@orchestraworks/worker-win32-x64 0.0.134

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Living Computers
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@orchestraworks/worker-win32-x64",
+  "version": "0.0.134",
+  "description": "The Software Factory worker binary for win32 x64.",
+  "license": "Apache-2.0",
+  "author": "Living Computers",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/livingcomputers/software-factory.git"
+  },
+  "os": [
+    "win32"
+  ],
+  "cpu": [
+    "x64"
+  ]
+}

package/script-harness/fetch-failure.js

@@ -0,0 +1,44 @@
+// Node's `fetch` (undici) reports EVERY transport failure with the same four characterless words,
+// "fetch failed", and puts the diagnosis on `error.cause`: an errno-style `code` (ECONNREFUSED,
+// UNABLE_TO_VERIFY_LEAF_SIGNATURE, …) and, for a connect failure, the `address`/`port` it could not
+// reach. A throw built from `error.message` alone discards the one fact that names the LAYER that broke.
+//
+// Its own module rather than a helper inside index.js: importing `index.js` installs a readline interface
+// on `process.stdin` and exits the process when that closes. This file is plain Node with no imports.
+
+/**
+ * Deliberately a *cause* renderer and not a message formatter: the caller keeps owning the sentence, so a
+ * call site that already says which request failed does not have that repeated back to it.
+ *
+ * @param {unknown} error the value `fetch` threw.
+ * @returns {string} e.g. `"ECONNREFUSED 10.0.1.5:443"`, the cause's own message when it carries no code,
+ *   or `""`.
+ */
+export function describeFetchFailure(error) {
+  const cause = error?.cause;
+  if (!cause) return "";
+  // A string cause is legal (`new Error(msg, { cause: "reset by peer" })`) and is
+  // the whole diagnosis when it happens.
+  if (typeof cause === "string") return cause.trim();
+  if (typeof cause !== "object") return "";
+
+  const code = typeof cause.code === "string" ? cause.code.trim() : "";
+  const peer = peerOf(cause);
+  if (code) return peer ? `${code} ${peer}` : code;
+
+  // No code: undici's aggregate causes and TLS alerts carry only a message, and
+  // that message is still strictly more than "fetch failed".
+  return typeof cause.message === "string" ? cause.message.trim() : "";
+}
+
+/**
+ * `address:port` when the cause names the peer it could not reach, `""` otherwise. An IPv6 literal is
+ * bracketed, because `fd00:a::17:443` reads as an address.
+ */
+function peerOf(cause) {
+  const address = typeof cause.address === "string" ? cause.address.trim() : "";
+  if (!address) return "";
+  const port = Number.isInteger(cause.port) ? String(cause.port) : "";
+  if (!port) return address;
+  return address.includes(":") ? `[${address}]:${port}` : `${address}:${port}`;
+}

package/script-harness/index.js

@@ -0,0 +1,757 @@
+#!/usr/bin/env node
+// The script agent runtime harness: a zero-dependency Node 22 ESM server speaking the Go bridge's
+// line-delimited stdio JSON-RPC. One process per bridge multiplexes every session over one stdio pipe,
+// so the read loop must never block on an in-flight command.
+//
+// Each turn ends by setting the session's outcome claim from the command's exit code. A machine the
+// customer enrolled, which the worker declares by setting `SFDK_MACHINE_ENROLLED`, has no edge of ours in
+// front of it, so every claim there would be refused: the harness makes no call at all and ends the turn
+// on the script's own answer.
+
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { createInterface } from "node:readline";
+
+import { describeFetchFailure } from "./fetch-failure.js";
+
+const HARNESS_NAME = "software-factory-script-harness";
+const HARNESS_VERSION = "0.0.134";
+
+const IS_WINDOWS = process.platform === "win32";
+
+// -32001 matches the bridge's own code for a failed runtime request.
+const SCRIPT_FAILURE_CODE = -32001;
+const INVALID_PARAMS_CODE = -32602;
+const METHOD_NOT_FOUND_CODE = -32601;
+const INTERNAL_ERROR_CODE = -32603;
+const TURN_RUNNING_CODE = -32002;
+
+// The bridge's stdout scanner caps a line at 1MB, so every tail the harness emits — and every
+// `session/update` chunk below — stays far inside that bound.
+const STDERR_TAIL_ERROR = 2000;
+const STDERR_TAIL_SUMMARY = 500;
+const STDOUT_TAIL_CONTENT = 2000;
+
+const UPDATE_CHUNK_LIMIT = 32000;
+
+// A SIBLING of the controller's `.software-factory/` rather than nested inside it: the capture walk
+// refuses two roots where one contains the other, because the outer root's walk would reach the inner
+// root's files under an exclusion list that does not name them. Also the descriptor's `home` and its
+// `storeLayout.directory`, authored in `agents/runtime/assembly/manifest.json`.
+const TRANSCRIPT_DIRECTORY = [".script-harness"];
+const INSTRUCTIONS_FILE = ".script-harness/instructions.sh";
+
+const TRANSCRIPT_SUFFIX = ".jsonl";
+
+// A session id becomes a FILE NAME. This harness mints filesystem-safe ids, but `session/load` carries
+// whatever id the caller handed the bridge, and a `/` or a `..` in one would address a file outside the
+// transcript directory. Anything outside this alphabet is not recorded and not replayed.
+const SAFE_SESSION_ID = /^[A-Za-z0-9_.-]+$/;
+
+// Counted in WIRE bytes. Per-frame slicing bounds the bridge's line scanner but not the volume: the
+// platform holds every frame of a turn in memory and this runtime's output is arbitrary customer job
+// output (`make 2>&1`), so an unbounded build log is an OOM shape. Past the ceiling exactly ONE
+// truncation notice is emitted; the command still runs and the exit-code contract is unchanged.
+const TURN_OUTPUT_LIMIT_BYTES = 5 * 1024 * 1024;
+const TURN_OUTPUT_TRUNCATION_NOTICE =
+  `\n[${HARNESS_NAME}] output truncated: this turn exceeded the ` +
+  `${TURN_OUTPUT_LIMIT_BYTES} byte streaming ceiling. The command is still running to ` +
+  `completion and its exit status is unaffected; only further streamed output is dropped.\n`;
+
+// A lingering grandchild can hold the pipes open forever, which must never wedge a turn.
+const STDIO_FLUSH_GRACE_MS = 250;
+
+// Undici's default headers timeout is 300s, half the platform's own ACP response timeout (600s): an
+// unreachable agent API would hold the turn that long before surfacing as the claim failure it is.
+const PLATFORM_REQUEST_TIMEOUT_MS = 30000;
+
+const sessions = new Map();
+
+function sessionState(sessionId) {
+  let state = sessions.get(sessionId);
+  if (!state) {
+    state = { context: null, turn: null, prompting: null, cwd: null };
+    sessions.set(sessionId, state);
+  }
+  return state;
+}
+
+/**
+ * The bridge has already mapped `cwd` to the runtime's NATIVE filesystem by the time it arrives, so no
+ * path handling of any kind belongs here. Anything that is not a non-empty string is `null`: the bridge
+ * forwards a non-string `cwd` untouched on purpose (it translates, it does not police), so this reader
+ * must not invent a failure for a frame the bridge tolerated.
+ */
+function declaredCwd(params) {
+  const cwd = params?.cwd;
+  return typeof cwd === "string" && cwd !== "" ? cwd : null;
+}
+
+function write(message) {
+  process.stdout.write(`${JSON.stringify(message)}\n`);
+}
+
+function respondResult(id, result) {
+  write({ jsonrpc: "2.0", id, result });
+}
+
+function respondError(id, code, message, data) {
+  const error = data === undefined ? { code, message } : { code, message, data };
+  write({ jsonrpc: "2.0", id, error });
+}
+
+function sessionUpdateFrame(sessionId, update) {
+  return { jsonrpc: "2.0", method: "session/update", params: { sessionId, update } };
+}
+
+/**
+ * The wire write comes first and the transcript append second: the frame is the contract and the
+ * transcript is a fidelity nicety, so a slow or broken filesystem can never delay or drop what the
+ * bridge sees.
+ */
+function agentMessageChunk(text) {
+  return { sessionUpdate: "agent_message_chunk", content: { type: "text", text } };
+}
+
+function notifySessionUpdate(sessionId, text) {
+  const update = agentMessageChunk(text);
+  write(sessionUpdateFrame(sessionId, update));
+  recordSessionUpdate(sessionId, update);
+}
+
+/**
+ * Bounded twice: each frame is sliced at [UPDATE_CHUNK_LIMIT], because the bridge reads this process's
+ * stdout with a 1MB LINE cap and one over-long line would stop its scanner and kill every session on
+ * the pipe; and the turn's TOTAL streamed volume is capped at [TURN_OUTPUT_LIMIT_BYTES].
+ *
+ * The ceiling counts the JSON-ENCODED size, because what the platform retains is the wire frame. JSON
+ * escaping inflates control-heavy output by up to ~6x (one NUL byte is six wire bytes), so raw
+ * accounting let a binary-ish `make 2>&1` push ~30 MB through a "5 MiB" ceiling.
+ */
+function emitOutput(turn, sessionId, text) {
+  if (turn.outputTruncated) return;
+  const bytes = Buffer.byteLength(JSON.stringify(text), "utf8");
+  if (turn.emittedBytes + bytes > TURN_OUTPUT_LIMIT_BYTES) {
+    turn.outputTruncated = true;
+    notifySessionUpdate(sessionId, TURN_OUTPUT_TRUNCATION_NOTICE);
+    return;
+  }
+  turn.emittedBytes += bytes;
+  for (let offset = 0; offset < text.length; offset += UPDATE_CHUNK_LIMIT) {
+    notifySessionUpdate(sessionId, text.slice(offset, offset + UPDATE_CHUNK_LIMIT));
+  }
+}
+
+function logDiagnostic(text) {
+  process.stderr.write(`[${HARNESS_NAME}] ${text}\n`);
+}
+
+// The platform grades a resume on REPLAY FIDELITY: it counts the `session/update` frames a runtime
+// emits between its `session/load` request and that request's response, and a session with a prior
+// completed turn that replays ZERO frames is downgraded from RESUMED to RECONSTRUCTED. `$HOME` is the
+// carrier because it is the one thing the compute plane keeps across a machine's death. One line per
+// frame, holding `params.update` verbatim; appends are SYNCHRONOUS because order is the point, and
+// every failure is reported once on stderr and swallowed, because the exit code is the contract.
+
+function sessionFile(sessionId, suffix) {
+  if (typeof sessionId !== "string" || !SAFE_SESSION_ID.test(sessionId) || sessionId.startsWith(".")) {
+    return null;
+  }
+  return path.join(homedir(), ...TRANSCRIPT_DIRECTORY, `${sessionId}${suffix}`);
+}
+
+function transcriptFile(sessionId) {
+  return sessionFile(sessionId, TRANSCRIPT_SUFFIX);
+}
+
+// One diagnostic per session, not one per frame, because the failure mode is "every append fails".
+const transcriptFailures = new Set();
+let transcriptDirectoryReady = false;
+
+function recordSessionUpdate(sessionId, update) {
+  const file = transcriptFile(sessionId);
+  if (!file) return;
+  try {
+    if (!transcriptDirectoryReady) {
+      mkdirSync(path.dirname(file), { recursive: true });
+      transcriptDirectoryReady = true;
+    }
+    appendFileSync(file, `${JSON.stringify(update)}\n`);
+  } catch (error) {
+    // Re-arm the mkdir: the cheapest explanation for an append that suddenly fails is a directory that
+    // went away.
+    transcriptDirectoryReady = false;
+    if (!transcriptFailures.has(sessionId)) {
+      transcriptFailures.add(sessionId);
+      logDiagnostic(`recording the transcript of ${sessionId} failed (best-effort): ${error.message}`);
+    }
+  }
+}
+
+/**
+ * `write` DIRECTLY, never `notifySessionUpdate`: the recording path would append the replay back into
+ * the same file, so every resume would double the history and the next one would double that again —
+ * a conversation growing turns it never took.
+ */
+function replaySessionTranscript(sessionId) {
+  const file = transcriptFile(sessionId);
+  if (!file) return;
+  let raw;
+  try {
+    raw = readFileSync(file, "utf8");
+  } catch (error) {
+    // A session that has never taken a turn has no file: the empty replay, not a failure.
+    if (error.code !== "ENOENT") {
+      logDiagnostic(`reading the transcript of ${sessionId} failed (best-effort): ${error.message}`);
+    }
+    return;
+  }
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let update;
+    try {
+      update = JSON.parse(line);
+    } catch {
+      // A truncated final line (the sandbox died mid-append) costs that one frame, never the whole replay.
+      continue;
+    }
+    if (!update || typeof update !== "object") continue;
+    write(sessionUpdateFrame(sessionId, update));
+  }
+}
+
+function endTurn(text) {
+  return { stopReason: "end_turn", content: [{ type: "text", text }] };
+}
+
+function tail(value, limit) {
+  return value.length <= limit ? value : value.slice(value.length - limit);
+}
+
+/**
+ * `settled` makes a second settle a no-op, so a path that answers and then throws cannot write two
+ * frames for one request.
+ */
+function turnResponder(id, errorData, settlement) {
+  const settle = (emit) => {
+    if (settlement.settled) return;
+    settlement.settled = true;
+    releasePrompt(settlement);
+    emit();
+  };
+  return {
+    succeed: (text) => settle(() => respondResult(id, endTurn(text))),
+    fail: (message) => settle(() => respondError(id, SCRIPT_FAILURE_CODE, message, errorData)),
+  };
+}
+
+// Installation can change the file while this harness lives; only a new spawn reads those bytes.
+let program;
+let programReadError;
+try {
+  program = readFileSync(path.join(homedir(), INSTRUCTIONS_FILE), "utf8");
+} catch (error) {
+  programReadError = `cannot read instructions file: ${error.message}`;
+}
+
+// NO Authorization header is ever attached — the egress broker mints and injects the short-lived agent
+// bearer for the agent-API destination (the agent runtime must never hold credentials).
+function agentApiBaseUrl() {
+  const configured = (process.env.PLATFORM_BASE_URL || "").trim().replace(/\/+$/, "");
+  if (!configured) {
+    throw new Error("PLATFORM_BASE_URL is not set");
+  }
+  return configured;
+}
+
+// The worker declares this on a machine the customer enrolled, and on no machine the platform launched.
+// Presence is the declaration. The worker answers it from that machine's own bootstrap rather than
+// passing a value through, so nothing running inside the machine can declare it of itself.
+const MACHINE_ENROLLED = "SFDK_MACHINE_ENROLLED";
+
+function machineIsEnrolled() {
+  return (process.env[MACHINE_ENROLLED] || "").trim() !== "";
+}
+
+async function platformRequest(method, path, organizationId, body) {
+  let response;
+  try {
+    response = await fetch(`${agentApiBaseUrl()}${path}`, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-Organization-Id": organizationId,
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(PLATFORM_REQUEST_TIMEOUT_MS),
+    });
+  } catch (error) {
+    if (error?.name === "TimeoutError" || error?.name === "AbortError") {
+      throw new Error(`${method} ${path} timed out after ${PLATFORM_REQUEST_TIMEOUT_MS}ms`);
+    }
+    // `fetch` says only "fetch failed"; the layer that broke is on `error.cause`. Carried in the MESSAGE
+    // because that is what reaches an operator, and re-thrown with `{ cause }` so a local chain still leads
+    // to the original.
+    const detail = describeFetchFailure(error);
+    throw new Error(`${method} ${path} failed: ${error.message}${detail ? ` (${detail})` : ""}`, {
+      cause: error,
+    });
+  }
+  // Read to the end so the connection goes back to the pool; only the status is the answer.
+  await response.text();
+  return { status: response.status, ok: response.ok };
+}
+
+// ONE contract, two spellings, because "the OS shell" is not the same program on the two operating
+// systems this family ships on: `bash -c <prompt>` on POSIX, `detached` so the command owns its process
+// GROUP; `powershell.exe … -EncodedCommand <base64 of the UTF-16LE prompt>` on win32, not detached,
+// because that image carries no POSIX shell at all and `bash` there is an unconditional ENOENT. On
+// PowerShell a terminating error exits 1 and an explicit `exit N` propagates N, so the exit-code
+// mapping needs no per-OS arm.
+
+/**
+ * Windows PowerShell 5.1 decodes its STDIN with the console's OEM code page, and writes its output the
+ * same way, so a UTF-8 turn payload arrives mojibaked. Both are process-local settings with no
+ * command-line switch, so the harness states them as a fixed preamble ahead of the prompt inside the
+ * encoded command. A NESTED PowerShell the prompt itself starts gets its own defaults back — ASCII-
+ * safe, and left as a stated residual rather than papered over.
+ */
+const WINDOWS_ENCODING_PREAMBLE =
+  "[Console]::InputEncoding = [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false); ";
+
+/**
+ * `-EncodedCommand` rather than `-Command "<prompt>"` removes the quoting layer entirely: base64 of
+ * UTF-16LE carries no metacharacters, so no escaping rule of ours can silently run a DIFFERENT
+ * command that still exits 0. The cost is Windows' 32767-character command-line ceiling, which that
+ * encoding reaches at roughly 12000 prompt characters; past it the spawn error lands on the turn as
+ * an ordinary exit-127 failure. `detached` is POSIX-only — on Windows the cancel path walks the
+ * process TREE instead — and `cwd` is an option rather than a default, so omitting the key is Node's
+ * "inherit this process's directory".
+ */
+function shellInvocation(command, cwd, env) {
+  const stdio = ["pipe", "pipe", "pipe"];
+  const where = cwd ? { cwd } : {};
+  if (!IS_WINDOWS) {
+    return {
+      file: "bash",
+      args: ["-c", command],
+      options: { env, stdio, detached: true, ...where },
+    };
+  }
+  const encoded = Buffer.from(`${WINDOWS_ENCODING_PREAMBLE}${command}`, "utf16le").toString("base64");
+  return {
+    file: "powershell.exe",
+    args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded],
+    options: { env, stdio, windowsHide: true, ...where },
+  };
+}
+
+/**
+ * POSIX: SIGTERM the whole process GROUP (the command runs `detached`, so the group id is the child's
+ * pid); signalling `bash` alone leaves its children running. The guard is the VALUE-shaped
+ * `!(pid > 0)`, not a `=== undefined` check, because `process.kill(-0, sig)` signals the CALLER'S OWN
+ * process group — this harness process, and with it every session it is multiplexing.
+ *
+ * win32: `child.kill()` is a `TerminateProcess` of the SHELL alone, so the tree walk is `taskkill /T`,
+ * with `/F` because plain `taskkill` posts WM_CLOSE to windows a console job does not have. The
+ * liveness probe is a REQUIREMENT there — Windows recycles pids — and its answer is also the CANCEL
+ * DISCRIMINATOR: a `TerminateProcess`d process reports an exit CODE and no signal.
+ */
+function terminateCommandTree(child, turn, reason) {
+  if (!child || !(child.pid > 0)) return;
+  if (!IS_WINDOWS) {
+    try {
+      process.kill(-child.pid, "SIGTERM");
+    } catch {
+      try {
+        child.kill("SIGTERM");
+      } catch (error) {
+        logDiagnostic(`failed to signal the command process group (${reason}): ${error.message}`);
+      }
+    }
+    return;
+  }
+  try {
+    process.kill(child.pid, 0);
+  } catch {
+    return;
+  }
+  if (turn) turn.treeKilled = true;
+  try {
+    const killer = spawn("taskkill", ["/T", "/F", "/PID", String(child.pid)], {
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    killer.on("error", (error) => {
+      logDiagnostic(`failed to run taskkill (${reason}): ${error.message}`);
+    });
+  } catch (error) {
+    logDiagnostic(`failed to run taskkill (${reason}): ${error.message}`);
+  }
+}
+
+function runCommand({ acpSessionId, command, cwd, organizationId, promptText, turn }) {
+  return new Promise((resolve) => {
+    let stdoutTail = "";
+    let stderrTail = "";
+    let settled = false;
+
+    // The worker already composed this process's whole environment, its session included, so the child
+    // adds only the organization, which the worker does not provide. On POSIX `detached` puts the command in
+    // its OWN process group so a cancel — or the orphan sweep below — can signal the whole script tree.
+    const invocation = shellInvocation(command, cwd, {
+      ...process.env,
+      SFDK_ORGANIZATION_ID: organizationId,
+    });
+    const child = spawn(invocation.file, invocation.args, invocation.options);
+    turn.child = child;
+
+    // Detaching the stream listeners is part of settling, not an optimization: a backgrounded grandchild
+    // (`cmd &` is idiomatic) keeps the pipes open and would otherwise emit `session/update` frames into the
+    // NEXT turn's transcript, unreachable by `session/cancel` because that turn is gone.
+    const detachStreams = () => {
+      for (const stream of [child.stdout, child.stderr]) {
+        if (!stream) continue;
+        stream.removeAllListeners("data");
+        stream.destroy();
+      }
+    };
+
+    const finish = (exitCode, signal) => {
+      if (settled) return;
+      settled = true;
+      detachStreams();
+      resolve({ exitCode, signal, stdoutTail, stderrTail });
+    };
+
+    const streamTo = (stream, onChunk) => {
+      stream.setEncoding("utf8");
+      stream.on("data", (chunk) => {
+        onChunk(chunk);
+        emitOutput(turn, acpSessionId, chunk);
+      });
+    };
+    streamTo(child.stdout, (chunk) => {
+      stdoutTail = tail(stdoutTail + chunk, STDOUT_TAIL_CONTENT);
+    });
+    streamTo(child.stderr, (chunk) => {
+      stderrTail = tail(stderrTail + chunk, STDERR_TAIL_ERROR);
+    });
+
+    // A signalled child reports code null; map it to a conventional non-zero status so the exit-code
+    // contract has a single shape.
+    const statusOf = (code, signal) => (code === null ? (signal ? 128 : 1) : code);
+
+    child.on("error", (error) => {
+      stderrTail = tail(`${stderrTail}${error.message}\n`, STDERR_TAIL_ERROR);
+      finish(127, null);
+    });
+    // `close` (stdio drained) is the fidelity-preserving settle, but a command that leaves a child holding
+    // the pipes open would never reach it — so `exit` starts a short flush grace and then settles
+    // regardless, killing the orphaned group on the way out.
+    child.on("close", (code, signal) => finish(statusOf(code, signal), signal));
+    child.on("exit", (code, signal) => {
+      setTimeout(() => {
+        if (settled) return;
+        terminateCommandTree(child, null, "post-exit orphan sweep");
+        finish(statusOf(code, signal), signal);
+      }, STDIO_FLUSH_GRACE_MS);
+    });
+
+    // A command that ignores stdin closes the pipe early; EPIPE there is expected, not a turn failure.
+    child.stdin.on("error", () => {});
+    if (promptText) child.stdin.write(promptText);
+    child.stdin.end();
+  });
+}
+
+/** Concatenate the prompt's text content blocks verbatim (no marker parsing). */
+function promptTextOf(params) {
+  const prompt = params?.prompt;
+  if (typeof prompt === "string") return prompt;
+  if (!Array.isArray(prompt)) return "";
+  return prompt
+    .filter((block) => block && block.type === "text" && typeof block.text === "string")
+    .map((block) => block.text)
+    .join("");
+}
+
+/**
+ * Checked field by field against the pinned ACP schema (`fwp/schema/acp/acp-schema.json`).
+ * `agentCapabilities.loadSession` is a boolean that DEFAULTS TO FALSE, and `LoadSessionRequest` is
+ * "Only available if the Agent supports the `loadSession` capability" — so declaring it is what makes a
+ * client send the request at all. `promptCapabilities` stays absent, which is the schema's all-false
+ * default and the truth: an image, audio or embedded-context block would be dropped.
+ */
+function handleInitialize(id) {
+  respondResult(id, {
+    protocolVersion: 1,
+    agentCapabilities: { loadSession: true },
+    agentInfo: { name: HARNESS_NAME, version: HARNESS_VERSION },
+  });
+}
+
+function handleSessionNew(id, params) {
+  const sessionId = `script-session-${randomUUID()}`;
+  const state = sessionState(sessionId);
+  state.cwd = declaredCwd(params);
+  state.context = params?._meta?.sfdk;
+  respondResult(id, { sessionId });
+}
+
+/**
+ * `session/load` answers this session's REPLAY: the platform counts the `session/update` frames emitted
+ * between this request and its response, and zero frames for a session with a prior completed turn
+ * downgrades the resume from RESUMED to RECONSTRUCTED. Still no execution and no platform call.
+ */
+function handleSessionLoad(id, params) {
+  const sessionId = params?.sessionId;
+  if (!sessionId) {
+    respondError(id, INVALID_PARAMS_CODE, "missing sessionId in params");
+    return;
+  }
+  // A revival carries the same anchored `cwd` the original `session/new` did, and the bridge maps the
+  // field on BOTH methods.
+  const state = sessionState(sessionId);
+  state.cwd = declaredCwd(params);
+  state.context = params?._meta?.sfdk;
+  replaySessionTranscript(sessionId);
+  respondResult(id, { sessionId });
+}
+
+/**
+ * Unconditional on purpose: whether the command is still running is not knowable here without racing
+ * node's `waitpid`, and signalling an already-exited group is a no-op that still reaches exactly the
+ * orphaned grandchildren the post-exit sweep would have swept. Whether the turn ANSWERS cancelled is
+ * decided later from the command's observed exit shape, not from this flag.
+ */
+function handleSessionCancel(id, params) {
+  const sessionId = params?.sessionId;
+  const turn = sessions.get(sessionId)?.turn;
+  if (turn && turn.child) {
+    turn.cancelled = true;
+    terminateCommandTree(turn.child, turn, `cancel of ${sessionId}`);
+  }
+  if (isRoutable(id)) respondResult(id, {});
+}
+
+// The session's turn runs from its prompt's arrival until its answer is written.
+function releasePrompt(settlement) {
+  if (settlement.state.prompting === settlement) settlement.state.prompting = null;
+}
+
+async function handleSessionPrompt(id, params) {
+  const acpSessionId = params?.sessionId;
+  if (!acpSessionId) {
+    respondError(id, INVALID_PARAMS_CODE, "missing sessionId in params");
+    return;
+  }
+  const state = sessionState(acpSessionId);
+  // One prompt at a time per session: a second one run beside the first would execute the command twice
+  // at once, and overwriting `state.turn` would leave the first unreachable by a cancel.
+  if (state.prompting) {
+    respondError(id, TURN_RUNNING_CODE, `a turn is already running for session ${acpSessionId}`);
+    return;
+  }
+  // Carried through every path that can answer the turn, so exactly one answer is written per request.
+  const settlement = { state, settled: false };
+  state.prompting = settlement;
+  try {
+    await runPrompt(id, params, acpSessionId, state, settlement);
+  } finally {
+    releasePrompt(settlement);
+  }
+}
+
+async function runPrompt(id, params, acpSessionId, state, settlement) {
+  const { fail } = turnResponder(id, undefined, settlement);
+
+  const command = program;
+  const context = state.context;
+  const platformSessionId = context?.sessionId;
+  const organizationId = context?.organizationId;
+  const cwd = state.cwd;
+  if (programReadError || typeof command !== "string" || command.trim() === "") {
+    fail(programReadError || "agent.instructions is empty — the script runtime has nothing to execute");
+    return;
+  }
+  if (!context || Array.isArray(context) ||
+      ![platformSessionId, organizationId].every(value =>
+        typeof value === "string" && value.trim() !== "" && !/[\x00-\x1f\x7f-\x9f]/.test(value))) {
+    fail("handshake context requires nonblank sessionId and organizationId without control characters");
+    return;
+  }
+  try {
+    // A missing base URL must fail before execution; otherwise a retry can repeat unclaimed work.
+    agentApiBaseUrl();
+  } catch (error) {
+    fail(error.message);
+    return;
+  }
+
+  const turn = { child: null, cancelled: false, treeKilled: false, emittedBytes: 0, outputTruncated: false };
+  state.turn = turn;
+  let outcome;
+  try {
+    outcome = await runCommand({
+      acpSessionId,
+      command,
+      cwd,
+      organizationId,
+      promptText: promptTextOf(params),
+      turn,
+    });
+  } finally {
+    if (state.turn === turn) state.turn = null;
+  }
+
+  const { exitCode, signal, stdoutTail, stderrTail } = outcome;
+  const answerText = stdoutTail ? `exit ${exitCode}\n${stdoutTail}` : `exit ${exitCode}`;
+  // The accumulator already caps at STDERR_TAIL_ERROR, so this is the tail.
+  const errorData = { stderrTail };
+
+  // "Cancelled" is an observed FACT about the kill, never the arrival of the cancel message: deciding on
+  // the flag alone raced node's `waitpid` — a cancel dispatched between the script's `exit 0` and the
+  // reap failed a turn whose script had SUCCEEDED, with zero claims. Each OS supplies the
+  // reap-order-independent fact it can: on POSIX the EXIT SHAPE, since a signal-killed command reports
+  // `code === null, signal === "SIGTERM"`; on win32 the KILL's own answer, since `terminateCommandTree`
+  // sets `treeKilled` only after `GetExitCodeProcess` proved the shell was still running.
+  if (turn.cancelled && (signal || turn.treeKilled)) {
+    // A cancelled turn claims nothing.
+    turnResponder(id, errorData, settlement).fail(`script cancelled (${signal ?? `exit ${exitCode}`})`);
+    return;
+  }
+
+  try {
+    await claimPlatformState({
+      id,
+      settlement,
+      platformSessionId,
+      organizationId,
+      exitCode,
+      stderrTail,
+      answerText,
+      errorData,
+    });
+  } catch (error) {
+    turnResponder(id, errorData, settlement).fail(`platform claim failed: ${error.message}`);
+  }
+}
+
+/**
+ * Sets the flat outcome claim, which is the handled failure path too, so a non-zero exit still answers
+ * `end_turn`. A `409` is benign: the session has ended, and there is nothing left to claim.
+ */
+async function claimPlatformState({
+  id,
+  settlement,
+  platformSessionId,
+  organizationId,
+  exitCode,
+  stderrTail,
+  answerText,
+  errorData,
+}) {
+  const { succeed, fail } = turnResponder(id, errorData, settlement);
+
+  // On a machine the customer enrolled there is no edge of ours, so nothing authorizes a call to the
+  // platform's API and every claim here would come back refused — failing a turn whose script succeeded
+  // and whose answer is already on the session. The answer is then the whole of what the turn reports.
+  // Read off the worker's declaration and not off a missing edge stamp: a machine the platform launched
+  // can be missing that stamp too, and there the refusal is a deployment fault to surface rather than a
+  // turn to settle quietly.
+  if (machineIsEnrolled()) {
+    logDiagnostic(
+      `${MACHINE_ENROLLED} is set, so this machine is one the platform did not launch and nothing ` +
+        `authorizes its calls to the platform: this turn claims no session state and settles on its answer`,
+    );
+    succeed(answerText);
+    return;
+  }
+
+  const body =
+    exitCode === 0
+      ? { outcome: "ACHIEVED", summary: "exit 0" }
+      : { outcome: "FAILED", summary: `exit ${exitCode}: ${tail(stderrTail, STDERR_TAIL_SUMMARY)}` };
+  const sessionPath = `/sessions/${encodeURIComponent(platformSessionId)}`;
+  const response = await platformRequest("PATCH", sessionPath, organizationId, body);
+  if (!response.ok && response.status !== 409) {
+    fail(`claim rejected: ${response.status}`);
+    return;
+  }
+  succeed(answerText);
+}
+
+// Dispatch is fire-and-forget: a `session/prompt` awaits its command inside its own async task, so no
+// other session is head-of-line blocked.
+function isRoutable(id) {
+  return id !== undefined && id !== null;
+}
+
+async function dispatch(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return;
+  let message;
+  try {
+    message = JSON.parse(trimmed);
+  } catch (error) {
+    logDiagnostic(`ignoring a non-JSON stdin line: ${error.message}`);
+    return;
+  }
+  if (!message || typeof message !== "object" || typeof message.method !== "string") {
+    // A response to a request the harness never makes — nothing to do.
+    return;
+  }
+
+  const { id, method, params } = message;
+  // An id-less request is unroutable: its answer is dropped on the floor and the frame the harness wrote
+  // is noise on a pipe the bridge is scanning. So the guard is DISPATCH-WIDE, not per-method.
+  // `session/cancel` is the one method exempt by contract: it is legitimately a notification, and it
+  // answers only when addressed.
+  if (method !== "session/cancel" && !isRoutable(id)) {
+    logDiagnostic(`ignoring an id-less ${method} (its answer would be unroutable)`);
+    return;
+  }
+  try {
+    switch (method) {
+      case "initialize":
+        handleInitialize(id);
+        return;
+      case "session/new":
+        handleSessionNew(id, params);
+        return;
+      case "session/load":
+        handleSessionLoad(id, params);
+        return;
+      case "session/prompt":
+        await handleSessionPrompt(id, params);
+        return;
+      case "session/cancel":
+        handleSessionCancel(id, params);
+        return;
+      default:
+        respondError(id, METHOD_NOT_FOUND_CODE, `Unknown method: ${method}`);
+    }
+  } catch (error) {
+    logDiagnostic(`unhandled failure in ${method}: ${error.stack || error.message}`);
+    if (isRoutable(id)) {
+      respondError(id, INTERNAL_ERROR_CODE, `harness failure: ${error.message}`);
+    }
+  }
+}
+
+process.stdout.on("error", (error) => {
+  if (error.code === "EPIPE") process.exit(0);
+});
+
+const stdinLines = createInterface({ input: process.stdin });
+stdinLines.on("line", (line) => {
+  void dispatch(line);
+});
+stdinLines.on("close", () => {
+  process.exit(0);
+});

package/script-harness/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "software-factory-script-harness",
+  "type": "module",
+  "version": "0.0.134",
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  }
+}

package/worker.exe

@@ -0,0 +1,4 @@
+[diffend] Oversized file quarantined before diffing.
+name: package/worker.exe
+size: 47435776 bytes
+sha256: f602de147451548ffb03249c938febebe4586c1956b47ac7c3cab43b2188debb