harnery 0.42.0 → 0.44.0

package/dist/core/semantic/contract.d.ts

@@ -152,7 +152,7 @@ export declare const SemanticUsageReceiptV1Schema: import("@sinclair/typebox").T
     scope: import("@sinclair/typebox").TLiteral<"unreported">;
 }>]>;
 export declare const SemanticEvidenceObservationV1Schema: import("@sinclair/typebox").TObject<{
-    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"error" | "recovery" | "artifact" | "operation" | "action" | "terminal" | "progress" | "task" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
+    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"recovery" | "artifact" | "error" | "operation" | "action" | "terminal" | "task" | "progress" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
     event_id: import("@sinclair/typebox").TString;
     observed_at: import("@sinclair/typebox").TString;
     label: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -193,7 +193,7 @@ export declare const SemanticEvidenceV1Schema: import("@sinclair/typebox").TObje
         started_at: import("@sinclair/typebox").TString;
     }>>;
     recent: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
-        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"error" | "recovery" | "artifact" | "operation" | "action" | "terminal" | "progress" | "task" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
+        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"recovery" | "artifact" | "error" | "operation" | "action" | "terminal" | "task" | "progress" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
         event_id: import("@sinclair/typebox").TString;
         observed_at: import("@sinclair/typebox").TString;
         label: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -201,7 +201,7 @@ export declare const SemanticEvidenceV1Schema: import("@sinclair/typebox").TObje
         error_class: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
     attention: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"error" | "recovery" | "artifact" | "operation" | "action" | "terminal" | "progress" | "task" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
+        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"recovery" | "artifact" | "error" | "operation" | "action" | "terminal" | "task" | "progress" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
         event_id: import("@sinclair/typebox").TString;
         observed_at: import("@sinclair/typebox").TString;
         label: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -628,7 +628,7 @@ export declare const SemanticInvalidReadModelV2Schema: import("@sinclair/typebox
     }>;
     receipt: import("@sinclair/typebox").TObject<{
         reason_code: import("@sinclair/typebox").TLiteral<"invalid_output">;
-        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "schema" | "privacy" | "confidence" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
+        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "confidence" | "schema" | "privacy" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
         usage: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
             schema_version: import("@sinclair/typebox").TLiteral<1>;
             source: import("@sinclair/typebox").TLiteral<"native">;
@@ -954,7 +954,7 @@ export declare const SemanticAgentReadModelV2Schema: import("@sinclair/typebox")
     }>;
     receipt: import("@sinclair/typebox").TObject<{
         reason_code: import("@sinclair/typebox").TLiteral<"invalid_output">;
-        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "schema" | "privacy" | "confidence" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
+        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "confidence" | "schema" | "privacy" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
         usage: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
             schema_version: import("@sinclair/typebox").TLiteral<1>;
             source: import("@sinclair/typebox").TLiteral<"native">;

package/dist/core/servers/index.d.ts

@@ -14,11 +14,12 @@
  *     for `gc` once its starting agent has ended or been unobserved for a long
  *     time AND nobody has used the server for the idle window.
  *
- * Fail-closed rules: a record whose pid was recycled is treated as dead, never
- * signalled; an unreadable coordination view makes every owner `unknown`,
+ * Fail-closed rules: a record whose pid was recycled is never signalled;
+ * an unreadable start token or coordination view is `unknown`,
  * which `gc` never stops; a record without an owner is never stopped
  * automatically.
  */
+import { type ProcessGenerationSignalDependencies, type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
 import { type ScanSupport } from "./net.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
 export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
@@ -40,13 +41,13 @@ export interface ServerRecord {
     start_token?: string;
     /** Further processes that belong to this server (helpers, children). */
     pids?: number[];
+    /** Generation witnesses captured when the further processes registered. */
+    pids_start_tokens?: Record<string, string>;
     host: string;
     /** What the server serves, usually a directory. */
     scope?: string;
     cwd?: string;
     log?: string;
-    /** Graceful stop command; signals are the fallback. */
-    stop_argv?: string[];
     owner?: {
         instance_id: string;
         name?: string;
@@ -63,11 +64,12 @@ export interface RegisterServerInput {
     url?: string;
     port?: number;
     pid?: number;
+    /** Preserve an observed witness when adopting, rather than probing a new generation. */
+    start_token?: string;
     pids?: number[];
     scope?: string;
     cwd?: string;
     log?: string;
-    stop_argv?: string[];
     started_at?: string;
     /** `null` records no owner; omitted resolves the calling agent session. */
     owner?: {
@@ -78,7 +80,7 @@ export interface RegisterServerInput {
 export interface ServerOptions {
     coordRoot?: string | null;
 }
-export type ServerState = "running" | "dead" | "other-host";
+export type ServerState = "running" | "dead" | "other-host" | "unknown";
 export type OwnerState = "live" | "abandoned" | "ended" | "unknown" | "none";
 export interface ServerView {
     record: ServerRecord;
@@ -90,6 +92,8 @@ export interface ServerView {
 }
 export interface UnregisteredListener {
     pid: number;
+    /** Captured during the scan, before a stop can be authorized. */
+    start_token?: string;
     port: number;
     address: string;
     command: string;
@@ -134,7 +138,7 @@ export declare function touchServer(id: string, options?: ServerOptions & {
 export declare function createServerToucher(id: string, options?: ServerOptions): () => void;
 export declare function readServerRecords(options?: ServerOptions): ServerRecord[];
 export declare function pidAlive(pid: number): boolean;
-export declare function serverState(record: ServerRecord): ServerState;
+export declare function serverState(record: ServerRecord, readToken?: (pid: number) => string | null, probePid?: (pid: number) => boolean): ServerState;
 export interface ListServersOptions extends ServerOptions {
     /** Look for listening processes inside the project that never registered. */
     scan?: boolean;
@@ -147,8 +151,6 @@ export interface ListServersOptions extends ServerOptions {
 }
 /** Read every record, observe it, and optionally find unregistered listeners. */
 export declare function listServers(options?: ListServersOptions): ServersReport;
-/** Register running tunnels that have no current record. Returns adopted ids. */
-export declare function adoptRunningTunnels(coordRoot: string): string[];
 /**
  * Listening processes that run inside the project (working directory or
  * command line within the coordination root) but are not covered by any
@@ -175,16 +177,21 @@ export declare function planServerGc(views: ServerView[], policy?: GcPolicy): Gc
 export interface StopResult {
     id: string;
     stopped: boolean;
-    method: "not-running" | "stop-command" | "signal" | "refused";
+    method: "not-running" | "signal" | "refused";
+    generation?: ProcessGenerationVerdict;
     detail?: string;
 }
+export interface ServerProcessDependencies extends ProcessGenerationSignalDependencies {
+    probePid?: (pid: number) => boolean;
+}
 /**
- * Stop one server: its graceful stop command first when recorded, then
- * SIGTERM to its process group, then SIGKILL after the grace period. A pid
- * whose start token no longer matches is never signalled.
+ * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
+ * Each signal, including the process group and auxiliary processes, requires
+ * a fresh generation check. Unknown or different generations retain the record.
  */
 export declare function stopServer(record: ServerRecord, options?: ServerOptions & {
     graceMs?: number;
+    signalDependencies?: ServerProcessDependencies;
 }): Promise<StopResult>;
 /**
  * The first free port in the configured range for `type`
@@ -200,6 +207,10 @@ export interface AdoptOptions extends ServerOptions {
     scope?: string;
     /** `self` (default) records the adopting agent as owner; `none` records no owner. */
     owner?: "self" | "none";
+    dependencies?: {
+        listServers?: typeof listServers;
+        readToken?: (pid: number) => string | null;
+    };
 }
 /**
  * Register a running server that never registered itself. Only a pid the scan

package/dist/core/servers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/servers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAGnD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,4BAA4B,CAAC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AASD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAuCrB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAMrB;AAaD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAWhG;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,IAAI,CAInF;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAUtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAYnF;AAmBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,EAAE,CAazE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO7C;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW,CAI7D;AAsBD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAuDvE;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAe/D;AASD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GACnD,oBAAoB,EAAE,CAiCxB;AAgBD,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,EAAE,CAiBjF;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC,UAAU,CAAC,CAkCrB;AA2BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAUvF;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CA8B7E;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/servers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AASvC,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAGnD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,4BAA4B,CAAC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AASD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CA4CrB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAMrB;AAaD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAWhG;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,IAAI,CAInF;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAUtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAYnF;AAmBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,EAAE,CAazE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAsBD,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAClC,WAAW,CAOb;AAsBD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAsDvE;AASD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GACnD,oBAAoB,EAAE,CAmCxB;AAgBD,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,EAAE,CAiBjF;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,mCAAmC;IACpF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAChD,GACA,OAAO,CAAC,UAAU,CAAC,CAgErB;AA8CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAWvF;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAsC7E;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/core/servers/index.js

@@ -14,27 +14,24 @@
  *     for `gc` once its starting agent has ended or been unobserved for a long
  *     time AND nobody has used the server for the idle window.
  *
- * Fail-closed rules: a record whose pid was recycled is treated as dead, never
- * signalled; an unreadable coordination view makes every owner `unknown`,
+ * Fail-closed rules: a record whose pid was recycled is never signalled;
+ * an unreadable start token or coordination view is `unknown`,
  * which `gc` never stops; a record without an owner is never stopped
  * automatically.
  */
-import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
-import { listStates } from "../../lib/tunnel/state.js";
 import { resolveCoordRoot } from "../agents/coord-client.js";
 import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.js";
-import { checkPidToken, processStartToken } from "../agents/state/proc-start.js";
+import { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "../agents/state/proc-start.js";
 import { serverPortRange } from "../config.js";
 import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from "../events/v3/coordination-view.js";
 import { liveInstanceIdV3 } from "../events/v3/live-route-observer.js";
 import { resolveOwner } from "../hooks/resolve/owner.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
 import { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, processStartedAt, readProcessInfo, scanSupport, } from "./net.js";
-import { tunnelServerId, tunnelServerInput } from "./tunnels.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
 export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
 export const SERVER_RECORD_SCHEMA_VERSION = 1;
@@ -87,7 +84,14 @@ export function registerServer(input, options) {
         throw new Error(`invalid server port: ${input.port}`);
     const id = input.id ?? serverId(input.type, input.scope);
     const now = new Date().toISOString();
-    const startToken = processStartToken(pid);
+    const startToken = input.start_token ?? processStartToken(pid);
+    const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
+    const pidsStartTokens = {};
+    for (const auxiliaryPid of pids) {
+        const token = processStartToken(auxiliaryPid);
+        if (token)
+            pidsStartTokens[auxiliaryPid] = token;
+    }
     const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
     const record = {
         schema_version: SERVER_RECORD_SCHEMA_VERSION,
@@ -99,19 +103,18 @@ export function registerServer(input, options) {
         ...(input.port ? { port: input.port } : {}),
         pid,
         ...(startToken ? { start_token: startToken } : {}),
-        ...(input.pids?.length
-            ? { pids: input.pids.filter((p) => Number.isSafeInteger(p) && p > 0) }
-            : {}),
+        ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
         host: hostname(),
         ...(input.scope ? { scope: resolve(input.scope) } : {}),
         ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
         ...(input.log ? { log: resolve(input.log) } : {}),
-        ...(input.stop_argv?.length ? { stop_argv: input.stop_argv } : {}),
         ...(owner ? { owner } : {}),
         started_at: input.started_at ?? now,
         registered_at: now,
         last_active_at: now,
     };
+    if (input.start_token !== undefined && verifyProcessGeneration(pid, input.start_token) !== "same")
+        throw new Error(`pid ${pid} generation could not be verified before registration`);
     writePrivateJsonAtomic(recordPath(coordRoot, id), record);
     return record;
 }
@@ -224,20 +227,33 @@ export function readServerRecords(options) {
         .sort((a, b) => a.kind.localeCompare(b.kind) || a.type.localeCompare(b.type) || a.id.localeCompare(b.id));
 }
 export function pidAlive(pid) {
+    return processPresence(pid) !== "absent";
+}
+function processPresence(pid, probePid) {
     try {
+        if (probePid)
+            return probePid(pid) ? "present" : "absent";
         process.kill(pid, 0);
-        return true;
+        return "present";
     }
     catch (error) {
-        return error.code === "EPERM";
+        const code = error.code;
+        return code === "ESRCH" ? "absent" : code === "EPERM" ? "present" : "unknown";
     }
 }
-export function serverState(record) {
+function allProcessesAbsent(record, probePid) {
+    return [record.pid, ...(record.pids ?? [])].every((pid) => processPresence(pid, probePid) === "absent");
+}
+export function serverState(record, readToken, probePid) {
     if (record.host !== hostname())
         return "other-host";
-    if (!pidAlive(record.pid))
-        return "dead";
-    return checkPidToken(record.pid, record.start_token) === "mismatch" ? "dead" : "running";
+    const presence = processPresence(record.pid, probePid);
+    if (presence === "absent")
+        return allProcessesAbsent(record, probePid) ? "dead" : "unknown";
+    if (presence === "unknown")
+        return "unknown";
+    const verdict = verifyProcessGeneration(record.pid, record.start_token, readToken);
+    return verdict === "same" ? "running" : verdict === "different" ? "dead" : "unknown";
 }
 function ownerReader(coordRoot, ownerStaleMs, nowMs) {
     let view = null;
@@ -268,7 +284,6 @@ export function listServers(options) {
     const now = options?.now ?? new Date();
     const nowMs = now.getTime();
     const ownerStaleMs = hours(options?.ownerStaleHours ?? SERVER_DEFAULT_OWNER_STALE_HOURS);
-    adoptRunningTunnels(coordRoot);
     const records = readServerRecords({ coordRoot });
     const ownerOf = ownerReader(coordRoot, ownerStaleMs, nowMs);
     const states = records.map((record) => serverState(record));
@@ -278,7 +293,7 @@ export function listServers(options) {
     const servers = [];
     records.forEach((record, i) => {
         const state = states[i];
-        if (state === "dead" && options?.prune !== false) {
+        if (state === "dead" && allProcessesAbsent(record) && options?.prune !== false) {
             unregisterServer(record.id, { coordRoot, pid: record.pid });
             pruned.push(record.id);
             return;
@@ -316,27 +331,6 @@ export function listServers(options) {
         pruned,
     };
 }
-/** Register running tunnels that have no current record. Returns adopted ids. */
-export function adoptRunningTunnels(coordRoot) {
-    const adopted = [];
-    let states;
-    try {
-        states = listStates(coordRoot);
-    }
-    catch {
-        return adopted;
-    }
-    for (const state of states) {
-        if (!state.gate_pid || !pidAlive(state.gate_pid))
-            continue;
-        const id = tunnelServerId(state.name);
-        if (readServer(id, { coordRoot })?.pid === state.gate_pid)
-            continue;
-        if (tryRegisterServer(tunnelServerInput(state, coordRoot), { coordRoot }))
-            adopted.push(id);
-    }
-    return adopted;
-}
 /** Processes that browser automation and editors start; never project servers. */
 const IGNORED_LISTENER_COMMANDS = [
     /(^|\/)(chrome|chromium|chrome-headless-shell|headless_shell|msedge|firefox)( |$)/i,
@@ -350,10 +344,10 @@ const IGNORED_LISTENER_COMMANDS = [
  * a recorded port.
  */
 export function findUnregisteredListeners(coordRoot, servers) {
-    const running = servers.filter((server) => server.state === "running");
+    const registered = servers.filter((server) => server.record.host === hostname());
     const covered = new Set();
     const ports = new Set();
-    for (const { record } of running) {
+    for (const { record } of registered) {
         covered.add(record.pid);
         for (const pid of record.pids ?? [])
             covered.add(pid);
@@ -363,8 +357,9 @@ export function findUnregisteredListeners(coordRoot, servers) {
     const results = [];
     const seenPids = new Map();
     for (const socket of listListeningSockets()) {
-        if (ports.has(socket.port) || socket.pid === process.pid)
+        if (ports.has(socket.port) || covered.has(socket.pid) || socket.pid === process.pid)
             continue;
+        const startToken = processStartToken(socket.pid);
         let inside = seenPids.get(socket.pid);
         const info = readProcessInfo(socket.pid);
         if (!info)
@@ -380,6 +375,7 @@ export function findUnregisteredListeners(coordRoot, servers) {
             continue;
         results.push({
             pid: socket.pid,
+            ...(startToken ? { start_token: startToken } : {}),
             port: socket.port,
             address: socket.address,
             command: info.command.slice(0, 300),
@@ -430,72 +426,111 @@ export function planServerGc(views, policy) {
     });
 }
 /**
- * Stop one server: its graceful stop command first when recorded, then
- * SIGTERM to its process group, then SIGKILL after the grace period. A pid
- * whose start token no longer matches is never signalled.
+ * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
+ * Each signal, including the process group and auxiliary processes, requires
+ * a fresh generation check. Unknown or different generations retain the record.
  */
 export async function stopServer(record, options) {
     const coordRoot = rootOf(options);
     const graceMs = options?.graceMs ?? 5_000;
+    const dependencies = options?.signalDependencies ?? {};
+    const targets = [
+        { pid: record.pid, token: record.start_token },
+        ...[...new Set(record.pids ?? [])]
+            .filter((pid) => pid !== record.pid)
+            .map((pid) => ({ pid, token: record.pids_start_tokens?.[pid] })),
+    ];
+    const refuse = (pid, generation) => ({
+        id: record.id,
+        stopped: false,
+        method: "refused",
+        generation,
+        detail: `pid ${pid} generation is ${generation}; left the server record in place`,
+    });
     const finish = (result) => {
         if (result.stopped || result.method === "not-running")
             unregisterServer(record.id, { coordRoot, pid: record.pid });
         return result;
     };
-    const state = serverState(record);
-    if (state === "other-host")
+    if (record.host !== hostname())
         return { id: record.id, stopped: false, method: "refused", detail: `runs on ${record.host}` };
-    if (state === "dead")
-        return finish({ id: record.id, stopped: false, method: "not-running" });
-    if (record.stop_argv?.length) {
-        const [command, ...args] = record.stop_argv;
-        spawnSync(command, args, { stdio: "ignore", timeout: 30_000, cwd: record.cwd });
-        if (await exited(record, graceMs))
-            return finish({ id: record.id, stopped: true, method: "stop-command" });
+    const leaderPresence = processPresence(record.pid, dependencies.probePid);
+    if (leaderPresence === "unknown" ||
+        (leaderPresence === "absent" && !allProcessesAbsent(record, dependencies.probePid)))
+        return refuse(record.pid, "unknown");
+    // Check every recorded live process before sending the first signal.
+    for (const target of targets) {
+        const presence = processPresence(target.pid, dependencies.probePid);
+        if (presence === "absent")
+            continue;
+        if (presence === "unknown")
+            return refuse(target.pid, "unknown");
+        const verdict = verifyProcessGeneration(target.pid, target.token, dependencies.readToken);
+        if (verdict !== "same")
+            return refuse(target.pid, verdict);
     }
-    signal(record.pid, "SIGTERM");
-    for (const pid of record.pids ?? [])
-        signal(pid, "SIGTERM");
-    if (await exited(record, graceMs))
-        return finish({ id: record.id, stopped: true, method: "signal" });
-    if (serverState(record) === "running") {
-        signal(record.pid, "SIGKILL");
-        for (const pid of record.pids ?? [])
-            signal(pid, "SIGKILL");
+    if (targets.every((target) => processPresence(target.pid, dependencies.probePid) === "absent"))
+        return finish({ id: record.id, stopped: false, method: "not-running" });
+    for (const name of ["SIGTERM", "SIGKILL"]) {
+        for (const target of targets) {
+            const presence = processPresence(target.pid, dependencies.probePid);
+            if (presence === "absent")
+                continue;
+            if (presence === "unknown")
+                return refuse(target.pid, "unknown");
+            const result = target.pid === record.pid
+                ? signalServerLeader(target.pid, target.token, name, dependencies)
+                : signalIfSameGeneration(target.pid, target.token, name, dependencies);
+            if (result.verdict !== "same")
+                return refuse(target.pid, result.verdict);
+        }
+        const observed = await waitForExit(targets, name === "SIGTERM" ? graceMs : 2_000, dependencies);
+        if (observed.refused)
+            return refuse(observed.refused.pid, observed.refused.verdict);
+        if (observed.exited)
+            return finish({ id: record.id, stopped: true, method: "signal", generation: "same" });
     }
-    const stopped = await exited(record, 2_000);
-    return finish({
+    return {
         id: record.id,
-        stopped,
+        stopped: false,
         method: "signal",
-        ...(stopped ? {} : { detail: "process survived SIGKILL" }),
-    });
+        generation: "same",
+        detail: "process survived SIGKILL",
+    };
 }
-function signal(pid, name) {
-    // Detached servers lead their own process group; signal the group so a
-    // wrapper (npm, bunx) does not orphan the real listener.
-    try {
-        process.kill(-pid, name);
-        return;
-    }
-    catch {
-        // Not a group leader, or already gone.
-    }
-    try {
-        process.kill(pid, name);
-    }
-    catch {
-        // Already gone.
-    }
+function signalServerLeader(pid, token, name, dependencies) {
+    // The leader's generation authorizes its group. A failed group signal must
+    // not reuse that observation for the direct-PID fallback.
+    const kill = dependencies.kill ?? process.kill;
+    const group = signalIfSameGeneration(pid, token, name, {
+        readToken: dependencies.readToken,
+        kill: (leader, signal) => kill(-leader, signal),
+    });
+    return group.sent || group.verdict !== "same"
+        ? group
+        : signalIfSameGeneration(pid, token, name, dependencies);
 }
-async function exited(record, waitMs) {
+async function waitForExit(targets, waitMs, dependencies) {
     const deadline = Date.now() + waitMs;
-    while (Date.now() < deadline) {
-        if (serverState(record) !== "running")
-            return true;
+    while (true) {
+        let live = false;
+        for (const target of targets) {
+            const presence = processPresence(target.pid, dependencies.probePid);
+            if (presence === "absent")
+                continue;
+            if (presence === "unknown")
+                return { exited: false, refused: { pid: target.pid, verdict: "unknown" } };
+            const verdict = verifyProcessGeneration(target.pid, target.token, dependencies.readToken);
+            if (verdict !== "same")
+                return { exited: false, refused: { pid: target.pid, verdict } };
+            live = true;
+        }
+        if (!live)
+            return { exited: true };
+        if (Date.now() >= deadline)
+            return { exited: false };
         await new Promise((r) => setTimeout(r, 100));
     }
-    return serverState(record) !== "running";
 }
 /**
  * The first free port in the configured range for `type`
@@ -510,7 +545,8 @@ export function allocateServerPort(type, options) {
         return null;
     const taken = listListeningPorts();
     for (const record of readServerRecords({ coordRoot })) {
-        if (record.port && serverState(record) === "running")
+        const state = serverState(record);
+        if (record.port && (state === "running" || state === "unknown"))
             taken.add(record.port);
     }
     for (let port = range[0]; port <= range[1]; port++)
@@ -526,12 +562,15 @@ export function adoptServer(pid, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot)
         throw new Error("no Harnery project found (coordination root did not resolve)");
-    const report = listServers({ coordRoot, sample: false });
+    const report = (options?.dependencies?.listServers ?? listServers)({ coordRoot, sample: false });
     const listeners = report.unregistered.filter((item) => item.pid === pid);
     if (!listeners.length)
         throw new Error(`pid ${pid} is not an unregistered listener inside this project`);
     const ports = listeners.map((item) => item.port).sort((a, b) => a - b);
     const first = listeners[0];
+    const generation = verifyProcessGeneration(pid, first.start_token, options?.dependencies?.readToken);
+    if (generation !== "same")
+        throw new Error(`pid ${pid} generation is ${generation}; adoption refused`);
     const type = options?.type ?? "adopted";
     const scope = options?.scope ?? first.cwd ?? undefined;
     const started = processStartedAt(pid);
@@ -543,6 +582,7 @@ export function adoptServer(pid, options) {
         url: `http://127.0.0.1:${ports[0]}/`,
         port: ports[0],
         pid,
+        start_token: first.start_token,
         ...(scope ? { scope } : {}),
         ...(first.cwd ? { cwd: first.cwd } : {}),
         ...(options?.owner === "none" ? { owner: null } : {}),

package/dist/core/servers/tunnels.d.ts

@@ -1,14 +1,12 @@
 /**
  * Tunnels as registry services.
  *
- * `tunnel up` and `tunnel reload` register the instance; `tunnel down`
- * removes it. Tunnels started before the registry existed are adopted the next
- * time the registry is read, so a long-lived tunnel never shows as an
- * unregistered listener.
+ * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
+ * its record. Older tunnels need an explicit adoption of an observed listener.
  */
 import { type TunnelState } from "../../lib/tunnel/state.js";
 import type { RegisterServerInput } from "./index.js";
 export declare function tunnelServerId(name: string): string;
-/** The registry input for one tunnel instance. */
+/** Register the new gate; saved helper PIDs have no generation witnesses. */
 export declare function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput;
 //# sourceMappingURL=tunnels.d.ts.map

package/dist/core/servers/tunnels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,kDAAkD;AAClD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAmB5F"}
+{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAc5F"}

package/dist/core/servers/tunnels.js

@@ -1,20 +1,16 @@
 /**
  * Tunnels as registry services.
  *
- * `tunnel up` and `tunnel reload` register the instance; `tunnel down`
- * removes it. Tunnels started before the registry existed are adopted the next
- * time the registry is read, so a long-lived tunnel never shows as an
- * unregistered listener.
+ * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
+ * its record. Older tunnels need an explicit adoption of an observed listener.
  */
 import { resolve } from "node:path";
 import { gateLogFile } from "../../lib/tunnel/state.js";
-import { resolveBinName } from "../config.js";
 export function tunnelServerId(name) {
     return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
 }
-/** The registry input for one tunnel instance. */
+/** Register the new gate; saved helper PIDs have no generation witnesses. */
 export function tunnelServerInput(state, coordRoot) {
-    const helpers = [state.cloudflared_pid, state.provider_pid].filter((pid) => typeof pid === "number" && pid > 0);
     return {
         id: tunnelServerId(state.name),
         kind: "service",
@@ -23,10 +19,8 @@ export function tunnelServerInput(state, coordRoot) {
         url: state.url,
         port: state.gate_port,
         pid: state.gate_pid,
-        ...(helpers.length ? { pids: helpers } : {}),
         log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
         cwd: coordRoot,
-        stop_argv: [resolveBinName(coordRoot), "tunnel", "down", "--name", state.name],
         started_at: state.started_at,
         owner: null,
     };