@starci/hfs 4.0.10 → 4.2.0

package/runtime/engine/db/provider-reservations.mjs

@@ -1,101 +0,0 @@
-// Provider receipt SQL participates in the machine writer's existing fenced transactions.
-
-export function providerReservationMethods({ need, parse, toJson, hex }) {
-  // Provider/account slots are shared by all five agent roles. A clock timeout is not exit evidence.
-  const providerReservationRow = (row) => row ? { id: row.id, fence: row.fence, attemptId: row.attempt_id,
-    provider: row.provider, account: row.account, model: row.model, role: row.role, state: row.state,
-    slots: row.slots, amountUnit: 'concurrent-launch', maxParallel: row.max_parallel,
-    handle: row.handle, pid: row.pid, launchIdentity: row.launch_identity, hostRequestId: row.host_request_id, createdAt: row.created_at, updatedAt: row.updated_at,
-    scope: parse(row.scope_json), estimate: parse(row.estimate_json), quota: parse(row.quota_json),
-    override: parse(row.override_json), releasedAt: row.released_at, proof: parse(row.proof_json) } : null;
-  function providerReservations(m, { provider = null, account = null, activeOnly = false } = {}) {
-    const where = [], args = [];
-    if (provider !== null) { where.push('provider=?'); args.push(provider); }
-    if (account !== null) { where.push('account=?'); args.push(account); }
-    if (activeOnly) where.push("state<>'released'");
-    return m.db.prepare(`SELECT * FROM provider_reservations${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY fence`).all(...args).map(providerReservationRow);
-  }
-  function providerReservationUsage(m, { provider, account = 'default' } = {}) {
-    const reservations = providerReservations(m, { provider, account, activeOnly: true });
-    return { running: reservations.length, reservations, observed: true };
-  }
-  /** Atomic last-slot admission. Replays preserve the original receipt; changed attempt meaning refuses. */
-  function reserveProvider(m, { provider, account = 'default', attemptId, role, model, maxParallel, scope = null, quota = null, estimate = null, override = null } = {}) {
-    need([provider, account, attemptId, model].every((value) => typeof value === 'string' && value.trim()), 'provider reservation needs provider, account, attemptId and concrete model');
-    need(typeof role === 'string' && role.trim(), 'provider reservation needs one agent role'); // The DDL owns the allowed role domain.
-    need(Number.isInteger(maxParallel) && maxParallel >= 0, 'provider reservation needs nonnegative integer maxParallel');
-    return m.transaction((db) => {
-      const existing = db.prepare('SELECT * FROM provider_reservations WHERE attempt_id=?').get(attemptId);
-      if (existing) {
-        if (existing.provider !== provider || existing.account !== account || existing.model !== model || existing.role !== role || existing.scope_json !== toJson(scope))
-          return { ok: false, reason: 'attempt-conflict', reservation: providerReservationRow(existing) };
-        return { ok: existing.state !== 'released', reason: existing.state === 'released' ? 'attempt-released' : 'reserved', reused: true, reservation: providerReservationRow(existing) };
-      }
-      const running = Number(db.prepare("SELECT count(*) n FROM provider_reservations WHERE provider=? AND account=? AND state<>'released'").get(provider, account).n);
-      if (running >= maxParallel) return { ok: false, reason: 'capacity', running, maxParallel };
-      const id = hex(16), at = m.now();
-      const result = db.prepare("INSERT INTO provider_reservations(id,attempt_id,provider,account,model,role,scope_json,state,max_parallel,quota_json,estimate_json,override_json,created_at,updated_at) VALUES(?,?,?,?,?,?,?,'reserved',?,?,?,?,?,?)")
-        .run(id, attemptId, provider, account, model, role, toJson(scope), maxParallel, toJson(quota), toJson(estimate), toJson(override), at, at);
-      db.prepare("INSERT INTO provider_reservation_events(reservation_id,at,from_state,to_state) VALUES(?,?,NULL,'reserved')").run(id, at);
-      return { ok: true, reason: 'reserved', reused: false, reservation: providerReservationRow(db.prepare('SELECT * FROM provider_reservations WHERE fence=?').get(result.lastInsertRowid)) };
-    });
-  }
-  const fencedProviderRow = (db, { id, fence, attemptId } = {}) => {
-    const row = db.prepare('SELECT * FROM provider_reservations WHERE id=? AND fence=?').get(id ?? '', fence ?? -1);
-    return row && (attemptId === undefined || row.attempt_id === attemptId) ? row : null;
-  };
-  /** Observe launch progress under its original fence; unknown still occupies its slot. */
-  function markProviderReservation(m, { id, fence, attemptId, provider, account, model, role, state, launchIdentity = null, hostRequestId = null, handle = null, pid = null } = {}) {
-    need(['launching', 'live', 'unknown'].includes(state), 'provider reservation observation needs launching, live or unknown');
-    return m.transaction((db) => {
-      const row = fencedProviderRow(db, { id, fence, attemptId });
-      if (!row) return { ok: false, reason: 'fenced' };
-      if (Object.entries({ provider, account, model, role }).some(([key, value]) => value !== undefined && row[key] !== value)) return { ok: false, reason: 'identity-conflict' };
-      if (row.state === 'released') return { ok: false, reason: 'released' };
-      if (state === 'launching' && (typeof launchIdentity !== 'string' || !launchIdentity.trim())) return { ok: false, reason: 'launch-identity-required' };
-      if (launchIdentity !== null && row.launch_identity && row.launch_identity !== launchIdentity) return { ok: false, reason: 'launch-identity-conflict', reservation: providerReservationRow(row) };
-      if (hostRequestId !== null && row.host_request_id && row.host_request_id !== hostRequestId) return { ok: false, reason: 'host-request-conflict', reservation: providerReservationRow(row) };
-      if (state === 'launching' && row.state !== 'reserved' && row.state !== 'launching') return { ok: false, reason: 'state-regression' };
-      if ((row.handle && handle && row.handle !== handle) || (row.pid && pid && row.pid !== pid)) return { ok: false, reason: 'identity-conflict' };
-      const at = m.now();
-      db.prepare('UPDATE provider_reservations SET state=?,launch_identity=coalesce(launch_identity,?),host_request_id=coalesce(host_request_id,?),handle=coalesce(handle,?),pid=coalesce(pid,?),updated_at=? WHERE id=? AND fence=?')
-        .run(state, launchIdentity, hostRequestId, handle, pid, at, id, fence);
-      if (row.state !== state) db.prepare('INSERT INTO provider_reservation_events(reservation_id,at,from_state,to_state) VALUES(?,?,?,?)').run(id, at, row.state, state);
-      return { ok: true, reservation: providerReservationRow(db.prepare('SELECT * FROM provider_reservations WHERE id=?').get(id)) };
-    });
-  }
-  /** Only the launcher/reconciler's definitive matching exit/no-effect receipt releases capacity. */
-  function releaseProviderReservation(m, { id, fence, attemptId, proof } = {}) {
-    return m.transaction((db) => {
-      const row = fencedProviderRow(db, { id, fence, attemptId });
-      if (!row) return { ok: false, reason: 'fenced' };
-      if (row.state === 'released') return { ok: true, reused: true, reservation: providerReservationRow(row) };
-      const affirmation = proof?.hostAffirmation;
-      const reply = affirmation?.receipt, result = reply?.result;
-      const residual = result?.residualResources ?? result?.worker?.residualResources;
-      const identities = [result, result?.worker, result?.terminal].filter((value) => value && typeof value === 'object');
-      const hostNoEffect = reply && typeof reply === 'object' && !['unknown', 'outcome_unknown'].includes(result?.state)
-        && !['unknown', 'outcome_unknown'].includes(result?.worker?.state)
-        && !(residual && typeof residual === 'object' && Object.keys(residual).length > 0)
-        && !identities.some((value) => ['agentTerminalHandle', 'terminalHandle', 'handle', 'pid', 'processId', 'dispatchId'].some((key) => value[key] !== undefined && value[key] !== null && value[key] !== ''))
-        && (result?.failedStage !== undefined || result?.stage !== undefined || typeof reply.error?.code === 'string' && reply.error.code.trim());
-      const resolvedUnknown = row.state === 'unknown' && row.launch_identity && proof?.launchIdentity === row.launch_identity
-        && row.host_request_id && affirmation?.requestId === row.host_request_id && affirmation.kind === 'worker-start-replay'
-        && affirmation.replayed === true && affirmation.outcome === 'failed' && affirmation.effectState === 'none'
-        && hostNoEffect;
-      const noEffect = proof?.kind === 'failed-before-launch' && proof.confirmed === true && !row.handle && !row.pid
-        && (['reserved', 'launching'].includes(row.state) || resolvedUnknown);
-      const terminalEnded = row.handle && proof?.kind === 'closed' && proof.handle === row.handle
-        && ['gone', 'disconnected'].includes(proof.terminalProof) && ['none', 'stopped'].includes(proof.processVerdict);
-      const processEnded = !row.handle && row.pid && proof?.kind === 'process-exited' && proof.pid === row.pid;
-      const ended = proof?.confirmed === true && (terminalEnded || processEnded)
-        && (!row.pid || proof.pid == null || proof.pid === row.pid);
-      if (!noEffect && !ended) return { ok: false, reason: 'exit-unproven', reservation: providerReservationRow(row) };
-      const at = m.now();
-      db.prepare("UPDATE provider_reservations SET state='released',released_at=?,updated_at=?,proof_json=? WHERE id=? AND fence=?").run(at, at, toJson(proof), id, fence);
-      db.prepare("INSERT INTO provider_reservation_events(reservation_id,at,from_state,to_state,proof_json) VALUES(?,?,?,'released',?)").run(id, at, row.state, toJson(proof));
-      return { ok: true, reused: false, reservation: providerReservationRow(db.prepare('SELECT * FROM provider_reservations WHERE id=?').get(id)) };
-    });
-  }
-  return { reserveProvider, providerReservations, providerReservationUsage, markProviderReservation, releaseProviderReservation };
-}

package/runtime/engine/digest.mjs

@@ -1,16 +0,0 @@
-// digest.mjs — the one SHA-256 the runtime hashes with. A leaf: every file's integrity digest,
-// every ledger input ref and every stamped asset is this function, so a byte stream and a file
-// never disagree about what their digest is.
-import { createHash } from 'node:crypto';
-import fs from 'node:fs';
-
-/** The lowercase hex SHA-256 of `value` (string, Buffer or TypedArray). */
-export const sha256 = (value) => createHash('sha256').update(value).digest('hex');
-/** The SHA-256 of the file's exact bytes; throws when the file cannot be read. */
-export function sha256File(file){
-  // A numeric descriptor belongs to the caller; positional reads preserve its offset.
-  const owned=typeof file!=='number',fd=owned?fs.openSync(file,'r'):file;
-  const hash=createHash('sha256'),buffer=Buffer.alloc(1024*1024);
-  try{let at=0,n;while((n=fs.readSync(fd,buffer,0,buffer.length,at))>0){hash.update(buffer.subarray(0,n));at+=n;}return hash.digest('hex');}
-  finally{if(owned)fs.closeSync(fd);}
-}

package/runtime/engine/refuse.mjs

@@ -1,11 +0,0 @@
-// refuse.mjs — the refusal Error every verb raises: a message plus a stable `code` (and any extra fields the
-// caller attaches). `refuse` builds it, `fail` throws it, `need` throws it when a required condition is false.
-
-/** An Error carrying `code` and `extra` fields; callers `throw` it or hand it to a result row. */
-export const refuse = (message, code, extra = {}) => Object.assign(new Error(message), { code, ...extra });
-
-/** Throws the refusal `refuse` builds — the spelling used where refusing is the whole statement. */
-export const fail = (message, code, extra = {}) => { throw refuse(message, code, extra); };
-
-/** Throws `refuse(message, code)` when `ok` is falsy — the assertion spelling of a refusal. */
-export const need = (ok, message, code) => { if (!ok) throw refuse(message, code); };

package/runtime/modules/ops/_labels.yaml

@@ -1,53 +0,0 @@
-# _labels.yaml — the human name of every operation, one shared map.
-# The underscore prefix keeps this file out of the op catalog scan, like
-# _common.yaml: scripts/route/build-ops-registry.mjs and route-op.mjs skip
-# modules/ops/*.yaml files whose names start with "_".
-#
-# Owner request 2026-09-27: kernels, workflows and op workers carry names a person understands. The
-# op id (interface.draw) stays the key everywhere — the ledger, the api, job ids, contracts; this map
-# only says what a human reads for it. Every reader goes through scripts/lib/display-names.mjs
-# (opLabel): Orca [Op] worker titles, starci kernel status legs/nextActions `label`, the supervisor digest and
-# progress report, Telegram notices and the harness UI (ui/server.mjs sends the map in the snapshot
-# as `opLabels`, so the UI shows exactly these words). tests/lib/display-names.spec.mjs keeps one entry per
-# modules/ops/ops/*.yaml. `vi` is what the owner reads; `en` is the UI's English rendering of it.
-schema: starci/op-labels@1
-
-labels:
-  request.analyze: { vi: Phân tích yêu cầu, en: Analyze request }
-  task.execute: { vi: Chọn luồng việc, en: Select workflow }
-  scope.define: { vi: Xác định phạm vi, en: Define scope }
-  scope.finish: { vi: Kết thúc phạm vi, en: Finish scope }
-  goal.revise: { vi: Sửa mục tiêu, en: Revise goal }
-  business.decide: { vi: Chốt nghiệp vụ, en: Decide business rules }
-  architecture.decide: { vi: Thiết kế kiến trúc, en: Design architecture }
-  brand.decide: { vi: Chốt thương hiệu, en: Decide brand }
-  decision.prepare: { vi: Chuẩn bị quyết định, en: Prepare decision }
-  provision.ask: { vi: Xin thông tin, en: Request information }
-  work.author: { vi: Chia việc chi tiết, en: Plan work }
-  workspace.manage: { vi: Dựng workspace, en: Manage workspace }
-  knowledge.repair: { vi: Sửa tri thức, en: Repair knowledge }
-  grammar.update: { vi: Bổ sung Grammar, en: Update grammar }
-  interface.draw: { vi: Vẽ giao diện, en: Draw interface }
-  interface.asset: { vi: Làm hình ảnh, en: Make assets }
-  interface.scaffold: { vi: Dựng khung giao diện, en: Scaffold interface }
-  interface.implement: { vi: Code giao diện, en: Implement interface }
-  interface.audit: { vi: Soát giao diện, en: Audit interface }
-  backend.scaffold: { vi: Dựng khung backend, en: Scaffold backend }
-  backend.implement: { vi: Code backend, en: Implement backend }
-  package.scaffold: { vi: Dựng khung package, en: Scaffold package }
-  code.refactor: { vi: Chỉnh sửa mã nguồn, en: Refactor code }
-  content.generate: { vi: Soạn nội dung, en: Generate content }
-  docs.author: { vi: Viết tài liệu, en: Write docs }
-  test.author: { vi: Viết test, en: Write tests }
-  integration.verify: { vi: Kiểm thử tích hợp, en: Integration test }
-  e2e.verify: { vi: Kiểm thử đầu cuối, en: End-to-end test }
-  perf.verify: { vi: Kiểm thử hiệu năng, en: Performance test }
-  unit.verify: { vi: Chạy toàn bộ unit test, en: Full unit test run }
-  security.verify: { vi: Soát bảo mật, en: Security review }
-  uat.verify: { vi: Kiểm thử UAT, en: UAT test }
-  uat.assisted.prepare: { vi: Chuẩn bị UAT có người, en: Prepare assisted UAT }
-  uat.assisted.verify: { vi: Xác minh UAT có người, en: Verify assisted UAT }
-  review.verify: { vi: Review cuối, en: Final review }
-  handover.review: { vi: Bàn giao, en: Handover }
-  release.deliver: { vi: Phát hành, en: Release }
-  runtime.operate: { vi: Vận hành môi trường, en: Operate runtime }

package/runtime/scripts/api/node/lib.mjs

@@ -1,14 +0,0 @@
-// scripts/api/node/lib.mjs — the runner of the runtime's own scripts as child processes: the node binary that runs this
-// process (process.execPath), a hidden window, utf8 text. The call files beside it (run-script.mjs, syntax-check.mjs,
-// run-node.mjs, spawn-node.mjs, exec-node.mjs) each name one use; nothing outside scripts/api/node imports this runner.
-import { assertMutationFence } from '../../lib/mutation-fence.mjs';
-import { execFile, spawn, spawnSync } from 'node:child_process';
-
-/** `node <args>` with this process's node binary, waited for; options pass through last (cwd, stdio, env, timeout, maxBuffer, input). */
-export const nodeSpawn = (args, options = {}) => { assertMutationFence({ kind: 'node-effect', args }); return spawnSync(process.execPath, args, { encoding: 'utf8', windowsHide: true, ...options }); };
-
-/** `node <args>` with this process's node binary, started and not waited for: the ChildProcess (detached, stdio, env pass through). */
-export const nodeStart = (args, options = {}) => { assertMutationFence({ kind: 'node-effect', args }); return spawn(process.execPath, args, { windowsHide: true, ...options }); };
-
-/** `node <args>` with this process's node binary, waited for without blocking the thread: callback(error, stdout, stderr). */
-export const nodeExecFile = (args, options, callback) => { assertMutationFence({ kind: 'node-effect', args }); return execFile(process.execPath, args, { encoding: 'utf8', windowsHide: true, ...options }, callback); };

package/runtime/scripts/api/node/spawn-node.mjs

@@ -1,6 +0,0 @@
-// spawn-node.mjs — `node <args>` with this process's node binary, started and not waited for: a long-running runtime
-// process (a server, an engine, a detached helper). Returns the ChildProcess.
-import { nodeStart } from './lib.mjs';
-
-/** Starts `node <args>`; options (cwd, env, stdio, detached) pass through. */
-export const spawnNode = (args, options = {}) => nodeStart(args, options);

package/runtime/scripts/api/process/lib.mjs

@@ -1,111 +0,0 @@
-// scripts/api/process/lib.mjs — what the process call files beside it share: the spawn options every child of the
-// runtime carries. The call files (process-list.mjs, kill-tree.mjs, run-shell.mjs, spawn-detached.mjs, set-priority.mjs,
-// hide-child-windows.mjs, ...) each name one use of the host's process table or a child process.
-
-/**
- * `list` with windowsHide: true added to its options argument. `hasArgv`:
- * the call's second argument may be an argv array (spawn, execFile) rather
- * than options (exec). An explicit windowsHide (true or false) is kept.
- */
-export function withWindowsHide(list, hasArgv) {
-  const out = [...list];
-  let slot = 1;
-  if (hasArgv && (Array.isArray(out[1]) || (out[1] == null && out.length > 2))) slot = 2;
-  const options = out[slot];
-  if (options == null) out.splice(slot, out.length > slot ? 1 : 0, { windowsHide: true });
-  else if (typeof options === 'function') out.splice(slot, 0, { windowsHide: true });
-  else if (typeof options === 'object' && !('windowsHide' in options)) out[slot] = { ...options, windowsHide: true };
-  return out;
-}
-
-// ---- the host process table (process-list.mjs, process-list-async.mjs) ------------------------------------------
-
-const psQuote = (s) => String(s).replace(/'/g, "''");
-
-/** The PowerShell script of one process-table read: Win32_Process rows (optionally filtered), with CPU when asked. */
-export function processListScript({ where = null, cmdMax = 4000, cpu = false } = {}) {
-  const filter = where ? ` -Filter '${psQuote(where)}'` : '';
-  return [
-    ...(cpu ? ['$perf = @{}', 'Get-CimInstance Win32_PerfFormattedData_PerfProc_Process | ForEach-Object { if ($_.IDProcess -gt 0) { $perf[[int]$_.IDProcess] = [double]$_.PercentProcessorTime } }'] : []),
-    `Get-CimInstance Win32_Process${filter} | ForEach-Object { $c = [string]$_.CommandLine; [pscustomobject]@{ pid = [int]$_.ProcessId; ppid = [int]$_.ParentProcessId; name = [string]$_.Name; exe = [string]$_.ExecutablePath;`,
-    `  cmd = $c.Substring(0, [Math]::Min(${Number(cmdMax) || 4000}, $c.Length)); ws = [int64]$_.WorkingSetSize;`,
-    `  created = $(if ($_.CreationDate) { ([DateTimeOffset]$_.CreationDate).ToUnixTimeMilliseconds() } else { 0 })${cpu ? '; cpu = $perf[[int]$_.ProcessId]' : ''} } } | ConvertTo-Json -Compress`,
-  ].join('\n');
-}
-
-/** The rows of the PowerShell read's JSON (one object or an array). */
-export const processRowsOfJson = (text) => {
-  const t = String(text ?? '').trim();
-  const v = t ? JSON.parse(t) : [];
-  return (Array.isArray(v) ? v : [v]).map((p) => ({ ...p, pid: Number(p.pid), ppid: Number(p.ppid), cmd: String(p.cmd ?? '') }));
-};
-
-/** The rows of `ps -eo pid=,ppid=,comm=,args=` (exe/created/ws are null there). */
-export const processRowsOfPs = (text, cmdMax = 4000) => String(text ?? '').split(/\r?\n/).map((line) => /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line)).filter(Boolean)
-  .map((m) => ({ pid: Number(m[1]), ppid: Number(m[2]), name: m[3].split('/').pop(), exe: null, cmd: m[4].slice(0, cmdMax), created: null, ws: null }));
-
-// ---- the environment of other processes (process-env.mjs) -------------------------------------------------------
-
-// Windows keeps a process's environment block in its PEB: PEB.ProcessParameters (+0x20) -> Environment (+0x80) and
-// EnvironmentSize (+0x3F0), x64 only. A same-user process opens with PROCESS_QUERY_INFORMATION | PROCESS_VM_READ (0x0410).
-export const PROCESS_ENV_NATIVE = `
-using System;
-using System.Collections.Generic;
-using System.Runtime.InteropServices;
-using System.Text;
-public static class StarciProcessEnv {
-  [StructLayout(LayoutKind.Sequential)] struct PBI { public IntPtr Reserved1; public IntPtr PebBaseAddress; public IntPtr Reserved2a; public IntPtr Reserved2b; public IntPtr UniqueProcessId; public IntPtr Reserved3; }
-  [DllImport("ntdll.dll")] static extern int NtQueryInformationProcess(IntPtr h, int cls, ref PBI pbi, int len, out int ret);
-  [DllImport("kernel32.dll")] static extern bool ReadProcessMemory(IntPtr h, IntPtr addr, byte[] buf, IntPtr size, out IntPtr read);
-  [DllImport("kernel32.dll")] static extern IntPtr OpenProcess(int access, bool inherit, int pid);
-  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr h);
-  [DllImport("kernel32.dll")] static extern bool IsWow64Process(IntPtr h, out bool wow);
-  static byte[] Read(IntPtr h, IntPtr addr, int size) {
-    var buf = new byte[size]; IntPtr n;
-    if (!ReadProcessMemory(h, addr, buf, (IntPtr)size, out n) || (int)n != size) return null;
-    return buf;
-  }
-  public static Dictionary<string, string> Env(int pid) {
-    var h = OpenProcess(0x0410, false, pid);
-    if (h == IntPtr.Zero) return null;
-    try { return EnvHandle(h); } finally { CloseHandle(h); }
-  }
-  public static Dictionary<string, string> EnvHandle(IntPtr h) {
-      bool wow; if (IsWow64Process(h, out wow) && wow) return null;
-      var pbi = new PBI(); int ret;
-      if (NtQueryInformationProcess(h, 0, ref pbi, Marshal.SizeOf(pbi), out ret) != 0) return null;
-      var peb = Read(h, pbi.PebBaseAddress + 0x20, 8); if (peb == null) return null;
-      var parameters = (IntPtr)BitConverter.ToInt64(peb, 0);
-      var envPtr = Read(h, parameters + 0x80, 8); if (envPtr == null) return null;
-      var sizeBuf = Read(h, parameters + 0x3F0, 8); if (sizeBuf == null) return null;
-      long size = BitConverter.ToInt64(sizeBuf, 0);
-      if (size <= 0 || size > 4 * 1024 * 1024) return null;
-      var block = Read(h, (IntPtr)BitConverter.ToInt64(envPtr, 0), (int)size); if (block == null) return null;
-      var d = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
-      foreach (var entry in Encoding.Unicode.GetString(block).Split('\\0')) {
-        if (entry.Length == 0) continue;
-        int i = entry.IndexOf('=', 1); if (i < 0) continue;
-        d[entry.Substring(0, i)] = entry.Substring(i + 1);
-      }
-      return d;
-  }
-}`;
-
-/** The PowerShell script reading `names` from the environment of `pids` (every process when null): JSON [{pid, readable, values}]. */
-export function processEnvScript({ names, pids = null }) {
-  const wanted = JSON.stringify([...names].map(String));
-  const ids = pids ? `@(${[...pids].map((p) => Number(p)).filter(Number.isInteger).join(',')})` : '(Get-Process).Id';
-  return [
-    `Add-Type -TypeDefinition @'${PROCESS_ENV_NATIVE}\n'@ -Language CSharp`,
-    `$names = '${psQuote(wanted)}' | ConvertFrom-Json`,
-    `$rows = foreach ($id in ${ids}) { $e = [StarciProcessEnv]::Env([int]$id); $v = [ordered]@{}; foreach ($n in $names) { $v[$n] = if ($null -ne $e -and $e.ContainsKey($n)) { $e[$n] } else { $null } }; [pscustomobject]@{ pid = [int]$id; readable = ($null -ne $e); values = $v } }`,
-    '@($rows) | ConvertTo-Json -Compress -Depth 4',
-  ].join('\n');
-}
-
-/** The rows of that script's JSON. */
-export const processEnvRowsOfJson = (text) => {
-  const t = String(text ?? '').trim();
-  const v = t ? JSON.parse(t) : [];
-  return (Array.isArray(v) ? v : [v]).map((r) => ({ pid: Number(r.pid), readable: r.readable === true, values: r.values ?? {} }));
-};

package/runtime/scripts/api/process/owned-process.mjs

@@ -1,78 +0,0 @@
-// Process-object identity and bounded termination; callers supply custody captured at their own launch.
-import { spawnSync } from 'node:child_process';
-import { PROCESS_ENV_NATIVE } from './lib.mjs';
-import { OWNED_PROCESS_SCHEMA, validProcessIdentity as validIdentity } from '../../lib/process-identity.mjs';
-import { allocationMs } from '../../../engine/config.mjs';
-
-const NATIVE = `
-public static class StarciOwnedProcess {
-  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetProcessTimes(IntPtr h, out long created, out long exited, out long kernel, out long user);
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool QueryFullProcessImageName(IntPtr h, uint flags, StringBuilder exe, ref int size);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool TerminateProcess(IntPtr h, uint code);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern uint WaitForSingleObject(IntPtr h, uint ms);
-  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr h);
-  public static object[] Call(int pid, bool stop, string birth, string image, string ownershipKey, string ownershipValue, uint waitMs) {
-    var h = OpenProcess(0x00101000u | (stop ? 1u : 0u) | (ownershipKey != null ? 0x0410u : 0u), false, pid);
-    if (h == IntPtr.Zero) return new object[] {false, "unknown", "process-open-unverified", null, null, Marshal.GetLastWin32Error()};
-    try {
-      long created, exited, kernel, user; var exe = new StringBuilder(32768); int size = exe.Capacity;
-      if (!GetProcessTimes(h, out created, out exited, out kernel, out user) || !QueryFullProcessImageName(h, 0, exe, ref size))
-        return new object[] {false, "unknown", "process-identity-unreadable", null, null, Marshal.GetLastWin32Error()};
-      var actualBirth = created.ToString(System.Globalization.CultureInfo.InvariantCulture); var actualImage = exe.ToString();
-      if (stop && (actualBirth != birth || !String.Equals(actualImage, image, StringComparison.OrdinalIgnoreCase)))
-        return new object[] {false, "refused", "process-identity-conflict", actualBirth, actualImage, 0};
-      if (!stop && ownershipKey != null) {
-        var environment = StarciProcessEnv.EnvHandle(h);
-        if (environment == null || !environment.ContainsKey(ownershipKey) || environment[ownershipKey] != ownershipValue)
-          return new object[] {false, "unknown", "process-launch-custody-unverified", actualBirth, actualImage, 0};
-      }
-      var first = WaitForSingleObject(h, 0);
-      if (!stop) return first == 258u ? new object[] {true, "captured", "process-handle-live", actualBirth, actualImage, 0}
-        : new object[] {false, "unknown", "process-not-live-at-capture", actualBirth, actualImage, 0};
-      if (first == 0u) return new object[] {true, "gone", "process-handle-signaled", actualBirth, actualImage, 0};
-      if (first != 258u || !TerminateProcess(h, 1))
-        return new object[] {false, "unknown", "process-termination-unverified", actualBirth, actualImage, Marshal.GetLastWin32Error()};
-      return WaitForSingleObject(h, waitMs) == 0u
-        ? new object[] {true, "stopped", "process-handle-signaled", actualBirth, actualImage, 0}
-        : new object[] {false, "unknown", "process-closure-unverified", actualBirth, actualImage, 0};
-    } finally { CloseHandle(h); }
-  }
-}`;
-const quote = (value) => value == null ? '$null' : `'${String(value).replaceAll("'", "''")}'`;
-
-/**
- * Capture a live process, or stop the exact captured identity on one verified native handle.
- * Only Windows is qualified; custody, platform, child completion or receipt failures remain refused or unknown.
- * The capture and stop call files constrain their modes; this engine preserves the supplied identity and raw outcome.
- */
-export function ownedProcess(pid, { identity = null, ownership = null, waitMs = allocationMs('workerClose.stopVerifyMs'), run = spawnSync, platform = process.platform } = {}) {
-  const base = { schema: OWNED_PROCESS_SCHEMA, pid, ok: false, outcome: 'unknown', identity: identity ?? null };
-  if (platform !== 'win32') return { ...base, reason: 'process-platform-unverified' };
-  if (!Number.isInteger(pid) || pid <= 0 || identity && !validIdentity(identity)
-      || ownership && (typeof ownership.key !== 'string' || !ownership.key || typeof ownership.value !== 'string' || !ownership.value))
-    return { ...base, outcome: 'refused', reason: 'process-custody-required' };
-  if (!Number.isInteger(waitMs) || waitMs <= 0 || waitMs > 60000) return { ...base, outcome: 'refused', reason: 'process-wait-invalid' };
-  const script = [`Add-Type -TypeDefinition @'\n${PROCESS_ENV_NATIVE}\n${NATIVE}\n'@ -Language CSharp`,
-    `$r = [StarciOwnedProcess]::Call(${pid}, $${identity ? 'true' : 'false'}, ${quote(identity?.birth)}, ${quote(identity?.exe)}, ${quote(ownership?.key)}, ${quote(ownership?.value)}, ${waitMs})`,
-    `@{ schema = '${OWNED_PROCESS_SCHEMA}'; pid = ${pid}; ok = $r[0]; outcome = $r[1]; proof = $r[2]; birth = $r[3]; exe = $r[4]; nativeError = $r[5] } | ConvertTo-Json -Compress`].join('\n');
-  let result;
-  try { result = run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script],
-    { encoding: 'utf8', windowsHide: true, timeout: waitMs + 15000, maxBuffer: 1024 * 1024 }); }
-  catch (error) { return { ...base, reason: 'process-call-incomplete', error: String(error?.message ?? error) }; }
-  if (result?.status !== 0 || result.error || result.signal)
-    return { ...base, reason: 'process-call-incomplete', status: result?.status ?? null, signal: result?.signal ?? null, error: result?.error?.message ?? null };
-  let data;
-  try { data = JSON.parse(String(result.stdout ?? '').trim()); } catch { return { ...base, reason: 'process-receipt-incomplete' }; }
-  const actual = { pid, birth: data?.birth, exe: data?.exe };
-  if (data?.schema !== OWNED_PROCESS_SCHEMA || data.pid !== pid || typeof data.ok !== 'boolean'
-      || !['unknown', 'refused', 'captured', 'stopped', 'gone'].includes(data.outcome) || typeof data.proof !== 'string'
-      || data.ok && (!validIdentity(actual) || identity && (actual.birth !== identity.birth || actual.exe.toLowerCase() !== identity.exe.toLowerCase())
-        || data.proof !== (identity ? 'process-handle-signaled' : 'process-handle-live')
-        || !(identity ? ['gone', 'stopped'] : ['captured']).includes(data.outcome)))
-    return { ...base, reason: 'process-receipt-incomplete' };
-  return { schema: OWNED_PROCESS_SCHEMA, pid, ok: data.ok, outcome: data.outcome, proof: data.proof,
-    identity: identity ?? (validIdentity(actual) ? actual : null), nativeError: data.nativeError ?? null,
-    ...(identity && validIdentity(actual) && (actual.birth !== identity.birth || actual.exe.toLowerCase() !== identity.exe.toLowerCase()) ? { observedIdentity: actual } : {}),
-    ...(data.ok ? {} : { reason: data.proof }) };
-}

package/runtime/scripts/api/process/stop-owned-process.mjs

@@ -1,9 +0,0 @@
-// The exact-identity stop call; never infer custody from a PID alone.
-import { ownedProcess as call } from './owned-process.mjs';
-import { OWNED_PROCESS_SCHEMA, validProcessIdentity as validIdentity } from '../../lib/process-identity.mjs';
-
-/** Stop only the process object whose immutable birth and executable were captured by its owner; a signaled handle proves closure, not descendant closure. */
-export function stopOwnedProcess(identity, options = {}) {
-  if (!validIdentity(identity)) return { schema: OWNED_PROCESS_SCHEMA, pid: identity?.pid ?? null, ok: false, outcome: 'refused', reason: 'process-custody-required', identity: identity ?? null };
-  return call(identity.pid, { ...options, identity });
-}