harnery 0.44.0 → 0.45.0

package/dist/commands/turn-rollback.d.ts

@@ -0,0 +1,5 @@
+import type { Command } from "commander";
+import type { EmitContext, HarneryProgramContext } from "../commander.js";
+/** Explicit turn boundaries; hooks cannot infer provider ownership or path scope. */
+export declare function registerTurnRollbackCommand(program: Command, emit: EmitContext, context?: HarneryProgramContext): void;
+//# sourceMappingURL=turn-rollback.d.ts.map

package/dist/commands/turn-rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-rollback.d.ts","sourceRoot":"","sources":["../../src/commands/turn-rollback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAa1E,qFAAqF;AACrF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CA2FN"}

package/dist/commands/turn-rollback.js

@@ -0,0 +1,76 @@
+import { monorepoRoot } from "../core/agents/index.js";
+import { applyTurnRollback, beginTurnRollback, inspectTurnRollback, prepareTurnRollback, sealTurnRollback, } from "../core/turn-rollback/index.js";
+import { readJsonRecord } from "../core/workflow/durable-record.js";
+import { readWorkspaceBinding } from "../core/workflow/workspaces/state.js";
+/** Explicit turn boundaries; hooks cannot infer provider ownership or path scope. */
+export function registerTurnRollbackCommand(program, emit, context) {
+    const command = program
+        .command("turn-rollback")
+        .description("Capture and review exact-path content rollback in an owned workspace");
+    const run = (operation) => async (options) => {
+        try {
+            const coordRoot = context?.resolveCoordRoot?.() ?? context?.repoRoot ?? monorepoRoot();
+            if (!coordRoot)
+                throw new Error("project coordination root is unavailable");
+            emit.config({ format: "json" });
+            const result = await operation(coordRoot, options);
+            emit.data(result);
+            if (result &&
+                typeof result === "object" &&
+                "status" in result &&
+                result.status === "unknown")
+                emit.setExitCode(1);
+        }
+        catch (error) {
+            emit.error({ code: "turn_rollback_refused", message: String(error) });
+            emit.setExitCode(1);
+        }
+    };
+    const binding = (root, options) => {
+        const value = readWorkspaceBinding(root, "local-git-worktree", options.binding);
+        if (!value)
+            throw new Error("immutable workspace binding was not found");
+        return value;
+    };
+    command
+        .command("begin")
+        .description("Capture exact literal paths before a turn")
+        .requiredOption("--binding <id>", "Owned workspace binding ID")
+        .requiredOption("--turn <id>", "Caller turn identity")
+        .requiredOption("--generation <number>", "Increasing turn generation")
+        .requiredOption("--path <file...>", "Exact relative file paths, including planned new files")
+        .action(run((root, options) => beginTurnRollback(root, {
+        binding: binding(root, options),
+        turn: { turn_id: options.turn, generation: Number(options.generation) },
+        paths: options.path,
+    })));
+    for (const operation of ["seal", "prepare", "show"]) {
+        command
+            .command(`${operation} <capture-id>`)
+            .description(`${operation} an exact turn capture`)
+            .requiredOption("--binding <id>", "Owned workspace binding ID")
+            .action((id, options) => run((root, opts) => {
+            const input = { binding: binding(root, opts), capture_id: id };
+            return operation === "seal"
+                ? sealTurnRollback(root, input)
+                : operation === "prepare"
+                    ? prepareTurnRollback(root, input)
+                    : inspectTurnRollback(root, input);
+        })(options));
+    }
+    command
+        .command("apply")
+        .description("Preview a saved proposal, or apply it after exact confirmation")
+        .requiredOption("--binding <id>", "Owned workspace binding ID")
+        .requiredOption("--plan <file>", "Saved JSON proposal returned by prepare")
+        .option("--yes", "Apply this exact proposal; preview is the default")
+        .option("--actor <name>", "Who authorized the restore")
+        .option("--reason <text>", "Why this turn is being restored")
+        .action(run((root, options) => applyTurnRollback(root, {
+        binding: binding(root, options),
+        plan: readJsonRecord(options.plan, "rollback proposal"),
+        yes: options.yes,
+        actor: options.actor,
+        reason: options.reason,
+    })));
+}

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA0EnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmvBjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmFnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqyBjF"}

package/dist/commands/workflow.js

@@ -475,6 +475,9 @@ export function registerWorkflowCommand(program, emit) {
         .description("Preview reclaim of an inactive owned workspace, or confirm salvage or discard and release.")
         .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
         .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+        .option("--unknown-liveness <sha256>", "Recover unknown evidence pinned by the preview digest; active evidence still refuses")
+        .option("--actor <id>", "Actor responsible for an audited recovery")
+        .option("--reason <text>", "Reason for an audited recovery")
         .option("--json", "Emit the reclaim preview or confirmed result as JSON")
         .action(async (runId, opts) => {
         const coordRoot = resolveCoordRoot();
@@ -499,6 +502,13 @@ export function registerWorkflowCommand(program, emit) {
             const result = await provider.reclaim(binding, {
                 mode: opts.discard ? "discard" : "salvage",
                 yes: opts.yes,
+                unknownLiveness: opts.unknownLiveness
+                    ? {
+                        evidenceSha256: opts.unknownLiveness,
+                        actor: opts.actor,
+                        reason: opts.reason,
+                    }
+                    : undefined,
             });
             if (opts.json) {
                 emit.config({ format: "json" });
@@ -509,6 +519,7 @@ export function registerWorkflowCommand(program, emit) {
                 const holders = result.lease_holder.map((holder) => `${holder.scope}: ${holder.owner_id ?? "unknown"}${holder.pid ? ` (pid ${holder.pid})` : ""}${holder.detail ? `; ${holder.detail}` : ""}`);
                 emit.text(`reclaim preview: ${result.run_id}\n` +
                     `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
+                    `evidence sha256: ${result.evidence_sha256}\n` +
                     `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
                     `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
                     (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
@@ -528,6 +539,39 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
     });
+    workflow
+        .command("unlock <run-id>")
+        .description("Preview or explicitly retire one exact resume lock whose local owner is proven dead.")
+        .option("--lock-sha256 <sha256>", "Exact lock identity digest returned by the preview")
+        .option("--actor <id>", "Actor responsible for the recovery")
+        .option("--reason <text>", "Reason for the recovery")
+        .option("--yes", "Confirm removal after dead-owner and exact-lock checks")
+        .option("--json", "Emit the recovery preview or result as JSON")
+        .action(async (runId, opts) => {
+        try {
+            const coordRoot = resolveCoordRoot();
+            if (!coordRoot)
+                throw new Error("no .harnery/ coordination root found");
+            const { recoverWorkflowResumeLease } = await import("../core/workflow/index.js");
+            const result = recoverWorkflowResumeLease(coordRoot, runId, opts);
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(result);
+                return;
+            }
+            emit.text(`resume lock ${result.action}: ${runId}\nowner: ${result.owner_state}\nlock sha256: ${result.lock_sha256 ?? "absent"}\n` +
+                (result.action === "preview"
+                    ? "Pass --lock-sha256, --actor, --reason and --yes to confirm exact dead-owner recovery.\n"
+                    : `recovery: ${result.recovery_id}\n`));
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_resume_unlock_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
     const approvals = program
         .command("approval")
         .description("Inspect and resolve durable run-policy approvals.");

package/dist/core/agents/coord-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CxD;AAgCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAsEA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsB5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AAyBD,sFAAsF;AACtF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAuCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAmB9C;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOpE"}
+{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA+DxD;AAgCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAsEA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsB5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AAyBD,sFAAsF;AACtF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAuCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAmB9C;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOpE"}

package/dist/core/agents/coord-client.js

@@ -251,7 +251,25 @@ export function parsePidmapRowStartToken(row) {
  * a test can hold this one against `processStartToken` and fail on drift.
  */
 export function pidStartToken(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
     const forced = process.env.HARNERY_PID_PROBE;
+    if (process.platform === "win32" && forced !== "procfs" && forced !== "ps") {
+        try {
+            const out = spawnSync("powershell.exe", [
+                "-NoLogo",
+                "-NoProfile",
+                "-NonInteractive",
+                "-Command",
+                `$process = [Diagnostics.Process]::GetProcessById(${pid}); try { 'w' + $process.StartTime.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture) } finally { $process.Dispose() }`,
+            ], { encoding: "utf8", timeout: 10_000, windowsHide: true });
+            const token = String(out.stdout ?? "").trim();
+            return out.status === 0 && /^w\d+$/.test(token) ? token : null;
+        }
+        catch {
+            return null;
+        }
+    }
     const useProcfs = forced === "procfs" || (forced !== "ps" && existsSync("/proc/self/stat"));
     // One machine, one probe. Falling back to the other on a read failure would
     // answer in the wrong dialect and read as a recycled pid.

package/dist/core/agents/state/proc-start.d.ts

@@ -30,8 +30,9 @@
  *    through the caller's locale and timezone, so both are pinned; without that,
  *    two callers reading the same live process disagree.
  */
+import { signalProcessWithHandle } from "./process-handle.js";
 /** Which probe answers "when did this process start?" on this machine. */
-export type StartTokenProbe = "procfs" | "ps";
+export type StartTokenProbe = "procfs" | "ps" | "windows";
 /**
  * Which probe this machine uses, decided once.
  *
@@ -74,13 +75,11 @@ type ReadProcessStartToken = (pid: number) => string | null;
 export declare function verifyProcessGeneration(pid: number, recordedToken: string | null | undefined, readToken?: ReadProcessStartToken): ProcessGenerationVerdict;
 export interface ProcessGenerationSignalDependencies {
     readToken?: ReadProcessStartToken;
-    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
+    signalProcess?: typeof signalProcessWithHandle;
 }
 /**
- * Recheck the process generation immediately before sending the signal.
- *
- * The process can still exit and its PID can be reused between the token read
- * and the signal. Eliminating that race requires a generation-bound OS handle.
+ * Observations may refuse a signal, but only the retained native process handle
+ * can authorize it. No numeric-PID effect follows the preliminary token read.
  */
 export declare function signalIfSameGeneration(pid: number, recordedToken: string | null | undefined, signal: NodeJS.Signals | number, dependencies?: ProcessGenerationSignalDependencies): {
     sent: boolean;

package/dist/core/agents/state/proc-start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proc-start.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/state/proc-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,IAAI,CAAC;AAc9C;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAOjD;AAyBD,uDAAuD;AACvD,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAiB,GAC7E,MAAM,GAAG,IAAI,CAUf;AAWD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE,KAAK,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAE5D,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,SAAS,GAAE,qBAAyC,GACnD,wBAAwB,CAkB1B;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC;CAClE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,EAC/B,YAAY,GAAE,mCAAwC,GACrD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAUtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQtE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,GAAG,UAAU,GAAG,YAAY,CAKrC"}
+{"version":3,"file":"proc-start.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/state/proc-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,uBAAuB,EAA4B,MAAM,qBAAqB,CAAC;AAExF,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAc1D;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAQjD;AAyBD,uDAAuD;AACvD,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAiB,GAC7E,MAAM,GAAG,IAAI,CAUf;AAWD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ5D;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE,KAAK,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAE5D,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,SAAS,GAAE,qBAAyC,GACnD,wBAAwB,CAkB1B;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,EAC/B,YAAY,GAAE,mCAAwC,GACrD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAQtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQtE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,GAAG,UAAU,GAAG,YAAY,CAKrC"}

package/dist/core/agents/state/proc-start.js

@@ -33,6 +33,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { coordEnv } from "../../../lib/env.js";
+import { signalProcessWithHandle, windowsProcessStartToken } from "./process-handle.js";
 /**
  * The `ps` probe is text formatted by `strftime("%c", localtime(...))`, so its
  * output moves with `TZ` and `LC_TIME`. A hook running under `LC_ALL=C` (git
@@ -54,6 +55,8 @@ export function startTokenProbe() {
     const override = coordEnv("PID_PROBE");
     if (override === "procfs" || override === "ps")
         return override;
+    if (process.platform === "win32")
+        return "windows";
     if (cachedProbe === undefined) {
         cachedProbe = existsSync("/proc/self/stat") ? "procfs" : "ps";
     }
@@ -149,7 +152,12 @@ function defaultPsRun(pid) {
 export function processStartToken(pid) {
     if (!Number.isFinite(pid) || pid <= 0)
         return null;
-    return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
+    const probe = startTokenProbe();
+    return probe === "windows"
+        ? windowsProcessStartToken(pid)
+        : probe === "procfs"
+            ? procfsStartToken(pid)
+            : psStartToken(pid);
 }
 /** A missing or unreadable token never establishes process identity. */
 export function verifyProcessGeneration(pid, recordedToken, readToken = processStartToken) {
@@ -174,22 +182,18 @@ export function verifyProcessGeneration(pid, recordedToken, readToken = processS
     }
 }
 /**
- * Recheck the process generation immediately before sending the signal.
- *
- * The process can still exit and its PID can be reused between the token read
- * and the signal. Eliminating that race requires a generation-bound OS handle.
+ * Observations may refuse a signal, but only the retained native process handle
+ * can authorize it. No numeric-PID effect follows the preliminary token read.
  */
 export function signalIfSameGeneration(pid, recordedToken, signal, dependencies = {}) {
-    const kill = dependencies.kill ?? process.kill;
     const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
     if (verdict !== "same")
         return { sent: false, verdict };
     try {
-        kill(pid, signal);
-        return { sent: true, verdict };
+        return (dependencies.signalProcess ?? signalProcessWithHandle)(pid, recordedToken, signal);
     }
     catch {
-        return { sent: false, verdict };
+        return { sent: false, verdict: "unknown" };
     }
 }
 /**

package/dist/core/agents/state/process-handle.d.ts

@@ -0,0 +1,26 @@
+import type { ProcessGenerationVerdict } from "./proc-start.js";
+export interface ProcessHandleSignalResult {
+    sent: boolean;
+    verdict: ProcessGenerationVerdict;
+}
+export type NativeProcessHelperRunner = (command: string, args: string[], options: {
+    input: string;
+    encoding: "utf8";
+    timeout: number;
+    maxBuffer: number;
+    windowsHide: boolean;
+}) => {
+    status: number | null;
+    stdout: string | Buffer | null;
+    error?: Error;
+};
+export declare const LINUX_PROCESS_HANDLE_SCRIPT = "\nimport json, os, pathlib, signal, sys\nresult = {\"sent\": False, \"verdict\": \"unknown\"}\nfd = None\ntry:\n    request = json.loads(sys.stdin.readline())\n    if not hasattr(os, \"pidfd_open\") or not hasattr(signal, \"pidfd_send_signal\"):\n        raise RuntimeError(\"pidfd support unavailable\")\n    fd = os.pidfd_open(request[\"pid\"])\n    stat = pathlib.Path(\"/proc/%d/stat\" % request[\"pid\"]).read_text()\n    ticks = stat[stat.rfind(\") \") + 2:].split()[19]\n    boot = pathlib.Path(\"/proc/sys/kernel/random/boot_id\").read_text().strip().replace(\"-\", \"\")[:8]\n    token = \"l%s.%s\" % (boot, ticks)\n    result[\"token\"] = token\n    recorded = request.get(\"token\")\n    result[\"verdict\"] = \"same\" if token == recorded else \"different\"\n    if request[\"mode\"] == \"signal\" and result[\"verdict\"] == \"same\":\n        print(json.dumps({\"phase\": \"verified\"}), flush=True)\n        if sys.stdin.readline().strip() == \"signal\":\n            signal.pidfd_send_signal(fd, request[\"signal\"])\n            result[\"sent\"] = True\nexcept Exception:\n    pass\nfinally:\n    if fd is not None:\n        os.close(fd)\nprint(json.dumps(result), flush=True)\n";
+export declare const WINDOWS_PROCESS_HANDLE_SCRIPT = "\n$ErrorActionPreference = 'Stop'\n$result = @{ sent = $false; verdict = 'unknown' }\n$handle = [IntPtr]::Zero\ntry {\n  Add-Type -TypeDefinition @'\nusing System;\nusing System.Runtime.InteropServices;\npublic static class HarneryProcessHandle {\n  [DllImport(\"kernel32.dll\", SetLastError=true)] public static extern IntPtr OpenProcess(uint access, bool inherit, uint processId);\n  [DllImport(\"kernel32.dll\", SetLastError=true)] public static extern bool GetProcessTimes(IntPtr handle, out long creation, out long exit, out long kernel, out long user);\n  [DllImport(\"kernel32.dll\", SetLastError=true)] public static extern bool TerminateProcess(IntPtr handle, uint exitCode);\n  [DllImport(\"kernel32.dll\")] public static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);\n  [DllImport(\"kernel32.dll\")] public static extern bool CloseHandle(IntPtr handle);\n}\n'@\n  $request = [Console]::In.ReadLine() | ConvertFrom-Json\n  $access = [uint32]0x101000\n  if ($request.mode -eq 'signal') { $access = $access -bor 1 }\n  $handle = [HarneryProcessHandle]::OpenProcess($access, $false, [uint32]$request.pid)\n  if ($handle -eq [IntPtr]::Zero) { throw 'process handle unavailable' }\n  [long]$creation = 0; [long]$exitTime = 0; [long]$kernel = 0; [long]$userTime = 0\n  if (-not [HarneryProcessHandle]::GetProcessTimes($handle, [ref]$creation, [ref]$exitTime, [ref]$kernel, [ref]$userTime)) { throw 'process time unavailable' }\n  $token = 'w' + $creation.ToString([Globalization.CultureInfo]::InvariantCulture)\n  $result.token = $token\n  $result.verdict = if ($token -ceq $request.token) { 'same' } else { 'different' }\n  if ($request.mode -eq 'signal' -and $result.verdict -eq 'same') {\n    [Console]::Out.WriteLine('{\"phase\":\"verified\"}')\n    [Console]::Out.Flush()\n    if ([Console]::In.ReadLine() -eq 'signal' -and [HarneryProcessHandle]::WaitForSingleObject($handle, 0) -eq 258) {\n      $result.sent = [HarneryProcessHandle]::TerminateProcess($handle, 1)\n    }\n  }\n} catch {} finally {\n  if ($handle -ne [IntPtr]::Zero) { [void][HarneryProcessHandle]::CloseHandle($handle) }\n}\n$result | ConvertTo-Json -Compress\n";
+/** Windows creation FILETIME, read from an OpenProcess handle. */
+export declare function windowsProcessStartToken(pid: number, run?: NativeProcessHelperRunner): string | null;
+/** No numeric-PID signaling fallback is permitted when an exact handle fails. */
+export declare function signalProcessWithHandle(pid: number, recordedToken: string, signal: NodeJS.Signals | number, options?: {
+    platform?: NodeJS.Platform;
+    run?: NativeProcessHelperRunner;
+}): ProcessHandleSignalResult;
+//# sourceMappingURL=process-handle.d.ts.map

package/dist/core/agents/state/process-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-handle.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/state/process-handle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAMD,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,KACE;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAI9E,eAAO,MAAM,2BAA2B,+qCA2BvC,CAAC;AAEF,eAAO,MAAM,6BAA6B,qnEAqCzC,CAAC;AAwCF,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,yBAAqC,GACzC,MAAM,GAAG,IAAI,CAGf;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,EAC/B,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAAC,GAAG,CAAC,EAAE,yBAAyB,CAAA;CAAO,GAC5E,yBAAyB,CAgB3B"}

package/dist/core/agents/state/process-handle.js

@@ -0,0 +1,121 @@
+import { spawnSync } from "node:child_process";
+import { constants } from "node:os";
+// The helper owns the descriptor throughout observation and effect. The second
+// input line authorizes the effect; EOF releases the handle without signaling.
+export const LINUX_PROCESS_HANDLE_SCRIPT = `
+import json, os, pathlib, signal, sys
+result = {"sent": False, "verdict": "unknown"}
+fd = None
+try:
+    request = json.loads(sys.stdin.readline())
+    if not hasattr(os, "pidfd_open") or not hasattr(signal, "pidfd_send_signal"):
+        raise RuntimeError("pidfd support unavailable")
+    fd = os.pidfd_open(request["pid"])
+    stat = pathlib.Path("/proc/%d/stat" % request["pid"]).read_text()
+    ticks = stat[stat.rfind(") ") + 2:].split()[19]
+    boot = pathlib.Path("/proc/sys/kernel/random/boot_id").read_text().strip().replace("-", "")[:8]
+    token = "l%s.%s" % (boot, ticks)
+    result["token"] = token
+    recorded = request.get("token")
+    result["verdict"] = "same" if token == recorded else "different"
+    if request["mode"] == "signal" and result["verdict"] == "same":
+        print(json.dumps({"phase": "verified"}), flush=True)
+        if sys.stdin.readline().strip() == "signal":
+            signal.pidfd_send_signal(fd, request["signal"])
+            result["sent"] = True
+except Exception:
+    pass
+finally:
+    if fd is not None:
+        os.close(fd)
+print(json.dumps(result), flush=True)
+`;
+export const WINDOWS_PROCESS_HANDLE_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$result = @{ sent = $false; verdict = 'unknown' }
+$handle = [IntPtr]::Zero
+try {
+  Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class HarneryProcessHandle {
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern IntPtr OpenProcess(uint access, bool inherit, uint processId);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool GetProcessTimes(IntPtr handle, out long creation, out long exit, out long kernel, out long user);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool TerminateProcess(IntPtr handle, uint exitCode);
+  [DllImport("kernel32.dll")] public static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);
+  [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr handle);
+}
+'@
+  $request = [Console]::In.ReadLine() | ConvertFrom-Json
+  $access = [uint32]0x101000
+  if ($request.mode -eq 'signal') { $access = $access -bor 1 }
+  $handle = [HarneryProcessHandle]::OpenProcess($access, $false, [uint32]$request.pid)
+  if ($handle -eq [IntPtr]::Zero) { throw 'process handle unavailable' }
+  [long]$creation = 0; [long]$exitTime = 0; [long]$kernel = 0; [long]$userTime = 0
+  if (-not [HarneryProcessHandle]::GetProcessTimes($handle, [ref]$creation, [ref]$exitTime, [ref]$kernel, [ref]$userTime)) { throw 'process time unavailable' }
+  $token = 'w' + $creation.ToString([Globalization.CultureInfo]::InvariantCulture)
+  $result.token = $token
+  $result.verdict = if ($token -ceq $request.token) { 'same' } else { 'different' }
+  if ($request.mode -eq 'signal' -and $result.verdict -eq 'same') {
+    [Console]::Out.WriteLine('{"phase":"verified"}')
+    [Console]::Out.Flush()
+    if ([Console]::In.ReadLine() -eq 'signal' -and [HarneryProcessHandle]::WaitForSingleObject($handle, 0) -eq 258) {
+      $result.sent = [HarneryProcessHandle]::TerminateProcess($handle, 1)
+    }
+  }
+} catch {} finally {
+  if ($handle -ne [IntPtr]::Zero) { [void][HarneryProcessHandle]::CloseHandle($handle) }
+}
+$result | ConvertTo-Json -Compress
+`;
+function runHelper(request, platform, run) {
+    const unknown = { sent: false, verdict: "unknown" };
+    if (!Number.isInteger(request.pid) || request.pid <= 0)
+        return unknown;
+    if (platform !== "linux" && platform !== "win32")
+        return unknown;
+    try {
+        const command = platform === "linux" ? "python3" : "powershell.exe";
+        const args = platform === "linux"
+            ? ["-I", "-c", LINUX_PROCESS_HANDLE_SCRIPT]
+            : ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", WINDOWS_PROCESS_HANDLE_SCRIPT];
+        const output = run(command, args, {
+            input: `${JSON.stringify(request)}\nsignal\n`,
+            encoding: "utf8",
+            timeout: 10_000,
+            maxBuffer: 64 * 1024,
+            windowsHide: true,
+        });
+        if (output.error || output.status !== 0)
+            return unknown;
+        const lines = String(output.stdout ?? "")
+            .trim()
+            .split(/\r?\n/);
+        const parsed = JSON.parse(lines.at(-1) ?? "");
+        if (typeof parsed.sent !== "boolean" ||
+            !["same", "different", "unknown"].includes(parsed.verdict) ||
+            (parsed.sent && parsed.verdict !== "same"))
+            return unknown;
+        return parsed;
+    }
+    catch {
+        return unknown;
+    }
+}
+/** Windows creation FILETIME, read from an OpenProcess handle. */
+export function windowsProcessStartToken(pid, run = spawnSync) {
+    const result = runHelper({ mode: "probe", pid }, "win32", run);
+    return typeof result.token === "string" && /^w\d+$/.test(result.token) ? result.token : null;
+}
+/** No numeric-PID signaling fallback is permitted when an exact handle fails. */
+export function signalProcessWithHandle(pid, recordedToken, signal, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const number = typeof signal === "number" ? signal : constants.signals[signal];
+    if (!Number.isInteger(number) ||
+        number <= 0 ||
+        (platform === "linux" && !/^l[0-9a-f]{8}\.\d+$/.test(recordedToken)) ||
+        (platform === "win32" && (!/^w\d+$/.test(recordedToken) || ![9, 15].includes(number))))
+        return { sent: false, verdict: "unknown" };
+    const result = runHelper({ mode: "signal", pid, token: recordedToken, signal: number }, platform, options.run ?? spawnSync);
+    return { sent: result.sent, verdict: result.verdict };
+}

package/dist/core/artifacts/delivery-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-card.d.ts","sourceRoot":"","sources":["../../../src/core/artifacts/delivery-card.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAE9E,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GACtD,wBAAwB,CAmB1B;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,wBAAwB,CAY1B;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,wBAAwB,CAU1B;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,2BAAiD,EACzD,WAAW,GAAE,kBAAuB,GACnC,oBAAoB,CAsDtB;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,KAAK,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,GACX,oBAAoB,CAQtB"}
+{"version":3,"file":"delivery-card.d.ts","sourceRoot":"","sources":["../../../src/core/artifacts/delivery-card.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAE9E,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GACtD,wBAAwB,CAmB1B;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,wBAAwB,CAY1B;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,wBAAwB,CAU1B;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,2BAAiD,EACzD,WAAW,GAAE,kBAAuB,GACnC,oBAAoB,CAsDtB;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,KAAK,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,GACX,oBAAoB,CAQtB"}

package/dist/core/artifacts/delivery-card.js

@@ -5,6 +5,7 @@ import { isAbsolute, relative, resolve, sep } from "node:path";
 import { encodeLinkSafeComponent } from "../../lib/local-file-url.js";
 import { findLiveTunnelForOrigin, tunnelServesPaths } from "../../lib/tunnel/state.js";
 import { resolveWebPort } from "../config.js";
+import { createTunnelReadinessVerifier } from "../servers/index.js";
 import { stateFileMode } from "../storage/modes.js";
 import { ARTIFACT_MANIFEST } from "./constants.js";
 import { resolveArtifactRef, showArtifact } from "./index.js";
@@ -243,7 +244,7 @@ function deliveryLinkBase(repoRoot, environment) {
     // The same holds for a dashboard tunnel whose path scope leaves out either
     // route: its gate would refuse every link on the card.
     const tunnel = environment.tunnelUrl === undefined
-        ? findLiveTunnelForOrigin(webPort, `localhost:${webPort}`, repoRoot)
+        ? findLiveTunnelForOrigin(webPort, `localhost:${webPort}`, repoRoot, createTunnelReadinessVerifier({ coordRoot: repoRoot }))
         : null;
     const tunnelUrl = environment.tunnelUrl === undefined
         ? tunnel && tunnelServesPaths(tunnel, ["/browse", "/files"])

package/dist/core/resources/service.d.ts

@@ -1,4 +1,4 @@
-import { type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
+import { type ProcessGenerationSignalDependencies, type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
 import { type ResourceServiceStatus, type ResourceServiceStatusRecord } from "./contract.js";
 import { sampleResources } from "./sampler.js";
 import { type ResourceProcessDependencies } from "./service-status.js";
@@ -11,24 +11,10 @@ export interface RunResourceServiceInput {
     sample?: typeof sampleResources;
     wait?: (milliseconds: number) => Promise<void>;
 }
-export type EnsureResourceServiceResult = {
-    state: "running" | "started";
-    status: ResourceServiceStatus;
-} | {
-    state: "unsupported" | "unavailable";
-    status: ResourceServiceStatus;
-    error: string;
-};
-export declare function spawnResourceService(coordRootRaw: string, options?: {
-    intervalMs?: number;
-}): Promise<ResourceServiceStatus>;
-export declare function ensureResourceServiceRunning(coordRoot: string): Promise<EnsureResourceServiceResult>;
 export interface ResourceServiceStopResult extends ResourceServiceStatus {
     signal_sent: boolean;
     signal_verdict: ProcessGenerationVerdict;
 }
-export declare function requestResourceServiceStop(coordRootRaw: string, dependencies?: ResourceProcessDependencies & {
-    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
-}): ResourceServiceStopResult;
+export declare function requestResourceServiceStop(coordRootRaw: string, dependencies?: ResourceProcessDependencies & ProcessGenerationSignalDependencies): ResourceServiceStopResult;
 export declare function runResourceService(input: RunResourceServiceInput): Promise<ResourceServiceStatusRecord>;
 //# sourceMappingURL=service.d.ts.map

package/dist/core/resources/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/resources/service.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,KAAK,wBAAwB,EAG9B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,KAAK,2BAA2B,EAGjC,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAY1D,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,eAAe,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC/D;IAAE,KAAK,EAAE,aAAa,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,OAAO,CAAC,qBAAqB,CAAC,CAyChC;AAED,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,2BAA2B,CAAC,CAoBtC;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,wBAAwB,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,2BAA2B,GAAG;IAC1C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC;CAC7D,GACL,yBAAyB,CAuB3B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,2BAA2B,CAAC,CA4FtC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/resources/service.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAG9B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,KAAK,2BAA2B,EAGjC,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAY1D,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,eAAe,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,wBAAwB,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,2BAA2B,GAAG,mCAAwC,GACnF,yBAAyB,CAuB3B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,2BAA2B,CAAC,CA4FtC"}

package/dist/core/resources/service.js

@@ -1,7 +1,6 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
-import { hostname, platform } from "node:os";
+import { hostname } from "node:os";
 import { resolve } from "node:path";
 import { processStartToken, signalIfSameGeneration, } from "../agents/state/proc-start.js";
 import { resolveBinName } from "../config.js";
@@ -14,72 +13,6 @@ import { resourcePaths, writePrivateJsonAtomic } from "./storage.js";
 export const RESOURCE_SERVICE_DEFAULT_INTERVAL_MS = 2_000;
 const RESOURCE_SERVICE_MIN_INTERVAL_MS = 500;
 const RESOURCE_SERVICE_MAX_INTERVAL_MS = 60_000;
-export async function spawnResourceService(coordRootRaw, options = {}) {
-    const coordRoot = resolve(coordRootRaw);
-    const current = readResourceServiceStatus(coordRoot);
-    if (current.liveness === "unknown")
-        throw unknownResourceOwnerError();
-    if (current.liveness === "running") {
-        throw new Error(`resource observer is already running under pid ${current.record?.pid}`);
-    }
-    const intervalMs = normalizeInterval(options.intervalMs);
-    const paths = resourcePaths(coordRoot);
-    assertResourceLeaseAvailable(paths.lease);
-    mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
-    const harnBin = new URL("../../../bin/harn", import.meta.url).pathname;
-    if (!existsSync(harnBin))
-        throw new Error(`cannot find harn executable at ${harnBin}`);
-    let spawnError;
-    const child = spawn(harnBin, ["resources", "service", "daemon", "--root", coordRoot, "--interval-ms", String(intervalMs)], {
-        cwd: coordRoot,
-        detached: true,
-        stdio: ["ignore", "ignore", "ignore"],
-        env: {
-            ...process.env,
-            HARNERY_COORD_ROOT_OVERRIDE: coordRoot,
-            HARNERY_OUTPUT_SESSION_TEE: "0",
-        },
-    });
-    child.once("error", (error) => {
-        spawnError = error;
-    });
-    child.unref();
-    const deadline = Date.now() + 5_000;
-    while (Date.now() < deadline) {
-        await delay(50);
-        if (spawnError)
-            throw spawnError;
-        const status = readResourceServiceStatus(coordRoot);
-        if (status.running && status.record?.pid === child.pid)
-            return status;
-        if (child.exitCode !== null)
-            break;
-    }
-    throw new Error(`resource observer failed to start; inspect ${paths.service}`);
-}
-export async function ensureResourceServiceRunning(coordRoot) {
-    const status = readResourceServiceStatus(coordRoot);
-    if (status.running)
-        return { state: "running", status };
-    if (platform() !== "linux") {
-        return {
-            state: "unsupported",
-            status,
-            error: `resource observer does not yet support ${platform()}`,
-        };
-    }
-    try {
-        const started = await spawnResourceService(coordRoot);
-        return { state: "started", status: started };
-    }
-    catch (error) {
-        return {
-            state: "unavailable",
-            status: readResourceServiceStatus(coordRoot),
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
 export function requestResourceServiceStop(coordRootRaw, dependencies = {}) {
     const coordRoot = resolve(coordRootRaw);
     const paths = resourcePaths(coordRoot);
@@ -266,16 +199,6 @@ function readLease(path) {
 function leaseIsLive(lease) {
     return resourceProcessLiveness(lease).liveness;
 }
-function assertResourceLeaseAvailable(path) {
-    if (!existsSync(path))
-        return;
-    const lease = readLease(path);
-    const liveness = lease ? leaseIsLive(lease) : "unknown";
-    if (liveness === "unknown")
-        throw unknownResourceOwnerError();
-    if (liveness === "running")
-        throw new Error(`resource observer lease is held by pid ${lease?.pid}`);
-}
 function unknownResourceOwnerError() {
     return new Error(`resource observer process identity is unknown; run ${resolveBinName()} supervisor stop to write the durable stop request before starting again`);
 }