create-agdf 0.20.2 → 0.31.0

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-lifecycle/prepared-call-journal.js

@@ -0,0 +1,269 @@
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmdirSync, unlinkSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { atomicWrite, fsyncDirectory, withOwnedFileLock } from '#agdf-core/owned-file-lock.js';
+import { renameSyncWithRetry } from '#agdf-core/fs-swap.js';
+
+const OWNER = 'agdf-prepared-calls-v1', DIRECTORY = 'prepared-calls';
+const MARKER = 'owner.json', KEY = 'key', RECORD = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\.json$/u;
+// Each live connection still has its original 256-entry Map. The shared
+// journal accommodates four such producers without silently evicting live IDs.
+const DIGEST = /^[0-9a-f]{64}$/u, LIMIT = 65_536, LIFETIME = 30 * 60_000, CAPACITY = 1024;
+const MAX_NAMESPACES = 16, MAX_BYTES = 64 * 1024 * 1024;
+const bad = () => { throw Error('runtime_provenance_invalid'); };
+const sha = text => createHash('sha256').update(text).digest('hex');
+const json = value => JSON.stringify(value);
+function privatePath(path, directory = false) {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1)
+      || realpathSync(path) !== resolve(path)
+      || process.getuid && stat.uid !== process.getuid()
+      || process.platform !== 'win32' && (stat.mode & 0o077)) bad();
+  return stat;
+}
+function boundedRead(path, limit) {
+  if (privatePath(path).size > limit) bad();
+  return readFileSync(path);
+}
+function identityOf(identity) {
+  if (!identity || Object.keys(identity).sort().join() !== 'dispatcher_digest,sdk_digest,server_digest,surface,version'
+      || !['codex', 'claude', 'copilot', 'opencode'].includes(identity.surface)
+      || typeof identity.version !== 'string' || !identity.version || identity.version.length > 128
+      || !['server_digest', 'dispatcher_digest', 'sdk_digest'].every(key => DIGEST.test(identity[key] ?? ''))) bad();
+  return { surface: identity.surface, version: identity.version, server_digest: identity.server_digest,
+    dispatcher_digest: identity.dispatcher_digest, sdk_digest: identity.sdk_digest };
+}
+function assertOwner(root) {
+  privatePath(root, true);
+  if (boundedRead(join(root, MARKER), 256).toString() !== json({ schema_version: 1, owner: OWNER })) bad();
+}
+function readNamespace(root, namespace) {
+  const dir = join(root, namespace); privatePath(dir, true);
+  const identity = JSON.parse(boundedRead(join(dir, MARKER), 2048));
+  if (identity.schema_version !== 1 || identity.owner !== OWNER || Object.keys(identity).sort().join() !== 'created,identity,owner,schema_version'
+      || !Number.isSafeInteger(identity.created) || identity.created < 0
+      || sha(json(identityOf(identity.identity))) !== namespace) bad();
+  const key = boundedRead(join(dir, KEY), 32); if (key.length !== 32) bad();
+  return { dir, key, created: identity.created };
+}
+const signature = (key, row) => createHmac('sha256', key).update(json(row)).digest('hex');
+function readEntry(dir, name, key, namespace) {
+  if (!RECORD.test(name)) bad();
+  const record = JSON.parse(boundedRead(join(dir, name), 2 * LIMIT + 4096));
+  const { mac, ...row } = record;
+  if (!DIGEST.test(mac ?? '') || !timingSafeEqual(Buffer.from(mac, 'hex'), Buffer.from(signature(key, row), 'hex'))
+      || row.schema_version !== 1 || row.namespace !== namespace || name !== row.id + '.json'
+      || !Number.isSafeInteger(row.created) || row.created < 0 || !['available', 'expired'].includes(row.state)) bad();
+  const fields = row.state === 'available' ? 'created,id,namespace,schema_version,signature,state,value'
+    : 'created,id,namespace,schema_version,state';
+  if (Object.keys(row).sort().join() !== fields) bad();
+  if (row.state === 'available' && (typeof row.value !== 'string' || Buffer.byteLength(row.value) > LIMIT
+      || !DIGEST.test(row.signature ?? '') || sha(row.value) !== row.signature)) bad();
+  return row;
+}
+function inspectRoot(publisherRoot) {
+  assertPublisherRoot(publisherRoot);
+  const root = join(publisherRoot, DIRECTORY);
+  if (!existsSync(root)) return 'absent';
+  assertOwner(root);
+  const namespaces = readdirSync(root).filter(name => name !== MARKER);
+  if (namespaces.length > MAX_NAMESPACES) bad();
+  let bytes = privatePath(join(root, MARKER)).size;
+  for (const namespace of namespaces) {
+    if (namespace === MARKER) continue;
+    if (!DIGEST.test(namespace)) bad();
+    const { dir, key } = readNamespace(root, namespace);
+    const names = readdirSync(dir);
+    if (names.length > 2 * CAPACITY + 2) bad();
+    let active = 0, expired = 0;
+    for (const name of names) {
+      bytes += privatePath(join(dir, name)).size;
+      if ([MARKER, KEY].includes(name)) continue;
+      const row = readEntry(dir, name, key, namespace);
+      row.state === 'available' ? active++ : expired++;
+    }
+    if (active > CAPACITY || expired > CAPACITY) bad();
+  }
+  if (bytes > MAX_BYTES) bad();
+  return 'owned';
+}
+export function inspectPreparedCallJournals(publisherRoot) {
+  try { return inspectRoot(publisherRoot); } catch { return 'foreign'; }
+}
+
+function locked(publisherRoot, operation) {
+  assertPublisherRoot(publisherRoot);
+  const deadline = performance.now() + 5550;
+  for (;;) {
+    try { return withOwnedFileLock(join(publisherRoot, '.agdf-prepared-calls'), () => { assertPublisherRoot(publisherRoot); return operation(); }); }
+    catch (error) {
+      if (error?.message !== 'AGDF_RUN_WRITE_LOCKED') throw error;
+      if (error.lock_owner_status !== 'live') bad();
+      if (performance.now() >= deadline) throw Error('dispatch_busy');
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    }
+  }
+}
+function assertPublisherRoot(root) {
+  const stat = lstatSync(root);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(root) !== root
+      || process.getuid && stat.uid !== process.getuid()) bad();
+}
+function normalizedError(error) {
+  if (['runtime_provenance_invalid', 'dispatch_busy'].includes(error?.message)) return error;
+  return Error('prepared_call_store_unavailable');
+}
+
+// The publisher supplies the root and immutable producer identity. No tool
+// argument can select this storage; constructing/discovering a server writes nothing.
+export function createPreparedCallJournal({ publisherRoot, identity, now = Date.now,
+  lifetimeMs = LIFETIME, maxEntries = CAPACITY, maxBytes = MAX_BYTES, checkpoint = () => {} } = {}) {
+  const canonical = realpathSync(publisherRoot);
+  if (canonical !== publisherRoot || lstatSync(canonical).isSymbolicLink()
+      || !Number.isSafeInteger(lifetimeMs) || lifetimeMs <= 0 || lifetimeMs > LIFETIME
+      || !Number.isSafeInteger(maxEntries) || maxEntries <= 0 || maxEntries > CAPACITY
+      || !Number.isSafeInteger(maxBytes) || maxBytes <= 0 || maxBytes > MAX_BYTES) bad();
+  assertPublisherRoot(canonical);
+  identity = identityOf(identity);
+  const namespace = sha(json(identity)), root = join(canonical, DIRECTORY), dir = join(root, namespace);
+  const publish = (row, key) => atomicWrite(join(dir, row.id + '.json'), json({ ...row, mac: signature(key, row) }));
+  function publishDirectory(target, contents, point) {
+    const stage = join(canonical, '.agdf-prepared-stage-' + randomUUID());
+    mkdirSync(stage, { mode: 0o700 }); const owned = lstatSync(stage);
+    try {
+      for (const [name, value] of Object.entries(contents)) atomicWrite(join(stage, name), value);
+      checkpoint(point);
+      if (existsSync(target)) bad();
+      renameSyncWithRetry(stage, target); fsyncDirectory(dirname(target));
+    } finally {
+      if (existsSync(stage)) {
+        const current = lstatSync(stage);
+        // A hard-killed unconfirmed sibling stage is retained by lifecycle
+        // inspection. Ordinary rollback removes only our same, unchanged inode
+        // and the exact initialization bytes authored by this invocation.
+        if (!current.isSymbolicLink() && current.dev === owned.dev && current.ino === owned.ino) {
+          for (const [name, value] of Object.entries(contents)) {
+            const file = join(stage, name);
+            if (existsSync(file) && boundedRead(file, 4096).equals(Buffer.from(value))) unlinkSync(file);
+          }
+          if (!readdirSync(stage).length) rmdirSync(stage);
+        }
+      }
+    }
+  }
+  function removeNamespace(target) {
+    for (const name of readdirSync(target)) unlinkSync(join(target, name));
+    rmdirSync(target);
+  }
+  function pruneNamespaces(time) {
+    if (inspectRoot(canonical) !== 'owned') bad();
+    for (const name of readdirSync(root).filter(name => name !== MARKER)) {
+      const scope = readNamespace(root, name), rows = readdirSync(scope.dir).filter(file => ![MARKER, KEY].includes(file))
+        .map(file => readEntry(scope.dir, file, scope.key, name));
+      // Keep one further lifetime of signed tombstones. Never delete a live
+      // call from another candidate merely to make room for the current one.
+      const latest = Math.max(scope.created, ...rows.map(row => row.created));
+      if (name !== namespace && time - latest >= 2 * LIFETIME) removeNamespace(scope.dir);
+    }
+  }
+  function size() {
+    return privatePath(join(root, MARKER)).size + readdirSync(root).filter(name => name !== MARKER).reduce((total, name) => {
+      const target = join(root, name);
+      return total + readdirSync(target).reduce((bytes, file) => bytes + privatePath(join(target, file)).size, 0);
+    }, 0);
+  }
+  function open(create = false, reserveBytes = 0) {
+    if (!existsSync(root)) {
+      if (!create) return null;
+      publishDirectory(root, { [MARKER]: json({ schema_version: 1, owner: OWNER }) }, 'root_staged');
+    }
+    assertOwner(root);
+    if (!existsSync(dir)) {
+      if (!create) return null;
+      // Verifying and pruning every namespace is costly; it runs only when a new
+      // namespace competes for the shared budget, not on every registration.
+      pruneNamespaces(now());
+      const marker = json({ schema_version: 1, owner: OWNER, identity, created: now() });
+      if (readdirSync(root).length - 1 >= MAX_NAMESPACES || size() + Buffer.byteLength(marker) + 32 + reserveBytes > maxBytes) return null;
+      publishDirectory(dir, { [MARKER]: marker, [KEY]: randomBytes(32) }, 'namespace_staged');
+    }
+    return readNamespace(root, namespace);
+  }
+  function entries(key) {
+    const names = readdirSync(dir).filter(name => ![MARKER, KEY].includes(name));
+    if (names.length > 2 * CAPACITY) bad();
+    return names.map(name => readEntry(dir, name, key, namespace));
+  }
+  function expire(rows, key, time) {
+    for (let index = 0; index < rows.length; index++) if (rows[index].state === 'available' && time - rows[index].created >= lifetimeMs) {
+      const old = rows[index], row = { schema_version: 1, namespace, id: old.id, created: old.created, state: 'expired' };
+      publish(row, key); rows[index] = row;
+    }
+    const expired = rows.filter(row => row.state === 'expired').sort((a, b) => b.created - a.created || a.id.localeCompare(b.id));
+    for (const row of expired.slice(maxEntries)) { unlinkSync(join(dir, row.id + '.json')); rows.splice(rows.indexOf(row), 1); }
+  }
+  function run(create, operation, reserveBytes = 0) {
+    try {
+      // Absent reads do not create lock/marker directories during discovery.
+      if (!create && !existsSync(root)) return { state: 'reference_unknown' };
+      return locked(canonical, () => { const opened = open(create, reserveBytes); return opened ? operation(opened.key) : create ? null : { state: 'reference_unknown' }; });
+    } catch (error) { throw normalizedError(error); }
+  }
+  return Object.freeze({
+    register({ value, signature: digest, created }) {
+      if (typeof value !== 'string' || Buffer.byteLength(value) > LIMIT || digest !== sha(value)
+          || !Number.isSafeInteger(created) || created < 0) bad();
+      const estimate = Buffer.byteLength(json({ schema_version: 1, namespace, id: '00000000-0000-4000-8000-000000000000', created,
+        state: 'available', signature: digest, value, mac: '0'.repeat(64) }));
+      return run(true, key => {
+        const rows = entries(key), time = now(); expire(rows, key, time);
+        const previous = rows.find(row => row.state === 'available' && row.signature === digest && row.value === value);
+        if (previous) return { id: previous.id, created: previous.created };
+        if (rows.filter(row => row.state === 'available').length >= maxEntries) return null;
+        // Stale candidate namespaces are reclaimed only when the shared byte budget is reached.
+        if (size() + estimate > maxBytes) pruneNamespaces(time);
+        if (size() + estimate > maxBytes) return null;
+        const row = { schema_version: 1, namespace, id: randomUUID(), created, state: 'available', signature: digest, value };
+        publish(row, key); return { id: row.id, created: row.created };
+      }, estimate);
+    },
+    load(id) {
+      if (!RECORD.test(id + '.json')) return { state: 'reference_unknown' };
+      return run(false, key => {
+        const file = join(dir, id + '.json');
+        if (!existsSync(file)) return { state: 'reference_unknown' };
+        let row = readEntry(dir, id + '.json', key, namespace);
+        if (row.state === 'available' && now() - row.created >= lifetimeMs) {
+          const rows = entries(key); expire(rows, key, now()); row = rows.find(value => value.id === id);
+        }
+        return row?.state === 'available' ? { state: 'available', value: row.value, signature: row.signature, created: row.created }
+          : { state: 'reference_expired' };
+      });
+    },
+  });
+}
+
+// Called only after the plugin owner has retired its executable generations.
+// Never adopts unknown records or follows a foreign/symlink entry for cleanup.
+export function retirePreparedCallJournals(publisherRoot) {
+  const root = join(publisherRoot, DIRECTORY);
+  if (!existsSync(root)) return;
+  locked(publisherRoot, () => {
+    // The lifecycle owner removed generations before acquiring this lock. A
+    // concurrent preparer can recreate it in that gap; retain every reference
+    // if any new generation node is present, even before it is fully published.
+    let generations;
+    try { generations = lstatSync(join(publisherRoot, 'generations')); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (generations) throw Error('AGDF_MCP_RUNTIME_RETAINED');
+    if (inspectRoot(publisherRoot) !== 'owned') bad();
+    for (const namespace of readdirSync(root).filter(name => name !== MARKER)) {
+      const dir = join(root, namespace);
+      for (const name of readdirSync(dir)) unlinkSync(join(dir, name));
+      rmdirSync(dir);
+    }
+    // The owner marker goes last: an interrupted cleanup still leaves a
+    // verifiable owned root instead of unmarked namespaces.
+    unlinkSync(join(root, MARKER)); rmdirSync(root);
+  });
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-lifecycle/thread-owner.js

@@ -0,0 +1,164 @@
+import { Worker } from 'node:worker_threads';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import process from 'node:process';
+import { createMcpGenerationPublisher } from './package.js';
+import { GENERATION_LIMITS as L, OWNER_LIMITS, generationMessage, validGenerationMessage,
+  generationFailureReason, ownerFrame, encodeOwnerFrame, decodeOwnerFrame, publicationSelector } from '../mcp-owner-protocol.js';
+
+// The detached retention owner alone owns actual Worker objects and claims.
+// It imports no SDK or domain factory. Protected slots survive uncertain exits.
+export function superviseThreadMcpFacade({ runtime, surface, cockpitDir, cockpitMode, pluginRoot,
+  env, claim, signals = process, deadlineNs } = {}) {
+  const binding = { token: claim.token, connection_epoch: randomUUID(), publication_id: runtime.publication_id };
+  const publicationDeadline = performance.now() + Math.max(0, Number(BigInt(deadlineNs) - process.hrtime.bigint()) / 1e6);
+  const publisher = createMcpGenerationPublisher(runtime, { publicationDeadline });
+  const rows = new Map(), seen = new Set();
+  let generationEpoch, highestGeneration = 0;
+  let facade, facadeExited = false, facadeAck = false, failed = false, pendingBytes = 0, pendingCount = 0;
+  const post = (kind, payload, id, row) => {
+    if (facadeExited) return;
+    facade.postMessage(encodeOwnerFrame(ownerFrame(binding, kind, payload, id, row), binding, { reply: true }));
+  };
+  function release(row, id) {
+    const entry = row.pending.get(id);
+    if (entry) { row.pending.delete(id); pendingBytes -= entry.bytes; --pendingCount; clearTimeout(entry.timer); }
+    return entry;
+  }
+  function transmit(row, message, { orphan = false, bytes = 0 } = {}) {
+    if (!row.worker || row.exited || row.pending.has(message.request_id)
+      || pendingCount >= OWNER_LIMITS.frames || pendingBytes + bytes > OWNER_LIMITS.bytes) throw Error('generation_request_capacity');
+    const entry = { message, orphan, bytes };
+    row.pending.set(message.request_id, entry); ++pendingCount; pendingBytes += bytes;
+    // An expired call is protected, not removed/replayed. A late reply can still
+    // settle ownership; until then its credit and slot remain occupied.
+    entry.timer = setTimeout(() => {
+      // The still-pending exact request protects the slot and claim. A later
+      // validated matching reply can prove completion; timeout alone cannot.
+      if (!orphan) post('failure', { reason: 'generation_response_unknown' }, message.request_id, row);
+    }, message.kind === 'shutdown' ? L.close : L.qualify);
+    row.worker.postMessage(JSON.stringify(message));
+  }
+  function drain(row) {
+    if (!facadeExited || row.exited || row.draining || row.pending.size || row.uncertain) return;
+    row.draining = true;
+    try { transmit(row, generationMessage(row.epoch, row.generation, 'session_inspect', {}, {}, null, randomUUID()), { orphan: true }); }
+    catch { row.uncertain = true; }
+  }
+  function receive(row, wire) {
+    if (typeof wire !== 'string' || Buffer.byteLength(wire) > L.result) { row.uncertain = true; return; }
+    let reply; try { reply = JSON.parse(wire); } catch { row.uncertain = true; return; }
+    if (!validGenerationMessage(reply, { epoch: row.epoch, generation: row.generation, reply: true })) { row.uncertain = true; return; }
+    const entry = row.pending.get(reply.request_id);
+    const expected = { qualify: 'qualified', invoke: 'result', session_inspect: 'status', shutdown: 'closed' }[entry?.message.kind];
+    if (!entry || reply.original_operation_id !== entry.message.original_operation_id
+      || reply.kind !== expected && reply.kind !== 'failure') { row.uncertain = true; return; }
+    release(row, reply.request_id);
+    if (reply.kind === 'closed') row.closeAck = !reply.payload.views && !reply.payload.inflight && !reply.payload.executor && !reply.payload.uncertain;
+    if (entry.message.original_operation_id && (reply.kind === 'failure' || reply.payload?.outcome === 'effect_unknown')) row.unknown.add(entry.message.original_operation_id);
+    const args = entry.message.payload?.arguments;
+    if (entry.message.payload?.name === 'agdf_inspect' && args?.operation === 'operation-status' && reply.payload?.report?.status === 'recorded'
+      && (reply.payload.report.receipt?.operation_id ?? reply.payload.report.receipt?.operation?.operation_id) === args.module.split('/').at(-1)) row.unknown.delete(args.module.split('/').at(-1));
+    if (entry.orphan) {
+      if (reply.kind === 'status' && !reply.payload.inflight && !reply.payload.executor && !reply.payload.uncertain && !row.unknown.size) {
+        try { transmit(row, generationMessage(row.epoch, row.generation, 'shutdown', {}, {}, null, randomUUID()), { orphan: true }); }
+        catch { row.uncertain = true; }
+      } else if (reply.kind !== 'closed') row.uncertain = true;
+    } else {
+      try { post('message', reply, reply.request_id, row); } catch { row.uncertain = true; }
+      drain(row);
+    }
+  }
+  function open(frame) {
+    if (rows.size >= L.slots || rows.has(frame.generation_id) || !frame.generation_epoch
+      || generationEpoch && frame.generation_epoch !== generationEpoch || frame.generation_id <= highestGeneration
+      || highestGeneration === 0 && (frame.generation_id !== 1 || frame.publication_id !== binding.publication_id)
+      || frame.payload?.publication_id !== frame.publication_id) throw Error('generation_capacity_protected');
+    // Re-resolve the actual candidate every time, never reuse the initial image
+    // across async boundaries or accept caller-selected paths.
+    generationEpoch ??= frame.generation_epoch; highestGeneration = frame.generation_id;
+    const initial = frame.generation_id === 1;
+    const expected = publicationSelector(runtime);
+    if (initial && (Object.keys(frame.payload).sort().join() !== Object.keys(expected).sort().join()
+      || Object.keys(expected).some(key => frame.payload[key] !== expected[key]))) throw Error('runtime_candidate_manifest_invalid');
+    // Initial identity is already bound, but never trusted across this async
+    // boundary: acquire below repeats the full fresh inspection under lock.
+    // Replacements additionally resolve through the existing publisher.
+    const selected = initial ? runtime : publisher.resolve(frame.payload);
+    if (selected.executionModel !== 'owner_threads_v1') throw Error('generation_manifest_incompatible');
+    const row = { epoch: frame.generation_epoch, generation: frame.generation_id, publication_id: frame.publication_id,
+      pending: new Map(), unknown: new Set(), uncertain: false, exited: false, closeAck: false };
+    rows.set(row.generation, row);
+    try {
+      const owned = publisher.acquire(selected, { ownerEpoch: row.epoch, generation: row.generation, ...(row.generation === 1 ? { publicationDeadline } : {}) });
+      row.claim = owned;
+      const worker = new Worker(pathToFileURL(join(selected.packageRoot, 'src/generation-thread-entry.js')),
+        { workerData: { epoch: row.epoch, generation: row.generation }, stdin: false, stdout: true, stderr: true, env: { ...env, AGDF_DISPATCH_PLUGIN_ROOT: pluginRoot }, execArgv: [] });
+      row.worker = worker;
+      // Domain output cannot contaminate the facade's public MCP STDOUT.
+      worker.stdout.resume(); worker.stderr.pipe(process.stderr, { end: false });
+      owned.bindOwnedWorker(worker, { confirmedEnd: () => row.closeAck && !row.pending.size && !row.unknown.size && !row.uncertain });
+      worker.on('message', wire => receive(row, wire));
+      worker.once('error', () => { row.uncertain = true; });
+      worker.once('exit', code => {
+        row.exited = true;
+        for (const entry of row.pending.values()) clearTimeout(entry.timer);
+        if (code === 0 && row.closeAck && !row.pending.size && !row.unknown.size && !row.uncertain) rows.delete(row.generation);
+        else { row.uncertain = true; failed = true; }
+        try { post('exit', { code }, randomUUID(), row); } catch { failed = true; }
+      });
+      post('opened', { opened: true }, frame.request_id, row);
+    } catch (error) {
+      if (!row.claim) rows.delete(row.generation);
+      else { row.uncertain = true; failed = true; }
+      throw error;
+    }
+  }
+  return new Promise((resolve, reject) => {
+    facade = new Worker(pathToFileURL(join(runtime.dispatcherRoot, 'lib/mcp-lifecycle/facade-thread-entry.js')),
+      { workerData: { input: { runtime, surface, ...(cockpitDir ? { cockpitDir } : {}), ...(cockpitMode ? { cockpitMode } : {}),
+        pluginRoot, token: claim.token, deadline_ns: deadlineNs }, binding }, env, stdin: true, stdout: true, stderr: true, execArgv: [] });
+    claim.bindOwnedWorker(facade, { confirmedEnd: () => facadeAck && !failed && rows.size === 0 });
+    // Native streams implement actual backpressure in both directions.
+    facade.stdout.pipe(process.stdout, { end: false }); facade.stderr.pipe(process.stderr, { end: false }); process.stdin.pipe(facade.stdin);
+    facade.stdin.on('error', () => {});
+    const stop = () => { try { post('stop', {}, randomUUID()); } catch { failed = true; } };
+    const detach = () => {
+      signals.off('SIGTERM', stop); signals.off('SIGINT', stop); signals.off('disconnect', stop); process.stdin.unpipe(facade.stdin);
+    };
+    signals.on('SIGTERM', stop); signals.on('SIGINT', stop); signals.on('disconnect', stop);
+    facade.on('message', wire => {
+      let frame;
+      try {
+        frame = decodeOwnerFrame(wire, binding);
+        if (seen.has(frame.request_id) || seen.size >= OWNER_LIMITS.history) throw Error('generation_request_capacity');
+        seen.add(frame.request_id);
+        if (frame.kind === 'closed' && frame.generation_id === null && frame.publication_id === binding.publication_id
+          && Object.keys(frame.payload).join() === 'confirmed' && typeof frame.payload.confirmed === 'boolean') {
+          facadeAck = frame.payload.confirmed;
+          // A signalled client may keep public stdin open. After the facade's
+          // own close acknowledgement, finish its real input stream so the
+          // Worker can exit naturally and supply actual lifetime evidence.
+          process.stdin.unpipe(facade.stdin); process.stdin.pause(); facade.stdin.end(); return;
+        }
+        if (frame.kind === 'open') { open(frame); return; }
+        const row = rows.get(frame.generation_id);
+        if (!row || row.epoch !== frame.generation_epoch || row.publication_id !== frame.publication_id
+          || frame.kind !== 'send' || !validGenerationMessage(frame.payload, { epoch: row.epoch, generation: row.generation })
+          || frame.request_id !== frame.payload.request_id) throw Error('generation_input_limit');
+        transmit(row, frame.payload, { bytes: Buffer.byteLength(wire) });
+      } catch (error) {
+        if (frame) try { post('failure', { reason: generationFailureReason(error) }, frame.request_id,
+          { epoch: frame.generation_epoch, generation: frame.generation_id, publication_id: frame.publication_id }); } catch { failed = true; }
+      }
+    });
+    facade.once('error', () => { failed = true; });
+    facade.once('exit', code => {
+      facadeExited = true; detach();
+      for (const row of rows.values()) drain(row);
+      if (code === 0 && facadeAck && !failed && rows.size === 0) resolve({ closed: true, confirmed_exit: true });
+      else reject(Error('AGDF_MCP_FACADE_CLOSE_UNCONFIRMED'));
+    });
+  });
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-owner-protocol.js

@@ -0,0 +1 @@
+export * from '#agdf-core/runtime/mcp-owner-protocol.js';