machine-bridge-mcp 1.2.6 → 1.2.8

package/scripts/release-acceptance.mjs

@@ -0,0 +1,169 @@
+import { createHash } from "node:crypto";
+import {
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+export const ACCEPTANCE_SCHEMA_VERSION = 1;
+export const ACCEPTANCE_POLICY_VERSION = "1.2.8";
+export const ACCEPTANCE_CONFIRMATION = "repository-owner-local-test";
+const MAX_ACCEPTANCE_BYTES = 64 * 1024;
+
+export function requiresLocalAcceptance(version) {
+  return compareVersions(parseVersion(version), parseVersion(ACCEPTANCE_POLICY_VERSION)) >= 0;
+}
+
+export function acceptancePath(root, version) {
+  return join(root, "release-acceptance", `v${version}.json`);
+}
+
+export function packProject(root, destination) {
+  const npmCli = process.env.npm_execpath;
+  if (!npmCli) {
+    throw new Error("release acceptance commands must run through npm so npm_execpath is available");
+  }
+  const result = spawnSync(process.execPath, [
+    npmCli,
+    "pack",
+    "--ignore-scripts",
+    "--silent",
+    "--json",
+    "--pack-destination",
+    destination,
+  ], {
+    cwd: root,
+    encoding: "utf8",
+    env: process.env,
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`npm pack failed: ${String(result.stderr || result.stdout).trim()}`);
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    throw new Error("npm pack did not return valid JSON");
+  }
+  const pkg = readPackage(root);
+  const record = normalizePackRecord(value, pkg.name);
+  if (!record) throw new Error("npm pack did not return package metadata");
+  const metadata = {
+    package_name: pkg.name,
+    package_version: pkg.version,
+    filename: String(record.filename || ""),
+    shasum: String(record.shasum || ""),
+    integrity: String(record.integrity || ""),
+  };
+  validatePackMetadata(metadata);
+  verifyTarball(join(destination, metadata.filename), metadata);
+  return metadata;
+}
+
+export function readAcceptance(root, version) {
+  const path = acceptancePath(root, version);
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`release acceptance record must be a regular file: ${path}`);
+  }
+  if (stat.size > MAX_ACCEPTANCE_BYTES) {
+    throw new Error(`release acceptance record exceeds ${MAX_ACCEPTANCE_BYTES} bytes`);
+  }
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new Error(`release acceptance record is not valid JSON: ${error.message}`);
+  }
+  return value;
+}
+
+export function verifyAcceptanceRecord(record, metadata) {
+  if (!record || typeof record !== "object" || Array.isArray(record)) {
+    throw new Error("release acceptance record must be an object");
+  }
+  if (record.schema_version !== ACCEPTANCE_SCHEMA_VERSION) {
+    throw new Error(`unsupported release acceptance schema: ${record.schema_version}`);
+  }
+  if (record.result !== "passed") throw new Error("local release acceptance result is not passed");
+  if (record.confirmation !== ACCEPTANCE_CONFIRMATION) {
+    throw new Error("local release acceptance confirmation is missing");
+  }
+  const acceptedAt = Date.parse(String(record.accepted_at || ""));
+  if (!Number.isFinite(acceptedAt)) throw new Error("local release acceptance timestamp is invalid");
+  for (const key of ["package_name", "package_version", "filename", "shasum", "integrity"]) {
+    if (record[key] !== metadata[key]) {
+      throw new Error(`local release acceptance ${key} does not match the current npm package`);
+    }
+  }
+  return record;
+}
+
+export function verifyCurrentReleaseAcceptance(root) {
+  const pkg = readPackage(root);
+  if (!requiresLocalAcceptance(pkg.version)) {
+    return { required: false, version: pkg.version };
+  }
+  const temp = mkdtempSync(join(tmpdir(), "mbm-release-acceptance-"));
+  try {
+    const metadata = packProject(root, temp);
+    const record = readAcceptance(root, pkg.version);
+    verifyAcceptanceRecord(record, metadata);
+    return { required: true, metadata, record };
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+export function verifyTarball(path, metadata) {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("release candidate tarball is not a regular file");
+  const bytes = readFileSync(path);
+  const shasum = createHash("sha1").update(bytes).digest("hex");
+  const integrity = `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
+  if (shasum !== metadata.shasum || integrity !== metadata.integrity) {
+    throw new Error("release candidate tarball hash does not match npm pack metadata");
+  }
+}
+
+export function normalizePackRecord(value, packageName) {
+  if (Array.isArray(value)) return value[0] ?? null;
+  if (!value || typeof value !== "object") return null;
+  if (value[packageName] && typeof value[packageName] === "object") return value[packageName];
+  return Object.values(value).find((item) => item && typeof item === "object") ?? null;
+}
+
+function readPackage(root) {
+  const value = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  if (typeof value.name !== "string" || !value.name) throw new Error("package.json name is invalid");
+  if (!parseVersion(value.version)) throw new Error("package.json version is invalid");
+  return value;
+}
+
+function validatePackMetadata(metadata) {
+  if (!metadata.filename.endsWith(".tgz") || metadata.filename.includes("/") || metadata.filename.includes("\\")) {
+    throw new Error("npm pack returned an invalid filename");
+  }
+  if (!/^[0-9a-f]{40}$/.test(metadata.shasum)) throw new Error("npm pack returned an invalid SHA-1 shasum");
+  if (!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(metadata.integrity)) throw new Error("npm pack returned an invalid SHA-512 integrity value");
+}
+
+function parseVersion(value) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/.exec(String(value || ""));
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+function compareVersions(left, right) {
+  if (!left || !right) throw new Error("version comparison requires semantic versions");
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] - right[index];
+  }
+  return 0;
+}

package/scripts/release-impact-check.mjs

@@ -25,20 +25,36 @@ const changed = new Set([
   ...lines(git(["ls-files", "--others", "--exclude-standard"])),
 ]);
 const relevant = [...changed].sort();
+const packageRelevant = relevant.filter((path) => isPackageRelevant(path, pkg.files));
 
 if (!relevant.length) {
-  process.stderr.write(`release impact check ok: no release-relevant changes since ${latestTag}\n`);
+  process.stderr.write(`release impact check ok: no repository changes since ${latestTag}\n`);
+  process.exit(0);
+}
+if (!packageRelevant.length) {
+  process.stderr.write(`release impact check ok: ${relevant.length} repository-only file(s) changed since ${latestTag}; npm package content is unchanged\n`);
   process.exit(0);
 }
 if (compareVersions(current, latest) <= 0) {
-  fail(`release-relevant changes exist since ${latestTag}, but package.json is still ${pkg.version}; bump the npm version and add a CHANGELOG section before merging`);
+  fail(`npm-package changes exist since ${latestTag}, but package.json is still ${pkg.version}; bump the npm version and add a CHANGELOG section before merging`);
 }
 
 const changelog = readFileSync(new URL("../CHANGELOG.md", import.meta.url), "utf8");
 const heading = new RegExp(`^## ${escapeRegExp(pkg.version)}(?:\\s+-[^\\n]*)?$`, "m");
 if (!heading.test(changelog)) fail(`CHANGELOG.md has no section for ${pkg.version}`);
 
-process.stderr.write(`release impact check ok: ${relevant.length} release-relevant file(s) since ${latestTag}; next npm version ${pkg.version}\n`);
+process.stderr.write(`release impact check ok: ${packageRelevant.length} npm-package file(s) changed since ${latestTag}; next npm version ${pkg.version}\n`);
+
+export function isPackageRelevant(path, packageFiles = []) {
+  const normalized = String(path || "").replaceAll("\\", "/").replace(/^\.\//, "");
+  if (!normalized) return false;
+  if (["package.json", "package-lock.json", "npm-shrinkwrap.json"].includes(normalized)) return true;
+  for (const entry of packageFiles || []) {
+    const candidate = String(entry || "").replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, "");
+    if (candidate && (normalized === candidate || normalized.startsWith(`${candidate}/`))) return true;
+  }
+  return false;
+}
 
 function git(args) {
   try {

package/src/local/browser-bridge.mjs

@@ -14,13 +14,14 @@ import {
 } from "./browser-pairing-store.mjs";
 import { clampInt } from "./browser-command.mjs";
 import { BrowserOperationService } from "./browser-operation-service.mjs";
+import { classifyOperationalError } from "./log.mjs";
 
 const MAX_PORT_ATTEMPTS = 10;
 const MAX_PENDING = 32;
 const EXTENSION_HANDSHAKE_MS = 3_000;
 
 export class BrowserBridgeManager {
-  constructor({ policy, authorizeTool = null, stateRoot = "", runProcess, readResourceText, readResourceBinary, throwIfCancelled = () => {} }) {
+  constructor({ policy, authorizeTool = null, stateRoot = "", runProcess, readResourceText, readResourceBinary, throwIfCancelled = () => {}, logger = null }) {
     this.policy = policy || {};
     this.authorizeTool = createToolAuthorizer(this.policy, authorizeTool);
     this.stateRoot = stateRoot ? resolve(stateRoot) : "";
@@ -28,6 +29,7 @@ export class BrowserBridgeManager {
     this.readResourceText = readResourceText;
     this.readResourceBinary = readResourceBinary;
     this.throwIfCancelled = throwIfCancelled;
+    this.logger = logger || { event() {} };
     this.server = null;
     this.wss = null;
     this.socket = null;
@@ -44,6 +46,7 @@ export class BrowserBridgeManager {
     this.stopping = false;
     this.pending = new Map();
     this.startPromise = null;
+    this.startGeneration = 0;
     this.port = 0;
     this.token = "";
     this.extensionPath = resolve(packageRoot, "browser-extension");
@@ -124,30 +127,59 @@ export class BrowserBridgeManager {
     if (this.stateRoot) assertStateMaintenanceAvailable(this.stateRoot);
     this.stopping = false;
     if (this.server || this.upstream?.readyState === 1) return;
-    if (!this.startPromise) this.startPromise = this.start();
-    try { await this.startPromise; } finally { this.startPromise = null; }
+    if (!this.startPromise) {
+      const generation = ++this.startGeneration;
+      this.startPromise = this.start(generation);
+    }
+    const pending = this.startPromise;
+    try { await pending; } finally {
+      if (this.startPromise === pending) this.startPromise = null;
+    }
   }
 
-  async start() {
-    const pairing = await loadOrCreatePairing(this.stateRoot);
-    this.token = pairing.token;
-    for (let offset = 0; offset < MAX_PORT_ATTEMPTS; offset += 1) {
-      const port = pairing.port + offset;
-      try {
-        await this.listen(port);
-        if (port !== pairing.port && this.stateRoot) await savePairing(this.stateRoot, { token: this.token, port });
-        return;
-      } catch (error) {
-        if (error?.code !== "EADDRINUSE") throw error;
-        if (await this.connectProxy(port)) {
-          this.port = port;
+  async start(generation = this.startGeneration) {
+    try {
+      const pairing = await loadOrCreatePairing(this.stateRoot);
+      this.assertStartCurrent(generation);
+      this.token = pairing.token;
+      for (let offset = 0; offset < MAX_PORT_ATTEMPTS; offset += 1) {
+        const port = pairing.port + offset;
+        try {
+          await this.listen(port);
+          this.assertStartCurrent(generation);
+          if (port !== pairing.port && this.stateRoot) {
+            await savePairing(this.stateRoot, { token: this.token, port });
+            this.assertStartCurrent(generation);
+          }
           return;
+        } catch (error) {
+          this.assertStartCurrent(generation);
+          if (error?.code !== "EADDRINUSE") throw error;
+          if (await this.connectProxy(port, generation)) {
+            this.assertStartCurrent(generation);
+            this.port = port;
+            return;
+          }
+          this.assertStartCurrent(generation);
+          if (offset === MAX_PORT_ATTEMPTS - 1) throw error;
         }
-        if (offset === MAX_PORT_ATTEMPTS - 1) throw error;
       }
+    } catch (error) {
+      const cancelled = !this.isStartCurrent(generation);
+      this.closeBrokerTransports(cancelled ? "browser bridge start cancelled" : "browser bridge start failed");
+      if (cancelled) throw new Error("browser bridge start cancelled");
+      throw error;
     }
   }
 
+  isStartCurrent(generation) {
+    return !this.stopping && generation === this.startGeneration;
+  }
+
+  assertStartCurrent(generation) {
+    if (!this.isStartCurrent(generation)) throw new Error("browser bridge start cancelled");
+  }
+
   async listen(port) {
     this.port = port;
     const server = createServer((request, response) => this.handleHttp(request, response));
@@ -192,7 +224,7 @@ export class BrowserBridgeManager {
     this.wss = wss;
   }
 
-  async connectProxy(port) {
+  async connectProxy(port, generation = this.startGeneration) {
     const url = `ws://127.0.0.1:${port}/runtime`;
     return new Promise((resolvePromise) => {
       let settled = false;
@@ -220,6 +252,11 @@ export class BrowserBridgeManager {
             closeProtocolSocket(ws, 1002, "runtime hello required");
             return;
           }
+          if (!this.isStartCurrent(generation)) {
+            try { ws.close(1001, "runtime stopped"); } catch {}
+            finish(false);
+            return;
+          }
           this.upstream = ws;
           const claimedExtension = message.extension_connected === true;
           this.proxyExtensionInfo = claimedExtension ? normalizeCompatibleExtensionInfo(message.extension_info) : null;
@@ -450,7 +487,11 @@ export class BrowserBridgeManager {
     if (this.stopping || this.recoveryTimer) return;
     this.recoveryTimer = setTimeout(() => {
       this.recoveryTimer = null;
-      void this.ensureStarted().catch(() => this.scheduleBrokerRecovery());
+      void this.ensureStarted().catch((error) => {
+        this.logger.event?.("debug", "browser.broker.recovery_failed", { error_class: classifyOperationalError(error) },
+          "browser broker recovery failed; retrying");
+        this.scheduleBrokerRecovery();
+      });
     }, 250);
     this.recoveryTimer.unref?.();
   }
@@ -525,9 +566,15 @@ export class BrowserBridgeManager {
 
   stop() {
     this.stopping = true;
+    this.startGeneration += 1;
     clearTimeout(this.recoveryTimer);
     this.recoveryTimer = null;
-    this.rejectPending("browser bridge stopped");
+    this.closeBrokerTransports("browser bridge stopped");
+  }
+
+  closeBrokerTransports(message) {
+    this.rejectPending(message);
+    this.rejectProxyRoutes(message);
     try { this.upstream?.close(1001, "runtime stopped"); } catch {}
     try { this.socket?.close(1001, "runtime stopped"); } catch {}
     try { this.pendingExtensionSocket?.close(1001, "runtime stopped"); } catch {}
@@ -541,8 +588,6 @@ export class BrowserBridgeManager {
     this.proxyExtensionReloadRequired = false;
     this.extensionReloadRequiredFlag = false;
     this.runtimeClients.clear();
-    for (const route of this.proxyRoutes.values()) clearTimeout(route.timeout);
-    this.proxyRoutes.clear();
     try { this.wss?.close(); } catch {}
     try { this.server?.close(); } catch {}
     this.wss = null;

package/src/local/cli-local-admin.mjs

@@ -10,6 +10,7 @@ import {
   acquireStartupLockWithWait, expandHome, loadState, ownerOnlyFile, packageRoot, saveState,
 } from "./state.mjs";
 import { resolvePolicy } from "./cli-policy.mjs";
+import { readLoopbackJson } from "./loopback-health.mjs";
 
 export function createLocalAdminCommands(dependencies) {
   const chooseWorkspace = dependencies.chooseWorkspace;
@@ -249,9 +250,7 @@ function readBrowserPairingState(pairingFile) {
 }
 
 function readBrowserHealth(healthUrl) {
-  return fetch(healthUrl, { signal: AbortSignal.timeout(2000), cache: "no-store" })
-    .then(async (response) => response.ok ? await response.json() : null)
-    .catch(() => null);
+  return readLoopbackJson(healthUrl, { pathname: "/healthz" });
 }
 
 function browserStatusResult(health, extensionPath, pairingUrl) {

package/src/local/daemon-process.mjs

@@ -11,6 +11,7 @@ import { inspectProcessInstance, isPidAlive, processCommandLine, splitProcessCom
 
 const DEFAULT_TAKEOVER_TIMEOUT_MS = 15_000;
 const DEFAULT_TAKEOVER_POLL_MS = 100;
+const DEFAULT_FORCE_AFTER_MS = 2_000;
 
 export async function acquireDaemonLockWithTakeover(state, options = {}) {
   const ownerMetadata = options.ownerMetadata || {};
@@ -50,9 +51,10 @@ export async function acquireDaemonLockWithTakeover(state, options = {}) {
 export async function stopWorkspaceServiceDaemon(state, options = {}) {
   const timeoutMs = boundedPositiveInt(options.timeoutMs, DEFAULT_TAKEOVER_TIMEOUT_MS);
   const pollMs = boundedPositiveInt(options.pollMs, DEFAULT_TAKEOVER_POLL_MS);
+  const forceAfterMs = Math.min(timeoutMs, boundedPositiveInt(options.forceAfterMs, DEFAULT_FORCE_AFTER_MS));
   const logger = options.logger || { info() {}, warn() {} };
   const deadline = createMonotonicDeadline(timeoutMs);
-  const signalled = new Set();
+  const signalled = new Map();
   let owner = options.owner || readDaemonLockOwner(daemonLockPathForState(state));
   let verified = false;
   let lastOwner = owner;
@@ -89,12 +91,42 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
             };
           }
         }
-        signalled.add(Number(owner.pid));
+        signalled.set(Number(owner.pid), {
+          owner: { ...owner },
+          forceDeadline: createMonotonicDeadline(forceAfterMs),
+          forced: false,
+        });
       }
     }
 
-    const liveSignalled = [...signalled].filter((pid) => isPidAlive(pid));
-    const currentOwnerAlive = Boolean(owner?.pid && isPidAlive(owner.pid));
+    for (const [pid, signalState] of signalled) {
+      if (signalState.forced || !signalState.forceDeadline.expired()) continue;
+      const current = inspectProcessInstance(signalState.owner);
+      if (!current.current) continue;
+      const identity = inspectWorkspaceDaemonOwner(state, signalState.owner);
+      if (!identity.verified_service_daemon) continue;
+      logger.warn?.(`detached background daemon ignored graceful termination; forcing process ${pid} to stop`);
+      try {
+        process.kill(pid, "SIGKILL");
+        signalState.forced = true;
+      } catch (error) {
+        if (error?.code !== "ESRCH") {
+          return {
+            ok: false,
+            found: true,
+            verified_service_daemon: true,
+            reason: "force_signal_failed",
+            timeout_ms: timeoutMs,
+            ...publicDaemonOwner(signalState.owner),
+          };
+        }
+      }
+    }
+
+    const liveSignalled = [...signalled.entries()]
+      .filter(([, signalState]) => inspectProcessInstance(signalState.owner).current)
+      .map(([pid]) => pid);
+    const currentOwnerAlive = Boolean(owner?.pid && inspectProcessInstance(owner).current);
     if (!currentOwnerAlive && liveSignalled.length === 0) break;
 
     if (deadline.expired()) {
@@ -107,6 +139,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
         verified_service_daemon: verified,
         reason: "timeout",
         timeout_ms: timeoutMs,
+        force_after_ms: forceAfterMs,
         pid: remainingPid,
         mode: publicDaemonMode(lastOwner),
         version: typeof lastOwner?.version === "string" ? lastOwner.version : "unknown",
@@ -126,6 +159,8 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
     verified_service_daemon: verified,
     reason: verified ? "stopped" : "not_running",
     timeout_ms: timeoutMs,
+    force_after_ms: forceAfterMs,
+    forced: [...signalled.values()].some((item) => item.forced),
     ...(lastOwner ? publicDaemonOwner(lastOwner) : {}),
   };
 }

package/src/local/execution-limits.mjs

@@ -0,0 +1,36 @@
+export const MAX_CONCURRENT_TOOL_CALLS = 16;
+export const MAX_PROCESS_SESSIONS = 8;
+export const MIN_PROCESS_TIMEOUT_SECONDS = 1;
+export const MAX_PROCESS_TIMEOUT_SECONDS = 600;
+export const DEFAULT_PROCESS_OUTPUT_BYTES = 512 * 1024;
+export const MAX_PROCESS_STDIN_BYTES = 1024 * 1024;
+export const MAX_PROCESS_SESSION_OUTPUT_BYTES = 1024 * 1024;
+export const MAX_PROCESS_SESSION_STDIN_BYTES = 64 * 1024;
+export const PROCESS_SESSION_RETENTION_MS = 30 * 60 * 1000;
+
+export function executionGuardrailsSnapshot() {
+  return {
+    tool_calls: {
+      maximum_concurrent: MAX_CONCURRENT_TOOL_CALLS,
+    },
+    one_shot_processes: {
+      timeout_seconds: { minimum: MIN_PROCESS_TIMEOUT_SECONDS, maximum: MAX_PROCESS_TIMEOUT_SECONDS },
+      stdin_max_bytes: MAX_PROCESS_STDIN_BYTES,
+      output_max_bytes_per_stream: DEFAULT_PROCESS_OUTPUT_BYTES,
+      process_tree_termination: "sigterm-then-sigkill",
+    },
+    process_sessions: {
+      maximum_concurrent: MAX_PROCESS_SESSIONS,
+      retained_output_max_bytes_per_stream: MAX_PROCESS_SESSION_OUTPUT_BYTES,
+      write_stdin_max_bytes: MAX_PROCESS_SESSION_STDIN_BYTES,
+      exited_retention_ms: PROCESS_SESSION_RETENTION_MS,
+      process_tree_termination: "sigterm-then-sigkill",
+    },
+    operating_system_enforcement: {
+      cpu_quota: "not-enforced",
+      memory_quota: "not-enforced",
+      network_isolation: "not-enforced",
+      required_boundary: "dedicated-low-privilege-account-or-vm-container",
+    },
+  };
+}

package/src/local/job-runner.mjs

@@ -4,7 +4,7 @@ import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs
 import { basename, join, resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 import { executionEnv } from "./shell.mjs";
-import { terminateProcessTree } from "./process-sessions.mjs";
+import { terminateProcessTreeWithEscalation } from "./process-tree.mjs";
 import { createExclusiveFileSync, removeOwnedJsonFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { currentProcessStartTimeMs } from "./process-identity.mjs";
@@ -279,8 +279,7 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
     let killTimer = null;
     const timer = setTimeout(() => {
       timedOut = true;
-      terminateProcessTree(child, "SIGTERM");
-      killTimer = setTimeout(() => terminateProcessTree(child, "SIGKILL"), 2000);
+      killTimer = terminateProcessTreeWithEscalation(child);
     }, timeoutMs);
     timer.unref?.();
     const cancellationPoll = setInterval(() => {
@@ -474,12 +473,10 @@ function requestCancellation() {
   cancelRequested = true;
   const child = activeChild;
   if (!child || !activeChildCancellationAware) return;
-  terminateProcessTree(child, "SIGTERM");
   if (cancellationEscalation) return;
-  cancellationEscalation = setTimeout(() => {
-    terminateProcessTree(child, "SIGKILL");
-    cancellationEscalation = null;
-  }, 2000);
+  cancellationEscalation = terminateProcessTreeWithEscalation(child, {
+    onEscalated: () => { cancellationEscalation = null; },
+  });
 }
 
 function isCancellationRequested() {

package/src/local/loopback-health.mjs

@@ -0,0 +1,67 @@
+import { request as requestHttp } from "node:http";
+
+export function readLoopbackJson(input, options = {}) {
+  let target;
+  try { target = new URL(String(input)); } catch { return Promise.resolve(null); }
+  const pathname = typeof options.pathname === "string" && options.pathname.startsWith("/") ? options.pathname : "/healthz";
+  const port = Number(target.port);
+  if (target.protocol !== "http:"
+      || target.hostname !== "127.0.0.1"
+      || target.pathname !== pathname
+      || target.username || target.password || target.search || target.hash
+      || !Number.isInteger(port) || port < 1024 || port > 65535) {
+    return Promise.resolve(null);
+  }
+  const request = typeof options.request === "function" ? options.request : requestHttp;
+  const timeoutMs = Number.isFinite(Number(options.timeoutMs)) ? Math.max(1, Number(options.timeoutMs)) : 2000;
+  const maximumBytes = Number.isFinite(Number(options.maximumBytes)) ? Math.max(1, Number(options.maximumBytes)) : 64 * 1024;
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    let client;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      resolvePromise(value);
+    };
+    try {
+      client = request({
+        protocol: "http:", hostname: "127.0.0.1", port, path: pathname, method: "GET", agent: false,
+        headers: { accept: "application/json", connection: "close" },
+      }, (response) => {
+        if (response.statusCode !== 200) {
+          response.resume();
+          finish(null);
+          return;
+        }
+        const chunks = [];
+        let total = 0;
+        response.on("data", (chunk) => {
+          if (settled) return;
+          total += chunk.length;
+          if (total > maximumBytes) {
+            client.destroy();
+            finish(null);
+            return;
+          }
+          chunks.push(chunk);
+        });
+        response.on("end", () => {
+          if (settled) return;
+          try {
+            const value = JSON.parse(Buffer.concat(chunks, total).toString("utf8"));
+            finish(value && typeof value === "object" && !Array.isArray(value) ? value : null);
+          } catch {
+            finish(null);
+          }
+        });
+        response.on("error", () => finish(null));
+      });
+    } catch {
+      finish(null);
+      return;
+    }
+    client.setTimeout(timeoutMs, () => client.destroy(new Error("loopback health request timed out")));
+    client.on("error", () => finish(null));
+    client.end();
+  });
+}