deadbyte-mcp 0.15.2 → 0.15.4

package/src/fuzzy-search.mjs

@@ -0,0 +1,34 @@
+import { Worker } from 'node:worker_threads';
+
+export const FUZZY_SEARCH_TIMEOUT_MS=30000;
+const WORKER_URL=new URL('./fuzzy-search-worker.mjs',import.meta.url);
+
+export function runFuzzySearchInWorker(text,query,timeoutMs=FUZZY_SEARCH_TIMEOUT_MS){
+  if(!Number.isInteger(timeoutMs)||timeoutMs<100||timeoutMs>FUZZY_SEARCH_TIMEOUT_MS)throw new Error('fuzzy timeout_ms must be in [100, 30000]');
+  return new Promise((resolve,reject)=>{
+    const worker=new Worker(WORKER_URL,{type:'module',workerData:{text,query},execArgv:[]});
+    worker.unref?.();
+    let settled=false;
+    let timer;
+    const finish=(fn,value)=>{
+      if(settled)return;
+      settled=true;
+      clearTimeout(timer);
+      fn(value);
+    };
+    timer=setTimeout(()=>{
+      worker.terminate().catch(()=>{});
+      finish(reject,new Error(`fuzzy search timed out after ${timeoutMs}ms`));
+    },timeoutMs);
+    timer.unref?.();
+    worker.once('message',message=>{
+      if(message?.ok)finish(resolve,message.result);
+      else finish(reject,new Error(`fuzzy search worker failed: ${String(message?.error??'unknown error')}`));
+      worker.terminate().catch(()=>{});
+    });
+    worker.once('error',error=>finish(reject,error));
+    worker.once('exit',code=>{
+      if(code!==0)finish(reject,new Error(`fuzzy search worker exited with code ${code}`));
+    });
+  });
+}

package/src/machine-fs-mcp-tools.mjs

@@ -32,7 +32,7 @@ export function registerMachineFsTools(server, { runtime }) {
   });
   server.registerTool('machine_fs_read', {
     description:'Read one bounded byte range from a root-relative regular file.',
-    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
+    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().min(-4*1024*1024).max(4*1024*1024).default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
     outputSchema:machineFsReadOutputSchema
   }, async ({root_id,path,offset,max_bytes,hash_file,timeout_ms}) => {
     try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file,timeoutMs:timeout_ms})); }

package/src/machine-fs-output-contracts.mjs

@@ -30,7 +30,7 @@ export const machineFsListOutputSchema = z.strictObject({
 export const machineFsReadOutputSchema = z.strictObject({
   status: statusOk, error,
   root_id: z.string().min(1).max(64).optional(), path: pathText.optional(),
-  offset: z.number().int().nonnegative().optional(), next_offset: z.number().int().nonnegative().optional(),
+  offset: z.number().int().nonnegative().optional(), requested_offset: z.number().int().optional(), next_offset: z.number().int().nonnegative().optional(),
   file_size: z.number().int().nonnegative().optional(), eof: z.boolean().optional(),
   data_base64: z.string().max(12 * 1024 * 1024).optional(), data_sha256: hex64.optional(),
   file_sha256: hex64.nullable().optional(), timeout_ms: z.number().int().min(100).max(180000).optional()

package/src/machine-fs-smoke-client.mjs

@@ -56,7 +56,7 @@ const transport = new StdioClientTransport({
 });
 const stderrChunks = [];
 transport.stderr?.on('data', chunk => stderrChunks.push(Buffer.from(chunk)));
-const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
+const baseTools = ['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
 const codingTools = [
   'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
   'coding_receipt_verify','coding_search','coding_session_status','coding_stat',

package/src/machine-fs.mjs

@@ -9,6 +9,7 @@ import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
+import { atomicMutation } from './atomic-mutation.mjs';
 
 export const MACHINE_FS_RECEIPT_SCHEMA = 'deadbyte.machine-fs-receipt.v1';
 const RECEIPT_DOMAIN = Buffer.from('DEADBYTE-MACHINE-FS-RECEIPT-V1\0', 'utf8');
@@ -271,29 +272,8 @@ function requestSha(operation, args) {
 }
 
 async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null) {
-  const before = await regularState(target);
-  checkExpectedFile(before, expectedSha256);
-  const temp = path.join(path.dirname(target), `.${path.basename(target)}.deadbyte-machine-fs-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
-  let handle;
-  try {
-    if (authorityCheck) await authorityCheck();
-    handle = await open(temp, 'wx', 0o600);
-    await handle.writeFile(bytes);
-    await handle.sync();
-    await handle.close();
-    handle = null;
-    checkExpectedFile(await regularState(target), expectedSha256);
-    if (authorityCheck) await authorityCheck();
-    await rename(temp, target);
-  } catch (error) {
-    if (handle) await handle.close().catch(() => {});
-    await rm(temp, { force: true }).catch(() => {});
-    throw error;
-  }
-  const after = await regularState(target);
-  const expectedAfter = sha256Bytes(bytes);
-  if (!after.exists || after.sha256 !== expectedAfter) throw new Error('machine fs post-commit hash mismatch');
-  return { before, after };
+  return atomicMutation({ target, bytes, expected: expectedSha256, readState: regularState,
+    assertExpected: checkExpectedFile, authorityCheck, tempTag: 'deadbyte-machine-fs' });
 }
 
 export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {
@@ -344,24 +324,25 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
     return { status: 'ok', root_id: rootId, path: found.relative, entries, next_cursor: nextCursor };
   }
   async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false, timeoutMs = 30000 }) {
-    if (!Number.isInteger(offset) || offset < 0) throw new Error('machine fs read offset must be nonnegative integer');
+    if (!Number.isInteger(offset) || offset < -policy.max_read_bytes || offset > policy.max_read_bytes) throw new Error(`machine fs read offset must be in [-${policy.max_read_bytes}, ${policy.max_read_bytes}]`);
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
     if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingArmed(policy, rootId);
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
     const info = await lstat(found.resolved);
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
-    if (offset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const length = Math.min(maxBytes, info.size - offset);
+    const effectiveOffset = offset < 0 ? Math.max(0, info.size + offset) : offset;
+    if (effectiveOffset > info.size) throw new Error('machine fs read offset exceeds file size');
+    const length = Math.min(maxBytes, info.size - effectiveOffset);
     await recheckCodingAuthority(policy, grant, rootId);
-    const worker = await boundedReadWorker({ file: found.resolved, offset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const worker = await boundedReadWorker({ file: found.resolved, offset: effectiveOffset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
     const buffer = Buffer.from(worker.data_base64, 'base64');
     if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
     await recheckCodingAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset, next_offset: offset + buffer.length, file_size: info.size,
-      eof: offset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      offset: effectiveOffset, requested_offset: offset, next_offset: effectiveOffset + buffer.length, file_size: info.size,
+      eof: effectiveOffset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
       data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
       timeout_ms: timeoutMs
     };

package/src/mcp-server.mjs

@@ -15,6 +15,7 @@ import { DEADBYTE_VERSION } from './version.mjs';
 import { currentIngressAdapterMode, TUNNEL_STDIO_PROBE_COMPAT_MODE } from './ingress-mode.mjs';
 import { installTunnelStdioProbeCompat } from './tunnel-stdio-compat.mjs';
 import { installStdioConsoleGuard } from './stdio-console-guard.mjs';
+import { recoverInterruptedSlotUpdates } from './runtime-update.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { assertHostArmed, hostExec, hostExecInline, hostExecNative, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
 import { createMachineRuntime } from './machine-identity.mjs';
@@ -74,6 +75,11 @@ const verifyKeyPath = process.env.DEADBYTE_VERIFY_KEY ?? defaultPublicKeyPath();
 const auditRuntimeMode = process.env.DEADBYTE_AUDIT_RUNTIME ?? '0';
 if (!['0','1'].includes(auditRuntimeMode)) throw new Error('DEADBYTE_AUDIT_RUNTIME must be 0 or 1');
 const runtimeStateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(),'.deadbyte-mcp'));
+const interruptedUpdateRecovery = await recoverInterruptedSlotUpdates({ stateRoot: runtimeStateRoot });
+if (interruptedUpdateRecovery.launched > 0) {
+  console.error(`[runtime-update-recovery] launched ${interruptedUpdateRecovery.launched} detached supervisor(s)`);
+}
+
 const surfaceProfile = capabilityProfileFromEnv(process.env);
 const localPrivilegedPolicyPath = path.join(packageRoot, 'controller', 'deadbyte-host-policy.json');
 const privilegedPolicyExplicit = Object.hasOwn(process.env, 'DEADBYTE_PRIVILEGED_POLICY');

package/src/observation-smoke-client.mjs

@@ -51,7 +51,7 @@ const transport=new StdioClientTransport({command:process.execPath,args:[serverP
   env:{...getDefaultEnvironment(),DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1',
     DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_STATE_ROOT:state,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath},stderr:'pipe'});
 const stderr=[]; transport.stderr?.on('data',chunk=>stderr.push(Buffer.from(chunk)));
-const base=['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
+const base=['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
 const machine=['machine_list','machine_ping','machine_revoke','machine_status'];
 const coding=['coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read','coding_receipt_verify','coding_search',
   'coding_session_status','coding_stat','coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',

package/src/process-mcp-tools.mjs

@@ -22,10 +22,10 @@ export function registerProcessTools(server, { runtime }) {
     description: 'Start one locally registered process profile inside an approved root. Executable identity comes only from local policy.',
     inputSchema: z.strictObject({
       profile_id: id, root_id: id, cwd: z.string().min(1).max(1024).default('.'),
-      args: z.array(z.string().max(8192)).max(64).default([])
+      args: z.array(z.string().max(8192)).max(64).default([]), timeout_ms: z.number().int().min(100).max(900000).nullable().default(null)
     }), outputSchema: processStartOutputSchema
-  }, async ({ profile_id, root_id, cwd, args }) => {
-    try { return ok(processStartOutputSchema, { status: 'ok', session: await runtime.start({ profileId: profile_id, rootId: root_id, cwd, args }) }); }
+  }, async ({ profile_id, root_id, cwd, args, timeout_ms }) => {
+    try { return ok(processStartOutputSchema, { status: 'ok', session: await runtime.start({ profileId: profile_id, rootId: root_id, cwd, args, timeoutMs: timeout_ms }) }); }
     catch (error) { return fail(processStartOutputSchema, 'denied', error); }
   });
   server.registerTool('process_session_read', {
@@ -66,6 +66,14 @@ export function registerProcessTools(server, { runtime }) {
     try { return ok(processListOutputSchema, { status: 'ok', ...(await runtime.list()) }); }
     catch (error) { return fail(processListOutputSchema, 'failed', error); }
   });
+  server.registerTool('process_session_cancel', {
+    description: 'Request cooperative cancellation of one DEADBYTE-owned process session. Cancellation is recorded separately from physical termination.',
+    inputSchema: z.strictObject({ session_id: hex64, reason: z.string().min(1).max(256).default('operator_request') }), outputSchema: processTerminateOutputSchema
+  }, async ({ session_id, reason }) => {
+    try { return ok(processTerminateOutputSchema, { status: 'ok', session: await runtime.cancel({ sessionId: session_id, reason }) }); }
+    catch (error) { return fail(processTerminateOutputSchema, 'denied', error); }
+  });
+
   server.registerTool('process_session_terminate', {
     description: 'Terminate one DEADBYTE-owned process session through its owned host boundary. Numeric PID is never an input.',
     inputSchema: z.strictObject({ session_id: hex64 }), outputSchema: processTerminateOutputSchema

package/src/process-output-contracts.mjs

@@ -4,6 +4,23 @@ import { structuredToolResult } from './output-contracts.mjs';
 const hex64 = z.string().regex(/^[0-9a-f]{64}$/);
 const digits = z.string().regex(/^[0-9]+$/);
 const processState = z.enum(['running','exited','terminated']);
+const termination = z.strictObject({
+  deadline_exceeded:z.boolean(), cancellation_requested:z.boolean(), physical_termination:z.boolean(), verified:z.boolean(),
+  terminal_semantics:z.string().min(1).max(64)
+});
+const deadline = z.strictObject({
+  schema:z.literal('deadbyte.deadline.v1'), id:hex64.nullable(), created_at_ms:z.number(), timeout_ms:z.number().int().positive().nullable(), deadline_ms:z.number().nullable()
+});
+const streamCoverage = z.strictObject({
+  logical_first_seq:z.number().int().min(1), logical_last_seq:z.number().int().min(0),
+  retained_first_seq:z.number().int().min(1), retained_last_seq:z.number().int().min(0),
+  complete:z.boolean(), truncated:z.boolean(),
+  missing_ranges:z.array(z.strictObject({from:z.number().int().min(1),to:z.number().int().min(0)})).max(100000),
+  logical_item_count:z.number().int().min(0), retained_item_count:z.number().int().min(0),
+  logical_bytes:z.number().int().min(0), retained_bytes:z.number().int().min(0),
+  dropped_items:z.number().int().min(0), dropped_bytes:z.number().int().min(0),
+  status:z.enum(['open','closed'])
+});
 
 export const processSessionRecordSchema = z.strictObject({
   session_id: hex64,
@@ -17,6 +34,12 @@ export const processSessionRecordSchema = z.strictObject({
   earliest_offset: z.number().int().nonnegative(),
   stream_head: z.number().int().nonnegative(),
   stream_sha256: hex64,
+  stream_id: hex64.nullable(),
+  stream_generation: z.number().int().min(1).nullable(),
+  stream_next_seq: z.number().int().min(1).nullable(),
+  stream_coverage: streamCoverage.nullable(),
+  termination: termination.nullable(),
+  deadline: deadline.nullable(),
   journal_head_sha256: hex64
 });
 

package/src/process-runtime.mjs

@@ -6,6 +6,8 @@ import { canonicalJson } from './canonical-json.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
 import { assertProcessArmed, recheckProcessAuthority } from './process-policy.mjs';
+import { createSequenceStream } from './workload-substrate.mjs';
+import { classifyTermination, composeAbortSignal, createCancellationToken, createDeadline } from './deadline-cancellation.mjs';
 
 const EVENT_SCHEMA = 'deadbyte.process-event.v1';
 const EVENT_DOMAIN = Buffer.from('DEADBYTE-PROCESS-EVENT-V1\0', 'utf8');
@@ -52,11 +54,18 @@ async function resolveCwd(policy, grant, profile, rootId, cwd) {
 }
 
 function publicSession(session) {
+  const stream = session.recovered_terminal ? null : session.output_stream;
   return {
     session_id: session.session_id, profile_id: session.profile_id, root_id: session.root_id,
     cwd: session.cwd_relative, child_pid: session.child_pid, creation_filetime: session.creation_filetime,
     state: session.state, exit_code: session.exit_code, earliest_offset: session.earliest_offset,
     stream_head: session.stream_head, stream_sha256: session.stream_sha256,
+    stream_id: stream?.streamId ?? null,
+    stream_generation: stream?.generation ?? null,
+    stream_next_seq: stream?.snapshot().next_seq ?? null,
+    stream_coverage: stream?.coverage() ?? null,
+    termination: session.termination ?? null,
+    deadline: session.deadline ?? null,
     journal_head_sha256: session.journal_head_sha256
   };
 }
@@ -93,6 +102,7 @@ function retainedIndexOf(session, needle, begin = 0) {
 function appendOutput(session, chunk) {
   if (!chunk?.length) return;
   const bytes = Buffer.from(chunk);
+  session.output_stream?.append(null, { producer: 'process-host', channel: 'merged-output', sizeBytes: bytes.length });
   session.stream_sha256 = sha256Bytes(Buffer.concat([
     Buffer.from(session.stream_sha256, 'hex'), bytes
   ]));
@@ -207,7 +217,8 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
           earliest_offset:terminal.detail.earliest_offset, stream_head:terminal.detail.stream_head,
           stream_sha256:terminal.detail.stream_sha256, output_chunks:[output], retained_output_bytes:output.length, control_buffer:Buffer.alloc(0),
           journal_head_sha256:checked.head_sha256, journal_path:path.join(policy.state_dir,name), event_count:checked.event_count,
-          max_retained_output_bytes:profile.max_retained_output_bytes, stderr:'', terminate_requested:terminal.type==='terminated',
+          max_retained_output_bytes:profile.max_retained_output_bytes, output_stream:createSequenceStream({streamId:sessionId,maxItems:1000000,maxBytes:profile.max_retained_output_bytes}), stderr:'', terminate_requested:terminal.type==='terminated',
+          termination:terminal.detail?.termination ?? null, deadline:terminal.detail?.deadline ?? null, cancellation:null,
           protocol_error:null, transport:profile.transport, win32_input_mode:false, host:null, close_promise:Promise.resolve(),
           recovered_terminal:true
         });
@@ -281,7 +292,8 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     }
   }
 
-  async function start({ profileId, rootId, cwd = '.', args = [] }) {
+  async function start({ profileId, rootId, cwd = '.', args = [], timeoutMs = null }) {
+    if (timeoutMs !== null && (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 900000)) throw new Error('process timeout_ms must be in [100, 900000] or null');
     await hydrateTerminalSessions();
     const grant = await assertProcessArmed(policy, profileId, rootId);
     const profile = policy.profiles[profileId];
@@ -303,16 +315,35 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
       cwd_relative: cwdInfo.relative, child_pid: null, creation_filetime: null, state: 'starting', exit_code: null,
       earliest_offset: 0, stream_head: 0, stream_sha256: ZERO_SHA256, output_chunks: [], retained_output_bytes: 0, control_buffer: Buffer.alloc(0),
       journal_head_sha256: ZERO_SHA256, journal_path: path.join(policy.state_dir, `${sessionId}.jsonl`), event_count: 0,
-      max_retained_output_bytes: profile.max_retained_output_bytes, stderr: '', terminate_requested: false, protocol_error: null,
+      max_retained_output_bytes: profile.max_retained_output_bytes, output_stream: createSequenceStream({streamId: sessionId, maxItems: 1000000, maxBytes: profile.max_retained_output_bytes}), stderr: '', terminate_requested: false, protocol_error: null,
+      deadline: createDeadline({ timeoutMs, id: sessionId }),
+      cancellation: createCancellationToken({ id: sessionId }),
+      termination: classifyTermination(),
       transport: profile.transport,
       win32_input_mode: false
     };
     await recheckProcessAuthority(policy, grant, profileId, rootId);
+    const composed = composeAbortSignal({ deadline: session.deadline, cancellation: session.cancellation });
+    session.abort_signal = composed;
     const host = spawn(policy.native_host.path,
       [profile.executable, cwdInfo.resolved, session.job_id, `--deadbyte-transport=${profile.transport}`, ...profile.prefix_args, ...args],
       { cwd: cwdInfo.resolved, env: processEnvironment(profile), windowsHide: true, shell: false, stdio: ['pipe','pipe','pipe'] });
     session.host = host;
     sessions.set(sessionId, session);
+    const abortProcess = () => {
+      const reason = String(composed.signal.reason ?? 'cancelled');
+      const snapshot = session.cancellation.snapshot();
+      session.termination = classifyTermination({
+        deadlineExceeded: reason === 'deadline_exceeded',
+        cancellationRequested: snapshot.requested,
+        physicallyTerminated: false,
+        verified: false
+      });
+      session.terminate_requested = true;
+      if (!host.killed) host.kill();
+    };
+    composed.signal.addEventListener('abort', abortProcess, { once: true });
+    if (composed.signal.aborted) abortProcess();
     const ready = new Promise((resolve, reject) => { session.ready_resolve = resolve; session.ready_reject = reject; });
     host.stdout.on('data', chunk => parseHostOutput(session, chunk));
     host.stderr.on('data', chunk => { session.stderr = (session.stderr + chunk.toString('utf8')).slice(-16384); });
@@ -322,6 +353,13 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
         parseHostOutput(session, null, true);
         if (session.state === 'starting') session.ready_reject?.(new Error(`process host exited before READY: ${session.stderr}`));
         session.exit_code ??= Number.isInteger(code) ? code : null;
+        const snapshot = session.cancellation.snapshot();
+        session.termination = classifyTermination({
+          deadlineExceeded: session.deadline.deadline_ms !== null && Date.now() >= session.deadline.deadline_ms && session.terminate_requested,
+          cancellationRequested: snapshot.requested,
+          physicallyTerminated: session.terminate_requested,
+          verified: true
+        });
         const terminalState = session.terminate_requested ? 'terminated' : 'exited';
         try {
           const outputFile = `${session.session_id}.stream.bin`;
@@ -336,10 +374,13 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
             stream_sha256:session.stream_sha256,
             retained_output_bytes:session.retained_output_bytes,
             retained_output_sha256:retainedOutputSha256,
+            termination:session.termination,
+            deadline:session.deadline,
             output_file:outputFile
           });
           session.state = terminalState;
         } catch {}
+        composed.close();
         resolve();
       });
     });
@@ -428,11 +469,19 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     await appendEvent(runtime, session, 'action', { action_id: actionId, logical_bytes: logicalBytes.length, logical_sha256: logicalSha256 });
     return { action_id: actionId, logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, session: publicSession(session) };
   }
+  async function cancel({ sessionId, reason = 'operator_request' }) {
+    const session = await sessionFor(sessionId);
+    if (typeof reason !== 'string' || reason.length < 1 || reason.length > 256) throw new Error('process cancellation reason invalid');
+    if (['exited','terminated'].includes(session.state)) return publicSession(session);
+    session.cancellation.request(reason);
+    await session.close_promise;
+    return publicSession(session);
+  }
   async function terminate({ sessionId }) {
     const session = await sessionFor(sessionId);
     if (['exited','terminated'].includes(session.state)) return publicSession(session);
     session.terminate_requested = true;
-    session.host.kill();
+    if (!session.host.killed) session.host.kill();
     await session.close_promise;
     return publicSession(session);
   }
@@ -463,5 +512,5 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return { ok: true, event_count: sequence, head_sha256: previous };
   }
 
-  return { policy, start, read, write, status, list, action, terminate, verifyEventJournal };
+  return { policy, start, read, write, status, list, action, cancel, terminate, verifyEventJournal };
 }

package/src/process-smoke-client.mjs

@@ -59,7 +59,7 @@ try {
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
   const expected = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open',
-    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate','process_session_write'].sort();
+    'process_session_action','process_session_cancel','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate','process_session_write'].sort();
   if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`process smoke catalog mismatch: ${JSON.stringify(names)}`);
   const started = structured(await client.callTool({ name: 'process_session_start', arguments: {
     profile_id: 'ping_hold', root_id: 'core', cwd: '.', args: []

package/src/resource-identity.mjs

@@ -0,0 +1,59 @@
+import { createHash } from 'node:crypto';
+
+const SHA256_RE = /^[0-9a-f]{64}$/;
+
+function hashObject(value) {
+  const json = JSON.stringify(value);
+  return createHash('sha256').update(Buffer.from(json, 'utf8')).digest('hex');
+}
+
+function requiredString(value, name, max = 512) {
+  if (typeof value !== 'string' || value.length < 1 || value.length > max) throw new Error(`resource identity ${name} invalid`);
+  return value;
+}
+
+export function createResourceIdentity({
+  rootId,
+  rootGeneration = null,
+  relativePath,
+  canonicalPath,
+  kind,
+  exists,
+  size = 0,
+  contentSha256 = null,
+  objectIdentitySha256 = null
+}) {
+  requiredString(rootId, 'root_id', 64);
+  requiredString(relativePath, 'relative_path');
+  requiredString(canonicalPath, 'canonical_path', 4096);
+  requiredString(kind, 'kind', 32);
+  if (rootGeneration !== null && typeof rootGeneration !== 'string') throw new Error('resource identity root_generation invalid');
+  if (typeof exists !== 'boolean') throw new Error('resource identity exists invalid');
+  if (!Number.isSafeInteger(size) || size < 0) throw new Error('resource identity size invalid');
+  if (contentSha256 !== null && !SHA256_RE.test(contentSha256)) throw new Error('resource identity content_sha256 invalid');
+  if (objectIdentitySha256 !== null && !SHA256_RE.test(objectIdentitySha256)) throw new Error('resource identity object_identity_sha256 invalid');
+
+  const location = {
+    schema: 'deadbyte.resource-location.v1',
+    root_id: rootId,
+    root_generation: rootGeneration,
+    relative_path: relativePath.replaceAll('\\', '/'),
+    canonical_path: canonicalPath,
+    kind,
+    exists
+  };
+  const resourceIdentitySha256 = hashObject(location);
+
+  return Object.freeze({
+    ...location,
+    size,
+    content_sha256: contentSha256,
+    object_identity_sha256: objectIdentitySha256,
+    resource_identity_sha256: resourceIdentitySha256
+  });
+}
+
+export function contentIdentitySha256(contentSha256) {
+  if (contentSha256 !== null && !SHA256_RE.test(contentSha256)) throw new Error('content_sha256 invalid');
+  return contentSha256;
+}