@qodeca/xezar 0.13.0 → 0.14.0

package/dist/paths.d.ts

@@ -102,8 +102,8 @@ export declare function serverLockPath(instance?: string): string;
  * Where each coding agent keeps its per-user config, honouring the env vars the
  * vendors document: `$CLAUDE_CONFIG_DIR` relocates Claude Code's home;
  * `$CODEX_HOME` relocates Codex's; `$OPENCODE_CONFIG_DIR`, then `$XDG_CONFIG_HOME`,
- * relocate OpenCode's config dir (falling back to `~/.config`). Read per call so
- * tests and ops can set env live.
+ * relocate OpenCode's config dir (falling back to `~/.config`); `$PI_CODING_AGENT_DIR`
+ * relocates pi's. Read per call so tests and ops can set env live.
  *
  * OpenCode's own variable is checked FIRST because it is the narrow one. Reaching
  * for `XDG_CONFIG_HOME` to move one agent's config relocates every XDG-aware tool
@@ -115,11 +115,21 @@ export declare function serverLockPath(instance?: string): string;
  * and does not reach here — this slot IS the config dir, nothing else, so the
  * config-only variable is exactly the right precision for it.
  *
- * pi is the one slot with NO vendor variable: it documents none, and its binary
- * reads none (checked against pi 0.85.1, 2026-09-10) — `PI_PACKAGE_DIR` names the
- * npm package, not the agent home. `src/core/agent-profiles.ts` records the same
- * fact for profiles. So `$HOME`/`$USERPROFILE` is the whole of pi's relocation,
- * and deriving it here rather than from `homedir()` at the call site is what keeps
+ * pi relocates through `$PI_CODING_AGENT_DIR` (#329, re-checked against pi 0.85.1
+ * on 2026-09-12). This repo said the opposite in five places on the strength of one
+ * check on 2026-09-10, so the correction is spelled out: `pi --help` lists
+ * `PI_CODING_AGENT_DIR - Config directory (default: ~/.pi/agent)` under "Environment
+ * Variables", the shipped package documents it in `docs/environment-variables.md`,
+ * and the binary was observed reading AND writing there — a corrupt `settings.json`
+ * inside the pinned dir produced `Warning: Invalid settings file <pinned>/settings.json`,
+ * and the run wrote `auth.json`, `models-store.json` and `sessions/` into it while
+ * reporting "No API key found" with a populated `~/.pi/agent/auth.json` on disk. So
+ * identity moves with the dir, which is what `src/core/agent-profiles.ts` needs.
+ * `PI_PACKAGE_DIR` remains unrelated — it names the npm package, not the agent home.
+ * `PI_CODING_AGENT_SESSION_DIR` is deliberately NOT read here: it moves session
+ * storage only, so honouring it would answer a dir that holds no credentials.
+ *
+ * Deriving pi's home here rather than from `homedir()` at the call site is what keeps
  * a test or a container off a real home — the reason this helper exists at all.
  *
  * These are the DEFAULT profile's dirs. A second login of the same CLI is an

package/dist/paths.js

@@ -141,8 +141,8 @@ export function serverLockPath(instance = DEFAULT_SERVER_INSTANCE) {
  * Where each coding agent keeps its per-user config, honouring the env vars the
  * vendors document: `$CLAUDE_CONFIG_DIR` relocates Claude Code's home;
  * `$CODEX_HOME` relocates Codex's; `$OPENCODE_CONFIG_DIR`, then `$XDG_CONFIG_HOME`,
- * relocate OpenCode's config dir (falling back to `~/.config`). Read per call so
- * tests and ops can set env live.
+ * relocate OpenCode's config dir (falling back to `~/.config`); `$PI_CODING_AGENT_DIR`
+ * relocates pi's. Read per call so tests and ops can set env live.
  *
  * OpenCode's own variable is checked FIRST because it is the narrow one. Reaching
  * for `XDG_CONFIG_HOME` to move one agent's config relocates every XDG-aware tool
@@ -154,11 +154,21 @@ export function serverLockPath(instance = DEFAULT_SERVER_INSTANCE) {
  * and does not reach here — this slot IS the config dir, nothing else, so the
  * config-only variable is exactly the right precision for it.
  *
- * pi is the one slot with NO vendor variable: it documents none, and its binary
- * reads none (checked against pi 0.85.1, 2026-09-10) — `PI_PACKAGE_DIR` names the
- * npm package, not the agent home. `src/core/agent-profiles.ts` records the same
- * fact for profiles. So `$HOME`/`$USERPROFILE` is the whole of pi's relocation,
- * and deriving it here rather than from `homedir()` at the call site is what keeps
+ * pi relocates through `$PI_CODING_AGENT_DIR` (#329, re-checked against pi 0.85.1
+ * on 2026-09-12). This repo said the opposite in five places on the strength of one
+ * check on 2026-09-10, so the correction is spelled out: `pi --help` lists
+ * `PI_CODING_AGENT_DIR - Config directory (default: ~/.pi/agent)` under "Environment
+ * Variables", the shipped package documents it in `docs/environment-variables.md`,
+ * and the binary was observed reading AND writing there — a corrupt `settings.json`
+ * inside the pinned dir produced `Warning: Invalid settings file <pinned>/settings.json`,
+ * and the run wrote `auth.json`, `models-store.json` and `sessions/` into it while
+ * reporting "No API key found" with a populated `~/.pi/agent/auth.json` on disk. So
+ * identity moves with the dir, which is what `src/core/agent-profiles.ts` needs.
+ * `PI_PACKAGE_DIR` remains unrelated — it names the npm package, not the agent home.
+ * `PI_CODING_AGENT_SESSION_DIR` is deliberately NOT read here: it moves session
+ * storage only, so honouring it would answer a dir that holds no credentials.
+ *
+ * Deriving pi's home here rather than from `homedir()` at the call site is what keeps
  * a test or a container off a real home — the reason this helper exists at all.
  *
  * These are the DEFAULT profile's dirs. A second login of the same CLI is an
@@ -173,7 +183,7 @@ export function agentHomePaths(env = process.env) {
         claude: env.CLAUDE_CONFIG_DIR?.trim() || join(home, '.claude'),
         codex: env.CODEX_HOME?.trim() || join(home, '.codex'),
         opencodeConfig: env.OPENCODE_CONFIG_DIR?.trim() || join(xdgConfig, 'opencode'),
-        pi: join(home, '.pi', 'agent'),
+        pi: env.PI_CODING_AGENT_DIR?.trim() || join(home, '.pi', 'agent'),
     };
 }
 /**

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,4EAA4E;IAC5E,gEAAgE;IAChE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAY,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAChG,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,OAAO;IAClE,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,0DAA0D;QACvF,qGAAqG,CACxG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SAC9B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,uBAAuB,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAW,uBAAuB;IACxE,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAQ,GAAW,uBAAuB;IACvE,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,QAAQ,eAAe,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC9D,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACrD,cAAc,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC9E,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1F,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE;WAC5D,UAAU,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;AACrG,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,4EAA4E;IAC5E,gEAAgE;IAChE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAY,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAChG,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,OAAO;IAClE,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,0DAA0D;QACvF,qGAAqG,CACxG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SAC9B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,uBAAuB,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAW,uBAAuB;IACxE,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAQ,GAAW,uBAAuB;IACvE,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,QAAQ,eAAe,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC9D,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACrD,cAAc,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC9E,EAAE,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1F,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE;WAC5D,UAAU,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;AACrG,CAAC"}

package/dist/runs/project-writer.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { closeSync, openSync, mkdirSync, readFileSync, readdirSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { join } from 'node:path';
+import { localMachineId, machineRelation } from '../machine-identity.js';
 const owned = new Map();
 export class ProjectWriterError extends Error {
     dataDir;
@@ -11,6 +12,56 @@ export class ProjectWriterError extends Error {
         this.name = 'ProjectWriterError';
     }
 }
+/** The claim's exact bytes, for PUBLISHING only — the self-check (`claimIsOurs`) compares
+ * fields, not bytes, because the `host` recorded here is display-only and this helper reads
+ * `hostname()` live. `machine` is omitted (not written as null) when this host cannot identify
+ * itself, so an unidentifiable host keeps writing the pre-#199 shape byte for byte. */
+function claimBody(machine) {
+    return JSON.stringify({ pid: process.pid, host: hostname(), ...(machine === null ? {} : { machine }) });
+}
+/**
+ * Is the claim this process published still the one on disk?
+ *
+ * It compares the two facts that identify a writer — the PID and the MACHINE — and never the
+ * hostname, for the same reason the peer scan stopped trusting it: `claimBody` reads
+ * `hostname()` live, so a byte-for-byte comparison against a freshly built body turns a machine
+ * renaming itself into "the active claim changed". That is #199's lockout reproduced INSIDE one
+ * process, and it is reachable long after boot — `automations/coordinator.ts` calls
+ * `ownProjectData` lazily, so a laptop that changes network while `xez serve` is up hits it.
+ * `localMachineId()` is memoized, so the hostname is the only field that could ever have moved.
+ *
+ * Fails closed on anything it cannot read or parse: an unreadable, truncated or rewritten claim
+ * is not this process's claim. `unknown` (this host will not name itself, or the claim predates
+ * the field) passes, exactly as the peer scan treats it — there is no evidence of a different
+ * machine, and the file's path already carries this process's PID and a UUID only it generated.
+ */
+function claimIsOurs(path, machine) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return false;
+    const claim = parsed;
+    return claim.pid === process.pid && machineRelation(claim.machine, machine) !== 'different';
+}
+/** Long hostnames and corrupt claims must not turn an error message into a wall of text. */
+function short(value) {
+    return JSON.stringify(String(value).slice(0, 120));
+}
+/** Name the file, both hostnames and the PID, because the only repair is deleting one file and
+ * "foreign-host writer claim" pointed at nothing (#199). Says WHY the machines were judged
+ * different, so "a different machine" and "no identity to compare" never read the same. */
+function foreignClaimDetail(path, recordedHost, pid, relation) {
+    const evidence = relation === 'different'
+        ? 'It also records a different machine identity.'
+        : 'It records no machine identity to compare, so the hostname was the only evidence.';
+    return `foreign-host writer claim: ${path} names host ${short(recordedHost)} (PID ${pid}); this host is ${short(hostname())}.`
+        + ` ${evidence} If that machine is no longer using this directory, delete that claim file.`;
+}
 /** One process owns a project's mutable state, independent of port and XEZ_HOME.
  * Publish a unique claim BEFORE scanning. Two simultaneous contenders may both refuse,
  * but cannot both see themselves alone. Dead claims have unique paths, so reclaiming one
@@ -20,19 +71,16 @@ export class ProjectWriterError extends Error {
 export function ownProjectData(dataDir) {
     mkdirSync(dataDir, { recursive: true });
     const canonical = realpathSync(dataDir);
+    const machine = localMachineId();
     const prior = owned.get(canonical);
     if (prior) {
         // Deleting active runtime state is not a supported way to release ownership.
-        let intact = false;
-        try {
-            intact = readFileSync(prior, 'utf8') === JSON.stringify({ pid: process.pid, host: hostname() });
-        }
-        catch { /* fail closed */ }
-        if (!intact) {
+        if (!claimIsOurs(prior, machine)) {
             throw new ProjectWriterError(canonical, 'the active claim changed');
         }
         return;
     }
+    const body = claimBody(machine);
     const directory = join(canonical, 'writer-claims');
     mkdirSync(directory, { recursive: true });
     const claim = join(directory, `${process.pid}-${randomUUID()}.json`);
@@ -41,7 +89,7 @@ export function ownProjectData(dataDir) {
         const descriptor = openSync(claim, 'wx', 0o600);
         published = true; // Exclusive open established ownership even if the following write fails.
         try {
-            writeFileSync(descriptor, JSON.stringify({ pid: process.pid, host: hostname() }));
+            writeFileSync(descriptor, body);
         }
         finally {
             closeSync(descriptor);
@@ -71,8 +119,22 @@ export function ownProjectData(dataDir) {
                 peer = JSON.parse(raw);
             }
             catch { /* A live incomplete claim still refuses below. */ }
-            if (peer && typeof peer === 'object' && 'host' in peer && peer.host !== hostname()) {
-                throw new Error('foreign-host writer claim');
+            // What the host check was load-bearing FOR: a PID number is only evidence on the machine
+            // that wrote it, so a foreign claim must never be reaped by probing that PID here. A
+            // hostname was standing in for the machine, and a laptop that changes networks changes its
+            // name (#199), so a recorded identity that MATCHES this machine settles the question and
+            // lets the hostname become display-only.
+            //
+            // Deliberately one-way. A mismatched or absent identity falls back to the hostname exactly
+            // as before, so no claim this guard used to refuse becomes reapable: a restarted container
+            // with a pinned hostname still recovers its own dead claim, and two hosts sharing storage
+            // are no more reapable by PID than they were. Only "provably the same machine" is new.
+            const relation = peer && typeof peer === 'object'
+                ? machineRelation(peer.machine, machine)
+                : 'unknown';
+            const foreign = (recordedHost) => relation !== 'same' && recordedHost !== hostname();
+            if (peer && typeof peer === 'object' && 'host' in peer && foreign(peer.host)) {
+                throw new Error(foreignClaimDetail(path, peer.host, pid, relation));
             }
             let dead = false;
             try {
@@ -93,10 +155,13 @@ export function ownProjectData(dataDir) {
                 }
                 continue;
             }
+            // Same host rule as above, through the same helper: half the sites is half a fix, and a
+            // live writer on this machine under its earlier name must report itself as the live writer
+            // it is rather than as an invalid claim.
             if (!peer || typeof peer !== 'object' || !('pid' in peer) || !('host' in peer)
                 || !Number.isSafeInteger(peer.pid) || Number(peer.pid) <= 0
-                || peer.host !== hostname() || peer.pid !== pid) {
-                throw new Error('invalid or foreign-host writer claim');
+                || foreign(peer.host) || peer.pid !== pid) {
+                throw new Error(`invalid or foreign-host writer claim: ${path}`);
             }
             throw new Error(`live writer PID ${peer.pid}`);
         }

package/dist/runs/project-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-writer.js","sourceRoot":"","sources":["../../src/runs/project-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7H,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,OAAO;IAA5B,YAAqB,OAAe,EAAE,MAAc;QAClD,KAAK,CAAC,oEAAoE,OAAO,KAAK,MAAM,8BAA8B,CAAC,CAAC;uBADzG,OAAO;QAE1B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,6EAA6E;QAC7E,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpI,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,SAAS,GAAG,IAAI,CAAC,CAAC,0EAA0E;QAC5F,IAAI,CAAC;YAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;gBAClF,CAAC;YAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,KAAK;gBAAE,SAAS;YAC7B,MAAM,KAAK,GAAG,iFAAiF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3G,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACvF,yEAAyE;YACzE,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBAAC,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBACjE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,iFAAiF;YACjF,iFAAiF;YACjF,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;YAC5F,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAC7B,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC;gBACnE,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACzB,OAAO,OAAO,EAAE,CAAC;oBAAC,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,OAAO,CAAC;gBAAC,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;mBACzE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;mBACxD,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}
+{"version":3,"file":"project-writer.js","sourceRoot":"","sources":["../../src/runs/project-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7H,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAwB,MAAM,wBAAwB,CAAC;AAE/F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,OAAO;IAA5B,YAAqB,OAAe,EAAE,MAAc;QAClD,KAAK,CAAC,oEAAoE,OAAO,KAAK,MAAM,8BAA8B,CAAC,CAAC;uBADzG,OAAO;QAE1B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;uFAGuF;AACvF,SAAS,SAAS,CAAC,OAAsB;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,OAAsB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAChF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,MAA8C,CAAC;IAC7D,OAAO,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC;AAC9F,CAAC;AAED,4FAA4F;AAC5F,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;2FAE2F;AAC3F,SAAS,kBAAkB,CAAC,IAAY,EAAE,YAAqB,EAAE,GAAW,EAAE,QAAyB;IACrG,MAAM,QAAQ,GAAG,QAAQ,KAAK,WAAW;QACvC,CAAC,CAAC,+CAA+C;QACjD,CAAC,CAAC,mFAAmF,CAAC;IACxF,OAAO,8BAA8B,IAAI,eAAe,KAAK,CAAC,YAAY,CAAC,SAAS,GAAG,mBAAmB,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG;UAC1H,IAAI,QAAQ,6EAA6E,CAAC;AAChG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,6EAA6E;QAC7E,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,SAAS,GAAG,IAAI,CAAC,CAAC,0EAA0E;QAC5F,IAAI,CAAC;YAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;gBAChC,CAAC;YAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,KAAK;gBAAE,SAAS;YAC7B,MAAM,KAAK,GAAG,iFAAiF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3G,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACvF,yEAAyE;YACzE,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBAAC,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBACjE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,iFAAiF;YACjF,iFAAiF;YACjF,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;YAC5F,yFAAyF;YACzF,qFAAqF;YACrF,2FAA2F;YAC3F,yFAAyF;YACzF,yCAAyC;YACzC,EAAE;YACF,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,uFAAuF;YACvF,MAAM,QAAQ,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAC/C,CAAC,CAAC,eAAe,CAAE,IAA8B,CAAC,OAAO,EAAE,OAAO,CAAC;gBACnE,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,YAAqB,EAAW,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YACvG,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAC7B,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC;gBACnE,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACzB,OAAO,OAAO,EAAE,CAAC;oBAAC,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,OAAO,CAAC;gBAAC,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,wFAAwF;YACxF,2FAA2F;YAC3F,yCAAyC;YACzC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;mBACzE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;mBACxD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/runs/retention.d.ts

@@ -1,3 +1,4 @@
+import { type OwnershipScope } from '../mcp/resource-ownership.ts';
 import type { RunRecord } from './store.ts';
 /** A run is reclaimable when it is finished, still has a materialized worktree
  *  directory, and has not already been reclaimed. */
@@ -34,7 +35,7 @@ export interface RematerializeStore {
  * run regains its isolated tree and becomes eligible for retention again;
  * without it the run would keep a directory on disk while staying invisible to
  * the enforcer forever (a leak). Returns true when it re-materialized.
- * Best-effort: never throws (the caller falls back to the repo root).
+ * Best-effort: never throws; the continuation caller refuses lost isolation before spawning.
  */
 export declare function rematerializeReclaimedWorktree(repoRoot: string, store: RematerializeStore, runId: string): Promise<boolean>;
 /**
@@ -47,7 +48,9 @@ export declare function rematerializeReclaimedWorktree(repoRoot: string, store:
  * report failure, so a run is stamped only once its directory is confirmed gone
  * — a locked/permission failure leaves the stamp unset so the next pass retries.
  * Idempotent under races: `removeWorktree` is `--force` + `prune` and a repeated
- * stamp is harmless.
+ * stamp is harmless. A caller with a lifecycle passes `shouldStop` and the sweep abandons the
+ * rest of the pass the moment that caller is done with the repository, returning the ids it had
+ * already reclaimed.
  */
 export interface ReclaimOptions {
     /** Timestamp source for the stamp — injectable for deterministic tests. */
@@ -56,5 +59,25 @@ export interface ReclaimOptions {
      *  Injectable so tests can exercise the "removal failed" branch without brittle
      *  filesystem-permission tricks. */
     remove?: (repoRoot: string, worktreePath: string) => Promise<void>;
+    /**
+     * Asked before EVERY iteration: has the caller stopped owning this repository?
+     *
+     * A sweep is a loop of `git worktree remove` spawns with a `store.updateRun` stamp after each
+     * one, so a caller that checks "am I still alive" once before calling this stops the sweep
+     * before its FIRST removal and never again — and a five-worktree pass that straddles a
+     * `RunManager.dispose()` goes on writing into a data root its owner has finished with (#200).
+     *
+     * Absent means "never stop", which is what every one-shot caller (boot, the reclaim route)
+     * wants: they have no lifecycle to lose mid-sweep.
+     */
+    shouldStop?: () => boolean;
 }
+/**
+ * A run of this project whose recorded worktree, if it names one, is provably this project's own
+ * (`ownRun` + `ownWorktree`) or already gone — the rule above, per run. The cockpit's run routes
+ * that delete, commit, push or run git in that worktree ask the same question through this one
+ * function (#316), so reclaim and those routes cannot come to disagree about what is ours.
+ * `null` when the run is unknown here or reaches anywhere else.
+ */
+export declare function ownRunAndWorktree(scope: OwnershipScope, runId: string): Promise<RunRecord | null>;
 export declare function reclaimWorktrees(repoRoot: string, store: RetentionStore, keep: number, opts?: ReclaimOptions): Promise<string[]>;

package/dist/runs/retention.js

@@ -5,7 +5,9 @@
 // recoverable) and the thin I/O enforcer that performs the reclaim. The selector
 // is pure and unit-testable; the enforcer never throws (helper discipline).
 import { existsSync } from 'node:fs';
+import { lstat } from 'node:fs/promises';
 import { createWorktree, removeWorktree } from '../git-worktree.js';
+import { ownRun, ownWorktree, ownershipScope } from '../mcp/resource-ownership.js';
 /** The "finished" status set — mirrors `RunStore.archiveFinished`. A run at the
  *  `review` gate is deliberately excluded: it still needs its worktree to render
  *  the diff and open a draft PR, so reclaiming it would break the gate. */
@@ -45,7 +47,7 @@ export function selectReclaimableWorktrees(runs, keep) {
  * run regains its isolated tree and becomes eligible for retention again;
  * without it the run would keep a directory on disk while staying invisible to
  * the enforcer forever (a leak). Returns true when it re-materialized.
- * Best-effort: never throws (the caller falls back to the repo root).
+ * Best-effort: never throws; the continuation caller refuses lost isolation before spawning.
  */
 export async function rematerializeReclaimedWorktree(repoRoot, store, runId) {
     const run = store.getRun(runId);
@@ -60,13 +62,72 @@ export async function rematerializeReclaimedWorktree(repoRoot, store, runId) {
         return false;
     }
 }
+/** Reclaim looks up no automation, so that half of the ownership scope refuses everything. */
+const NO_AUTOMATIONS = { get: () => undefined, latestReceipts: () => new Map() };
+/**
+ * The reclaimable runs whose worktree is provably this project's own (#288). A record's
+ * `worktreePath` is data — a copied or hand-edited `.local/xezar` can name another project's
+ * worktree — and reclaim deletes that directory. So a candidate must name this project's
+ * `<root>/.local/xezar/worktrees/<id>` (`ownRun`), and a directory that exists there must be a
+ * real one reached through no symlink (`ownWorktree`). A directory that is already gone reaches
+ * nothing and stays a candidate, so its stamp is still written. Anything else is left out BEFORE
+ * selection: it neither counts against `keep` nor is touched. Per record rather than `ownSweep`'s
+ * whole-sweep refusal, because this also runs unattended at boot and at every task's end, where
+ * refusing the whole sweep would silently switch retention (#483) off for the project.
+ */
+async function ownedReclaimable(repoRoot, runs) {
+    const byId = new Map(runs.map((r) => [r.id, r]));
+    const scope = ownershipScope({
+        root: repoRoot,
+        store: { getRun: (id) => byId.get(id), listRuns: () => [...runs] },
+        automationStore: NO_AUTOMATIONS,
+    });
+    const owned = [];
+    for (const run of runs) {
+        if (isReclaimable(run) && (await ownRunAndWorktree(scope, run.id)))
+            owned.push(run);
+    }
+    return owned;
+}
+/**
+ * A run of this project whose recorded worktree, if it names one, is provably this project's own
+ * (`ownRun` + `ownWorktree`) or already gone — the rule above, per run. The cockpit's run routes
+ * that delete, commit, push or run git in that worktree ask the same question through this one
+ * function (#316), so reclaim and those routes cannot come to disagree about what is ours.
+ * `null` when the run is unknown here or reaches anywhere else.
+ */
+export async function ownRunAndWorktree(scope, runId) {
+    const run = ownRun(scope, runId);
+    if (!run.ok)
+        return null;
+    const path = run.value.worktreePath;
+    if (path === undefined || (await ownWorktree(scope, runId)).ok || (await isAbsent(path)))
+        return run.value;
+    return null;
+}
+/** Nothing at `path`, not even a dangling link. Any other answer is not "absent" (fail closed). */
+async function isAbsent(path) {
+    try {
+        await lstat(path);
+        return false;
+    }
+    catch (err) {
+        return err.code === 'ENOENT';
+    }
+}
 export async function reclaimWorktrees(repoRoot, store, keep, opts = {}) {
     const now = opts.now ?? (() => new Date().toISOString());
     const remove = opts.remove ?? ((root, path) => removeWorktree(root, path)); // branch kept
+    const shouldStop = opts.shouldStop ?? (() => false);
     const runs = store.listRuns();
     const byId = new Map(runs.map((r) => [r.id, r]));
     const reclaimed = [];
-    for (const id of selectReclaimableWorktrees(runs, keep)) {
+    for (const id of selectReclaimableWorktrees(await ownedReclaimable(repoRoot, runs), keep)) {
+        // Per iteration, not once before the loop: each pass costs a git spawn and a record write,
+        // and the caller's ownership can end between any two of them. Returning what was already
+        // reclaimed is honest — those directories really are gone.
+        if (shouldStop())
+            break;
         const run = byId.get(id);
         if (!run?.worktreePath)
             continue;

package/dist/runs/retention.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/runs/retention.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oFAAoF;AACpF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpE;;2EAE2E;AAC3E,MAAM,QAAQ,GAA2B,IAAI,GAAG,CAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7F;;kFAEkF;AAClF,SAAS,UAAU,CAAC,GAAc;IAChC,OAAO,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;qDACqD;AACrD,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA0B,EAAE,IAAY;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI;SACrB,MAAM,CAAC,aAAa,CAAC;SACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAgB,EAChB,KAAyB,EACzB,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAChE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAqB,EACrB,IAAY,EACZ,IAAI,GAAmB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,YAAY;YAAE,SAAS;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,SAAS,CAAC,kCAAkC;YAC9E,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/runs/retention.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oFAAoF;AACpF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAA8C,MAAM,8BAA8B,CAAC;AAG/H;;2EAE2E;AAC3E,MAAM,QAAQ,GAA2B,IAAI,GAAG,CAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7F;;kFAEkF;AAClF,SAAS,UAAU,CAAC,GAAc;IAChC,OAAO,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;qDACqD;AACrD,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA0B,EAAE,IAAY;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI;SACrB,MAAM,CAAC,aAAa,CAAC;SACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAgB,EAChB,KAAyB,EACzB,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAChE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAqCD,8FAA8F;AAC9F,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAoD,CAAC;AAEnI;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAA0B;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,cAAc,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;QAClE,eAAe,EAAE,cAAc;KAChC,CAAC,CAAC;IACH,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAqB,EAAE,KAAa;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAC3G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAqB,EACrB,IAAY,EACZ,IAAI,GAAmB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,0BAA0B,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1F,2FAA2F;QAC3F,yFAAyF;QACzF,2DAA2D;QAC3D,IAAI,UAAU,EAAE;YAAE,MAAM;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,YAAY;YAAE,SAAS;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,SAAS,CAAC,kCAAkC;YAC9E,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/server/forge/github.js

@@ -2482,6 +2482,49 @@ async function mergePullRequest(repoRoot, repoRef, number, input) {
 export function mergePreflightAllowed(current, overrideRules = false) {
     return current.canMerge || (overrideRules && current.canOverride);
 }
+const readyInflight = new Set();
+/**
+ * Mark a draft pull request ready for review (`gh pr ready`). The same preflight shape as the
+ * merge: a FRESH read of the forge, the reviewed head as a compare-and-swap, and a refusal in
+ * plain words for a pull request that is not an open draft. What counts as a quality reason not
+ * to ready it is the caller's policy; this only does what the forge would do. Never throws.
+ */
+async function markPullRequestReady(repoRoot, repoRef, number, input) {
+    const key = `${repoRoot}:${number}`;
+    if (readyInflight.has(key))
+        return { ready: false, status: 409, error: 'This pull request is already being marked ready.', code: 'concurrent' };
+    readyInflight.add(key);
+    try {
+        const fresh = await fetchPrMergeState(repoRoot, repoRef, number, true);
+        if (!fresh.available)
+            return { ready: false, status: 502, error: fresh.reason };
+        const current = fresh.mergeState;
+        if (current.state !== 'open') {
+            return { ready: false, status: 409, error: current.state === 'merged' ? 'This pull request is merged.' : 'This pull request is closed.', code: 'terminal', current };
+        }
+        if (!current.isDraft) {
+            return { ready: false, status: 409, error: 'This pull request is already ready for review.', code: 'already-ready', current };
+        }
+        if (current.headSha !== input.expectedHeadSha) {
+            return { ready: false, status: 409, error: 'The pull request head changed. Review the new commits before marking it ready.', code: 'stale-head', current };
+        }
+        if (process.env.XEZ_DRY_RUN === '1') {
+            evictGithubProjectCaches(repoRoot);
+            return { ready: true, number, url: current.url };
+        }
+        await gh(repoRoot, ['pr', 'ready', String(number)]);
+        evictGithubProjectCaches(repoRoot);
+        return { ready: true, number, url: current.url };
+    }
+    catch (error) {
+        const message = firstLine(error instanceof Error ? error.message : String(error));
+        const status = /403|permission|forbidden/i.test(message) ? 403 : /404|not found/i.test(message) ? 404 : 502;
+        return { ready: false, status, error: status === 403 ? 'GitHub permission denied.' : status === 404 ? 'Pull request or repository not found.' : 'GitHub could not mark the pull request ready.' };
+    }
+    finally {
+        readyInflight.delete(key);
+    }
+}
 const GH_PR_STATES = {
     MERGED: 'merged',
     CLOSED: 'closed',
@@ -2520,6 +2563,7 @@ export function createGithubDriver(repoRoot, repoRef) {
         },
         prMergeState: (number, opts) => fetchPrMergeState(repoRoot, repoRef, number, opts?.refresh),
         mergePR: (number, input) => mergePullRequest(repoRoot, repoRef, number, input),
+        markReady: (number, input) => markPullRequestReady(repoRoot, repoRef, number, input),
         viewUrl: (kind, ref) => {
             if (!repoRef)
                 return null;