grepmax 0.26.58 → 0.26.60

package/dist/lib/utils/host-resource.js

@@ -0,0 +1,248 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOST_SAMPLE_TIMEOUT_MS = void 0;
+exports.parseResourceProcesses = parseResourceProcesses;
+exports.parseBatchFootprints = parseBatchFootprints;
+exports.sampleHostResources = sampleHostResources;
+const node_child_process_1 = require("node:child_process");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const kernel_zone_1 = require("./kernel-zone");
+const process_footprint_1 = require("./process-footprint");
+exports.HOST_SAMPLE_TIMEOUT_MS = 3000;
+const MAX_PROCESSES = 64;
+const PS_ARGS = ["-axo", "uid=,pid=,ppid=,pgid=,lstart=,comm="];
+const ROLES = {
+    "gmax-daemon": "daemon",
+    "gmax-mcp": "mcp",
+    "gmax-worker": "worker",
+    "gmax-embed": "embedding",
+    gmax: "client",
+};
+/** No argv/environment inspection. Include all same-user gmax clients, then
+ * their entire child trees (uv launchers are not substitutes for Python). */
+function parseResourceProcesses(output, uid, selfPid, extraPids = [], extraGroups = []) {
+    var _a;
+    const rows = output
+        .trim()
+        .split("\n")
+        .map((line) => {
+        const match = /^\s*(-?\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\w{3}\s+\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/.exec(line);
+        if (!match)
+            throw new Error("process inventory could not be parsed");
+        return {
+            uid: Number(match[1]),
+            pid: Number(match[2]),
+            parentPid: Number(match[3]),
+            groupPid: Number(match[4]),
+            start: match[5].replace(/\s+/g, " "),
+            command: path.basename(match[6].trim()),
+        };
+    })
+        // ps sees itself as our child. It exits before footprint runs and is not
+        // part of gmax's working set; including it makes every sample incomplete.
+        .filter((row) => row.uid === uid && !(row.parentPid === selfPid && row.command === "ps"));
+    const selected = new Map();
+    for (const row of rows) {
+        const role = (_a = ROLES[row.command]) !== null && _a !== void 0 ? _a : (row.pid === selfPid
+            ? "client"
+            : extraPids.includes(row.pid) || extraGroups.includes(row.groupPid)
+                ? "embedding"
+                : undefined);
+        if (role)
+            selected.set(row.pid, {
+                pid: row.pid,
+                parentPid: row.parentPid,
+                groupPid: row.groupPid,
+                start: row.start,
+                role,
+                footprintMb: null,
+            });
+    }
+    let added = true;
+    while (added) {
+        added = false;
+        for (const row of rows) {
+            if (selected.has(row.pid) || !selected.has(row.parentPid))
+                continue;
+            selected.set(row.pid, {
+                pid: row.pid,
+                parentPid: row.parentPid,
+                groupPid: row.groupPid,
+                start: row.start,
+                role: "helper",
+                footprintMb: null,
+            });
+            added = true;
+        }
+    }
+    if (!selected.has(selfPid))
+        throw new Error("required process missing from inventory");
+    if (selected.size > MAX_PROCESSES)
+        throw new Error("process inventory exceeds 64 processes");
+    return [...selected.values()].sort((a, b) => a.pid - b.pid);
+}
+function parseBatchFootprints(output) {
+    const result = new Map();
+    for (const line of output.split("\n")) {
+        const match = /\[(\d+)\]:.*\bFootprint:/.exec(line);
+        if (!match)
+            continue;
+        const value = (0, process_footprint_1.parseFootprintMb)(line);
+        const pid = Number(match[1]);
+        if (value === null || value < 0 || result.has(pid))
+            throw new Error("invalid process footprint");
+        result.set(pid, value);
+    }
+    return result;
+}
+function sampleHostResources(extraPids = [], overrides = {}, extraGroups = []) {
+    var _a;
+    var _b, _c;
+    const deps = Object.assign({ platform: process.platform, pid: process.pid, uid: (_b = (_a = process.getuid) === null || _a === void 0 ? void 0 : _a.call(process)) !== null && _b !== void 0 ? _b : -1, now: Date.now, monotonic: () => performance.now(), freeBytes: os.freemem, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
+            encoding: "utf8",
+            timeout: timeoutMs,
+            maxBuffer: 512 * 1024,
+            stdio: ["ignore", "pipe", "ignore"],
+        }) }, overrides);
+    const snapshot = {
+        at: deps.now(),
+        completedAt: deps.now(),
+        platform: deps.platform,
+        processes: [],
+        aggregateFootprintMb: null,
+        physicalFreeMb: null,
+        swapUsedMb: null,
+        memoryPressure: deps.platform === "darwin" ? "unknown" : "unsupported",
+        kernelPressure: deps.platform === "darwin" ? "unknown" : "unsupported",
+        kernelBytes: null,
+        incompleteReasons: [],
+    };
+    if (deps.platform !== "darwin")
+        return snapshot;
+    const deadline = deps.monotonic() + exports.HOST_SAMPLE_TIMEOUT_MS;
+    const run = (command, args, maximumMs = 500) => {
+        const remaining = Math.floor(deadline - deps.monotonic());
+        if (remaining <= 0)
+            throw new Error("resource sample deadline exceeded");
+        return deps.run(command, args, Math.min(maximumMs, remaining));
+    };
+    try {
+        const bytes = deps.freeBytes();
+        if (Number.isFinite(bytes) && bytes >= 0)
+            snapshot.physicalFreeMb = bytes / 1048576;
+    }
+    catch (_d) { }
+    try {
+        const zone = (0, kernel_zone_1.parseZprintOutput)(run("zprint", ["-L", "data.kalloc.1024"]));
+        if (zone) {
+            const bytes = zone.elements * zone.elementSize;
+            if (Number.isSafeInteger(bytes)) {
+                snapshot.kernelBytes = bytes;
+                snapshot.kernelPressure = (0, kernel_zone_1.classifyZonePressure)(bytes);
+            }
+        }
+    }
+    catch (_e) { }
+    try {
+        const swap = /\bused\s*=\s*([\d.]+)([MG])/i.exec(run("sysctl", ["-n", "vm.swapusage"]));
+        if (swap) {
+            const mb = Number(swap[1]) * (swap[2].toUpperCase() === "G" ? 1024 : 1);
+            if (Number.isFinite(mb) && mb >= 0)
+                snapshot.swapUsedMb = mb;
+        }
+    }
+    catch (_f) { }
+    try {
+        snapshot.processes = parseResourceProcesses(run("ps", PS_ARGS), deps.uid, deps.pid, extraPids, extraGroups);
+        const footprints = parseBatchFootprints(run("footprint", [
+            "--noCategories",
+            ...snapshot.processes.flatMap((p) => ["-p", String(p.pid)]),
+        ], 1500));
+        for (const p of snapshot.processes)
+            p.footprintMb = (_c = footprints.get(p.pid)) !== null && _c !== void 0 ? _c : null;
+        const after = parseResourceProcesses(run("ps", PS_ARGS), deps.uid, deps.pid, extraPids, extraGroups);
+        const identity = (p) => [
+            p.pid,
+            p.parentPid,
+            p.groupPid,
+            p.start,
+            p.role,
+        ];
+        if (JSON.stringify(after.map(identity)) !==
+            JSON.stringify(snapshot.processes.map(identity)))
+            throw new Error("process inventory changed during sample");
+        if (snapshot.processes.some((p) => p.footprintMb === null))
+            throw new Error("process footprint unavailable");
+        snapshot.aggregateFootprintMb = snapshot.processes.reduce((sum, p) => sum + p.footprintMb, 0);
+    }
+    catch (error) {
+        snapshot.incompleteReasons.push(error instanceof Error &&
+            /^(process|required|resource)/.test(error.message)
+            ? error.message
+            : "process inventory or footprint unavailable");
+        snapshot.aggregateFootprintMb = null;
+    }
+    // Fresh cheap pressure check after the batch; an earlier normal value cannot
+    // authorize a fork after pressure changes during native sampling.
+    try {
+        const raw = run("sysctl", [
+            "-n",
+            "kern.memorystatus_vm_pressure_level",
+        ]).trim();
+        snapshot.memoryPressure =
+            raw === "1"
+                ? "normal"
+                : raw === "2"
+                    ? "warn"
+                    : raw === "4"
+                        ? "critical"
+                        : "unknown";
+    }
+    catch (_g) { }
+    if (snapshot.memoryPressure === "unknown")
+        snapshot.incompleteReasons.push("OS memory pressure unavailable");
+    if (snapshot.kernelPressure === "unknown")
+        snapshot.incompleteReasons.push("kernel pressure unavailable");
+    if (snapshot.physicalFreeMb === null)
+        snapshot.incompleteReasons.push("physical free pages unavailable");
+    if (snapshot.swapUsedMb === null)
+        snapshot.incompleteReasons.push("swap usage unavailable");
+    snapshot.completedAt = deps.now();
+    if (deps.monotonic() > deadline)
+        snapshot.incompleteReasons.push("resource sample deadline exceeded");
+    return snapshot;
+}

package/dist/lib/utils/resource-budget.js

@@ -0,0 +1,409 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceBudget = exports.ResourceBudget = exports.ResourceAdmissionError = exports.HELPER_RESOURCE_RESERVE_MB = exports.EMBEDDING_RESOURCE_RESERVE_MB = exports.WORKER_RESOURCE_RESERVE_MB = exports.DEFAULT_RESOURCE_BUDGET_MB = void 0;
+exports.resolveResourceBudgetMb = resolveResourceBudgetMb;
+exports.assertResourceSnapshot = assertResourceSnapshot;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
+const config_1 = require("../../config");
+const autostart_1 = require("./autostart");
+const host_resource_1 = require("./host-resource");
+const safety_latch_1 = require("./safety-latch");
+/** Admission thresholds, not an OS-enforced memory cap. Keep enough room for
+ * a worker's measured 1536MiB recycle threshold, and charge pending launches
+ * before another session can admit work. Actual footprint can exceed a reserve;
+ * subsequent admission/heartbeat then pauses heavy work. */
+exports.DEFAULT_RESOURCE_BUDGET_MB = 6144;
+exports.WORKER_RESOURCE_RESERVE_MB = 1536;
+exports.EMBEDDING_RESOURCE_RESERVE_MB = 1024;
+exports.HELPER_RESOURCE_RESERVE_MB = 512;
+class ResourceAdmissionError extends Error {
+    constructor(message, critical = false) {
+        super(message);
+        this.critical = critical;
+        this.code = "HOST_RESOURCE";
+        this.name = "ResourceAdmissionError";
+    }
+}
+exports.ResourceAdmissionError = ResourceAdmissionError;
+function resolveResourceBudgetMb(raw = process.env.GMAX_RESOURCE_BUDGET_MB) {
+    if (raw === undefined)
+        return exports.DEFAULT_RESOURCE_BUDGET_MB;
+    const n = Number(raw);
+    // A malformed/disabled budget must not silently become unlimited.
+    if (!Number.isInteger(n) || n < 256 || n > exports.DEFAULT_RESOURCE_BUDGET_MB)
+        throw new ResourceAdmissionError("resource budget must be 256..6144 MiB");
+    return n;
+}
+function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now()) {
+    if (snapshot.memoryPressure === "critical" ||
+        snapshot.kernelPressure === "critical")
+        throw new ResourceAdmissionError("critical host pressure; heavy work refused", true);
+    if (snapshot.memoryPressure === "warn" || snapshot.kernelPressure === "warn")
+        throw new ResourceAdmissionError("warning host pressure; heavy work paused");
+    if (snapshot.platform !== "darwin")
+        return;
+    if (now < snapshot.at ||
+        now - snapshot.at > 5000 ||
+        snapshot.completedAt < snapshot.at ||
+        snapshot.completedAt > now)
+        throw new ResourceAdmissionError("resource sample stale or clock changed; heavy work paused");
+    if (snapshot.incompleteReasons.length ||
+        snapshot.aggregateFootprintMb === null ||
+        snapshot.memoryPressure !== "normal" ||
+        snapshot.kernelPressure !== "ok")
+        throw new ResourceAdmissionError(`unknown aggregate resources; heavy work paused: ${snapshot.incompleteReasons.join(", ") || "incomplete sample"}`);
+    if (!Number.isFinite(chargedMb) ||
+        chargedMb < 0 ||
+        !Number.isFinite(budgetMb) ||
+        budgetMb <= 0 ||
+        chargedMb > budgetMb)
+        throw new ResourceAdmissionError(`aggregate resource budget exceeded (${Math.ceil(chargedMb)}/${budgetMb} MiB); heavy work paused`);
+}
+/** One ledger under the shared home, independent of which store a client uses.
+ * Reservations survive parent failure and installation; only a verified dead
+ * or reused PID may be reaped. Unknown/corrupt owners refuse expansion. */
+class ResourceBudget {
+    constructor(overrides = {}) {
+        this.deps = Object.assign({ root: path.join(config_1.PATHS.sharedRoot, "resource-budget"), platform: process.platform, pid: process.pid, now: Date.now, sample: (extraPids = []) => {
+                const records = this.readRecords();
+                return (0, host_resource_1.sampleHostResources)([...records.map((r) => r.pid), ...extraPids], {}, records.flatMap((r) => (r.groupPid ? [r.groupPid] : [])));
+            }, signal: (pid) => process.kill(pid, 0), quarantine: autostart_1.daemonStartDeniedReason, latch: safety_latch_1.latchSafetyStop, processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
+                encoding: "utf8",
+                timeout: 500,
+                maxBuffer: 1024,
+                stdio: ["ignore", "pipe", "ignore"],
+            })
+                .trim()
+                .replace(/\s+/g, " ") }, overrides);
+    }
+    withLock(fn) {
+        const { root } = this.deps;
+        fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+        const stat = fs.lstatSync(root);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new ResourceAdmissionError("unverified resource budget directory");
+        fs.chmodSync(root, 0o700);
+        const file = path.join(root, "admission");
+        const fd = fs.openSync(file, fs.constants.O_CREAT | fs.constants.O_NOFOLLOW | fs.constants.O_WRONLY, 0o600);
+        fs.closeSync(fd);
+        let release;
+        try {
+            // Synchronous sections contain only a <=3s sample and bounded metadata.
+            // Competing sessions refuse immediately instead of blocking their tools.
+            release = proper_lockfile_1.default.lockSync(file, {
+                retries: 0,
+                stale: 30000,
+                realpath: false,
+            });
+        }
+        catch (_a) {
+            throw new ResourceAdmissionError("resource admission busy or unavailable; retry later");
+        }
+        try {
+            return fn();
+        }
+        finally {
+            release();
+        }
+    }
+    readRecords() {
+        const entries = fs.readdirSync(this.deps.root);
+        if (entries.some((name) => name.endsWith(".tmp")))
+            throw new ResourceAdmissionError("interrupted resource reservation; heavy work paused");
+        const files = entries.filter((name) => name.endsWith(".json"));
+        if (files.length > 128)
+            throw new ResourceAdmissionError("resource reservation limit exceeded");
+        const records = [];
+        for (const name of files) {
+            const file = path.join(this.deps.root, name);
+            let record;
+            try {
+                const stat = fs.lstatSync(file);
+                if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096)
+                    throw Error();
+                record = JSON.parse(fs.readFileSync(file, "utf8"));
+                if (record.version !== 1 ||
+                    !Number.isSafeInteger(record.pid) ||
+                    record.pid < 1 ||
+                    typeof record.start !== "string" ||
+                    !record.start ||
+                    typeof record.nonce !== "string" ||
+                    name !== `${record.nonce}.json` ||
+                    !Number.isFinite(record.mb) ||
+                    record.mb <= 0 ||
+                    record.mb > exports.DEFAULT_RESOURCE_BUDGET_MB ||
+                    (record.unverified !== undefined &&
+                        typeof record.unverified !== "boolean") ||
+                    typeof record.kind !== "string")
+                    throw Error();
+            }
+            catch (_a) {
+                throw new ResourceAdmissionError("unverified resource reservation; heavy work paused");
+            }
+            if (record.groupPid !== undefined && record.groupPid !== record.pid)
+                throw new ResourceAdmissionError("unverified resource process group");
+            records.push(record);
+        }
+        return records;
+    }
+    records(snapshot) {
+        const records = [];
+        for (const record of this.readRecords()) {
+            const file = path.join(this.deps.root, `${record.nonce}.json`);
+            const live = snapshot.processes.find((p) => p.pid === record.pid);
+            if (record.unverified) {
+                try {
+                    this.deps.signal(record.groupPid ? -record.groupPid : record.pid);
+                }
+                catch (error) {
+                    if (error.code === "ESRCH") {
+                        fs.unlinkSync(file);
+                        continue;
+                    }
+                }
+                throw new ResourceAdmissionError("unverified launched process; heavy work paused");
+            }
+            if (live && live.start !== record.start) {
+                fs.unlinkSync(file);
+                continue;
+            }
+            if (!live) {
+                try {
+                    this.deps.signal(record.groupPid ? -record.groupPid : record.pid);
+                }
+                catch (error) {
+                    if (error.code === "ESRCH") {
+                        fs.unlinkSync(file);
+                        continue;
+                    }
+                }
+                throw new ResourceAdmissionError("resource reservation owner missing or unknown; heavy work paused");
+            }
+            records.push(record);
+        }
+        return records;
+    }
+    charge(snapshot, records) {
+        return snapshot.processes.reduce((sum, p) => { var _a; return sum +
+            Math.max((_a = p.footprintMb) !== null && _a !== void 0 ? _a : Number.NaN, records.filter((r) => r.pid === p.pid).reduce((n, r) => n + r.mb, 0)); }, 0);
+    }
+    persist(record) {
+        const file = path.join(this.deps.root, `${record.nonce}.json`);
+        const temporary = `${file}.tmp`;
+        const fd = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify(record));
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(temporary, file);
+        const dir = fs.openSync(this.deps.root, "r");
+        try {
+            fs.fsyncSync(dir);
+        }
+        finally {
+            fs.closeSync(dir);
+        }
+    }
+    checked(snapshot, records) {
+        try {
+            assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now());
+            const legacy = snapshot.processes.filter((p) => p.role === "mcp" &&
+                !records.some((r) => r.pid === p.pid && r.kind === "client"));
+            if (legacy.length)
+                throw new ResourceAdmissionError(`${legacy.length} MCP client(s) need to reconnect after upgrading; heavy work paused`);
+        }
+        catch (error) {
+            if (error instanceof ResourceAdmissionError && error.critical) {
+                try {
+                    this.deps.latch(error.message);
+                }
+                catch (_a) {
+                    error.message += "; safety stop persistence failed";
+                }
+            }
+            throw error;
+        }
+        const denied = this.deps.quarantine();
+        if (denied)
+            throw new ResourceAdmissionError(`heavy work refused: ${denied}`);
+    }
+    /** Registration is metadata-only and must preserve STDIO availability under
+     * warning/unknown pressure. It proves this client participates in reservation
+     * admission; old clients cannot silently bypass the cross-session budget. */
+    registerClient() {
+        if (this.deps.platform !== "darwin")
+            return { attach: () => { }, release: () => { } };
+        const start = this.deps.processStart();
+        if (!start)
+            throw new ResourceAdmissionError("MCP process identity unavailable");
+        const record = {
+            version: 1,
+            pid: this.deps.pid,
+            start,
+            nonce: (0, node_crypto_1.randomUUID)(),
+            mb: 128,
+            kind: "client",
+        };
+        this.withLock(() => {
+            if (this.readRecords().length >= 128)
+                throw new ResourceAdmissionError("resource reservation limit exceeded");
+            this.persist(record);
+        });
+        return {
+            attach: () => {
+                throw new ResourceAdmissionError("client registration cannot transfer");
+            },
+            release: () => {
+                try {
+                    fs.unlinkSync(path.join(this.deps.root, `${record.nonce}.json`));
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+            },
+        };
+    }
+    check(requiredPid) {
+        if (this.deps.platform !== "darwin")
+            return null;
+        if (requiredPid !== undefined &&
+            (!Number.isSafeInteger(requiredPid) ||
+                requiredPid === null ||
+                requiredPid < 1))
+            throw new ResourceAdmissionError("adopted model process identity unavailable; heavy work paused");
+        return this.withLock(() => {
+            const snapshot = this.deps.sample(requiredPid ? [requiredPid] : []);
+            if (requiredPid && !snapshot.processes.some((p) => p.pid === requiredPid))
+                throw new ResourceAdmissionError("adopted model process missing; heavy work paused");
+            this.checked(snapshot, this.records(snapshot));
+            return snapshot;
+        });
+    }
+    reserve(mb, kind) {
+        if (!Number.isFinite(mb) || mb <= 0 || mb > exports.DEFAULT_RESOURCE_BUDGET_MB)
+            throw new ResourceAdmissionError("invalid resource reservation");
+        if (this.deps.platform !== "darwin")
+            return { attach: () => { }, release: () => { } };
+        let record = this.withLock(() => {
+            var _a;
+            const denied = this.deps.quarantine();
+            if (denied)
+                throw new ResourceAdmissionError(`heavy work refused: ${denied}`);
+            const snapshot = this.deps.sample();
+            const owner = snapshot.processes.find((p) => p.pid === this.deps.pid);
+            if (!owner)
+                throw new ResourceAdmissionError("resource owner identity unavailable");
+            const records = this.records(snapshot);
+            const reserved = records
+                .filter((r) => r.pid === owner.pid)
+                .reduce((sum, r) => sum + r.mb, 0);
+            // Preserve the current working set as well as each new allocation. A
+            // large parent must not make a pending child appear free.
+            const charge = mb + Math.max(0, ((_a = owner.footprintMb) !== null && _a !== void 0 ? _a : Number.NaN) - reserved);
+            const next = {
+                version: 1,
+                pid: owner.pid,
+                start: owner.start,
+                nonce: (0, node_crypto_1.randomUUID)(),
+                mb: charge,
+                kind,
+            };
+            this.checked(snapshot, [...records, next]);
+            this.persist(next);
+            return next;
+        });
+        let released = false;
+        return {
+            attach: (pid, processGroup = false) => {
+                if (released)
+                    throw new ResourceAdmissionError("resource reservation released");
+                if (!Number.isSafeInteger(pid) || pid < 1)
+                    throw new ResourceAdmissionError("resource child PID unavailable");
+                // Publish uncertainty before probing/locking. This is our own nonce;
+                // moving its existing pending charge cannot grant any new capacity.
+                // A failed lock or killed parent must still account for the child.
+                record = Object.assign(Object.assign(Object.assign({}, record), { pid, start: "unverified", mb, unverified: true }), (processGroup ? { groupPid: pid } : {}));
+                this.persist(record);
+                this.withLock(() => {
+                    const snapshot = this.deps.sample();
+                    const child = snapshot.processes.find((p) => p.pid === pid);
+                    if (!child ||
+                        child.parentPid !== this.deps.pid ||
+                        (processGroup && child.groupPid !== child.pid)) {
+                        // The child was forked, even if the identity probe failed. Retain
+                        // a durable uncertain charge across parent failure until it is
+                        // confirmed dead; do not revert to a parent-only reservation.
+                        record = Object.assign(Object.assign(Object.assign({}, record), { pid, start: "unverified", mb, unverified: true }), (processGroup ? { groupPid: pid } : {}));
+                        this.persist(record);
+                        throw new ResourceAdmissionError("resource child identity unavailable");
+                    }
+                    // Transfer does not admit more work. Preserve the charge even if
+                    // pressure changed; the caller owns termination of its new child.
+                    record = Object.assign(Object.assign(Object.assign({}, record), { pid: child.pid, start: child.start, mb, unverified: false }), (processGroup ? { groupPid: child.pid } : {}));
+                    this.persist(record);
+                });
+            },
+            release: () => {
+                if (released)
+                    return;
+                // Only the holder removes its nonce, after actual native/process close.
+                // Concurrent admission can overcharge or refuse a disappearing file,
+                // but removal never grants capacity before resources have been freed.
+                try {
+                    fs.unlinkSync(path.join(this.deps.root, `${record.nonce}.json`));
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+                released = true;
+            },
+        };
+    }
+}
+exports.ResourceBudget = ResourceBudget;
+exports.resourceBudget = new ResourceBudget();

package/dist/lib/utils/resource-snapshot.js

@@ -3,18 +3,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildResourceSnapshot = buildResourceSnapshot;
 function buildResourceSnapshot(counters, memory = process.memoryUsage(), at = Date.now()) {
     const mb = (bytes) => Math.round(bytes / 1024 / 1024);
-    return {
-        at,
-        reason: counters.reason,
-        footprintMb: counters.footprintMb,
-        rssMb: mb(memory.rss),
-        heapUsedMb: mb(memory.heapUsed),
-        externalMb: mb(memory.external),
-        arrayBuffersMb: mb(memory.arrayBuffers),
-        lanceCacheMb: counters.lanceCacheBytes === null ? null : mb(counters.lanceCacheBytes),
-        workers: counters.workers,
-        pendingFiles: counters.pendingFiles,
-        operations: counters.operations,
-        maintenance: counters.maintenance,
-    };
+    return Object.assign({ at, reason: counters.reason, footprintMb: counters.footprintMb, rssMb: mb(memory.rss), heapUsedMb: mb(memory.heapUsed), externalMb: mb(memory.external), arrayBuffersMb: mb(memory.arrayBuffers), lanceCacheMb: counters.lanceCacheBytes === null ? null : mb(counters.lanceCacheBytes), workers: counters.workers, pendingFiles: counters.pendingFiles, operations: counters.operations, maintenance: counters.maintenance }, (counters.host ? { host: counters.host } : {}));
 }