@ricsam/r5d-worker 0.0.123 → 0.0.125

package/README.md

@@ -89,7 +89,7 @@ The launcher owns admission, OS isolation, budgets, and diagnostic evidence. Its
 
 Requests must be processed concurrently so cancellation and cleanup cannot wait behind queued admission. Controller RPCs are bounded (10 seconds, or 90 seconds for acquisition); external policy must reject excessive queue waits within that bound. Controller loss or protocol failure stops command admission, preserves uncertain outcomes for recovery, reaps ordinary children, and restarts the runtime through its supervisor. It never falls back to direct spawning. Shutdown closes controller stdin; the controller must reap its jobs before exiting.
 
-Cancellation is checked again immediately before spawn. Transient disconnects preserve commands and terminals; expiry of the five-minute execution lease cancels agent work and closes terminals. File operations, communication recovery, and cancellation do not enter launcher admission. Internal worker maintenance subprocesses are also outside this hook. The worker reports its own view of every lane (holders and queue, by run id) to the server with `capacity_report` whenever an admission changes; the platform exposes it through `r5dctl ps list` and `r5dctl workspace status`. Deployment-specific limits and service protection are documented in [Worker deployment resources](../../docs/worker-deployment-resources.md).
+Cancellation is checked again immediately before spawn. A `cancel` carrying `scope: "unstarted"` is the server giving up on a start whose budget expired: it revokes only a launch that has not spawned (capacity queue, mount hold, preparation) and leaves a running process alone; `cancel_result.outcome` reports `unstarted`, `started`, `stopped`, or `unknown` (no record of the run; the cancellation is remembered so a later arrival is refused). Transient disconnects preserve commands and terminals; expiry of the five-minute execution lease cancels agent work and closes terminals. File operations, communication recovery, and cancellation do not enter launcher admission. Internal worker maintenance subprocesses are also outside this hook. The worker reports its own view of every lane (holders and queue, by run id) to the server with `capacity_report` whenever an admission changes; the platform exposes it through `r5dctl ps list` and `r5dctl workspace status`. Deployment-specific limits and service protection are documented in [Worker deployment resources](../../docs/worker-deployment-resources.md).
 
 When the connected `r5d-browser` requests a port forward, the worker opens each relayed connection only to `127.0.0.1` on the requested worker port. Browser-side and worker-side ports may differ. The worker never opens a public listener, and a disconnected worker leaves the browser's long-lived mapping unavailable until the same worker label reconnects.
 

package/dist/cjs/command-launcher.cjs

@@ -245,7 +245,9 @@ class WorkerCommandLauncher {
         if (!argv.length) throw new Error("Command argv must not be empty");
         return [...prefix, ...argv];
       },
-      cancel: () => this.cancel(request.id),
+      cancel: async () => {
+        await this.cancel(request.id);
+      },
       diagnose: async () => {
         this.assertHealthy();
         if (!this.child) return void 0;
@@ -261,9 +263,10 @@ class WorkerCommandLauncher {
       release: () => this.releaseRecord(record)
     };
   }
+  /** Revoke a launch. Returns whether this launcher still held it (queued or acquired, not yet released). */
   async cancel(id) {
     const record = this.launches.get(id);
-    if (!record || record.released) return;
+    if (!record || record.released) return false;
     record.revoked = true;
     record.rejectAdmission(new CommandLaunchCancelledError());
     if (this.child) {
@@ -273,6 +276,7 @@ class WorkerCommandLauncher {
         throw this.fail(error instanceof Error ? error : new Error(String(error)));
       }
     }
+    return true;
   }
   async cancelSession(sessionId) {
     await this.cancelMatching((_id, ownerSessionId) => ownerSessionId === sessionId);