@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/fleets/daemon/execution-listen-policy.js

@@ -0,0 +1,678 @@
+import { WireObjectSchema, WireFunctionSchema, RuntimeExecutionPortSchema, LoopMonitorPortSchema, ExecutionSessionPortSchema, ProcessHandlePortSchema, WireProcessPortSchema, WireWatchPortSchema, WireMethodsSchema } from "../../schemas/fleet-wire.js";
+/**
+ * The execution listen policy — how the fleet daemon exposes a `runtime/execution`
+ * impl over the `runtime/rpc` wire (fleet.md §4.2, §4.3; L6d phase 4).
+ *
+ * The L4b transport (`runtime-rpc-http`) is kind-agnostic: it never names a kind,
+ * a method, or a channel. So the daemon must supply the *listen policy* that tells
+ * the protocol which owner return values become refs (a `session`/`handle` is a
+ * ref; a plain result is inline JSON) and how the opaque `'pty'` channel maps onto
+ * a session's `onOutput`/`write`/`kill`. This is the canonical version of the
+ * policy each transport test reproduces inline — the daemon ships it once.
+ *
+ * This module carries NO authz/friction logic and NO transport plumbing. The gates
+ * are L5's (run inside the L1 invoke pipeline the daemon mounts, §4.5); the
+ * transport is L4b's. This is purely the kind↔wire shape for `runtime/execution`.
+ */
+import { CapabilityError, isCapabilityError, settle as observe, settleNow as observeNow, captureValue, composeDeclaredExecution, composeDeclaredSession, composeDeclaredSpawn } from '@vibesdotdev/kernel';
+import { isCallerOwnedSpawn } from '@vibesdotdev/kernel/execution';
+import { encodeFileContent, decodeFileContent, decodeFileBytes, encodeFileRead, encodeFileObservation, encodeConditionalWrite } from '@vibesdotdev/filesystem/wire';
+import { WorkspaceCustodyRecordSchema, WorkspaceEnrollmentInputSchema } from '@vibesdotdev/workspace-schemas/custody';
+/** The kind id the daemon exposes execution under (gate context + diagnostics). */
+export const EXECUTION_KIND_ID = 'runtime/execution';
+/** The opaque stream channel name the PTY session's byte stream rides. */
+export const PTY_CHANNEL = 'pty';
+/** The spawned-process stream channel names (`spawn()` mode over the wire). */
+export const STDOUT_CHANNEL = 'stdout';
+export const STDERR_CHANNEL = 'stderr';
+export const STDIN_CHANNEL = 'stdin';
+/**
+ * The opaque stream channel a proxied `filesystem/adapter` watch's change events
+ * ride (UNIT-A8, the B3 residual). A live change CALLBACK has no inline wire
+ * representation, exactly as a PTY session's `onOutput` has none — so it rides the
+ * `stream` verb, the SAME wire representation the PTY byte channel uses. The
+ * consumer side (`agent-code-session/src/remote-workspace-fs.ts`) opens this same
+ * channel name by convention (the two packages are wire-independent, like
+ * `REMOTE_FILESYSTEM_WIRE_METHODS`).
+ */
+export const WATCH_CHANNEL = 'fs-watch';
+/**
+ * The async I/O method names a proxied `filesystem/adapter` exposes over the wire
+ * (path utilities are pure and run consumer-side, so they are NOT proxied). The
+ * daemon-side counterpart of the consumer's `REMOTE_FILESYSTEM_WIRE_METHODS` — the
+ * two agree by convention (wire-independent packages). `watch` is proxied
+ * separately (it returns a {@link WireFilesystemWatch} ref, not an inline result).
+ */
+export const FILESYSTEM_IO_WIRE_METHODS = [
+    'exists',
+    'stat',
+    'readFile',
+    'writeFile',
+    'list',
+    'mkdir',
+    'remove',
+    'rename',
+    'copy',
+    'glob'
+];
+/**
+ * The wire surface of `RuntimeExecution` — the methods a consumer invokes back
+ * across the boundary once it has resolved the host's execution impl as a ref.
+ */
+export const EXECUTION_REF_METHODS = [
+    'execute',
+    'spawn',
+    'session',
+    'resolveCommand',
+    'getCapabilities',
+    'healthCheck'
+];
+/** Structural guard: is this owner value the host's {@link RuntimeExecution} impl? */
+export function isRuntimeExecution(value) {
+    return RuntimeExecutionPortSchema.safeParse(value).success;
+}
+/**
+ * The wire surface of the read-only `autoloop/monitor` (fleet fan-out). A consumer
+ * invokes these back across the boundary once it has resolved the host's monitor
+ * as a ref via `query('autoloop/monitor')`.
+ */
+export const MONITOR_REF_METHODS = ['listLoops', 'getLoop', 'listEvents'];
+/**
+ * Structural guard: is this owner value the read-only `autoloop/monitor` impl? It
+ * has exactly the three read methods and no execution methods (so it is never
+ * confused with a RuntimeExecution). Used to classify it as a wire ref.
+ */
+export function isLoopMonitor(value) {
+    return LoopMonitorPortSchema.safeParse(value).success;
+}
+/** Structural guard: is this owner value an interactive PTY {@link ExecutionSession}? */
+export function isExecutionSession(value) {
+    return ExecutionSessionPortSchema.safeParse(value).success;
+}
+/** Structural guard: is this owner value a non-PTY {@link ProcessHandle}? */
+export function isProcessHandle(value) {
+    return ProcessHandlePortSchema.safeParse(value).success;
+}
+/** The wire methods of a spawned process, as the consumer's `adaptWireProcessHandle` reaches them. */
+export const PROCESS_REF_METHODS = ['info', 'exited', 'kill', 'abandon', 'writeStdin', 'closeStdin'];
+/** Structural guard: a process handle whose `exited` is already invocable. */
+export function isWireProcessHandle(value) {
+    return WireProcessPortSchema.safeParse(value).success;
+}
+/** Wrap an owner-side {@link ProcessHandle} into its wire shape. */
+export function toWireProcessHandle(handle, custody) {
+    // ONE retained stdin writer serves every write and the close: a second
+    // `getWriter()` on a locked stream would throw.
+    let stdinWriter = null;
+    const writer = () => {
+        if (!handle.stdin) {
+            throw new CapabilityError('This spawned process has no stdin.', 'UNAVAILABLE', {
+                reason: 'process-stdin-unavailable',
+                retryable: false
+            });
+        }
+        stdinWriter ??= handle.stdin.getWriter();
+        return stdinWriter;
+    };
+    // One hub per output (see createOutputHub). `exited()` is the process exit
+    // JOINED with every output's outcome, opened or not: it resolves once each
+    // output reached its EOF or its channel was closed, and rejects typed as
+    // soon as a read fails — before or after the exit, and however late the
+    // channel was opened. A consumer joins it by opening every advertised output
+    // channel (the adapter does) or closing the ones it does not read.
+    const outputs = new Map();
+    if (handle.stdout)
+        outputs.set(STDOUT_CHANNEL, createOutputHub(handle.stdout, STDOUT_CHANNEL));
+    if (handle.stderr)
+        outputs.set(STDERR_CHANNEL, createOutputHub(handle.stderr, STDERR_CHANNEL));
+    let nativeExited = false;
+    const nativeExit = handle.exited.then(exit => { nativeExited = true; return exit; });
+    const exited = Promise.all([nativeExit, ...Array.from(outputs.values()).map((output) => output.outcome)]).then(([exit]) => exit);
+    void observe(() => exited);
+    let abandoning = null;
+    /** Kill first, never delayed; then release every unopened output; join them all. */
+    const abandonProcess = async (signal) => {
+        const kill = observeNow(() => nativeExited ? undefined : handle.kill(signal));
+        const killed = kill.ok ? Promise.resolve(kill.value) : Promise.reject(kill.cause);
+        const releases = Array.from(outputs.values()).map((output) => output.releaseUnopened());
+        const results = await Promise.allSettled([killed, ...releases]);
+        const causes = results.flatMap((result) => (result.status === 'rejected' ? [result.reason] : []));
+        if (causes.length === 0)
+            return;
+        throw new CapabilityError('The abandoned process was not cleaned up.', 'UNAVAILABLE', {
+            reason: 'execution-wire-cleanup-failed',
+            retryable: false,
+            details: { failures: causes.length },
+            cause: causes.length === 1 ? causes[0] : new AggregateError(causes, 'The abandoned process was not cleaned up.')
+        });
+    };
+    let ownership;
+    if (custody === 'caller') {
+        ownership = { release: async () => {
+                abandoning ??= abandonProcess('SIGKILL');
+                await abandoning;
+                await exited;
+            } };
+    }
+    return {
+        ownership,
+        pid: handle.pid,
+        stdout: handle.stdout,
+        stderr: handle.stderr,
+        stdin: handle.stdin,
+        info: async () => ({ pid: handle.pid }),
+        exited: () => exited,
+        kill: (signal) => handle.kill(signal),
+        abandon: (signal) => {
+            abandoning ??= abandonProcess(signal);
+            return abandoning;
+        },
+        outputBinding: (channel) => outputs.get(channel)?.binding ?? null,
+        writeStdin: async (data) => {
+            const target = writer();
+            await target.write(Uint8Array.from(data)).catch((cause) => {
+                throw new CapabilityError('The spawned process did not accept stdin bytes.', 'UNAVAILABLE', {
+                    reason: 'process-stdin-write-failed',
+                    retryable: false,
+                    cause
+                });
+            });
+        },
+        closeStdin: async () => {
+            const target = writer();
+            await target.close().catch((cause) => {
+                throw new CapabilityError('The spawned process stdin did not close.', 'UNAVAILABLE', {
+                    reason: 'process-stdin-close-failed',
+                    retryable: false,
+                    cause
+                });
+            });
+        }
+    };
+}
+/** Structural guard: is this owner value a {@link WireFilesystemWatch}? */
+export function isWireFilesystemWatch(value) {
+    return WireWatchPortSchema.safeParse(value).success;
+}
+/**
+ * Build a host-side {@link WireFilesystemWatch} over a local adapter's async
+ * `watch(path, callback)`. The host watch starts EAGERLY (so a bad path rejects the
+ * `watch(path)` invoke — never a silently-dead stream); events observed before the
+ * FIRST subscriber attaches buffer in order and flush on attach (mirroring the
+ * http transport's pre-attach frame buffer). `close()` releases the host watch.
+ */
+export async function createFilesystemWatchHandle(adapter, path) {
+    const handlers = new Set();
+    const pending = [];
+    let flushed = false;
+    let closed = false;
+    const unsubscribeHost = await adapter.watch(path, (eventType, filename) => {
+        const event = { eventType, filename: filename || '' };
+        if (handlers.size > 0) {
+            for (const handler of Array.from(handlers))
+                handler(event);
+        }
+        else if (!flushed) {
+            // Buffer events that fire between the eager start and the first subscriber.
+            pending.push(event);
+        }
+    });
+    // `watch` resolved after `close()` already ran (a fast release) — tear the host
+    // watch down immediately so it does not leak.
+    if (closed) {
+        unsubscribeHost();
+    }
+    return {
+        __fleetFsWatch: true,
+        subscribe(onEvent) {
+            handlers.add(onEvent);
+            if (!flushed) {
+                flushed = true;
+                for (const event of pending.splice(0))
+                    onEvent(event);
+            }
+            return () => handlers.delete(onEvent);
+        },
+        close() {
+            closed = true;
+            handlers.clear();
+            pending.length = 0;
+            unsubscribeHost();
+        }
+    };
+}
+/**
+ * Wrap a host-side {@link WatchableFilesystemAdapter} as a {@link ProxiedKind} the
+ * daemon proxies under `filesystem/adapter` (D-DAEMON-CLIENT). The ten async I/O
+ * methods forward untouched; `watch(path)` returns a {@link WireFilesystemWatch}
+ * whose change events ride the {@link WATCH_CHANNEL} stream. Path utilities stay
+ * pure/consumer-side and are deliberately NOT proxied. Pass the result to
+ * `startFleetDaemon({ resolveKind })` (or a `KindResolver`).
+ */
+export function wrapFilesystemAdapterForWire(adapter) {
+    const observeFile = adapter.observeFile?.bind(adapter);
+    const readFileObserved = adapter.readFileObserved?.bind(adapter);
+    const readFileVersioned = adapter.readFileVersioned?.bind(adapter);
+    const writeFileConditional = adapter.writeFileConditional?.bind(adapter);
+    const impl = {
+        describe: adapter.descriptor ? async () => adapter.descriptor : undefined,
+        exists: (path) => adapter.exists(path),
+        stat: (path) => adapter.stat(path),
+        readFile: async (...args) => encodeFileContent(await adapter.readFile(...args)),
+        observeFile: observeFile ? async (...args) => encodeFileObservation(await observeFile(...args)) : undefined,
+        readFileObserved: readFileObserved ? async (...args) => encodeFileRead(await readFileObserved(...args)) : undefined,
+        readFileVersioned: readFileVersioned ? async (...args) => encodeFileRead(await readFileVersioned(...args)) : undefined,
+        writeFileConditional: writeFileConditional ? async (path, data, options) => encodeConditionalWrite(await writeFileConditional(path, decodeFileBytes(data), options)) : undefined,
+        writeFile: (path, data, options) => adapter.writeFile(path, decodeFileContent(data), options),
+        list: (path) => adapter.list(path),
+        mkdir: (...args) => adapter.mkdir(...args),
+        remove: (...args) => adapter.remove(...args),
+        rename: (oldPath, newPath) => adapter.rename(oldPath, newPath),
+        copy: (...args) => adapter.copy(...args),
+        glob: (...args) => adapter.glob(...args),
+        watch: (path) => createFilesystemWatchHandle(adapter, path)
+    };
+    const methods = [...FILESYSTEM_IO_WIRE_METHODS, 'watch'];
+    if (adapter.descriptor)
+        methods.push('describe');
+    if (adapter.observeFile)
+        methods.push('observeFile');
+    if (adapter.readFileObserved)
+        methods.push('readFileObserved');
+    if (adapter.readFileVersioned)
+        methods.push('readFileVersioned');
+    if (adapter.writeFileConditional)
+        methods.push('writeFileConditional');
+    return { impl, methods };
+}
+/** The selected native owner's authority stays on its host; a peer cannot add another hop. */
+export function wrapWorkspaceCustodyForWire(custody) {
+    const enroll = custody.enroll?.bind(custody);
+    const methods = ['resolve'];
+    const impl = {
+        resolve: async (id) => WorkspaceCustodyRecordSchema.nullable().parse(await custody.resolve(id)),
+        enroll: enroll === undefined ? undefined : async (input) => {
+            const local = WorkspaceEnrollmentInputSchema.omit({ host: true }).parse(input);
+            return WorkspaceCustodyRecordSchema.parse(await enroll(local));
+        }
+    };
+    if (enroll)
+        methods.push('enroll');
+    return { impl, methods };
+}
+/** The result fields that cross back; the composed child environment never does. */
+function executionResultOnly(result) {
+    return {
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        durationMs: result.durationMs,
+        timedOut: result.timedOut,
+        aborted: result.aborted
+    };
+}
+/**
+ * The fleet receiving operation (rc02-rc03 C15, cross-host). `execute`, `spawn`
+ * and `session` accept a DECLARED request, `{ command, args?, cwd?, …,
+ * declaration: { env?, inheritEnv? } }`, passed to the kernel as `unknown`:
+ * admission happens inside `composeDeclaredExecution`/`composeDeclaredSpawn`/
+ * `composeDeclaredSession`, which refuse `env`,
+ * `envMode` and `unsetEnv` (`declared-execution-env-injection`) and any unknown
+ * field or remote signal (`declared-execution-invalid`), then compose the child
+ * environment on THIS host's runtime with `envMode: 'replace'`. The caller's
+ * PATH and HOME never travel, and only the execution result crosses back.
+ *
+ * Every `spawn()` result crosses the wire as a {@link WireProcessHandle}. The
+ * daemon root applies this once, so the classifier/binder below only ever see
+ * the wire shape for spawned processes.
+ */
+export function wrapExecutionForWire(execution, host) {
+    return {
+        id: execution.id,
+        descriptor: execution.descriptor,
+        environmentId: execution.environmentId,
+        execute: async (request) => executionResultOnly(await execution.execute(composeDeclaredExecution(host.runtime, captureValue(request), host.signal ? { signal: host.signal } : {}))),
+        spawn: async (request) => {
+            const options = composeDeclaredSpawn(host.runtime, captureValue(request));
+            const handle = await execution.spawn(options);
+            return toWireProcessHandle(handle, isCallerOwnedSpawn(options) ? 'caller' : 'handoff');
+        },
+        kill: (...args) => execution.kill(...args),
+        listSpawnedProcesses: () => execution.listSpawnedProcesses(),
+        // A session is cancelled by its own kill(); it carries no signal.
+        session: (request) => execution.session(composeDeclaredSession(host.runtime, captureValue(request))),
+        resolveCommand: (...args) => execution.resolveCommand(...args),
+        getCapabilities: () => execution.getCapabilities(),
+        healthCheck: () => execution.healthCheck()
+    };
+}
+/**
+ * The generic wire-ref marker (D-DAEMON-CLIENT). A daemon that proxies a kind
+ * beyond `runtime/execution` (e.g. `runtime/client` by id, or `filesystem/adapter`
+ * for a remote code-session workspace) tags the host-side impl with the EXACT
+ * method names a consumer may invoke back across the boundary.
+ * {@link classifyExecutionResult} reads this marker FIRST, so any proxied kind
+ * crosses as an owner-side ref without the classifier needing structural
+ * knowledge of every kind. The marker is a non-enumerable Symbol, so it never
+ * leaks into JSON or the wire method set.
+ */
+const WIRE_REF_METHODS = Symbol('vibes.fleet-daemon.wireRefMethods');
+/**
+ * Tag a host-side impl for the wire: returns a CLEAN forwarding object exposing
+ * exactly `methods` (each bound to `impl`) plus the {@link WIRE_REF_METHODS}
+ * marker. Forwarding (rather than mutating `impl`) keeps a shared impl — e.g. the
+ * host's single filesystem adapter — free of daemon-only markers, and guarantees
+ * only the declared async surface is reachable (a consumer proxy exposes only
+ * declared methods; undeclared props are `undefined`, matching local semantics).
+ */
+export function asWireRef(impl, methods) {
+    const source = WireObjectSchema.parse(impl);
+    const wrapper = {};
+    for (const name of methods) {
+        const method = WireFunctionSchema.safeParse(source[name]);
+        if (method.success)
+            wrapper[name] = method.data.bind(impl);
+    }
+    Object.defineProperty(wrapper, WIRE_REF_METHODS, {
+        value: Object.freeze([...methods]), enumerable: false, configurable: true
+    });
+    return wrapper;
+}
+export function getWireRefMethods(value) {
+    const source = WireObjectSchema.safeParse(value);
+    if (!source.success)
+        return undefined;
+    const methods = WireMethodsSchema.safeParse(Object.getOwnPropertyDescriptor(source.data, WIRE_REF_METHODS)?.value);
+    return methods.success ? methods.data : undefined;
+}
+export function wireMethodNames(impl) {
+    const source = WireObjectSchema.parse(impl);
+    const names = new Set();
+    for (const key of Object.keys(source)) {
+        if (WireFunctionSchema.safeParse(source[key]).success)
+            names.add(key);
+    }
+    let proto = Object.getPrototypeOf(impl);
+    while (proto && proto !== Object.prototype) {
+        for (const key of Object.getOwnPropertyNames(proto)) {
+            if (key === 'constructor')
+                continue;
+            const descriptor = Object.getOwnPropertyDescriptor(proto, key);
+            if (descriptor && WireFunctionSchema.safeParse(descriptor.value).success)
+                names.add(key);
+        }
+        proto = Object.getPrototypeOf(proto);
+    }
+    return [...names];
+}
+/**
+ * Classify an owner return value into the wire shape (fleet.md §4.2 — execution
+ * over RPC). A `session()` and a `spawn()` handle become owner-side refs (their
+ * methods are invoked back over `invoke`); everything else (an `execute()` result,
+ * `resolveCommand`/`getCapabilities` JSON) crosses inline.
+ *
+ * The method lists are exactly the methods a consumer may invoke back across the
+ * boundary — they are the wire surface of `ExecutionSession`/`ProcessHandle`.
+ */
+/** Termination is confirmed by native exit, including an already-closed PTY. */
+async function releaseExecutionSession(session) {
+    const signaled = observeNow(() => session.signal('SIGKILL'));
+    const exited = await observe(() => session.exited());
+    const absent = !signaled.ok && isCapabilityError(signaled.cause) &&
+        (signaled.cause.reason === 'pty-closed' || signaled.cause.reason === 'execution-process-gone');
+    const causes = [
+        ...(!signaled.ok && !absent ? [signaled.cause] : []),
+        ...(!exited.ok ? [exited.cause] : [])
+    ];
+    if (causes.length) {
+        throw new CapabilityError('The owned terminal session did not close cleanly.', 'UNAVAILABLE', {
+            reason: 'execution-wire-cleanup-failed', retryable: false,
+            cause: new AggregateError(causes, 'Terminal session cleanup failed')
+        });
+    }
+}
+export const classifyExecutionResult = (value) => {
+    // A generically-proxied kind (D-DAEMON-CLIENT): a runtime/client, its withId
+    // selector, or a proxied filesystem/adapter, tagged by asWireRef with its exact
+    // wire method surface. Checked FIRST so any proxied kind crosses as an owner ref.
+    const wireMethods = getWireRefMethods(value);
+    if (wireMethods) {
+        return { mode: 'ref', kind: 'object', methods: [...wireMethods] };
+    }
+    // The host's execution impl itself is the FIRST ref a consumer reaches: the
+    // daemon root's `query('runtime/execution')` returns it, and the consumer
+    // invokes execute/spawn/session back over the wire. It must be a ref, not
+    // inline JSON (which would strip its methods — the cause of "execute is not a
+    // function").
+    if (isRuntimeExecution(value)) {
+        return { mode: 'ref', kind: 'object', methods: [...EXECUTION_REF_METHODS] };
+    }
+    // The read-only autoloop/monitor (fleet fan-out): the first ref a loop-monitor
+    // consumer reaches via `query('autoloop/monitor')`. It must be a ref so its
+    // read methods are invocable back over the wire (inline JSON would strip them).
+    // Its results (loop summaries / events) are plain JSON → cross inline.
+    if (isLoopMonitor(value)) {
+        return { mode: 'ref', kind: 'object', methods: [...MONITOR_REF_METHODS] };
+    }
+    if (isWireFilesystemWatch(value)) {
+        // A filesystem/adapter watch handle (UNIT-A8): its change events ride the
+        // WATCH_CHANNEL stream (bindExecutionChannel), so `close` is the only
+        // invocable method. A change callback has no inline wire representation —
+        // the `stream` verb IS the wire, exactly as onOutput is for a PTY session.
+        return { mode: 'ref', kind: 'object', methods: ['close'], ownership: { release: () => value.close() } };
+    }
+    if (isExecutionSession(value)) {
+        return { mode: 'ref', kind: 'object', methods: ['write', 'resize', 'signal', 'exited', 'kill'], ownership: { release: () => releaseExecutionSession(value) } };
+    }
+    if (isWireProcessHandle(value)) {
+        // A spawn() result, pre-wrapped by the daemon root (wrapExecutionForWire)
+        // so `exited` is an invocable METHOD. stdout/stderr/stdin ride the
+        // like-named channels (bindExecutionChannel), never inline JSON; the ref
+        // advertises exactly the channels this process has.
+        return { mode: 'ref', kind: 'object', methods: [...PROCESS_REF_METHODS], channels: processChannels(value), ownership: value.ownership };
+    }
+    if (isProcessHandle(value)) {
+        // A RAW ProcessHandle should never cross (the root wraps spawn results);
+        // if one does, only `kill` is invocable — `exited` is a Promise property
+        // and would NO_METHOD. Declaring it would advertise a broken method.
+        throw new CapabilityError('A process handle must be wrapped by its execution owner before RPC transfer.', 'INVALID_INPUT', {
+            reason: 'execution-wire-handle-unwrapped', retryable: false
+        });
+    }
+    return { mode: 'inline' };
+};
+/** The byte channels a spawned process serves: the ones it has streams for. */
+function processChannels(handle) {
+    return [
+        ...(handle.stdout ? [STDOUT_CHANNEL] : []),
+        ...(handle.stderr ? [STDERR_CHANNEL] : []),
+        ...(handle.stdin ? [STDIN_CHANNEL] : [])
+    ];
+}
+/**
+ * One spawned output stream behind its channel. Nothing reads the stream until
+ * a transport registers the channel (its first `onData`): then exactly ONE
+ * reader (this pump) starts, so the transport's own teardown (which closes
+ * every registered channel) covers every reader and buffer the hub ever owns.
+ * An output no channel was opened for holds no reader and buffers nothing; the
+ * process's own pipe keeps its backpressure.
+ *
+ * - EOF: the channel's end subscribers run once, after the last chunk, so the
+ *   transport sends the channel's CLOSE and the consumer's `ended` settles;
+ *   the outcome resolves.
+ * - A read that fails mid-stream is NOT an EOF: the channel never reports a
+ *   graceful end, and the outcome rejects typed (`process-stream-read-failed`),
+ *   which fails the process's `exited()` (the wire has no error-end for a
+ *   byte channel).
+ * - `close()` (the consumer cancelled this channel, or its connection went
+ *   away) settles the outcome and releases this stream: it cancels a live
+ *   reader, accepts one that already reached its end, and cancels an unread
+ *   stream. It never kills the process. Its acknowledgement is memoized: a
+ *   repeat close returns the same settlement, so a failed release stays
+ *   failed; the transport reports it typed (`rpc-channel-close-failed`).
+ */
+function createOutputHub(stream, channel) {
+    const acquireReader = () => stream.getReader();
+    const handlers = new Set();
+    const endHandlers = new Set();
+    let reader = null;
+    /** The pump finished (EOF, failure or cancellation) and released its lock. */
+    let released = false;
+    let closed = false;
+    let ended = false;
+    let closing = null;
+    let settle;
+    const outcome = new Promise((resolve, reject) => {
+        settle = (failure) => (failure ? reject(failure) : resolve());
+    });
+    void observe(() => outcome);
+    async function pump(active) {
+        try {
+            for (;;) {
+                const { done, value } = await active.read();
+                if (done)
+                    break;
+                if (value)
+                    for (const handler of Array.from(handlers))
+                        handler(value);
+            }
+        }
+        finally {
+            active.releaseLock();
+            released = true;
+        }
+        // Our own close() cancels the read: a teardown it already settled, not an EOF.
+        if (closed)
+            return;
+        ended = true;
+        for (const handler of Array.from(endHandlers))
+            handler();
+        endHandlers.clear();
+        settle();
+    }
+    const release = async () => {
+        closed = true;
+        handlers.clear();
+        endHandlers.clear();
+        if (!reader) {
+            // An unread stream: its outcome settles from the cancel's actual result.
+            try {
+                await stream.cancel();
+            }
+            catch (cause) {
+                settle(new CapabilityError(`The spawned process ${channel} was not released.`, 'UNAVAILABLE', {
+                    reason: 'process-stream-release-failed',
+                    retryable: false,
+                    details: { channel },
+                    cause
+                }));
+                throw cause;
+            }
+            settle();
+            return;
+        }
+        // A closed channel is a settled outcome, never a failed read.
+        settle();
+        // A reader that already reached its end holds nothing to release.
+        if (released)
+            return;
+        return reader.cancel();
+    };
+    const binding = {
+        onData: (handler) => {
+            handlers.add(handler);
+            if (!reader && !closed) {
+                const active = acquireReader();
+                reader = active;
+                void (async () => {
+                    const pumped = await observe(() => pump(active));
+                    if (!pumped.ok && !closed)
+                        settle(new CapabilityError(`The spawned process ${channel} failed mid-read.`, 'UNAVAILABLE', {
+                            reason: 'process-stream-read-failed', retryable: false, details: { channel }, cause: pumped.cause
+                        }));
+                })();
+            }
+            return () => handlers.delete(handler);
+        },
+        onEnd: (handler) => {
+            if (ended) {
+                handler();
+                return () => { };
+            }
+            endHandlers.add(handler);
+            return () => endHandlers.delete(handler);
+        },
+        // stdout/stderr are read-only surfaces; a stray stream/write frame is
+        // dropped (throwing here would 500 the transport's write route).
+        write: () => { },
+        close: () => {
+            closing ??= release();
+            return closing;
+        }
+    };
+    const releaseUnopened = () => {
+        // An opened output reaches its own end; an already-closed one returns its settlement.
+        if (reader && !closing)
+            return Promise.resolve();
+        // Memoized like a close: a later close from the transport returns this settlement.
+        closing ??= release();
+        return closing;
+    };
+    return { binding, outcome, releaseUnopened };
+}
+/**
+ * Bind the opaque stream channels the daemon exposes (fleet.md §4.3):
+ *   - `'pty'` on an interactive session → onOutput/write/kill.
+ *   - `'stdout'`/`'stderr'` on a spawned process → pumped ReadableStream.
+ *   - `'stdin'` on a spawned process → WritableStream writer.
+ *   - `'fs-watch'` on a filesystem/adapter watch handle → change-event stream (A8).
+ * The protocol carries the bytes; this names the methods. Any other
+ * target/channel pair has no binding (the consumer gets `NO_CHANNEL`).
+ */
+export const bindExecutionChannel = (target, channel) => {
+    if (channel === PTY_CHANNEL && isExecutionSession(target)) {
+        const session = target;
+        return {
+            onData: (handler) => session.onOutput(handler),
+            write: (data) => session.write(data),
+            close: () => session.kill()
+        };
+    }
+    if (channel === WATCH_CHANNEL && isWireFilesystemWatch(target)) {
+        const watch = target;
+        const encoder = new TextEncoder();
+        return {
+            // Each change event crosses as one JSON frame (1:1 with the consumer's
+            // onData); the consumer decodes it back to a (eventType, filename) call.
+            onData: (handler) => watch.subscribe((event) => handler(encoder.encode(JSON.stringify(event)))),
+            // A change stream is read-only; a stray write frame is dropped (throwing
+            // here would 500 the transport's write route).
+            write: () => { },
+            // Closing the channel (consumer unsubscribe / SSE drop) releases the host watch.
+            close: () => watch.close()
+        };
+    }
+    if (isWireProcessHandle(target)) {
+        if (channel === STDOUT_CHANNEL && target.stdout) {
+            return target.outputBinding(STDOUT_CHANNEL);
+        }
+        if (channel === STDERR_CHANNEL && target.stderr) {
+            return target.outputBinding(STDERR_CHANNEL);
+        }
+        if (channel === STDIN_CHANNEL && target.stdin) {
+            // Availability: stdin bytes and its close are the awaited writeStdin /
+            // closeStdin methods, through the handle's one retained writer.
+            return {
+                onData: () => () => { },
+                write: (data) => {
+                    return target.writeStdin(Array.from(data));
+                },
+                close: () => {
+                    return target.closeStdin();
+                }
+            };
+        }
+    }
+    return null;
+};
+//# sourceMappingURL=execution-listen-policy.js.map