chati-dev 4.5.28 → 4.5.29

package/node_modules/@chati/core/native/descriptor-fs.c

@@ -0,0 +1,407 @@
+/* Minimal synchronous Node-API boundary for descriptor-relative POSIX I/O.
+ * No JS execution, subprocesses, path resolution or implicit global cwd changes.
+ * Each name is one component and each directory is an explicit open descriptor.
+ */
+#define _GNU_SOURCE
+#include <node_api.h>
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <math.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/file.h>
+#include <unistd.h>
+#ifdef __APPLE__
+#include <sys/sysctl.h>
+#include <uuid/uuid.h>
+#include <time.h>
+#endif
+#ifdef __linux__
+#include <sys/syscall.h>
+#include <linux/fs.h>
+#endif
+
+#define CHECK(call) do { if ((call) != napi_ok) { \
+  napi_throw_error(env, "NATIVE_STORAGE_API_ERROR", "Node-API call failed"); return NULL; \
+} } while (0)
+
+static napi_value failure(napi_env env, const char *operation, int error) {
+  const char *code = "EIO";
+#define ERROR_NAME(value) case value: code = #value; break
+  switch (error) {
+    ERROR_NAME(EACCES); ERROR_NAME(EBADF); ERROR_NAME(EEXIST); ERROR_NAME(EFAULT);
+    ERROR_NAME(EFBIG); ERROR_NAME(EINTR); ERROR_NAME(EINVAL); ERROR_NAME(EIO);
+    ERROR_NAME(EISDIR); ERROR_NAME(ELOOP); ERROR_NAME(EMFILE); ERROR_NAME(ENAMETOOLONG);
+    ERROR_NAME(ENFILE); ERROR_NAME(ENOENT); ERROR_NAME(ENOMEM); ERROR_NAME(ENOSPC);
+    ERROR_NAME(ENOTDIR); ERROR_NAME(ENOTEMPTY); ERROR_NAME(ENXIO); ERROR_NAME(EPERM);
+    ERROR_NAME(EROFS); ERROR_NAME(EXDEV); ERROR_NAME(EOVERFLOW);
+    ERROR_NAME(ESRCH); ERROR_NAME(ENOSYS); ERROR_NAME(ETIMEDOUT); ERROR_NAME(EADDRINUSE);
+    default: break;
+  }
+#undef ERROR_NAME
+  napi_value message, error_code, exception, number;
+  char text[256];
+  snprintf(text, sizeof(text), "%s: %s", operation, strerror(error));
+  CHECK(napi_create_string_utf8(env, text, NAPI_AUTO_LENGTH, &message));
+  CHECK(napi_create_string_utf8(env, code, NAPI_AUTO_LENGTH, &error_code));
+  CHECK(napi_create_error(env, error_code, message, &exception));
+  CHECK(napi_create_int32(env, error, &number));
+  CHECK(napi_set_named_property(env, exception, "errno", number));
+  CHECK(napi_throw(env, exception));
+  return NULL;
+}
+
+static int integer(napi_env env, napi_value value, int *result) {
+  double number;
+  if (napi_get_value_double(env, value, &number) != napi_ok || !isfinite(number)
+      || number < 0 || number > INT_MAX || floor(number) != number) {
+    napi_throw_type_error(env, "INVALID_STORAGE_ARGUMENT", "expected a nonnegative signed integer");
+    return 0;
+  }
+  *result = (int)number;
+  return 1;
+}
+
+static int component(napi_env env, napi_value value, char *name) {
+  size_t length, written;
+  if (napi_get_value_string_utf8(env, value, NULL, 0, &length) != napi_ok
+      || length == 0 || length > NAME_MAX
+      || napi_get_value_string_utf8(env, value, name, NAME_MAX + 1, &written) != napi_ok
+      || written != length || strlen(name) != length
+      || strchr(name, '/') || strchr(name, '\\') || !strcmp(name, ".") || !strcmp(name, "..")) {
+    napi_throw_type_error(env, "INVALID_STORAGE_NAME", "expected one bounded path component");
+    return 0;
+  }
+  return 1;
+}
+
+static int arguments(napi_env env, napi_callback_info info, size_t required, napi_value *args) {
+  size_t count = required + 1;
+  if (napi_get_cb_info(env, info, &count, args, NULL, NULL) != napi_ok || count != required) {
+    napi_throw_type_error(env, "INVALID_STORAGE_ARGUMENT", "incorrect argument count");
+    return 0;
+  }
+  return 1;
+}
+
+static napi_value open_at(napi_env env, napi_callback_info info) {
+  napi_value args[5], result;
+  int dir, flags, mode;
+  char name[NAME_MAX + 1];
+  if (!arguments(env, info, 4, args) || !integer(env, args[0], &dir)
+      || !component(env, args[1], name) || !integer(env, args[2], &flags)
+      || !integer(env, args[3], &mode)) return NULL;
+  if (mode > 0777) return failure(env, "openat mode", EINVAL);
+  int fd = openat(dir, name, flags | O_CLOEXEC | O_NOFOLLOW, (mode_t)mode);
+  if (fd < 0) return failure(env, "openat", errno);
+  if (napi_create_int32(env, fd, &result) != napi_ok) {
+    close(fd);
+    napi_throw_error(env, "NATIVE_STORAGE_API_ERROR", "could not return descriptor");
+    return NULL;
+  }
+  return result;
+}
+
+/* Hold until the caller closes its CLOEXEC descriptor. Never wait or unlink. */
+static napi_value try_exclusive_file_lock(napi_env env, napi_callback_info info) {
+  napi_value args[2], result;
+  int fd;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &fd)) return NULL;
+  int status = flock(fd, LOCK_EX | LOCK_NB);
+  if (status < 0 && errno != EWOULDBLOCK && errno != EAGAIN) return failure(env, "flock", errno);
+  CHECK(napi_get_boolean(env, status == 0, &result));
+  return result;
+}
+
+static napi_value try_shared_file_lock(napi_env env, napi_callback_info info) {
+  napi_value args[2], result;
+  int fd;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &fd)) return NULL;
+  int status = flock(fd, LOCK_SH | LOCK_NB);
+  if (status < 0 && errno != EWOULDBLOCK && errno != EAGAIN) return failure(env, "flock", errno);
+  CHECK(napi_get_boolean(env, status == 0, &result));
+  return result;
+}
+
+static napi_value duplicate_directory(napi_env env, napi_callback_info info) {
+  napi_value args[2], result;
+  int dir;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &dir)) return NULL;
+  int fd = openat(dir, ".", O_RDONLY | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
+  if (fd < 0) return failure(env, "duplicate directory", errno);
+  if (napi_create_int32(env, fd, &result) != napi_ok) {
+    close(fd);
+    napi_throw_error(env, "NATIVE_STORAGE_API_ERROR", "could not return descriptor");
+    return NULL;
+  }
+  return result;
+}
+
+static napi_value mkdir_at(napi_env env, napi_callback_info info) {
+  napi_value args[4], result;
+  int dir, mode;
+  char name[NAME_MAX + 1];
+  if (!arguments(env, info, 3, args) || !integer(env, args[0], &dir)
+      || !component(env, args[1], name) || !integer(env, args[2], &mode)) return NULL;
+  if (mode > 0777) return failure(env, "mkdirat mode", EINVAL);
+  if (mkdirat(dir, name, (mode_t)mode) < 0) return failure(env, "mkdirat", errno);
+  CHECK(napi_get_undefined(env, &result));
+  return result;
+}
+
+static napi_value rename_at(napi_env env, napi_callback_info info) {
+  napi_value args[5], result;
+  int source, target;
+  char from[NAME_MAX + 1], to[NAME_MAX + 1];
+  if (!arguments(env, info, 4, args) || !integer(env, args[0], &source)
+      || !component(env, args[1], from) || !integer(env, args[2], &target)
+      || !component(env, args[3], to)) return NULL;
+  if (renameat(source, from, target, to) < 0) return failure(env, "renameat", errno);
+  CHECK(napi_get_undefined(env, &result));
+  return result;
+}
+
+static napi_value unlink_at(napi_env env, napi_callback_info info) {
+  napi_value args[3], result;
+  int dir;
+  char name[NAME_MAX + 1];
+  if (!arguments(env, info, 2, args) || !integer(env, args[0], &dir)
+      || !component(env, args[1], name)) return NULL;
+  /* Never recursive, and never remove directories through this primitive. */
+  if (unlinkat(dir, name, 0) < 0) return failure(env, "unlinkat", errno);
+  CHECK(napi_get_undefined(env, &result));
+  return result;
+}
+
+static napi_value link_at(napi_env env, napi_callback_info info) {
+  napi_value args[5], result;
+  int source, target;
+  char from[NAME_MAX + 1], to[NAME_MAX + 1];
+  if (!arguments(env, info, 4, args) || !integer(env, args[0], &source)
+      || !component(env, args[1], from) || !integer(env, args[2], &target)
+      || !component(env, args[3], to)) return NULL;
+  /* No AT_SYMLINK_FOLLOW and no overwrite of an existing destination. */
+  if (linkat(source, from, target, to, 0) < 0) return failure(env, "linkat", errno);
+  CHECK(napi_get_undefined(env, &result));
+  return result;
+}
+
+static napi_value stat_at(napi_env env, napi_callback_info info) {
+  napi_value args[3], result, value;
+  int dir;
+  char name[NAME_MAX + 1];
+  struct stat stat;
+  if (!arguments(env, info, 2, args) || !integer(env, args[0], &dir)
+      || !component(env, args[1], name)) return NULL;
+  if (fstatat(dir, name, &stat, AT_SYMLINK_NOFOLLOW) < 0) return failure(env, "fstatat", errno);
+  CHECK(napi_create_object(env, &result));
+#define UNSIGNED_FIELD(key, field) \
+  CHECK(napi_create_bigint_uint64(env, (uint64_t)(field), &value)); \
+  CHECK(napi_set_named_property(env, result, key, value))
+  UNSIGNED_FIELD("dev", stat.st_dev); UNSIGNED_FIELD("ino", stat.st_ino);
+  UNSIGNED_FIELD("mode", stat.st_mode); UNSIGNED_FIELD("uid", stat.st_uid);
+  UNSIGNED_FIELD("gid", stat.st_gid); UNSIGNED_FIELD("nlink", stat.st_nlink);
+  UNSIGNED_FIELD("rdev", stat.st_rdev); UNSIGNED_FIELD("size", stat.st_size);
+  UNSIGNED_FIELD("blksize", stat.st_blksize); UNSIGNED_FIELD("blocks", stat.st_blocks);
+#undef UNSIGNED_FIELD
+#ifdef __APPLE__
+  struct timespec atime = stat.st_atimespec, mtime = stat.st_mtimespec, ctime = stat.st_ctimespec;
+#else
+  struct timespec atime = stat.st_atim, mtime = stat.st_mtim, ctime = stat.st_ctim;
+#endif
+#define TIME_FIELD(key, field) \
+  CHECK(napi_create_bigint_int64(env, (int64_t)field.tv_sec * 1000000000LL + field.tv_nsec, &value)); \
+  CHECK(napi_set_named_property(env, result, key, value))
+  TIME_FIELD("atimeNs", atime); TIME_FIELD("mtimeNs", mtime); TIME_FIELD("ctimeNs", ctime);
+#undef TIME_FIELD
+  return result;
+}
+
+static napi_value directory_path(napi_env env, napi_callback_info info) {
+  napi_value args[2], result;
+  int dir;
+  struct stat stat;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &dir)) return NULL;
+  if (fstat(dir, &stat) < 0) return failure(env, "directory path", errno);
+  if (!S_ISDIR(stat.st_mode)) return failure(env, "directory path", ENOTDIR);
+  char path[PATH_MAX + 1];
+#ifdef __APPLE__
+  if (fcntl(dir, F_GETPATH, path) < 0) return failure(env, "F_GETPATH", errno);
+#else
+  char reference[64];
+  snprintf(reference, sizeof(reference), "/proc/self/fd/%d", dir);
+  ssize_t length = readlink(reference, path, PATH_MAX);
+  if (length < 0) return failure(env, "readlink directory", errno);
+  if (length >= PATH_MAX) return failure(env, "readlink directory", ENAMETOOLONG);
+  path[length] = '\0';
+#endif
+  CHECK(napi_create_string_utf8(env, path, NAPI_AUTO_LENGTH, &result));
+  return result;
+}
+
+static napi_value read_directory_impl(napi_env env, napi_callback_info info, int as_bytes) {
+  napi_value args[2], result, value;
+  int dir;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &dir)) return NULL;
+  CHECK(napi_create_array(env, &result));
+  /* Open a fresh description: dup() alone would share the directory offset. */
+  int fd = openat(dir, ".", O_RDONLY | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
+  if (fd < 0) return failure(env, "open directory for listing", errno);
+  DIR *stream = fdopendir(fd);
+  if (!stream) {
+    int error = errno;
+    close(fd);
+    return failure(env, "fdopendir", error);
+  }
+  uint32_t index = 0;
+  for (;;) {
+    errno = 0;
+    struct dirent *entry = readdir(stream);
+    if (!entry) {
+      int error = errno;
+      int closed = closedir(stream);
+      if (error) return failure(env, "readdir", error);
+      if (closed < 0) return failure(env, "closedir", errno);
+      return result;
+    }
+    if (!strcmp(entry->d_name, ".") || !strcmp(entry->d_name, "..")) continue;
+    if (index == UINT32_MAX) { closedir(stream); return failure(env, "readdir", EOVERFLOW); }
+    napi_status created = as_bytes
+      ? napi_create_buffer_copy(env, strlen(entry->d_name), entry->d_name, NULL, &value)
+      : napi_create_string_utf8(env, entry->d_name, NAPI_AUTO_LENGTH, &value);
+    if (created != napi_ok
+        || napi_set_element(env, result, index++, value) != napi_ok) {
+      closedir(stream);
+      napi_throw_error(env, "NATIVE_STORAGE_API_ERROR", "could not return directory entry");
+      return NULL;
+    }
+  }
+}
+
+static napi_value read_directory(napi_env env, napi_callback_info info) {
+  return read_directory_impl(env, info, 0);
+}
+
+static napi_value read_directory_bytes(napi_env env, napi_callback_info info) {
+  return read_directory_impl(env, info, 1);
+}
+
+#include "process-info-pipe.c"
+#ifdef __linux__
+#include "linux-process.c"
+#endif
+
+static napi_value readlink_at(napi_env env, napi_callback_info info) {
+  napi_value args[3], result;
+  int dir;
+  char name[NAME_MAX + 1], target[PATH_MAX + 1];
+  if (!arguments(env, info, 2, args) || !integer(env, args[0], &dir)
+      || !component(env, args[1], name)) return NULL;
+  ssize_t size = readlinkat(dir, name, target, sizeof(target));
+  if (size < 0) return failure(env, "readlinkat", errno);
+  if (size >= (ssize_t)sizeof(target)) return failure(env, "readlinkat", ENAMETOOLONG);
+  CHECK(napi_create_buffer_copy(env, (size_t)size, target, NULL, &result));
+  return result;
+}
+
+static napi_value rename_no_replace_at(napi_env env, napi_callback_info info) {
+  napi_value args[5], result;
+  int from, to, status;
+  char old_name[NAME_MAX + 1], new_name[NAME_MAX + 1];
+  if (!arguments(env, info, 4, args) || !integer(env, args[0], &from)
+      || !component(env, args[1], old_name) || !integer(env, args[2], &to)
+      || !component(env, args[3], new_name)) return NULL;
+#if defined(__linux__) && defined(SYS_renameat2)
+  status = (int)syscall(SYS_renameat2, from, old_name, to, new_name, RENAME_NOREPLACE);
+#elif defined(__APPLE__)
+  status = renameatx_np(from, old_name, to, new_name, RENAME_EXCL);
+#else
+  return failure(env, "no-replace rename unavailable", ENOSYS);
+#endif
+  if (status < 0) return failure(env, "no-replace rename", errno);
+  CHECK(napi_get_undefined(env, &result));
+  return result;
+}
+
+static napi_value symlink_at(napi_env env, napi_callback_info info) {
+  napi_value args[4], result;
+  int dir;
+  char name[NAME_MAX + 1], target[PATH_MAX + 1];
+  void *data; size_t length; bool is_buffer;
+  if (!arguments(env, info, 3, args) || !integer(env, args[1], &dir)
+      || !component(env, args[2], name)) return NULL;
+  if (napi_is_buffer(env, args[0], &is_buffer) != napi_ok || !is_buffer
+      || napi_get_buffer_info(env, args[0], &data, &length) != napi_ok
+      || length == 0 || length > PATH_MAX || memchr(data, 0, length)) {
+    napi_throw_type_error(env, "INVALID_STORAGE_ARGUMENT", "symlink target must be bounded nonempty bytes without NUL");
+    return NULL;
+  }
+  memcpy(target, data, length); target[length] = 0;
+  if (symlinkat(target, dir, name) < 0) return failure(env, "symlinkat", errno);
+  CHECK(napi_get_undefined(env, &result));
+  return result;
+}
+
+#ifdef __APPLE__
+#include "darwin-browser-listener.c"
+/* Both values come from the running kernel. Never fall back to boot volume UUID,
+ * wall-clock boot time, hostname or an environment-provided machine identifier. */
+static napi_value darwin_host_boot(napi_env env, napi_callback_info info) {
+  napi_value args[1], result, host_value, boot_value;
+  if (!arguments(env, info, 0, args)) return NULL;
+  uuid_t host, boot;
+  char host_text[37], boot_text[37];
+  size_t size = sizeof(boot_text);
+  struct timespec timeout = { .tv_sec = 1, .tv_nsec = 0 };
+  if (gethostuuid(host, &timeout) < 0) return failure(env, "gethostuuid", errno);
+  if (uuid_is_null(host)) return failure(env, "empty host UUID", EIO);
+  if (sysctlbyname("kern.bootsessionuuid", boot_text, &size, NULL, 0) < 0) {
+    return failure(env, "kernel boot-session UUID", errno);
+  }
+  if (size != sizeof(boot_text) || boot_text[36] != 0 || strlen(boot_text) != 36
+      || uuid_parse(boot_text, boot) != 0 || uuid_is_null(boot)) {
+    return failure(env, "invalid kernel boot-session UUID", EIO);
+  }
+  uuid_unparse_lower(host, host_text);
+  uuid_unparse_lower(boot, boot_text);
+  CHECK(napi_create_object(env, &result));
+  CHECK(napi_create_string_utf8(env, host_text, 36, &host_value));
+  CHECK(napi_create_string_utf8(env, boot_text, 36, &boot_value));
+  CHECK(napi_set_named_property(env, result, "host_uuid", host_value));
+  CHECK(napi_set_named_property(env, result, "boot_session_uuid", boot_value));
+  return result;
+}
+#endif
+
+static napi_value initialize(napi_env env, napi_value exports) {
+#define METHOD(name, function) { name, NULL, function, NULL, NULL, NULL, napi_default, NULL }
+  napi_property_descriptor methods[] = {
+    METHOD("openAt", open_at), METHOD("duplicateDirectory", duplicate_directory),
+    METHOD("mkdirAt", mkdir_at), METHOD("renameAt", rename_at), METHOD("unlinkAt", unlink_at),
+    METHOD("linkAt", link_at),
+    METHOD("statAt", stat_at), METHOD("directoryPath", directory_path),
+    METHOD("readDirectory", read_directory), METHOD("readDirectoryBytes", read_directory_bytes),
+    METHOD("readlinkAt", readlink_at),
+    METHOD("renameNoReplaceAt", rename_no_replace_at), METHOD("symlinkAt", symlink_at),
+    METHOD("tryExclusiveFileLock", try_exclusive_file_lock),
+    METHOD("trySharedFileLock", try_shared_file_lock),
+    METHOD("processPipe", process_pipe), METHOD("readProcessPipe", read_process_pipe),
+#ifdef __APPLE__
+    METHOD("darwinHostBoot", darwin_host_boot),
+    METHOD("createDarwinBrowserListener", create_darwin_browser_listener),
+    METHOD("inspectDarwinBrowserListener", inspect_darwin_browser_listener),
+#endif
+#ifdef __linux__
+    METHOD("openPidfd", open_pidfd), METHOD("waitPidfd", wait_pidfd), METHOD("killPidfd", kill_pidfd),
+#endif
+  };
+#undef METHOD
+  CHECK(napi_define_properties(env, exports, sizeof(methods) / sizeof(methods[0]), methods));
+  return exports;
+}
+
+NAPI_MODULE(descriptor_fs, initialize)

package/node_modules/@chati/core/native/execution-admission.h

@@ -0,0 +1,59 @@
+/* Positive-GO protocol shared by the pre-exec gate and suspended Darwin
+ * launcher. The optional owner channel is separate from the one-shot GO pipe.
+ * It is only a liveness notification, never proof of descendant termination. */
+#ifndef CHATI_EXECUTION_ADMISSION_H
+#define CHATI_EXECUTION_ADMISSION_H
+#include <errno.h>
+#include <poll.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+
+static long long chati_admission_monotonic_ms(void) {
+  struct timespec now;
+  if (clock_gettime(CLOCK_MONOTONIC, &now) != 0) return -1;
+  return (long long)now.tv_sec * 1000 + now.tv_nsec / 1000000;
+}
+
+static int chati_admission_channel(int fd) {
+  struct stat state;
+  return fd >= 3 && fstat(fd, &state) == 0
+    && (S_ISFIFO(state.st_mode) || S_ISSOCK(state.st_mode));
+}
+
+static const char *chati_wait_for_admission(int fd, int owner_fd, int timeout) {
+  if (!chati_admission_channel(fd)) return "channel";
+  if (owner_fd != -1 && (owner_fd == fd || !chati_admission_channel(owner_fd))) return "owner_channel";
+  if (timeout < 1 || timeout > 30000) return "timeout";
+  long long started = chati_admission_monotonic_ms();
+  if (started < 0) return "clock";
+  long long deadline = started + timeout;
+  for (;;) {
+    long long now = chati_admission_monotonic_ms();
+    if (now < 0) return "clock";
+    if (now >= deadline) return "timeout";
+    struct pollfd inputs[2] = {
+      { .fd = fd, .events = POLLIN }, { .fd = owner_fd, .events = POLLIN }
+    };
+    int available = poll(inputs, 2, (int)(deadline - now));
+    if (available < 0 && errno == EINTR) continue;
+    if (available <= 0) return available == 0 ? "timeout" : "poll";
+    // A live owner keeps its pipe open and writes nothing, even after GO.
+    if (inputs[1].revents) return "owner_channel";
+    if (inputs[0].revents & (POLLERR | POLLNVAL)) return "poll";
+    if (!(inputs[0].revents & (POLLIN | POLLHUP))) continue;
+    char token = 0;
+    ssize_t count = read(fd, &token, 1);
+    if (count < 0 && (errno == EINTR || errno == EAGAIN)) continue;
+    if (count != 1 || token != 'G') return count == 0 ? "eof" : "token";
+    // Narrow the GO/lifetime race. The launcher's separate reaper continues
+    // observing this channel after this function returns.
+    if (owner_fd != -1) {
+      int alive;
+      do { alive = poll(&inputs[1], 1, 0); } while (alive < 0 && errno == EINTR);
+      if (alive != 0) return "owner_channel";
+    }
+    return NULL;
+  }
+}
+#endif

package/node_modules/@chati/core/native/execution-gate.c

@@ -0,0 +1,41 @@
+/* Maintainer-built pre-exec admission boundary. No provider code runs until
+ * the owning control plane sends GO through its private inherited channel.
+ * EOF, invalid input, I/O error and deadline expiration are fatal, never GO.
+ */
+#define _POSIX_C_SOURCE 200809L
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+#include "execution-admission.h"
+
+static int reject(const char *reason) {
+  fprintf(stderr, "CHATI_EXECUTION_GATE_REJECTED: %s\n", reason);
+  return 125;
+}
+
+static long integer(const char *text, long minimum, long maximum) {
+  char *end = NULL;
+  errno = 0;
+  long value = strtol(text, &end, 10);
+  if (errno || !text[0] || *end || value < minimum || value > maximum) return -1;
+  return value;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 4 || argv[3][0] != '/') return reject("arguments");
+  long descriptor = integer(argv[1], 3, INT_MAX);
+  long timeout = integer(argv[2], 1, 30000);
+  if (descriptor < 0 || timeout < 0) return reject("arguments");
+  int fd = (int)descriptor;
+  const char *error = chati_wait_for_admission(fd, -1, (int)timeout);
+  if (error) return reject(error);
+  if (close(fd) != 0) return reject("close");
+  execv(argv[3], &argv[3]);
+  return reject("exec");
+}

package/node_modules/@chati/core/native/linux-process.c

@@ -0,0 +1,41 @@
+/* Included by the existing Node-API boundary only on Linux. These syscalls
+ * never resolve a caller-supplied process path or signal a numeric PID. */
+#include <signal.h>
+#include <sys/syscall.h>
+
+static napi_value open_pidfd(napi_env env, napi_callback_info info) {
+  napi_value args[2], result;
+  int pid;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &pid)) return NULL;
+  if (pid <= 1) return failure(env, "pidfd pid", EINVAL);
+  int fd = (int)syscall(SYS_pidfd_open, pid, 0);
+  if (fd < 0) return failure(env, "pidfd_open", errno);
+  if (napi_create_int32(env, fd, &result) != napi_ok) {
+    close(fd);
+    napi_throw_error(env, "NATIVE_PROCESS_API_ERROR", "could not return pidfd");
+    return NULL;
+  }
+  return result;
+}
+
+static napi_value wait_pidfd(napi_env env, napi_callback_info info) {
+  napi_value args[3], result;
+  int fd, timeout;
+  if (!arguments(env, info, 2, args) || !integer(env, args[0], &fd)
+      || !integer(env, args[1], &timeout)) return NULL;
+  if (timeout > 30000) return failure(env, "pidfd timeout", EINVAL);
+  int ready = process_poll(fd, timeout);
+  if (ready < 0) return failure(env, "pidfd poll", errno);
+  CHECK(napi_get_boolean(env, ready != 0, &result));
+  return result;
+}
+
+static napi_value kill_pidfd(napi_env env, napi_callback_info info) {
+  napi_value args[2], result;
+  int fd;
+  if (!arguments(env, info, 1, args) || !integer(env, args[0], &fd)) return NULL;
+  int sent = (int)syscall(SYS_pidfd_send_signal, fd, SIGKILL, NULL, 0);
+  if (sent < 0 && errno != ESRCH) return failure(env, "pidfd_send_signal", errno);
+  CHECK(napi_get_boolean(env, sent == 0, &result));
+  return result;
+}

package/node_modules/@chati/core/native/process-info-pipe.c

@@ -0,0 +1,91 @@
+/* Included by descriptor-fs.c on supported POSIX hosts. This bounded private
+ * transport makes no claim about the identity or lifetime of a process. */
+#include <poll.h>
+#include <time.h>
+
+static long long process_monotonic_ms(void) {
+  struct timespec now;
+  if (clock_gettime(CLOCK_MONOTONIC, &now) != 0) return -1;
+  return (long long)now.tv_sec * 1000 + now.tv_nsec / 1000000;
+}
+
+static int process_poll(int fd, int timeout) {
+  long long started = process_monotonic_ms();
+  if (started < 0) return -1;
+  long long deadline = started + timeout;
+  for (;;) {
+    long long now = process_monotonic_ms();
+    if (now < 0) return -1;
+    int remaining = now >= deadline ? 0 : (int)(deadline - now);
+    struct pollfd input = { .fd = fd, .events = POLLIN };
+    int result = poll(&input, 1, remaining);
+    if (result < 0 && errno == EINTR) continue;
+    if (result <= 0) return result;
+    if (input.revents & POLLNVAL) { errno = EBADF; return -1; }
+    if (input.revents & POLLERR) { errno = EIO; return -1; }
+    return (input.revents & (POLLIN | POLLHUP)) ? 1 : 0;
+  }
+}
+
+static napi_value process_pipe(napi_env env, napi_callback_info info) {
+  napi_value args[1], result, entry;
+  int fds[2];
+  if (!arguments(env, info, 0, args)) return NULL;
+#ifdef __linux__
+  if (pipe2(fds, O_CLOEXEC | O_NONBLOCK) < 0) return failure(env, "process pipe", errno);
+#else
+  if (pipe(fds) < 0) return failure(env, "process pipe", errno);
+  /* macOS pipe flags are set after creation, not atomically. Launchers must
+   * still close every non-explicit descriptor in the child spawn contract. */
+  for (int index = 0; index < 2; index++) {
+    int flags = fcntl(fds[index], F_GETFL);
+    if (flags < 0 || fcntl(fds[index], F_SETFL, flags | O_NONBLOCK) < 0
+        || fcntl(fds[index], F_SETFD, FD_CLOEXEC) < 0) {
+      int saved = errno;
+      close(fds[0]); close(fds[1]);
+      return failure(env, "process pipe flags", saved);
+    }
+  }
+#endif
+  if (napi_create_array_with_length(env, 2, &result) != napi_ok) goto failed;
+  for (uint32_t index = 0; index < 2; index++) {
+    if (napi_create_int32(env, fds[index], &entry) != napi_ok
+        || napi_set_element(env, result, index, entry) != napi_ok) goto failed;
+  }
+  return result;
+failed:
+  close(fds[0]); close(fds[1]);
+  napi_throw_error(env, "NATIVE_PROCESS_API_ERROR", "could not return pipe descriptors");
+  return NULL;
+}
+
+static napi_value read_process_pipe(napi_env env, napi_callback_info info) {
+  napi_value args[3], result;
+  int fd, timeout;
+  struct stat state;
+  if (!arguments(env, info, 2, args) || !integer(env, args[0], &fd)
+      || !integer(env, args[1], &timeout)) return NULL;
+  if (timeout > 30000) return failure(env, "process pipe timeout", EINVAL);
+  if (fstat(fd, &state) < 0) return failure(env, "process pipe", errno);
+  if (!S_ISFIFO(state.st_mode)) return failure(env, "process pipe type", EINVAL);
+  long long started = process_monotonic_ms();
+  if (started < 0) return failure(env, "process clock", errno);
+  long long deadline = started + timeout;
+  char output[4097];
+  size_t used = 0;
+  for (;;) {
+    long long now = process_monotonic_ms();
+    if (now < 0) return failure(env, "process clock", errno);
+    int available = process_poll(fd, now >= deadline ? 0 : (int)(deadline - now));
+    if (available < 0) return failure(env, "process pipe poll", errno);
+    if (!available) return failure(env, "process pipe timeout", ETIMEDOUT);
+    ssize_t count = read(fd, output + used, sizeof(output) - used);
+    if (count < 0 && (errno == EINTR || errno == EAGAIN)) continue;
+    if (count < 0) return failure(env, "process pipe read", errno);
+    if (count == 0) break;
+    used += (size_t)count;
+    if (used > 4096) return failure(env, "process pipe size", EOVERFLOW);
+  }
+  CHECK(napi_create_string_utf8(env, output, used, &result));
+  return result;
+}

package/node_modules/@chati/core/package.json

@@ -5,7 +5,8 @@
   "type": "module",
   "exports": "./src/index.js",
   "scripts": {
-    "test": "node --test test/**/*.test.js"
+    "build:native": "node scripts/build-native.js",
+    "test": "node scripts/build-native.js && node --test test/**/*.test.js"
   },
   "engines": {
     "node": ">=20.0.0"