@platless/axom-cli 0.3.13 → 0.5.9

package/dist/keepers/acp/keeper.mjs

@@ -0,0 +1,3083 @@
+import { createRequire as __axomKeeperCreateRequire } from 'node:module';
+const require = __axomKeeperCreateRequire(import.meta.url);
+
+// src/workstation/keepers/kit/bootstrap.ts
+import { readFileSync, unlinkSync as unlinkSync2 } from "node:fs";
+
+// src/workstation/keepers/kit/launchConfig.ts
+var decodeLaunchConfig = (encoded) => JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+
+// src/workstation/keepers/kit/lock.ts
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { promises as fs } from "node:fs";
+var MAX_MANIFEST_BYTES = 4096;
+function pidAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var readProcCmdline = (pid) => fs.readFile(`/proc/${pid}/cmdline`);
+var PS_TIMEOUT_MS = 2e3;
+function processCommandFromPs(pid) {
+  return new Promise((resolve) => execFile("ps", ["-ww", "-p", String(pid), "-o", "command="], { timeout: PS_TIMEOUT_MS }, (error, stdout) => {
+    if (!error) {
+      resolve(stdout.trim());
+      return;
+    }
+    resolve(error.code === 1 ? "" : null);
+  }));
+}
+async function processCommand(pid, deps = {}) {
+  if ((deps.platform ?? process.platform) !== "linux") return processCommandFromPs(pid);
+  const read = deps.readCmdline ?? readProcCmdline;
+  try {
+    return (await read(pid)).toString("utf8").split("\0").filter((part) => part.length > 0).join(" ");
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ESRCH") return null;
+    try {
+      await read("self");
+      return "";
+    } catch {
+      return null;
+    }
+  }
+}
+async function manifestProcessLive(manifest) {
+  if (!pidAlive(manifest.pid)) return false;
+  const command = await processCommand(manifest.pid);
+  return command === null ? true : command.includes(manifest.bundleDir);
+}
+async function writePidManifest(pidFile, manifest) {
+  const temp = `${pidFile}.${randomUUID()}.tmp`;
+  await fs.writeFile(temp, JSON.stringify(manifest), { mode: 384 });
+  await fs.rename(temp, pidFile);
+}
+function validManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const m = value;
+  return (m.kind === "terminal" || m.kind === "acp") && typeof m.gen === "string" && typeof m.buildVersion === "string" && typeof m.bundleDir === "string" && typeof m.identity === "string" && Number.isFinite(m.startedAt) && Number.isSafeInteger(m.pid);
+}
+async function readPidManifest(pidFile) {
+  try {
+    const stat = await fs.lstat(pidFile);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_MANIFEST_BYTES) throw new Error("Invalid keeper PID manifest");
+    const value = JSON.parse(await fs.readFile(pidFile, "utf8"));
+    if (!validManifest(value)) throw new Error("Invalid keeper PID manifest");
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+// src/workstation/keepers/kit/server.ts
+import { randomBytes, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { promises as fs2, renameSync, unlinkSync } from "node:fs";
+import net from "node:net";
+
+// src/workstation/keepers/kit/activity.ts
+var MAX_ACTIVITY_ITEMS = 32;
+var MAX_ACTIVITY_STRING = 256;
+var RESERVED_METRIC_PREFIX = "kit.";
+var DEFAULT_SAMPLE_TIMEOUT_MS = 2e3;
+var validItem = (value) => {
+  if (typeof value !== "object" || value === null) return false;
+  const item = value;
+  return typeof item.type === "string" && typeof item.id === "string" && typeof item.label === "string" && typeof item.state === "string" && typeof item.sinceEpochMs === "number" && Number.isFinite(item.sinceEpochMs);
+};
+var clip = (value) => value.length > MAX_ACTIVITY_STRING ? value.slice(0, MAX_ACTIVITY_STRING) : value;
+var pending = /* @__PURE__ */ new WeakMap();
+async function runSampler(sampler, timeoutMs) {
+  let timer;
+  let sample = pending.get(sampler);
+  if (!sample) {
+    const started = Promise.resolve().then(sampler);
+    sample = started;
+    pending.set(sampler, started);
+    const release = () => {
+      if (pending.get(sampler) === started) pending.delete(sampler);
+    };
+    started.then(release, release);
+  }
+  try {
+    return await Promise.race([
+      sample,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("activity sampler timed out")), timeoutMs);
+        timer.unref();
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function sampleActivity(samplers, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_SAMPLE_TIMEOUT_MS;
+  const settled = await Promise.allSettled(samplers.map((sampler) => runSampler(sampler, timeoutMs)));
+  const metrics = {};
+  const items = [];
+  let errors = 0;
+  let omitted = 0;
+  let reserved = 0;
+  for (const result of settled) {
+    if (result.status === "rejected") {
+      errors += 1;
+      try {
+        options.onError?.(result.reason);
+      } catch {
+      }
+      continue;
+    }
+    const part = result.value;
+    if (typeof part !== "object" || part === null) continue;
+    if (typeof part.metrics === "object" && part.metrics !== null) {
+      for (const [name, value] of Object.entries(part.metrics)) {
+        if (typeof value !== "number" || !Number.isFinite(value)) continue;
+        if (name.startsWith(RESERVED_METRIC_PREFIX)) {
+          reserved += 1;
+          continue;
+        }
+        metrics[name] = (metrics[name] ?? 0) + value;
+      }
+    }
+    if (Array.isArray(part.items)) {
+      for (const item of part.items) {
+        if (!validItem(item)) continue;
+        if (items.length < MAX_ACTIVITY_ITEMS) {
+          const kept = { type: clip(item.type), id: clip(item.id), label: clip(item.label), state: clip(item.state), sinceEpochMs: item.sinceEpochMs };
+          if (typeof item.jobId === "string" && item.jobId) kept.jobId = clip(item.jobId);
+          items.push(kept);
+        } else omitted += 1;
+      }
+    }
+  }
+  if (errors > 0) metrics["kit.sampleErrors"] = errors;
+  if (omitted > 0) metrics["kit.itemsOmitted"] = omitted;
+  if (reserved > 0) metrics["kit.reservedDropped"] = reserved;
+  return { metrics, items };
+}
+
+// src/workstation/keepers/kit/ipc.ts
+var FrameError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "FrameError";
+  }
+  code;
+};
+var NEWLINE = 10;
+var LineDecoder = class {
+  constructor(maxBytes) {
+    this.maxBytes = maxBytes;
+  }
+  maxBytes;
+  chunks = [];
+  pending = 0;
+  /** Changes the cap for lines not yet completed (used once a peer has authenticated). */
+  setMax(maxBytes) {
+    this.maxBytes = maxBytes;
+  }
+  /** Bytes of an incomplete trailing line currently buffered. */
+  get buffered() {
+    return this.pending;
+  }
+  push(chunk) {
+    const lines = [];
+    let start = 0;
+    for (; ; ) {
+      const newline = chunk.indexOf(NEWLINE, start);
+      if (newline < 0) break;
+      const tail = chunk.subarray(start, newline);
+      const length = this.pending + tail.length;
+      if (length > this.maxBytes) throw new FrameError(`Frame exceeds ${this.maxBytes} bytes`, "too_large");
+      lines.push(this.chunks.length === 0 ? Buffer.from(tail) : Buffer.concat([...this.chunks, tail], length));
+      this.chunks = [];
+      this.pending = 0;
+      start = newline + 1;
+    }
+    if (start < chunk.length) {
+      const rest = chunk.subarray(start);
+      if (this.pending + rest.length > this.maxBytes) throw new FrameError(`Frame exceeds ${this.maxBytes} bytes`, "too_large");
+      this.chunks.push(Buffer.from(rest));
+      this.pending += rest.length;
+    }
+    return lines;
+  }
+};
+function encodeFrame(frame) {
+  const body = Buffer.from(JSON.stringify(frame), "utf8");
+  return { data: Buffer.concat([body, Buffer.from("\n")]), length: body.length };
+}
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isId = (value) => Number.isSafeInteger(value) && value >= 0;
+var malformed = (what) => {
+  throw new FrameError(`Malformed frame: ${what}`, "malformed");
+};
+function parseJsonObject(line) {
+  let value;
+  try {
+    value = JSON.parse(line.toString("utf8"));
+  } catch {
+    return malformed("not JSON");
+  }
+  return isRecord(value) ? value : malformed("not an object");
+}
+function parseServerBound(line) {
+  const frame = parseJsonObject(line);
+  if (frame.t === "req") {
+    if (!isId(frame.id)) malformed("req id");
+    if (typeof frame.method !== "string" || frame.method.length === 0 || frame.method.length > 128) malformed("req method");
+    if (frame.params !== void 0 && !isRecord(frame.params)) malformed("req params");
+    return frame;
+  }
+  if (frame.t === "credit") {
+    if (typeof frame.stream !== "string" || frame.stream.length === 0) malformed("credit stream");
+    if (!Number.isSafeInteger(frame.n) || frame.n <= 0) malformed("credit n");
+    if (frame.bytes !== void 0 && (!Number.isSafeInteger(frame.bytes) || frame.bytes < 0)) malformed("credit bytes");
+    return frame;
+  }
+  return malformed("unexpected frame type");
+}
+
+// src/workstation/keepers/kit/protocol.ts
+var FRAME_LIMITS = {
+  terminal: { in: 128 * 1024, out: 2 * 1024 * 1024 },
+  acp: { in: 32 * 1024 * 1024, out: 32 * 1024 * 1024 }
+};
+var UNKNOWN_KIND_LIMITS = { in: 1024 * 1024, out: 1024 * 1024 };
+var frameLimitsOf = (kind) => kind ? FRAME_LIMITS[kind] : UNKNOWN_KIND_LIMITS;
+var MAX_CONNECTIONS = 32;
+var PRE_HELLO_MAX_BYTES = 64 * 1024;
+var MAX_EVT_RECORDS = 256;
+function isProtocolWindow(value) {
+  return Array.isArray(value) && value.length === 2 && Number.isSafeInteger(value[0]) && Number.isSafeInteger(value[1]) && value[0] >= 0 && value[0] <= value[1];
+}
+var ErrorCode = {
+  badRequest: "bad_request",
+  unauthenticated: "unauthenticated",
+  badToken: "bad_token",
+  unknownMethod: "unknown_method",
+  unknownStream: "unknown_stream",
+  frameTooLarge: "frame_too_large",
+  /** A method that starts new work was called on a keeper that is draining or stopping. */
+  draining: "draining",
+  internal: "internal"
+};
+var KeeperMethodError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "KeeperMethodError";
+  }
+  code;
+};
+
+// src/workstation/keepers/kit/server.ts
+var GENERIC = /* @__PURE__ */ new Set(["keeper.hello", "keeper.ping", "keeper.info", "keeper.activity", "keeper.drain", "keeper.stop", "keeper.subscribe", "keeper.unsubscribe"]);
+var MAX_CREDIT = 1e9;
+var MAX_CREDIT_BYTES = Number.MAX_SAFE_INTEGER;
+var wireError = (code, message) => ({ code, message });
+var Subscription = class {
+  constructor(connection, stream, source, from, credit, creditBytes) {
+    this.connection = connection;
+    this.stream = stream;
+    this.source = source;
+    this.next = from;
+    this.credit = credit;
+    this.byteWindowed = creditBytes !== void 0;
+    this.byteCredit = creditBytes ?? Number.POSITIVE_INFINITY;
+    this.unwatch = source.watch(() => this.kick());
+  }
+  connection;
+  stream;
+  source;
+  credit;
+  /** Bytes the subscriber may still be sent; `Infinity` on a subscription without a byte window. */
+  byteCredit;
+  byteWindowed;
+  next;
+  pumping = false;
+  dirty = false;
+  closed = false;
+  started = false;
+  unwatch;
+  /** Begins pushing. Called after the subscribe reply is written so no `evt` can overtake its `res`. */
+  start() {
+    this.started = true;
+    this.kick();
+  }
+  grant(n, bytes) {
+    this.credit = Math.min(MAX_CREDIT, this.credit + n);
+    if (this.byteWindowed && bytes !== void 0) this.byteCredit = Math.min(MAX_CREDIT_BYTES, this.byteCredit + bytes);
+    this.kick();
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.unwatch();
+  }
+  kick() {
+    this.dirty = true;
+    if (this.started && !this.pumping && !this.closed) void this.pump();
+  }
+  async pump() {
+    this.pumping = true;
+    try {
+      while (this.dirty && !this.closed) {
+        this.dirty = false;
+        while (!this.closed && this.credit > 0 && this.byteCredit > 0) {
+          if (!await this.connection.writable()) return;
+          const limit = Math.min(this.credit, MAX_EVT_RECORDS);
+          const records = await (this.byteWindowed ? this.source.read(this.next, limit, { maxBytes: this.byteCredit }) : this.source.read(this.next, limit));
+          if (this.closed || records.length === 0) break;
+          const { batch, bytes } = this.fit(records);
+          if (batch.length === 0) {
+            this.end("record_too_large");
+            return;
+          }
+          this.next = batch[batch.length - 1].o + 1;
+          this.credit -= batch.length;
+          if (this.byteWindowed) this.byteCredit -= bytes;
+          this.connection.send({ t: "evt", stream: this.stream, records: batch, ...this.byteWindowed ? { bytes } : {} });
+        }
+      }
+    } catch {
+      this.end("source_error");
+    } finally {
+      this.pumping = false;
+    }
+  }
+  /** Longest prefix of `records` whose evt frame stays under the outbound cap, and its size (each record's JSON line). */
+  fit(records) {
+    const budget = this.connection.limits.out - 256 - this.stream.length * 2;
+    let used = 0;
+    let count = 0;
+    for (const record of records) {
+      const size = Buffer.byteLength(JSON.stringify(record)) + 1;
+      if (used + size > budget) break;
+      used += size;
+      count += 1;
+    }
+    return { batch: records.slice(0, count), bytes: used };
+  }
+  end(reason) {
+    this.close();
+    this.connection.removeSubscription(this.stream, this);
+    this.connection.send({ t: "evt", stream: this.stream, records: [], closed: reason });
+  }
+};
+var Connection = class {
+  constructor(server, socket, unauthenticatedTimeoutMs) {
+    this.server = server;
+    this.socket = socket;
+    this.limits = frameLimitsOf(server.options.kind);
+    this.decoder = new LineDecoder(Math.min(PRE_HELLO_MAX_BYTES, this.limits.in));
+    socket.on("data", (chunk) => this.onData(chunk));
+    socket.on("error", () => this.destroy());
+    socket.on("close", () => this.destroy());
+    socket.on("drain", () => this.wake());
+    this.authTimer = setTimeout(() => {
+      if (!this.authenticated) this.destroy();
+    }, unauthenticatedTimeoutMs);
+    this.authTimer.unref();
+  }
+  server;
+  socket;
+  id = randomUUID2();
+  limits;
+  authenticated = false;
+  decoder;
+  subscriptions = /* @__PURE__ */ new Map();
+  dead = false;
+  authTimer;
+  drainWaiters = [];
+  get isDead() {
+    return this.dead;
+  }
+  pendingAnswers = 0;
+  /** No `res` frame of this connection is still waiting to leave the socket. Pushed `evt` data does not count: a stalled subscriber must not hold up a stop. */
+  get flushed() {
+    return this.dead || this.pendingAnswers === 0;
+  }
+  destroy() {
+    if (this.dead) return;
+    this.dead = true;
+    clearTimeout(this.authTimer);
+    for (const sub of this.subscriptions.values()) sub.close();
+    this.subscriptions.clear();
+    this.socket.destroy();
+    this.wake();
+    this.server.forget(this);
+  }
+  wake() {
+    const waiters = this.drainWaiters;
+    this.drainWaiters = [];
+    for (const w of waiters) w();
+  }
+  /** Resolves true when the socket can take more data, false when the connection died meanwhile. */
+  async writable() {
+    while (!this.dead && this.socket.writableNeedDrain) await new Promise((resolve) => this.drainWaiters.push(resolve));
+    return !this.dead;
+  }
+  /** Writes one frame. An oversized `res` is replaced by an error answer so the request still completes. */
+  send(frame, then) {
+    if (this.dead) return;
+    let encoded;
+    try {
+      encoded = encodeFrame(frame);
+    } catch {
+      encoded = frame.t === "res" ? encodeFrame({ t: "res", id: frame.id, ok: false, error: wireError(ErrorCode.internal, "Result is not serialisable") }) : encodeFrame({ t: "evt", stream: frame.stream, records: [], closed: "source_error" });
+    }
+    if (encoded.length > this.limits.out) {
+      if (frame.t !== "res") return;
+      encoded = encodeFrame({ t: "res", id: frame.id, ok: false, error: wireError(ErrorCode.frameTooLarge, `Response exceeds ${this.limits.out} bytes`) });
+    }
+    if (frame.t === "res") {
+      this.pendingAnswers += 1;
+      this.socket.write(encoded.data, () => {
+        this.pendingAnswers -= 1;
+        then?.();
+      });
+    } else this.socket.write(encoded.data);
+  }
+  removeSubscription(stream, sub) {
+    if (this.subscriptions.get(stream) === sub) this.subscriptions.delete(stream);
+  }
+  starts = [];
+  subscribe(stream, source, from, credit, creditBytes) {
+    this.subscriptions.get(stream)?.close();
+    const sub = new Subscription(this, stream, source, from, credit, creditBytes);
+    this.subscriptions.set(stream, sub);
+    this.starts.push(sub);
+  }
+  discardStarts() {
+    const starts = this.starts;
+    this.starts = [];
+    for (const sub of starts) this.unsubscribeIf(sub);
+  }
+  unsubscribeIf(sub) {
+    if (this.subscriptions.get(sub.stream) === sub) {
+      sub.close();
+      this.subscriptions.delete(sub.stream);
+    }
+  }
+  startSubscriptions() {
+    const starts = this.starts;
+    this.starts = [];
+    for (const sub of starts) if (this.subscriptions.get(sub.stream) === sub) sub.start();
+  }
+  unsubscribe(stream) {
+    const sub = this.subscriptions.get(stream);
+    if (!sub) return false;
+    sub.close();
+    this.subscriptions.delete(stream);
+    return true;
+  }
+  onData(chunk) {
+    let lines;
+    try {
+      lines = this.decoder.push(chunk);
+    } catch {
+      this.protocolViolation();
+      return;
+    }
+    for (const line of lines) {
+      if (this.dead) return;
+      let frame;
+      try {
+        frame = parseServerBound(line);
+      } catch {
+        this.protocolViolation();
+        return;
+      }
+      this.dispatch(frame);
+    }
+  }
+  /** A malformed or oversized frame ends this connection (and only this one). */
+  protocolViolation() {
+    this.destroy();
+  }
+  dispatch(frame) {
+    if (frame.t === "credit") {
+      if (!this.authenticated) {
+        this.destroy();
+        return;
+      }
+      this.subscriptions.get(frame.stream)?.grant(frame.n, frame.bytes);
+      return;
+    }
+    const reply = (ok, payload, then) => this.send(ok ? { t: "res", id: frame.id, ok: true, result: payload } : { t: "res", id: frame.id, ok: false, error: payload }, then);
+    const fail = (code, message, then) => reply(false, wireError(code, message), then);
+    const { method } = frame;
+    const params = frame.params ?? {};
+    if (method === "keeper.hello") {
+      const token = typeof params.token === "string" ? Buffer.from(params.token) : Buffer.alloc(0);
+      const expected = Buffer.from(this.server.token);
+      if (token.length !== expected.length || !timingSafeEqual(token, expected)) {
+        fail(ErrorCode.badToken, "Invalid keeper token", () => this.destroy());
+        return;
+      }
+      if (!isProtocolWindow(params.daemonProtocol)) {
+        fail(ErrorCode.badRequest, "daemonProtocol must be [min, max]");
+        return;
+      }
+      this.authenticated = true;
+      clearTimeout(this.authTimer);
+      this.decoder.setMax(this.limits.in);
+      reply(true, this.server.hello());
+      return;
+    }
+    if (!this.authenticated && method !== "keeper.ping") {
+      fail(ErrorCode.unauthenticated, "keeper.hello required");
+      return;
+    }
+    const context = {
+      connection: { id: this.id },
+      subscribe: (stream, source, from, credit, creditBytes) => this.subscribe(stream, source, from, credit, creditBytes),
+      unsubscribe: (stream) => {
+        this.unsubscribe(stream);
+      }
+    };
+    void (async () => {
+      try {
+        const result = GENERIC.has(method) ? await this.server.generic(method, params, context, () => reply(true, {}, () => this.server.stopped(params.mode))) : await this.server.callHandler(method, params, context);
+        if (result !== NOT_REPLIED) reply(true, result);
+        this.startSubscriptions();
+      } catch (error) {
+        this.discardStarts();
+        if (error instanceof KeeperMethodError) fail(error.code, error.message);
+        else fail(ErrorCode.internal, error instanceof Error ? error.message : String(error));
+      }
+    })();
+  }
+};
+var NOT_REPLIED = /* @__PURE__ */ Symbol("replied");
+var KeeperServer = class {
+  options;
+  startedAt = Date.now();
+  handlers = /* @__PURE__ */ new Map();
+  streamResolver;
+  connections = /* @__PURE__ */ new Set();
+  net = net.createServer((socket) => this.accept(socket));
+  tokenValue = "";
+  drainingFlag = false;
+  startsWork = /* @__PURE__ */ new Set();
+  samplers = [];
+  inFlightCount = 0;
+  stopState;
+  constructor(options) {
+    this.options = options;
+    if (options.activity) this.samplers.push(options.activity);
+    this.net.on("error", () => {
+    });
+  }
+  get token() {
+    return this.tokenValue;
+  }
+  get connectionCount() {
+    return this.connections.size;
+  }
+  /** Connections that passed `keeper.hello` (a daemon, not a stray probe). */
+  get authenticatedConnectionCount() {
+    let count = 0;
+    for (const connection of this.connections) if (connection.authenticated) count += 1;
+    return count;
+  }
+  get draining() {
+    return this.drainingFlag;
+  }
+  /** Domain requests currently running (the `keeper.*` methods are not counted). */
+  get inFlight() {
+    return this.inFlightCount;
+  }
+  /** Registers a domain method. The `keeper.*` namespace belongs to the kit. */
+  register(method, handler, options = {}) {
+    if (method.startsWith("keeper.")) throw new Error(`The keeper.* namespace is reserved: ${method}`);
+    if (this.handlers.has(method)) throw new Error(`Method already registered: ${method}`);
+    this.handlers.set(method, handler);
+    if (options.startsWork) this.startsWork.add(method);
+  }
+  /** Adds a source for `keeper.activity`. Each sample asks every sampler afresh; nothing is accumulated. */
+  addActivitySampler(sampler) {
+    this.samplers.push(sampler);
+  }
+  report(error) {
+    try {
+      this.options.onError?.(error);
+    } catch {
+    }
+  }
+  /** Stops accepting new work (methods registered with `startsWork`). Everything else keeps working. Idempotent. */
+  drain() {
+    if (this.drainingFlag) return;
+    this.drainingFlag = true;
+    try {
+      this.options.onDrain?.();
+    } catch (error) {
+      this.report(error);
+    }
+  }
+  /** How `keeper.subscribe{stream}` finds its source. */
+  setStreamResolver(resolver) {
+    this.streamResolver = resolver;
+  }
+  hello() {
+    const o = this.options;
+    return { kind: o.kind, protocolVersion: o.protocolVersion, buildVersion: o.buildVersion, gen: o.gen, pid: process.pid, startedAt: this.startedAt, capabilities: [...o.capabilities ?? []] };
+  }
+  /**
+   * Generates a fresh 32-byte token and listens on the 0600 socket. The token reaches `run/<gen>/token` (0600, atomic rename)
+   * only once this process actually owns the socket, before any connection is served: a second start for the same generation
+   * that fails with EADDRINUSE must leave the live keeper's token file alone.
+   */
+  async listen() {
+    const token = randomBytes(32).toString("hex");
+    const temp = `${this.options.tokenFile}.${randomUUID2()}.tmp`;
+    await fs2.writeFile(temp, token, { mode: 384 });
+    try {
+      await new Promise((resolve, reject) => {
+        const failed = (error) => reject(error);
+        this.net.once("error", failed);
+        this.net.listen(this.options.socket, () => {
+          this.net.off("error", failed);
+          try {
+            renameSync(temp, this.options.tokenFile);
+            this.tokenValue = token;
+            resolve();
+          } catch (error) {
+            this.net.close();
+            reject(error);
+          }
+        });
+      });
+    } catch (error) {
+      try {
+        unlinkSync(temp);
+      } catch {
+      }
+      throw error;
+    }
+    await fs2.chmod(this.options.socket, 384);
+  }
+  async close() {
+    for (const connection of [...this.connections]) connection.destroy();
+    if (!this.net.listening) return;
+    await new Promise((resolve) => this.net.close(() => resolve()));
+  }
+  forget(connection) {
+    this.connections.delete(connection);
+  }
+  accept(socket) {
+    if (this.connections.size >= (this.options.maxConnections ?? MAX_CONNECTIONS)) {
+      socket.destroy();
+      return;
+    }
+    this.connections.add(new Connection(this, socket, this.options.unauthenticatedTimeoutMs ?? 1e4));
+  }
+  async callHandler(method, params, context) {
+    const handler = this.handlers.get(method);
+    if (!handler) throw new KeeperMethodError(ErrorCode.unknownMethod, `Unknown method: ${method}`);
+    if (this.drainingFlag && this.startsWork.has(method)) throw new KeeperMethodError(ErrorCode.draining, `Keeper is draining; ${method} starts new work`);
+    this.inFlightCount += 1;
+    try {
+      return await handler(params, context);
+    } finally {
+      this.inFlightCount -= 1;
+    }
+  }
+  /**
+   * `keeper.stop` was accepted (before its reply is written): from now on `info.stopping` is set and new work is refused (both modes:
+   * a force stop's onStop may still be tearing things down, and no `startsWork` call may slip in meanwhile).
+   * A force request upgrades a pending graceful one.
+   */
+  beginStop(mode) {
+    if (!this.stopState) this.stopState = { mode };
+    else if (mode === "force") this.stopState.mode = "force";
+    this.drain();
+  }
+  /**
+   * The stop reply has been written. Graceful: wait until no request is in flight and every answer has left its socket, bounded by
+   * `stopGraceMs`, then stop (also when the grace ran out). Force: stop now, even over a pending graceful stop. The stop happens once.
+   */
+  stopped(mode) {
+    this.beginStop(mode);
+    const state = this.stopState;
+    if (state.finish) {
+      if (state.mode === "force") state.finish();
+      return;
+    }
+    let done = false;
+    let timer;
+    let poll;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      clearTimeout(poll);
+      try {
+        if (this.options.onStop) this.options.onStop(state.mode);
+        else {
+          for (const connection of [...this.connections]) connection.destroy();
+          if (this.net.listening) this.net.close();
+          this.options.exit?.(0);
+        }
+      } catch (error) {
+        this.report(error);
+        this.stopState = void 0;
+      }
+    };
+    state.finish = finish;
+    if (state.mode === "force") {
+      finish();
+      return;
+    }
+    timer = setTimeout(finish, this.options.stopGraceMs ?? 3e3);
+    timer.unref();
+    const check = () => {
+      if (done) return;
+      if (this.inFlightCount === 0 && [...this.connections].every((c) => c.flushed)) {
+        finish();
+        return;
+      }
+      poll = setTimeout(check, 10);
+    };
+    check();
+  }
+  async generic(method, params, context, replyStop) {
+    const o = this.options;
+    switch (method) {
+      case "keeper.ping":
+        return { pid: process.pid, identity: o.identity, gen: o.gen, kind: o.kind, buildVersion: o.buildVersion, protocolVersion: o.protocolVersion };
+      case "keeper.info":
+        return { ...this.hello(), identity: o.identity, draining: this.drainingFlag, stopping: this.stopState?.mode ?? null, inFlight: this.inFlightCount, connections: this.connections.size, uptimeMs: Date.now() - this.startedAt };
+      case "keeper.activity":
+        return sampleActivity(this.samplers, { timeoutMs: o.activityTimeoutMs, onError: (error) => this.report(error) });
+      case "keeper.drain":
+        this.drain();
+        return { draining: true };
+      case "keeper.stop": {
+        if (params.mode !== "graceful" && params.mode !== "force") throw new KeeperMethodError(ErrorCode.badRequest, "mode must be graceful or force");
+        this.beginStop(params.mode);
+        replyStop();
+        return NOT_REPLIED;
+      }
+      case "keeper.subscribe": {
+        const { stream, creditBytes } = params;
+        const from = params.from ?? 0;
+        const credit = params.credit ?? 0;
+        if (typeof stream !== "string" || !stream || !Number.isSafeInteger(from) || from < 0 || !Number.isSafeInteger(credit) || credit < 0)
+          throw new KeeperMethodError(ErrorCode.badRequest, "subscribe needs stream, from >= 0 and credit >= 0");
+        if (creditBytes !== void 0 && (!Number.isSafeInteger(creditBytes) || creditBytes <= 0))
+          throw new KeeperMethodError(ErrorCode.badRequest, "creditBytes must be a positive integer");
+        const source = await this.streamResolver?.(stream);
+        if (!source) throw new KeeperMethodError(ErrorCode.unknownStream, `Unknown stream: ${stream}`);
+        context.subscribe(stream, source, from, Math.min(credit, MAX_CREDIT), creditBytes);
+        return { stream, from };
+      }
+      case "keeper.unsubscribe": {
+        if (typeof params.stream !== "string") throw new KeeperMethodError(ErrorCode.badRequest, "unsubscribe needs stream");
+        context.unsubscribe(params.stream);
+        return {};
+      }
+      default:
+        throw new KeeperMethodError(ErrorCode.unknownMethod, `Unknown method: ${method}`);
+    }
+  }
+};
+
+// src/workstation/keepers/kit/bootstrap.ts
+var STRING_FIELDS = ["identity", "gen", "unit", "buildVersion", "bundleDir", "runDir", "dataDir", "socket", "pidFile", "tokenFile"];
+function readLaunchConfig(argv, kind) {
+  const encoded = argv[2];
+  if (!encoded) throw new Error("Missing keeper launch config argument");
+  let config;
+  try {
+    config = decodeLaunchConfig(encoded);
+  } catch {
+    throw new Error("Unreadable keeper launch config");
+  }
+  if (typeof config !== "object" || config === null) throw new Error("Unreadable keeper launch config");
+  if (config.kind !== kind) throw new Error(`Launch config is for keeper kind ${String(config.kind)}, not ${kind}`);
+  for (const field of STRING_FIELDS) if (typeof config[field] !== "string" || !config[field]) throw new Error(`Launch config lacks ${field}`);
+  if (!Number.isInteger(config.umask) || config.umask < 0 || config.umask > 511) throw new Error("Launch config lacks umask");
+  return config;
+}
+var defaultLog = (kind) => (line) => {
+  try {
+    process.stderr.write(`${(/* @__PURE__ */ new Date()).toISOString()} keeper-${kind}: ${line}
+`);
+  } catch {
+  }
+};
+var unlinkIf = (file, owned) => {
+  try {
+    if (owned()) unlinkSync2(file);
+  } catch {
+  }
+};
+async function bootstrapKeeper(options) {
+  const log = options.log ?? defaultLog(options.kind);
+  const exit = options.exit ?? ((code) => process.exit(code));
+  const report = (error) => log(error instanceof Error ? error.stack ?? error.message : String(error));
+  const hooks = options.processHooks !== false;
+  const config = readLaunchConfig(options.argv ?? process.argv, options.kind);
+  const ownsManifest = () => {
+    try {
+      return JSON.parse(readFileSync(config.pidFile, "utf8")).pid === process.pid;
+    } catch {
+      return false;
+    }
+  };
+  if (hooks) {
+    process.umask(config.umask);
+    try {
+      process.chdir(config.runDir);
+    } catch (error) {
+      report(error);
+    }
+    process.on("uncaughtException", (error) => report(error));
+    process.on("unhandledRejection", (error) => report(error));
+    process.on("SIGHUP", () => {
+    });
+  }
+  const previous = await readPidManifest(config.pidFile).catch(() => null);
+  if (previous && previous.pid !== process.pid && previous.identity === config.identity && previous.gen === config.gen && await manifestProcessLive(previous))
+    throw new Error(`Keeper ${options.kind} ${config.gen} already runs as pid ${previous.pid}`);
+  await writePidManifest(config.pidFile, {
+    kind: config.kind,
+    gen: config.gen,
+    buildVersion: config.buildVersion,
+    bundleDir: config.bundleDir,
+    startedAt: Date.now(),
+    identity: config.identity,
+    pid: process.pid
+  });
+  let finishStop;
+  const stopped = new Promise((resolve) => {
+    finishStop = resolve;
+  });
+  let module;
+  let server;
+  let token = "";
+  let stopping = false;
+  const onStop = (mode) => {
+    if (stopping) return;
+    stopping = true;
+    void (async () => {
+      try {
+        if (module?.shutdown) {
+          let timer;
+          await Promise.race([
+            Promise.resolve().then(() => module.shutdown(mode)),
+            new Promise((resolve) => {
+              timer = setTimeout(resolve, options.shutdownTimeoutMs ?? 5e3);
+              timer.unref();
+            })
+          ]).catch(report).finally(() => clearTimeout(timer));
+        }
+      } finally {
+        unlinkIf(config.pidFile, ownsManifest);
+        unlinkIf(config.tokenFile, () => token !== "" && readFileSync(config.tokenFile, "utf8") === token);
+        await server.close().catch(report);
+        finishStop();
+        exit(0);
+      }
+    })();
+  };
+  try {
+    module = await options.create(config, { log });
+    server = new KeeperServer({
+      kind: options.kind,
+      identity: config.identity,
+      gen: config.gen,
+      buildVersion: config.buildVersion,
+      protocolVersion: options.protocolVersion,
+      socket: config.socket,
+      tokenFile: config.tokenFile,
+      capabilities: module.capabilities ?? [],
+      onError: report,
+      onStop,
+      ...options.server
+    });
+    module.install(server);
+    const umask = hooks ? process.umask(63) : void 0;
+    try {
+      await server.listen();
+    } finally {
+      if (umask !== void 0) process.umask(umask);
+    }
+    token = server.token;
+  } catch (error) {
+    unlinkIf(config.pidFile, ownsManifest);
+    try {
+      await module?.shutdown?.("force");
+    } catch (shutdownError) {
+      report(shutdownError);
+    }
+    throw error;
+  }
+  const stop = (mode) => server.stopped(mode);
+  if (hooks) {
+    process.on("SIGTERM", () => stop("graceful"));
+    process.on("SIGINT", () => stop("graceful"));
+  }
+  log(`listening (pid ${process.pid}, build ${config.buildVersion.slice(0, 12)}, protocol ${options.protocolVersion})`);
+  return { config, server, stop, stopped };
+}
+async function runKeeperMain(options) {
+  try {
+    return await bootstrapKeeper(options);
+  } catch (error) {
+    (options.log ?? defaultLog(options.kind))(`start failed: ${error instanceof Error ? error.message : String(error)}`);
+    (options.exit ?? ((code) => process.exit(code)))(1);
+    return void 0;
+  }
+}
+
+// src/workstation/keepers/acp/host.ts
+import { createHash } from "node:crypto";
+import { closeSync as closeSync4, existsSync, fsyncSync as fsyncSync2, mkdirSync as mkdirSync2, openSync as openSync4, renameSync as renameSync4, rmSync as rmSync2, statfs, writeSync as writeSync3 } from "node:fs";
+import path4 from "node:path";
+
+// src/workstation/keepers/kit/streamLog.ts
+import {
+  chmodSync,
+  closeSync,
+  fstatSync,
+  fsync,
+  fsyncSync,
+  ftruncateSync,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync2,
+  readSync,
+  readdirSync,
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync3,
+  writeSync
+} from "node:fs";
+import path from "node:path";
+var SEGMENT_BYTES = 8 * 1024 * 1024;
+var SOFT_QUOTA_BYTES = 256 * 1024 * 1024;
+var FSYNC_INTERVAL_MS = 100;
+var FSYNC_BYTES = 64 * 1024;
+var IMMEDIATE_KINDS = ["spawn", "exit", "checkpoint", "commit"];
+var INDEX_STRIDE = 64;
+var CHUNK_BYTES = 1024 * 1024;
+var SUBSCRIBE_BATCH = 256;
+var SEGMENT_NAME = /^seg-(\d+)\.log$/;
+var CHECKPOINT_NAME = /^checkpoint-(\d+)\.json$/;
+var META_FILE = "meta.json";
+var KEPT_CHECKPOINTS = 2;
+var StreamCorruptError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "StreamCorruptError";
+  }
+};
+var openStreams = /* @__PURE__ */ new Set();
+function fsyncDirectory(dir) {
+  let fd;
+  try {
+    fd = openSync(dir, "r");
+    fsyncSync(fd);
+  } catch {
+  } finally {
+    if (fd !== void 0) try {
+      closeSync(fd);
+    } catch {
+    }
+  }
+}
+function writeAll(fd, data) {
+  let written = 0;
+  while (written < data.length) written += writeSync(fd, data, written, data.length - written);
+}
+function atomicWrite(file, content) {
+  const temp = `${file}.tmp`;
+  const fd = openSync(temp, "w", 384);
+  try {
+    writeAll(fd, Buffer.from(content));
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync2(temp, file);
+  fsyncDirectory(path.dirname(file));
+}
+function scanLines(fd, start, end, onLine) {
+  const chunk = Buffer.allocUnsafe(Math.min(CHUNK_BYTES, Math.max(1, end - start)));
+  let pos = start;
+  let lineStart = start;
+  let carry = [];
+  while (pos < end) {
+    const n = readSync(fd, chunk, 0, Math.min(chunk.length, end - pos), pos);
+    if (n <= 0) break;
+    const view = chunk.subarray(0, n);
+    let from = 0;
+    for (; ; ) {
+      const nl = view.indexOf(10, from);
+      if (nl < 0) break;
+      let line;
+      if (carry.length > 0) {
+        carry.push(chunk.subarray(from, nl));
+        line = Buffer.concat(carry);
+        carry = [];
+      } else line = chunk.subarray(from, nl);
+      if (onLine(line, lineStart) === false) return lineStart;
+      lineStart = pos + nl + 1;
+      from = nl + 1;
+    }
+    if (from < n) carry.push(Buffer.from(chunk.subarray(from, n)));
+    pos += n;
+  }
+  return lineStart;
+}
+function parseRecord(line) {
+  try {
+    const value = JSON.parse(line.toString("utf8"));
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const r = value;
+      if (Number.isSafeInteger(r.o) && typeof r.k === "string" && typeof r.t === "number") return r;
+    }
+  } catch {
+  }
+  return void 0;
+}
+var StreamLog = class _StreamLog {
+  /** Bytes dropped from the newest segment's end when the log was opened (a torn tail); 0 for a clean open. */
+  repairedBytes;
+  dir;
+  segmentBytes;
+  softQuota;
+  fsyncIntervalMs;
+  fsyncBytes;
+  immediate;
+  now;
+  syncFile;
+  onError;
+  segments = [];
+  active;
+  nextOffset = 0;
+  committedOffset = -1;
+  tail;
+  checkpointSeq = 0;
+  checkpointOffset = -1;
+  totalBytes = 0;
+  /** Bytes ever appended / bytes known durable (by a completed fsync). The difference is what a crash could still lose. */
+  appendedBytes = 0;
+  syncedBytes = 0;
+  syncTimer;
+  syncCount = 0;
+  syncErrors = 0;
+  lastSyncError;
+  /** The one background fsync (batched appends never fsync on the event loop); `again` = more bytes arrived meanwhile. */
+  inflight;
+  closed = false;
+  notifyPending = false;
+  watchers = /* @__PURE__ */ new Set();
+  static open(options) {
+    return new _StreamLog(options);
+  }
+  constructor(options) {
+    this.dir = path.resolve(options.dir);
+    this.segmentBytes = options.segmentBytes ?? SEGMENT_BYTES;
+    this.softQuota = options.softQuotaBytes ?? SOFT_QUOTA_BYTES;
+    this.fsyncIntervalMs = options.fsyncIntervalMs ?? FSYNC_INTERVAL_MS;
+    this.fsyncBytes = options.fsyncBytes ?? FSYNC_BYTES;
+    this.immediate = new Set(options.immediateKinds ?? IMMEDIATE_KINDS);
+    this.now = options.now ?? Date.now;
+    this.onError = options.onError;
+    this.syncFile = options.syncFile ?? fsyncSync;
+    if (options.baseOffset !== void 0 && (!Number.isSafeInteger(options.baseOffset) || options.baseOffset < 0))
+      throw new RangeError(`Invalid baseOffset ${options.baseOffset}`);
+    if (openStreams.has(this.dir)) throw new Error(`Stream log already open in this process: ${this.dir}`);
+    mkdirSync(this.dir, { recursive: true, mode: 448 });
+    chmodSync(this.dir, 448);
+    openStreams.add(this.dir);
+    let repaired = 0;
+    try {
+      repaired = this.recover(options.baseOffset);
+      if (repaired > 0) this.append({ k: "discontinuity", reason: "torn-tail", droppedBytes: repaired }, { sync: true });
+    } catch (error) {
+      this.closed = true;
+      this.closeActive();
+      if (this.syncTimer) clearTimeout(this.syncTimer);
+      openStreams.delete(this.dir);
+      throw error;
+    }
+    this.repairedBytes = repaired;
+  }
+  // ---- recovery ----------------------------------------------------------------------------------------------
+  recover(baseOffset) {
+    const names = readdirSync(this.dir);
+    if (baseOffset !== void 0 && baseOffset > 0 && !names.some((n) => SEGMENT_NAME.test(n) || n === META_FILE)) {
+      atomicWrite(path.join(this.dir, META_FILE), JSON.stringify({ v: 1, committed: baseOffset - 1, t: this.now() }));
+      names.push(META_FILE);
+    }
+    for (const name of names) if (name.endsWith(".tmp")) try {
+      unlinkSync3(path.join(this.dir, name));
+    } catch {
+    }
+    const firsts = names.map((n) => SEGMENT_NAME.exec(n)).filter((m) => !!m).map((m) => Number(m[1])).sort((a, b) => a - b);
+    for (let i = 0; i < firsts.length; i++) {
+      const file = path.join(this.dir, `seg-${firsts[i]}.log`);
+      const bytes = fstatSizeOf(file);
+      const count = i + 1 < firsts.length ? firsts[i + 1] - firsts[i] : 0;
+      this.segments.push({ first: firsts[i], file, bytes, count, idx: [], indexed: false });
+    }
+    let meta = {};
+    try {
+      meta = JSON.parse(readFileSync2(path.join(this.dir, META_FILE), "utf8"));
+    } catch {
+    }
+    this.committedOffset = Number.isSafeInteger(meta.committed) ? meta.committed : -1;
+    this.tail = meta.tail;
+    let repaired = 0;
+    const newest = this.segments[this.segments.length - 1];
+    if (newest) repaired = this.repairNewest(newest);
+    const firstRetained = this.segments[0]?.first;
+    if (firstRetained !== void 0) this.committedOffset = Math.max(this.committedOffset, firstRetained - 1);
+    this.nextOffset = newest ? newest.first + newest.count : 0;
+    this.nextOffset = Math.max(this.nextOffset, this.committedOffset + 1);
+    this.totalBytes = this.segments.reduce((sum, s) => sum + s.bytes, 0);
+    this.deleteCommittedSegments();
+    const last = this.segments[this.segments.length - 1];
+    if (last && last.first + last.count === this.nextOffset) {
+      const fd = openSync(last.file, "a", 384);
+      this.active = { seg: last, fd };
+    }
+    const checkpoints = this.checkpointFiles();
+    if (checkpoints.length > 0) this.checkpointSeq = checkpoints[checkpoints.length - 1].seq;
+    this.checkpointOffset = this.latestCheckpoint()?.offset ?? -1;
+    return repaired;
+  }
+  /** Scans the newest segment: counts and indexes its records and truncates anything after the last intact one. */
+  repairNewest(seg) {
+    const fd = openSync(seg.file, "r+", 384);
+    try {
+      let expected = seg.first;
+      let good = 0;
+      const idx = [];
+      const size = fstatSync(fd).size;
+      scanLines(fd, 0, size, (line, pos) => {
+        const record = parseRecord(line);
+        if (!record || record.o !== expected) return false;
+        if ((expected - seg.first) % INDEX_STRIDE === 0) idx.push(pos);
+        expected++;
+        good = pos + line.length + 1;
+        return true;
+      });
+      let dropped = 0;
+      if (good < size) {
+        dropped = size - good;
+        ftruncateSync(fd, good);
+        fsyncSync(fd);
+      }
+      seg.bytes = good;
+      seg.count = expected - seg.first;
+      seg.idx = idx;
+      seg.indexed = true;
+      return dropped;
+    } finally {
+      closeSync(fd);
+    }
+  }
+  deleteCommittedSegments() {
+    let removed = false;
+    while (this.segments.length > 0) {
+      const seg = this.segments[0];
+      if (seg.first + seg.count - 1 > this.committedOffset) break;
+      if (this.active?.seg === seg) {
+        this.retireFd(this.active.fd);
+        this.active = void 0;
+      }
+      try {
+        unlinkSync3(seg.file);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      this.totalBytes -= seg.bytes;
+      this.segments.shift();
+      removed = true;
+    }
+    if (removed) fsyncDirectory(this.dir);
+  }
+  // ---- append ------------------------------------------------------------------------------------------------
+  /**
+   * Appends one record (stamping `o` and `t`) and returns it.
+   *
+   * Durability: ordinary records are fsynced in the background (at most one fsync in flight; started when 64 KiB are
+   * unsynced or 100 ms after the first unsynced append) and never block the caller. Records of an immediate kind
+   * (spawn/exit/checkpoint/commit by default) or appended with `sync: true` are fsynced synchronously before returning.
+   * Once the line is written the append has succeeded: if that synchronous fsync then fails, the record IS in the log
+   * (a retry would duplicate it), so the error is reported through `onError` and `stats().syncErrors`/`lastSyncError`
+   * instead of being thrown, and the record stays counted as unsynced. Only a failure to write the line itself throws.
+   */
+  append(input, options = {}) {
+    this.assertOpen();
+    if (typeof input.k !== "string" || input.k === "") throw new TypeError("A stream record needs a non-empty kind `k`");
+    if ("o" in input || "t" in input) throw new TypeError("`o` and `t` are stamped by the stream log");
+    const { k, ...rest } = input;
+    const record = { o: this.nextOffset, t: this.now(), k, ...rest };
+    const line = Buffer.from(`${JSON.stringify(record)}
+`);
+    let target = this.active;
+    if (target && target.seg.bytes > 0 && target.seg.bytes + line.length > this.segmentBytes) {
+      this.sealActive();
+      target = void 0;
+    }
+    if (!target) target = this.startSegment(record.o);
+    try {
+      writeAll(target.fd, line);
+    } catch (error) {
+      try {
+        ftruncateSync(target.fd, target.seg.bytes);
+      } catch {
+      }
+      throw error;
+    }
+    const seg = target.seg;
+    if (seg.count % INDEX_STRIDE === 0) seg.idx.push(seg.bytes);
+    seg.bytes += line.length;
+    seg.count++;
+    this.totalBytes += line.length;
+    this.nextOffset++;
+    this.appendedBytes += line.length;
+    this.scheduleNotify();
+    if (options.sync || this.immediate.has(k)) {
+      try {
+        this.sync();
+      } catch (error) {
+        this.reportSyncError(error);
+      }
+    } else if (this.appendedBytes - this.syncedBytes >= this.fsyncBytes) this.startBackgroundSync();
+    else if (!this.syncTimer && !this.inflight) {
+      this.syncTimer = setTimeout(() => {
+        this.syncTimer = void 0;
+        this.startBackgroundSync();
+      }, this.fsyncIntervalMs);
+      this.syncTimer.unref();
+    }
+    return record;
+  }
+  reportSyncError(error) {
+    this.syncErrors++;
+    this.lastSyncError = error instanceof Error ? error : new Error(String(error));
+    this.onError?.(this.lastSyncError);
+  }
+  /** Starts the single background fsync of the active segment, or asks the running one to go again when it finishes. */
+  startBackgroundSync() {
+    if (this.closed || !this.active) return;
+    if (this.inflight) {
+      this.inflight.again = true;
+      return;
+    }
+    if (this.appendedBytes === this.syncedBytes) return;
+    const flight = { fd: this.active.fd, covers: this.appendedBytes, again: false, closeAfter: false };
+    this.inflight = flight;
+    fsync(flight.fd, (error) => {
+      this.inflight = void 0;
+      if (flight.closeAfter) {
+        try {
+          closeSync(flight.fd);
+        } catch {
+        }
+      }
+      if (error) {
+        if (!flight.closeAfter) this.reportSyncError(error);
+        return;
+      }
+      this.syncCount++;
+      this.syncedBytes = Math.max(this.syncedBytes, flight.covers);
+      if (this.closed) return;
+      if (flight.again || this.appendedBytes - this.syncedBytes >= this.fsyncBytes) this.startBackgroundSync();
+      else if (this.appendedBytes > this.syncedBytes && !this.syncTimer) {
+        this.syncTimer = setTimeout(() => {
+          this.syncTimer = void 0;
+          this.startBackgroundSync();
+        }, this.fsyncIntervalMs);
+        this.syncTimer.unref();
+      }
+    });
+  }
+  /** Closes `fd`, or hands it to the in-flight fsync to close when that completes (never close under a running fsync). */
+  retireFd(fd) {
+    if (this.inflight?.fd === fd) {
+      this.inflight.closeAfter = true;
+      return;
+    }
+    try {
+      closeSync(fd);
+    } catch {
+    }
+  }
+  /** Appends an explicit `discontinuity` record: the caller (or the keeper) knows data before this point may be missing. */
+  markDiscontinuity(reason, fields = {}) {
+    return this.append({ ...fields, k: "discontinuity", reason }, { sync: true });
+  }
+  /** Synchronously fsyncs everything appended so far (throws if the fsync fails). */
+  sync() {
+    if (this.syncTimer) {
+      clearTimeout(this.syncTimer);
+      this.syncTimer = void 0;
+    }
+    if (this.active && this.appendedBytes > this.syncedBytes) {
+      const covers = this.appendedBytes;
+      this.syncFile(this.active.fd);
+      this.syncCount++;
+      this.syncedBytes = Math.max(this.syncedBytes, covers);
+    }
+  }
+  startSegment(first) {
+    const file = path.join(this.dir, `seg-${first}.log`);
+    const fd = openSync(file, "a", 384);
+    const seg = { first, file, bytes: 0, count: 0, idx: [], indexed: true };
+    this.segments.push(seg);
+    this.active = { seg, fd };
+    fsyncDirectory(this.dir);
+    return this.active;
+  }
+  sealActive() {
+    if (!this.active) return;
+    this.sync();
+    this.retireFd(this.active.fd);
+    this.active = void 0;
+  }
+  // ---- read / subscribe --------------------------------------------------------------------------------------
+  /**
+   * Up to `limit` records with `o >= from`, in order. If `from` was already truncated away the result starts at the first
+   * retained record (the caller can tell from `records[0].o`; use `readFrom` or `subscribe`'s `onTruncated` to be told).
+   */
+  read(from, limit, options = {}) {
+    return this.readFrom(from, limit, options).records;
+  }
+  /** Like `read`, plus `first` (first retained offset) and `truncated` (true when `from < first`: requested records are gone). */
+  readFrom(from, limit, options = {}) {
+    this.assertOpen();
+    const maxBytes = options.maxBytes ?? Number.POSITIVE_INFINITY;
+    let bytes = 0;
+    const first = this.segments[0]?.first ?? this.nextOffset;
+    const truncated = from < first;
+    const out = [];
+    if (!(limit > 0) || this.segments.length === 0) return { records: out, first, truncated };
+    from = Math.max(from, first);
+    if (from >= this.nextOffset) return { records: out, first, truncated };
+    let si = this.segments.length - 1;
+    while (si > 0 && this.segments[si].first > from) si--;
+    let full = false;
+    for (; si < this.segments.length && out.length < limit && !full; si++) {
+      const seg = this.segments[si];
+      if (seg.count === 0) continue;
+      this.ensureIndexed(seg);
+      const rel = Math.max(0, from - seg.first);
+      const slot = Math.floor(rel / INDEX_STRIDE);
+      let skip = rel - slot * INDEX_STRIDE;
+      let expected = seg.first + slot * INDEX_STRIDE;
+      const fd = openSync(seg.file, "r");
+      try {
+        scanLines(fd, seg.idx[slot], seg.bytes, (line) => {
+          if (skip > 0) {
+            skip--;
+            expected++;
+            return true;
+          }
+          if (out.length > 0 && bytes + line.length + 1 > maxBytes) {
+            full = true;
+            return false;
+          }
+          const record = parseRecord(line);
+          if (!record || record.o !== expected) throw new StreamCorruptError(`Corrupt record at offset ${expected} in ${seg.file}`);
+          expected++;
+          out.push(record);
+          bytes += line.length + 1;
+          return out.length < limit;
+        });
+      } finally {
+        closeSync(fd);
+      }
+    }
+    return { records: out, first, truncated };
+  }
+  ensureIndexed(seg) {
+    if (seg.indexed) return;
+    const fd = openSync(seg.file, "r");
+    try {
+      let n = 0;
+      const idx = [];
+      scanLines(fd, 0, seg.bytes, (_line, pos) => {
+        if (n % INDEX_STRIDE === 0) idx.push(pos);
+        n++;
+      });
+      if (n !== seg.count) throw new StreamCorruptError(`Segment ${seg.file} holds ${n} records, expected ${seg.count}`);
+      seg.idx = idx;
+      seg.indexed = true;
+    } finally {
+      closeSync(fd);
+    }
+  }
+  /**
+   * Pushes records with `o >= from` to `on`, in batches, now and whenever more are appended. Returns the unsubscribe.
+   * Delivery is asynchronous (never from inside `append`). A throwing `on` ends that subscription and goes to `onError`.
+   * If `from` is below the first retained record, delivery starts at that record and `onTruncated({from, first})` is
+   * called once before the first batch, so the loss of the committed range is observable.
+   */
+  subscribe(from, on, options = {}) {
+    let next = from;
+    let live = true;
+    let reported = false;
+    const pump = () => {
+      if (!live || this.closed) return;
+      try {
+        for (; ; ) {
+          const { records: batch, first, truncated } = this.readFrom(next, SUBSCRIBE_BATCH);
+          if (truncated && !reported) {
+            reported = true;
+            options.onTruncated?.({ from: next, first });
+          }
+          if (batch.length === 0) return;
+          next = batch[batch.length - 1].o + 1;
+          on(batch);
+          if (!live) return;
+        }
+      } catch (error) {
+        live = false;
+        unwatch();
+        this.onError?.(error);
+      }
+    };
+    const unwatch = this.watch(pump);
+    this.scheduleNotify(pump);
+    return () => {
+      live = false;
+      unwatch();
+    };
+  }
+  /** Calls `notify` (asynchronously, coalesced) after appends. Returns the unwatch. */
+  watch(notify) {
+    this.watchers.add(notify);
+    return () => {
+      this.watchers.delete(notify);
+    };
+  }
+  /** The adapter the kit server streams from (`keeper.subscribe`, credit counted in records). */
+  asEventSource(options = {}) {
+    return {
+      read: (from, limit, perRead) => {
+        const caps = [options.maxBytes, perRead?.maxBytes].filter((cap) => cap !== void 0);
+        const result = this.readFrom(from, limit, { maxBytes: caps.length > 0 ? Math.min(...caps) : void 0 });
+        if (result.truncated) options.onTruncated?.({ from, first: result.first });
+        return result.records;
+      },
+      watch: (notify) => this.watch(notify)
+    };
+  }
+  scheduleNotify(only) {
+    if (only) {
+      queueMicrotask(() => {
+        if (!this.closed) only();
+      });
+      return;
+    }
+    if (this.notifyPending || this.watchers.size === 0) return;
+    this.notifyPending = true;
+    queueMicrotask(() => {
+      this.notifyPending = false;
+      if (this.closed) return;
+      for (const watcher of [...this.watchers]) {
+        try {
+          watcher();
+        } catch (error) {
+          this.onError?.(error);
+        }
+      }
+    });
+  }
+  // ---- commit / checkpoint -----------------------------------------------------------------------------------
+  /**
+   * Marks records through `through` (inclusive) as committed and deletes the segments that hold nothing else — whole
+   * segments only, files are never rewritten. `tail` is the caller's opaque watermark; it is persisted atomically with
+   * the truncation and stays readable (`state().committedTail`) after the records are gone. Omitting `tail` keeps the
+   * previous one. A `through` at or below the current watermark changes nothing (but a given `tail` is still stored).
+   */
+  commit(through, tail) {
+    this.assertOpen();
+    if (!Number.isSafeInteger(through) || through < -1) throw new RangeError(`Invalid commit offset ${through}`);
+    if (through > this.nextOffset - 1) throw new RangeError(`Commit offset ${through} is beyond the head ${this.nextOffset - 1}`);
+    const advance = through > this.committedOffset;
+    if (!advance && tail === void 0) return;
+    this.sync();
+    const committed = advance ? through : this.committedOffset;
+    const newTail = tail === void 0 ? this.tail : tail;
+    atomicWrite(path.join(this.dir, META_FILE), JSON.stringify({ v: 1, committed, tail: newTail, t: this.now() }));
+    this.committedOffset = committed;
+    this.tail = newTail;
+    if (advance) this.deleteCommittedSegments();
+  }
+  /** Atomically stores a checkpoint slot (tmp + rename, fsynced), keeping the latest two. `blob` is opaque. */
+  writeCheckpoint(offset, blob) {
+    this.assertOpen();
+    if (!Number.isSafeInteger(offset) || offset < -1) throw new RangeError(`Invalid checkpoint offset ${offset}`);
+    const data = typeof blob === "string" ? Buffer.from(blob, "utf8") : Buffer.from(blob);
+    this.sync();
+    const seq = this.checkpointSeq + 1;
+    const t = this.now();
+    atomicWrite(path.join(this.dir, `checkpoint-${String(seq).padStart(12, "0")}.json`), JSON.stringify({ v: 1, seq, offset, t, blob: data.toString("base64") }));
+    this.checkpointSeq = seq;
+    this.checkpointOffset = offset;
+    const files = this.checkpointFiles();
+    for (const old of files.slice(0, Math.max(0, files.length - KEPT_CHECKPOINTS))) try {
+      unlinkSync3(old.file);
+    } catch {
+    }
+    return { seq, offset, t, blob: data };
+  }
+  /** The newest readable checkpoint (falls back to the previous slot when the newest cannot be parsed). */
+  latestCheckpoint() {
+    const files = this.checkpointFiles();
+    for (let i = files.length - 1; i >= 0; i--) {
+      try {
+        const value = JSON.parse(readFileSync2(files[i].file, "utf8"));
+        if (Number.isSafeInteger(value.seq) && Number.isSafeInteger(value.offset) && typeof value.t === "number" && typeof value.blob === "string") {
+          return { seq: value.seq, offset: value.offset, t: value.t, blob: Buffer.from(value.blob, "base64") };
+        }
+      } catch {
+      }
+    }
+    return void 0;
+  }
+  checkpointFiles() {
+    return readdirSync(this.dir).map((n) => CHECKPOINT_NAME.exec(n)).filter((m) => !!m).map((m) => ({ seq: Number(m[1]), file: path.join(this.dir, m[0]) })).sort((a, b) => a.seq - b.seq);
+  }
+  // ---- state / lifecycle -------------------------------------------------------------------------------------
+  state() {
+    return {
+      head: this.nextOffset - 1,
+      committed: this.committedOffset,
+      committedTail: this.tail,
+      overQuota: this.totalBytes > this.softQuota,
+      checkpointOffset: this.checkpointOffset,
+      first: this.segments[0]?.first ?? this.nextOffset,
+      next: this.nextOffset,
+      bytes: this.totalBytes,
+      segments: this.segments.length
+    };
+  }
+  /** Counters for tests and diagnostics. */
+  stats() {
+    return { fsyncs: this.syncCount, unsyncedBytes: this.appendedBytes - this.syncedBytes, syncErrors: this.syncErrors, lastSyncError: this.lastSyncError };
+  }
+  /** Flushes, closes the files and releases the directory. Idempotent. */
+  close() {
+    if (this.closed) return;
+    try {
+      this.sync();
+    } finally {
+      this.closed = true;
+      this.closeActive();
+      this.watchers.clear();
+      openStreams.delete(this.dir);
+    }
+  }
+  closeActive() {
+    if (this.active) {
+      this.retireFd(this.active.fd);
+      this.active = void 0;
+    }
+  }
+  assertOpen() {
+    if (this.closed) throw new Error("Stream log is closed");
+  }
+};
+function fstatSizeOf(file) {
+  const fd = openSync(file, "r");
+  try {
+    return fstatSync(fd).size;
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// src/workstation/keepers/acp/params.ts
+import { statSync } from "node:fs";
+import path2 from "node:path";
+
+// src/workstation/keepers/acp/protocol.ts
+var ACP_CAPABILITY = "acp";
+function parseAcpStream(name) {
+  for (const stream of ["raw", "outbox"]) if (name.startsWith(`${stream}/`) && name.length > stream.length + 1) return { stream, sessionKey: name.slice(stream.length + 1) };
+  return void 0;
+}
+var ACP_TERMINATE_GRACE_MS = 2e3;
+var ACP_KILL_GRACE_MS = 2e3;
+var ACP_EXIT_DRAIN_MS = 2e3;
+var ACP_STDERR_TAIL_BYTES = 8 * 1024;
+var ACP_STDERR_LINE_BYTES = 16 * 1024;
+var ACP_STDERR_FILE_BYTES = 1024 * 1024;
+var ACP_MAX_RECORD_BYTES = 30 * 1024 * 1024;
+var ACP_READ_MAX_BYTES = 16 * 1024 * 1024;
+var ACP_READ_MAX_RECORDS = 4096;
+var ACP_MIN_FREE_DISK_BYTES = 1024 * 1024 * 1024;
+var ACP_DISK_CHECK_MS = 5e3;
+var ACP_SESSION_LIMIT = 256;
+var ACP_SESSION_KEY_CHARS = 256;
+var ACP_LABEL_BYTES = 4096;
+var ACP_ANNOTATION_BYTES = 64 * 1024;
+var ACP_ENV_BYTES = 1024 * 1024;
+var ACP_ENVELOPE_PENDING = 256;
+var ACP_ENVELOPE_SNIFF_BYTES = 256 * 1024;
+var AcpErrorCode = {
+  badRequest: "bad_request",
+  notFound: "acp_session_not_found",
+  /** A process is starting or running in this session (spawn, release). */
+  busy: "acp_session_busy",
+  limit: "acp_limit",
+  /** The command could not be started (ENOENT, EACCES, …): nothing was appended to the session. */
+  spawnFailed: "acp_spawn_failed",
+  /** The session belongs to another live keeper-acp generation. */
+  foreign: "acp_session_foreign",
+  /** The session's directory has a session.json this keeper cannot read (corrupt, another schema): left alone, never reused. */
+  unreadable: "acp_session_unreadable"
+};
+
+// src/workstation/keepers/acp/params.ts
+var MAX_PATH = 4096;
+var MAX_ARGS = 4096;
+var MAX_ENV_ENTRIES = 4096;
+var MAX_LIST = 256;
+var bad = (message) => {
+  throw new KeeperMethodError(AcpErrorCode.badRequest, message);
+};
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var jsonBytes = (value) => {
+  try {
+    return Buffer.byteLength(JSON.stringify(value) ?? "");
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+};
+function onlyKeys(params, allowed) {
+  for (const key of Object.keys(params)) if (!allowed.includes(key)) bad(`Unknown parameter ${key}`);
+}
+function sessionKeyOf(value) {
+  if (typeof value !== "string" || !value || value.length > ACP_SESSION_KEY_CHARS || value.includes("\0")) bad("Invalid sessionKey");
+  return value;
+}
+function offsetOf(value, name, min = 0) {
+  if (!Number.isSafeInteger(value) || value < min) bad(`Invalid ${name}`);
+  return value;
+}
+function causeOf(value, name = "cause") {
+  if (!isRecord2(value) || !Number.isSafeInteger(value.o) || value.o < 0 || !Number.isSafeInteger(value.i) || value.i < 0) bad(`Invalid ${name}`);
+  return { o: value.o, i: value.i };
+}
+function absolutePath(value, name) {
+  if (typeof value !== "string" || !value || value.length > MAX_PATH || value.includes("\0") || !path2.isAbsolute(value)) bad(`Invalid ${name}`);
+  return path2.normalize(value);
+}
+function stringList(value, name, max) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.length > max || value.some((v) => typeof v !== "string" || v.includes("\0"))) bad(`Invalid ${name}`);
+  return [...value];
+}
+function environment(value) {
+  if (!isRecord2(value)) return bad("Invalid env");
+  const entries = Object.entries(value);
+  if (entries.length > MAX_ENV_ENTRIES || jsonBytes(value) > ACP_ENV_BYTES) bad("Invalid env");
+  const env = {};
+  for (const [name, entry] of entries) {
+    if (!name || name.includes("=") || name.includes("\0") || typeof entry !== "string" || entry.includes("\0")) bad("Invalid env");
+    env[name] = entry;
+  }
+  return env;
+}
+function removablePath(value, protectedDirs) {
+  const target = absolutePath(value, "removeOnExit");
+  if (target.split(path2.sep).filter(Boolean).length < 2) bad("removeOnExit path is too shallow");
+  for (const dir of protectedDirs) {
+    const rel = path2.relative(target, dir);
+    if (rel === "" || !rel.startsWith("..") && !path2.isAbsolute(rel)) bad("removeOnExit may not contain keeper data");
+  }
+  return target;
+}
+function spawnSpecOf(value, protectedDirs) {
+  if (!isRecord2(value)) return bad("Invalid spec");
+  onlyKeys(value, ["command", "args", "env", "cwd", "stderrSecrets", "removeOnExit"]);
+  const { command } = value;
+  if (typeof command !== "string" || !command || command.length > MAX_PATH || command.includes("\0")) bad("Invalid command");
+  const args = stringList(value.args, "args", MAX_ARGS);
+  const cwd = absolutePath(value.cwd, "cwd");
+  let isDirectory = false;
+  try {
+    isDirectory = statSync(cwd).isDirectory();
+  } catch {
+  }
+  if (!isDirectory) bad("Adapter working directory is not a directory");
+  const stderrSecrets = stringList(value.stderrSecrets, "stderrSecrets", MAX_LIST);
+  const removeOnExit = stringList(value.removeOnExit, "removeOnExit", MAX_LIST).map((p) => removablePath(p, protectedDirs));
+  return { command, args, env: environment(value.env), cwd, stderrSecrets, removeOnExit };
+}
+function labelOf(value) {
+  if (!isRecord2(value) || jsonBytes(value) > ACP_LABEL_BYTES) return bad("Invalid label");
+  return JSON.parse(JSON.stringify(value));
+}
+function annotationOf(value) {
+  if (!isRecord2(value) || jsonBytes(value) > ACP_ANNOTATION_BYTES) return bad("Invalid annotation");
+  causeOf(value.cause, "annotation.cause");
+  return value;
+}
+function redactionsOf(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.length > MAX_LIST) return bad("Invalid redact");
+  return value.map((entry) => {
+    if (!isRecord2(entry) || typeof entry.ref !== "string" || !entry.ref || typeof entry.value !== "string") return bad("Invalid redact");
+    return { ref: entry.ref, value: entry.value };
+  });
+}
+function noteOf(value) {
+  if (!isRecord2(value) || typeof value.type !== "string" || !value.type) return bad("Invalid note");
+  return value;
+}
+function outboxEntriesOf(value) {
+  if (!Array.isArray(value) || value.length === 0) return bad("Invalid entries");
+  return value.map((entry) => {
+    if (!isRecord2(entry) || !Number.isSafeInteger(entry.seq) || !isRecord2(entry.frame)) return bad("Invalid outbox entry");
+    return { seq: entry.seq, src: causeOf(entry.src, "outbox src"), frame: entry.frame };
+  });
+}
+
+// src/workstation/keepers/acp/recover.ts
+import { closeSync as closeSync2, openSync as openSync2, readFileSync as readFileSync4, readSync as readSync2, readdirSync as readdirSync2, fstatSync as fstatSync2 } from "node:fs";
+import path3 from "node:path";
+
+// src/workstation/keepers/kit/orphanSweep.ts
+import { execFile as execFile2 } from "node:child_process";
+import { readFileSync as readFileSync3 } from "node:fs";
+var procStat = (pid) => readFileSync3(`/proc/${pid}/stat`, "utf8");
+var procBootId = () => readFileSync3("/proc/sys/kernel/random/boot_id", "utf8");
+function darwinLstart(pid) {
+  return new Promise((resolve) => {
+    execFile2("/bin/ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 5e3, env: { LC_ALL: "C", TZ: "UTC", PATH: "/bin:/usr/bin" } }, (error, stdout) => {
+      if (!error) {
+        resolve(stdout.trim());
+        return;
+      }
+      resolve(error.code === 1 ? "" : null);
+    });
+  });
+}
+function linuxStartTicks(stat) {
+  const close = stat.lastIndexOf(")");
+  if (close < 0) return null;
+  const fields = stat.slice(close + 2).trim().split(/\s+/);
+  const ticks = fields[19];
+  return ticks && /^\d+$/.test(ticks) ? ticks : null;
+}
+async function processStartTime(pid, deps = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  const platform = deps.platform ?? process.platform;
+  if (platform === "linux") {
+    try {
+      const ticks = linuxStartTicks((deps.readStat ?? procStat)(pid));
+      const boot = (deps.readBootId ?? procBootId)().trim();
+      return ticks && boot ? `linux:${boot}:${ticks}` : null;
+    } catch {
+      return null;
+    }
+  }
+  const lstart = await (deps.psLstart ?? darwinLstart)(pid);
+  return lstart ? `${platform}:${lstart.replace(/\s+/g, " ")}` : null;
+}
+async function sameProcess(pid, startTime, deps = {}) {
+  if (!startTime) return false;
+  return await processStartTime(pid, deps) === startTime;
+}
+function signalGroup(pgid, signal) {
+  if (!Number.isSafeInteger(pgid) || pgid <= 1) return false;
+  try {
+    process.kill(-pgid, signal);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function settleOrphan(spawn2, onKeeperLoss, killGraceMs, deps = {}) {
+  if (!await sameProcess(spawn2.pid, spawn2.startTime, deps)) return "gone";
+  if (onKeeperLoss === "leave") return "left";
+  const send = deps.signal ?? signalGroup;
+  send(spawn2.pgid, "SIGTERM");
+  const later = deps.later ?? ((ms, run) => {
+    setTimeout(run, ms).unref();
+  });
+  later(killGraceMs, () => {
+    send(spawn2.pgid, "SIGKILL");
+  });
+  return "killed";
+}
+
+// src/workstation/keepers/acp/recover.ts
+var SESSION_FILE = "session.json";
+var STDERR_FILE = "stderr.log";
+function validMeta(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const m = value;
+  const spawn2 = m.spawn;
+  return m.v === 1 && typeof m.sessionKey === "string" && typeof m.label === "object" && m.label !== null && Number.isFinite(m.createdAtMs) && typeof m.exited === "boolean" && Array.isArray(m.removeOnExit) && m.removeOnExit.every((p) => typeof p === "string") && (spawn2 === null || typeof spawn2 === "object" && typeof spawn2.spawnId === "string" && Number.isSafeInteger(spawn2.pid) && Number.isSafeInteger(spawn2.pgid) && (spawn2.startTime === null || typeof spawn2.startTime === "string"));
+}
+function readSessionMeta(dir) {
+  let text;
+  try {
+    text = readFileSync4(path3.join(dir, SESSION_FILE), "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? "absent" : "unreadable";
+  }
+  try {
+    const value = JSON.parse(text);
+    return validMeta(value) ? value : "unreadable";
+  } catch {
+    return "unreadable";
+  }
+}
+function listSessionDirs(sessionsDir, report) {
+  let names;
+  try {
+    names = readdirSync2(sessionsDir);
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const name of names.sort()) {
+    const dir = path3.join(sessionsDir, name);
+    let value;
+    try {
+      value = JSON.parse(readFileSync4(path3.join(dir, SESSION_FILE), "utf8"));
+    } catch {
+      continue;
+    }
+    if (!validMeta(value)) {
+      report(`${name}: unreadable session metadata, left alone`);
+      continue;
+    }
+    found.push({ dir, meta: value });
+  }
+  return found;
+}
+function stderrTailOf(dir) {
+  let fd;
+  try {
+    fd = openSync2(path3.join(dir, STDERR_FILE), "r");
+    const size = fstatSync2(fd).size;
+    const length = Math.min(size, ACP_STDERR_TAIL_BYTES);
+    const buffer = Buffer.alloc(length);
+    readSync2(fd, buffer, 0, length, size - length);
+    let text = buffer.toString("utf8");
+    if (length < size) text = text.replace(/^[^\n]*\n?/, "");
+    return text;
+  } catch {
+    return "";
+  } finally {
+    if (fd !== void 0) try {
+      closeSync2(fd);
+    } catch {
+    }
+  }
+}
+async function settleLostAdapter(meta, afterGrace, deps = {}) {
+  const spawn2 = meta.spawn;
+  if (!spawn2) {
+    afterGrace();
+    return "gone";
+  }
+  const later = deps.later ?? ((ms, run) => {
+    setTimeout(run, ms).unref();
+  });
+  let killDue;
+  const outcome = await settleOrphan({ pid: spawn2.pid, pgid: spawn2.pgid, startTime: spawn2.startTime }, "kill", ACP_KILL_GRACE_MS, {
+    ...deps,
+    later: (ms, run) => {
+      killDue = run;
+      later(ms, () => {
+        try {
+          run();
+        } finally {
+          afterGrace();
+        }
+      });
+    }
+  });
+  if (!killDue) afterGrace();
+  return outcome;
+}
+
+// src/workstation/keepers/acp/session.ts
+import { spawn } from "node:child_process";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { rmSync } from "node:fs";
+
+// src/workstation/keepers/acp/envelope.ts
+function sniffEnvelope(line) {
+  if (line.length > ACP_ENVELOPE_SNIFF_BYTES) return void 0;
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const message = value;
+  const id = typeof message.id === "string" || typeof message.id === "number" ? JSON.stringify(message.id) : void 0;
+  const method = typeof message.method === "string" ? message.method.slice(0, 128) : void 0;
+  return { ...id !== void 0 ? { id } : {}, ...method !== void 0 ? { method } : {} };
+}
+var EnvelopeTracker = class {
+  /** Daemon → adapter requests (down lines) awaiting an up response. */
+  outbound = /* @__PURE__ */ new Map();
+  /** Adapter → daemon requests (up lines) awaiting a down response. */
+  inbound = /* @__PURE__ */ new Map();
+  lastUp = null;
+  lastDown = null;
+  unsniffed = 0;
+  /** A new process: nothing from the previous one can be answered any more. */
+  reset() {
+    this.outbound.clear();
+    this.inbound.clear();
+  }
+  up(line, at) {
+    this.lastUp = at;
+    this.observe(line, at, this.inbound, this.outbound);
+  }
+  down(line, at) {
+    this.lastDown = at;
+    this.observe(line, at, this.outbound, this.inbound);
+  }
+  observe(line, at, mine, theirs) {
+    const envelope = sniffEnvelope(line);
+    if (!envelope) {
+      this.unsniffed += 1;
+      return;
+    }
+    if (envelope.id === void 0) return;
+    if (envelope.method !== void 0) {
+      mine.delete(envelope.id);
+      mine.set(envelope.id, { id: envelope.id, method: envelope.method, sinceEpochMs: at });
+      while (mine.size > ACP_ENVELOPE_PENDING) mine.delete(mine.keys().next().value);
+    } else theirs.delete(envelope.id);
+  }
+  get pendingInboundCount() {
+    return this.inbound.size;
+  }
+  get pendingOutboundCount() {
+    return this.outbound.size;
+  }
+  snapshot() {
+    return {
+      pendingOutbound: [...this.outbound.values()].map((p) => ({ ...p })),
+      pendingInbound: [...this.inbound.values()].map((p) => ({ ...p })),
+      lastUpEpochMs: this.lastUp,
+      lastDownEpochMs: this.lastDown,
+      unsniffed: this.unsniffed
+    };
+  }
+};
+
+// src/workstation/keepers/acp/stderr.ts
+import { closeSync as closeSync3, fstatSync as fstatSync3, openSync as openSync3, renameSync as renameSync3, writeSync as writeSync2 } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
+var REDACTED = "[REDACTED]";
+var omittedLine = (chars) => `[keeper-acp] stderr line of ${chars}+ characters omitted`;
+var jsonEscaped = (value) => JSON.stringify(value).slice(1, -1);
+var asciiEscaped = (value) => jsonEscaped(value).replace(/[^\x00-\x7e]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+function secretForms(secret) {
+  if (!secret) return [];
+  const base = /* @__PURE__ */ new Set([secret]);
+  if (secret.startsWith("Bearer ") && secret.length > "Bearer ".length) base.add(secret.slice("Bearer ".length));
+  if (/[\r\n]/.test(secret)) {
+    for (const line of secret.split(/\r?\n|\r/)) if (line.trim().length >= 8) base.add(line);
+  }
+  const forms = /* @__PURE__ */ new Set();
+  for (const form of base) for (const encoded of [form, jsonEscaped(form), jsonEscaped(jsonEscaped(form)), asciiEscaped(form)]) if (encoded) forms.add(encoded);
+  return [...forms];
+}
+var StderrCapture = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  /** Longest first, so a secret that contains another is removed whole. */
+  secrets = [];
+  decoder = new StringDecoder("utf8");
+  partial = "";
+  dropping = false;
+  tailText = "";
+  fd;
+  fileSize = 0;
+  /** Adds secrets to redact from now on (kept for the session's lifetime: a later spawn may print an earlier secret). */
+  addSecrets(values) {
+    const all = new Set(this.secrets);
+    for (const value of values) for (const form of secretForms(value)) all.add(form);
+    this.secrets = [...all].sort((a, b) => b.length - a.length);
+  }
+  redact(text) {
+    let safe = text;
+    for (const secret of this.secrets) if (safe.includes(secret)) safe = safe.replaceAll(secret, REDACTED);
+    return safe;
+  }
+  /** A new process: a fresh line buffer and tail (the tail belongs to one process's exit). */
+  restart() {
+    this.decoder = new StringDecoder("utf8");
+    this.partial = "";
+    this.dropping = false;
+    this.tailText = "";
+  }
+  get tail() {
+    return this.tailText;
+  }
+  push(chunk) {
+    let text = this.decoder.write(chunk);
+    for (; ; ) {
+      const newline = text.indexOf("\n");
+      if (newline < 0) break;
+      const piece = text.slice(0, newline);
+      text = text.slice(newline + 1);
+      if (this.dropping) {
+        this.dropping = false;
+        this.partial = "";
+        continue;
+      }
+      this.line(this.partial + piece);
+      this.partial = "";
+    }
+    if (this.dropping) return;
+    this.partial += text;
+    if (this.partial.length > ACP_STDERR_LINE_BYTES) {
+      this.emit(omittedLine(ACP_STDERR_LINE_BYTES));
+      this.partial = "";
+      this.dropping = true;
+    }
+  }
+  /** The stream ended: a final unterminated line is still a line. */
+  end() {
+    const rest = this.partial + this.decoder.end();
+    this.partial = "";
+    if (this.dropping) {
+      this.dropping = false;
+      return;
+    }
+    if (rest) this.line(rest);
+  }
+  line(raw) {
+    this.emit(raw.length > ACP_STDERR_LINE_BYTES ? omittedLine(ACP_STDERR_LINE_BYTES) : this.redact(raw));
+  }
+  emit(safe) {
+    this.tailText = (this.tailText + safe + "\n").slice(-ACP_STDERR_TAIL_BYTES);
+    this.writeFile(`${safe}
+`);
+    try {
+      this.options.onLine(safe);
+    } catch (error) {
+      this.options.onError?.(error);
+    }
+  }
+  writeFile(text) {
+    const file = this.options.file;
+    if (!file) return;
+    try {
+      const data = Buffer.from(text, "utf8");
+      const cap = this.options.fileBytes ?? ACP_STDERR_FILE_BYTES;
+      if (this.fd === void 0) {
+        this.fd = openSync3(file, "a", 384);
+        this.fileSize = fstatSync3(this.fd).size;
+      }
+      if (this.fileSize > 0 && this.fileSize + data.length > cap) {
+        closeSync3(this.fd);
+        this.fd = void 0;
+        renameSync3(file, `${file}.1`);
+        this.fd = openSync3(file, "a", 384);
+        this.fileSize = 0;
+      }
+      let written = 0;
+      while (written < data.length) written += writeSync2(this.fd, data, written, data.length - written);
+      this.fileSize += data.length;
+    } catch (error) {
+      this.options.onError?.(error);
+    }
+  }
+  close() {
+    if (this.fd !== void 0) {
+      try {
+        closeSync3(this.fd);
+      } catch {
+      }
+      this.fd = void 0;
+    }
+  }
+};
+
+// src/workstation/keepers/acp/session.ts
+var MAX_EVENT_RECORDS = 256;
+var GROUP_POLL_MS = 50;
+var SpawnFailedError = class extends KeeperMethodError {
+  constructor(message) {
+    super(AcpErrorCode.spawnFailed, message);
+    this.name = "SpawnFailedError";
+  }
+};
+var messageOf = (error) => error instanceof Error ? error.message : String(error);
+var causeKeyOf = (cause) => `${cause.o}:${cause.i}`;
+var sleep = (ms) => new Promise((resolve) => {
+  setTimeout(resolve, ms).unref();
+});
+var AcpSession = class {
+  constructor(options) {
+    this.options = options;
+    this.meta = options.meta;
+    this.raw = options.raw;
+    this.outbox = options.outbox;
+    this.downsComplete = options.freshRaw;
+    this.lastExit = options.meta.lastExit ?? null;
+    this.stderr = new StderrCapture({ file: options.stderrFile, onLine: (line) => this.appendRaw({ k: "err", l: line }), onError: (error) => this.report(error) });
+    const head = this.outbox.state().head;
+    if (head >= this.outbox.state().first) {
+      const last = this.outbox.readFrom(head, 1).records[0];
+      if (last && Number.isSafeInteger(last.seq)) this.lastSeq = last.seq;
+    }
+  }
+  options;
+  meta;
+  raw;
+  outbox;
+  proc;
+  lastExit = null;
+  downs = /* @__PURE__ */ new Map();
+  downsComplete;
+  envelope = new EnvelopeTracker();
+  stderr;
+  lastSeq = null;
+  stdoutHeld = false;
+  released = false;
+  spawning = false;
+  get sessionKey() {
+    return this.meta.sessionKey;
+  }
+  get running() {
+    return !!this.proc && this.proc.state !== "exited";
+  }
+  get pendingInbound() {
+    return this.envelope.pendingInboundCount;
+  }
+  report(error) {
+    this.options.log(`session ${this.meta.sessionKey}: ${messageOf(error)}`);
+  }
+  appendRaw(input) {
+    return this.raw.append(input);
+  }
+  // ---- spawn ---------------------------------------------------------------------------------------------------------------
+  /**
+   * Starts the adapter: `spawn(command, args, {cwd, env, detached})` with exactly the daemon's env (never this process's own).
+   * Either a `proc spawn` record is appended (and later exactly one `proc exit`), or the spawn fails with nothing appended.
+   * stdout/stderr are held until the spawn record is in raw, so it is always the process's first record.
+   */
+  async spawn(spec) {
+    if (this.released) throw new KeeperMethodError(AcpErrorCode.notFound, "Session released");
+    if (this.spawning || this.proc && this.proc.state !== "exited") throw new KeeperMethodError(AcpErrorCode.busy, "A process is already running in this session");
+    this.spawning = true;
+    try {
+      return await this.spawnNow(spec);
+    } finally {
+      this.spawning = false;
+    }
+  }
+  get busy() {
+    return this.spawning || this.running;
+  }
+  async spawnNow(spec) {
+    const spawnId = randomUUID3();
+    let child;
+    try {
+      child = (this.options.spawnProcess ?? spawn)(spec.command, spec.args, { cwd: spec.cwd, env: spec.env, detached: this.options.detached, stdio: ["pipe", "pipe", "pipe"] });
+    } catch (error) {
+      throw new SpawnFailedError(messageOf(error));
+    }
+    child.stdin.on("error", () => {
+    });
+    if (child.pid === void 0) {
+      const error = await new Promise((resolve) => child.once("error", resolve));
+      throw new SpawnFailedError(messageOf(error));
+    }
+    child.on("error", (error) => this.report(error));
+    const pid = child.pid;
+    const pgid = this.options.detached ? pid : 0;
+    let markRecorded;
+    const proc = {
+      spawnId,
+      child,
+      pid,
+      pgid,
+      startTime: null,
+      sinceMs: this.options.now(),
+      state: "starting",
+      recorded: new Promise((resolve) => {
+        markRecorded = resolve;
+      }),
+      stdout: { chunks: [], bytes: 0, dropping: 0 }
+    };
+    this.proc = proc;
+    this.envelope.reset();
+    this.stderr.restart();
+    this.stderr.addSecrets(spec.stderrSecrets ?? []);
+    this.meta.spawn = { spawnId, pid, pgid, startTime: null, atMs: proc.sinceMs };
+    this.meta.exited = false;
+    this.meta.removeOnExit = [...spec.removeOnExit ?? []];
+    this.saveMeta();
+    let held = [];
+    child.stdout.on("data", (chunk) => {
+      if (held) {
+        held.push(["out", chunk]);
+        child.stdout.pause();
+        return;
+      }
+      this.onStdout(proc, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (held) {
+        held.push(["err", chunk]);
+        child.stderr.pause();
+        return;
+      }
+      this.stderr.push(chunk);
+    });
+    child.stdout.on("error", () => {
+    });
+    child.stderr.on("error", () => {
+    });
+    child.stdout.pause();
+    child.stderr.pause();
+    child.once("exit", (code, signal) => this.onLeaderExit(proc, code, signal));
+    child.once("close", () => {
+      void this.finish(proc);
+    });
+    let record;
+    try {
+      proc.startTime = await (this.options.startTime ?? ((p) => processStartTime(p)))(pid).catch(() => null);
+      this.meta.spawn.startTime = proc.startTime;
+      this.saveMeta();
+      record = this.appendRaw({
+        k: "proc",
+        kind: "spawn",
+        spawnId,
+        pid,
+        pgid,
+        startTime: proc.startTime ?? "",
+        command: spec.command,
+        args: spec.args,
+        cwd: spec.cwd,
+        envKeys: Object.keys(spec.env).sort()
+      });
+    } catch (error) {
+      this.signal(proc, "SIGKILL");
+      held = void 0;
+      proc.state = "exited";
+      this.proc = void 0;
+      this.meta.spawn = null;
+      this.meta.exited = true;
+      this.saveMeta();
+      markRecorded();
+      throw new SpawnFailedError(`Could not record the spawn: ${messageOf(error)}`);
+    }
+    if (proc.state === "starting") proc.state = "running";
+    markRecorded();
+    const pending2 = held;
+    held = void 0;
+    for (const [stream, chunk] of pending2) {
+      if (stream === "out") this.onStdout(proc, chunk);
+      else this.stderr.push(chunk);
+    }
+    if (!this.stdoutHeld) child.stdout.resume();
+    child.stderr.resume();
+    return { spawnId, pid, pgid, o: record.o };
+  }
+  saveMeta() {
+    try {
+      this.options.saveMeta(this.meta);
+    } catch (error) {
+      this.report(error);
+    }
+  }
+  /** Persists the metadata now (an adopting keeper records itself as the owner). */
+  persist() {
+    this.saveMeta();
+  }
+  /** stdout → one `up` record per line, verbatim (no newline). A line over the record cap is dropped and a `gap` says so. */
+  onStdout(proc, chunk) {
+    const out = proc.stdout;
+    let start = 0;
+    for (; ; ) {
+      const newline = chunk.indexOf(10, start);
+      if (newline < 0) break;
+      const piece = chunk.subarray(start, newline);
+      start = newline + 1;
+      if (out.dropping > 0) {
+        this.appendGap(out.dropping + piece.length);
+        out.dropping = 0;
+        continue;
+      }
+      const line = out.chunks.length === 0 ? piece : Buffer.concat([...out.chunks, piece], out.bytes + piece.length);
+      out.chunks = [];
+      out.bytes = 0;
+      this.upLine(line);
+    }
+    if (start >= chunk.length) return;
+    const rest = chunk.subarray(start);
+    if (out.dropping > 0) {
+      out.dropping += rest.length;
+      return;
+    }
+    out.chunks.push(Buffer.from(rest));
+    out.bytes += rest.length;
+    if (out.bytes > ACP_MAX_RECORD_BYTES) {
+      out.dropping = out.bytes;
+      out.chunks = [];
+      out.bytes = 0;
+    }
+  }
+  upLine(bytes) {
+    const line = bytes.toString("utf8");
+    if (bytes.length > ACP_MAX_RECORD_BYTES / 2 && Buffer.byteLength(JSON.stringify(line)) > ACP_MAX_RECORD_BYTES - 1024) {
+      this.appendGap(bytes.length);
+      return;
+    }
+    try {
+      const record = this.appendRaw({ k: "up", l: line });
+      this.envelope.up(line, record.t);
+    } catch (error) {
+      this.report(error);
+    }
+  }
+  appendGap(droppedBytes) {
+    try {
+      this.appendRaw({ k: "gap", stream: "stdout", droppedBytes });
+    } catch (error) {
+      this.report(error);
+    }
+  }
+  /** The keeper's disk guard (spec §3.4: below 1 GiB free, stop reading adapter stdout). stderr keeps flowing (bounded file). */
+  holdStdout(hold) {
+    if (this.stdoutHeld === hold) return;
+    this.stdoutHeld = hold;
+    const proc = this.proc;
+    if (!proc || proc.state === "starting" || proc.state === "exited") return;
+    if (hold) proc.child.stdout.pause();
+    else proc.child.stdout.resume();
+  }
+  // ---- exit ----------------------------------------------------------------------------------------------------------------
+  onLeaderExit(proc, code, signal) {
+    proc.leaderExit = { code, signal };
+    if (proc.state !== "exited") proc.state = "exiting";
+    if (this.stdoutHeld) proc.child.stdout.resume();
+    if (proc.terminateReason) return;
+    if (this.options.detached && this.groupAlive(proc)) {
+      signalGroup(proc.pgid, "SIGTERM");
+      proc.groupTimer = setTimeout(() => {
+        if (this.groupAlive(proc)) signalGroup(proc.pgid, "SIGKILL");
+      }, ACP_KILL_GRACE_MS);
+      proc.groupTimer.unref();
+    }
+    proc.drainTimer = setTimeout(() => {
+      this.closePipes(proc);
+      void this.finish(proc);
+    }, ACP_EXIT_DRAIN_MS);
+    proc.drainTimer.unref();
+  }
+  /** Writes the exit record once: flushes partial lines, appends `proc exit`, runs `removeOnExit`. */
+  finish(proc) {
+    proc.finished ??= (async () => {
+      await proc.recorded;
+      clearTimeout(proc.drainTimer);
+      if (this.proc !== proc) return this.lastExit;
+      if (proc.stdout.dropping > 0) {
+        this.appendGap(proc.stdout.dropping);
+        proc.stdout.dropping = 0;
+      }
+      if (proc.stdout.bytes > 0) {
+        const line = Buffer.concat(proc.stdout.chunks, proc.stdout.bytes);
+        proc.stdout.chunks = [];
+        proc.stdout.bytes = 0;
+        this.upLine(line);
+      }
+      this.stderr.end();
+      const code = proc.leaderExit?.code ?? proc.child.exitCode ?? null;
+      const signal = proc.leaderExit?.signal ?? proc.child.signalCode ?? null;
+      const stderrTail = this.stderr.tail;
+      let exit = null;
+      try {
+        const record = this.appendRaw({ k: "proc", kind: "exit", code, signal, stderrTail, ...proc.terminateReason ? { reason: proc.terminateReason } : {} });
+        exit = { code, signal, stderrTail, ...proc.terminateReason ? { reason: proc.terminateReason } : {}, o: record.o, atMs: record.t };
+      } catch (error) {
+        this.report(error);
+      }
+      proc.state = "exited";
+      this.lastExit = exit;
+      this.meta.exited = true;
+      this.meta.lastExit = exit;
+      this.saveMeta();
+      this.removeOnExit();
+      return exit;
+    })();
+    return proc.finished;
+  }
+  /**
+   * Removes `targets` (default: what the current spawn named) and drops them from the metadata. A caller cleaning up after an
+   * EARLIER spawn passes the list it captured then: a later spawn's own targets are never touched (final review minor 8).
+   */
+  removeOnExit(targets = this.meta.removeOnExit) {
+    const removing = [...targets];
+    for (const target of removing) {
+      try {
+        rmSync(target, { recursive: true, force: true });
+      } catch (error) {
+        this.report(error);
+      }
+    }
+    const remaining = this.meta.removeOnExit.filter((target) => !removing.includes(target));
+    if (remaining.length !== this.meta.removeOnExit.length) {
+      this.meta.removeOnExit = remaining;
+      this.saveMeta();
+    }
+  }
+  groupAlive(proc) {
+    if (!this.options.detached) return proc.child.exitCode === null && proc.child.signalCode === null;
+    try {
+      process.kill(-proc.pgid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  signal(proc, signal) {
+    if (this.options.detached) {
+      signalGroup(proc.pgid, signal);
+      return;
+    }
+    try {
+      proc.child.kill(signal);
+    } catch {
+    }
+  }
+  closePipes(proc) {
+    proc.child.stdin.destroy();
+    proc.child.stdout.destroy();
+    proc.child.stderr.destroy();
+  }
+  /** Until the group (fallback: the child) is gone or `ms` passed. True when it is gone. */
+  async goneWithin(proc, ms) {
+    const end = Date.now() + ms;
+    for (; ; ) {
+      const leaderDone = proc.leaderExit !== void 0;
+      if (leaderDone && !this.groupAlive(proc)) return true;
+      if (!this.options.detached && leaderDone) return true;
+      if (Date.now() >= end) return false;
+      await sleep(Math.min(GROUP_POLL_MS, Math.max(1, end - Date.now())));
+    }
+  }
+  /**
+   * SIGTERM to the process group → up to `graceMs` → SIGKILL → up to 2 s → close the pipes → `exit` record (spec §5.3). The group,
+   * not just the leader: an adapter's CLI and MCP servers must not survive it. Idempotent; an exited session answers its last exit.
+   */
+  async terminate(graceMs = ACP_TERMINATE_GRACE_MS, reason = "terminated") {
+    const proc = this.proc;
+    if (!proc) return this.lastExit;
+    await proc.recorded;
+    if (this.proc !== proc || proc.state === "exited") return this.lastExit;
+    if (proc.terminating) return proc.terminating;
+    proc.terminateReason ??= reason;
+    proc.terminating = (async () => {
+      clearTimeout(proc.drainTimer);
+      clearTimeout(proc.groupTimer);
+      if (graceMs > 0) {
+        this.signal(proc, "SIGTERM");
+        if (await this.goneWithin(proc, graceMs)) {
+          await this.drainBriefly(proc);
+          this.closePipes(proc);
+          return this.finish(proc);
+        }
+      }
+      this.signal(proc, "SIGKILL");
+      await this.goneWithin(proc, ACP_KILL_GRACE_MS);
+      this.closePipes(proc);
+      return this.finish(proc);
+    })();
+    return proc.terminating;
+  }
+  /** After a clean exit, give stdio a moment to deliver what the adapter wrote last (it normally closes at once). */
+  async drainBriefly(proc) {
+    if (proc.finished) return;
+    await Promise.race([new Promise((resolve) => proc.child.once("close", () => resolve())), sleep(250)]);
+  }
+  // ---- write / note / outbox / commit --------------------------------------------------------------------------------------
+  /**
+   * Atomic (one synchronous step, so no other request interleaves): refused unless `spawnId` is the process running now; a cause
+   * already in raw is a duplicate; otherwise secrets join the stderr redaction, the LOGGED line is appended as `down`, and the line
+   * with secrets substituted goes to stdin. Append before stdin: a line that reached the adapter always has its record.
+   */
+  write(spawnId, line, annotation, redact) {
+    const proc = this.proc;
+    if (!proc || proc.state !== "running" || proc.terminateReason) return { status: "refused", reason: "not_running" };
+    if (proc.spawnId !== spawnId) return { status: "refused", reason: "spawn_mismatch" };
+    const key = causeKeyOf(annotation.cause);
+    const existing = this.downs.get(key);
+    if (existing !== void 0) return { status: "duplicate", o: existing };
+    if (line.includes("\n")) throw new KeeperMethodError(AcpErrorCode.badRequest, "A down line may not contain a newline");
+    if (line.length > ACP_MAX_RECORD_BYTES / 4 && Buffer.byteLength(JSON.stringify(line)) > ACP_MAX_RECORD_BYTES - 64 * 1024)
+      throw new KeeperMethodError(AcpErrorCode.badRequest, "Down line exceeds the record limit");
+    let stdinLine = line;
+    for (const { ref, value } of redact) stdinLine = stdinLine.split(ref).join(jsonEscaped(value));
+    this.stderr.addSecrets(redact.map((r) => r.value));
+    const record = this.appendRaw({ k: "down", l: line, a: annotation, ...redact.length > 0 ? { redact: redact.map((r) => r.ref) } : {} });
+    this.downs.set(key, record.o);
+    this.envelope.down(line, record.t);
+    proc.child.stdin.write(`${stdinLine}
+`);
+    return { status: "written", o: record.o };
+  }
+  note(note) {
+    return { o: this.appendRaw({ k: "note", n: note }).o };
+  }
+  outboxAppend(entries) {
+    let last = this.lastSeq;
+    for (const entry of entries) {
+      if (last !== null && entry.seq <= last) throw new KeeperMethodError(AcpErrorCode.badRequest, `Outbox seq ${entry.seq} does not follow ${last}`);
+      last = entry.seq;
+    }
+    let first = -1;
+    let lastO = -1;
+    for (const entry of entries) {
+      const record = this.outbox.append({ k: "frame", seq: entry.seq, src: entry.src, frame: entry.frame });
+      if (first < 0) first = record.o;
+      lastO = record.o;
+      this.lastSeq = entry.seq;
+    }
+    return { first, last: lastO };
+  }
+  /** Checkpoint, then outbox truncation (with its watermark), then raw truncation — never past the latest checkpoint. */
+  commit(params) {
+    const rawState = this.raw.state();
+    if (params.checkpoint) {
+      if (params.checkpoint.offset > rawState.head) throw new KeeperMethodError(AcpErrorCode.badRequest, "Checkpoint offset is beyond the raw head");
+      this.raw.writeCheckpoint(params.checkpoint.offset, Buffer.from(params.checkpoint.blob, "base64"));
+    }
+    if (params.outbox) {
+      if (params.outbox.through > this.outbox.state().head) throw new KeeperMethodError(AcpErrorCode.badRequest, "Outbox commit is beyond the outbox head");
+      this.outbox.commit(params.outbox.through, params.outbox.tail);
+    }
+    if (params.rawThrough !== void 0) {
+      const checkpointOffset = this.raw.latestCheckpoint()?.offset ?? -1;
+      if (params.rawThrough > checkpointOffset) throw new KeeperMethodError(AcpErrorCode.badRequest, "Raw may only be truncated through the latest checkpoint");
+      this.raw.commit(params.rawThrough);
+      for (const [key, o] of this.downs) if (o <= params.rawThrough) this.downs.delete(key);
+    }
+    return { raw: this.streamState("raw"), outbox: this.streamState("outbox"), checkpointOffset: this.raw.latestCheckpoint()?.offset ?? -1 };
+  }
+  // ---- read ------------------------------------------------------------------------------------------------------------------
+  read(stream, from, limit = ACP_READ_MAX_RECORDS) {
+    const log = stream === "raw" ? this.raw : this.outbox;
+    const result = log.readFrom(from, Math.min(limit, ACP_READ_MAX_RECORDS), { maxBytes: ACP_READ_MAX_BYTES });
+    const state = log.state();
+    const next = result.records.length > 0 ? result.records[result.records.length - 1].o + 1 : Math.max(from, result.first);
+    return { records: result.records, first: result.first, head: state.head, next, truncated: result.truncated };
+  }
+  source(stream) {
+    const log = stream === "raw" ? this.raw : this.outbox;
+    const inner = log.asEventSource({ maxBytes: ACP_READ_MAX_BYTES });
+    return { read: (from, limit, options) => inner.read(from, Math.min(limit, MAX_EVENT_RECORDS), options), watch: (notify) => inner.watch(notify) };
+  }
+  /** Is a `down` with this cause in raw (the in-process lookup of the daemon's fallback)? */
+  hasDown(cause) {
+    if (!this.downsComplete) this.downsFrom(0);
+    return this.downs.has(causeKeyOf(cause));
+  }
+  /** Every retained `down` with a cause at or after `from` (scans raw once for a session this owner did not create). */
+  downsFrom(from) {
+    if (!this.downsComplete) {
+      let next = this.raw.state().first;
+      for (; ; ) {
+        const { records } = this.raw.readFrom(next, ACP_READ_MAX_RECORDS, { maxBytes: ACP_READ_MAX_BYTES });
+        if (records.length === 0) break;
+        for (const record of records) {
+          const cause = record.k === "down" ? record.a?.cause : void 0;
+          if (cause && Number.isSafeInteger(cause.o) && Number.isSafeInteger(cause.i)) this.downs.set(causeKeyOf(cause), record.o);
+        }
+        next = records[records.length - 1].o + 1;
+      }
+      this.downsComplete = true;
+    }
+    const downs = [...this.downs.entries()].filter(([, o]) => o >= from).sort((a, b) => a[1] - b[1]).map(([key, o]) => {
+      const [co, ci] = key.split(":").map(Number);
+      return { o, cause: { o: co, i: ci } };
+    });
+    const state = this.raw.state();
+    return { downs, first: state.first, head: state.head };
+  }
+  // ---- state -----------------------------------------------------------------------------------------------------------------
+  streamState(stream) {
+    const s = (stream === "raw" ? this.raw : this.outbox).state();
+    return { head: s.head, first: s.first, next: s.next, committed: s.committed, bytes: s.bytes, overQuota: s.overQuota };
+  }
+  get overQuota() {
+    return this.raw.state().overQuota || this.outbox.state().overQuota;
+  }
+  processInfo() {
+    const proc = this.proc;
+    if (proc && proc.state !== "exited") return { state: proc.state, spawnId: proc.spawnId, pid: proc.pid, pgid: proc.pgid, startTime: proc.startTime, sinceEpochMs: proc.sinceMs };
+    if (proc || this.meta.spawn) return { state: "exited", spawnId: proc?.spawnId ?? this.meta.spawn?.spawnId ?? null, exit: this.lastExit };
+    return { state: "none" };
+  }
+  /**
+   * A keeper loss (spec §5.3): the process this session's metadata names was not started by this keeper, so whatever it was is
+   * over for this session. `proc exit{reason:'keeper_lost'}` is appended with the stderr tail the file kept, and the session is exited.
+   */
+  recordKeeperLost(stderrTail) {
+    let exit = null;
+    try {
+      const record = this.appendRaw({ k: "proc", kind: "exit", code: null, signal: null, stderrTail, reason: "keeper_lost" });
+      exit = { code: null, signal: null, stderrTail, reason: "keeper_lost", o: record.o, atMs: record.t };
+    } catch (error) {
+      this.report(error);
+    }
+    this.lastExit = exit;
+    this.meta.exited = true;
+    this.meta.lastExit = exit;
+    this.saveMeta();
+    return exit;
+  }
+  summary() {
+    const outbox = this.outbox.state();
+    return {
+      sessionKey: this.meta.sessionKey,
+      label: this.meta.label,
+      createdAtMs: this.meta.createdAtMs,
+      process: this.processInfo(),
+      raw: this.streamState("raw"),
+      outbox: { ...this.streamState("outbox"), committedTail: outbox.committedTail, lastSeq: this.lastSeq }
+    };
+  }
+  attach() {
+    const summary = this.summary();
+    const raw = this.raw.state();
+    const checkpoint = this.raw.latestCheckpoint();
+    const cp = checkpoint ? { seq: checkpoint.seq, offset: checkpoint.offset, t: checkpoint.t, blob: checkpoint.blob.toString("base64") } : null;
+    return { ...summary, head: raw.head, committed: raw.committed, committedTail: this.outbox.state().committedTail, checkpoint: cp, envelope: this.envelope.snapshot() };
+  }
+  /** Closes the streams (the process must have exited). `remove` also deletes what the caller keeps on disk for it. */
+  close() {
+    this.released = true;
+    this.stderr.close();
+    try {
+      this.raw.close();
+    } catch (error) {
+      this.report(error);
+    }
+    try {
+      this.outbox.close();
+    } catch (error) {
+      this.report(error);
+    }
+  }
+};
+
+// src/workstation/keepers/acp/host.ts
+var META_TMP = `${SESSION_FILE}.tmp`;
+function privateDir(dir) {
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+}
+function atomicJson(file, value) {
+  const temp = path4.join(path4.dirname(file), META_TMP);
+  const fd = openSync4(temp, "w", 384);
+  try {
+    const data = Buffer.from(JSON.stringify(value));
+    let written = 0;
+    while (written < data.length) written += writeSync3(fd, data, written, data.length - written);
+    fsyncSync2(fd);
+  } finally {
+    closeSync4(fd);
+  }
+  renameSync4(temp, file);
+}
+var sessionDirName = (sessionKey) => createHash("sha256").update(sessionKey).digest("hex").slice(0, 32);
+var labelText = (label) => {
+  for (const key of ["agentKey", "agentId"]) if (typeof label[key] === "string" && label[key]) return label[key].slice(0, 128);
+  return "adapter";
+};
+var AcpHost = class {
+  constructor(options) {
+    this.options = options;
+    this.sessionsDir = path4.join(options.dataDir, "sessions");
+    this.now = options.now ?? Date.now;
+    this.logLine = options.log ?? (() => {
+    });
+  }
+  options;
+  sessions = /* @__PURE__ */ new Map();
+  dirs = /* @__PURE__ */ new Map();
+  sessionsDir;
+  now;
+  logLine;
+  diskTimer;
+  maintenanceTimer;
+  stdoutHeld = false;
+  stopping = false;
+  adopting;
+  /** Lost adapters of adopted sessions still being settled (SIGTERM, grace, SIGKILL), by key: a spawn into one waits (minor 8). */
+  settling = /* @__PURE__ */ new Map();
+  report(error) {
+    this.logLine(`acp: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  /** Start-up: adopt every session whose keeper is gone (keeper_lost), then start the disk guard and the periodic adoption. */
+  async open() {
+    privateDir(this.sessionsDir);
+    await this.adopt();
+    this.diskTimer = setInterval(() => {
+      void this.checkDisk();
+    }, ACP_DISK_CHECK_MS);
+    this.diskTimer.unref();
+    void this.checkDisk();
+    this.maintenanceTimer = setInterval(() => {
+      void this.adopt();
+    }, this.options.maintenanceMs ?? 6e4);
+    this.maintenanceTimer.unref();
+  }
+  async ownerAlive(owner) {
+    if (!owner || owner.pid === this.options.owner.pid) return false;
+    return (this.options.ownerAlive ?? manifestProcessLive)(owner);
+  }
+  /** Adopt now every session directory whose keeper is gone (what the periodic adoption does). */
+  adoptNow() {
+    return this.adopt();
+  }
+  adopt() {
+    this.adopting ??= (async () => {
+      const alive = /* @__PURE__ */ new Map();
+      const ownerAlive = (owner) => {
+        const key = JSON.stringify(owner ?? null);
+        let probe = alive.get(key);
+        if (!probe) alive.set(key, probe = this.ownerAlive(owner));
+        return probe;
+      };
+      for (const { dir, meta } of listSessionDirs(this.sessionsDir, (message) => this.logLine(`acp: ${message}`))) {
+        if (this.sessions.has(meta.sessionKey) || this.stopping) continue;
+        if (path4.basename(dir) !== sessionDirName(meta.sessionKey)) {
+          this.logLine(`acp: ${path4.basename(dir)}: misnamed session directory, left alone`);
+          continue;
+        }
+        try {
+          if (await ownerAlive(meta.owner)) continue;
+          if (this.sessions.has(meta.sessionKey)) continue;
+          await this.adoptOne(dir, meta);
+        } catch (error) {
+          this.report(error);
+        }
+      }
+    })().finally(() => {
+      this.adopting = void 0;
+    });
+    return this.adopting;
+  }
+  async adoptOne(dir, meta) {
+    meta.owner = { ...this.options.owner };
+    const lostRemoveOnExit = [...meta.removeOnExit];
+    const key = meta.sessionKey;
+    const session = this.openSession(dir, meta, { fresh: false });
+    this.sessions.set(key, session);
+    this.dirs.set(key, dir);
+    session.persist();
+    if (meta.spawn && !meta.exited) {
+      session.recordKeeperLost(stderrTailOf(dir));
+      let settled;
+      const settling = new Promise((resolve) => {
+        settled = resolve;
+      });
+      this.settling.set(key, settling);
+      void settling.then(() => {
+        if (this.settling.get(key) === settling) this.settling.delete(key);
+      });
+      let outcome;
+      try {
+        outcome = await settleLostAdapter(meta, () => {
+          try {
+            session.removeOnExit(lostRemoveOnExit);
+          } finally {
+            settled();
+          }
+        }, this.options.sweep);
+      } catch (error) {
+        settled();
+        throw error;
+      }
+      this.logLine(`acp: session ${key}: keeper lost; adapter group ${outcome}`);
+    } else if (lostRemoveOnExit.length > 0) session.removeOnExit(lostRemoveOnExit);
+  }
+  openSession(dir, meta, options) {
+    const onError = (error) => this.report(error);
+    const raw = StreamLog.open({ dir: path4.join(dir, "raw"), now: this.now, immediateKinds: ["proc"], onError, ...options.baseOffset !== void 0 ? { baseOffset: options.baseOffset } : {} });
+    let outbox;
+    try {
+      outbox = StreamLog.open({ dir: path4.join(dir, "outbox"), now: this.now, immediateKinds: [], onError });
+    } catch (error) {
+      raw.close();
+      throw error;
+    }
+    const session = new AcpSession({
+      meta,
+      raw,
+      outbox,
+      freshRaw: options.fresh,
+      detached: true,
+      stderrFile: path4.join(dir, STDERR_FILE),
+      saveMeta: (m) => atomicJson(path4.join(dir, SESSION_FILE), m),
+      now: this.now,
+      log: this.logLine
+    });
+    if (this.stdoutHeld) session.holdStdout(true);
+    return session;
+  }
+  find(sessionKey) {
+    const session = this.sessions.get(sessionKey);
+    if (!session) throw new KeeperMethodError(AcpErrorCode.notFound, "ACP session not found");
+    return session;
+  }
+  // ---- methods ---------------------------------------------------------------------------------------------------------------
+  async spawn(params) {
+    onlyKeys(params, ["sessionKey", "spec", "label", "baseOffset"]);
+    const sessionKey = sessionKeyOf(params.sessionKey);
+    const spec = spawnSpecOf(params.spec, [this.options.dataDir]);
+    const label = labelOf(params.label);
+    const baseOffset = params.baseOffset === void 0 ? void 0 : offsetOf(params.baseOffset, "baseOffset");
+    const existing = this.sessions.get(sessionKey);
+    if (existing) {
+      if (baseOffset !== void 0) bad("baseOffset only applies to a new session");
+      await this.settling.get(sessionKey);
+      return existing.spawn(spec);
+    }
+    if (this.sessions.size >= ACP_SESSION_LIMIT) throw new KeeperMethodError(AcpErrorCode.limit, "Too many ACP sessions in keeper-acp");
+    const dir = path4.join(this.sessionsDir, sessionDirName(sessionKey));
+    if (existsSync(dir)) {
+      const found = readSessionMeta(dir);
+      if (found === "unreadable") throw new KeeperMethodError(AcpErrorCode.unreadable, "This ACP session directory has unreadable metadata; it is left alone");
+      if (found !== "absent") {
+        if (found.sessionKey !== sessionKey || await this.ownerAlive(found.owner)) throw new KeeperMethodError(AcpErrorCode.foreign, "This ACP session belongs to another keeper-acp");
+        if (!this.sessions.has(sessionKey)) await this.adoptOne(dir, found);
+        const adopted = this.sessions.get(sessionKey);
+        if (baseOffset !== void 0) bad("baseOffset only applies to a new session");
+        await this.settling.get(sessionKey);
+        return adopted.spawn(spec);
+      }
+      rmSync2(dir, { recursive: true, force: true });
+    }
+    const meta = { v: 1, sessionKey, label, createdAtMs: this.now(), owner: { ...this.options.owner }, spawn: null, exited: false, removeOnExit: [], lastExit: null };
+    let session;
+    try {
+      privateDir(dir);
+      atomicJson(path4.join(dir, SESSION_FILE), meta);
+      session = this.openSession(dir, meta, { fresh: true, baseOffset });
+    } catch (error) {
+      rmSync2(dir, { recursive: true, force: true });
+      throw error;
+    }
+    this.sessions.set(sessionKey, session);
+    this.dirs.set(sessionKey, dir);
+    try {
+      return await session.spawn(spec);
+    } catch (error) {
+      if (this.sessions.get(sessionKey) === session) {
+        this.sessions.delete(sessionKey);
+        this.dirs.delete(sessionKey);
+      }
+      session.close();
+      rmSync2(dir, { recursive: true, force: true });
+      throw error;
+    }
+  }
+  list() {
+    return { sessions: [...this.sessions.values()].map((s) => s.summary()) };
+  }
+  attach(params) {
+    onlyKeys(params, ["sessionKey"]);
+    return this.find(sessionKeyOf(params.sessionKey)).attach();
+  }
+  write(params) {
+    onlyKeys(params, ["sessionKey", "spawnId", "line", "annotation", "redact"]);
+    const session = this.find(sessionKeyOf(params.sessionKey));
+    if (typeof params.spawnId !== "string" || !params.spawnId) bad("Invalid spawnId");
+    if (typeof params.line !== "string") bad("Invalid line");
+    return session.write(params.spawnId, params.line, annotationOf(params.annotation), redactionsOf(params.redact));
+  }
+  note(params) {
+    onlyKeys(params, ["sessionKey", "note"]);
+    return this.find(sessionKeyOf(params.sessionKey)).note(noteOf(params.note));
+  }
+  read(params) {
+    onlyKeys(params, ["sessionKey", "stream", "from", "limit"]);
+    const session = this.find(sessionKeyOf(params.sessionKey));
+    if (params.stream !== "raw" && params.stream !== "outbox") bad("Invalid stream");
+    const limit = params.limit === void 0 ? void 0 : offsetOf(params.limit, "limit", 1);
+    return session.read(params.stream, offsetOf(params.from, "from"), limit);
+  }
+  downs(params) {
+    onlyKeys(params, ["sessionKey", "from"]);
+    return this.find(sessionKeyOf(params.sessionKey)).downsFrom(params.from === void 0 ? 0 : offsetOf(params.from, "from"));
+  }
+  outboxAppend(params) {
+    onlyKeys(params, ["sessionKey", "entries"]);
+    return this.find(sessionKeyOf(params.sessionKey)).outboxAppend(outboxEntriesOf(params.entries));
+  }
+  commit(params) {
+    onlyKeys(params, ["sessionKey", "checkpoint", "outbox", "rawThrough"]);
+    const session = this.find(sessionKeyOf(params.sessionKey));
+    const checkpoint = params.checkpoint;
+    const outbox = params.outbox;
+    if (checkpoint !== void 0 && (typeof checkpoint !== "object" || checkpoint === null || typeof checkpoint.blob !== "string")) bad("Invalid checkpoint");
+    if (outbox !== void 0 && (typeof outbox !== "object" || outbox === null || typeof outbox.tail !== "object" || outbox.tail === null)) bad("Invalid outbox commit");
+    return session.commit({
+      ...checkpoint ? { checkpoint: { offset: offsetOf(checkpoint.offset, "checkpoint.offset", -1), blob: checkpoint.blob } } : {},
+      ...outbox ? { outbox: { through: offsetOf(outbox.through, "outbox.through", -1), tail: outbox.tail } } : {},
+      ...params.rawThrough !== void 0 ? { rawThrough: offsetOf(params.rawThrough, "rawThrough", -1) } : {}
+    });
+  }
+  async terminate(params) {
+    onlyKeys(params, ["sessionKey", "graceMs"]);
+    const session = this.find(sessionKeyOf(params.sessionKey));
+    const graceMs = params.graceMs === void 0 ? void 0 : Math.min(offsetOf(params.graceMs, "graceMs"), 6e4);
+    return { exit: await session.terminate(graceMs) };
+  }
+  release(params) {
+    onlyKeys(params, ["sessionKey"]);
+    const sessionKey = sessionKeyOf(params.sessionKey);
+    const session = this.find(sessionKey);
+    if (session.busy) throw new KeeperMethodError(AcpErrorCode.busy, "Terminate the process before releasing the session");
+    this.sessions.delete(sessionKey);
+    const dir = this.dirs.get(sessionKey);
+    this.dirs.delete(sessionKey);
+    session.close();
+    if (dir) rmSync2(dir, { recursive: true, force: true });
+    return { released: true };
+  }
+  source(stream) {
+    const parsed = parseAcpStream(stream);
+    return parsed ? this.sessions.get(parsed.sessionKey)?.source(parsed.stream) : void 0;
+  }
+  // ---- disk guard, activity, shutdown --------------------------------------------------------------------------------------------
+  async freeBytes() {
+    if (this.options.diskFree) return this.options.diskFree();
+    return new Promise((resolve, reject) => statfs(this.sessionsDir, (error, stats) => error ? reject(error) : resolve(Number(stats.bavail) * Number(stats.bsize))));
+  }
+  /** Spec §3.4's hard limit: with less than 1 GiB free, adapter stdout is no longer read (the adapter blocks) until space returns. */
+  async checkDisk() {
+    let free;
+    try {
+      free = await this.freeBytes();
+    } catch (error) {
+      this.report(error);
+      return;
+    }
+    const hold = free < ACP_MIN_FREE_DISK_BYTES;
+    if (hold === this.stdoutHeld) return;
+    this.stdoutHeld = hold;
+    this.logLine(`acp: ${hold ? "less than 1 GiB free: adapter stdout paused" : "disk space back: adapter stdout resumed"}`);
+    for (const session of this.sessions.values()) session.holdStdout(hold);
+  }
+  /** Adapters this keeper runs now (any state but exited). */
+  get runningAdapters() {
+    let count = 0;
+    for (const session of this.sessions.values()) if (session.running) count += 1;
+    return count;
+  }
+  /** Mechanical facts only (spec §3.5): sessions, running adapters, unanswered adapter requests; one item per session. */
+  activity() {
+    const items = [];
+    let running = 0;
+    let overQuota = 0;
+    let pendingInbound = 0;
+    for (const session of this.sessions.values()) {
+      const info = session.processInfo();
+      if (session.running) running += 1;
+      if (session.overQuota) overQuota += 1;
+      pendingInbound += session.pendingInbound;
+      const since = info.state === "exited" ? info.exit?.atMs ?? session.meta.createdAtMs : info.state === "none" ? session.meta.createdAtMs : info.sinceEpochMs;
+      items.push({ type: "acp", id: session.sessionKey, label: labelText(session.meta.label), state: info.state, sinceEpochMs: since });
+    }
+    return { metrics: { sessions: this.sessions.size, sessionsRunning: running, sessionsOverQuota: overQuota, pendingInbound, stdoutPaused: this.stdoutHeld ? 1 : 0 }, items };
+  }
+  /** The keeper stops: every adapter is terminated (`keeper_stopped`; force: SIGKILL at once) and every stream closed. */
+  async dispose(mode = "graceful") {
+    this.stopping = true;
+    clearInterval(this.diskTimer);
+    clearInterval(this.maintenanceTimer);
+    await Promise.all([...this.sessions.values()].map((s) => s.terminate(mode === "force" ? 0 : 1500, "keeper_stopped").catch((error) => this.report(error))));
+    for (const session of this.sessions.values()) session.close();
+  }
+};
+var ACP_IDLE_EXIT_MS = 24 * 60 * 60 * 1e3;
+var ACP_IDLE_CHECK_MS = 6e4;
+function createAcpKeeper(host, options = {}) {
+  const now = options.now ?? Date.now;
+  let idleTimer;
+  return {
+    capabilities: [ACP_CAPABILITY],
+    install(server) {
+      const idleExitMs = options.idleExitMs ?? ACP_IDLE_EXIT_MS;
+      let busyAt = now();
+      idleTimer = setInterval(() => {
+        if (server.authenticatedConnectionCount > 0 || host.runningAdapters > 0) {
+          busyAt = now();
+          return;
+        }
+        if (now() - busyAt < idleExitMs) return;
+        clearInterval(idleTimer);
+        options.log?.(`acp: no daemon connection and no running adapter for ${Math.round(idleExitMs / 6e4)} min; stopping`);
+        server.stopped("graceful");
+      }, options.idleCheckMs ?? ACP_IDLE_CHECK_MS);
+      idleTimer.unref();
+      server.register("acp.spawn", (params) => host.spawn(params), { startsWork: true });
+      server.register("acp.list", async () => {
+        await host.adoptNow();
+        return host.list();
+      });
+      server.register("acp.attach", (params) => host.attach(params));
+      server.register("acp.write", (params) => host.write(params));
+      server.register("acp.note", (params) => host.note(params));
+      server.register("acp.read", (params) => host.read(params));
+      server.register("acp.downs", (params) => host.downs(params));
+      server.register("acp.outbox.append", (params) => host.outboxAppend(params));
+      server.register("acp.commit", (params) => host.commit(params));
+      server.register("acp.terminate", (params) => host.terminate(params));
+      server.register("acp.release", (params) => host.release(params));
+      server.setStreamResolver((stream) => host.source(stream));
+      server.addActivitySampler(() => host.activity());
+    },
+    shutdown: (mode) => {
+      clearInterval(idleTimer);
+      return host.dispose(mode);
+    }
+  };
+}
+
+// src/workstation/keepers/acp/main.ts
+var protocolVersion = 1;
+await runKeeperMain({
+  kind: "acp",
+  protocolVersion,
+  create: async (config, { log }) => {
+    const host = new AcpHost({ dataDir: config.dataDir, owner: { pid: process.pid, gen: config.gen, bundleDir: config.bundleDir }, log });
+    await host.open();
+    return createAcpKeeper(host, { log });
+  }
+});
+export {
+  protocolVersion
+};