@with-logic/elwood 0.1.0

package/dist/runtime/terminate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminate.d.ts","sourceRoot":"","sources":["../../src/runtime/terminate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,KAAK,mBAAmB,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAKrF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EACnC,QAAQ,GAAE,mBAAqC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/runtime/terminate.js

@@ -0,0 +1,129 @@
+/**
+ * Shared PTY termination helper for graceful stop and force kill.
+ * Implements PRD §5.3 and §9.4.
+ */
+import { causeDetails, ElwoodError, elwoodError, errnoCode } from "../core/errors.js";
+const defaultTimeouts = { gracefulMs: 5_000, forceMs: 1_000 };
+const POST_EXIT_REAP_RETRIES = 4;
+const POST_EXIT_REAP_RETRY_MS = 25;
+/**
+ * Signal the PTY, wait for exit, and reap the leader's process group. The reap is
+ * ATTEMPTED on EVERY exit path — normal exit, timeout, or a throwing PTY operation
+ * — so no path skips it. It does NOT guarantee the tree is gone: a failing reap
+ * (e.g. EPERM) still leaves descendants alive, so that failure is PROPAGATED as a
+ * typed `termination_failed` (never swallowed) and the reaper stays unlatched so a
+ * later `teardown()` RETRIES it. A successful reap latches, so a later reuse is a
+ * harmless no-op (see SessionReaper) (C-LIFE-10).
+ */
+export async function terminatePty(pty, signal, reaper, timeouts = defaultTimeouts) {
+    let terminationError;
+    let observedExit = false;
+    try {
+        const timeoutMs = signal === "SIGTERM" ? timeouts.gracefulMs : timeouts.forceMs;
+        const exited = await waitForExitAfterSignal(pty, signal, timeoutMs);
+        // On a SIGTERM timeout, escalate to SIGKILL. The reported signal is the one
+        // whose wait actually failed, so an operator is sent to the right phase.
+        const escalated = !exited && signal === "SIGTERM"
+            ? await waitForExitAfterSignal(pty, "SIGKILL", timeouts.forceMs)
+            : exited;
+        observedExit = escalated;
+        if (!escalated) {
+            const failedSignal = signal === "SIGTERM" ? "SIGKILL" : signal;
+            terminationError = elwoodError("termination_failed", `PTY did not exit after ${failedSignal}.`);
+        }
+    }
+    catch (error) {
+        terminationError = error;
+    }
+    // Reap on every path — even if the wait timed out or a PTY call threw — so a
+    // termination_failed outcome never leaks the descendant tree (C-LIFE-10). The
+    // reaper does NOT latch on failure, so a later teardown can retry. When BOTH
+    // termination and reap fail, neither cause is dropped: the thrown error keeps
+    // the termination message and carries the reap failure in its details. When
+    // ONLY the reap fails (termination succeeded), the raw system error is wrapped
+    // as a typed `termination_failed` so the caller always rejects with an
+    // ElwoodError, never a bare EPERM (PRD §10, C-ERR-01).
+    try {
+        await reapAfterTermination(reaper, observedExit);
+    }
+    catch (reapError) {
+        if (terminationError === undefined)
+            throw reapOnlyFailed(reapError);
+        throw bothFailed(terminationError, reapError);
+    }
+    if (terminationError !== undefined)
+        throw terminationError;
+}
+async function reapAfterTermination(reaper, observedExit) {
+    let retries = observedExit ? POST_EXIT_REAP_RETRIES : 0;
+    while (true) {
+        try {
+            reaper.reap();
+            return;
+        }
+        catch (error) {
+            if (errnoCode(error) !== "EPERM" || retries === 0)
+                throw error;
+            retries -= 1;
+            await new Promise((resolve) => setTimeout(resolve, POST_EXIT_REAP_RETRY_MS));
+        }
+    }
+}
+/**
+ * Builds one error preserving BOTH the termination and the reap failure causes.
+ * The reap cause is carried on a dedicated `.reapError` string property (NOT the
+ * standard `.cause`, which the termination error may already use for its own root
+ * cause): an ElwoodError gets it in `details.reapError`; any other Error gets it as
+ * a `.reapError` property added in place, preserving the original identity/stack.
+ * Either way neither cause is dropped, whether termination failed with a typed
+ * ElwoodError or a plain PTY Error (C-LIFE-10). Callers/tests read `.reapError`.
+ */
+function bothFailed(terminationError, reapError) {
+    const reap = reapError instanceof Error ? reapError.message : String(reapError);
+    if (terminationError instanceof ElwoodError) {
+        return elwoodError(terminationError.code, terminationError.message, {
+            ...terminationError.details,
+            reapError: reap,
+        });
+    }
+    // Any other termination error reaching here is always an Error (ElwoodError is
+    // handled above; a thrown PTY value was normalized to Error in
+    // waitForExitAfterSignal). Preserve the reap cause on it without losing the
+    // original identity/stack.
+    terminationError.reapError = reap;
+    return terminationError;
+}
+/**
+ * Wraps a reap-only failure (PTY termination SUCCEEDED, the group reap FAILED) as
+ * a typed `termination_failed` error with a normalized cause (errno/syscall/path
+ * when available), so `stop()`/`kill()` reject with an ElwoodError rather than a
+ * raw system error (PRD §10, C-ERR-01, C-LIFE-10).
+ */
+function reapOnlyFailed(reapError) {
+    return elwoodError("termination_failed", "PTY exited but its process group could not be reaped.", {
+        ...causeDetails(reapError),
+    });
+}
+function waitForExitAfterSignal(pty, signal, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let unsubscribe;
+        const timer = setTimeout(() => {
+            unsubscribe?.();
+            resolve(false);
+        }, timeoutMs);
+        try {
+            unsubscribe = pty.onExit(() => {
+                clearTimeout(timer);
+                unsubscribe?.();
+                resolve(true);
+            });
+            pty.kill(signal);
+        }
+        catch (error) {
+            clearTimeout(timer);
+            unsubscribe?.();
+            reject(error instanceof Error ? error : new Error(String(error)));
+        }
+    });
+}
+//# sourceMappingURL=terminate.js.map

package/dist/runtime/terminate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminate.js","sourceRoot":"","sources":["../../src/runtime/terminate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAKtF,MAAM,eAAe,GAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnF,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,MAA6B,EAC7B,MAAmC,EACnC,WAAgC,eAAe;IAE/C,IAAI,gBAAyB,CAAC;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,SAAS,GACb,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/D,gBAAgB,GAAG,WAAW,CAC5B,oBAAoB,EACpB,0BAA0B,YAAY,GAAG,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,IAAI,gBAAgB,KAAK,SAAS;YAAE,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,UAAU,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS;QAAE,MAAM,gBAAgB,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,MAAmC,EACnC,YAAqB;IAErB,IAAI,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC/D,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,gBAAyB,EAAE,SAAkB;IAC/D,MAAM,IAAI,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,gBAAgB,YAAY,WAAW,EAAE,CAAC;QAC5C,OAAO,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE;YAClE,GAAG,gBAAgB,CAAC,OAAO;YAC3B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,+EAA+E;IAC/E,+DAA+D;IAC/D,4EAA4E;IAC5E,2BAA2B;IAC1B,gBAAmD,CAAC,SAAS,GAAG,IAAI,CAAC;IACtE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAkB;IACxC,OAAO,WAAW,CAChB,oBAAoB,EACpB,uDAAuD,EACvD;QACE,GAAG,YAAY,CAAC,SAAS,CAAC;KAC3B,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAAe,EACf,MAA6B,EAC7B,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,IAAI,WAAqC,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,WAAW,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,CAAC;YACH,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,WAAW,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/update/lock.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cross-process lease for globally mutating agent updates.
+ * Implements PRD §9.2, C-LIFE-09, and C-PERF-04: separate Elwood hosts for
+ * one macOS user serialize per-adapter updates and recover a killed owner's lease.
+ */
+export type UpdateAdapter = "claude" | "codex";
+export type UpdateLeaseOptions = {
+    readonly root?: string;
+    readonly pollMs?: number;
+    readonly staleMs?: number;
+};
+export declare function updateLockPath(adapter: UpdateAdapter, root?: string): string;
+/**
+ * Runs `update` only for the lease owner. A contender waits until that owner
+ * settles and then returns without a duplicate update; callers re-read version
+ * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
+ */
+export declare function coordinatedAutoupdate(adapter: UpdateAdapter, update: () => Promise<void>, options?: UpdateLeaseOptions): Promise<void>;
+//# sourceMappingURL=lock.d.ts.map

package/dist/runtime/update/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAYF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,SAAqB,GAAG,MAAM,CAExF;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/runtime/update/lock.js

@@ -0,0 +1,184 @@
+/**
+ * Cross-process lease for globally mutating agent updates.
+ * Implements PRD §9.2, C-LIFE-09, and C-PERF-04: separate Elwood hosts for
+ * one macOS user serialize per-adapter updates and recover a killed owner's lease.
+ */
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { errnoCode } from "../../core/errors.js";
+const defaultPollMs = 50;
+const defaultStaleMs = 30_000;
+const ownerFile = "owner";
+function defaultLeaseRoot() {
+    const user = userInfo();
+    return join(user.homedir, "Library", "Caches", "elwood", `${user.uid}-updates`);
+}
+export function updateLockPath(adapter, root = defaultLeaseRoot()) {
+    return join(root, `${adapter}.lock`);
+}
+/**
+ * Runs `update` only for the lease owner. A contender waits until that owner
+ * settles and then returns without a duplicate update; callers re-read version
+ * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
+ */
+export async function coordinatedAutoupdate(adapter, update, options = {}) {
+    const root = options.root ?? defaultLeaseRoot();
+    const path = updateLockPath(adapter, root);
+    const pollMs = options.pollMs ?? defaultPollMs;
+    const staleMs = options.staleMs ?? defaultStaleMs;
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    await chmod(root, 0o700);
+    const owner = { pid: process.pid, token: randomUUID() };
+    const completion = join(root, `${adapter}.completed`);
+    const priorCompletion = await readCompletion(completion);
+    let observedActive = (await pathExists(path)) || (await pathExists(recoveryPath(path)));
+    let recoveredStale = false;
+    while (!(await claimLease(path, owner))) {
+        // Losing the claim IS an observation of an active owner. Sampling only before
+        // the loop misses a peer that claimed in the interim, and that contender would
+        // then treat its own later claim as the first attempt and run a duplicate
+        // update (PRD §9.2: a contender skips its duplicate attempt).
+        observedActive = true;
+        const waited = await waitForOwner(path, pollMs, staleMs);
+        if (waited === "released")
+            return;
+        recoveredStale = true;
+    }
+    if (!recoveredStale &&
+        (observedActive || (await readCompletion(completion)) !== priorCompletion)) {
+        await releaseLease(path, owner);
+        return;
+    }
+    try {
+        await update();
+    }
+    finally {
+        await Promise.allSettled([writeFile(completion, owner.token, { mode: 0o600 })]);
+        await releaseLease(path, owner);
+    }
+}
+async function claimLease(path, owner) {
+    if (await pathExists(recoveryPath(path)))
+        return false;
+    try {
+        await mkdir(path, { mode: 0o700 });
+    }
+    catch {
+        return false;
+    }
+    try {
+        await writeFile(join(path, ownerFile), serializeOwner(owner), { flag: "wx", mode: 0o600 });
+        if (await pathExists(recoveryPath(path))) {
+            await releaseLease(path, owner);
+            return false;
+        }
+        return true;
+    }
+    catch {
+        await rmdir(path).catch(() => undefined);
+        return false;
+    }
+}
+async function waitForOwner(path, pollMs, staleMs) {
+    for (;;) {
+        let lease;
+        try {
+            lease = await stat(path);
+        }
+        catch {
+            if (await restoreRecovery(path))
+                continue;
+            return "released";
+        }
+        if (Date.now() - lease.mtimeMs >= staleMs) {
+            const recovered = await recoverStaleLease(path);
+            if (recovered === "removed")
+                return "stale_removed";
+            if (recovered === "unrecoverable")
+                return "released";
+        }
+        await delay(pollMs);
+    }
+}
+async function recoverStaleLease(path) {
+    const expected = await readOwner(path);
+    if (expected !== undefined && ownerIsAlive(expected.pid))
+        return "alive";
+    const recovery = recoveryPath(path);
+    try {
+        await rename(path, recovery);
+    }
+    catch {
+        return (await pathExists(recovery)) ? "alive" : "unrecoverable";
+    }
+    const moved = await readOwner(recovery);
+    if (expected?.token !== moved?.token || (moved !== undefined && ownerIsAlive(moved.pid))) {
+        return "unrecoverable";
+    }
+    try {
+        if (moved !== undefined)
+            await unlink(join(recovery, ownerFile));
+        await rmdir(recovery);
+        return "removed";
+    }
+    catch {
+        return "unrecoverable";
+    }
+}
+async function restoreRecovery(path) {
+    try {
+        await rename(recoveryPath(path), path);
+        return true;
+    }
+    catch {
+        return pathExists(path);
+    }
+}
+function recoveryPath(path) {
+    return `${path}.recovery`;
+}
+async function pathExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function releaseLease(path, owner) {
+    const current = await readOwner(path);
+    if (current?.token !== owner.token)
+        return;
+    await unlink(join(path, ownerFile)).catch(() => undefined);
+    await rmdir(path).catch(() => undefined);
+}
+/** File contents, or undefined when absent/unreadable (never throws). */
+async function readCompletion(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readOwner(path) {
+    const match = /^(\d+):([0-9a-f-]+)$/.exec((await readCompletion(join(path, ownerFile))) ?? "");
+    return match ? { pid: Number(match[1]), token: match[2] } : undefined;
+}
+function serializeOwner(owner) {
+    return `${owner.pid}:${owner.token}`;
+}
+function ownerIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return errnoCode(error) !== "ESRCH";
+    }
+}
+//# sourceMappingURL=lock.js.map

package/dist/runtime/update/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUjD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,SAAS,GAAG,OAAO,CAAC;AAG1B,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsB,EACtB,MAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAClD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAuB,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,8EAA8E;QAC9E,+EAA+E;QAC/E,0EAA0E;QAC1E,8DAA8D;QAC9D,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO;QAClC,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IACE,CAAC,cAAc;QACf,CAAC,cAAc,IAAI,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,eAAe,CAAC,EAC1E,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB;IACvD,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,MAAc,EACd,OAAe;IAEf,SAAS,CAAC;QACR,IAAI,KAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,eAAe,CAAC;YACpD,IAAI,SAAS,KAAK,eAAe;gBAAE,OAAO,UAAU,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,KAAK,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,GAAG,IAAI,WAAW,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAiB;IACzD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO;IAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/runtime/update/once.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Process-local autoupdate/cache guard layered over the cross-process update lease.
+ * Implements PRD §9.2 fleet-spawn dedupe, version caching, and the best-effort,
+ * never-poisoning update contract (C-LIFE-09, C-LIFE-11).
+ */
+import type { CommandResult } from "../seams.ts";
+import { coordinatedAutoupdate, type UpdateAdapter } from "./lock.ts";
+/** The outcome of a best-effort autoupdate: it NEVER rejects — a failure is a value. */
+export type AutoupdateOutcome = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: unknown;
+};
+/**
+ * Runs the adapter's update at most once per process; concurrent callers share the single
+ * in-flight attempt. NEVER rejects — a throwing `runUpdate` resolves to `{ok:false, error}` so the
+ * caller can contain it (warn + continue). The cross-process coordinator invalidates the local
+ * version cache whether this process owned the update or waited for a peer.
+ */
+export declare function cachedAutoupdate(adapter: UpdateAdapter, runUpdate: () => Promise<void>, afterAttempt?: () => void): Promise<AutoupdateOutcome>;
+/**
+ * Reads the adapter's `--version` at most once per process. Concurrent first callers share the
+ * single in-flight read; later callers reuse the settled result. A REJECTED read is evicted (not
+ * retained), so a transient failure does not poison later callers — they re-attempt. Invalidated
+ * after an autoupdate so the post-update version is re-read.
+ */
+export declare function cachedVersionRead(adapter: UpdateAdapter, read: () => Promise<CommandResult>): Promise<CommandResult>;
+export declare function invalidateVersionRead(adapter: UpdateAdapter): void;
+/**
+ * Share one in-flight promise per key, but EVICT the entry if it rejects, so a rejected result is
+ * never retained/replayed to a later caller (which would poison the process). A successful result
+ * stays cached for the process lifetime. This is the general guard against the "cached rejected
+ * promise poisons every later caller" class of bug (C-LIFE-11).
+ */
+export declare function dedupeInFlight<K, T>(cache: Map<K, Promise<T>>, key: K, run: () => Promise<T>): Promise<T>;
+export declare function resetAutoupdateForTests(): void;
+export declare function setUpdateCoordinatorForTests(coordinator: typeof coordinatedAutoupdate): void;
+export declare function resetPreflightCacheForTests(): void;
+//# sourceMappingURL=once.d.ts.map

package/dist/runtime/update/once.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"once.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/once.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAItE,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAQpD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC9B,YAAY,CAAC,EAAE,MAAM,IAAI,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAS5B;AAsBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,GACjC,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EACjC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AAED,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,OAAO,qBAAqB,GAAG,IAAI,CAK5F;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/runtime/update/once.js

@@ -0,0 +1,88 @@
+/**
+ * Process-local autoupdate/cache guard layered over the cross-process update lease.
+ * Implements PRD §9.2 fleet-spawn dedupe, version caching, and the best-effort,
+ * never-poisoning update contract (C-LIFE-09, C-LIFE-11).
+ */
+import { coordinatedAutoupdate } from "./lock.js";
+let coordinateUpdate = coordinatedAutoupdate;
+// The settled autoupdate outcome per adapter. Every `autoupdate: true` caller awaits the SAME
+// attempt (concurrent roster spawns run one update); a FAILURE is recorded as a resolved
+// `{ok:false}` value, NOT a rejected promise — so one failed update can neither reject the other
+// concurrent callers nor poison a later start (C-LIFE-09, C-LIFE-11). Best-effort → not retried.
+const autoupdates = new Map();
+/**
+ * Runs the adapter's update at most once per process; concurrent callers share the single
+ * in-flight attempt. NEVER rejects — a throwing `runUpdate` resolves to `{ok:false, error}` so the
+ * caller can contain it (warn + continue). The cross-process coordinator invalidates the local
+ * version cache whether this process owned the update or waited for a peer.
+ */
+export function cachedAutoupdate(adapter, runUpdate, afterAttempt) {
+    const existing = autoupdates.get(adapter);
+    if (existing)
+        return existing;
+    const pending = coordinateUpdate(adapter, runUpdate).then(() => finalizeAutoupdate(adapter, { ok: true }, afterAttempt), (error) => finalizeAutoupdate(adapter, { ok: false, error }, afterAttempt));
+    autoupdates.set(adapter, pending);
+    return pending;
+}
+function finalizeAutoupdate(adapter, outcome, afterAttempt) {
+    try {
+        // A failed installer may still have changed the binary. Invalidate after
+        // every attempt, including a peer-owned or failed one, before validation.
+        invalidateVersionRead(adapter);
+        afterAttempt?.();
+        return outcome;
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+// The in-flight/settled `--version` read per adapter. Caching the PROMISE (not the value) means N
+// concurrent first spawns share ONE subprocess rather than each starting its own.
+const versionReads = new Map();
+/**
+ * Reads the adapter's `--version` at most once per process. Concurrent first callers share the
+ * single in-flight read; later callers reuse the settled result. A REJECTED read is evicted (not
+ * retained), so a transient failure does not poison later callers — they re-attempt. Invalidated
+ * after an autoupdate so the post-update version is re-read.
+ */
+export function cachedVersionRead(adapter, read) {
+    return dedupeInFlight(versionReads, adapter, read);
+}
+export function invalidateVersionRead(adapter) {
+    versionReads.delete(adapter);
+}
+/**
+ * Share one in-flight promise per key, but EVICT the entry if it rejects, so a rejected result is
+ * never retained/replayed to a later caller (which would poison the process). A successful result
+ * stays cached for the process lifetime. This is the general guard against the "cached rejected
+ * promise poisons every later caller" class of bug (C-LIFE-11).
+ */
+export function dedupeInFlight(cache, key, run) {
+    const existing = cache.get(key);
+    if (existing)
+        return existing;
+    const pending = run();
+    cache.set(key, pending);
+    // Evict on rejection so the next caller retries rather than inheriting the failure. Identity-
+    // guarded (only evict if THIS promise is still cached), so a later successful entry is never
+    // clobbered. The `.catch` also keeps the eviction chain from becoming an unhandled rejection.
+    pending.catch(() => {
+        if (cache.get(key) === pending)
+            cache.delete(key);
+    });
+    return pending;
+}
+export function resetAutoupdateForTests() {
+    autoupdates.clear();
+    coordinateUpdate = coordinatedAutoupdate;
+}
+export function setUpdateCoordinatorForTests(coordinator) {
+    // Unit tests provide in-memory command runners and must never contend with a
+    // real desktop host's global update lease. Cross-process coverage calls the
+    // production coordinator directly from fresh child processes.
+    coordinateUpdate = coordinator;
+}
+export function resetPreflightCacheForTests() {
+    versionReads.clear();
+}
+//# sourceMappingURL=once.js.map

package/dist/runtime/update/once.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"once.js","sourceRoot":"","sources":["../../../src/runtime/update/once.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAsB,MAAM,WAAW,CAAC;AAEtE,IAAI,gBAAgB,GAAiC,qBAAqB,CAAC;AAO3E,8FAA8F;AAC9F,yFAAyF;AACzF,iGAAiG;AACjG,iGAAiG;AACjG,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6C,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,SAA8B,EAC9B,YAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CACvD,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,EAC7D,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,YAAY,CAAC,CAC3E,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAsB,EACtB,OAA0B,EAC1B,YAAyB;IAEzB,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/B,YAAY,EAAE,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyC,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,IAAkC;IAElC,OAAO,cAAc,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAyB,EACzB,GAAM,EACN,GAAqB;IAErB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,8FAA8F;IAC9F,6FAA6F;IAC7F,8FAA8F;IAC9F,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;QACjB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,gBAAgB,GAAG,qBAAqB,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,WAAyC;IACpF,6EAA6E;IAC7E,4EAA4E;IAC5E,8DAA8D;IAC9D,gBAAgB,GAAG,WAAW,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}

package/dist/runtime/update-lock.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cross-process lease for globally mutating agent updates.
+ * Implements PRD §9.2, C-LIFE-09, and C-PERF-04: separate Elwood hosts for
+ * one macOS user serialize per-adapter updates and recover a killed owner's lease.
+ */
+export type UpdateAdapter = "claude" | "codex";
+export type UpdateLeaseOptions = {
+    readonly root?: string;
+    readonly pollMs?: number;
+    readonly staleMs?: number;
+};
+export declare function updateLockPath(adapter: UpdateAdapter, root?: string): string;
+/**
+ * Runs `update` only for the lease owner. A contender waits until that owner
+ * settles and then returns without a duplicate update; callers re-read version
+ * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
+ */
+export declare function coordinatedAutoupdate(adapter: UpdateAdapter, update: () => Promise<void>, options?: UpdateLeaseOptions): Promise<void>;
+//# sourceMappingURL=update-lock.d.ts.map

package/dist/runtime/update-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-lock.d.ts","sourceRoot":"","sources":["../../src/runtime/update-lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAaF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,SAAqB,GAAG,MAAM,CAExF;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA8Bf"}