@phnx-labs/agents-cli 1.22.112 → 1.22.114

package/dist/lib/session/parse.d.ts

@@ -71,17 +71,6 @@ export declare function parseClaude(filePath: string, opts?: ParseSessionOptions
 export declare function parseClaudeContent(content: string, opts?: ParseSessionOptions): SessionEvent[];
 /** Parse a Codex JSONL session file into normalized events. */
 export declare function parseCodex(filePath: string): SessionEvent[];
-/**
- * Extract target file path(s) from a Codex apply_patch envelope. The patch body
- * opens with `*** Begin Patch` and carries one or more file ops of the form
- * `*** Update File: <path>` / `*** Add File: <path>` / `*** Delete File: <path>`.
- * Returns every path in order (a multi-file patch emits multiple paths so
- * artifact discovery sees each file — RUSH-1410). Empty when unparseable.
- */
-export declare function applyPatchTargets(input: string): Array<{
-    path: string;
-    op: 'Add' | 'Update' | 'Delete';
-}>;
 export declare function applyPatchTargetPaths(input: string): string[];
 /**
  * Codex writes its turn TWICE in one rollout: the raw `response_item` records
@@ -119,14 +108,6 @@ export declare function parseGemini(filePath: string): SessionEvent[];
  * request step and a completion step that share the id).
  */
 export declare function parseAntigravity(dbPath: string): SessionEvent[];
-/**
- * Separator between a container file and the id it holds inside a *composite*
- * session `file_path`. Some harnesses keep every session in ONE file (OpenCode's
- * single `opencode.db`), so the index stores `<container>#<session-id>` rather
- * than one path per session — e.g.
- * `/home/u/.local/share/opencode/opencode.db#ses_02410a2c…`.
- */
-export declare const SESSION_FILE_PATH_SEP = "#";
 /**
  * Split a stored session `file_path` into its on-disk container and the optional
  * in-container fragment. For a plain per-session file the container is the path
@@ -179,7 +160,7 @@ export declare function sessionFilePathContainer(filePath: string): string;
  * session that committed / opened / merged a PR and to report a tool-failure
  * count the event stream cannot supply.
  */
-export interface GrokSessionSignals {
+interface GrokSessionSignals {
     gitCommitCount: number;
     prCreatedCount: number;
     prMergedCount: number;
@@ -232,18 +213,6 @@ export declare function parseOpenCode(filePath: string): SessionEvent[];
 export declare function parseOpencodeCloud(filePath: string): SessionEvent[];
 /** Parse a Rush JSONL session file into normalized events. */
 export declare function parseRush(filePath: string): SessionEvent[];
-/**
- * Muse Code session.jsonl → normalized events.
- *
- * Muse records an append-only event log. We map:
- *   - runtime.command_intake.received / turn_submit → user message
- *   - assistant_message_committed → assistant message
- *   - model_completed.usage → usage
- *   - tool-related events when present
- */
-export declare function parseMuse(filePath: string): SessionEvent[];
-/** Parse a Hermes session JSON file into normalized events. */
-export declare function parseHermes(filePath: string): SessionEvent[];
 /** Parse a Kimi session state.json file by reading its agents/main/wire.jsonl. */
 export declare function parseKimi(filePath: string): SessionEvent[];
 /** Parse Cursor's Anthropic-shaped message JSONL transcript. */

package/dist/lib/session/parse.js

@@ -609,7 +609,7 @@ export function parseCodex(filePath) {
  * Returns every path in order (a multi-file patch emits multiple paths so
  * artifact discovery sees each file — RUSH-1410). Empty when unparseable.
  */
-export function applyPatchTargets(input) {
+function applyPatchTargets(input) {
     const targets = [];
     const re = /^\*\*\* (Update|Add|Delete) File: (.+)$/gm;
     for (const m of input.matchAll(re)) {
@@ -1391,7 +1391,7 @@ export function parseAntigravity(dbPath) {
  * than one path per session — e.g.
  * `/home/u/.local/share/opencode/opencode.db#ses_02410a2c…`.
  */
-export const SESSION_FILE_PATH_SEP = '#';
+const SESSION_FILE_PATH_SEP = '#';
 /**
  * Split a stored session `file_path` into its on-disk container and the optional
  * in-container fragment. For a plain per-session file the container is the path
@@ -2086,7 +2086,7 @@ export function parseRush(filePath) {
  *   - model_completed.usage → usage
  *   - tool-related events when present
  */
-export function parseMuse(filePath) {
+function parseMuse(filePath) {
     const content = safeReadSessionFile(filePath);
     const lines = content.split('\n').filter((l) => l.trim());
     const events = [];
@@ -2166,7 +2166,7 @@ export function parseMuse(filePath) {
     return events;
 }
 /** Parse a Hermes session JSON file into normalized events. */
-export function parseHermes(filePath) {
+function parseHermes(filePath) {
     let session;
     try {
         session = JSON.parse(safeReadSessionFile(filePath));

package/dist/lib/session/pid-registry.d.ts

@@ -49,7 +49,17 @@ export interface PidSessionEntry {
      */
     tmuxPane?: string;
     startedAtMs: number;
+    /** Kernel provenance, captured by the writer; absent on legacy records. */
+    processIdentity?: {
+        bootId?: string;
+        pidNamespace?: string;
+        initStartTicks?: string;
+        startTicks?: string;
+        startTime?: string;
+    };
 }
+/** Read-only identity proof for exact joins. Unknown is never a positive match. */
+export declare function pidSessionEntryMatchesLiveProcess(entry: PidSessionEntry): boolean | undefined;
 export declare function isSessionIdShape(value: string): boolean;
 export declare function extractSessionIdArg(args: string[]): string | undefined;
 /**
@@ -76,6 +86,8 @@ export declare function sessionIdFromLivePid(pid: number): string | undefined;
 export declare function writePidSessionEntry(entry: PidSessionEntry): void;
 /** Look up a live pid's recorded session. Returns undefined if absent/corrupt. */
 export declare function readPidSessionEntry(pid: number): PidSessionEntry | undefined;
+/** Live consumers require identity proof; raw history is not a PID binding. */
+export declare function readLivePidSessionEntry(pid: number): PidSessionEntry | undefined;
 /**
  * Every recorded launch, one entry per live-or-dead pid. Used to index launches
  * by their `tmuxPane` so the authoritative tmux source can attribute a pane it did
@@ -87,9 +99,10 @@ export declare function listPidSessionEntries(): PidSessionEntry[];
 /**
  * Remove entries whose pid is no longer alive. Best-effort housekeeping.
  *
- * `isAlive` receives the entry's recorded `startedAtMs` so it can reject a pid
- * that a newer process recycled (a "zombie" registry entry), not just one that
- * no longer exists. An unreadable/corrupt entry falls back to the pid-only
- * check.
+ * Linux deletion requires the writer's boot and PID namespace to match our own
+ * trustworthy proc view. ESRCH in another namespace says nothing about the
+ * recorded process. Legacy/corrupt/unreadable ownership is unknown, never dead.
+ * Kernel start ticks reject PID reuse without wall-clock heuristics. Other
+ * platforms retain the caller's start-time check after checking kernel liveness.
  */
-export declare function prunePidSessionRegistry(isAlive: (pid: number, startedAtMs?: number) => boolean): void;
+export declare function prunePidSessionRegistry(isAlive?: (pid: number, startedAtMs?: number) => boolean | undefined): void;

package/dist/lib/session/pid-registry.js

@@ -19,7 +19,69 @@
 import fs from 'fs';
 import path from 'path';
 import { execFileSync } from 'child_process';
+import { hostProcessView, writerProcessView } from './process-view.js';
 import { getTerminalsDir } from '../state.js';
+import { atomicWriteFileSync, withFileLock } from '../fs-atomic.js';
+function linuxStartTicks(pid) {
+    try {
+        const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+        // comm (field 2) may contain spaces or parentheses; starttime is field 22.
+        const value = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+        return value && /^\d+$/.test(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function pidExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ESRCH')
+            return false;
+        if (code === 'EPERM')
+            return true;
+        return undefined;
+    }
+}
+function darwinStartTime(pid) {
+    try {
+        return execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'] }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read-only identity proof for exact joins. Unknown is never a positive match. */
+export function pidSessionEntryMatchesLiveProcess(entry) {
+    if (!Number.isInteger(entry.pid) || entry.pid < 1)
+        return undefined;
+    if (process.platform === 'darwin') {
+        const exists = pidExists(entry.pid);
+        if (exists !== true)
+            return exists;
+        const start = darwinStartTime(entry.pid);
+        return start && entry.processIdentity?.startTime ? start === entry.processIdentity.startTime : undefined;
+    }
+    if (process.platform !== 'linux')
+        return undefined;
+    const scope = hostProcessView();
+    if (!scope || entry.processIdentity?.bootId !== scope.bootId
+        || entry.processIdentity?.pidNamespace !== scope.pidNamespace
+        || entry.processIdentity?.initStartTicks !== scope.initStartTicks)
+        return undefined;
+    const exists = pidExists(entry.pid);
+    if (exists !== true)
+        return exists;
+    const start = linuxStartTicks(entry.pid);
+    const recordedStart = entry.processIdentity?.startTicks;
+    if (!start || typeof recordedStart !== 'string' || !/^\d+$/.test(recordedStart))
+        return undefined;
+    return start === recordedStart;
+}
 /**
  * Pull an explicit `--session-id <uuid>` (or `--session-id=<uuid>`) out of a
  * raw agent arg vector. The transparent shim forwards args untouched, but when
@@ -106,13 +168,46 @@ function pidRegistryDir() {
 function entryPath(pid) {
     return path.join(pidRegistryDir(), `${pid}.json`);
 }
+// The deployed SessionStart hook reconstructs by-pid entries from an allowlist.
+// Keep launcher ownership separately, bound to the immutable launch coordinates.
+function ownershipPath(pid) {
+    return path.join(getTerminalsDir(), 'by-pid-ownership', `${pid}.json`);
+}
+function persistOwnership(entry) {
+    fs.mkdirSync(path.dirname(ownershipPath(entry.pid)), { recursive: true });
+    atomicWriteFileSync(ownershipPath(entry.pid), JSON.stringify(entry), 'utf8');
+}
+function restoreOwnership(entry) {
+    if (entry.processIdentity)
+        return entry;
+    try {
+        const owner = JSON.parse(fs.readFileSync(ownershipPath(entry.pid), 'utf8'));
+        if (owner.pid === entry.pid && owner.launchId === entry.launchId && owner.startedAtMs === entry.startedAtMs) {
+            return { ...entry, processIdentity: owner.processIdentity };
+        }
+    }
+    catch { /* legacy launch */ }
+    return entry;
+}
 /** Record a launched agent process. Never throws — the registry is an optimization. */
 export function writePidSessionEntry(entry) {
-    if (!entry.pid || entry.pid < 1)
+    if (!Number.isInteger(entry.pid) || entry.pid < 1)
         return;
     try {
+        const scope = process.platform === 'linux' ? writerProcessView() : undefined;
+        if (process.platform === 'linux' && !scope)
+            return;
         fs.mkdirSync(pidRegistryDir(), { recursive: true });
-        fs.writeFileSync(entryPath(entry.pid), JSON.stringify(entry), 'utf8');
+        const processIdentity = scope?.bootId && scope.pidNamespace ? { bootId: scope.bootId, pidNamespace: scope.pidNamespace, initStartTicks: scope.initStartTicks, startTicks: linuxStartTicks(entry.pid) }
+            : process.platform === 'darwin' ? { startTime: darwinStartTime(entry.pid) } : undefined;
+        const file = entryPath(entry.pid);
+        withFileLock(file, () => {
+            // The host writer owns numeric PID slots. Old-boot and legacy records
+            // must not reserve a recycled slot; restricted namespaces never get here.
+            const owned = { ...entry, processIdentity };
+            persistOwnership(owned);
+            atomicWriteFileSync(file, JSON.stringify(owned), 'utf8');
+        }, { realpath: false, acquireTimeoutMs: 0 });
     }
     catch {
         /* degrade to the newest-jsonl heuristic */
@@ -129,8 +224,8 @@ export function readPidSessionEntry(pid) {
     }
     try {
         const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object' && typeof parsed.pid === 'number') {
-            return parsed;
+        if (parsed && typeof parsed === 'object' && parsed.pid === pid) {
+            return restoreOwnership(parsed);
         }
     }
     catch {
@@ -138,6 +233,32 @@ export function readPidSessionEntry(pid) {
     }
     return undefined;
 }
+/** Live consumers require identity proof; raw history is not a PID binding. */
+export function readLivePidSessionEntry(pid) {
+    const entry = readPidSessionEntry(pid);
+    if (!entry || !hostProcessView())
+        return undefined;
+    if (process.platform === 'win32')
+        return pidExists(pid) === true ? entry : undefined;
+    if (!entry.processIdentity && pidExists(pid) === true) {
+        // Upgrade a native legacy launch only after the home namespace is proven,
+        // and the actual process start excludes a recycled PID. Hook timestamps may
+        // be later than process start, but cannot predate this process incarnation.
+        const start = darwinStartTime(pid);
+        const startMs = start ? Date.parse(start) : NaN;
+        if (Number.isFinite(startMs) && entry.startedAtMs >= startMs - 1000 && entry.startedAtMs <= Date.now()) {
+            const scope = hostProcessView();
+            entry.processIdentity = process.platform === 'linux'
+                ? { ...scope, startTicks: linuxStartTicks(pid) }
+                : { startTime: start };
+            try {
+                persistOwnership(entry);
+            }
+            catch { /* read remains useful */ }
+        }
+    }
+    return pidSessionEntryMatchesLiveProcess(entry) === true ? entry : undefined;
+}
 /**
  * Every recorded launch, one entry per live-or-dead pid. Used to index launches
  * by their `tmuxPane` so the authoritative tmux source can attribute a pane it did
@@ -158,7 +279,7 @@ export function listPidSessionEntries() {
         try {
             const parsed = JSON.parse(fs.readFileSync(path.join(pidRegistryDir(), f), 'utf8'));
             if (parsed && typeof parsed === 'object' && typeof parsed.pid === 'number') {
-                out.push(parsed);
+                out.push(restoreOwnership(parsed));
             }
         }
         catch {
@@ -170,10 +291,11 @@ export function listPidSessionEntries() {
 /**
  * Remove entries whose pid is no longer alive. Best-effort housekeeping.
  *
- * `isAlive` receives the entry's recorded `startedAtMs` so it can reject a pid
- * that a newer process recycled (a "zombie" registry entry), not just one that
- * no longer exists. An unreadable/corrupt entry falls back to the pid-only
- * check.
+ * Linux deletion requires the writer's boot and PID namespace to match our own
+ * trustworthy proc view. ESRCH in another namespace says nothing about the
+ * recorded process. Legacy/corrupt/unreadable ownership is unknown, never dead.
+ * Kernel start ticks reject PID reuse without wall-clock heuristics. Other
+ * platforms retain the caller's start-time check after checking kernel liveness.
  */
 export function prunePidSessionRegistry(isAlive) {
     let files;
@@ -183,23 +305,48 @@ export function prunePidSessionRegistry(isAlive) {
     catch {
         return;
     }
+    const scope = process.platform === 'linux' ? hostProcessView() : undefined;
     for (const f of files) {
         const pid = Number(f.slice(0, -'.json'.length));
-        if (!Number.isInteger(pid))
+        if (!Number.isInteger(pid) || pid < 1)
             continue;
-        let startedAtMs;
+        let raw;
+        let entry;
         try {
-            const parsed = JSON.parse(fs.readFileSync(path.join(pidRegistryDir(), f), 'utf8'));
-            if (typeof parsed?.startedAtMs === 'number')
-                startedAtMs = parsed.startedAtMs;
+            raw = fs.readFileSync(path.join(pidRegistryDir(), f), 'utf8');
+            entry = restoreOwnership(JSON.parse(raw));
+            if (entry?.pid !== pid)
+                continue;
         }
         catch {
-            /* unreadable/corrupt — fall back to the pid-only liveness check */
+            continue;
         }
-        if (isAlive(pid, startedAtMs))
+        if (process.platform === 'linux' && (!scope
+            || entry.processIdentity?.bootId !== scope.bootId
+            || entry.processIdentity?.pidNamespace !== scope.pidNamespace
+            || entry.processIdentity?.initStartTicks !== scope.initStartTicks))
+            continue;
+        const exists = pidExists(pid);
+        if (exists === undefined)
             continue;
+        if (exists) {
+            if (process.platform === 'linux') {
+                const start = linuxStartTicks(pid);
+                const recordedStart = entry.processIdentity?.startTicks;
+                if (!start || typeof recordedStart !== 'string' || !/^\d+$/.test(recordedStart) || start === recordedStart)
+                    continue;
+            }
+            else if (!isAlive || isAlive(pid, entry.startedAtMs) !== false)
+                continue;
+        }
         try {
-            fs.unlinkSync(path.join(pidRegistryDir(), f));
+            const file = path.join(pidRegistryDir(), f);
+            // Share the writer's lock so comparison and deletion cannot remove a
+            // successor published after the liveness check.
+            withFileLock(file, () => {
+                if (fs.readFileSync(file, 'utf8') === raw)
+                    fs.unlinkSync(file);
+            }, { realpath: false, acquireTimeoutMs: 0 });
         }
         catch {
             /* raced with another writer/pruner */

package/dist/lib/session/presence.d.ts

@@ -44,7 +44,7 @@ export declare function loadPresence(dir?: string): Record<string, PresenceRecor
 export declare function savePresence(map: Record<string, PresenceRecord>, dir?: string): void;
 /** The subset of an `ActiveSession` the presence adapter reads (structural, so
  *  this module doesn't import the heavy active-session graph). */
-export interface ActiveSessionLike {
+interface ActiveSessionLike {
     sessionId?: string;
     kind: string;
     /** 'terminal' (interactive) | 'headless' | 'teams' | 'cloud' | ... */
@@ -83,3 +83,4 @@ export declare function reconcilePresence(prev: Record<string, PresenceRecord>,
     next: Record<string, PresenceRecord>;
     transitions: PresenceTransition[];
 };
+export {};

package/dist/lib/session/process-view.d.ts

@@ -0,0 +1,25 @@
+export interface HostProcessView {
+    bootId?: string;
+    pidNamespace?: string;
+    /** Namespace inodes can be reused within one boot; its init identifies the incarnation. */
+    initStartTicks?: string;
+    ownerPid?: number;
+    ownerStartTicks?: string;
+}
+/** Measure the calling process, never infer authority from a process name. */
+export declare function currentProcessView(): HostProcessView | undefined;
+/** Read-only ownership check. Observing a HOME never claims or migrates it. */
+export declare function hostProcessView(): HostProcessView | undefined;
+/** Explicit writers may enroll a fresh HOME in their measured namespace.
+ * Foreign ownership remains protected even when the prior writer is invisible.
+ * The initial host may enroll legacy state before daemon startup. */
+export declare function writerProcessView(): HostProcessView | undefined;
+/** Preflight BEFORE even the PID-keyed legacy lifecycle lock is inspected.
+ * The same decision is repeated under that lock before daemon state changes. */
+export declare function daemonProcessViewAllowed(): boolean;
+/** Called by the canonical daemon writer before lifecycle mutation.
+ * This is a writer statement, not an observer's guess about a numeric PID.
+ * Existing same-boot ownership cannot be taken over from another namespace. */
+export declare function recordDaemonProcessView(): void;
+export declare function requireHostProcessView(): void;
+export declare function requireWriterProcessView(): void;

package/dist/lib/session/process-view.js

@@ -0,0 +1,176 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { getCacheDir, getTerminalsDir, getDaemonDir } from '../state.js';
+import { atomicWriteFileSync, withFileLock } from '../fs-atomic.js';
+// Linux UAPI PID_NS_INIT_INO (include/uapi/linux/nsfs.h; previously
+// PROC_PID_INIT_INO in include/linux/proc_ns.h). This is a kernel-defined
+// namespace identity, independent of PID 1's executable or command name.
+function isInitialPidNamespace(view) {
+    return view.pidNamespace === 'pid:[4026531836]';
+}
+function sameProcessView(owner, view) {
+    return owner.bootId === view.bootId && owner.pidNamespace === view.pidNamespace
+        && owner.initStartTicks === view.initStartTicks;
+}
+/** Authenticate the legacy singleton with kernel socket credentials. A host
+ * daemon invisible in a nested namespace has peer PID 0, never a colliding PID.
+ * No socket/PID/command-name guess grants migration authority. */
+function verifiedLegacyDaemon() {
+    try {
+        execFileSync('python3', ['-c', `import os,socket,struct,sys
+s=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
+s.settimeout(0.2)
+s.connect(sys.argv[1])
+pid,uid,gid=struct.unpack('3i',s.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+assert pid>0 and uid==os.getuid()
+assert pid==int(open(sys.argv[2]).read().strip())
+assert os.readlink('/proc/%d/ns/pid'%pid)==os.readlink('/proc/self/ns/pid')
+`, path.join(getCacheDir(), 'helpers', 'browser', 'browser.sock'), path.join(getDaemonDir(), 'daemon.pid')], {
+            stdio: 'ignore', timeout: 1000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function hasLegacyState() {
+    return [path.join(getTerminalsDir(), 'by-pid'), path.join(getCacheDir(), 'state', 'sessions')]
+        .some(dir => fs.existsSync(dir) && fs.readdirSync(dir).length > 0)
+        // Health/log output records attempted starts, not ownership. The ordinary
+        // start path writes health.json BEFORE spawning its first daemon.
+        || ['daemon.pid', 'daemon.lifetime', 'heartbeat.json'].some(file => fs.existsSync(path.join(getDaemonDir(), file)))
+        || fs.existsSync(path.join(getCacheDir(), 'helpers', 'browser', 'browser.sock'))
+        || ['.active-sessions.json', '.active-session-immutable.json'].some(file => fs.existsSync(path.join(getCacheDir(), file)));
+}
+/** Measure the calling process, never infer authority from a process name. */
+export function currentProcessView() {
+    if (process.platform !== 'linux')
+        return {};
+    try {
+        if (Number(fs.readFileSync('/proc/self/stat', 'utf8').split(' ', 1)[0]) !== process.pid)
+            return undefined;
+        const bootId = fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+        const pidNamespace = fs.readlinkSync('/proc/self/ns/pid');
+        // NSpid is relative to the procfs mount. Multiple coordinates mean this
+        // mount exposes an ancestor namespace, even if numeric PIDs happen to match.
+        const procPids = fs.readFileSync('/proc/self/status', 'utf8').match(/^NSpid:\s+([^\n]+)$/m)?.[1].trim().split(/\s+/);
+        if (procPids?.length !== 1 || Number(procPids[0]) !== process.pid)
+            return undefined;
+        const initStat = fs.readFileSync('/proc/1/stat', 'utf8');
+        const initStartTicks = initStat.slice(initStat.lastIndexOf(')') + 2).split(' ')[19];
+        const stat = fs.readFileSync('/proc/self/stat', 'utf8');
+        const ownerStartTicks = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+        return bootId && pidNamespace && /^\d+$/.test(initStartTicks) && /^\d+$/.test(ownerStartTicks)
+            ? { bootId, pidNamespace, initStartTicks, ownerPid: process.pid, ownerStartTicks } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read-only ownership check. Observing a HOME never claims or migrates it. */
+export function hostProcessView() {
+    const view = currentProcessView();
+    if (!view || process.platform !== 'linux')
+        return view;
+    try {
+        const owner = JSON.parse(fs.readFileSync(path.join(getTerminalsDir(), 'process-view.json'), 'utf8'));
+        return sameProcessView(owner, view) ? view : undefined;
+    }
+    catch (error) {
+        // The initial kernel namespace is authoritative before any daemon has
+        // enrolled this HOME. This observation itself must remain read-only.
+        return error.code === 'ENOENT' && isInitialPidNamespace(view) ? view : undefined;
+    }
+}
+/** Explicit writers may enroll a fresh HOME in their measured namespace.
+ * Foreign ownership remains protected even when the prior writer is invisible.
+ * The initial host may enroll legacy state before daemon startup. */
+export function writerProcessView() {
+    const view = currentProcessView();
+    if (!view || process.platform !== 'linux')
+        return view;
+    const file = path.join(getTerminalsDir(), 'process-view.json');
+    try {
+        if (fs.existsSync(file)) {
+            const owner = JSON.parse(fs.readFileSync(file, 'utf8'));
+            return sameProcessView(owner, view) ? view : undefined;
+        }
+        // A foreign observer of legacy state must not even create a directory or
+        // claim lock. Repeat this preflight under the lock before enrollment.
+        if (hasLegacyState() && !isInitialPidNamespace(view))
+            return undefined;
+        fs.mkdirSync(getTerminalsDir(), { recursive: true });
+        return withFileLock(file, () => {
+            if (fs.existsSync(file)) {
+                const owner = JSON.parse(fs.readFileSync(file, 'utf8'));
+                return sameProcessView(owner, view) ? view : undefined;
+            }
+            // Unowned nonempty registry is not evidence this caller owns the host.
+            if (hasLegacyState() && !isInitialPidNamespace(view))
+                return undefined;
+            atomicWriteFileSync(file, JSON.stringify(view), 'utf8');
+            return view;
+        }, { realpath: false, acquireTimeoutMs: 0 });
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Preflight BEFORE even the PID-keyed legacy lifecycle lock is inspected.
+ * The same decision is repeated under that lock before daemon state changes. */
+export function daemonProcessViewAllowed() {
+    const view = currentProcessView();
+    if (!view)
+        return false;
+    if (process.platform !== 'linux')
+        return true;
+    try {
+        const file = path.join(getTerminalsDir(), 'process-view.json');
+        if (!fs.existsSync(file))
+            return !hasLegacyState() || isInitialPidNamespace(view) || verifiedLegacyDaemon();
+        const owner = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (sameProcessView(owner, view))
+            return true;
+        return typeof owner.bootId === 'string' && !!owner.bootId && owner.bootId !== view.bootId
+            && (isInitialPidNamespace(view) || verifiedLegacyDaemon());
+    }
+    catch {
+        return false;
+    }
+}
+/** Called by the canonical daemon writer before lifecycle mutation.
+ * This is a writer statement, not an observer's guess about a numeric PID.
+ * Existing same-boot ownership cannot be taken over from another namespace. */
+export function recordDaemonProcessView() {
+    const view = currentProcessView();
+    if (!view)
+        throw new Error('Cannot record daemon ownership from an incoherent process namespace');
+    if (process.platform !== 'linux')
+        return;
+    const file = path.join(getTerminalsDir(), 'process-view.json');
+    fs.mkdirSync(getTerminalsDir(), { recursive: true });
+    withFileLock(file, () => {
+        if (fs.existsSync(file)) {
+            const owner = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (sameProcessView(owner, view))
+                return;
+            if (typeof owner.bootId !== 'string' || !owner.bootId || owner.bootId === view.bootId || (!isInitialPidNamespace(view) && !verifiedLegacyDaemon())) {
+                throw new Error('Another or unverified process namespace owns host session state; automatic reuse of a private-container HOME across namespaces is unsupported. Run in the owning namespace or use a fresh HOME.');
+            }
+        }
+        else if (hasLegacyState() && !isInitialPidNamespace(view) && !verifiedLegacyDaemon()) {
+            throw new Error('Legacy session state requires a verified live canonical daemon before namespace migration');
+        }
+        atomicWriteFileSync(file, JSON.stringify(view), 'utf8');
+    }, { realpath: false, acquireTimeoutMs: 0 });
+}
+export function requireHostProcessView() {
+    if (!hostProcessView())
+        throw new Error('Host session state is unavailable in this process namespace; read the host daemon snapshot or run sessions on the host.');
+}
+export function requireWriterProcessView() {
+    if (!writerProcessView())
+        throw new Error('Host session state is unavailable in this process namespace; run the writer in its owning namespace or use a fresh HOME. Automatic reuse of a private-container HOME across namespaces is unsupported.');
+}

package/dist/lib/session/projection.d.ts

@@ -0,0 +1,13 @@
+import type { SessionWatchEnvelope, SessionWatchRow } from './watch.js';
+/** Device observations are not sessions: a launcher may observe a peer's run.
+ * Keep those observations separately and publish execution-owned state once. */
+export declare class SessionProjection {
+    private readonly observations;
+    private projected;
+    private selected;
+    private sequence;
+    private readonly streamId;
+    /** Only the selected observation may publish execution-owned attention. */
+    rowForObservation(scope: string, rowKey: string): SessionWatchRow | undefined;
+    apply(event: SessionWatchEnvelope): SessionWatchEnvelope[];
+}