@steipete/oracle 0.17.3 → 0.19.0

package/dist/src/browser/tabLeaseRegistry.js

@@ -1,14 +1,21 @@
 import path from "node:path";
-import { randomUUID } from "node:crypto";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { isProcessAlive } from "./profileState.js";
+import net from "node:net";
+import { createHash, randomUUID } from "node:crypto";
+import { lstat, mkdir, readFile, realpath, rename, rm, rmdir, stat, writeFile, } from "node:fs/promises";
+import { isProcessAlive, readProcessStartTimeMs } from "./profileState.js";
 import { delay } from "./utils.js";
 export const DEFAULT_MAX_CONCURRENT_CHATGPT_TABS = 3;
 const REGISTRY_FILENAME = "oracle-tab-leases.json";
 const REGISTRY_LOCK_DIRNAME = "oracle-tab-leases.lock";
 const DEFAULT_POLL_MS = 1000;
-const DEFAULT_STALE_MS = 6 * 60 * 60 * 1000;
+const DEFAULT_STALE_MS = 2 * 60 * 1000;
+const LEASE_HEARTBEAT_INTERVAL_MS = 15_000;
 const REGISTRY_LOCK_TIMEOUT_MS = 10_000;
+const REGISTRY_LOCK_OWNER_FILENAME = "owner.json";
+const REGISTRY_RECOVERY_POLL_MS = 50;
+const LEGACY_OWNERLESS_LOCK_STALE_MS = 5 * 60 * 1000;
+const PROCESS_START_TIME_TOLERANCE_MS = 10_000;
+const REGISTRY_RENAME_RETRY_ATTEMPTS = 6;
 export function normalizeMaxConcurrentTabs(value) {
     if (value === undefined || value === null) {
         return DEFAULT_MAX_CONCURRENT_CHATGPT_TABS;
@@ -26,17 +33,21 @@ export async function acquireBrowserTabLease(profileDir, options, deps = {}) {
     const staleMs = Math.max(60_000, options.staleMs ?? DEFAULT_STALE_MS);
     const now = deps.now ?? Date.now;
     const pid = deps.pid ?? process.pid;
+    const processStartedAtMs = await (deps.readProcessStartTimeMs ?? readProcessStartTimeMs)(pid);
     const leaseId = randomUUID();
     const startedAt = now();
     let warned = false;
     let lastHeartbeatAt = 0;
     for (;;) {
+        options.signal?.throwIfAborted();
         const acquired = await withRegistryLock(profileDir, async () => {
+            options.signal?.throwIfAborted();
             const registry = await readRegistry(profileDir);
-            const active = pruneStaleLeases(registry.leases, {
+            const active = await pruneStaleLeases(registry.leases, {
                 nowMs: now(),
                 staleMs,
                 isProcessAlive: deps.isProcessAlive ?? isProcessAlive,
+                readProcessStartTimeMs: deps.readProcessStartTimeMs ?? readProcessStartTimeMs,
             });
             if (active.length >= maxConcurrentTabs) {
                 if (active.length !== registry.leases.length) {
@@ -48,6 +59,7 @@ export async function acquireBrowserTabLease(profileDir, options, deps = {}) {
             const lease = {
                 id: leaseId,
                 pid,
+                ...(processStartedAtMs === null ? {} : { processStartedAtMs }),
                 sessionId: options.sessionId,
                 chromeHost: options.chromeHost,
                 chromePort: options.chromePort,
@@ -56,13 +68,51 @@ export async function acquireBrowserTabLease(profileDir, options, deps = {}) {
             };
             await writeRegistry(profileDir, { version: 1, leases: [...active, lease] });
             return lease;
-        });
+        }, options.signal);
         if (acquired) {
             options.logger?.(`[browser] Acquired ChatGPT browser slot ${leaseId.slice(0, 8)} (${maxConcurrentTabs} max).`);
+            let released = false;
+            let heartbeatInFlight = false;
+            let heartbeatPromise = null;
+            let heartbeatWarningEmitted = false;
+            const heartbeat = setInterval(() => {
+                if (released || heartbeatInFlight)
+                    return;
+                heartbeatInFlight = true;
+                const heartbeatWork = updateBrowserTabLease(profileDir, leaseId, {})
+                    .then(() => {
+                    heartbeatWarningEmitted = false;
+                })
+                    .catch((error) => {
+                    if (!heartbeatWarningEmitted) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        options.logger?.(`[browser] ChatGPT browser slot heartbeat failed; preserving the slot until stale grace expires: ${message}`);
+                        heartbeatWarningEmitted = true;
+                    }
+                })
+                    .finally(() => {
+                    heartbeatInFlight = false;
+                    if (heartbeatPromise === heartbeatWork)
+                        heartbeatPromise = null;
+                });
+                heartbeatPromise = heartbeatWork;
+            }, Math.max(10, deps.heartbeatMs ?? LEASE_HEARTBEAT_INTERVAL_MS));
+            heartbeat.unref();
             return {
                 id: leaseId,
-                release: async (releaseOptions) => releaseBrowserTabLease(profileDir, leaseId, options.logger, releaseOptions),
-                update: async (patch) => updateBrowserTabLease(profileDir, leaseId, patch),
+                release: async (releaseOptions) => {
+                    if (released)
+                        return;
+                    released = true;
+                    clearInterval(heartbeat);
+                    await heartbeatPromise?.catch(() => undefined);
+                    await releaseBrowserTabLease(profileDir, leaseId, options.logger, releaseOptions);
+                },
+                update: async (patch) => {
+                    if (released)
+                        return;
+                    await updateBrowserTabLease(profileDir, leaseId, patch);
+                },
             };
         }
         const elapsed = now() - startedAt;
@@ -74,12 +124,15 @@ export async function acquireBrowserTabLease(profileDir, options, deps = {}) {
         if (timeoutMs > 0 && elapsed >= timeoutMs) {
             throw new Error(`Timed out waiting for ChatGPT browser slot after ${Math.round(elapsed / 1000)}s (${maxConcurrentTabs} max).`);
         }
-        await delay(timeoutMs > 0 ? Math.min(pollMs, timeoutMs - elapsed) : pollMs);
+        await delay(timeoutMs > 0 ? Math.min(pollMs, timeoutMs - elapsed) : pollMs, options.signal);
     }
 }
 export async function updateBrowserTabLease(profileDir, leaseId, patch) {
     await withRegistryLock(profileDir, async () => {
         const registry = await readRegistry(profileDir);
+        if (!registry.leases.some((lease) => lease.id === leaseId)) {
+            throw new Error(`Oracle ChatGPT browser slot ${leaseId.slice(0, 8)} is no longer owned by this controller.`);
+        }
         const leases = registry.leases.map((lease) => lease.id === leaseId
             ? { ...lease, ...patch, id: lease.id, updatedAt: new Date().toISOString() }
             : lease);
@@ -89,26 +142,44 @@ export async function updateBrowserTabLease(profileDir, leaseId, patch) {
 export async function releaseBrowserTabLease(profileDir, leaseId, logger, options = {}) {
     await withRegistryLock(profileDir, async () => {
         const registry = await readRegistry(profileDir);
-        const active = pruneStaleLeases(registry.leases, {
-            nowMs: Date.now(),
-            staleMs: DEFAULT_STALE_MS,
-            isProcessAlive,
-        });
-        const leases = active.filter((lease) => lease.id !== leaseId);
+        // Release is a safety-critical reference-count decrement. Never prune other
+        // controllers here: a transient cross-process liveness false-negative would
+        // make this run look like the final lease and allow it to terminate shared
+        // Chrome underneath live tabs. Stale records are reclaimed by a later acquire.
+        const releasedLease = registry.leases.find((lease) => lease.id === leaseId);
+        if (!releasedLease) {
+            throw new Error(`Oracle ChatGPT browser slot ${leaseId.slice(0, 8)} was already lost; refusing final shared-Chrome cleanup.`);
+        }
+        const leases = registry.leases.filter((lease) => lease.id !== leaseId);
         await writeRegistry(profileDir, { version: 1, leases });
-        await options.onRelease?.({ isLastLease: leases.length === 0 });
-    }).catch(() => undefined);
+        logger?.(`[browser] ChatGPT browser slot ${leaseId.slice(0, 8)} release decision: ` +
+            `isLastLease=${leases.length === 0}; remaining=${leases.length}; ` +
+            `remainingSessions=${formatRemainingLeaseSessions(leases)}.`);
+        await options.onRelease?.({
+            isLastLease: leases.length === 0,
+            releasedLease,
+            remainingLeases: leases,
+        });
+    });
     logger?.(`[browser] Released ChatGPT browser slot ${leaseId.slice(0, 8)}.`);
 }
+function formatRemainingLeaseSessions(leases) {
+    if (leases.length === 0)
+        return "none";
+    return leases
+        .map((lease) => `${lease.id.slice(0, 8)}:${lease.sessionId ?? "unknown"}:pid${lease.pid}:target${lease.chromeTargetId ?? "pending"}`)
+        .join(",");
+}
 export async function hasOtherActiveBrowserTabLeases(profileDir, leaseId, options = {}) {
     const now = options.now ?? Date.now;
     const staleMs = Math.max(60_000, options.staleMs ?? DEFAULT_STALE_MS);
     return withRegistryLock(profileDir, async () => {
         const registry = await readRegistry(profileDir);
-        const active = pruneStaleLeases(registry.leases, {
+        const active = await pruneStaleLeases(registry.leases, {
             nowMs: now(),
             staleMs,
             isProcessAlive: options.isProcessAlive ?? isProcessAlive,
+            readProcessStartTimeMs: options.readProcessStartTimeMs ?? readProcessStartTimeMs,
         });
         if (active.length !== registry.leases.length) {
             await writeRegistry(profileDir, { version: 1, leases: active });
@@ -116,66 +187,366 @@ export async function hasOtherActiveBrowserTabLeases(profileDir, leaseId, option
         return active.some((lease) => lease.id !== leaseId);
     });
 }
-async function withRegistryLock(profileDir, callback) {
+async function withRegistryLock(profileDir, callback, signal) {
     const lockDir = path.join(profileDir, REGISTRY_LOCK_DIRNAME);
+    const lockId = randomUUID();
+    const processStartedAtMs = await readProcessStartTimeMs(process.pid);
     const startedAt = Date.now();
     for (;;) {
+        signal?.throwIfAborted();
         try {
+            // mkdir is exclusive on every platform; rename can replace a live empty
+            // directory on POSIX (including locks held by older Oracle controllers).
             await mkdir(lockDir, { recursive: false });
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EEXIST" && code !== "EPERM" && code !== "ENOTEMPTY") {
+                throw error;
+            }
+            const owner = await readRegistryLockOwner(lockDir);
+            if (owner && !(await isRegistryLockOwnerAlive(owner))) {
+                await recoverDeadRegistryLock(profileDir, lockDir, owner);
+                continue;
+            }
+            if (!owner && (await isRegistryOwnerFileMissing(lockDir))) {
+                const identity = await readRegistryLockIdentity(lockDir);
+                if (identity && Date.now() - identity.mtimeMs >= LEGACY_OWNERLESS_LOCK_STALE_MS) {
+                    await recoverOwnerlessRegistryLock(profileDir, lockDir, identity);
+                    continue;
+                }
+            }
+            if (Date.now() - startedAt > REGISTRY_LOCK_TIMEOUT_MS) {
+                throw new Error(`Timed out waiting for Oracle tab lease registry lock ${lockDir}; preserving the existing lock to avoid split-brain cleanup.`);
+            }
+            await delay(50, signal);
+            continue;
+        }
+        const acquiredIdentity = await readRegistryLockIdentity(lockDir);
+        const temporaryOwner = path.join(lockDir, `${lockId}.tmp`);
+        try {
+            // Publish only complete ownership evidence. A crash before rename leaves
+            // an ownerless lock, which the aged-lock recovery path can safely reclaim.
+            await writeFile(temporaryOwner, `${JSON.stringify({
+                id: lockId,
+                pid: process.pid,
+                createdAt: new Date().toISOString(),
+                ...(processStartedAtMs === null ? {} : { processStartedAtMs }),
+            })}\n`, { encoding: "utf8", flag: "wx" });
+            await renameRegistryFileWithRetry(temporaryOwner, path.join(lockDir, REGISTRY_LOCK_OWNER_FILENAME));
+        }
+        catch (error) {
+            await rm(temporaryOwner, { force: true }).catch(() => undefined);
+            await removeRegistryLockIfOwned(lockDir, lockId).catch(() => undefined);
+            if (acquiredIdentity &&
+                sameRegistryLockDirectory(await readRegistryLockIdentity(lockDir), acquiredIdentity)) {
+                // Only an unchanged empty directory can be removed without an owner.
+                await rmdir(lockDir).catch(() => undefined);
+            }
+            throw error;
+        }
+        break;
+    }
+    try {
+        return await callback();
+    }
+    finally {
+        await removeRegistryLockIfOwned(lockDir, lockId, { requireOwned: true });
+    }
+}
+async function readRegistryLockOwner(lockDir, readFileImpl = readFile) {
+    try {
+        const raw = await readFileImpl(path.join(lockDir, REGISTRY_LOCK_OWNER_FILENAME), "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.id !== "string" ||
+            typeof parsed.pid !== "number" ||
+            !Number.isSafeInteger(parsed.pid) ||
+            parsed.pid <= 0 ||
+            (parsed.processStartedAtMs !== undefined &&
+                (typeof parsed.processStartedAtMs !== "number" ||
+                    !Number.isFinite(parsed.processStartedAtMs)))) {
+            return null;
+        }
+        return {
+            id: parsed.id,
+            pid: parsed.pid,
+            ...(typeof parsed.createdAt === "string" ? { createdAt: parsed.createdAt } : {}),
+            ...(typeof parsed.processStartedAtMs === "number"
+                ? { processStartedAtMs: parsed.processStartedAtMs }
+                : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function isRegistryLockOwnerAlive(owner, deps = { isProcessAlive, readProcessStartTimeMs }) {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const alive = deps.isProcessAlive(owner.pid);
+        const actualStartedAtMs = await deps.readProcessStartTimeMs(owner.pid);
+        // A positive independent identity probe outranks a transient native PID miss.
+        if (actualStartedAtMs !== null) {
+            if (owner.processStartedAtMs !== undefined) {
+                return (Math.abs(actualStartedAtMs - owner.processStartedAtMs) <= PROCESS_START_TIME_TOLERANCE_MS);
+            }
+            const createdAt = owner.createdAt ? Date.parse(owner.createdAt) : Number.NaN;
+            return (!Number.isFinite(createdAt) ||
+                actualStartedAtMs <= createdAt + PROCESS_START_TIME_TOLERANCE_MS);
+        }
+        if (alive)
+            return true;
+        if (attempt === 0)
+            await delay(REGISTRY_RECOVERY_POLL_MS);
+    }
+    return false;
+}
+async function isRegistryOwnerFileMissing(lockDir) {
+    try {
+        await lstat(path.join(lockDir, REGISTRY_LOCK_OWNER_FILENAME));
+        return false;
+    }
+    catch (error) {
+        return error.code === "ENOENT";
+    }
+}
+async function readRegistryLockIdentity(lockDir) {
+    try {
+        const value = await stat(lockDir);
+        return {
+            dev: value.dev,
+            ino: value.ino,
+            birthtimeMs: value.birthtimeMs,
+            mtimeMs: value.mtimeMs,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function sameRegistryLockIdentity(left, right) {
+    return sameRegistryLockDirectory(left, right) && left?.mtimeMs === right.mtimeMs;
+}
+function sameRegistryLockDirectory(left, right) {
+    return (left !== null &&
+        left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.birthtimeMs === right.birthtimeMs);
+}
+async function removeRegistryLockIfOwned(lockDir, lockId, options = {}) {
+    const owner = await readRegistryLockOwnerWithRetry(lockDir, options.readFileImpl);
+    const lockIdentity = owner ? null : await readRegistryLockIdentity(lockDir);
+    if (!owner) {
+        if (lockIdentity && options.requireOwned) {
+            throw new Error(`Unable to verify ownership while releasing Oracle tab lease registry lock ${lockDir}.`);
+        }
+        return false;
+    }
+    if (owner?.id !== lockId) {
+        if (options.requireOwned) {
+            throw new Error(`Oracle tab lease registry lock ${lockDir} changed owners before release; preserving it.`);
+        }
+        return false;
+    }
+    await removeRegistryLockDirectoryWithRetry(lockDir, options.removeImpl);
+    return true;
+}
+async function readRegistryLockOwnerWithRetry(lockDir, readFileImpl = readFile) {
+    for (let attempt = 0;; attempt += 1) {
+        const owner = await readRegistryLockOwner(lockDir, readFileImpl);
+        if (owner)
+            return owner;
+        const identity = await readRegistryLockIdentity(lockDir);
+        if (!identity || attempt + 1 >= REGISTRY_RENAME_RETRY_ATTEMPTS)
+            return null;
+        await delay(25 * (attempt + 1));
+    }
+}
+async function removeRegistryLockDirectoryWithRetry(lockDir, removeImpl = rm) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await removeImpl(lockDir, { recursive: true, force: true });
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            const transient = code === "EPERM" || code === "EBUSY" || code === "EACCES";
+            if (!transient || attempt + 1 >= REGISTRY_RENAME_RETRY_ATTEMPTS)
+                throw error;
+            await delay(50 * (attempt + 1));
+        }
+    }
+}
+export async function removeRegistryLockIfOwnedForTest(lockDir, lockId, options = {}) {
+    return removeRegistryLockIfOwned(lockDir, lockId, { ...options, requireOwned: true });
+}
+async function recoverDeadRegistryLock(profileDir, lockDir, observedOwner) {
+    await withRegistryRecoveryLock(profileDir, async () => {
+        // Re-read after acquiring the crash-safe recovery mutex. Another process may
+        // already have reaped the dead lock and installed a live owner.
+        const currentOwner = await readRegistryLockOwner(lockDir);
+        if (currentOwner?.id !== observedOwner.id ||
+            currentOwner.pid !== observedOwner.pid ||
+            currentOwner.createdAt !== observedOwner.createdAt ||
+            currentOwner.processStartedAtMs !== observedOwner.processStartedAtMs ||
+            (await isRegistryLockOwnerAlive(currentOwner))) {
+            return;
+        }
+        await removeRegistryLockIfOwned(lockDir, currentOwner.id);
+    });
+}
+async function recoverOwnerlessRegistryLock(profileDir, lockDir, observedIdentity) {
+    await withRegistryRecoveryLock(profileDir, async () => {
+        if ((await readRegistryLockOwner(lockDir)) || !(await isRegistryOwnerFileMissing(lockDir)))
+            return;
+        const currentIdentity = await readRegistryLockIdentity(lockDir);
+        if (!sameRegistryLockIdentity(currentIdentity, observedIdentity) ||
+            Date.now() - observedIdentity.mtimeMs < LEGACY_OWNERLESS_LOCK_STALE_MS) {
+            return;
+        }
+        await rm(lockDir, { recursive: true, force: true });
+    });
+}
+async function withRegistryRecoveryLock(profileDir, callback) {
+    const identity = await canonicalProfileIdentity(profileDir);
+    const digest = createHash("sha256").update(identity).digest("hex").slice(0, 24);
+    const windowsEndpoint = `\\\\.\\pipe\\oracle-tab-lease-recovery-${digest}`;
+    const posixPort = 20_000 + (Number.parseInt(digest.slice(0, 8), 16) % 40_000);
+    const endpoint = process.platform === "win32" ? windowsEndpoint : `127.0.0.1:${posixPort}`;
+    const startedAt = Date.now();
+    let server = null;
+    for (;;) {
+        const candidate = net.createServer((socket) => socket.destroy());
+        try {
+            await new Promise((resolve, reject) => {
+                candidate.once("error", reject);
+                const listenOptions = process.platform === "win32"
+                    ? windowsEndpoint
+                    : { host: "127.0.0.1", port: posixPort, exclusive: true };
+                candidate.listen(listenOptions, () => {
+                    candidate.removeListener("error", reject);
+                    resolve();
+                });
+            });
+            server = candidate;
             break;
         }
         catch (error) {
-            if (error.code !== "EEXIST") {
+            candidate.close();
+            if (error.code !== "EADDRINUSE") {
                 throw error;
             }
             if (Date.now() - startedAt > REGISTRY_LOCK_TIMEOUT_MS) {
-                await rm(lockDir, { recursive: true, force: true }).catch(() => undefined);
-                continue;
+                throw new Error(`Timed out waiting for Oracle tab lease recovery mutex ${endpoint}.`);
             }
-            await delay(50);
+            await delay(REGISTRY_RECOVERY_POLL_MS);
         }
     }
     try {
         return await callback();
     }
     finally {
-        await rm(lockDir, { recursive: true, force: true }).catch(() => undefined);
+        if (server) {
+            await new Promise((resolve) => server?.close(() => resolve()));
+        }
     }
 }
+async function canonicalProfileIdentity(profileDir) {
+    let resolved = path.resolve(profileDir);
+    try {
+        resolved = await realpath(resolved);
+    }
+    catch {
+        // The profile normally exists before lease acquisition. Keep an absolute,
+        // normalized fallback so an introspection failure remains fail-closed.
+    }
+    resolved = path.normalize(resolved);
+    if (process.platform === "win32") {
+        if (/^\\\\\?\\UNC\\/iu.test(resolved)) {
+            resolved = `\\\\${resolved.slice(8)}`;
+        }
+        else {
+            resolved = resolved.replace(/^\\\\\?\\/u, "");
+        }
+        resolved = resolved.toLowerCase();
+    }
+    const root = path.parse(resolved).root;
+    while (resolved.length > root.length && /[\\/]$/u.test(resolved)) {
+        resolved = resolved.slice(0, -1);
+    }
+    return resolved;
+}
+export async function canonicalProfileIdentityForTest(profileDir) {
+    return canonicalProfileIdentity(profileDir);
+}
 async function readRegistry(profileDir) {
     try {
         const raw = await readFile(registryPath(profileDir), "utf8");
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed.leases)) {
-            return { version: 1, leases: [] };
+            throw new Error("Oracle tab lease registry is missing its leases array.");
+        }
+        if (!parsed.leases.every(isLeaseRecord)) {
+            throw new Error("Oracle tab lease registry contains an invalid lease record.");
         }
         return {
             version: 1,
-            leases: parsed.leases.filter(isLeaseRecord),
+            leases: parsed.leases,
         };
     }
-    catch {
-        return { version: 1, leases: [] };
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { version: 1, leases: [] };
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Unable to read Oracle tab lease registry: ${message}`, { cause: error });
     }
 }
 async function writeRegistry(profileDir, registry) {
     await mkdir(profileDir, { recursive: true });
-    await writeFile(registryPath(profileDir), `${JSON.stringify(registry, null, 2)}\n`, "utf8");
+    const destination = registryPath(profileDir);
+    const temporary = `${destination}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, `${JSON.stringify(registry, null, 2)}\n`, "utf8");
+        await renameRegistryFileWithRetry(temporary, destination);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}
+async function renameRegistryFileWithRetry(source, destination) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await rename(source, destination);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            const transient = code === "EPERM" || code === "EBUSY" || code === "EACCES";
+            if (!transient || attempt + 1 >= REGISTRY_RENAME_RETRY_ATTEMPTS)
+                throw error;
+            await delay(25 * (attempt + 1));
+        }
+    }
 }
 function registryPath(profileDir) {
     return path.join(profileDir, REGISTRY_FILENAME);
 }
-function pruneStaleLeases(leases, options) {
-    return leases.filter((lease) => {
-        if (!options.isProcessAlive(lease.pid)) {
-            return false;
-        }
+async function pruneStaleLeases(leases, options) {
+    const active = [];
+    for (const lease of leases) {
         const updatedAt = Date.parse(lease.updatedAt);
-        if (Number.isFinite(updatedAt) && options.nowMs - updatedAt > options.staleMs) {
-            return false;
+        // One cross-process liveness probe is not trustworthy enough to delete a
+        // fresh foreign lease. Active controllers refresh updatedAt every 15s; only
+        // a missed heartbeat beyond the grace period permits identity verification.
+        // Invalid timestamps fail closed.
+        if (!Number.isFinite(updatedAt) || options.nowMs - updatedAt <= options.staleMs) {
+            active.push(lease);
+            continue;
         }
-        return true;
-    });
+        if (await isRegistryLockOwnerAlive(lease, options))
+            active.push(lease);
+    }
+    return active;
 }
 function isLeaseRecord(value) {
     if (!value || typeof value !== "object")
@@ -183,6 +554,11 @@ function isLeaseRecord(value) {
     const record = value;
     return (typeof record.id === "string" &&
         typeof record.pid === "number" &&
+        Number.isSafeInteger(record.pid) &&
+        record.pid > 0 &&
+        (record.processStartedAtMs === undefined ||
+            (typeof record.processStartedAtMs === "number" &&
+                Number.isFinite(record.processStartedAtMs))) &&
         typeof record.createdAt === "string" &&
         typeof record.updatedAt === "string");
 }

package/dist/src/browser/utils.js

@@ -1,6 +1,22 @@
 export { parseDuration } from "../duration.js";
-export function delay(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+import { currentBrowserAbortSignal } from "./cancellation.js";
+export function delay(ms, signal = currentBrowserAbortSignal()) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            reject(signal?.reason);
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
 }
 export function estimateTokenCount(text) {
     if (!text) {
@@ -18,6 +34,8 @@ export async function withRetries(task, options = {}) {
             return await task();
         }
         catch (error) {
+            if (error instanceof Error && ["AbortError", "BrowserRunCancelledError"].includes(error.name))
+                throw error;
             if (attempt === retries) {
                 throw error;
             }