@mcpjam/inspector 3.3.6 → 3.4.1

package/dist/server/{chunk-7TOT3ZWN.js → chunk-5TXZXCUR.js}

@@ -12,11 +12,19 @@ var ALLOWED_ENVIRONMENTS = [
   "local",
   "test"
 ];
+var ENVIRONMENT_ALIASES = {
+  production: "prod",
+  development: "dev"
+};
 function resolveEnvironment() {
-  const fromEnv = process.env.ENVIRONMENT;
+  const fromEnv = process.env.ENVIRONMENT?.trim();
   if (fromEnv && ALLOWED_ENVIRONMENTS.includes(fromEnv)) {
     return fromEnv;
   }
+  const aliased = fromEnv ? ENVIRONMENT_ALIASES[fromEnv] : void 0;
+  if (aliased) {
+    return aliased;
+  }
   if (process.env.NODE_ENV === "test") return "test";
   if (process.env.NODE_ENV === "production") {
     if (!warnedMissingEnv) {
@@ -29,7 +37,7 @@ function resolveEnvironment() {
   }
   return "dev";
 }
-var BAKED_VERSION = "3.3.6";
+var BAKED_VERSION = "3.4.1";
 function blankToNull(value) {
   return value === void 0 || value.trim() === "" ? null : value;
 }
@@ -342,19 +350,19 @@ function emit(eventName, base, payload, options) {
 process.on("beforeExit", () => logger.flush());
 
 // server/utils/harness/local/runtime-install.ts
-import { createHash as createHash2, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import { createReadStream, createWriteStream } from "fs";
 import {
-  mkdir,
-  readdir as readdir3,
-  readFile as readFile3,
-  rename,
-  rm,
-  stat as stat2,
-  writeFile
+  mkdir as mkdir3,
+  readdir as readdir4,
+  readFile as readFile5,
+  rename as rename2,
+  rm as rm3,
+  stat as stat4,
+  writeFile as writeFile3
 } from "fs/promises";
 import { homedir } from "os";
-import { basename, join as join2 } from "path";
+import { basename, join as join5 } from "path";
 import { pipeline } from "stream/promises";
 import { Readable } from "stream";
 import { x as extractTar } from "tar";
@@ -424,7 +432,7 @@ function verifyPackManifestSignature(manifestBytes, signatureBase64, keys = PACK
 import { createHash } from "crypto";
 import { execFile as execFile2 } from "child_process";
 import { readdir as readdir2, readFile as readFile2, realpath, stat } from "fs/promises";
-import { dirname, isAbsolute, join, normalize, relative, sep } from "path";
+import { dirname, isAbsolute, join as join2, normalize, relative, sep } from "path";
 
 // server/utils/harness/local/targets.ts
 var LOCAL_PACK_TARGETS = /* @__PURE__ */ new Set([
@@ -448,8 +456,9 @@ function currentLocalPlatform(platform = process.platform) {
 }
 
 // server/utils/harness/local/process-identity.ts
-import { execFile } from "child_process";
+import { execFile, spawn } from "child_process";
 import { readdir, readFile } from "fs/promises";
+import { join } from "path";
 var PS_TIMEOUT_MS = 3e3;
 function parseLinuxProcStat(raw) {
   const close = raw.lastIndexOf(")");
@@ -534,12 +543,125 @@ async function probeDarwin(pid) {
     identity: `darwin:${parsed.lstart}|${parsed.command}`
   };
 }
+var WIN32_PROBE_TIMEOUT_MS = 15e3;
+function win32SystemRoot() {
+  return process.env.SYSTEMROOT ?? process.env.WINDIR ?? "C:\\Windows";
+}
+function win32PowerShellPath() {
+  return join(
+    win32SystemRoot(),
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe"
+  );
+}
+function parseWin32ProbeLine(raw) {
+  const line = raw.trim();
+  const match = /^(\d+)\|(.+)$/.exec(line);
+  if (match === null) return null;
+  return { fileTime: match[1], name: match[2] };
+}
+async function probeWin32(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") return { state: "gone" };
+    if (code !== "EPERM") {
+      return {
+        state: "unknown",
+        reason: `kill(0) failed (${code ?? "unknown"})`
+      };
+    }
+  }
+  const script = [
+    `$p = Get-Process -Id ${pid} -ErrorAction SilentlyContinue`,
+    "if ($null -eq $p) { exit 1 }",
+    "try { $t = $p.StartTime.ToFileTimeUtc() } catch { exit 3 }",
+    "Write-Output ('{0}|{1}' -f $t, $p.ProcessName)"
+  ].join("; ");
+  const result = await new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      resolve(value);
+    };
+    let child;
+    try {
+      child = spawn(
+        win32PowerShellPath(),
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-InputFormat",
+          "None",
+          "-ExecutionPolicy",
+          "Bypass",
+          "-Command",
+          script
+        ],
+        { stdio: ["ignore", "pipe", "pipe"], env: process.env, windowsHide: true }
+      );
+    } catch (error) {
+      done({
+        ok: false,
+        exitCode: null,
+        reason: `PowerShell failed to start (${String(
+          error.code ?? "unknown"
+        )})`
+      });
+      return;
+    }
+    let stdout = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < 16 * 1024) stdout += chunk;
+    });
+    child.stderr?.resume();
+    timer = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      done({ ok: false, exitCode: null, reason: "Get-Process timed out" });
+    }, WIN32_PROBE_TIMEOUT_MS);
+    child.on(
+      "error",
+      (error) => done({
+        ok: false,
+        exitCode: null,
+        reason: `PowerShell failed (${String(error.code ?? "unknown")})`
+      })
+    );
+    child.on("close", (code) => {
+      if (code === 0) done({ ok: true, stdout });
+      else done({ ok: false, exitCode: code, reason: `Get-Process exited ${code}` });
+    });
+  });
+  if (!result.ok) {
+    if (result.exitCode === 1) return { state: "gone" };
+    return { state: "unknown", reason: result.reason };
+  }
+  const parsed = parseWin32ProbeLine(result.stdout);
+  if (parsed === null) {
+    return { state: "unknown", reason: "unparseable Get-Process output" };
+  }
+  return {
+    state: "alive",
+    identity: `win32:${parsed.fileTime}|${parsed.name}`
+  };
+}
 async function probeProcess(pid, platform = process.platform) {
   if (!Number.isInteger(pid) || pid <= 0) {
     return { state: "unknown", reason: "implausible pid" };
   }
   if (platform === "linux") return probeLinux(pid);
   if (platform === "darwin") return probeDarwin(pid);
+  if (platform === "win32") return probeWin32(pid);
   return { state: "unknown", reason: `no liveness primitive on ${platform}` };
 }
 async function readProcessBirthIdentity(pid, platform = process.platform) {
@@ -640,6 +762,12 @@ async function probeProcessGroup(pid, platform = process.platform) {
   if (!Number.isInteger(pid) || pid <= 0) return "unknown";
   if (platform === "linux") return probeLinuxGroup(pid);
   if (platform === "darwin") return probeDarwinGroup(pid);
+  if (platform === "win32") {
+    const root = await probeProcess(pid, platform);
+    if (root.state === "gone") return "empty";
+    if (root.state === "alive") return "live";
+    return "unknown";
+  }
   return "unknown";
 }
 async function readProcessGroupId(pid, platform = process.platform) {
@@ -743,7 +871,8 @@ function signalProcessGroup(pid, signal, platform = process.platform) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
     if (platform === "win32") {
-      return false;
+      process.kill(pid, signal);
+      return true;
     }
     process.kill(-pid, signal);
     return true;
@@ -841,7 +970,7 @@ async function digestTreeWithSnapshot(root) {
     const entries = await readdir2(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const entry of entries) {
-      const full = join(dir, entry.name);
+      const full = join2(dir, entry.name);
       const rel = relative(root, full).split(sep).join("/");
       if (entry.isSymbolicLink()) {
         throw new Error(
@@ -979,7 +1108,7 @@ async function resolveManagedBundle(args) {
     };
   }
   const policy = manifest.runtime;
-  const root = join(runtimeRoot, policy.bundleName);
+  const root = join2(runtimeRoot, policy.bundleName);
   let canonicalRoot;
   try {
     canonicalRoot = await realpath(root);
@@ -1023,7 +1152,7 @@ async function resolveManagedBundle(args) {
   }
   const digest = verification.digest;
   const insideBundle = async (relativePath, label, requireExecutable) => {
-    const full = join(canonicalRoot, relativePath);
+    const full = join2(canonicalRoot, relativePath);
     if (!normalize(full).startsWith(canonicalRoot + sep)) {
       return {
         ok: false,
@@ -1196,7 +1325,7 @@ async function resolveSystemInstall(opts) {
   const rejections = [];
   for (const dir of searchPaths) {
     for (const name of policy.executableNames) {
-      const candidate = join(dir, name);
+      const candidate = join2(dir, name);
       let canonical;
       try {
         canonical = await realpath(candidate);
@@ -1336,7 +1465,7 @@ async function detectSnapshotDrift(snapshot) {
   const walk = async (dir) => {
     const entries = await readdir2(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join(dir, entry.name);
+      const full = join2(dir, entry.name);
       const rel = relative(snapshot.root, full).split(sep).join("/");
       if (entry.isSymbolicLink()) return `a symlink appeared at ${rel}`;
       if (entry.isDirectory()) {
@@ -1417,6 +1546,568 @@ async function revalidateRuntime(runtime) {
   }
 }
 
+// server/utils/harness/local/compatibility.ts
+var LOCAL_HARNESS_MANIFEST = {
+  "claude-code": {
+    harnessId: "claude-code",
+    adapterVersion: "1.0.100",
+    runtime: {
+      source: "managed-bundle",
+      bundleName: "claude-code",
+      // Generated by the release pack build, and EMPTY until one has run.
+      // Either way the result is `bundle-absent` before any tree is read, but
+      // WHICH message depends on what is on disk: with no bundle directory —
+      // today's state — `resolveManagedBundle` reports the missing bundle
+      // first; with a directory present, the empty map has no entry for this
+      // machine's `<os>-<arch>` and it names the target instead ("no pack has
+      // been built for linux-x64"). Both fail closed; only the second names a
+      // pack a user could go looking for.
+      bundleDigest: PACK_TREE_DIGESTS["claude-code"],
+      launcherRelativePath: "launcher.mjs",
+      nodeLauncherRelativePath: "bin/node",
+      jobLauncherRelativePath: "bin/mcpjam-job-launcher.exe",
+      vendorPackages: {
+        "@anthropic-ai/claude-code": "pinned-by-adapter-bridge-lockfile"
+      }
+    },
+    argvPolicy: { requiredFlags: [], deniedFlags: [] },
+    configStrategy: "synthetic-home",
+    supportsBuiltinToolApprovals: true,
+    permissionProfileMapping: {
+      "read-only": "allow-reads",
+      "workspace-edits": "allow-edits"
+      // `unrestricted` is deliberately absent: Claude Code CAN surface
+      // approvals, so there is no reason to offer a profile that switches them
+      // off on a host.
+    },
+    // Native eligibility is per platform. macOS and Linux have POSIX process
+    // groups, which is what whole-tree cleanup is built on there.
+    //
+    // Windows has no process group; its whole-tree guarantee is a Job Object
+    // with KILL_ON_JOB_CLOSE, created by `tools/mcpjam-job-launcher`, which
+    // ships INSIDE the Windows pack so its bytes are covered by the tree
+    // digest. Listing `win32` here is necessary but not sufficient:
+    // `supportsOwnershipProof('win32')` still answers false until runtime
+    // resolution has verified that launcher, so a pack without one keeps the
+    // platform refused exactly as before.
+    //
+    // Earned, not asserted: the conformance suite's `windows-latest` leg runs
+    // the full scenario and the abort scenario against the real pack and the
+    // real vendor CLI, and its survivor scan is what turns "we wrote a Job
+    // Object" into evidence that stopping a session stops everything it
+    // started. That leg is gating; the day it goes red, this entry is wrong.
+    nativePlatforms: ["darwin", "linux", "win32"],
+    // Empty until a backend's escape probes actually pass (I6).
+    isolatedBackends: {},
+    lifecycleConformanceVersion: "",
+    adapterBootstrapDir: ".harness-bootstrap/claude-code",
+    adapterBootstrapFiles: [
+      "package.json",
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "bridge.mjs"
+    ],
+    bridgeBundleDigest: `sha256:${"0".repeat(64)}`
+  },
+  codex: {
+    harnessId: "codex",
+    adapterVersion: "1.0.98",
+    runtime: {
+      source: "managed-bundle",
+      bundleName: "codex",
+      bundleDigest: PACK_TREE_DIGESTS.codex,
+      launcherRelativePath: "launcher.mjs",
+      nodeLauncherRelativePath: "bin/node",
+      vendorPackages: {
+        "@openai/codex-sdk": "pinned-by-adapter-bridge-lockfile"
+      }
+    },
+    argvPolicy: { requiredFlags: [], deniedFlags: [] },
+    configStrategy: "explicit-config-root",
+    supportsBuiltinToolApprovals: false,
+    // No mapping at all: the adapter rejects every mode but `allow-all`, and
+    // `allow-all` on a host with no outer boundary is the thing this plan
+    // exists to prevent. Codex earns a mapping when its adapter gains a
+    // reviewed restricted mode, or inside a verified isolation backend.
+    permissionProfileMapping: {},
+    nativePlatforms: [],
+    isolatedBackends: {},
+    lifecycleConformanceVersion: "",
+    adapterBootstrapDir: ".harness-bootstrap/codex",
+    adapterBootstrapFiles: ["package.json", "pnpm-lock.yaml", "bridge.mjs"],
+    bridgeBundleDigest: `sha256:${"0".repeat(64)}`
+  }
+};
+function localPermissionModeFor(harnessId, permissionProfile, targetKind) {
+  const manifests = LOCAL_HARNESS_MANIFEST;
+  const manifest = Object.prototype.hasOwnProperty.call(manifests, harnessId) ? manifests[harnessId] : void 0;
+  if (manifest === void 0) return null;
+  if (permissionProfile === "unrestricted" && targetKind === "local-native") {
+    return null;
+  }
+  return manifest.permissionProfileMapping[permissionProfile] ?? null;
+}
+function resolveLocalCompatibility(query, manifests = LOCAL_HARNESS_MANIFEST) {
+  const manifest = Object.prototype.hasOwnProperty.call(
+    manifests,
+    query.harnessId
+  ) ? manifests[query.harnessId] : void 0;
+  if (!manifest) {
+    return {
+      ok: false,
+      status: "harness-not-supported",
+      message: `${query.harnessId} has no reviewed local compatibility manifest. Run it hosted, or add a manifest entry with conformance evidence.`
+    };
+  }
+  if (query.installedAdapterVersion !== manifest.adapterVersion) {
+    return {
+      ok: false,
+      status: "adapter-version-mismatch",
+      message: `${query.harnessId} adapter ${query.installedAdapterVersion ?? "(version not supplied)"} is installed but the local manifest was reviewed against ${manifest.adapterVersion}. An adapter upgrade can change the command shapes the local provider translates, so it must be re-reviewed before local execution is enabled.`
+    };
+  }
+  if (manifest.lifecycleConformanceVersion === "") {
+    return {
+      ok: false,
+      status: "conformance-missing",
+      message: `${query.harnessId} has no recorded lifecycle conformance evidence. Local execution stays disabled until the conformance suite has been run for this harness/runtime/platform/mode tuple and its version is recorded in the manifest.`
+    };
+  }
+  if (query.platform === null) {
+    return {
+      ok: false,
+      status: "platform-not-supported",
+      // NOT "run the harness hosted instead". A requested-local turn has Send
+      // disabled in this state (`localHarnessBlocksSend`), so nothing falls
+      // back — and on a local Inspector with no cloud data plane there is no
+      // hosted target to switch to either, which makes the instruction
+      // unactionable exactly where it is most likely to be read.
+      message: `local execution is not supported on this platform.`
+    };
+  }
+  if (query.targetKind === "local-native") {
+    if (!manifest.nativePlatforms.includes(query.platform)) {
+      const reason = manifest.nativePlatforms.length === 0 ? `${query.harnessId} is not eligible for native mode on any platform: its adapter cannot surface tool approvals, so native execution would give it the OS user's full authority with no approval gate. Use hosted, or a verified isolation backend.` : `${query.harnessId} native mode is not supported on ${query.platform} (supported: ${manifest.nativePlatforms.join(", ")}).`;
+      return {
+        ok: false,
+        status: "native-not-eligible",
+        message: reason
+      };
+    }
+  } else {
+    if (query.backend === void 0) {
+      return {
+        ok: false,
+        status: "backend-not-verified",
+        message: "an isolated target must name its isolation backend."
+      };
+    }
+    const verifiedHere = manifest.isolatedBackends[query.platform] ?? [];
+    if (!verifiedHere.includes(query.backend)) {
+      return {
+        ok: false,
+        status: "backend-not-verified",
+        message: `isolation backend ${query.backend} has not passed conformance for ${query.harnessId} on ${query.platform}. Isolated mode never falls back to native \u2014 run hosted until the backend is verified for this platform.`
+      };
+    }
+  }
+  const permissionMode = manifest.permissionProfileMapping[query.permissionProfile];
+  if (permissionMode === void 0) {
+    const offered = Object.keys(manifest.permissionProfileMapping);
+    return {
+      ok: false,
+      status: "permission-profile-not-supported",
+      message: `${query.harnessId} does not offer the ${query.permissionProfile} permission profile locally` + (offered.length ? ` (offered: ${offered.join(", ")}).` : `; it has no locally offered profile at all.`)
+    };
+  }
+  if (query.permissionProfile === "unrestricted" && query.targetKind === "local-native") {
+    return {
+      ok: false,
+      status: "permission-profile-not-supported",
+      message: `the unrestricted profile requires a verified isolation backend. Native mode has no host containment, so an unrestricted turn there would run with the OS user's full authority.`
+    };
+  }
+  return { ok: true, manifest, permissionMode };
+}
+
+// server/utils/harness/local/runtime-lifecycle.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  mkdir as mkdir2,
+  readdir as readdir3,
+  readFile as readFile4,
+  rename,
+  rm as rm2,
+  stat as stat3,
+  writeFile as writeFile2
+} from "fs/promises";
+import { join as join4 } from "path";
+
+// server/utils/harness/local/local-state-lock.ts
+import { randomUUID } from "crypto";
+import { mkdir, readFile as readFile3, rm, stat as stat2, writeFile } from "fs/promises";
+import { join as join3 } from "path";
+var DEFAULT_STALE_MS = 3e4;
+var DEFAULT_POLL_MS = 25;
+var DEFAULT_TIMEOUT_MS = 45e3;
+async function readLockBody(file) {
+  try {
+    const parsed = JSON.parse(await readFile3(file, "utf8"));
+    if (!parsed || typeof parsed !== "object") return null;
+    const body = parsed;
+    if (typeof body.pid !== "number" || !Number.isInteger(body.pid) || body.pid <= 0 || typeof body.nonce !== "string" || body.nonce.length === 0) {
+      return null;
+    }
+    return { pid: body.pid, nonce: body.nonce, at: Number(body.at) || 0 };
+  } catch {
+    return null;
+  }
+}
+function lockHolderProvablyGone(body) {
+  if (body === null || body.pid === process.pid) return false;
+  try {
+    process.kill(body.pid, 0);
+    return false;
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+}
+function createLocalStateMutationLock(options) {
+  let mutationChain = Promise.resolve();
+  const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const acquire = async () => {
+    const root = options.rootDir();
+    const file = join3(root, options.lockFileName);
+    await mkdir(root, { recursive: true, mode: 448 });
+    const nonce = randomUUID();
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      try {
+        await writeFile(
+          file,
+          JSON.stringify({ pid: process.pid, nonce, at: Date.now() }),
+          { flag: "wx", mode: 384 }
+        );
+        return async () => {
+          const held = await readLockBody(file);
+          if (held?.nonce !== nonce) {
+            logger.warn(
+              `[local-harness] ${options.resourceLabel} lock was taken over; not releasing`
+            );
+            return;
+          }
+          await rm(file, { force: true }).catch(() => {
+          });
+        };
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        const body = await readLockBody(file);
+        const age = await stat2(file).then(
+          (info) => Date.now() - info.mtimeMs,
+          () => 0
+        );
+        const holderGone = lockHolderProvablyGone(body);
+        const unattributable = body === null && age > staleMs;
+        if (holderGone || unattributable) {
+          logger.warn(
+            `[local-harness] breaking an abandoned ${options.resourceLabel} lock`,
+            { age, holderGone, unattributable }
+          );
+          await rm(file, { force: true }).catch(() => {
+          });
+          continue;
+        }
+        if (Date.now() > deadline) {
+          throw new Error(
+            `timed out waiting for the local harness ${options.resourceLabel} lock` + (body === null ? "" : ` (held by pid ${body.pid})`) + ". Its holder could not be proven gone, and taking it over would admit concurrent state writers."
+          );
+        }
+        await new Promise(
+          (resolvePromise) => setTimeout(resolvePromise, pollMs)
+        );
+      }
+    }
+  };
+  return (operation) => {
+    const guarded = async () => {
+      const release = await acquire();
+      try {
+        return await operation();
+      } finally {
+        await release();
+      }
+    };
+    const run = mutationChain.then(guarded, guarded);
+    mutationChain = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  };
+}
+
+// server/utils/harness/local/runtime-lifecycle.ts
+var OPERATION_FILE = ".mcpjam-operation.json";
+var USE_DIR = ".mcpjam-inuse";
+var STAGING_PREFIX = ".mcpjam-tmp-";
+var STAGING_OWNER_FILE = ".mcpjam-staging-owner.json";
+function operationKeyString(key) {
+  return [
+    key.runtimeRoot,
+    key.harnessId,
+    key.target,
+    key.packVersion,
+    key.treeDigest
+  ].join("\0");
+}
+function installRootOf(key) {
+  return join4(key.runtimeRoot, key.target);
+}
+var locksByRoot = /* @__PURE__ */ new Map();
+function lockFor(key) {
+  const root = installRootOf(key);
+  let lock = locksByRoot.get(root);
+  if (lock === void 0) {
+    lock = createLocalStateMutationLock({
+      rootDir: () => root,
+      lockFileName: ".mcpjam-runtime-lifecycle.lock",
+      resourceLabel: "runtime lifecycle",
+      // Short by construction: every critical section here is a read, a
+      // compare and an atomic write. A caller waiting longer than this is
+      // waiting on something that is not doing that.
+      timeoutMs: 15e3
+    });
+    locksByRoot.set(root, lock);
+  }
+  return lock;
+}
+function ownerProvablyGone(record) {
+  if (record.ownerPid === process.pid) {
+    return record.ownerStartedAt !== processStartedAt();
+  }
+  try {
+    process.kill(record.ownerPid, 0);
+    return false;
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+}
+var cachedStartedAt = null;
+function processStartedAt() {
+  if (cachedStartedAt === null) {
+    cachedStartedAt = Math.floor((Date.now() - process.uptime() * 1e3) / 1e3);
+  }
+  return cachedStartedAt;
+}
+async function writeJsonAtomic(file, value) {
+  const tmp = `${file}.${process.pid}.${randomUUID2()}.tmp`;
+  await writeFile2(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  await rename(tmp, file);
+}
+async function readJson(file) {
+  try {
+    return JSON.parse(await readFile4(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function readRuntimeOperation(key) {
+  const file = join4(installRootOf(key), OPERATION_FILE);
+  const record = await readJson(file);
+  if (record === null) return null;
+  if (record.packVersion !== key.packVersion || record.treeDigest !== key.treeDigest || record.harnessId !== key.harnessId) {
+    return null;
+  }
+  const terminal = record.state === "ready" || record.state === "failed" || record.state === "interrupted";
+  if (terminal || !ownerProvablyGone(record)) return record;
+  return lockFor(key)(async () => {
+    const fresh = await readJson(file);
+    if (fresh === null) return null;
+    if (fresh.attemptId !== record.attemptId) return fresh;
+    if (fresh.state === "ready" || fresh.state === "failed" || fresh.state === "interrupted") {
+      return fresh;
+    }
+    if (!ownerProvablyGone(fresh)) return fresh;
+    const reconciled = {
+      ...fresh,
+      state: "interrupted",
+      message: "the Inspector that started this install is no longer running, so the attempt was abandoned partway through",
+      updatedAt: Date.now()
+    };
+    await writeJsonAtomic(file, reconciled);
+    logger.info("[local-harness] recovered an interrupted install attempt", {
+      attemptId: reconciled.attemptId,
+      packVersion: reconciled.packVersion
+    });
+    return reconciled;
+  });
+}
+async function beginInstallAttempt(key) {
+  const root = installRootOf(key);
+  await mkdir2(root, { recursive: true, mode: 448 });
+  const file = join4(root, OPERATION_FILE);
+  return lockFor(key)(async () => {
+    const existing = await readJson(file);
+    if (existing !== null && existing.packVersion === key.packVersion && existing.treeDigest === key.treeDigest && existing.harnessId === key.harnessId) {
+      const live = existing.state !== "ready" && existing.state !== "failed" && existing.state !== "interrupted";
+      if (live && !ownerProvablyGone(existing)) {
+        return { kind: "joined", record: existing };
+      }
+    }
+    const record = {
+      attemptId: `att_${randomUUID2()}`,
+      ownerPid: process.pid,
+      ownerStartedAt: processStartedAt(),
+      harnessId: key.harnessId,
+      target: key.target,
+      packVersion: key.packVersion,
+      treeDigest: key.treeDigest,
+      state: "reserved",
+      startedAt: Date.now(),
+      updatedAt: Date.now()
+    };
+    await writeJsonAtomic(file, record);
+    return { kind: "started", record };
+  });
+}
+async function updateInstallAttempt(key, attemptId, patch) {
+  const file = join4(installRootOf(key), OPERATION_FILE);
+  return lockFor(key)(async () => {
+    const existing = await readJson(file);
+    if (existing === null || existing.attemptId !== attemptId) return false;
+    await writeJsonAtomic(file, {
+      ...existing,
+      ...patch,
+      updatedAt: Date.now()
+    });
+    return true;
+  });
+}
+async function attemptStillOwns(key, attemptId) {
+  const record = await readJson(
+    join4(installRootOf(key), OPERATION_FILE)
+  );
+  return record?.attemptId === attemptId;
+}
+async function reserveRuntimeUse(args) {
+  const dir = join4(installRootOf(args.key), USE_DIR);
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  const file = join4(dir, `${process.pid}-${randomUUID2()}.json`);
+  const record = {
+    pid: process.pid,
+    startedAt: processStartedAt(),
+    runtimeRoot: args.runtimeRoot,
+    at: Date.now(),
+    ...args.label ? { label: args.label } : {}
+  };
+  await writeJsonAtomic(file, record);
+  let released = false;
+  return {
+    release: async () => {
+      if (released) return;
+      released = true;
+      await rm2(file, { force: true }).catch(() => {
+      });
+    }
+  };
+}
+async function runtimeUseState(args) {
+  const dir = join4(installRootOf(args.key), USE_DIR);
+  let entries;
+  try {
+    entries = await readdir3(dir);
+  } catch {
+    return { busy: false, holders: [] };
+  }
+  const holders = [];
+  for (const entry of entries) {
+    if (!entry.endsWith(".json")) continue;
+    const file = join4(dir, entry);
+    const record = await readJson(file);
+    if (record === null) {
+      continue;
+    }
+    if (record.runtimeRoot !== args.runtimeRoot) continue;
+    if (ownerProvablyGone({ ownerPid: record.pid, ownerStartedAt: record.startedAt })) {
+      await rm2(file, { force: true }).catch(() => {
+      });
+      continue;
+    }
+    holders.push(record.pid);
+  }
+  return { busy: holders.length > 0, holders };
+}
+async function claimStagingDirectory(args) {
+  await writeJsonAtomic(join4(args.staging, STAGING_OWNER_FILE), {
+    pid: process.pid,
+    startedAt: processStartedAt(),
+    attemptId: args.attemptId,
+    at: Date.now()
+  });
+}
+async function sweepAbandonedStaging(key) {
+  const root = installRootOf(key);
+  let entries;
+  try {
+    entries = await readdir3(root);
+  } catch {
+    return { removed: 0, left: 0 };
+  }
+  let removed = 0;
+  let left = 0;
+  for (const entry of entries) {
+    if (!entry.startsWith(STAGING_PREFIX)) continue;
+    const path = join4(root, entry);
+    const owner = await readJson(join4(path, STAGING_OWNER_FILE));
+    if (owner === null) {
+      left += 1;
+      continue;
+    }
+    if (!ownerProvablyGone({ ownerPid: owner.pid, ownerStartedAt: owner.startedAt })) {
+      left += 1;
+      continue;
+    }
+    await rm2(path, { recursive: true, force: true }).catch(() => {
+    });
+    removed += 1;
+  }
+  if (removed > 0 || left > 0) {
+    logger.debug("[local-harness] staging sweep", { removed, left });
+  }
+  return { removed, left };
+}
+async function recoverInterruptedActivation(args) {
+  const previous = `${args.versionRoot}${PREVIOUS_SUFFIX}`;
+  const hasPrevious = await stat3(previous).then(
+    (info) => info.isDirectory(),
+    () => false
+  );
+  if (!hasPrevious) return false;
+  return lockFor(args.key)(async () => {
+    const current = await stat3(args.versionRoot).then(
+      (info) => info.isDirectory(),
+      () => false
+    );
+    if (current) {
+      await rm2(previous, { recursive: true, force: true }).catch(() => {
+      });
+      return false;
+    }
+    await rename(previous, args.versionRoot);
+    logger.warn("[local-harness] restored a runtime after an interrupted activation", {
+      packVersion: args.key.packVersion
+    });
+    return true;
+  });
+}
+var PREVIOUS_SUFFIX = ".mcpjam-previous";
+function withRuntimeLifecycleLock(key, operation) {
+  return lockFor(key)(operation);
+}
+
 // server/utils/harness/local/runtime-install.ts
 var MAX_ARCHIVE_BYTES = 1500 * 1024 * 1024;
 var MAX_EXTRACTED_BYTES = 2 * 1024 * 1024 * 1024;
@@ -1424,13 +2115,13 @@ var MAX_MANIFEST_BYTES = 1024 * 1024;
 function runtimeInstallRoot() {
   const override = process.env.MCPJAM_RUNTIME_ROOT;
   if (override && override.trim().length > 0) return override.trim();
-  return join2(homedir(), ".mcpjam", "harness-local", "runtime");
+  return join5(homedir(), ".mcpjam", "harness-local", "runtime");
 }
 function packVersionRoot(packVersion, target = localPackTarget()) {
-  return join2(targetInstallRoot(target), packVersion);
+  return join5(targetInstallRoot(target), packVersion);
 }
 function targetInstallRoot(target) {
-  return join2(runtimeInstallRoot(), target ?? packPlatformKey());
+  return join5(runtimeInstallRoot(), target ?? packPlatformKey());
 }
 function expectedPackFor(harnessId, target) {
   const override = developmentPackExpectation();
@@ -1466,124 +2157,357 @@ function packPlatformKey(platform = process.platform, arch = process.arch) {
   return `${platform}-${arch}`;
 }
 async function readRuntimeInstallStatus(args) {
-  const platform = currentLocalPlatform(args.platform ?? process.platform);
-  if (platform === null) {
-    return {
-      state: "unsupported-platform",
-      message: `${args.platform ?? process.platform} has no local harness runtime`
-    };
+  const resolved = resolveInstallTarget(args);
+  if (!resolved.ok) return resolved.status;
+  const { key, expected, versionRoot } = resolved;
+  await recoverInterruptedActivation({ key, versionRoot });
+  const inProcess = active.get(operationKeyString(key));
+  if (inProcess !== void 0) return inProcess.status;
+  const record = await readRuntimeOperation(key);
+  if (record !== null && !isRecordTerminal(record)) {
+    return operationRecordStatus(record);
+  }
+  const onDisk = await readMarkerStatus({
+    harnessId: args.harnessId,
+    versionRoot,
+    expected
+  });
+  if (onDisk.state === "ready") return onDisk;
+  if (record !== null && isRecordTerminal(record) && record.state !== "ready") {
+    return operationRecordStatus(record);
   }
-  const target = localPackTarget(args.platform, args.arch);
-  const expected = target === null ? null : expectedPackFor(args.harnessId, target);
-  if (expected === null) {
-    return {
-      state: "unsupported-platform",
-      message: `no ${args.harnessId} runtime pack has been built for ${packPlatformKey(args.platform, args.arch)}`
-    };
+  return onDisk;
+}
+function manifestWithExpectedBundleDigest(manifest, harnessId, target) {
+  if (target === null) return manifest;
+  if (manifest.runtime.source !== "managed-bundle") return manifest;
+  const expected = expectedPackFor(harnessId, target);
+  if (expected === null) return manifest;
+  if (manifest.runtime.bundleDigest[target] === expected.treeDigest) {
+    return manifest;
   }
-  const inFlight = active.get(expected.packVersion);
-  if (inFlight !== void 0) return inFlight.status;
-  const root = packVersionRoot(expected.packVersion, target);
+  return {
+    ...manifest,
+    runtime: {
+      ...manifest.runtime,
+      bundleDigest: {
+        ...manifest.runtime.bundleDigest,
+        [target]: expected.treeDigest
+      }
+    }
+  };
+}
+async function readVerifiedRuntimeStatus(args) {
+  const status = await readRuntimeInstallStatus(args);
+  if (status.state !== "ready") return status;
+  const platform = currentLocalPlatform(args.platform ?? process.platform);
+  if (platform === null) return status;
+  const resolvedBundle = await resolveManagedBundle({
+    manifest: manifestWithExpectedBundleDigest(
+      LOCAL_HARNESS_MANIFEST[args.harnessId],
+      args.harnessId,
+      localPackTarget(args.platform, args.arch)
+    ),
+    runtimeRoot: status.runtimeRoot,
+    platform,
+    ...args.arch ? { arch: args.arch } : {}
+  });
+  if (resolvedBundle.ok) return status;
+  return {
+    state: "corrupt",
+    packVersion: status.packVersion,
+    message: resolvedBundle.message
+  };
+}
+async function readMarkerStatus(args) {
   try {
     const marker = JSON.parse(
-      await readFile3(join2(root, INSTALL_MARKER), "utf8")
+      await readFile5(join5(args.versionRoot, INSTALL_MARKER), "utf8")
     );
-    if (marker.treeDigest !== expected.treeDigest) {
+    if (marker.treeDigest !== args.expected.treeDigest) {
       return {
         state: "corrupt",
-        packVersion: expected.packVersion,
+        packVersion: args.expected.packVersion,
         message: "the installed runtime pack does not match the digest this Inspector expects; reinstall it"
       };
     }
-    await stat2(join2(root, args.harnessId));
+    await stat4(join5(args.versionRoot, args.harnessId));
     return {
       state: "ready",
-      packVersion: expected.packVersion,
-      runtimeRoot: root,
-      digest: expected.treeDigest
+      packVersion: args.expected.packVersion,
+      runtimeRoot: args.versionRoot,
+      digest: args.expected.treeDigest
     };
   } catch {
-    return { state: "absent", packVersion: expected.packVersion };
+    return { state: "absent", packVersion: args.expected.packVersion };
+  }
+}
+function isRecordTerminal(record) {
+  return record.state === "ready" || record.state === "failed" || record.state === "interrupted";
+}
+function operationRecordStatus(record) {
+  switch (record.state) {
+    case "reserved":
+    case "downloading":
+      return {
+        state: "downloading",
+        packVersion: record.packVersion,
+        percent: record.percent ?? 0,
+        attemptId: record.attemptId
+      };
+    case "verifying":
+    case "activating":
+      return {
+        state: "verifying",
+        packVersion: record.packVersion,
+        attemptId: record.attemptId
+      };
+    case "failed":
+      return {
+        state: "failed",
+        packVersion: record.packVersion,
+        reason: record.reason ?? "unknown",
+        message: record.message ?? "the install did not complete",
+        attemptId: record.attemptId
+      };
+    case "interrupted":
+      return {
+        state: "interrupted",
+        packVersion: record.packVersion,
+        message: record.message ?? "setup was interrupted before it finished",
+        attemptId: record.attemptId
+      };
+    case "ready":
+      return {
+        state: "ready",
+        packVersion: record.packVersion,
+        runtimeRoot: packVersionRoot(record.packVersion, record.target),
+        digest: record.treeDigest
+      };
   }
 }
+function resolveInstallTarget(args) {
+  const platform = currentLocalPlatform(args.platform ?? process.platform);
+  if (platform === null) {
+    return {
+      ok: false,
+      status: {
+        state: "unsupported-platform",
+        message: `${args.platform ?? process.platform} has no local harness runtime`
+      }
+    };
+  }
+  const target = localPackTarget(args.platform, args.arch);
+  const expected = target === null ? null : expectedPackFor(args.harnessId, target);
+  if (expected === null || target === null) {
+    return {
+      ok: false,
+      status: {
+        state: "unsupported-platform",
+        message: `no ${args.harnessId} runtime pack has been built for ${packPlatformKey(args.platform, args.arch)}`
+      }
+    };
+  }
+  return {
+    ok: true,
+    platform,
+    target,
+    expected,
+    versionRoot: packVersionRoot(expected.packVersion, target),
+    key: {
+      runtimeRoot: runtimeInstallRoot(),
+      harnessId: args.harnessId,
+      target,
+      packVersion: expected.packVersion,
+      treeDigest: expected.treeDigest
+    }
+  };
+}
 var INSTALL_MARKER = ".mcpjam-pack-installed.json";
 var active = /* @__PURE__ */ new Map();
-async function installRuntimePack(options) {
-  const platform = currentLocalPlatform(options.platform ?? process.platform);
-  if (platform === null) {
+async function startRuntimeInstall(options) {
+  const resolved = resolveInstallTarget(options);
+  if (!resolved.ok) {
     return {
-      state: "unsupported-platform",
-      message: `${options.platform ?? process.platform} has no local harness runtime`
+      kind: "refused",
+      status: resolved.status,
+      reason: resolved.status.state === "unsupported-platform" ? resolved.status.message : "this machine has no runtime pack to install"
+    };
+  }
+  const { key, expected, versionRoot } = resolved;
+  if (options.expectedPack !== void 0 && (options.expectedPack.packVersion !== expected.packVersion || options.expectedPack.treeDigest !== expected.treeDigest)) {
+    return {
+      kind: "refused",
+      reason: "this Inspector now expects a different runtime than the one that was approved, so it will not download it under that approval",
+      status: {
+        state: "failed",
+        packVersion: expected.packVersion,
+        reason: "verification",
+        message: `the approved runtime was ${options.expectedPack.packVersion} (${options.expectedPack.treeDigest.slice(0, 19)}\u2026) but this Inspector now expects ${expected.packVersion} (${expected.treeDigest.slice(0, 19)}\u2026). Authorize the new one.`
+      }
     };
   }
-  const target = localPackTarget(options.platform, options.arch);
-  const expected = target === null ? null : expectedPackFor(options.harnessId, target);
-  if (expected === null) {
+  const keyString = operationKeyString(key);
+  const running = active.get(keyString);
+  if (running !== void 0) {
+    return { kind: "joined", status: running.status };
+  }
+  await recoverInterruptedActivation({ key, versionRoot });
+  const verified = await readVerifiedRuntimeStatus(options);
+  if (verified.state === "ready") return { kind: "ready", status: verified };
+  const attempt = await beginInstallAttempt(key);
+  if (attempt.kind === "joined") {
     return {
-      state: "unsupported-platform",
-      message: `no ${options.harnessId} runtime pack has been built for ${packPlatformKey(options.platform, options.arch)}`
+      kind: "joined",
+      status: operationRecordStatus(attempt.record),
+      attemptId: attempt.record.attemptId
     };
   }
-  const existing = active.get(expected.packVersion);
-  if (existing !== void 0) return existing.promise;
   const record = {
-    status: { state: "downloading", packVersion: expected.packVersion, percent: 0 },
+    status: {
+      state: "downloading",
+      packVersion: expected.packVersion,
+      percent: 0,
+      attemptId: attempt.record.attemptId
+    },
     promise: Promise.resolve({
       state: "absent",
       packVersion: expected.packVersion
     })
   };
-  active.set(expected.packVersion, record);
+  active.set(keyString, record);
+  record.promise = runInstallAttempt({
+    options,
+    resolved,
+    attemptId: attempt.record.attemptId,
+    record,
+    keyString
+  });
+  void record.promise;
+  return {
+    kind: "started",
+    status: record.status,
+    attemptId: attempt.record.attemptId
+  };
+}
+async function installRuntimePack(options) {
+  const started = await startRuntimeInstall(options);
+  if (started.kind === "ready" || started.kind === "refused") {
+    return started.status;
+  }
+  const resolved = resolveInstallTarget(options);
+  if (!resolved.ok) return resolved.status;
+  const running = active.get(operationKeyString(resolved.key));
+  if (running !== void 0) return running.promise;
+  return awaitForeignAttempt(resolved.key, options);
+}
+async function awaitForeignAttempt(key, options) {
+  for (; ; ) {
+    if (options.signal?.aborted === true) {
+      return readRuntimeInstallStatus(options);
+    }
+    const record = await readRuntimeOperation(key);
+    if (record === null) return readRuntimeInstallStatus(options);
+    if (isRecordTerminal(record)) {
+      return record.state === "ready" ? readRuntimeInstallStatus(options) : operationRecordStatus(record);
+    }
+    options.onProgress?.(operationRecordStatus(record));
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 500));
+  }
+}
+async function runInstallAttempt(args) {
+  const { options, resolved, attemptId, record, keyString } = args;
+  const { key, expected } = resolved;
   const setStatus = (status) => {
     record.status = status;
     options.onProgress?.(status);
+    void updateInstallAttempt(key, attemptId, {
+      state: status.state === "downloading" ? "downloading" : status.state === "verifying" ? "verifying" : "reserved",
+      ...status.state === "downloading" ? { percent: status.percent } : {}
+    }).catch(() => {
+    });
   };
-  record.promise = (async () => {
-    try {
-      return await performInstall({
-        ...options,
-        platform,
-        expected,
-        setStatus
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      logger.warn("[local-harness] runtime pack install failed", { message });
-      return {
-        state: "corrupt",
-        packVersion: expected.packVersion,
-        message
-      };
-    } finally {
-      active.delete(expected.packVersion);
-    }
-  })();
-  return record.promise;
+  try {
+    const result = await performInstall({
+      ...options,
+      platform: resolved.platform,
+      expected,
+      key,
+      attemptId,
+      setStatus
+    });
+    record.status = result;
+    await updateInstallAttempt(key, attemptId, {
+      state: result.state === "ready" ? "ready" : "failed",
+      ...result.state === "failed" ? { reason: result.reason, message: result.message } : {}
+    }).catch(() => {
+    });
+    return result;
+  } catch (error) {
+    const failure = classifyInstallFailure(error, expected.packVersion);
+    logger.warn("[local-harness] runtime pack install failed", {
+      reason: failure.reason,
+      message: failure.message
+    });
+    record.status = failure;
+    await updateInstallAttempt(key, attemptId, {
+      state: "failed",
+      reason: failure.reason,
+      message: failure.message
+    }).catch(() => {
+    });
+    return failure;
+  } finally {
+    active.delete(keyString);
+  }
+}
+function classifyInstallFailure(error, packVersion) {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = error?.code;
+  const causeCode = error?.cause?.code;
+  const reason = code === "ENOSPC" || code === "EACCES" || code === "EPERM" || code === "EROFS" || code === "EDQUOT" ? "disk" : code === "ENOTFOUND" || code === "ECONNRESET" || code === "ETIMEDOUT" || code === "ECONNREFUSED" || causeCode === "ENOTFOUND" || causeCode === "ECONNRESET" || causeCode === "ETIMEDOUT" || causeCode === "ECONNREFUSED" || /could not be downloaded|responded \d{3}|fetch failed|network/i.test(
+    message
+  ) ? "network" : /does not match|signature|signed manifest|no signed manifest|digest|exceeds its size ceiling|has no .* directory at its root/i.test(
+    message
+  ) ? "verification" : "unknown";
+  return { state: "failed", packVersion, reason, message };
 }
 async function performInstall(args) {
-  const { expected, setStatus } = args;
+  const { expected, setStatus, key, attemptId } = args;
   const platformKey = packPlatformKey(args.platform, args.arch);
   const target = localPackTarget(args.platform, args.arch);
   const versionRoot = packVersionRoot(expected.packVersion, target);
   const installRoot = targetInstallRoot(target);
-  await mkdir(installRoot, { recursive: true, mode: 448 });
-  const staging = join2(installRoot, `.mcpjam-tmp-${randomUUID()}`);
-  await mkdir(staging, { recursive: true, mode: 448 });
+  await mkdir3(installRoot, { recursive: true, mode: 448 });
+  await sweepAbandonedStaging(key);
+  const staging = join5(installRoot, `${STAGING_PREFIX}${randomUUID3()}`);
+  await mkdir3(staging, { recursive: true, mode: 448 });
+  await claimStagingDirectory({ staging, attemptId });
   try {
     const source = packSourceFor(expected.packVersion, platformKey);
-    const archivePath = join2(staging, "pack.tar.gz");
-    setStatus({ state: "downloading", packVersion: expected.packVersion, percent: 0 });
+    const archivePath = join5(staging, "pack.tar.gz");
+    setStatus({
+      state: "downloading",
+      packVersion: expected.packVersion,
+      percent: 0,
+      attemptId
+    });
     const archiveSha = await fetchArchive({
       source,
       destination: archivePath,
       onPercent: (percent) => setStatus({
         state: "downloading",
         packVersion: expected.packVersion,
-        percent
+        percent,
+        attemptId
       }),
       ...args.signal ? { signal: args.signal } : {}
     });
-    setStatus({ state: "verifying", packVersion: expected.packVersion });
+    setStatus({
+      state: "verifying",
+      packVersion: expected.packVersion,
+      attemptId
+    });
     const manifest = await loadAndVerifyManifest({
       source,
       packVersion: expected.packVersion,
@@ -1597,8 +2521,8 @@ async function performInstall(args) {
         );
       }
     }
-    const extractRoot = join2(staging, "extracted");
-    await mkdir(extractRoot, { recursive: true, mode: 448 });
+    const extractRoot = join5(staging, "extracted");
+    await mkdir3(extractRoot, { recursive: true, mode: 448 });
     await extractTar({
       file: archivePath,
       cwd: extractRoot,
@@ -1613,8 +2537,8 @@ async function performInstall(args) {
       preservePaths: false,
       strict: true
     });
-    const packRoot = join2(extractRoot, args.harnessId);
-    const info = await stat2(packRoot).catch(() => null);
+    const packRoot = join5(extractRoot, args.harnessId);
+    const info = await stat4(packRoot).catch(() => null);
     if (info === null || !info.isDirectory()) {
       throw new Error(
         `the runtime pack archive has no ${args.harnessId} directory at its root`
@@ -1633,8 +2557,8 @@ async function performInstall(args) {
       );
     }
     if (args.platform === "darwin") await clearQuarantine(extractRoot);
-    await writeFile(
-      join2(extractRoot, INSTALL_MARKER),
+    await writeFile3(
+      join5(extractRoot, INSTALL_MARKER),
       `${JSON.stringify(
         {
           packVersion: expected.packVersion,
@@ -1649,10 +2573,18 @@ async function performInstall(args) {
 `,
       { mode: 384 }
     );
-    await rm(versionRoot, { recursive: true, force: true });
-    await rename(extractRoot, versionRoot);
-    clearRuntimeVerificationCache();
-    await sweepOtherVersions(installRoot, expected.packVersion);
+    setStatus({
+      state: "verifying",
+      packVersion: expected.packVersion,
+      attemptId
+    });
+    await updateInstallAttempt(key, attemptId, { state: "activating" });
+    await activateVerifiedPack({
+      key,
+      attemptId,
+      versionRoot,
+      extractRoot
+    });
     logger.info("[local-harness] runtime pack installed", {
       packVersion: expected.packVersion,
       platform: platformKey
@@ -1664,20 +2596,60 @@ async function performInstall(args) {
       digest
     };
   } finally {
-    await rm(staging, { recursive: true, force: true }).catch(() => {
+    await rm3(staging, { recursive: true, force: true }).catch(() => {
     });
   }
 }
+async function activateVerifiedPack(args) {
+  const { key, versionRoot, extractRoot } = args;
+  if (!await attemptStillOwns(key, args.attemptId)) {
+    throw new Error(
+      "another install took over this runtime while this one was downloading, so it was not activated"
+    );
+  }
+  const inUse = await runtimeUseState({ key, runtimeRoot: versionRoot });
+  if (inUse.busy) {
+    throw new Error(
+      `this runtime is in use by ${inUse.holders.length} running session(s) on this machine, so it was not replaced. Stop them and retry.`
+    );
+  }
+  await withRuntimeLifecycleLock(key, async () => {
+    const stillFree = await runtimeUseState({ key, runtimeRoot: versionRoot });
+    if (stillFree.busy) {
+      throw new Error(
+        "a session started using this runtime while it was being replaced, so it was left alone. Stop it and retry."
+      );
+    }
+    const previous = `${versionRoot}${PREVIOUS_SUFFIX}`;
+    await rm3(previous, { recursive: true, force: true }).catch(() => {
+    });
+    const hasCurrent = await stat4(versionRoot).then(
+      () => true,
+      () => false
+    );
+    if (hasCurrent) await rename2(versionRoot, previous);
+    try {
+      await rename2(extractRoot, versionRoot);
+    } catch (error) {
+      if (hasCurrent) await rename2(previous, versionRoot).catch(() => {
+      });
+      throw error;
+    }
+    await rm3(previous, { recursive: true, force: true }).catch(() => {
+    });
+  });
+  clearRuntimeVerificationCache();
+}
 async function assertExtractedSize(root) {
   let bytes = 0;
   const walk = async (dir) => {
-    for (const entry of await readdir3(dir, { withFileTypes: true })) {
-      const full = join2(dir, entry.name);
+    for (const entry of await readdir4(dir, { withFileTypes: true })) {
+      const full = join5(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
       }
-      bytes += (await stat2(full)).size;
+      bytes += (await stat4(full)).size;
       if (bytes > MAX_EXTRACTED_BYTES) {
         throw new Error("the extracted runtime pack exceeds its size ceiling");
       }
@@ -1685,31 +2657,6 @@ async function assertExtractedSize(root) {
   };
   await walk(root);
 }
-async function sweepOtherVersions(installRoot, keepVersion) {
-  let entries;
-  try {
-    entries = await readdir3(installRoot);
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (entry === keepVersion) continue;
-    const path = join2(installRoot, entry);
-    if (entry.startsWith(".mcpjam-tmp-")) {
-      await rm(path, { recursive: true, force: true }).catch(() => {
-      });
-      continue;
-    }
-    if (!/^[\w.-]+$/.test(entry)) continue;
-    const owned = await readFile3(join2(path, INSTALL_MARKER), "utf8").then(
-      () => true,
-      () => false
-    );
-    if (!owned) continue;
-    await rm(path, { recursive: true, force: true }).catch(() => {
-    });
-  }
-}
 async function clearQuarantine(root) {
   const { execFile: execFile3 } = await import("child_process");
   await new Promise((resolvePromise) => {
@@ -1730,8 +2677,8 @@ async function loadAndVerifyManifest(args) {
   try {
     if (args.source.kind === "file") {
       const dir = args.source.location.endsWith(".tar.gz") ? args.source.location.slice(0, -basename(args.source.location).length) : args.source.location;
-      manifestBytes = await readFile3(join2(dir, manifestName));
-      signature = await readFile3(join2(dir, signatureName), "utf8");
+      manifestBytes = await readFile5(join5(dir, manifestName));
+      signature = await readFile5(join5(dir, signatureName), "utf8");
     } else {
       const base = args.source.location.slice(
         0,
@@ -1807,7 +2754,7 @@ async function fetchArchive(args) {
   });
   if (args.source.kind === "file") {
     const path = args.source.location;
-    const info = await stat2(path);
+    const info = await stat4(path);
     total = info.size;
     if (total > MAX_ARCHIVE_BYTES) {
       throw new Error("the runtime pack archive exceeds its size ceiling");
@@ -1879,7 +2826,7 @@ export {
   isOriginCaptureHandled,
   captureOriginErrorToSentry,
   logger,
-  PACK_TREE_DIGESTS,
+  localPackTarget,
   LOCAL_HARNESS_POLICY_VERSION,
   LOCAL_ISOLATION_POLICY_VERSION,
   currentLocalPlatform,
@@ -1894,9 +2841,18 @@ export {
   resolveManagedBundle,
   resolveSystemInstall,
   revalidateRuntime,
+  LOCAL_HARNESS_MANIFEST,
+  localPermissionModeFor,
+  resolveLocalCompatibility,
+  createLocalStateMutationLock,
+  reserveRuntimeUse,
   runtimeInstallRoot,
+  expectedPackFor,
   readRuntimeInstallStatus,
+  manifestWithExpectedBundleDigest,
+  readVerifiedRuntimeStatus,
+  startRuntimeInstall,
   installRuntimePack,
   reportLocalHarnessRuntimeStatusInBackground
 };
-//# sourceMappingURL=chunk-7TOT3ZWN.js.map
+//# sourceMappingURL=chunk-5TXZXCUR.js.map