@with-logic/elwood 0.2.1 → 0.2.2

package/dist/runtime/startup/buffer.d.ts

@@ -2,18 +2,20 @@
  * Bounded, release-able collector for the first PTY output of a session.
  *
  * The startup usability check (see index.ts, `assertStartupUsable`) reads the
- * agent's early output exactly once at ~500ms to detect a crash or auth banner.
+ * agent's early output once, at ~500ms, to detect a crash or auth banner.
  * The PTY data handler is never detached for the session's lifetime, so a naive
  * `startupOutput += data` accumulates a second unbounded in-memory transcript
  * for the WHOLE session even though only the startup snapshot is ever consumed.
  *
  * This collector appends only while the startup gate is open and caps the buffer
- * so a chatty CLI cannot balloon it; once `release()` is called (right after the
- * usability check reads it) further chunks are dropped and the retained bytes are
- * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
- * usability and §9.4 resource cleanup.
+ * so a chatty CLI cannot balloon it. For a launch the e2e home guard checks, it also
+ * watches every chunk, past the cap, for the guard's stop marker (PRD §12, C-E2E-24):
+ * after a status-97 exit the check waits up to a second more for that marker before
+ * it settles. Once `release()` is called, when the check settles, further chunks are
+ * dropped and the retained bytes and the watcher are cleared, so no per-session
+ * transcript lingers. Implements PRD §9.1 startup usability and §9.4 resource cleanup.
  */
-import type { PtyExit } from "../../pty/types.ts";
+import type { PtyExit, PtyProcess } from "../../pty/types.ts";
 import { type StartupAdapter } from "./index.ts";
 export type StartupBuffer = {
     /** Appends a PTY chunk while the gate is open; a no-op once released. */
@@ -22,8 +24,25 @@ export type StartupBuffer = {
     readonly read: () => string;
     /** Stops collecting and clears the retained buffer for the rest of the session. */
     readonly release: () => void;
+    /**
+     * Whether the output until release, past the cap included, carried the e2e home guard's stop
+     * marker (PRD §12, C-E2E-24): the guard writes its line after the startup files' own output,
+     * however long that was. `undefined` for a launch the guard does not check, whose output is
+     * never scanned for it.
+     */
+    readonly sawStopMarker: (() => boolean) | undefined;
 };
-export declare function createStartupBuffer(cap?: number): StartupBuffer;
+/**
+ * `watchStopMarker` defaults to whether the e2e home guard checks a launch started now
+ * (`homeGuardChecksLaunch`), as it does the session's. Given a `source` PTY, the buffer reads
+ * it directly, raw and before any rendering, until release: the session's terminal stops
+ * reading a PTY that has exited, while the check may still be waiting for the guard's line.
+ */
+export declare function createStartupBuffer(options?: {
+    readonly capBytes?: number;
+    readonly watchStopMarker?: boolean;
+    readonly source?: Pick<PtyProcess, "onData">;
+}): StartupBuffer;
 /**
  * Runs the ~500ms startup usability check against `buffer`, then releases it on
  * every path (success OR failure) so the collector stops appending and clears

package/dist/runtime/startup/buffer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buffer.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAMtE,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAA2B,GAAG,aAAa,CAwBnF;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf"}
+{"version":3,"file":"buffer.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAMtE,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE;IACP,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;CACzC,GACL,aAAa,CAiCf;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/runtime/startup/buffer.js

@@ -2,45 +2,63 @@
  * Bounded, release-able collector for the first PTY output of a session.
  *
  * The startup usability check (see index.ts, `assertStartupUsable`) reads the
- * agent's early output exactly once at ~500ms to detect a crash or auth banner.
+ * agent's early output once, at ~500ms, to detect a crash or auth banner.
  * The PTY data handler is never detached for the session's lifetime, so a naive
  * `startupOutput += data` accumulates a second unbounded in-memory transcript
  * for the WHOLE session even though only the startup snapshot is ever consumed.
  *
  * This collector appends only while the startup gate is open and caps the buffer
- * so a chatty CLI cannot balloon it; once `release()` is called (right after the
- * usability check reads it) further chunks are dropped and the retained bytes are
- * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
- * usability and §9.4 resource cleanup.
+ * so a chatty CLI cannot balloon it. For a launch the e2e home guard checks, it also
+ * watches every chunk, past the cap, for the guard's stop marker (PRD §12, C-E2E-24):
+ * after a status-97 exit the check waits up to a second more for that marker before
+ * it settles. Once `release()` is called, when the check settles, further chunks are
+ * dropped and the retained bytes and the watcher are cleared, so no per-session
+ * transcript lingers. Implements PRD §9.1 startup usability and §9.4 resource cleanup.
  */
+import { homeGuardChecksLaunch, watchForStopMarker } from "../home-guard/index.js";
 import { assertStartupUsable } from "./index.js";
 // Startup output is tiny (a banner, a prompt); this cap is comfortably larger
 // than any real startup screen while still bounding a misbehaving CLI.
-const STARTUP_BUFFER_CAP = 64 * 1024;
-export function createStartupBuffer(cap = STARTUP_BUFFER_CAP) {
+const STARTUP_BUFFER_CAP_BYTES = 64 * 1024;
+/**
+ * `watchStopMarker` defaults to whether the e2e home guard checks a launch started now
+ * (`homeGuardChecksLaunch`), as it does the session's. Given a `source` PTY, the buffer reads
+ * it directly, raw and before any rendering, until release: the session's terminal stops
+ * reading a PTY that has exited, while the check may still be waiting for the guard's line.
+ */
+export function createStartupBuffer(options = {}) {
+    const cap = options.capBytes ?? STARTUP_BUFFER_CAP_BYTES;
     let buffer = Buffer.alloc(cap);
     let length = 0;
     let open = true;
+    const watched = options.watchStopMarker ?? homeGuardChecksLaunch();
+    let stop = watched ? watchForStopMarker() : undefined;
+    const push = (data) => {
+        stop?.feed(Buffer.from(data));
+        if (!open || length >= cap)
+            return;
+        const remaining = cap - length;
+        // UTF-8 needs at least as many bytes as UTF-16 units. Only measure chunks
+        // already bounded by the remaining capacity; never scan a huge receipt.
+        open = data.length <= remaining && Buffer.byteLength(data, "utf8") <= remaining;
+        // The bounded write stops before an incomplete code point and copies the
+        // prefix into owned storage, without retaining the original chunk string.
+        length += buffer.write(data.slice(0, remaining), length, remaining, "utf8");
+    };
+    const unsubscribe = options.source?.onData(push);
     return {
-        push(data) {
-            if (!open || length >= cap)
-                return;
-            const remaining = cap - length;
-            // UTF-8 needs at least as many bytes as UTF-16 units. Only measure chunks
-            // already bounded by the remaining capacity; never scan a huge receipt.
-            open = data.length <= remaining && Buffer.byteLength(data, "utf8") <= remaining;
-            // The bounded write stops before an incomplete code point and copies the
-            // prefix into owned storage, without retaining the original chunk string.
-            length += buffer.write(data.slice(0, remaining), length, remaining, "utf8");
-        },
+        push,
         read() {
             return buffer.toString("utf8", 0, length);
         },
         release() {
+            unsubscribe?.();
             open = false;
             buffer = Buffer.alloc(0);
             length = 0;
+            stop = undefined;
         },
+        sawStopMarker: watched ? () => stop?.seen ?? false : undefined,
     };
 }
 /**
@@ -50,7 +68,12 @@ export function createStartupBuffer(cap = STARTUP_BUFFER_CAP) {
  */
 export async function assertStartupThenRelease(adapter, buffer, exit) {
     try {
-        await assertStartupUsable({ adapter, exit, output: () => buffer.read() });
+        await assertStartupUsable({
+            adapter,
+            exit,
+            output: () => buffer.read(),
+            sawStopMarker: buffer.sawStopMarker,
+        });
     }
     finally {
         buffer.release();

package/dist/runtime/startup/buffer.js.map

@@ -1 +1 @@
-{"version":3,"file":"buffer.js","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAC;AAEtE,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,kBAAkB;IAClE,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,IAAY;YACf,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,GAAG;gBAAE,OAAO;YACnC,MAAM,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC;YAC/B,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC;YAChF,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"buffer.js","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAC;AAEtE,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAkB3C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAII,EAAE;IAEN,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IACzD,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAAE,CAAC;IACnE,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO;QACnC,MAAM,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC;QAC/B,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC;QAChF,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO;QACL,IAAI;QACJ,IAAI;YACF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,WAAW,EAAE,EAAE,CAAC;YAChB,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC,CAAC;YACX,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC;YACxB,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/startup/cleanup.d.ts

@@ -2,17 +2,24 @@
  * Best-effort startup cleanup that preserves the original startup error.
  * Implements PRD §9.1 and §10 error stability.
  */
-import type { PtyProcess } from "../../pty/types.ts";
+import { type ReapErrorCode } from "../../core/warnings/reasons.ts";
 export type StartupTerminationTimeouts = {
     readonly gracefulMs: number;
     readonly forceMs: number;
 };
+/** A failed startup's PTY, ended by the session that owns its exit and its reaper. */
+export type StartupPty = {
+    /** The leader's pid, which is also its process-group id; reported, never signaled. */
+    readonly pid: number;
+    /** Ends the PTY and reaps its group; never signals a PTY whose exit was already seen. */
+    readonly terminate: (timeouts: StartupTerminationTimeouts) => Promise<void>;
+};
 export type StartupCleanupResources = {
     readonly before?: () => void;
     readonly bridge?: {
         readonly stop: () => Promise<void>;
     };
-    readonly pty?: PtyProcess;
+    readonly pty?: StartupPty;
     readonly terminal?: {
         readonly dispose: () => void;
     };
@@ -20,24 +27,43 @@ export type StartupCleanupResources = {
     /** Overrides the bounded PTY termination window (tests only; production defaults). */
     readonly terminationTimeouts?: StartupTerminationTimeouts;
 };
+/** The parts of a failed startup's cleanup that the session itself owns. */
+export type SessionStartupCleanup = Required<Pick<StartupCleanupResources, "before" | "pty">>;
+/**
+ * A failed startup's PTY termination or group reap that could not be confirmed (§9.1),
+ * so part of the CLI's process tree may still be running. The errno token is
+ * allowlisted, so it is content-free. The group id is diagnostic only: once the leader is
+ * gone the number may be reissued to an unrelated group, so it is never signaled. This
+ * covers the PTY only; the other cleanup steps stay best-effort and unreported.
+ */
+export type UnconfirmedStartupPtyCleanup = {
+    readonly cleanupErrorCode: ReapErrorCode;
+    readonly cleanupProcessGroupId: number;
+};
 /**
  * Wraps the ENTIRE `start*FromRecord` body so the fresh per-launch socket FILE the
  * launch minted is removed on ANY failure before the session takes ownership — a
  * failed state/runtime write, bridge start, PTY start, or guarded post-spawn step
  * otherwise leaks a socket under `/tmp/elwood-*` (§9.1). It removes only THIS launch's
- * own file, never the shared stable home a concurrent launch may still own; the home is
- * deterministic, so the session's next start/resume/teardown collects any empty
- * leftover. On success ownership transfers to the returned session (teardown removes the
- * whole home). The cleanup is contained so it never replaces the original startup error.
+ * own file, and the stable home only when that leaves it empty, so a home a concurrent
+ * launch's socket is in stays (§8.1). On success ownership transfers to the returned
+ * session (teardown removes the whole home; its bridge's stop releases its socket). The
+ * cleanup is contained so it never replaces the original startup error.
+ */
+export declare function withSocketHomeCleanup<T>(releaseSocket: () => void, build: () => Promise<T>): Promise<T>;
+/**
+ * Runs every cleanup step, each best-effort. Resolves to the unconfirmed PTY cleanup, or
+ * `undefined` when there was no PTY or its termination and group reap were both
+ * confirmed. Failures of the other steps never surface here.
  */
-export declare function withSocketHomeCleanup<T>(removeOwnSocketFile: () => void, build: () => Promise<T>): Promise<T>;
-export declare function cleanupStartupResources(resources: StartupCleanupResources): Promise<void>;
+export declare function cleanupStartupResources(resources: StartupCleanupResources): Promise<UnconfirmedStartupPtyCleanup | undefined>;
 /**
  * Runs the post-session-construction startup steps behind ONE cleanup boundary
  * (PRD §9.1, §9.4): if `region` rejects — a failed startup assertion, a PTY write
- * fault, anything — the now-live PTY, bridge, terminal, and any watcher
- * are torn down via `cleanupStartupResources` before the original error rethrows, so
- * a rejected `startClaude`/`startCodex` never leaks live resources.
+ * fault, anything — the now-live PTY, bridge, terminal, and any watcher are torn down
+ * via `cleanupStartupResources` before the original error rethrows. That teardown is
+ * best-effort: when the PTY's termination or group reap could not be confirmed, part of
+ * the process tree may remain, and a typed startup error names that in its details.
  */
 export declare function guardStartupRegion(region: () => Promise<void>, resources: StartupCleanupResources): Promise<void>;
 //# sourceMappingURL=cleanup.d.ts.map

package/dist/runtime/startup/cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,mBAAmB,EAAE,MAAM,IAAI,EAC/B,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAMD,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F;AAUD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAOf"}
+{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,gCAAgC,CAAC;AAExC,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,sFAAsF;AACtF,MAAM,MAAM,UAAU,GAAG;IACvB,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;IACzC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,aAAa,EAAE,MAAM,IAAI,EACzB,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAMD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAcnD;AA2BD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/runtime/startup/cleanup.js

@@ -2,25 +2,25 @@
  * Best-effort startup cleanup that preserves the original startup error.
  * Implements PRD §9.1 and §10 error stability.
  */
-import { SessionReaper } from "../shutdown/reap-tree.js";
-import { terminatePty } from "../shutdown/terminate.js";
+import { ElwoodError, elwoodError, underlyingErrno } from "../../core/errors.js";
+import { isReapErrorCode, unknownErrorToken, } from "../../core/warnings/reasons.js";
 /**
  * Wraps the ENTIRE `start*FromRecord` body so the fresh per-launch socket FILE the
  * launch minted is removed on ANY failure before the session takes ownership — a
  * failed state/runtime write, bridge start, PTY start, or guarded post-spawn step
  * otherwise leaks a socket under `/tmp/elwood-*` (§9.1). It removes only THIS launch's
- * own file, never the shared stable home a concurrent launch may still own; the home is
- * deterministic, so the session's next start/resume/teardown collects any empty
- * leftover. On success ownership transfers to the returned session (teardown removes the
- * whole home). The cleanup is contained so it never replaces the original startup error.
+ * own file, and the stable home only when that leaves it empty, so a home a concurrent
+ * launch's socket is in stays (§8.1). On success ownership transfers to the returned
+ * session (teardown removes the whole home; its bridge's stop releases its socket). The
+ * cleanup is contained so it never replaces the original startup error.
  */
-export async function withSocketHomeCleanup(removeOwnSocketFile, build) {
+export async function withSocketHomeCleanup(releaseSocket, build) {
     try {
         return await build();
     }
     catch (error) {
         try {
-            removeOwnSocketFile();
+            releaseSocket();
         }
         catch {
             // Secondary: the original startup error is the one that rejects.
@@ -31,44 +31,74 @@ export async function withSocketHomeCleanup(removeOwnSocketFile, build) {
 // Bounded so a failed startup never hangs on an unresponsive CLI while still
 // giving the leader a chance to exit gracefully before the group SIGKILL reap.
 const startupTermination = { gracefulMs: 5_000, forceMs: 1_000 };
+/**
+ * Runs every cleanup step, each best-effort. Resolves to the unconfirmed PTY cleanup, or
+ * `undefined` when there was no PTY or its termination and group reap were both
+ * confirmed. Failures of the other steps never surface here.
+ */
 export async function cleanupStartupResources(resources) {
     tryCall(resources.before);
-    // Route the PTY through the SAME group-reaping primitive the normal exit path
-    // uses: it signals, waits (bounded), and SIGKILLs the leader's process group on
-    // EVERY path — even when the PTY signal throws — so CLI descendants (e.g. a
-    // hook-bridge grandchild reparented to PID 1) cannot survive a failed startup
-    // (PRD §9.1, §9.4, C-LIFE-10). A termination/reap failure stays SECONDARY: it is
-    // contained here so the original startup error is the one that rejects.
-    if (resources.pty)
-        await reapPtyGroup(resources.pty, resources.terminationTimeouts ?? startupTermination);
+    // The session ends its PTY with the reaper its exit path uses, so the leader's group
+    // is SIGKILLed once (PRD §9.1, §9.4, C-LIFE-10). That kill is attempted even when the
+    // PTY signal throws, so a hook-bridge grandchild reparented to PID 1 is not left
+    // behind. A failure stays secondary: it is returned as a content-free diagnostic,
+    // never thrown in place of the startup error, and the group may still be running.
+    const unconfirmed = resources.pty
+        ? await endPty(resources.pty, resources.terminationTimeouts ?? startupTermination)
+        : undefined;
     await stopQuietly(resources.bridge);
     tryCall(resources.after);
     tryCall(resources.terminal?.dispose.bind(resources.terminal));
+    return unconfirmed;
 }
-async function reapPtyGroup(pty, timeouts) {
+async function endPty(pty, timeouts) {
     try {
-        await terminatePty(pty, "SIGTERM", new SessionReaper(pty.pid), timeouts);
+        await pty.terminate(timeouts);
+        return undefined;
     }
-    catch {
-        // Preserve the original startup error; a reap/termination failure is secondary.
+    catch (error) {
+        const errno = cleanupErrno(error);
+        return {
+            cleanupErrorCode: isReapErrorCode(errno) ? errno : unknownErrorToken,
+            cleanupProcessGroupId: pty.pid,
+        };
     }
 }
+/**
+ * The errno to report: the failed group reap's errno when there is one, because that
+ * reap decides whether descendants may still be running; otherwise the termination's.
+ */
+function cleanupErrno(error) {
+    const reapErrno = error instanceof ElwoodError ? error.details["reapErrno"] : undefined;
+    return typeof reapErrno === "string" ? reapErrno : underlyingErrno(error);
+}
 /**
  * Runs the post-session-construction startup steps behind ONE cleanup boundary
  * (PRD §9.1, §9.4): if `region` rejects — a failed startup assertion, a PTY write
- * fault, anything — the now-live PTY, bridge, terminal, and any watcher
- * are torn down via `cleanupStartupResources` before the original error rethrows, so
- * a rejected `startClaude`/`startCodex` never leaks live resources.
+ * fault, anything — the now-live PTY, bridge, terminal, and any watcher are torn down
+ * via `cleanupStartupResources` before the original error rethrows. That teardown is
+ * best-effort: when the PTY's termination or group reap could not be confirmed, part of
+ * the process tree may remain, and a typed startup error names that in its details.
  */
 export async function guardStartupRegion(region, resources) {
     try {
         await region();
     }
     catch (error) {
-        await cleanupStartupResources(resources);
-        throw error;
+        throw withCleanupFailure(error, await cleanupStartupResources(resources));
     }
 }
+/**
+ * Keeps the startup error's code, message, and stack and adds the unconfirmed-cleanup
+ * details. Only Elwood's own typed errors gain them: any other startup error is
+ * rethrown unchanged, never wrapped or mutated.
+ */
+function withCleanupFailure(error, unconfirmed) {
+    if (unconfirmed === undefined || !(error instanceof ElwoodError))
+        return error;
+    const enriched = elwoodError(error.code, error.message, { ...error.details, ...unconfirmed });
+    return Object.assign(enriched, { stack: error.stack });
+}
 /** Stops the bridge if one exists; a sync throw or rejection stays secondary. */
 async function stopQuietly(bridge) {
     try {

package/dist/runtime/startup/cleanup.js.map

@@ -1 +1 @@
-{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["../../../src/runtime/startup/cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBxD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,mBAA+B,EAC/B,KAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,kBAAkB,GAA+B,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE7F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAkC;IAC9E,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,iFAAiF;IACjF,wEAAwE;IACxE,IAAI,SAAS,CAAC,GAAG;QACf,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,IAAI,kBAAkB,CAAC,CAAC;IACzF,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,QAAoC;IAC/E,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA2B,EAC3B,SAAkC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,MAAyC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,QAAkC;IACjD,IAAI,CAAC;QACH,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["../../../src/runtime/startup/cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,eAAe,EAEf,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAwCxC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAyB,EACzB,KAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,aAAa,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,kBAAkB,GAA+B,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE7F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAkC;IAElC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,qFAAqF;IACrF,sFAAsF;IACtF,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG;QAC/B,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,IAAI,kBAAkB,CAAC;QAClF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,GAAe,EACf,QAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO;YACL,gBAAgB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;YACpE,qBAAqB,EAAE,GAAG,CAAC,GAAG;SAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,SAAS,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA2B,EAC3B,SAAkC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,KAAc,EACd,WAAqD;IAErD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,MAAyC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,QAAkC;IACjD,IAAI,CAAC;QACH,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC"}

package/dist/runtime/startup/index.d.ts

@@ -1,16 +1,28 @@
 /**
  * Startup readiness checks for newly spawned agent PTYs.
- * Implements PRD §9.1 and §10.
+ * Implements PRD §9.1 and §10, and names the e2e home guard of §12 (C-E2E-24).
  */
 import type { PtyExit } from "../../pty/types.ts";
 export type StartupAdapter = "claude" | "codex";
 type StartupValue<T> = T | (() => T);
 export declare function setStartupWaitMsForTests(value: number): void;
 export declare function resetStartupWaitMsForTests(): void;
+/**
+ * Fails a session's start when its CLI exited or asked for a login during startup. It waits
+ * `waitMs` (500 ms by default) first, then reads the exit and the output once. A status-97
+ * exit of a launch the e2e home guard checks (`sawStopMarker` set) may wait up to
+ * `stopMarkerGraceMs` more for the guard's line (PRD §12, C-E2E-24); any other check adds no
+ * wait.
+ */
 export declare function assertStartupUsable(input: {
     readonly adapter: StartupAdapter;
     readonly exit: StartupValue<PtyExit | undefined>;
     readonly output: StartupValue<string>;
+    /**
+     * Whether the output carried the e2e home guard's stop marker, past any cap on `output`;
+     * `undefined` for a launch the guard does not check.
+     */
+    readonly sawStopMarker?: (() => boolean) | undefined;
     readonly waitMs?: number;
 }): Promise<void>;
 export {};

package/dist/runtime/startup/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAGrC,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAOlD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAUrC,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB"}

package/dist/runtime/startup/index.js

@@ -1,29 +1,61 @@
 /**
  * Startup readiness checks for newly spawned agent PTYs.
- * Implements PRD §9.1 and §10.
+ * Implements PRD §9.1 and §10, and names the e2e home guard of §12 (C-E2E-24).
  */
 import { isClaudeReauthRequiredText } from "../../claude/login/expiry-screen.js";
+import { delay } from "../../core/delay.js";
 import { elwoodError } from "../../core/errors.js";
+import { homeGuardExitCode, homeGuardStopped, homeGuardStoppedReason, } from "../home-guard/index.js";
 let startupWaitMs = 500;
+/**
+ * Once the check sees a status-97 exit of a launch the e2e home guard checks, the longest it
+ * waits for the guard's line: a PTY's last output can arrive after its exit (§9.4).
+ */
+const stopMarkerGraceMs = 1_000;
+/** How often that wait looks for the line: often enough to add little to a stop's report. */
+const stopMarkerPollMs = 10;
 export function setStartupWaitMsForTests(value) {
     startupWaitMs = value;
 }
 export function resetStartupWaitMsForTests() {
     startupWaitMs = 500;
 }
+/**
+ * Fails a session's start when its CLI exited or asked for a login during startup. It waits
+ * `waitMs` (500 ms by default) first, then reads the exit and the output once. A status-97
+ * exit of a launch the e2e home guard checks (`sawStopMarker` set) may wait up to
+ * `stopMarkerGraceMs` more for the guard's line (PRD §12, C-E2E-24); any other check adds no
+ * wait.
+ */
 export async function assertStartupUsable(input) {
-    await new Promise((resolve) => setTimeout(resolve, input.waitMs ?? startupWaitMs));
+    await delay(input.waitMs ?? startupWaitMs);
     const exit = readStartupValue(input.exit);
     if (exit) {
-        throw elwoodError(`${input.adapter}_start_failed`, `${input.adapter} exited during startup.`, {
-            exitCode: exit.exitCode,
-            signal: exit.signal,
-        });
+        // The guard's own line is in the output, among the user's startup output: name the guard
+        // instead of forwarding that output.
+        const stopped = await stoppedByGuard(exit.exitCode, input.sawStopMarker);
+        const guard = stopped ? `: ${homeGuardStoppedReason}` : "";
+        throw elwoodError(`${input.adapter}_start_failed`, `${input.adapter} exited during startup${guard}.`, { exitCode: exit.exitCode, signal: exit.signal });
     }
     if (isAuthFailure(input.adapter, readStartupValue(input.output))) {
         throw elwoodError(`${input.adapter}_not_authenticated`, `${input.adapter} is not authenticated.`);
     }
 }
+/**
+ * Whether the e2e home guard stopped a session's login shell that exited with `exitCode`. For
+ * a launch the guard checks, a status-97 exit first waits, up to `stopMarkerGraceMs`, for the
+ * guard's line to arrive. A launch it does not check fails at once.
+ */
+async function stoppedByGuard(exitCode, sawMarker) {
+    if (sawMarker === undefined)
+        return false;
+    if (exitCode === homeGuardExitCode) {
+        const deadline = performance.now() + stopMarkerGraceMs;
+        while (!sawMarker() && performance.now() < deadline)
+            await delay(stopMarkerPollMs);
+    }
+    return homeGuardStopped(exitCode, sawMarker);
+}
 function isAuthFailure(adapter, output) {
     // Claude's re-authentication banner ("Login expired" then "Please run /login")
     // spans multiple lines, so it is matched against the WHOLE output, not per line,

package/dist/runtime/startup/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/startup/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKnD,IAAI,aAAa,GAAG,GAAG,CAAC;AAExB,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,GAAG,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,WAAW,CAAC,GAAG,KAAK,CAAC,OAAO,eAAe,EAAE,GAAG,KAAK,CAAC,OAAO,yBAAyB,EAAE;YAC5F,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,CACf,GAAG,KAAK,CAAC,OAAO,oBAAoB,EACpC,GAAG,KAAK,CAAC,OAAO,wBAAwB,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAuB,EAAE,MAAc;IAC5D,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,IAAI,OAAO,KAAK,QAAQ,IAAI,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB,EAAE,IAAY;IAC9D,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAI,KAAsB;IACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/startup/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAIhC,IAAI,aAAa,GAAG,GAAG,CAAC;AACxB;;;GAGG;AACH,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,6FAA6F;AAC7F,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,GAAG,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAUzC;IACC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,yFAAyF;QACzF,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,WAAW,CACf,GAAG,KAAK,CAAC,OAAO,eAAe,EAC/B,GAAG,KAAK,CAAC,OAAO,yBAAyB,KAAK,GAAG,EACjD,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,CACf,GAAG,KAAK,CAAC,OAAO,oBAAoB,EACpC,GAAG,KAAK,CAAC,OAAO,wBAAwB,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,SAAsC;IAEtC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QACvD,OAAO,CAAC,SAAS,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,OAAuB,EAAE,MAAc;IAC5D,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,IAAI,OAAO,KAAK,QAAQ,IAAI,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB,EAAE,IAAY;IAC9D,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAI,KAAsB;IACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC"}

package/dist/runtime/stream-marker.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Watches one byte stream for a marker its chunks may split anywhere. A watcher keeps that
+ * stream's state, so each stream needs its own. Shared by the probe shell's start line
+ * (PRD §9.2, C-PERF-05) and the e2e home guard's stop marker (PRD §12, C-E2E-24), so both
+ * read a split marker the same way.
+ */
+export declare class StreamMarkerWatcher {
+    private readonly marker;
+    private tail;
+    private found;
+    constructor(marker: Buffer);
+    /** Whether the stream has carried the marker. */
+    get seen(): boolean;
+    /** True exactly once: for the chunk that completes the marker. */
+    feed(chunk: Buffer): boolean;
+}
+//# sourceMappingURL=stream-marker.d.ts.map

package/dist/runtime/stream-marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-marker.d.ts","sourceRoot":"","sources":["../../src/runtime/stream-marker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,IAAI,CAAmB;IAC/B,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,MAAM;IAI1B,iDAAiD;IACjD,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,kEAAkE;IAClE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAc7B"}

package/dist/runtime/stream-marker.js

@@ -0,0 +1,35 @@
+/**
+ * Watches one byte stream for a marker its chunks may split anywhere. A watcher keeps that
+ * stream's state, so each stream needs its own. Shared by the probe shell's start line
+ * (PRD §9.2, C-PERF-05) and the e2e home guard's stop marker (PRD §12, C-E2E-24), so both
+ * read a split marker the same way.
+ */
+export class StreamMarkerWatcher {
+    marker;
+    tail = Buffer.alloc(0);
+    found = false;
+    constructor(marker) {
+        this.marker = marker;
+    }
+    /** Whether the stream has carried the marker. */
+    get seen() {
+        return this.found;
+    }
+    /** True exactly once: for the chunk that completes the marker. */
+    feed(chunk) {
+        if (this.found)
+            return false;
+        const window = Buffer.concat([this.tail, chunk]);
+        if (window.includes(this.marker)) {
+            this.found = true;
+            this.tail = Buffer.alloc(0);
+            return true;
+        }
+        // Keep a copy of only what could still begin a split marker: a view would pin the whole
+        // chunk for as long as the watcher lives, as an unresolved probe's reaper retains it.
+        const keep = this.marker.length - 1;
+        this.tail = Buffer.from(window.subarray(Math.max(0, window.length - keep)));
+        return false;
+    }
+}
+//# sourceMappingURL=stream-marker.js.map

package/dist/runtime/stream-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-marker.js","sourceRoot":"","sources":["../../src/runtime/stream-marker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAS;IACxB,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,GAAG,KAAK,CAAC;IAEtB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,wFAAwF;QACxF,sFAAsF;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/runtime/update/acquire.d.ts

@@ -0,0 +1,16 @@
+import type { UpdateAdapter } from "./lock.ts";
+import { type LeaseOwner } from "./owner.ts";
+type Acquisition = {
+    readonly adapter: UpdateAdapter;
+    readonly leasePath: string;
+    readonly owner: LeaseOwner;
+    readonly completionMarkerPath: string;
+    readonly pollMs: number;
+    readonly staleMs: number;
+    readonly waitUntilMs: number;
+    readonly claim: () => Promise<boolean>;
+};
+/** True grants update ownership; false means no update lease acquired. */
+export declare function acquireUpdateLease({ adapter, leasePath, owner, completionMarkerPath, pollMs, staleMs, waitUntilMs, claim, }: Acquisition): Promise<boolean>;
+export {};
+//# sourceMappingURL=acquire.d.ts.map

package/dist/runtime/update/acquire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/acquire.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,YAAY,CAAC;AAG3D,KAAK,WAAW,GAAG;IACjB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACxC,CAAC;AAEF,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,SAAS,EACT,KAAK,EACL,oBAAoB,EACpB,MAAM,EACN,OAAO,EACP,WAAW,EACX,KAAK,GACN,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CA6ChC"}