUUID2()}`,
-      ownerPid: process.pid,
-      ownerStartedAt: processStartedAt(),
-      harnessId: key.harnessId,
-      target: key.target,
-      packVersion: key.packVersion,
-      treeDigest: key.treeDigest,
-      state: "reserved",
-      startedAt: Date.now(),
-      updatedAt: Date.now()
+  }
+  if (query.installedAdapterVersion !== manifest.adapterVersion) {
+    return {
+      ok: false,
+      status: "adapter-version-mismatch",
+      message: `${query.harnessId} adapter ${query.installedAdapterVersion ?? "(version not supplied)"} is installed but the local manifest was reviewed against ${manifest.adapterVersion}. An adapter upgrade can change the command shapes the local provider translates, so it must be re-reviewed before local execution is enabled.`
     };
-    await writeJsonAtomic(file, record);
-    return { kind: "started", record };
-  });
-}
-async function updateInstallAttempt(key, attemptId, patch) {
-  const file = join4(installRootOf(key), OPERATION_FILE);
-  return lockFor(key)(async () => {
-    const existing = await readJson(file);
-    if (existing === null || existing.attemptId !== attemptId) return false;
-    await writeJsonAtomic(file, {
-      ...existing,
-      ...patch,
-      updatedAt: Date.now()
-    });
-    return true;
-  });
-}
-async function attemptStillOwns(key, attemptId) {
-  const record = await readJson(
-    join4(installRootOf(key), OPERATION_FILE)
-  );
-  return record?.attemptId === attemptId;
-}
-async function reserveRuntimeUse(args) {
-  const dir = join4(installRootOf(args.key), USE_DIR);
-  await mkdir2(dir, { recursive: true, mode: 448 });
-  const file = join4(dir, `${process.pid}-${randomUUID2()}.json`);
-  const record = {
-    pid: process.pid,
-    startedAt: processStartedAt(),
-    runtimeRoot: args.runtimeRoot,
-    at: Date.now(),
-    ...args.label ? { label: args.label } : {}
-  };
-  await writeJsonAtomic(file, record);
-  let released = false;
-  return {
-    release: async () => {
-      if (released) return;
-      released = true;
-      await rm2(file, { force: true }).catch(() => {
-      });
-    }
-  };
-}
-async function runtimeUseState(args) {
-  const dir = join4(installRootOf(args.key), USE_DIR);
-  let entries;
-  try {
-    entries = await readdir3(dir);
-  } catch {
-    return { busy: false, holders: [] };
   }
-  const holders = [];
-  for (const entry of entries) {
-    if (!entry.endsWith(".json")) continue;
-    const file = join4(dir, entry);
-    const record = await readJson(file);
-    if (record === null) {
-      continue;
-    }
-    if (record.runtimeRoot !== args.runtimeRoot) continue;
-    if (ownerProvablyGone({ ownerPid: record.pid, ownerStartedAt: record.startedAt })) {
-      await rm2(file, { force: true }).catch(() => {
-      });
-      continue;
-    }
-    holders.push(record.pid);
+  if (manifest.lifecycleConformanceVersion === "") {
+    return {
+      ok: false,
+      status: "conformance-missing",
+      message: `${query.harnessId} has no recorded lifecycle conformance evidence. Local execution stays disabled until the conformance suite has been run for this harness/runtime/platform/mode tuple and its version is recorded in the manifest.`
+    };
   }
-  return { busy: holders.length > 0, holders };
-}
-async function claimStagingDirectory(args) {
-  await writeJsonAtomic(join4(args.staging, STAGING_OWNER_FILE), {
-    pid: process.pid,
-    startedAt: processStartedAt(),
-    attemptId: args.attemptId,
-    at: Date.now()
-  });
-}
-async function sweepAbandonedStaging(key) {
-  const root = installRootOf(key);
-  let entries;
-  try {
-    entries = await readdir3(root);
-  } catch {
-    return { removed: 0, left: 0 };
+  if (query.platform === null) {
+    return {
+      ok: false,
+      status: "platform-not-supported",
+      // NOT "run the harness hosted instead". A requested-local turn has Send
+      // disabled in this state (`localHarnessBlocksSend`), so nothing falls
+      // back — and on a local Inspector with no cloud data plane there is no
+      // hosted target to switch to either, which makes the instruction
+      // unactionable exactly where it is most likely to be read.
+      message: `local execution is not supported on this platform.`
+    };
   }
-  let removed = 0;
-  let left = 0;
-  for (const entry of entries) {
-    if (!entry.startsWith(STAGING_PREFIX)) continue;
-    const path = join4(root, entry);
-    const owner = await readJson(join4(path, STAGING_OWNER_FILE));
-    if (owner === null) {
-      left += 1;
-      continue;
+  if (query.targetKind === "local-native") {
+    if (!manifest.nativePlatforms.includes(query.platform)) {
+      const reason = manifest.nativePlatforms.length === 0 ? `${query.harnessId} is not eligible for native mode on any platform: its adapter cannot surface tool approvals, so native execution would give it the OS user's full authority with no approval gate. Use hosted, or a verified isolation backend.` : `${query.harnessId} native mode is not supported on ${query.platform} (supported: ${manifest.nativePlatforms.join(", ")}).`;
+      return {
+        ok: false,
+        status: "native-not-eligible",
+        message: reason
+      };
     }
-    if (!ownerProvablyGone({ ownerPid: owner.pid, ownerStartedAt: owner.startedAt })) {
-      left += 1;
-      continue;
+  } else {
+    if (query.backend === void 0) {
+      return {
+        ok: false,
+        status: "backend-not-verified",
+        message: "an isolated target must name its isolation backend."
+      };
+    }
+    const verifiedHere = manifest.isolatedBackends[query.platform] ?? [];
+    if (!verifiedHere.includes(query.backend)) {
+      return {
+        ok: false,
+        status: "backend-not-verified",
+        message: `isolation backend ${query.backend} has not passed conformance for ${query.harnessId} on ${query.platform}. Isolated mode never falls back to native \u2014 run hosted until the backend is verified for this platform.`
+      };
     }
-    await rm2(path, { recursive: true, force: true }).catch(() => {
-    });
-    removed += 1;
   }
-  if (removed > 0 || left > 0) {
-    logger.debug("[local-harness] staging sweep", { removed, left });
+  const permissionMode = manifest.permissionProfileMapping[query.permissionProfile];
+  if (permissionMode === void 0) {
+    const offered = Object.keys(manifest.permissionProfileMapping);
+    return {
+      ok: false,
+      status: "permission-profile-not-supported",
+      message: `${query.harnessId} does not offer the ${query.permissionProfile} permission profile locally` + (offered.length ? ` (offered: ${offered.join(", ")}).` : `; it has no locally offered profile at all.`)
+    };
   }
-  return { removed, left };
-}
-async function recoverInterruptedActivation(args) {
-  const previous = `${args.versionRoot}${PREVIOUS_SUFFIX}`;
-  const hasPrevious = await stat3(previous).then(
-    (info) => info.isDirectory(),
-    () => false
-  );
-  if (!hasPrevious) return false;
-  return lockFor(args.key)(async () => {
-    const current = await stat3(args.versionRoot).then(
-      (info) => info.isDirectory(),
-      () => false
-    );
-    if (current) {
-      await rm2(previous, { recursive: true, force: true }).catch(() => {
-      });
-      return false;
-    }
-    await rename(previous, args.versionRoot);
-    logger.warn("[local-harness] restored a runtime after an interrupted activation", {
-      packVersion: args.key.packVersion
-    });
-    return true;
-  });
-}
-var PREVIOUS_SUFFIX = ".mcpjam-previous";
-function withRuntimeLifecycleLock(key, operation) {
-  return lockFor(key)(operation);
+  if (query.scope !== "unattended" && query.permissionProfile === "unrestricted" && query.targetKind === "local-native") {
+    return {
+      ok: false,
+      status: "permission-profile-not-supported",
+      message: `the unrestricted profile requires a verified isolation backend. Native mode has no host containment, so an unrestricted turn there would run with the OS user's full authority.`
+    };
+  }
+  return { ok: true, manifest, permissionMode };
 }
 
 // server/utils/harness/local/runtime-install.ts
@@ -2169,7 +2167,7 @@ function packSourceFor(packVersion, platformKey) {
   }
   return {
     kind: "url",
-    location: `https://github.com/MCPJam/inspector/releases/download/v${packVersion}/local-harness-pack-${platformKey}-${packVersion}.tar.gz`
+    location: `https://github.com/MCPJam/inspector/releases/download/local-harness-pack-v${packVersion}/local-harness-pack-${platformKey}-${packVersion}.tar.gz`
   };
 }
 function packPlatformKey(platform = process.platform, arch = process.arch) {
@@ -2875,4 +2873,4 @@ export {
   installRuntimePack,
   reportLocalHarnessRuntimeStatusInBackground
 };
-//# sourceMappingURL=chunk-5T6DFO27.js.map
+//# sourceMappingURL=chunk-QA6VJT6A.js.map