harnery 0.43.0 → 0.45.0

package/src/core/agents/render/session-context.ts

@@ -12,9 +12,8 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { resolveBinName, resolveHooksSetupHint } from "../../config.ts";
 import { harneryVersion, loadAdapterWiring } from "../../hooks/adapter/wiring.ts";
-import { appendEntry } from "../../journal/index.ts";
+import { formatPeerInbox, peerInbox } from "../../inbox/peer-messages.ts";
 import { readRemoteMachines } from "../../presence/index.ts";
-import { drainMailbox, formatMailboxDelivery, type MailboxMessageV1 } from "../mailbox.ts";
 import { readLiveCoordinationRows } from "../state/live-coordination-view.ts";
 import { forkRelationLabels, readForkState } from "../state/names.ts";
 import type { AgentActivity, TaskState } from "../state/session-state.ts";
@@ -42,6 +41,8 @@ export interface RenderOpts {
   /** Adapter label rendered in parens after the self-name (e.g. "Cursor", "Codex").
    * Claude Code omits it. */
   platformLabel?: string;
+  /** The emitter acknowledges exactly these IDs only after output succeeds. */
+  onInboxPrepared?: (messageIds: readonly string[]) => void;
 }
 
 /**
@@ -92,15 +93,12 @@ export function renderSessionContext(opts: RenderOpts): string {
     );
   }
 
-  // 3. Peer messages queued for this name while no session held it. Draining
-  // here is what makes `agents ping` safe to use on a dormant agent: the sender
-  // never has to know whether the recipient is running.
-  if (agentName) {
-    const delivered = drainMailbox(coordRoot, agentName);
-    if (delivered.length > 0) {
-      recordDeliveredMessages(instanceId, delivered);
-      messages.push(formatMailboxDelivery(coordRoot, delivered));
-    }
+  // 3. Rendering never consumes a message. The native emitter acknowledges the
+  // prepared instance-bound batch only after it has flushed the output.
+  const delivered = peerInbox(coordRoot).prepareSurface(instanceId);
+  if (delivered.length > 0) {
+    opts.onInboxPrepared?.(delivered.map(({ message_id }) => message_id));
+    messages.push(formatPeerInbox(coordRoot, delivered));
   }
 
   // 4. Council invites
@@ -147,27 +145,6 @@ export function renderSessionContext(opts: RenderOpts): string {
   return messages.join("\n\n");
 }
 
-/**
- * Write delivered peer messages into the recipient's own journal, so they
- * survive context compaction the way any other coordination breadcrumb does.
- * A message the sender already journaled (the recipient was live when it was
- * sent) is skipped to avoid a duplicate entry.
- */
-export function recordDeliveredMessages(
-  instanceId: string,
-  messages: readonly MailboxMessageV1[],
-): void {
-  for (const m of messages) {
-    if (m.journaled) continue;
-    try {
-      appendEntry(instanceId, "handoff", `from agent-${m.from_name}: ${m.body}`);
-    } catch {
-      // A journal write failure must never cost the delivery itself; the
-      // message is already in the rendered context the model reads.
-    }
-  }
-}
-
 /** One-line-per-agent view of sessions on other machines (presence refs). */
 function formatRemoteMachines(coordRoot: string): string {
   try {

package/src/core/agents/rules/stop-hook.ts

@@ -424,9 +424,9 @@ function sessionNameBlock(coordRoot: string, instanceId: string): VerdictResult
   } catch {
     // The ledger evidence still authorizes the block; the cache is UX only.
   }
-  const instruction = name
-    ? `Reproduce it by itself in a fenced code block: ${name}`
-    : `Run \`${resolveBinName(coordRoot)} agents suggest-name\`, then reproduce its output by itself in a fenced code block.`;
+  // The first post-mint reply was already rejected. Repeating its title later
+  // cannot change that evidence; the JSON retry result opens a new window.
+  const instruction = `Run \`${resolveBinName(coordRoot)} agents suggest-name --json\` as your only tool call to create a fresh verification boundary, then display its suggested_session_name verbatim by itself in a fenced code block${name ? `: ${name}` : "."}`;
   return {
     allow: false,
     exit_code: 2,

package/src/core/agents/state/heartbeat-writer.ts

@@ -24,6 +24,11 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
+import {
+  assertCurrentGenerationV3,
+  withGenerationCustodyV3,
+} from "../../events/v3/generation-custody.ts";
+import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
 import { canonicalClaimPath } from "../claim-path.ts";
 import { type Heartbeat, heartbeatPath, readHeartbeat } from "./heartbeat-reader.ts";
 import type { TaskState } from "./session-state.ts";
@@ -63,12 +68,15 @@ function mutate(
   instanceId: string,
   fn: (hb: Heartbeat) => Heartbeat,
 ): Heartbeat | null {
-  const hb = readHeartbeat(coordRoot, instanceId);
-  if (!hb) return null;
-  const next = fn(hb);
-  next.last_heartbeat = nowIsoSeconds();
-  atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(next, null, 2));
-  return next;
+  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () => {
+    const hb = readHeartbeat(coordRoot, instanceId);
+    if (!hb) return null;
+    const next = fn(hb);
+    next.last_heartbeat = nowIsoSeconds();
+    assertCurrentGenerationV3(coordRoot, liveInstanceIdV3(instanceId), hb.v3_generation_id);
+    atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(next, null, 2));
+    return next;
+  });
 }
 
 export function setTask(coordRoot: string, instanceId: string, task: string): Heartbeat | null {
@@ -100,12 +108,15 @@ export function setIdentityCache(
   name: string,
   agentId: string,
 ): Heartbeat | null {
-  const heartbeat = readHeartbeat(coordRoot, instanceId);
-  if (!heartbeat) return null;
-  heartbeat.name = name;
-  heartbeat.agent_id = agentId;
-  atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(heartbeat, null, 2));
-  return heartbeat;
+  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () => {
+    const heartbeat = readHeartbeat(coordRoot, instanceId);
+    if (!heartbeat) return null;
+    heartbeat.name = name;
+    heartbeat.agent_id = agentId;
+    assertCurrentGenerationV3(coordRoot, liveInstanceIdV3(instanceId), heartbeat.v3_generation_id);
+    atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(heartbeat, null, 2));
+    return heartbeat;
+  });
 }
 
 /** Restore the pool-assigned display name on a generation that was
@@ -328,6 +339,12 @@ export function clearCoordinationCache(coordRoot: string, instanceId: string): b
 }
 
 export function healPidmap(coordRoot: string, instanceId: string, pid: number): void {
+  withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () =>
+    healPidmapUnderCustody(coordRoot, instanceId, pid),
+  );
+}
+
+function healPidmapUnderCustody(coordRoot: string, instanceId: string, pid: number): void {
   const dir = join(coordRoot, ".harnery", "pid-map");
   mkdirSync(dir, { recursive: true });
   const hb = readHeartbeat(coordRoot, instanceId);

package/src/core/agents/state/live-coordination-writer.ts

@@ -5,6 +5,10 @@ import {
   readCoordinationViewV3,
   requireAuthoritySafeCoordinationViewV3,
 } from "../../events/v3/coordination-view.ts";
+import {
+  assertCurrentGenerationV3,
+  withGenerationCustodyV3,
+} from "../../events/v3/generation-custody.ts";
 import { liveInstanceIdV3, resolveLiveEventLedgerRouteV3 } from "../../events/v3/live-routing.ts";
 import { type Heartbeat, readHeartbeat } from "./heartbeat-reader.ts";
 import {
@@ -64,6 +68,26 @@ function materializeLiveCoordinationHeartbeat(
   _adapter: Adapter,
   model: string | undefined,
   force: boolean,
+): Heartbeat | null {
+  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(nativeInstanceId)], () =>
+    materializeHeartbeatUnderCustody(
+      coordRoot,
+      nativeInstanceId,
+      nativeSessionId,
+      _adapter,
+      model,
+      force,
+    ),
+  );
+}
+
+function materializeHeartbeatUnderCustody(
+  coordRoot: string,
+  nativeInstanceId: string,
+  nativeSessionId: string,
+  _adapter: Adapter,
+  model: string | undefined,
+  force: boolean,
 ): Heartbeat | null {
   const route = resolveLiveEventLedgerRouteV3(coordRoot);
   if (route.state === "blocked") throw new Error(`event_v3_coordination_view:${route.reason}`);
@@ -133,6 +157,11 @@ function materializeLiveCoordinationHeartbeat(
     v3_projection_event_id: generation.last_event_id,
     v3_task_state: generation.task_state === "set" ? "set" : "cleared",
   };
+  assertCurrentGenerationV3(
+    coordRoot,
+    liveInstanceIdV3(nativeInstanceId),
+    generation.generation_id,
+  );
   writeHeartbeatCache(coordRoot, nativeInstanceId, materialized);
   return materialized;
 }

package/src/core/agents/state/pidmap.ts

@@ -24,6 +24,8 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
+import { withGenerationCustodyV3 } from "../../events/v3/generation-custody.ts";
+import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
 import { checkPidToken, processStartToken } from "./proc-start.ts";
 
 /**
@@ -126,6 +128,17 @@ export function writePidmapRow(
   pid: number,
   instanceId: string,
   platform: string,
+): void {
+  withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () =>
+    writePidmapRowUnderCustody(coordRoot, pid, instanceId, platform),
+  );
+}
+
+function writePidmapRowUnderCustody(
+  coordRoot: string,
+  pid: number,
+  instanceId: string,
+  platform: string,
 ): void {
   const dir = join(coordRoot, ".harnery", "pid-map");
   const path = join(dir, String(pid));

package/src/core/agents/state/proc-start.ts

@@ -34,9 +34,10 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { coordEnv } from "../../../lib/env.ts";
+import { signalProcessWithHandle, windowsProcessStartToken } from "./process-handle.ts";
 
 /** Which probe answers "when did this process start?" on this machine. */
-export type StartTokenProbe = "procfs" | "ps";
+export type StartTokenProbe = "procfs" | "ps" | "windows";
 
 /**
  * The `ps` probe is text formatted by `strftime("%c", localtime(...))`, so its
@@ -60,6 +61,7 @@ let cachedBootId: string | null | undefined;
 export function startTokenProbe(): StartTokenProbe {
   const override = coordEnv("PID_PROBE");
   if (override === "procfs" || override === "ps") return override;
+  if (process.platform === "win32") return "windows";
   if (cachedProbe === undefined) {
     cachedProbe = existsSync("/proc/self/stat") ? "procfs" : "ps";
   }
@@ -157,7 +159,65 @@ function defaultPsRun(pid: number): { status: number | null; stdout: string } {
  */
 export function processStartToken(pid: number): string | null {
   if (!Number.isFinite(pid) || pid <= 0) return null;
-  return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
+  const probe = startTokenProbe();
+  return probe === "windows"
+    ? windowsProcessStartToken(pid)
+    : probe === "procfs"
+      ? procfsStartToken(pid)
+      : psStartToken(pid);
+}
+
+export type ProcessGenerationVerdict = "same" | "different" | "unknown";
+
+type ReadProcessStartToken = (pid: number) => string | null;
+
+/** A missing or unreadable token never establishes process identity. */
+export function verifyProcessGeneration(
+  pid: number,
+  recordedToken: string | null | undefined,
+  readToken: ReadProcessStartToken = processStartToken,
+): ProcessGenerationVerdict {
+  if (
+    !Number.isInteger(pid) ||
+    pid <= 0 ||
+    typeof recordedToken !== "string" ||
+    !recordedToken.trim()
+  )
+    return "unknown";
+  // A bootless Linux token cannot identify a process across machine boots.
+  if (/^l\d+$/.test(recordedToken)) return "unknown";
+  try {
+    const currentToken = readToken(pid);
+    if (typeof currentToken !== "string" || !currentToken.trim()) return "unknown";
+    if (/^l\d+$/.test(currentToken)) return "unknown";
+    return currentToken === recordedToken ? "same" : "different";
+  } catch {
+    return "unknown";
+  }
+}
+
+export interface ProcessGenerationSignalDependencies {
+  readToken?: ReadProcessStartToken;
+  signalProcess?: typeof signalProcessWithHandle;
+}
+
+/**
+ * Observations may refuse a signal, but only the retained native process handle
+ * can authorize it. No numeric-PID effect follows the preliminary token read.
+ */
+export function signalIfSameGeneration(
+  pid: number,
+  recordedToken: string | null | undefined,
+  signal: NodeJS.Signals | number,
+  dependencies: ProcessGenerationSignalDependencies = {},
+): { sent: boolean; verdict: ProcessGenerationVerdict } {
+  const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
+  if (verdict !== "same") return { sent: false, verdict };
+  try {
+    return (dependencies.signalProcess ?? signalProcessWithHandle)(pid, recordedToken!, signal);
+  } catch {
+    return { sent: false, verdict: "unknown" };
+  }
 }
 
 /**

package/src/core/agents/state/process-handle.ts

@@ -0,0 +1,165 @@
+import { spawnSync } from "node:child_process";
+import { constants } from "node:os";
+import type { ProcessGenerationVerdict } from "./proc-start.ts";
+
+export interface ProcessHandleSignalResult {
+  sent: boolean;
+  verdict: ProcessGenerationVerdict;
+}
+
+interface NativeHelperResult extends ProcessHandleSignalResult {
+  token?: string;
+}
+
+export type NativeProcessHelperRunner = (
+  command: string,
+  args: string[],
+  options: {
+    input: string;
+    encoding: "utf8";
+    timeout: number;
+    maxBuffer: number;
+    windowsHide: boolean;
+  },
+) => { status: number | null; stdout: string | Buffer | null; error?: Error };
+
+// The helper owns the descriptor throughout observation and effect. The second
+// input line authorizes the effect; EOF releases the handle without signaling.
+export const LINUX_PROCESS_HANDLE_SCRIPT = `
+import json, os, pathlib, signal, sys
+result = {"sent": False, "verdict": "unknown"}
+fd = None
+try:
+    request = json.loads(sys.stdin.readline())
+    if not hasattr(os, "pidfd_open") or not hasattr(signal, "pidfd_send_signal"):
+        raise RuntimeError("pidfd support unavailable")
+    fd = os.pidfd_open(request["pid"])
+    stat = pathlib.Path("/proc/%d/stat" % request["pid"]).read_text()
+    ticks = stat[stat.rfind(") ") + 2:].split()[19]
+    boot = pathlib.Path("/proc/sys/kernel/random/boot_id").read_text().strip().replace("-", "")[:8]
+    token = "l%s.%s" % (boot, ticks)
+    result["token"] = token
+    recorded = request.get("token")
+    result["verdict"] = "same" if token == recorded else "different"
+    if request["mode"] == "signal" and result["verdict"] == "same":
+        print(json.dumps({"phase": "verified"}), flush=True)
+        if sys.stdin.readline().strip() == "signal":
+            signal.pidfd_send_signal(fd, request["signal"])
+            result["sent"] = True
+except Exception:
+    pass
+finally:
+    if fd is not None:
+        os.close(fd)
+print(json.dumps(result), flush=True)
+`;
+
+export const WINDOWS_PROCESS_HANDLE_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$result = @{ sent = $false; verdict = 'unknown' }
+$handle = [IntPtr]::Zero
+try {
+  Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class HarneryProcessHandle {
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern IntPtr OpenProcess(uint access, bool inherit, uint processId);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool GetProcessTimes(IntPtr handle, out long creation, out long exit, out long kernel, out long user);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool TerminateProcess(IntPtr handle, uint exitCode);
+  [DllImport("kernel32.dll")] public static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);
+  [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr handle);
+}
+'@
+  $request = [Console]::In.ReadLine() | ConvertFrom-Json
+  $access = [uint32]0x101000
+  if ($request.mode -eq 'signal') { $access = $access -bor 1 }
+  $handle = [HarneryProcessHandle]::OpenProcess($access, $false, [uint32]$request.pid)
+  if ($handle -eq [IntPtr]::Zero) { throw 'process handle unavailable' }
+  [long]$creation = 0; [long]$exitTime = 0; [long]$kernel = 0; [long]$userTime = 0
+  if (-not [HarneryProcessHandle]::GetProcessTimes($handle, [ref]$creation, [ref]$exitTime, [ref]$kernel, [ref]$userTime)) { throw 'process time unavailable' }
+  $token = 'w' + $creation.ToString([Globalization.CultureInfo]::InvariantCulture)
+  $result.token = $token
+  $result.verdict = if ($token -ceq $request.token) { 'same' } else { 'different' }
+  if ($request.mode -eq 'signal' -and $result.verdict -eq 'same') {
+    [Console]::Out.WriteLine('{"phase":"verified"}')
+    [Console]::Out.Flush()
+    if ([Console]::In.ReadLine() -eq 'signal' -and [HarneryProcessHandle]::WaitForSingleObject($handle, 0) -eq 258) {
+      $result.sent = [HarneryProcessHandle]::TerminateProcess($handle, 1)
+    }
+  }
+} catch {} finally {
+  if ($handle -ne [IntPtr]::Zero) { [void][HarneryProcessHandle]::CloseHandle($handle) }
+}
+$result | ConvertTo-Json -Compress
+`;
+
+function runHelper(
+  request: { mode: "probe" | "signal"; pid: number; token?: string; signal?: number },
+  platform: NodeJS.Platform,
+  run: NativeProcessHelperRunner,
+): NativeHelperResult {
+  const unknown = { sent: false, verdict: "unknown" } as const;
+  if (!Number.isInteger(request.pid) || request.pid <= 0) return unknown;
+  if (platform !== "linux" && platform !== "win32") return unknown;
+  try {
+    const command = platform === "linux" ? "python3" : "powershell.exe";
+    const args =
+      platform === "linux"
+        ? ["-I", "-c", LINUX_PROCESS_HANDLE_SCRIPT]
+        : ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", WINDOWS_PROCESS_HANDLE_SCRIPT];
+    const output = run(command, args, {
+      input: `${JSON.stringify(request)}\nsignal\n`,
+      encoding: "utf8",
+      timeout: 10_000,
+      maxBuffer: 64 * 1024,
+      windowsHide: true,
+    });
+    if (output.error || output.status !== 0) return unknown;
+    const lines = String(output.stdout ?? "")
+      .trim()
+      .split(/\r?\n/);
+    const parsed = JSON.parse(lines.at(-1) ?? "") as NativeHelperResult;
+    if (
+      typeof parsed.sent !== "boolean" ||
+      !["same", "different", "unknown"].includes(parsed.verdict) ||
+      (parsed.sent && parsed.verdict !== "same")
+    )
+      return unknown;
+    return parsed;
+  } catch {
+    return unknown;
+  }
+}
+
+/** Windows creation FILETIME, read from an OpenProcess handle. */
+export function windowsProcessStartToken(
+  pid: number,
+  run: NativeProcessHelperRunner = spawnSync,
+): string | null {
+  const result = runHelper({ mode: "probe", pid }, "win32", run);
+  return typeof result.token === "string" && /^w\d+$/.test(result.token) ? result.token : null;
+}
+
+/** No numeric-PID signaling fallback is permitted when an exact handle fails. */
+export function signalProcessWithHandle(
+  pid: number,
+  recordedToken: string,
+  signal: NodeJS.Signals | number,
+  options: { platform?: NodeJS.Platform; run?: NativeProcessHelperRunner } = {},
+): ProcessHandleSignalResult {
+  const platform = options.platform ?? process.platform;
+  const number = typeof signal === "number" ? signal : constants.signals[signal];
+  if (
+    !Number.isInteger(number) ||
+    number <= 0 ||
+    (platform === "linux" && !/^l[0-9a-f]{8}\.\d+$/.test(recordedToken)) ||
+    (platform === "win32" && (!/^w\d+$/.test(recordedToken) || ![9, 15].includes(number)))
+  )
+    return { sent: false, verdict: "unknown" };
+  const result = runHelper(
+    { mode: "signal", pid, token: recordedToken, signal: number },
+    platform,
+    options.run ?? spawnSync,
+  );
+  return { sent: result.sent, verdict: result.verdict };
+}