firedrill-run 2.2.5 → 3.0.1

package/dist/cli/src/runner-world-journal.js

@@ -0,0 +1,510 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, opendir, rename, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { privateDirectory } from './credentials.js';
+import { API_ORIGIN, CliError } from './http.js';
+import { identifier } from './world-contracts.js';
+import { processLifetimeLock } from './runner-process-lock.js';
+const MAX = 2 * 1024 ** 2, MAGIC = Buffer.from('FDWE1');
+const encryptedName = /^[a-z0-9][a-z0-9.-]{0,149}\.bin(?:\.[a-f0-9-]{36}\.tmp)?$/;
+const markerTemporary = /^erasure\.json\.[a-f0-9-]{36}\.tmp$/;
+const ERASURE_PASS = 1000;
+const sha = (raw) => createHash('sha256').update(raw).digest('hex');
+const invalid = () => new CliError('local_world_journal_unavailable', 'The original encrypted world journal could not be read safely. No action was repeated.');
+/** Private ciphertext on disk; its random per-lease key lives only in the OS
+ * credential store. Target outputs may contain private values before the cloud
+ * whole-file inspector sees them, so Unix permissions alone are not enough.
+ * This is not source/target/provider credential storage or a new execution lane.
+ */
+export class LocalWorldJournal {
+    closed = false;
+    retainUntil = Infinity;
+    erasureState = null;
+    get expiresAt() { return this.retainUntil; }
+    get removalStarted() { return this.erasureState !== null; }
+    directory;
+    key;
+    aad;
+    ownership;
+    get signal() { return this.ownership.signal; }
+    keyEntry;
+    erasureOnly;
+    constructor(directory, key, aad, ownership, keyEntry, erasureOnly = false) {
+        this.directory = directory;
+        this.key = key;
+        this.aad = aad;
+        this.ownership = ownership;
+        this.keyEntry = keyEntry;
+        this.erasureOnly = erasureOnly;
+    }
+    static async acquire(owner, manifest, options = {}) {
+        if (!owner.evidenceUpload || !/^[a-f0-9]{64}$/.test(manifest))
+            throw invalid();
+        const identity = [owner.owner, owner.workspace, owner.device, owner.lease].map(identifier).join('/');
+        const directory = join(await privateDirectory(), 'world-' + identity.replaceAll('/', '-'));
+        if (!options.existingOnly)
+            await mkdir(directory, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+                throw error; });
+        const info = await lstat(directory);
+        if (!info.isDirectory() || info.isSymbolicLink() || info.mode & 0o077 || process.getuid && info.uid !== process.getuid())
+            throw invalid();
+        const lock = await processLifetimeLock(join(directory, 'owner.lock'));
+        let key = null;
+        try {
+            const { Entry } = await import('@napi-rs/keyring');
+            lock.assertHeld();
+            const store = new Entry('run.firedrill.simulation.world-evidence.v1', API_ORIGIN + '/' + identity, process.platform === 'linux' ? { linux: { store: 'secret-service' } } : undefined);
+            const erasure = await lstat(join(directory, 'erasure.json')).catch(error => { if (error.code === 'ENOENT')
+                return null; throw error; });
+            if (erasure && !options.erasureOnly)
+                throw new CliError('local_world_journal_erased', 'This private journal is being removed or was removed. No replacement key or target is created.');
+            let encoded = store.getPassword();
+            if (encoded === null) {
+                if (options.erasureOnly && erasure)
+                    key = Buffer.alloc(0); // Erasure recovery only, never a decryption fallback.
+                else {
+                    if (options.existingOnly || options.erasureOnly)
+                        throw invalid();
+                    // Never create a replacement key when an earlier ciphertext exists.
+                    const marker = await lstat(join(directory, 'identity.bin')).catch(error => { if (error.code === 'ENOENT')
+                        return null; throw error; });
+                    if (marker)
+                        throw invalid();
+                    key = randomBytes(32);
+                    encoded = key.toString('base64url');
+                    store.setPassword(encoded);
+                    if (store.getPassword() !== encoded)
+                        throw invalid();
+                }
+            }
+            else {
+                if (!/^[A-Za-z0-9_-]{43}$/.test(encoded))
+                    throw invalid();
+                key = Buffer.from(encoded, 'base64url');
+                if (key.length !== 32 || key.toString('base64url') !== encoded)
+                    throw invalid();
+            }
+            const aad = Buffer.from(JSON.stringify({ schema: 'firedrill.local-world-journal.v1', origin: API_ORIGIN,
+                owner: owner.owner, workspace: owner.workspace, device: owner.device, lease: owner.lease, attempt: owner.attempt,
+                native_session: owner.nativeSession, job: owner.job, request: owner.request, grant: owner.grant, payload: owner.payloadDigest,
+                session: { session_id: owner.session.session_id, configuration_id: owner.session.configuration_id,
+                    input_sha256: owner.session.input_sha256, expires_at: owner.session.expires_at }, manifest }));
+            lock.assertHeld();
+            const journal = new LocalWorldJournal(directory, key, aad, lock, store, options.erasureOnly);
+            if (erasure) {
+                const original = await journal.erasure();
+                if (!original)
+                    throw invalid();
+                journal.erasureState = original.state;
+                return journal;
+            }
+            if (options.existingOnly || options.erasureOnly) {
+                const retained = await journal.get('identity');
+                try {
+                    if (!retained || retained.length !== aad.length || sha(retained) !== sha(aad))
+                        throw invalid();
+                }
+                finally {
+                    retained?.fill(0);
+                }
+            }
+            else
+                await journal.put('identity', aad);
+            const retention = await journal.get('retention');
+            try {
+                if (retention) {
+                    const value = JSON.parse(retention.toString('utf8'));
+                    if (!value || Object.keys(value).sort().join(',') !== 'expires_at,manifest_sha256,schema'
+                        || value.schema !== 'firedrill.local-world-retention.v1' || value.manifest_sha256 !== manifest
+                        || typeof value.expires_at !== 'string' || !Number.isFinite(Date.parse(value.expires_at))
+                        || options.retainUntil && options.retainUntil !== value.expires_at)
+                        throw invalid();
+                    journal.retainUntil = Date.parse(value.expires_at);
+                }
+                else {
+                    if (options.erasureOnly)
+                        return journal; // Explicit cleanup can remove a partially initialized owned journal.
+                    if (options.existingOnly || options.erasureOnly || !options.retainUntil || !Number.isFinite(Date.parse(options.retainUntil)))
+                        throw invalid();
+                    const raw = Buffer.from(JSON.stringify({ schema: 'firedrill.local-world-retention.v1', manifest_sha256: manifest, expires_at: options.retainUntil }));
+                    try {
+                        await journal.put('retention', raw);
+                    }
+                    finally {
+                        raw.fill(0);
+                    }
+                    journal.retainUntil = Date.parse(options.retainUntil);
+                }
+            }
+            finally {
+                retention?.fill(0);
+            }
+            if (!options.erasureOnly && journal.retainUntil <= Date.now()) {
+                throw new CliError('local_world_journal_expired', 'Local evidence retention ended. Remove this operation with firedrill runner evidence forget. No target is run to reconstruct it.');
+            }
+            return journal;
+        }
+        catch (error) {
+            key?.fill(0);
+            await lock.close();
+            if (error instanceof CliError)
+                throw error;
+            throw new CliError('local_world_journal_key_unavailable', 'Unlock the OS credential store for private world evidence. No plaintext fallback or target restart is used.');
+        }
+    }
+    path(name) {
+        this.ownership.assertHeld();
+        if (this.closed || !/^[a-z0-9][a-z0-9.-]{0,149}$/.test(name))
+            throw invalid();
+        if (!this.erasureOnly && this.retainUntil <= Date.now())
+            throw new CliError('local_world_journal_expired', 'Local evidence retention ended. Use firedrill runner evidence forget for this operation.');
+        return join(this.directory, name + '.bin');
+    }
+    async readEnvelope(name) {
+        const path = this.path(name);
+        const before = await lstat(path).catch(error => { if (error.code === 'ENOENT')
+            return null; throw error; });
+        if (!before)
+            return null;
+        if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.mode & 0o077 || before.size > MAX + 64
+            || process.getuid && before.uid !== process.getuid())
+            throw invalid();
+        const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const actual = await file.stat();
+            if (actual.ino !== before.ino || actual.dev !== before.dev || actual.size !== before.size)
+                throw invalid();
+            const raw = await file.readFile(), after = await file.stat();
+            if (after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) {
+                raw.fill(0);
+                throw invalid();
+            }
+            return raw;
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async get(name) {
+        if (this.key.length !== 32)
+            throw invalid();
+        const raw = await this.readEnvelope(name);
+        if (!raw)
+            return null;
+        try {
+            if (raw.length < 33 || !raw.subarray(0, 5).equals(MAGIC))
+                throw invalid();
+            const decipher = createDecipheriv('aes-256-gcm', this.key, raw.subarray(5, 17));
+            decipher.setAAD(Buffer.concat([this.aad, Buffer.from('\0' + name)]));
+            decipher.setAuthTag(raw.subarray(17, 33));
+            return Buffer.concat([decipher.update(raw.subarray(33)), decipher.final()]);
+        }
+        catch {
+            throw invalid();
+        }
+        finally {
+            raw.fill(0);
+        }
+    }
+    async put(name, body, replace = false) {
+        if (this.erasureOnly || this.key.length !== 32)
+            throw invalid();
+        const path = this.path(name);
+        if (!body.length || body.length > MAX)
+            throw invalid();
+        const previous = await this.get(name);
+        if (previous) {
+            try {
+                if (previous.length === body.length && sha(previous) === sha(body))
+                    return;
+                if (!replace)
+                    throw invalid();
+            }
+            finally {
+                previous.fill(0);
+            }
+        }
+        const iv = randomBytes(12), cipher = createCipheriv('aes-256-gcm', this.key, iv);
+        cipher.setAAD(Buffer.concat([this.aad, Buffer.from('\0' + name)]));
+        const encrypted = Buffer.concat([cipher.update(body), cipher.final()]);
+        const envelope = Buffer.concat([MAGIC, iv, cipher.getAuthTag(), encrypted]);
+        const pending = path + '.' + randomUUID() + '.tmp';
+        const file = await open(pending, 'wx', 0o600);
+        try {
+            await file.writeFile(envelope);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+            envelope.fill(0);
+            encrypted.fill(0);
+        }
+        this.ownership.assertHeld();
+        await rename(pending, path);
+        const parent = await open(this.directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0));
+        try {
+            await parent.sync();
+        }
+        finally {
+            await parent.close();
+        }
+    }
+    async *commandIdentities(signal) {
+        this.ownership.assertHeld();
+        if (this.closed)
+            throw invalid();
+        // Close the directory on exhaustion, cancellation or an early consumer
+        // return. Never enumerate all artifact parts just to find command metadata.
+        for await (const item of await opendir(this.directory, { bufferSize: 32 })) {
+            signal?.throwIfAborted();
+            this.ownership.assertHeld();
+            if (this.closed)
+                throw invalid();
+            const match = /^command-([a-f0-9-]{36})-identity\.bin$/.exec(item.name);
+            if (match)
+                yield identifier(match[1]);
+        }
+    }
+    async privateBytes(name, maximum) {
+        this.ownership.assertHeld();
+        const path = join(this.directory, name), before = await lstat(path).catch(error => { if (error.code === 'ENOENT')
+            return null; throw error; });
+        if (!before)
+            return null;
+        if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.mode & 0o077 || before.size > maximum
+            || process.getuid && before.uid !== process.getuid())
+            throw invalid();
+        const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const actual = await file.stat();
+            if (actual.dev !== before.dev || actual.ino !== before.ino || actual.size !== before.size)
+                throw invalid();
+            const raw = await file.readFile(), after = await file.stat();
+            if (after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) {
+                raw.fill(0);
+                throw invalid();
+            }
+            return raw;
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async erasure() {
+        const raw = await this.privateBytes('erasure.json', 8192);
+        if (!raw)
+            return null;
+        try {
+            const value = JSON.parse(raw.toString('utf8'));
+            if (!value || Object.keys(value).sort().join(',') !== 'file_count,finished_at,identity_sha256,pending_file,requested_at,schema,state'
+                || value.schema !== 'firedrill.local-world-erasure.v2' || value.identity_sha256 !== sha(this.aad)
+                || !['erasing', 'removed'].includes(value.state) || !Number.isFinite(Date.parse(value.requested_at))
+                || !Number.isSafeInteger(value.file_count) || value.file_count < 0
+                || value.state === 'removed' && (value.pending_file !== null || !value.finished_at || !Number.isFinite(Date.parse(value.finished_at)))
+                || value.state === 'erasing' && value.finished_at !== null)
+                throw invalid();
+            const one = value.pending_file;
+            if (one !== null && (!one || Object.keys(one).sort().join(',') !== 'device,inode,name,size'
+                || !encryptedName.test(one.name) && !markerTemporary.test(one.name)
+                || !Number.isSafeInteger(one.size) || one.size < 0 || one.size > (markerTemporary.test(one.name) ? 8192 : MAX + 64)
+                || typeof one.device !== 'string' || !/^[0-9]+$/.test(one.device)
+                || typeof one.inode !== 'string' || !/^[0-9]+$/.test(one.inode)))
+                throw invalid();
+            return value;
+        }
+        finally {
+            raw.fill(0);
+        }
+    }
+    async writeErasure(value) {
+        this.ownership.assertHeld();
+        const path = join(this.directory, 'erasure.json'), pending = path + '.' + randomUUID() + '.tmp';
+        const body = Buffer.from(JSON.stringify(value));
+        if (body.length > 8192) {
+            body.fill(0);
+            throw invalid();
+        }
+        const file = await open(pending, 'wx', 0o600);
+        try {
+            await file.writeFile(body);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+            body.fill(0);
+        }
+        this.ownership.assertHeld();
+        await rename(pending, path);
+        const parent = await open(this.directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0));
+        try {
+            await parent.sync();
+        }
+        finally {
+            await parent.close();
+        }
+    }
+    async fileIdentity(name, maximum) {
+        this.ownership.assertHeld();
+        const path = join(this.directory, name), before = await lstat(path).catch(error => { if (error.code === 'ENOENT')
+            return null; throw error; });
+        if (!before)
+            return null;
+        if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.mode & 0o077 || before.size > maximum
+            || process.getuid && before.uid !== process.getuid())
+            throw invalid();
+        const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const actual = await file.stat();
+            if (actual.dev !== before.dev || actual.ino !== before.ino || actual.size !== before.size)
+                throw invalid();
+            return { name, size: actual.size, device: actual.dev.toString(), inode: actual.ino.toString() };
+        }
+        finally {
+            await file.close();
+        }
+    }
+    /** Caller first confirms cleanup of the ORIGINAL container. Revoking this
+     * random evidence key is separate from provider/target credentials. Only
+     * validated original ciphertext files are unlinked; no recursive removal.
+     * A private metadata-only tombstone prevents replacement or resurrection.
+     */
+    async erase(signal) {
+        this.ownership.assertHeld();
+        if (!this.erasureOnly || this.closed)
+            throw invalid();
+        const active = AbortSignal.any([this.signal, ...(signal ? [signal] : [])]);
+        const check = () => { active.throwIfAborted(); this.ownership.assertHeld(); };
+        check();
+        let receipt = await this.erasure();
+        const alreadyRemoved = receipt?.state === 'removed';
+        if (!receipt) {
+            const identity = await this.get('identity');
+            try {
+                if (!identity || sha(identity) !== sha(this.aad))
+                    throw invalid();
+            }
+            finally {
+                identity?.fill(0);
+            }
+            // Preserve the original unknown-file refusal before key destruction, but
+            // stream names in fixed directory buffers instead of retaining a manifest.
+            // This first read-only discovery can traverse the journal; later passes
+            // resume the tombstone directly without repeating the whole preflight.
+            for await (const item of await opendir(this.directory, { bufferSize: 32 })) {
+                check();
+                if (!['owner.lock', 'erasure.json'].includes(item.name)
+                    && !encryptedName.test(item.name) && !markerTemporary.test(item.name))
+                    throw invalid();
+            }
+            // This constant-size original tombstone precedes key destruction and
+            // prevents collectors from recreating any file or decryption authority.
+            // Individual inode intents are recorded immediately before each unlink.
+            receipt = { schema: 'firedrill.local-world-erasure.v2', identity_sha256: sha(this.aad), state: 'erasing',
+                requested_at: new Date().toISOString(), finished_at: null, file_count: 0, pending_file: null };
+            await this.writeErasure(receipt); // Durable intent BEFORE irreversible key deletion.
+        }
+        let encoded;
+        try {
+            encoded = this.keyEntry.getPassword();
+        }
+        catch {
+            throw new CliError('local_world_erasure_pending', 'Unlock the OS credential store and repeat the same forget command. Key removal is not confirmed.');
+        }
+        if (encoded !== null) {
+            if (receipt.state === 'removed' || this.key.length !== 32 || encoded !== this.key.toString('base64url'))
+                throw invalid();
+            try {
+                this.keyEntry.deleteCredential();
+            }
+            catch { /* Read the original key state, never replace it. */ }
+            let absent = false;
+            try {
+                absent = this.keyEntry.getPassword() === null;
+            }
+            catch { /* Unknown is not removal proof. */ }
+            if (!absent)
+                throw new CliError('local_world_erasure_pending', 'Private evidence key removal is not confirmed. Unlock the OS credential store and repeat the same forget command.');
+        }
+        this.key.fill(0);
+        let removed = 0;
+        const complete = async (one) => {
+            check();
+            const limit = markerTemporary.test(one.name) ? 8192 : MAX + 64;
+            const actual = await this.fileIdentity(one.name, limit);
+            if (actual && (actual.size !== one.size || actual.device !== one.device || actual.inode !== one.inode))
+                throw invalid();
+            if (actual) {
+                check();
+                const current = await lstat(join(this.directory, one.name));
+                if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1 || current.size !== one.size
+                    || current.dev.toString() !== one.device || current.ino.toString() !== one.inode)
+                    throw invalid();
+                await unlink(join(this.directory, one.name));
+            }
+            const parent = await open(this.directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0));
+            try {
+                await parent.sync();
+            }
+            finally {
+                await parent.close();
+            }
+            if (!Number.isSafeInteger(receipt.file_count + 1))
+                throw invalid();
+            receipt = { ...receipt, file_count: receipt.file_count + 1, pending_file: null };
+            await this.writeErasure(receipt);
+            removed++;
+        };
+        // If unlink succeeded before a crash, reconcile this same inode's absence
+        // once. Never rediscover a substitute name or increment the count twice.
+        if (receipt.pending_file)
+            await complete(receipt.pending_file);
+        for await (const item of await opendir(this.directory, { bufferSize: 32 })) {
+            check();
+            if (['owner.lock', 'erasure.json'].includes(item.name))
+                continue;
+            if (alreadyRemoved || !encryptedName.test(item.name) && !markerTemporary.test(item.name))
+                throw invalid();
+            const one = await this.fileIdentity(item.name, markerTemporary.test(item.name) ? 8192 : MAX + 64);
+            if (!one)
+                continue; // An already-renamed private marker temporary.
+            receipt = { ...receipt, pending_file: one };
+            await this.writeErasure(receipt);
+            await complete(one);
+            if (removed >= ERASURE_PASS)
+                break;
+        }
+        let pending = false;
+        for await (const item of await opendir(this.directory, { bufferSize: 32 })) {
+            check();
+            if (['owner.lock', 'erasure.json'].includes(item.name))
+                continue;
+            if (!encryptedName.test(item.name) && !markerTemporary.test(item.name))
+                throw invalid();
+            pending = true;
+            break;
+        }
+        if (!pending) {
+            receipt = { ...receipt, state: 'removed', finished_at: receipt.finished_at ?? new Date().toISOString() };
+            await this.writeErasure(receipt);
+        }
+        this.erasureState = receipt.state;
+        return { schema: 'firedrill.local-world-erasure-receipt.v2', state: receipt.state, key_removed: true,
+            already_removed: alreadyRemoved, file_count: receipt.file_count, finished_at: receipt.finished_at, cloud_data_changed: false,
+            files_removed_this_pass: removed, continuation_required: pending, filesystem_backup_erasure_attested: false };
+    }
+    async close() {
+        if (this.closed)
+            return;
+        try {
+            await this.ownership.close();
+        }
+        finally {
+            this.closed = true;
+            this.key.fill(0);
+            this.aad.fill(0);
+        }
+        // Unless erase() already removed them, the OS key/ciphertexts remain for
+        // explicit recovery within policy. Closing alone proves no erasure.
+    }
+}

package/dist/cli/src/runner-world-native-filters.js

@@ -0,0 +1,134 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { api } from './auth.js';
+import { CliError } from './http.js';
+import { signRunnerRequest } from './runner-identity.js';
+import { nativeFilterReference } from './runner-world-session-protocol.js';
+import { localWorldClaimPath, localWorldClaimTime } from './runner-world-claim.js';
+import { localWorldIdentityMatches, LOCAL_WORLD_IDENTITY_KEYS } from '../../contracts/local-world-native-contracts.js';
+const PART = 32768, CHUNK = 16384;
+const sha = (body) => createHash('sha256').update(body).digest('hex');
+const invalid = () => new CliError('local_world_filter_transfer_changed', 'The private evidence protection did not match this exact world. No command was sent.');
+const pending = () => new CliError('local_world_filter_transfer_unconfirmed', 'Private evidence protection is not confirmed. The original local world was not replaced.');
+function inspect(value, owner, manifest, context, reference) {
+    const count = Math.ceil(reference.size / PART);
+    const keys = [...LOCAL_WORLD_IDENTITY_KEYS, 'context_sha256', 'lease_id', 'part_bytes', 'part_count', 'provenance', 'received_parts',
+        'reference', 'schema', 'server_time', 'session_id', 'state'];
+    if (!value || !localWorldIdentityMatches(value, owner, manifest) || Object.keys(value).sort().join(',') !== keys.sort().join(',')
+        || value.schema !== 'firedrill.local-world-native-filter-receipt.v1' || value.session_id !== owner.session.session_id
+        || value.lease_id !== owner.lease || value.context_sha256 !== context || value.provenance !== 'customer_device'
+        || !['not_retained', 'uploading', 'validating', 'ready', 'unavailable'].includes(value.state)
+        || value.part_bytes !== PART || !Array.isArray(value.received_parts) || !Number.isFinite(Date.parse(value.server_time)))
+        throw invalid();
+    if (value.reference === null) {
+        if (value.state !== 'not_retained' || value.part_count !== 0 || value.received_parts.length !== 0)
+            throw invalid();
+    }
+    else {
+        nativeFilterReference(value.reference);
+        if (value.reference.sha256 !== reference.sha256 || value.reference.size !== reference.size || value.reference.pattern_count !== reference.pattern_count
+            || value.part_count !== count || new Set(value.received_parts).size !== value.received_parts.length
+            || value.received_parts.some(index => !Number.isSafeInteger(index) || index < 0 || index >= count)
+            || ['validating', 'ready'].includes(value.state) && value.received_parts.length !== count)
+            throw invalid();
+    }
+    if (value.state === 'unavailable')
+        throw pending();
+    return value;
+}
+async function transfer(owner, configuration, channel, reference, signal) {
+    const control = configuration.control;
+    if (control.schema !== 'firedrill.world-session.v1' || !owner.evidenceUpload
+        || !/^[a-f0-9]{64}$/.test(control.evidence_context_sha256))
+        throw invalid();
+    const prefix = localWorldClaimPath(owner);
+    const auth = { actor: owner.owner, workspace: owner.workspace, signal };
+    const request = async (action) => {
+        signal.throwIfAborted();
+        const sent = await localWorldClaimTime(owner, signal);
+        const payload = { schema: 'firedrill.local-world-native-filters.v1', job_id: owner.job,
+            attempt_id: owner.attempt, lease_id: owner.lease, request_key: owner.request, device_key: owner.device,
+            native_session_id: owner.nativeSession, manifest_sha256: configuration.manifest_sha256, session_id: owner.session.session_id,
+            context_sha256: control.evidence_context_sha256, filter_sha256: reference.sha256, write_key: randomUUID(), sent_at_ms: sent,
+            ...action };
+        const proof = await signRunnerRequest(owner, owner.device, payload, signal);
+        // No blind transport retry. An explicit later synchronization uses the
+        // same original immutable parts/version intents, never another world/key.
+        return inspect(await api(prefix + '/world-native-filters', { ...auth, method: 'POST', body: proof }), owner, configuration.manifest_sha256, control.evidence_context_sha256, reference);
+    };
+    const file = await channel.openNativeFilters(control.evidence_context_sha256);
+    let bytes = null;
+    try {
+        if (file.size !== reference.size || file.sha256 !== reference.sha256)
+            throw invalid();
+        bytes = Buffer.alloc(reference.size);
+        try {
+            for (let offset = 0; offset < bytes.length; offset += CHUNK) {
+                const chunk = await file.read(offset, Math.min(CHUNK, bytes.length - offset));
+                try {
+                    chunk.copy(bytes, offset);
+                }
+                finally {
+                    chunk.fill(0);
+                }
+            }
+        }
+        finally {
+            await file.close();
+        }
+        if (sha(bytes) !== reference.sha256)
+            throw invalid();
+        const parts = [];
+        for (let offset = 0; offset < bytes.length; offset += PART) {
+            const body = bytes.subarray(offset, offset + PART);
+            parts.push({ size: body.length, sha256: sha(body) });
+        }
+        let receipt = await request({ action: 'begin', reference, parts });
+        for (let index = 0; index < parts.length; index++) {
+            if (receipt.received_parts.includes(index))
+                continue;
+            receipt = await request({ action: 'part', index, content_base64: bytes.subarray(index * PART, (index + 1) * PART).toString('base64') });
+            if (!receipt.received_parts.includes(index))
+                throw pending();
+        }
+        if (receipt.state !== 'ready')
+            receipt = await request({ action: 'commit' });
+        bytes.fill(0);
+        bytes = null;
+        while (receipt.state !== 'ready') {
+            if (receipt.state !== 'validating')
+                throw pending();
+            // Actual durable validation is pending. The separate keeper, not this
+            // loop, owns presence; a read does not extend any execution authority.
+            await sleep(1000, undefined, { signal });
+            receipt = await request({ action: 'status' });
+        }
+    }
+    finally {
+        bytes?.fill(0); // Best effort only. JS/HTTP strings are not zeroized memory.
+        await file.close().catch(() => undefined);
+    }
+}
+/** No manual command callback runs until original native matchers are retained.
+ * A world that closes before producing them may only reach closing collection.
+ */
+export async function protectLocalWorldSession(owner, configuration, channel, signal) {
+    while (!channel.isClosing) {
+        signal.throwIfAborted();
+        let reference;
+        try {
+            reference = (await channel.observe()).status?.native_filters;
+        }
+        catch (error) {
+            if (!(error instanceof CliError) || error.code !== 'local_session_observation_unavailable')
+                throw error;
+        }
+        if (reference !== undefined && reference !== null) {
+            nativeFilterReference(reference);
+            await transfer(owner, configuration, channel, reference, signal);
+            return !channel.isClosing;
+        }
+        await Promise.race([sleep(500, undefined, { signal }), channel.waitClosing()]);
+    }
+    return false;
+}