@rulvar/executor 1.94.0 → 1.96.0

package/dist/index.d.ts

@@ -18,8 +18,11 @@ declare class ExecutorError extends Error {
 * the executor knows BEFORE the external effect is dispatched, which is
 * exactly the set a host needs to reconcile an orphaned effect with the
 * effect's provider (look the idempotency key up, correlate by tool and
-* argsHash). `startedAt` is the attempt join key: the outcome record of
-* the same attempt carries the identical value.
+* argsHash). `attemptId` is the attempt join key (RV501): the outcome
+* record of the same attempt carries the identical value. `startedAt`
+* remains the documented legacy join for rows written before the id
+* shipped; a wall-clock millisecond is not unique, which is why the id
+* exists.
 */
 interface ToolEffectIntent {
   /** The stable per-call idempotency key (createEngine derives it). */
@@ -33,6 +36,15 @@ interface ToolEffectIntent {
   /** The ephemeral working directory the dispatch runs in. */
   workdir: string;
   startedAt: number;
+  /**
+  * Unique id of this dispatch ATTEMPT (RV501): the reference executors
+  * mint one before the intent row is written and copy it verbatim onto
+  * the same attempt's outcome row, so the two phases pair exactly.
+  * Optional because rows written before v1.96.0 (and third-party
+  * ledgers) may omit it; {@link loadEffectLedger} then falls back to
+  * the legacy (idempotencyKey, startedAt) join.
+  */
+  attemptId?: string;
 }
 /** One dispatch's side-effect facts, for the ledger. */
 interface ToolEffectRecord extends ToolEffectIntent {
@@ -59,9 +71,9 @@ interface ToolEffectLedger {
   * with the typed `ledger` code) and the outcome `record` after it. A
   * host crash between the effect and the outcome row then leaves an
   * orphan intent, the reconciliation signal, instead of an untracked
-  * effect: an intent whose idempotency key has no outcome row means
-  * "look this key up with the effect's provider before retrying or
-  * compensating". Absent, the ledger keeps the historical
+  * effect: an intent whose OWN attempt has no outcome row (RV501)
+  * means "look this key up with the effect's provider before retrying
+  * or compensating". Absent, the ledger keeps the historical
   * single-record contract and executor behavior is byte-identical.
   */
   intent?(entry: ToolEffectIntent): void | Promise<void>;
@@ -230,29 +242,87 @@ declare function containerExecutor(options: ContainerExecutorOptions): ToolExecu
 * A two-phase ToolEffectLedger appending JSON lines to `path`
 * (`{ phase: 'intent' | 'outcome', ... }`). Pass it to
 * `subprocessExecutor({ ledger })` or `containerExecutor({ ledger })`;
-* scan it back with {@link loadEffectLedger}.
+* scan it back with {@link loadEffectLedger}. The first append lazily
+* repairs a torn tail left by a crashed predecessor (RV502).
+*/
+declare function jsonlEffectLedger(path: string, options?: {
+  now?: () => number;
+}): ToolEffectLedger;
+/** One unparseable interior line of the ledger file, surfaced for triage. */
+interface CorruptLedgerLine {
+  /** 1-based physical line number in the file. */
+  line: number;
+  /** Byte offset of the line's first byte within the file. */
+  offset: number;
+  /** sha256 (hex) of the raw line bytes: forensics without re-reading. */
+  sha256: string;
+  /** The first 120 characters of the line. */
+  preview: string;
+}
+/** A torn fragment the writer quarantined while repairing a tail (RV502). */
+interface TornLedgerArtifact {
+  /** The raw torn bytes, preserved verbatim. */
+  bytes: string;
+  /** Wall-clock ms when the writer quarantined the fragment. */
+  recoveredAt: number;
+}
+/**
+* The fail-closed refusal of {@link loadEffectLedger} (RV502): the file
+* holds at least one unparseable INTERIOR line, which the writer's tail
+* repair can never produce, so it means external damage or a second
+* writer, never a normal crash artifact. Reconciling from a partial
+* scan would silently drop intents; triage the named lines instead
+* (`tolerateCorrupt: true` surfaces them as data).
 */
-declare function jsonlEffectLedger(path: string): ToolEffectLedger;
+declare class LedgerCorruptionError extends Error {
+  readonly lines: CorruptLedgerLine[];
+  constructor(path: string, lines: CorruptLedgerLine[]);
+}
 /** What {@link loadEffectLedger} reads back from a JSONL ledger file. */
 interface EffectLedgerScan {
   intents: ToolEffectIntent[];
   outcomes: ToolEffectRecord[];
   /**
-  * The reconciliation signal (RV404): every intent whose idempotency
-  * key has NO outcome row at all. A key with a later outcome (an
-  * at-least-once retry of the same logical call that completed) is not
-  * orphaned: the retry resolved it. For each orphan, look the key up
-  * with the effect's provider before retrying or compensating.
+  * The reconciliation signal (RV501): every intent whose OWN attempt
+  * never got an outcome row. Pairing is exact: an outcome resolves the
+  * intent carrying the same `attemptId` (rows written before the id
+  * shipped pair by the legacy (idempotencyKey, startedAt) join), and
+  * an outcome of ANY class resolves only its own attempt. A sibling
+  * retry's outcome, ok or error, says nothing about THIS attempt, so
+  * it never clears it: closing the logical key belongs to the host
+  * reconciler, against the effect provider's receipt. For each orphan,
+  * look the key up with the effect's provider before retrying or
+  * compensating.
   */
   orphanedIntents: ToolEffectIntent[];
+  /**
+  * Unparseable interior lines, populated only under `tolerateCorrupt`
+  * (the default scan throws {@link LedgerCorruptionError} instead).
+  * Empty on a healthy file.
+  */
+  corrupt: CorruptLedgerLine[];
+  /** Fragments the writer quarantined while repairing torn tails (RV502). */
+  tornArtifacts: TornLedgerArtifact[];
+  /**
+  * A live unterminated, unparseable trailing fragment: the artifact of
+  * a crash mid-write no writer has repaired yet. Tolerated and named,
+  * never silent.
+  */
+  tornTail?: {
+    preview: string;
+  };
 }
 /**
 * Scans a JSONL ledger file into intents, outcomes, and the orphaned
-* intents a host must reconcile. A torn trailing line (the artifact of
-* a crash mid-write) is skipped, never a scan failure: the durable rows
-* before it are exactly what reconciliation needs.
+* intents a host must reconcile, pairing attempts exactly (RV501). A
+* torn TRAILING fragment (the crash-mid-write artifact) is tolerated
+* and reported; an unparseable INTERIOR line fails the scan closed with
+* a typed {@link LedgerCorruptionError} unless `tolerateCorrupt` asks
+* for the lines as data (RV502).
 */
-declare function loadEffectLedger(path: string): Promise<EffectLedgerScan>;
+declare function loadEffectLedger(path: string, options?: {
+  tolerateCorrupt?: boolean;
+}): Promise<EffectLedgerScan>;
 //#endregion
 //#region src/conformance.d.ts
 /** The executor options the shared contract exercises. */
@@ -337,4 +407,4 @@ interface ChildResult {
 */
 declare function runChildProcess(spec: ChildSpec): Promise<ChildResult>;
 //#endregion
-export { type ChildResult, type ChildSpec, type ChildStopReason, type ConformanceExecutorConfig, type ConformanceExecutorFactory, type ContainerExecutorOptions, type EffectLedgerScan, type ExecutorConformanceCheck, type ExecutorConformanceSuite, ExecutorError, type ExecutorErrorCode, type ExecutorTestRegistrar, type SubprocessCommandSpec, type SubprocessExecutorOptions, type SubprocessToolInit, type ToolEffectIntent, type ToolEffectLedger, type ToolEffectRecord, containerExecutor, executorConformance, hashArgs, jsonlEffectLedger, loadEffectLedger, memoryEffectLedger, parseToolResult, registerExecutorConformance, runChildProcess, subprocessExecutor, subprocessTool };
+export { type ChildResult, type ChildSpec, type ChildStopReason, type ConformanceExecutorConfig, type ConformanceExecutorFactory, type ContainerExecutorOptions, type CorruptLedgerLine, type EffectLedgerScan, type ExecutorConformanceCheck, type ExecutorConformanceSuite, ExecutorError, type ExecutorErrorCode, type ExecutorTestRegistrar, LedgerCorruptionError, type SubprocessCommandSpec, type SubprocessExecutorOptions, type SubprocessToolInit, type ToolEffectIntent, type ToolEffectLedger, type ToolEffectRecord, type TornLedgerArtifact, containerExecutor, executorConformance, hashArgs, jsonlEffectLedger, loadEffectLedger, memoryEffectLedger, parseToolResult, registerExecutorConformance, runChildProcess, subprocessExecutor, subprocessTool };

package/dist/index.js

@@ -1,9 +1,9 @@
-import { appendFile, mkdtemp, readFile, rm } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { appendFile, mkdtemp, readFile, rm, truncate } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { tool } from "@rulvar/core";
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
 import { existsSync, mkdtempSync, readdirSync, writeFileSync } from "node:fs";
 //#region src/child.ts
 /**
@@ -208,7 +208,7 @@ function parseToolResult(stdout, tool) {
 *
 * Docs: https://docs.rulvar.com/guide/isolated-executor.
 */
-const wallClock$1 = Date.now.bind(globalThis);
+const wallClock$2 = Date.now.bind(globalThis);
 function resolveCommand(request, options) {
 	const spec = request.spec ?? {};
 	const command = typeof spec.command === "string" ? spec.command : options.command;
@@ -230,12 +230,13 @@ function subprocessExecutor(options = {}) {
 	const killGraceMs = options.killGraceMs ?? 2e3;
 	const maxOutputBytes = options.maxOutputBytes ?? 1024 * 1024;
 	const workdirBase = options.workdirBase ?? tmpdir();
-	const now = options.now ?? wallClock$1;
+	const now = options.now ?? wallClock$2;
 	return { async run(request) {
 		const { command, args } = resolveCommand(request, options);
 		const workdir = await mkdtemp(join(workdirBase, `rulvar-exec-${request.tool}-`));
 		const startedAt = now();
 		const argsHash = hashArgs(request.args);
+		const attemptId = randomUUID();
 		if (options.ledger?.intent !== void 0) try {
 			await options.ledger.intent({
 				idempotencyKey: request.ctx.idempotencyKey,
@@ -245,7 +246,8 @@ function subprocessExecutor(options = {}) {
 				argsHash,
 				executor: request.executor,
 				workdir,
-				startedAt
+				startedAt,
+				attemptId
 			});
 		} catch (err) {
 			await rm(workdir, {
@@ -257,6 +259,9 @@ function subprocessExecutor(options = {}) {
 		let outcome = "error";
 		let exitCode = null;
 		let signal = null;
+		let settled;
+		let bodyThrew = false;
+		let thrownBody;
 		try {
 			const env = {};
 			for (const name of options.allowEnv ?? []) {
@@ -312,9 +317,14 @@ function subprocessExecutor(options = {}) {
 			}
 			const result = parseToolResult(child.stdout, request.tool);
 			outcome = "ok";
-			return result;
-		} finally {
-			const durationMs = now() - startedAt;
+			settled = result;
+		} catch (thrown) {
+			bodyThrew = true;
+			thrownBody = thrown;
+		}
+		const durationMs = now() - startedAt;
+		let ledgerFailure;
+		try {
 			if (options.ledger !== void 0) await options.ledger.record({
 				idempotencyKey: request.ctx.idempotencyKey,
 				runId: request.ctx.runId,
@@ -324,16 +334,22 @@ function subprocessExecutor(options = {}) {
 				executor: request.executor,
 				workdir,
 				startedAt,
+				attemptId,
 				durationMs,
 				outcome,
 				exitCode,
 				signal
 			});
-			await rm(workdir, {
-				recursive: true,
-				force: true
-			});
+		} catch (recordErr) {
+			ledgerFailure = new ExecutorError("ledger", `tool '${request.tool}' outcome was not recorded: the ledger record write failed (${recordErr instanceof Error ? recordErr.message : String(recordErr)})` + (bodyThrew ? `; the dispatch itself had already failed (${thrownBody instanceof Error ? thrownBody.message : String(thrownBody)})` : ""));
 		}
+		await rm(workdir, {
+			recursive: true,
+			force: true
+		});
+		if (ledgerFailure !== void 0) throw ledgerFailure;
+		if (bodyThrew) throw thrownBody;
+		return settled;
 	} };
 }
 /**
@@ -384,7 +400,7 @@ function subprocessTool(init) {
 * ToolExecutorProvider seam; this docker adapter is the batteries-included
 * reference. Docs: https://docs.rulvar.com/guide/isolated-executor.
 */
-const wallClock = Date.now.bind(globalThis);
+const wallClock$1 = Date.now.bind(globalThis);
 /** The default host variables the docker CLI needs to reach its daemon. */
 const DEFAULT_DAEMON_ENV = [
 	"PATH",
@@ -414,7 +430,7 @@ function containerExecutor(options) {
 	const killGraceMs = options.killGraceMs ?? 5e3;
 	const maxOutputBytes = options.maxOutputBytes ?? 1024 * 1024;
 	const workdirBase = options.workdirBase ?? tmpdir();
-	const now = options.now ?? wallClock;
+	const now = options.now ?? wallClock$1;
 	return { async run(request) {
 		const spec = request.spec ?? {};
 		const command = typeof spec.command === "string" ? spec.command : options.command;
@@ -424,6 +440,7 @@ function containerExecutor(options) {
 		const workdir = await mkdtemp(join(workdirBase, `rulvar-cexec-${request.tool}-`));
 		const startedAt = now();
 		const argsHash = hashArgs(request.args);
+		const attemptId = randomUUID();
 		if (options.ledger?.intent !== void 0) try {
 			await options.ledger.intent({
 				idempotencyKey: request.ctx.idempotencyKey,
@@ -433,7 +450,8 @@ function containerExecutor(options) {
 				argsHash,
 				executor: request.executor,
 				workdir,
-				startedAt
+				startedAt,
+				attemptId
 			});
 		} catch (err) {
 			await rm(workdir, {
@@ -445,6 +463,9 @@ function containerExecutor(options) {
 		let outcome = "error";
 		let exitCode = null;
 		let signal = null;
+		let settled;
+		let bodyThrew = false;
+		let thrownBody;
 		try {
 			const daemonEnv = options.daemonEnv ?? DEFAULT_DAEMON_ENV;
 			const env = {};
@@ -520,9 +541,14 @@ function containerExecutor(options) {
 			}
 			const result = parseToolResult(child.stdout, request.tool);
 			outcome = "ok";
-			return result;
-		} finally {
-			const durationMs = now() - startedAt;
+			settled = result;
+		} catch (thrown) {
+			bodyThrew = true;
+			thrownBody = thrown;
+		}
+		const durationMs = now() - startedAt;
+		let ledgerFailure;
+		try {
 			if (options.ledger !== void 0) await options.ledger.record({
 				idempotencyKey: request.ctx.idempotencyKey,
 				runId: request.ctx.runId,
@@ -532,42 +558,102 @@ function containerExecutor(options) {
 				executor: request.executor,
 				workdir,
 				startedAt,
+				attemptId,
 				durationMs,
 				outcome,
 				exitCode,
 				signal
 			});
-			await rm(workdir, {
-				recursive: true,
-				force: true
-			});
+		} catch (recordErr) {
+			ledgerFailure = new ExecutorError("ledger", `container tool '${request.tool}' outcome was not recorded: the ledger record write failed (${recordErr instanceof Error ? recordErr.message : String(recordErr)})` + (bodyThrew ? `; the dispatch itself had already failed (${thrownBody instanceof Error ? thrownBody.message : String(thrownBody)})` : ""));
 		}
+		await rm(workdir, {
+			recursive: true,
+			force: true
+		});
+		if (ledgerFailure !== void 0) throw ledgerFailure;
+		if (bodyThrew) throw thrownBody;
+		return settled;
 	} };
 }
 //#endregion
 //#region src/ledger.ts
 /**
-* The durable JSONL reference of the two-phase effect ledger (RV404):
-* one JSON line per phase, appended and awaited, so the intent row is
-* on disk before the external effect is dispatched and survives a host
-* process crash between the effect and the outcome write. What it is
-* NOT: a transactional outbox, business authorization, or monetary
-* reconciliation; those stay host obligations, this file is the strict
-* interface the host reconciles FROM.
+* The durable JSONL reference of the two-phase effect ledger (RV404,
+* hardened by RV501/RV502): one JSON line per phase, appended and
+* awaited, so the intent row is on disk before the external effect is
+* dispatched and survives a host process crash between the effect and
+* the outcome write. What it is NOT: a transactional outbox, business
+* authorization, or monetary reconciliation; those stay host
+* obligations, this file is the strict interface the host reconciles
+* FROM.
+*
+* Identity (RV501): every reference-executor dispatch is one ATTEMPT
+* with its own `attemptId`, and an outcome resolves exactly the intent
+* of its own attempt. A sibling retry's outcome, whatever its class,
+* says nothing about another attempt, so it never clears one: closing
+* the logical idempotency key is the host reconciler's job, against
+* the effect provider's receipt.
+*
+* Recovery (RV502): before its first append the writer repairs a torn
+* tail (the artifact of a crash mid-write): a complete record missing
+* only its newline is terminated in place, an unparseable fragment is
+* truncated and quarantined verbatim as a `{"phase":"torn"}` line. A
+* later scan therefore treats an unparseable INTERIOR line as real
+* damage and fails closed instead of skipping it silently.
 *
 * Durability boundary, stated honestly: an awaited append survives a
 * process crash (the write has entered the kernel), not necessarily a
 * power loss before the OS flushes; a host that needs power-loss
 * durability wraps the seam over its own fsync or database write.
 */
+const wallClock = Date.now.bind(globalThis);
+/**
+* Repairs the file's tail so an append can never glue onto a torn
+* fragment (RV502): a parseable unterminated record gets its newline, a
+* torn fragment is truncated and preserved verbatim in a quarantine
+* line old readers parse and skip. Runs under the ledger's documented
+* single-writer discipline.
+*/
+async function repairTail(path, now) {
+	let raw;
+	try {
+		raw = await readFile(path);
+	} catch (err) {
+		if (err.code === "ENOENT") return;
+		throw err;
+	}
+	if (raw.length === 0 || raw[raw.length - 1] === 10) return;
+	const boundary = raw.lastIndexOf(10) + 1;
+	const fragment = raw.subarray(boundary).toString("utf8");
+	try {
+		JSON.parse(fragment);
+	} catch {
+		await truncate(path, boundary);
+		await appendFile(path, `${JSON.stringify({
+			phase: "torn",
+			bytes: fragment,
+			recoveredAt: now()
+		})}\n`, "utf8");
+		return;
+	}
+	await appendFile(path, "\n", "utf8");
+}
 /**
 * A two-phase ToolEffectLedger appending JSON lines to `path`
 * (`{ phase: 'intent' | 'outcome', ... }`). Pass it to
 * `subprocessExecutor({ ledger })` or `containerExecutor({ ledger })`;
-* scan it back with {@link loadEffectLedger}.
+* scan it back with {@link loadEffectLedger}. The first append lazily
+* repairs a torn tail left by a crashed predecessor (RV502).
 */
-function jsonlEffectLedger(path) {
-	const append = (line) => appendFile(path, `${JSON.stringify(line)}\n`, "utf8");
+function jsonlEffectLedger(path, options) {
+	const now = options?.now ?? wallClock;
+	let boundaryReady;
+	const append = async (line) => {
+		boundaryReady ??= repairTail(path, now);
+		await boundaryReady;
+		await appendFile(path, `${JSON.stringify(line)}\n`, "utf8");
+	};
 	return {
 		intent(entry) {
 			return append({
@@ -584,21 +670,61 @@ function jsonlEffectLedger(path) {
 	};
 }
 /**
+* The fail-closed refusal of {@link loadEffectLedger} (RV502): the file
+* holds at least one unparseable INTERIOR line, which the writer's tail
+* repair can never produce, so it means external damage or a second
+* writer, never a normal crash artifact. Reconciling from a partial
+* scan would silently drop intents; triage the named lines instead
+* (`tolerateCorrupt: true` surfaces them as data).
+*/
+var LedgerCorruptionError = class extends Error {
+	lines;
+	constructor(path, lines) {
+		const first = lines[0];
+		super(`effect ledger '${path}' has ${String(lines.length)} corrupt interior line(s); first at line ${String(first?.line)}, byte ${String(first?.offset)}, sha256 ${String(first?.sha256)}. An interior line the scan cannot parse means external damage or a second writer; reconciliation must not proceed from a partial scan (loadEffectLedger with { tolerateCorrupt: true } surfaces the lines for triage).`);
+		this.name = "LedgerCorruptionError";
+		this.lines = lines;
+	}
+};
+/**
 * Scans a JSONL ledger file into intents, outcomes, and the orphaned
-* intents a host must reconcile. A torn trailing line (the artifact of
-* a crash mid-write) is skipped, never a scan failure: the durable rows
-* before it are exactly what reconciliation needs.
+* intents a host must reconcile, pairing attempts exactly (RV501). A
+* torn TRAILING fragment (the crash-mid-write artifact) is tolerated
+* and reported; an unparseable INTERIOR line fails the scan closed with
+* a typed {@link LedgerCorruptionError} unless `tolerateCorrupt` asks
+* for the lines as data (RV502).
 */
-async function loadEffectLedger(path) {
-	const raw = await readFile(path, "utf8");
+async function loadEffectLedger(path, options) {
+	const raw = await readFile(path);
 	const intents = [];
 	const outcomes = [];
-	for (const line of raw.split("\n")) {
-		if (line.trim() === "") continue;
+	const corrupt = [];
+	const tornArtifacts = [];
+	let tornTail;
+	let line = 0;
+	let start = 0;
+	for (let i = 0; i <= raw.length; i += 1) {
+		const atEnd = i === raw.length;
+		if (!atEnd && raw[i] !== 10) continue;
+		const bytes = raw.subarray(start, i);
+		const offset = start;
+		const terminated = !atEnd;
+		start = i + 1;
+		if (atEnd && bytes.length === 0) break;
+		line += 1;
+		const text = bytes.toString("utf8");
+		if (text.trim() === "") continue;
 		let parsed;
 		try {
-			parsed = JSON.parse(line);
+			parsed = JSON.parse(text);
 		} catch {
+			if (terminated) corrupt.push({
+				line,
+				offset,
+				sha256: createHash("sha256").update(bytes).digest("hex"),
+				preview: text.slice(0, 120)
+			});
+			else tornTail = { preview: text.slice(0, 120) };
 			continue;
 		}
 		if (parsed.phase === "intent") {
@@ -607,13 +733,23 @@ async function loadEffectLedger(path) {
 		} else if (parsed.phase === "outcome") {
 			const { phase: _phase, ...entry } = parsed;
 			outcomes.push(entry);
-		}
+		} else if (parsed.phase === "torn") tornArtifacts.push({
+			bytes: parsed.bytes,
+			recoveredAt: parsed.recoveredAt
+		});
 	}
-	const resolvedKeys = new Set(outcomes.map((entry) => entry.idempotencyKey));
+	if (corrupt.length > 0 && options?.tolerateCorrupt !== true) throw new LedgerCorruptionError(path, corrupt);
+	const resolvedAttempts = /* @__PURE__ */ new Set();
+	const resolvedLegacy = /* @__PURE__ */ new Set();
+	for (const outcome of outcomes) if (outcome.attemptId === void 0) resolvedLegacy.add(JSON.stringify([outcome.idempotencyKey, outcome.startedAt]));
+	else resolvedAttempts.add(outcome.attemptId);
 	return {
 		intents,
 		outcomes,
-		orphanedIntents: intents.filter((entry) => !resolvedKeys.has(entry.idempotencyKey))
+		orphanedIntents: intents.filter((entry) => entry.attemptId === void 0 ? !resolvedLegacy.has(JSON.stringify([entry.idempotencyKey, entry.startedAt])) : !resolvedAttempts.has(entry.attemptId)),
+		corrupt,
+		tornArtifacts,
+		...tornTail === void 0 ? {} : { tornTail }
 	};
 }
 //#endregion
@@ -961,4 +1097,4 @@ function executorConformance(factory, options = {}) {
 	};
 }
 //#endregion
-export { ExecutorError, containerExecutor, executorConformance, hashArgs, jsonlEffectLedger, loadEffectLedger, memoryEffectLedger, parseToolResult, registerExecutorConformance, runChildProcess, subprocessExecutor, subprocessTool };
+export { ExecutorError, LedgerCorruptionError, containerExecutor, executorConformance, hashArgs, jsonlEffectLedger, loadEffectLedger, memoryEffectLedger, parseToolResult, registerExecutorConformance, runChildProcess, subprocessExecutor, subprocessTool };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/executor",
-  "version": "1.94.0",
+  "version": "1.96.0",
   "description": "Rulvar isolated tool executors: reference ToolExecutorProvider adapters that run tool work out of process (subprocess and container) so hostile or model-generated scripts cannot reach host capabilities.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,13 +22,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.94.0"
+    "@rulvar/core": "1.96.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
     "tsdown": "^0.22.14",
     "typescript": "~6.0.3",
-    "@rulvar/testing": "1.94.0"
+    "@rulvar/testing": "1.96.0"
   },
   "repository": {
     "type": "git",