@proagentstore/cli 0.4.87 → 0.4.89

package/dist/browser-runner/coding/runtime.js

@@ -12,6 +12,19 @@ const MAX_PANE = 64 * 1024;
 export class CodingRuntime {
     reposBaseDir;
     sessions = new Map();
+    /**
+     * Coding sessions that are running here (#896).
+     *
+     * A Claude session survives a restart — it is re-spawned with `--resume <session_id>` and only
+     * the turn in flight is cut — but a Codex, Grok or raw-engine session restarts cold and its turn
+     * is gone. Both are named, because the owner is the one deciding whether to take the machine.
+     */
+    liveWork() {
+        return [...this.sessions.values()].map((s) => {
+            const engine = s.clientType ?? "";
+            return engine === "claude" ? "a Claude coding session (resumes after a restart)" : `a ${engine || "coding"} turn (lost on a restart)`;
+        });
+    }
     /** Background cold-start clones, one per folder (#858). */
     cloneJobs = new CloneJobs();
     /**

package/dist/browser-runner/index.js

@@ -38,6 +38,12 @@ function configFromArgs() {
         token: arg("--token", process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID()}`,
         instanceId: arg("--instance-id", process.env.PAGS_INSTANCE_ID),
         headless: flag("--headless") || process.env.PAGS_RUNNER_HEADLESS === "1",
+        // #896: the single-instance lock's identity and shutdown credential, passed by the parent
+        // (`runner connect`) that took the lock. Absent when nothing holds a lock — a bare
+        // `pags runner start`, or a CLI older than the lock — and then `/control/shutdown` refuses.
+        rsid: process.env.PAGS_RUNNER_RSID || undefined,
+        launch: process.env.PAGS_RUNNER_LAUNCH || undefined,
+        controlNonce: process.env.PAGS_RUNNER_CONTROL_NONCE || undefined,
     };
 }
 if (flag("--help") || flag("-h")) {

package/dist/browser-runner/local-apply/bridge.js

@@ -25,6 +25,7 @@
  * The trace carries classes, domains, decisions and artifact handles — never a typed value.
  */
 import { classifyApplyClick } from "./contract.js";
+import { CONFIRMATION_INTERVAL_SECONDS, CONFIRMATION_LOOKS, CONFIRMATION_TEXT_RE, confirmationMarker, observe, } from "./confirmation.js";
 import { ELEMENT_PROBE_FN } from "../commit-guard.js";
 import { normalize } from "../local-artifact/engine.js";
 import { evaluateResult, hostOf, refRole } from "../local-browser/bridge.js";
@@ -58,8 +59,15 @@ const CONSENT_NAME = /\b(agree|consent|terms|privacy|acknowledge|certify|accept|
 const CREDENTIAL_NAME = /password|passcode|one[- ]?time|\botp\b|verification code|security code|2fa|two[- ]factor/i;
 /** Keys that move between fields without entering or activating anything. */
 const SAFE_KEYS = /^(Tab|Shift\+Tab|Arrow(Up|Down|Left|Right)|Escape|Home|End|PageUp|PageDown)$/;
-/** Runs inside the page, through the browser's own evaluate tool — never offered to the CLI. */
+/**
+ * Runs inside the page, through the browser's own evaluate tool — never offered to the CLI.
+ *
+ * The success vocabulary is INTERPOLATED from `confirmation.ts` rather than written out here
+ * (#994): a second copy of that regex is how the "sent" family — the exact word SEEK uses — was
+ * missing from the detector while being present in nobody's tests, through three live runs.
+ */
 const INSPECT_PAGE = `() => {
+	const CONFIRMATION_TEXT_SOURCE = ${JSON.stringify(CONFIRMATION_TEXT_RE.source)};
 	const text = (document.body ? document.body.innerText : "").slice(0, 20000).toLowerCase();
 	const has = (s) => !!document.querySelector(s);
 	return {
@@ -70,7 +78,7 @@ const INSPECT_PAGE = `() => {
 		login: has('input[type=password]'),
 		duplicate: /you('ve| have) already applied|already applied (for|to) this|application (already exists|has already been (submitted|received))|duplicate application/.test(text),
 		antiBot: /unusual traffic|access (is )?denied|request (has been )?blocked|bot detected|checking (if the site connection is secure|your browser)/.test(text),
-		confirmed: /thank you for (your )?appl|application (has been |was )?(received|submitted)|we('ve| have) received your application|successfully (applied|submitted)/.test(text),
+		confirmed: new RegExp(CONFIRMATION_TEXT_SOURCE).test(text),
 		unavailable: /(?:this |the )?(?:job|position|posting|role|opportunity).{0,120}(?:has )?(?:expired|closed|been filled|is no longer available|is no longer accepting applications)|(?:expired|closed|no longer available|no longer accepting applications).{0,120}(?:job|position|posting|role|opportunity)/.test(text)
 			? (/expired/.test(text) ? "expired" : "unavailable")
 			: null,
@@ -120,6 +128,8 @@ export class ApplyBridge {
     /** Present only after the CLI explicitly reports a notice that the runner independently saw. */
     unavailable = null;
     submitAttempted = false;
+    /** What was seen after the submit click (#994) — read by the runtime to build the diagnostic. */
+    confirmation = null;
     submitted = null;
     /** The last thing that stopped the work and was not resolved — the block reason if the run ends here. */
     blocked = null;
@@ -609,17 +619,44 @@ export class ApplyBridge {
         this.submitAttempted = true;
         this.host.emit({ type: "submit.attempted", url: before.url, domain, detail: { class: "submit", gateId: this.host.gateId } });
         const res = await this.browser.callTool("browser_click", forward);
-        await this.browser.callTool("browser_wait_for", { time: 2 }).catch(() => undefined);
-        const after = res.isError ? null : await this.inspect();
-        if (after?.confirmed) {
-            this.submitted = { url: after.url, at: new Date(this.host.now()).toISOString(), gateId: this.host.gateId };
-            this.host.emit({ type: "submit.confirmed", url: after.url, domain: hostOf(after.url) ?? domain, detail: { gateId: this.host.gateId } });
+        // Look REPEATEDLY, not once (#994). The old path waited two seconds and read the page a
+        // single time, so a receipt that arrives on a navigation or a client-side re-render a moment
+        // later was simply not there yet when the only look happened. `submitAttempted` is already
+        // true above, so waiting longer cannot make a pressed button look unpressed.
+        const { after, looks } = res.isError ? { after: null, looks: 0 } : await this.awaitConfirmation(before);
+        const seen = observe(before, after, looks);
+        this.confirmation = seen;
+        const evidence = { looks: seen.looks, urlChanged: seen.urlChanged, titleChanged: seen.titleChanged };
+        if (seen.marker) {
+            const at = after;
+            this.submitted = { url: at.url, at: new Date(this.host.now()).toISOString(), gateId: this.host.gateId };
+            this.host.emit({ type: "submit.confirmed", url: at.url, domain: hostOf(at.url) ?? domain, detail: { gateId: this.host.gateId, marker: seen.marker, ...evidence } });
             return text("Submitted, and the site confirmed it. Stop now.");
         }
         this.blocked = { reason: "submit_unconfirmed", questions: ["The application was submitted but the site did not confirm it. Check the employer's site or your email before anything is retried."] };
-        this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId } });
+        this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId, ...evidence } });
         return text("The submit was pressed but no confirmation was seen. Do not press it again. Stop now.", true);
     }
+    /**
+     * Read the page until it confirms, or until the looks run out (#994).
+     *
+     * It returns the LAST page it read, not the first: when nothing confirms, the owner's
+     * diagnostic should describe where the browser actually ended up. Bounded by
+     * `CONFIRMATION_LOOKS` — an application run holds the owner's only browser, so "look again"
+     * must never become "sit here".
+     */
+    async awaitConfirmation(before) {
+        let after = null;
+        for (let i = 0; i < CONFIRMATION_LOOKS; i++) {
+            await this.browser.callTool("browser_wait_for", { time: CONFIRMATION_INTERVAL_SECONDS }).catch(() => undefined);
+            const page = await this.inspect();
+            if (page)
+                after = page;
+            if (confirmationMarker(before, page))
+                return { after: page, looks: i + 1 };
+        }
+        return { after, looks: CONFIRMATION_LOOKS };
+    }
     /** A cloud-persisted checkpoint, not a prompt instruction, authorizes each page's writes. */
     requireSupervisor(tool, actionClass) {
         if (this.supervisorApproved)

package/dist/browser-runner/local-apply/confirmation.js

@@ -0,0 +1,125 @@
+/**
+ * Did the employer's site confirm the submission? (#994)
+ *
+ * ── The live failure this module exists for
+ *
+ * Three distinct approved auto-submit runs on `au.seek.com` reached `submit.attempted` and all
+ * three ended terminal `blocked / submit_unconfirmed` with `submittedAt=null`: applications
+ * `435d31c8…` (run `a4bf5c0f…`), `71765edd…` (run `76416747…`) and `b6244557…` (run `2f2e88a5…`).
+ * The honest safety state was right — nothing was retried, and the owner was told to check the
+ * employer's site — but a 3/3 rate says the DETECTOR was wrong, not the sites.
+ *
+ * Three facts about the old detector, each read off the code rather than guessed at:
+ *
+ *  1. **The vocabulary had no "sent".** It matched `thank you for (your) appl`,
+ *     `application (has been|was) (received|submitted)`, `we('ve| have) received your application`
+ *     and `successfully (applied|submitted)` — and nothing else. SEEK's own post-apply wording is
+ *     the "sent" family ("Application sent", "Your application has been sent", "You've applied"),
+ *     so the one word the page actually uses was the one word the regex could not see.
+ *  2. **It looked once, 2 seconds after the click** (`browser_wait_for {time: 2}` then one
+ *     `inspect()`), so a success state that arrives on a navigation or a client-side re-render a
+ *     moment later was simply not there yet when the only look happened.
+ *  3. **Text was the only evidence considered.** The URL the click navigates to, the title, and
+ *     the site's own "you have already applied" notice were all collected by `INSPECT_PAGE` and
+ *     none of them counted.
+ *
+ * What remains UNVERIFIED, and is stated here rather than implied: no live SEEK page was captured
+ * while writing this, so which of the three was decisive for those three runs is not established.
+ * The tests below use realistic fixtures of the wording SEEK and the big ATSs publish, which the
+ * issue explicitly allows; a live capture would still be worth taking.
+ *
+ * ── What counts as confirmation
+ *
+ * A named marker, never a feeling. Every marker is an id this platform defines, and only the ID
+ * crosses the contract — never the text that matched it. That is the same rule `signalsOf` follows
+ * in `runtime.ts` for engine output, and for the same reason: an application page holds the
+ * owner's typed answers, and no redaction reliably separates those from the rest of the prose.
+ *
+ * The URL and duplicate markers are deliberately comparative — they need the page as it was BEFORE
+ * the click, which the submit path already has. A `/success` URL that was already there is not
+ * evidence of this click; "you have already applied" that was already there is somebody's earlier
+ * application, not this one.
+ */
+/**
+ * The success vocabulary, as ONE source used in two places: this module (tested in Node) and the
+ * in-page script (built from `.source`, executed in the browser). Two copies of a regex is how the
+ * "sent" family went missing from one of them for three live runs.
+ *
+ * Lower-cased text is matched, so the patterns carry no case class.
+ */
+export const CONFIRMATION_TEXT_RE = /thank you for (your )?appl|application (has been |was )?(received|submitted|sent)|we('ve| have) received your application|successfully (applied|submitted|sent)|your application (is|has been) (on its way|complete)|you(r application)?('ve| have)? (now )?applied|applied (on|to this job)|application (sent|complete|submitted) *[.!]?$/;
+/**
+ * A URL that is itself the receipt. Matched against the path and query of the page the click
+ * landed on, and only when the click CHANGED it.
+ *
+ * Kept narrow on purpose: `/apply` alone is the form, not the confirmation, and treating it as one
+ * would turn "the click did nothing" into "submitted".
+ */
+export const CONFIRMATION_URL_RE = /(^|\/)(apply|application|applications|job)?[^/]*\/(success|succeeded|complete|completed|confirmation|confirmed|submitted|sent|thank-?you|receipt)(\/|$|\?)|[?&](applied|submitted|success)=(1|true|yes)/;
+/** Ordered by how strong the evidence is: the first match is the one recorded. */
+export function confirmationMarker(before, after) {
+    if (!after)
+        return null;
+    if (after.confirmed)
+        return "page_text";
+    const url = urlPathAndQuery(after.url).toLowerCase();
+    if (CONFIRMATION_URL_RE.test(url) && !!before && urlPathAndQuery(before.url).toLowerCase() !== url)
+        return "url_receipt";
+    // The site's own duplicate notice, but ONLY if it appeared after this click: "you have already
+    // applied" that was on the page beforehand is an earlier application of the owner's, and
+    // reading it as this run's success would record a submission that never happened.
+    if (after.duplicate && before && !before.duplicate)
+        return "already_applied_notice";
+    return null;
+}
+/** Path + query only: a host or a fragment is not evidence, and the host is recorded separately. */
+function urlPathAndQuery(raw) {
+    try {
+        const u = new URL(raw);
+        return `${u.pathname}${u.search}`;
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * How long to keep looking, and how often.
+ *
+ * The old path waited 2s once. These are bounded for the reason every wait in this runner is: an
+ * application run holds the owner's only browser, so "look again" must not become "sit here". Six
+ * looks over ~9s covers a navigation and a client-side re-render, and stops long before the
+ * engine's own minute budget notices.
+ */
+export const CONFIRMATION_LOOKS = 6;
+export const CONFIRMATION_INTERVAL_SECONDS = 1.5;
+export function observe(before, after, looks) {
+    return {
+        marker: confirmationMarker(before, after),
+        looks,
+        urlChanged: !!after && !!before && after.url !== before.url,
+        titleChanged: !!after && !!before && after.title !== before.title,
+        unreadable: !after,
+    };
+}
+/**
+ * The closed-vocabulary signals that go on the run's diagnostic when a submit was pressed and not
+ * confirmed, so the owner's record says what was seen rather than only what was not.
+ *
+ * Each is an id, so nothing here can carry page text; together they distinguish the three cases a
+ * person would act on differently: the page never changed (the click may not have landed), the page
+ * moved but said nothing this detector knows (a wording to add), and the page could not be read.
+ */
+export function confirmationSignals(o) {
+    const out = [];
+    if (o.unreadable)
+        out.push("confirmation_page_unreadable");
+    else if (!o.marker)
+        out.push("confirmation_no_marker");
+    if (o.urlChanged)
+        out.push("confirmation_url_changed");
+    else if (!o.unreadable)
+        out.push("confirmation_url_unchanged");
+    if (o.titleChanged)
+        out.push("confirmation_title_changed");
+    return out;
+}

package/dist/browser-runner/local-apply/contract.js

@@ -82,31 +82,38 @@ export const LOCAL_APPLY_BLOCK_REASONS = [
  * dispatch, naming the update, rather than silently producing the older behaviour (`apply.ts`
  * `runnerContractProblem`).
  *
- * ── Why it moved to 0.4.85 (#989)
+ * ── Why it moved to 0.4.89 (#994)
  *
- * #985 fixed the runner's click classification — the press that OPENS a SEEK application stopped
- * being read as the final submit ({@link classifyApplyClick}) — and that fix lives in
- * `packages/browser-runner`, which ships INSIDE the published CLI. The commit did not bump
- * `packages/cli/package.json`, and `publish-npm.yml` publishes only a version that is new, so
- * nothing was published: the live machine kept running 0.4.84, whose bundled bridge still tests
- * `FALLBACK_COMMIT_RE`. The next live run therefore reproduced the defect the fix had already
- * removed from `main` — `browser_click → class: submit → refused: fill_and_review`, no `rule`
- * field, three seconds after the cloud's own `continue` — and the only durable evidence that the
- * code was old was the absence of a field nobody looks for.
+ * #994 makes a post-click confirmation observable and recognises SEEK's "application sent"
+ * receipt wording. It also carries only closed-vocabulary evidence when a pressed submit remains
+ * unconfirmed. Those changes live in `packages/browser-runner`, which ships INSIDE the published
+ * CLI. A machine below this floor cannot provide that evidence, so it must not silently look
+ * equivalent to a current runner.
  *
  * A behaviour change in the runner is a CONTRACT change, because the cloud's decisions assume it.
- * So this floor moves with it: a machine that cannot tell the entry control from the final submit
- * is refused with a sentence that says so, instead of ending `awaiting_review` having typed
- * nothing.
+ * So this floor moves with it: a machine that cannot observe a post-submit receipt is refused
+ * with a sentence that says so, rather than reporting an unhelpful `submit_unconfirmed` state.
  *
  * Bump this when the runner's half of the contract changes again, together with the CLI version
  * that ships it — `policy.test.ts` pins the pair, so the floor cannot name a release that has not
  * been published. `cliAtLeast` treats an unreported version as capable, which is the convention
  * every MIN_CLI gate here follows.
  */
-export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.85";
-export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output"];
-export const LOCAL_APPLY_SIGNALS = ["approval_policy_blocked", "bridge_tools_missing", "auth_prompt", "no_output", "engine_refused_task"];
+export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.89";
+export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output", "submit_unconfirmed"];
+export const LOCAL_APPLY_CONFIRMATION_MARKERS = ["page_text", "url_receipt", "already_applied_notice"];
+export const LOCAL_APPLY_SIGNALS = [
+    "approval_policy_blocked",
+    "bridge_tools_missing",
+    "auth_prompt",
+    "no_output",
+    "engine_refused_task",
+    "confirmation_no_marker",
+    "confirmation_page_unreadable",
+    "confirmation_url_changed",
+    "confirmation_url_unchanged",
+    "confirmation_title_changed",
+];
 export const LOCAL_APPLY_UNAVAILABLE_REASONS = ["expired", "unavailable"];
 export const LOCAL_APPLY_EVENT_TYPES = [
     "engine.auth_checked",
@@ -140,7 +147,11 @@ const isHttpUrl = (v) => /^https?:\/\/[^\s/]+/i.test(v);
 // submit since #985, and this whitelist silently dropped it — so the one fact that tells "it
 // refused the control that opens the form" from "it refused the real submit" never reached the
 // cloud trace, which is where the live investigation needed it.
-const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded"]);
+// `marker`, `looks`, `urlChanged` and `titleChanged` are #994's post-click evidence: a marker ID
+// from `LOCAL_APPLY_CONFIRMATION_MARKERS`, how many times the page was read, and whether it moved.
+// Each is an id, a count or a boolean — the same whitelist rule as everything else here, so no page
+// text and no typed value can ride along on a `submit.confirmed` / `submit.unconfirmed` event.
+const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded", "marker", "looks", "urlChanged", "titleChanged"]);
 /** A validated event, or null. Detail keeps only whitelisted, primitive, bounded values. */
 export function parseLocalApplyEvent(raw) {
     if (!raw || typeof raw !== "object")
@@ -167,6 +178,15 @@ export function parseLocalApplyEvent(raw) {
         for (const [k, v] of Object.entries(o.detail)) {
             if (!DETAIL_KEYS.has(k))
                 continue;
+            // #994: `marker` is a runner-defined confirmation ID, never the success sentence the
+            // page displayed. Keep the closed vocabulary closed even if a compromised/outdated
+            // runner tries to use this otherwise-string field as a prose channel.
+            if (k === "marker") {
+                const marker = oneOf(LOCAL_APPLY_CONFIRMATION_MARKERS, v);
+                if (marker)
+                    detail[k] = marker;
+                continue;
+            }
             if (typeof v === "string")
                 detail[k] = v.slice(0, 300);
             else if (typeof v === "number" || typeof v === "boolean")

package/dist/browser-runner/local-apply/runtime.js

@@ -33,6 +33,7 @@ import { redactText, secretEnvValues } from "../local-browser/contract.js";
 import { finalText, missingLogin, signInHelp } from "../local-browser/engine.js";
 import { resolveWorkspacePath } from "../local-browser/runtime.js";
 import { ApplyBridge } from "./bridge.js";
+import { confirmationSignals } from "./confirmation.js";
 import { LOCAL_APPLY_AUTH_MODES, LOCAL_APPLY_CAPS, LOCAL_APPLY_ENGINES, LOCAL_APPLY_MODES, LOCAL_APPLY_TASK_TYPE, } from "./contract.js";
 import { applyPrompt, buildApplyEngineSpec, observedApplyAuth } from "./engine.js";
 const MAX_EVENTS = 1000;
@@ -167,6 +168,10 @@ function bridgeUnusedHelp(engine, d) {
 export class LocalApplyRuntime {
     deps;
     runs = new Map();
+    /** Application fills that a restart would lose (#896) — their state is in this process. */
+    liveWork() {
+        return [...this.runs.values()].filter((r) => r.state !== "ended").map((r) => `an application fill (${r.envelope.applicationId.slice(0, 8)})`);
+    }
     root;
     now;
     spawn;
@@ -368,8 +373,20 @@ export class LocalApplyRuntime {
             return { outcome: "submitted", summary, submitted: b.submitted };
         if (b?.unavailable)
             return { outcome: "blocked", summary, blockReason: "job_unavailable", unavailable: b.unavailable };
-        if (b?.submitAttempted)
-            return { outcome: "blocked", summary, blockReason: "submit_unconfirmed", questions: b.blocked?.questions ?? [] };
+        // #994: a pressed submit nobody confirmed now SAYS what was seen. The outcome is unchanged —
+        // terminal, no retry, the owner told to check the employer's site — because that safety is
+        // correct; what was missing was any way to tell "the click never moved the page" from "the
+        // page moved and said something this platform does not recognise yet".
+        if (b?.submitAttempted) {
+            const d = this.diagnosticOf(run, code, "submit_unconfirmed");
+            return {
+                outcome: "blocked",
+                summary,
+                blockReason: "submit_unconfirmed",
+                questions: b.blocked?.questions ?? [],
+                diagnostic: { ...d, signals: [...d.signals, ...(b.confirmation ? confirmationSignals(b.confirmation) : [])] },
+            };
+        }
         if (b?.reviewReady)
             return { outcome: "awaiting_review", summary };
         if (!b?.filled && missingLogin(e.engine, run.output.join("\n")))

package/dist/browser-runner/local-artifact/runtime.js

@@ -111,6 +111,10 @@ class Pause extends Error {
 export class LocalArtifactRuntime {
     deps;
     runs = new Map();
+    /** Tailoring runs that a restart would lose (#896) — their state is in this process. */
+    liveWork() {
+        return [...this.runs.values()].filter((r) => r.state !== "ended").map((r) => `a tailoring run (${r.envelope.runId.slice(0, 8)})`);
+    }
     root;
     now;
     spawn;

package/dist/browser-runner/local-browser/runtime.js

@@ -138,6 +138,15 @@ export function resolveWorkspacePath(path, home) {
 export class LocalBrowserRuntime {
     deps;
     runs = new Map();
+    /**
+     * Research runs that would be LOST if this process stopped (#896).
+     *
+     * Their state is in this process's memory: a restart does not resume them, and the cloud only
+     * gives up on them minutes later. So `--replace` asks before taking the machine.
+     */
+    liveWork() {
+        return [...this.runs.values()].filter((r) => r.state !== "ended").map((r) => `a browser research run (${r.envelope.instanceId.slice(0, 8)})`);
+    }
     root;
     now;
     spawn;

package/dist/browser-runner/runner.js

@@ -112,6 +112,20 @@ export class LocalRunner {
         if (expired > 0)
             console.log(`[runner] expired ${expired} orphaned in-flight task(s) from a previous session`);
     }
+    /**
+     * What this process is doing that a restart would destroy (#896).
+     *
+     * `close()` stops every local runtime it owns, so "restart the runner" is not a free action: a
+     * Claude coding session resumes, but a Codex or Grok turn, a browser research run, a tailoring
+     * run and an application fill are each lost, and the cloud only reports them `runner_lost`
+     * minutes later. `pags up --replace` reads this and refuses while anything is live unless the
+     * owner passes `--now`, which is the whole reason it is reported rather than counted silently.
+     */
+    liveWork() {
+        const coding = this.coding.liveWork();
+        const local = [...this.localBrowser.liveWork(), ...this.localArtifact.liveWork(), ...this.localApply.liveWork()];
+        return { codingTurns: coding.length, localRuns: local.length, detail: [...coding, ...local].slice(0, 10) };
+    }
     capabilities() {
         return {
             runtime: "pags-browser-runtime",
@@ -255,6 +269,17 @@ export class LocalRunner {
      * holding a live browser until someone `kill -9`ed it. That kill is exactly
      * what orphans the browser, so an unswallowed error here MADE the leak.
      */
+    /**
+     * Stop because somebody with the lock asked (#896) — the same teardown a signal runs.
+     *
+     * Deliberately not a second shutdown path: `index.ts`'s handler is idempotent and time-boxed
+     * (#274), so raising SIGTERM on ourselves reuses it rather than re-implementing it, which is
+     * what keeps "asked to stop" and "signalled to stop" from drifting apart.
+     */
+    async requestShutdown(reason) {
+        console.log(`[runner] stopping on request (${reason.slice(0, 60)})`);
+        process.kill(process.pid, "SIGTERM");
+    }
     async close() {
         this.localBrowser.closeAll();
         this.localArtifact.closeAll();

package/dist/browser-runner/server.js

@@ -57,6 +57,12 @@ async function route(runner, req, res) {
     const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
     const path = url.pathname.replace(/\/$/, "") || "/";
     if ((req.method === "GET" || req.method === "POST") && path === "/health") {
+        // #896: a health check that cannot say WHO answered is not enough to decide anything with.
+        // A contender for the single-instance lock has a pid and a port from the lock file; what it
+        // needs is proof that the process on that port is the one the lock names (`rsid`), and what
+        // `--replace` needs on top of that is what would be destroyed by stopping it (`work`).
+        // Without the id, a recycled port answering "ok" reads as a live holder; without the work
+        // counts, replacing silently ends a Codex turn, a research run or an application fill.
         return json(res, 200, {
             ok: true,
             service: "proagentstore-browser-runtime",
@@ -64,8 +70,36 @@ async function route(runner, req, res) {
             controlPlane: "pags",
             runtimePlane: "pags",
             instanceId: runner.config.instanceId,
+            rsid: runner.config.rsid ?? null,
+            pid: process.pid,
+            launch: runner.config.launch ?? null,
+            work: runner.liveWork(),
         });
     }
+    /**
+     * `POST /control/shutdown` — stop gracefully, when asked by somebody holding the lock (#896).
+     *
+     * This is what makes `pags up --replace` and `pags down` an ASK rather than a kill. The caller
+     * proves it is entitled by quoting the nonce from the mode-600 lock file, which only a process
+     * able to read the owner's own lock can do; `pkill`, which this replaced, proved nothing and
+     * stopped anything matching a name — including another account's runner and a service's.
+     *
+     * The drain itself is `close()`, the same teardown a signal runs, so there is one shutdown path
+     * and not a second one that forgets something.
+     */
+    if (req.method === "POST" && path === "/control/shutdown") {
+        const expected = runner.config.controlNonce ?? "";
+        const body = (await readJson(req).catch(() => null));
+        const given = typeof body?.nonce === "string" ? body.nonce : "";
+        if (!expected || !given || given !== expected)
+            return json(res, 403, { error: "This runner only stops for a request carrying its own lock's nonce." });
+        const work = runner.liveWork();
+        json(res, 202, { stopping: true, pid: process.pid, work });
+        // Answer first, then stop: the caller is waiting for the pid to go, and a reply written
+        // after teardown never arrives.
+        setTimeout(() => void runner.requestShutdown(typeof body?.reason === "string" ? body.reason : "requested"), 10);
+        return;
+    }
     if ((req.method === "GET" || req.method === "POST") && path === "/capabilities") {
         return json(res, 200, runner.capabilities());
     }

package/dist/index.js

@@ -1098,7 +1098,7 @@ var publishCommand = new Command6("publish").description("Publish an agent to Pr
 
 // src/commands/runner/command.ts
 import { spawn as spawn4 } from "child_process";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { Command as Command7 } from "commander";
 
 // src/commands/runner/process.ts
@@ -1597,7 +1597,16 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       const [relayRttMs, sessions] = await Promise.all([first ? first.probeRtt() : Promise.resolve(null), readSessionResources(localUrl, runnerToken)]);
       const resources = sampleResources(void 0, void 0, {
         disk: sampleDisk() ?? void 0,
-        runner: { startedAt: processStartedAt, uptimeSec: Math.round(process.uptime()), starts24h, relayReconnects },
+        runner: {
+          startedAt: processStartedAt,
+          uptimeSec: Math.round(process.uptime()),
+          starts24h,
+          relayReconnects,
+          // #896: who is heartbeating. Set by `runner connect` from the lock it took.
+          ...process.env.PAGS_RUNNER_RSID ? { rsid: process.env.PAGS_RUNNER_RSID } : {},
+          pid: process.pid,
+          ...process.env.PAGS_RUNNER_LAUNCH ? { launch: process.env.PAGS_RUNNER_LAUNCH } : {}
+        },
         relayRttMs,
         sessions: sessions ?? void 0
       });
@@ -1853,7 +1862,204 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
   };
 }
 
+// src/runner-lock.ts
+import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { execFileSync as execFileSync2 } from "child_process";
+import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync, unlinkSync as unlinkSync2, writeSync } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join7 } from "path";
+function configDir(env = process.env) {
+  return env.PAGS_CONFIG_DIR?.trim() || join7(homedir3(), ".config", "proagentstore");
+}
+var accountKey = (account) => createHash("sha256").update(account.trim().toLowerCase()).digest("hex").slice(0, 12);
+var lockPath = (account, env = process.env) => join7(configDir(env), `up-${accountKey(account)}.lock`);
+function classifyHolder(facts) {
+  const lock = facts.lock;
+  if (!lock) return "unknown";
+  if (lock.v !== 1) return "unknown";
+  if (!lock.pid || !Number.isInteger(lock.pid)) return "unknown";
+  if (!facts.pidAlive) return "dead";
+  if (lock.pidStartedAt && facts.pidStartedAt && lock.pidStartedAt !== facts.pidStartedAt) return "dead";
+  if (facts.healthRsid && facts.healthRsid === lock.rsid) return "live";
+  return "unresponsive";
+}
+var isTakeable = (verdict) => verdict === "dead";
+function holderWhere(lock) {
+  if (lock.launch === "tmux") return `tmux session ${lock.launchDetail || "?"}`;
+  if (lock.launch === "service") return "a background service (launchd/systemd)";
+  if (lock.launch === "headless") return "headless";
+  return lock.launchDetail ? `terminal ${lock.launchDetail}` : "a terminal";
+}
+function holderMessage(lock, verdict) {
+  const since = new Date(lock.startedAt).toLocaleString();
+  const lines = [
+    `A \`pags up\` is already running for this account on this machine.`,
+    `  pid ${lock.pid}, started ${since}, CLI ${lock.version || "?"}, in ${holderWhere(lock)}.`
+  ];
+  if (verdict === "unresponsive") {
+    lines.push(`  It is NOT answering its health check \u2014 it may be asleep, stopped, or the machine may be overloaded.`);
+  }
+  if (verdict === "unknown") {
+    lines.push(`  Its lock file could not be read (a newer CLI may have written it), so it is assumed to be running.`);
+  }
+  lines.push("", "  What you can do:");
+  if (lock.launch === "tmux" && lock.launchDetail) lines.push(`    tmux attach -t ${lock.launchDetail}   \u2014 go to the one that is running`);
+  lines.push(
+    `    pags status                      \u2014 what it is doing, and anything else running here`,
+    lock.launch === "service" ? `    (this one is a service \u2014 stop its launchd/systemd unit rather than replacing it)` : `    pags up --replace                \u2014 stop that one gracefully, then take over`
+  );
+  return lines;
+}
+function detectLaunch(env = process.env, isTty = Boolean(process.stdout.isTTY)) {
+  if (env.PAGS_SERVICE === "1") return { launch: "service", detail: env.PAGS_SERVICE_NAME?.trim() || "" };
+  if (env.TMUX) return { launch: "tmux", detail: env.TMUX_PANE?.trim() || env.TMUX.split(",")[0]?.split("/").pop() || "" };
+  if (!isTty) return { launch: "headless", detail: "" };
+  return { launch: "tty", detail: env.TERM_SESSION_ID?.trim() || env.WINDOWID?.trim() || "" };
+}
+function pidAlive(pid) {
+  if (!pid || !Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+function pidStartedAt(pid) {
+  if (!pidAlive(pid)) return "";
+  try {
+    if (process.platform === "win32") {
+      const out = execFileSync2("wmic", ["process", "where", `ProcessId=${pid}`, "get", "CreationDate", "/value"], { encoding: "utf-8", timeout: 4e3, stdio: ["ignore", "pipe", "ignore"] });
+      return (out.match(/CreationDate=(\S+)/)?.[1] ?? "").trim();
+    }
+    return execFileSync2("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf-8", timeout: 4e3, stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+async function healthRsid(port, token = "", timeoutMs = 5e3, fetchImpl = fetch) {
+  if (!port) return null;
+  try {
+    const res = await fetchImpl(`http://127.0.0.1:${port}/health`, { headers: token ? { Authorization: `Bearer ${token}` } : {}, signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.rsid === "string" && body.rsid ? body.rsid : null;
+  } catch {
+    return null;
+  }
+}
+function readLock(path) {
+  try {
+    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    return parsed && typeof parsed === "object" && typeof parsed.rsid === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function inspectHolder(path, opts = {}) {
+  const lock = readLock(path);
+  if (!lock) return { lock: null, verdict: "unknown" };
+  const alive = pidAlive(lock.pid);
+  const facts = {
+    lock,
+    pidAlive: alive,
+    pidStartedAt: alive ? pidStartedAt(lock.pid) : "",
+    healthRsid: alive ? await healthRsid(lock.port, lock.runnerToken ?? "", opts.healthTimeoutMs ?? 5e3, opts.fetchImpl ?? fetch) : null
+  };
+  return { lock, verdict: classifyHolder(facts) };
+}
+async function acquireLock(input) {
+  const env = input.env ?? process.env;
+  const path = lockPath(input.account, env);
+  const rsid = input.rsid ?? randomUUID2();
+  const handoff = input.handoffFrom?.trim() || env.PAGS_LOCK_HANDOFF?.trim() || "";
+  mkdirSync5(configDir(env), { recursive: true });
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const written = tryWrite(path, buildLock(input, rsid, env));
+    if (written) return { ok: true, lock: written, path, tookOver: attempt === 0 ? "none" : "stale" };
+    const { lock: lock2, verdict: verdict2 } = await inspectHolder(path);
+    if (handoff && lock2?.rsid === handoff) {
+      renameAside(path, lock2.pid);
+      const taken = tryWrite(path, buildLock(input, rsid, env));
+      if (taken) return { ok: true, lock: taken, path, tookOver: "handoff" };
+      continue;
+    }
+    if (!isTakeable(verdict2)) return { ok: false, lock: lock2, path, verdict: verdict2 };
+    if (!takeAsideIfStill(path, lock2?.rsid ?? "", lock2?.pid ?? 0)) continue;
+  }
+  const { lock, verdict } = await inspectHolder(path);
+  return { ok: false, lock, path, verdict };
+}
+function buildLock(input, rsid, env) {
+  const { launch, detail } = detectLaunch(env);
+  const now = Date.now();
+  return {
+    v: 1,
+    rsid,
+    pid: process.pid,
+    pidStartedAt: pidStartedAt(process.pid),
+    startedAt: now,
+    port: input.port,
+    node: input.node,
+    machineId: input.machineId,
+    account: input.account,
+    version: input.version,
+    launch,
+    launchDetail: detail,
+    childPids: [],
+    nonce: randomUUID2(),
+    runnerToken: input.runnerToken ?? "",
+    heartbeatAt: now
+  };
+}
+function tryWrite(path, lock) {
+  let fd = null;
+  try {
+    fd = openSync(path, "wx", 384);
+    writeSync(fd, JSON.stringify(lock, null, 2));
+    return lock;
+  } catch (e) {
+    if (e.code === "EEXIST") return null;
+    throw e;
+  } finally {
+    if (fd !== null) closeSync(fd);
+  }
+}
+function renameAside(path, pid) {
+  const aside = `${path}.stale-${pid || "unknown"}`;
+  try {
+    renameSync(path, aside);
+    return aside;
+  } catch {
+    return null;
+  }
+}
+function takeAsideIfStill(path, deadRsid, pid) {
+  const aside = renameAside(path, pid);
+  if (!aside) return false;
+  const moved = readLock(aside);
+  if (moved && deadRsid && moved.rsid !== deadRsid) {
+    try {
+      renameSync(aside, path);
+    } catch {
+    }
+    return false;
+  }
+  return true;
+}
+function releaseLock(path, rsid) {
+  const current = readLock(path);
+  if (!current || current.rsid !== rsid) return false;
+  try {
+    unlinkSync2(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/commands/runner/command.ts
+import { hostname as hostname4 } from "os";
 function collectCapability(value, previous = []) {
   return [...previous, value];
 }
@@ -1865,9 +2071,23 @@ function createRunnerCommand() {
     await startRunnerForeground(opts);
   });
   command.command("connect <instanceIds...>").description("Start ONE local runtime, connect via WebSocket relay, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--runner-version <version>", "Runner version").option("--force", "Take over from another connected machine").option("--watch-instances", "Attach newly eligible agents while running, without a restart").action(async (instanceIds, opts) => {
-    const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID2()}`;
+    const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID3()}`;
     const host = clean(opts.host) || "127.0.0.1";
     const port = clean(opts.port) || String(await findFreePort2(49171));
+    const lockAccount = clean(process.env.PAGS_LOCK_ACCOUNT) || "";
+    let lockHeld = null;
+    if (lockAccount) {
+      const taken = await acquireLock({ account: lockAccount, node: hostname4(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
+      if (!taken.ok) {
+        for (const line of taken.lock ? holderMessage(taken.lock, taken.verdict) : ["Another `pags up` holds this machine for this account."]) writeError(line);
+        process.exit(1);
+      }
+      lockHeld = { path: taken.path, rsid: taken.lock.rsid, nonce: taken.lock.nonce, launch: taken.lock.launch };
+      writeLine(`STATUS runner-session=${taken.lock.rsid}`);
+    }
+    const releaseHeldLock = () => {
+      if (lockHeld) releaseLock(lockHeld.path, lockHeld.rsid);
+    };
     const localUrl = `http://${host}:${port}`;
     const primary = instanceIds[0];
     const runnerOpts = { ...opts, host, port, token: runnerToken };
@@ -1875,7 +2095,14 @@ function createRunnerCommand() {
     const runner = spawn4(spec.command, spec.args, {
       cwd: spec.cwd,
       stdio: ["ignore", "pipe", "pipe"],
-      shell: process.platform === "win32"
+      shell: process.platform === "win32",
+      // #896: the runtime answers `/health` with the lock's identity and stops for a
+      // request quoting its nonce — so a contender can prove who is on that port, and a
+      // replace is an authorisation rather than a signal aimed at a name pattern.
+      env: {
+        ...process.env,
+        ...lockHeld ? { PAGS_RUNNER_RSID: lockHeld.rsid, PAGS_RUNNER_CONTROL_NONCE: lockHeld.nonce, PAGS_RUNNER_LAUNCH: lockHeld.launch } : {}
+      }
     });
     runner.stdout?.on("data", (data) => process.stdout.write(data));
     runner.stderr?.on("data", (data) => process.stderr.write(data));
@@ -1887,6 +2114,7 @@ function createRunnerCommand() {
     });
     const shutdown = () => {
       shuttingDown = true;
+      releaseHeldLock();
       if (!runner.killed) runner.kill("SIGTERM");
     };
     process.once("exit", shutdown);
@@ -2023,14 +2251,14 @@ function createRunnerCommand() {
 var runnerCommand = createRunnerCommand();
 
 // src/commands/up.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { createRequire as createRequire2 } from "module";
 import { Command as Command8 } from "commander";
-import { hostname as hostname5 } from "os";
+import { hostname as hostname6 } from "os";
 
 // src/tui.ts
 import chalk from "chalk";
-import { hostname as hostname4 } from "os";
+import { hostname as hostname5 } from "os";
 import readline from "readline";
 var ACCENT = "#7c3aed";
 var c = chalk.hex(ACCENT);
@@ -2083,7 +2311,7 @@ function printStatus(state) {
   clearScreen();
   printLogo(state.version);
   const connected = state.runner === "online" && state.tunnel === "online" && state.registration === "registered";
-  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname4()));
+  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname5()));
   console.log("");
   const row = (kind, s, override) => {
     const { icon, label, note } = describe(kind, s);
@@ -2145,28 +2373,94 @@ async function waitForKey(keys, onInterrupt) {
   });
 }
 
+// src/runner-replace.ts
+var REPLACE_EXIT_TIMEOUT_MS = 3e4;
+function describeWork(work) {
+  if (work.detail.length) return work.detail.join(", ");
+  const parts = [];
+  if (work.codingTurns) parts.push(`${work.codingTurns} coding turn${work.codingTurns === 1 ? "" : "s"}`);
+  if (work.localRuns) parts.push(`${work.localRuns} local run${work.localRuns === 1 ? "" : "s"}`);
+  return parts.join(", ") || "work";
+}
+var hasWork = (work) => !!work && work.codingTurns + work.localRuns > 0;
+function replaceVerdict(lock, work, opts) {
+  if (lock.launch === "service") {
+    return {
+      allowed: false,
+      lines: [
+        `That runner is managed by a background service${lock.launchDetail ? ` (${lock.launchDetail})` : ""}, so replacing it would only make the service start it again.`,
+        "Stop its launchd/systemd unit instead, then run `pags up` here."
+      ]
+    };
+  }
+  if (hasWork(work) && !opts.now) {
+    return {
+      allowed: false,
+      lines: [
+        `That runner is busy: ${describeWork(work)}.`,
+        "Stopping it now would lose that work \u2014 a Codex or Grok turn, a research run, a tailoring run or an application fill do not survive a restart.",
+        "Wait for it to finish, or run `pags up --replace --now` to stop it anyway."
+      ]
+    };
+  }
+  return { allowed: true, lines: [] };
+}
+async function holderWork(lock, deps = {}) {
+  if (!lock.port) return null;
+  try {
+    const res = await (deps.fetchImpl ?? fetch)(`http://127.0.0.1:${lock.port}/health`, { headers: lock.runnerToken ? { Authorization: `Bearer ${lock.runnerToken}` } : {}, signal: AbortSignal.timeout(5e3) });
+    if (!res.ok) return null;
+    const body = await res.json();
+    const w2 = body.work;
+    if (!w2) return null;
+    const n = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.floor(v) : 0;
+    return { codingTurns: n(w2.codingTurns), localRuns: n(w2.localRuns), detail: (Array.isArray(w2.detail) ? w2.detail : []).filter((x) => typeof x === "string").slice(0, 10) };
+  } catch {
+    return null;
+  }
+}
+async function replaceHolder(lock, opts = {}, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const alive = deps.alive ?? pidAlive;
+  const now = deps.now ?? Date.now;
+  const work = await holderWork(lock, deps);
+  const verdict = replaceVerdict(lock, work, opts);
+  if (!verdict.allowed) return { ok: false, lines: verdict.lines };
+  if (!lock.port) {
+    return { ok: false, lines: [`The runner holding this machine (pid ${lock.pid}) does not say which port it is on, so it cannot be asked to stop.`, "Stop it where it is running, then try again."] };
+  }
+  try {
+    const res = await fetchImpl(`http://127.0.0.1:${lock.port}/control/shutdown`, {
+      method: "POST",
+      // The runner authorises every request, and the nonce authorises THIS one: the token says
+      // "I may talk to you", the nonce says "I hold your lock" (#896).
+      headers: { "Content-Type": "application/json", ...lock.runnerToken ? { Authorization: `Bearer ${lock.runnerToken}` } : {} },
+      body: JSON.stringify({ nonce: lock.nonce, reason: "replaced" }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return { ok: false, lines: [`The runner on pid ${lock.pid} refused the stop request (HTTP ${res.status}).`, "Stop it where it is running, then try again."] };
+  } catch (e) {
+    return { ok: false, lines: [`The runner on pid ${lock.pid} could not be asked to stop: ${e instanceof Error ? e.message : String(e)}.`, "Stop it where it is running, then try again."] };
+  }
+  const until = now() + REPLACE_EXIT_TIMEOUT_MS;
+  while (now() < until) {
+    if (!alive(lock.pid)) return { ok: true, lines: [`Replaced the \`pags up\` on pid ${lock.pid}`] };
+    await sleep(500);
+  }
+  return {
+    ok: false,
+    lines: [
+      `The runner on pid ${lock.pid} was asked to stop but is still running after ${Math.round(REPLACE_EXIT_TIMEOUT_MS / 1e3)}s.`,
+      "It may be finishing something. Wait and try again, or stop it where it is running \u2014 this command will not kill it for you."
+    ]
+  };
+}
+
 // src/commands/up.ts
 var API_BASE3 = "https://api.proagentstore.online";
 var CLI_VERSION2 = createRequire2(import.meta.url)("../package.json").version;
-async function stopRunnerProcesses() {
-  if (process.platform === "win32") return false;
-  const { execFileSync: execFileSync3 } = await import("child_process");
-  const patterns = [
-    "dist/browser-runner/index.js",
-    "browser-runner/src/index",
-    "runner connect"
-  ];
-  let stopped = false;
-  for (const p of patterns) {
-    try {
-      execFileSync3("pkill", ["-f", p], { stdio: "ignore" });
-      stopped = true;
-    } catch {
-    }
-  }
-  return stopped;
-}
-var upCommand = new Command8("up").description("Start the browser runner for all your agent instances").option("--headless", "Run browser in headless mode").option("--instance <id>", "Connect to a specific instance only").option("--force", "Take over from another connected machine").action(async (opts) => {
+var upCommand = new Command8("up").description("Start the browser runner for all your agent instances").option("--headless", "Run browser in headless mode").option("--instance <id>", "Connect to a specific instance only").option("--force", "Take over from another connected machine").option("--replace", "Stop the `pags up` already running here for this account, then take over").option("--now", "With --replace: stop it even though work is running on it (that work is lost)").action(async (opts) => {
   const session = requireSession();
   const state = {
     user: session.user.login,
@@ -2221,7 +2515,7 @@ var upCommand = new Command8("up").description("Start the browser runner for all
     headless: opts.headless
   }).catch(() => void 0);
   if (!opts.instance) {
-    const split = partitionByPin(instances, hostname5(), loadMachineIdentity(hostname5()).names);
+    const split = partitionByPin(instances, hostname6(), loadMachineIdentity(hostname6()).names);
     instances = split.here;
     elsewhere = split.elsewhere;
   }
@@ -2242,7 +2536,26 @@ var upCommand = new Command8("up").description("Start the browser runner for all
   }
   state.activeInstance = instances.length === 1 ? instances[0].name || instances[0].slug || instances[0].id.slice(0, 8) : `${instances.length} agents`;
   printStep(`Connecting ${state.activeInstance}\u2026`, "wait");
-  await stopRunnerProcesses();
+  const lockFile = lockPath(session.user.login);
+  const held = await inspectHolder(lockFile);
+  if (held.lock && !isTakeable(held.verdict)) {
+    if (!opts.replace) {
+      clearScreen();
+      printLogo(CLI_VERSION2);
+      for (const line of holderMessage(held.lock, held.verdict)) writeLine(`  ${line}`);
+      writeLine("");
+      process.exit(1);
+    }
+    const replaced = await replaceHolder(held.lock, { now: opts.now === true });
+    if (!replaced.ok) {
+      clearScreen();
+      printLogo(CLI_VERSION2);
+      for (const line of replaced.lines) writeLine(`  ${line}`);
+      writeLine("");
+      process.exit(1);
+    }
+    for (const line of replaced.lines) printStep(line, "ok");
+  }
   const { spawn: spawn5 } = await import("child_process");
   const cliPath = process.argv[1];
   const args = [cliPath, "runner", "connect", ...instances.map((i) => i.id)];
@@ -2251,9 +2564,12 @@ var upCommand = new Command8("up").description("Start the browser runner for all
   if (!opts.instance) args.push("--watch-instances");
   const child = spawn5(process.execPath, args, {
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PAGS_TOKEN: session.token, [SUPERVISED_ENV]: SUPERVISOR_RESTARTS }
+    // The child is the lock HOLDER (#896): it owns the relay sockets, so it is what a
+    // contender must find and what `--replace` must be able to stop.
+    env: { ...process.env, PAGS_TOKEN: session.token, [SUPERVISED_ENV]: SUPERVISOR_RESTARTS, PAGS_LOCK_ACCOUNT: session.user.login }
   });
   const logs = [];
+  let childRsid = "";
   const handleOutput = (data2) => {
     const text = data2.toString("utf-8");
     for (const line of text.split("\n")) {
@@ -2261,6 +2577,8 @@ var upCommand = new Command8("up").description("Start the browser runner for all
       if (!trimmed) continue;
       logs.push(trimmed);
       if (logs.length > 200) logs.shift();
+      const rsidLine = trimmed.match(/^STATUS runner-session=(\S+)/);
+      if (rsidLine) childRsid = rsidLine[1];
       const status = parseStatusLine(trimmed);
       if (status) {
         if (status.registration) {
@@ -2319,7 +2637,13 @@ var upCommand = new Command8("up").description("Start the browser runner for all
       return;
     }
     childDead = true;
-    if (code && code !== 0) {
+    if (code === null) {
+      state.runner = "error";
+      state.lastEvent = "Runner stopped by another process (signal) \u2014 it is not connected any more";
+      printStatus(state);
+      return;
+    }
+    if (code !== 0) {
       state.runner = "error";
       state.lastEvent = `Runner exited (code ${code})`;
       const recent = logs.slice(-5);
@@ -2332,7 +2656,7 @@ var upCommand = new Command8("up").description("Start the browser runner for all
     try {
       if (process.stdin.isTTY) process.stdin.setRawMode(false);
       process.stdin.pause();
-      execFileSync2(process.execPath, [process.argv[1], ...restartUpArgs(opts)], { stdio: "inherit", env: { ...process.env, ...env } });
+      execFileSync3(process.execPath, [process.argv[1], ...restartUpArgs(opts)], { stdio: "inherit", env: { ...process.env, ...env } });
     } catch (e) {
       const status = e.status;
       writeLine(`  Restart failed${typeof status === "number" ? ` (exit ${status})` : ""} \u2014 the runner is NOT running. Run 'pags up' again.`);
@@ -2367,26 +2691,37 @@ var upCommand = new Command8("up").description("Start the browser runner for all
       printStatus(state);
     }
     if (key === "r") {
-      if (childDead) restartUp("Restarting runner...");
+      if (childDead) {
+        const other = await inspectHolder(lockFile);
+        if (other.lock && other.lock.rsid !== childRsid && !isTakeable(other.verdict)) {
+          state.lastEvent = `Another \`pags up\` holds this machine (pid ${other.lock.pid}) \u2014 restart refused`;
+          printStatus(state);
+          continue;
+        }
+        restartUp("Restarting runner...");
+      }
       printStatus(state);
     }
   }
 });
-var downCommand = new Command8("down").description("Stop the browser runner and disconnect").action(async () => {
+var downCommand = new Command8("down").description("Stop the browser runner and disconnect").option("--now", "Stop it even though work is running on it (that work is lost)").action(async (opts) => {
   clearScreen();
   printLogo(CLI_VERSION2);
-  if (process.platform === "win32") {
-    writeLine("  On Windows: switch to the 'pags up' window and press Ctrl+C to disconnect.");
+  const session = requireSession();
+  const lock = readLock(lockPath(session.user.login));
+  if (!lock) {
+    writeLine("  No runner of yours is running on this machine \u2014 nothing to stop.");
     writeLine("");
     return;
   }
-  const stopped = await stopRunnerProcesses();
-  if (stopped) {
+  const stopped = await replaceHolder(lock, { now: opts.now === true });
+  if (stopped.ok) {
+    releaseLock(lockPath(session.user.login), lock.rsid);
     writeLine("  \u2713 Runner stopped \u2014 you're disconnected.");
     writeLine("");
     writeLine("  Your agent won't act on the web until you run 'pags up' again.");
   } else {
-    writeLine("  No runner was running \u2014 nothing to stop.");
+    for (const line of stopped.lines) writeLine(`  ${line}`);
   }
   writeLine("");
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.87",
+  "version": "0.4.89",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",