machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/local/resource-host-sample-file.mjs

@@ -0,0 +1,23 @@
+import { readBoundedRegularFileSync } from "./secure-file.mjs";
+
+const HOST_SAMPLE_MAX_BYTES = 32 * 1024;
+const HOST_SAMPLE_READ_ATTEMPTS = 4;
+
+export function readResourceHostSample(file, options = {}) {
+  const readFile = options.readFile || readBoundedRegularFileSync;
+  for (let attempt = 1; attempt <= HOST_SAMPLE_READ_ATTEMPTS; attempt += 1) {
+    try {
+      const text = readFile(file, HOST_SAMPLE_MAX_BYTES, "resource host sample", {
+        verifyPathIdentity: true,
+        rejectMultipleLinks: true,
+      }).toString("utf8");
+      const value = JSON.parse(text);
+      return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    } catch (error) {
+      if (options.optional === true && (error?.code === "ENOENT" || error?.cause?.code === "ENOENT")) return null;
+      const identityChanged = error?.code === "MBM_IDENTITY_CHANGED" || error?.cause?.code === "MBM_IDENTITY_CHANGED";
+      if (!identityChanged || attempt === HOST_SAMPLE_READ_ATTEMPTS) throw error;
+    }
+  }
+  throw new Error("resource host sample generation did not settle");
+}

package/src/local/resource-host-snapshot.mjs

@@ -0,0 +1,99 @@
+import { availableParallelism, cpus, freemem, loadavg, totalmem } from "node:os";
+import { statfsSync } from "node:fs";
+import { statfs } from "node:fs/promises";
+import { sampleDarwinHost, sampleDarwinHostAsync } from "./resource-host-darwin.mjs";
+import { sampleLinuxHost } from "./resource-host-linux.mjs";
+const CPU_BUSY_SAMPLE_MS = 50;
+export function sampleResourceHost(options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const platform = String(options.platform || process.platform);
+  const cpuCores = cpuCount(options);
+  const sample = baseSample(cpuCores, platform, options);
+  Object.assign(sample, diskStatsSync(cwd));
+  if (platform === "darwin") sampleDarwinHost(sample, options);
+  else if (platform === "linux") sampleLinuxHost(sample, options);
+  sample.sampled_at_ms = Date.now();
+  return sample;
+}
+export async function sampleResourceHostAsync(options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const platform = String(options.platform || process.platform);
+  const cpuCores = cpuCount(options);
+  const sample = baseSample(cpuCores, platform, options);
+  const [cpu, filesystem, darwin] = await Promise.all([
+    sampleCpuBusyCoresAsync(cpuCores, sample, options),
+    diskStatsAsync(cwd),
+    platform === "darwin" ? sampleDarwinHostAsync(options) : Promise.resolve(null),
+  ]);
+  sample.cpu_busy_cores = cpu.busy;
+  sample.cpu_time_ms_total = cpu.total;
+  sample.cpu_idle_ms_total = cpu.idle;
+  Object.assign(sample, filesystem);
+  if (darwin) Object.assign(sample, darwin);
+  else if (platform === "linux") sampleLinuxHost(sample, options);
+  sample.sampled_at_ms = Date.now();
+  return sample;
+}
+function baseSample(cpuCores, platform, options) {
+  const totalMemoryBytes = totalmem();
+  const cpuTotals = cpuTimeTotals(options.cpuTimes);
+  return {
+    sampled_at_ms: 0, platform, cpu_cores: cpuCores,
+    total_memory_mb: Math.round(totalMemoryBytes / (1024 * 1024)),
+    cpu_busy_cores: null, load1: Number(loadavg()[0]) || 0,
+    memory_free_percent: platform === "win32" && totalMemoryBytes > 0
+      ? Math.max(0, Math.min(100, freemem() * 100 / totalMemoryBytes))
+      : null,
+    cpu_time_ms_total: cpuTotals?.total ?? null, cpu_idle_ms_total: cpuTotals?.idle ?? null,
+    pageouts_total: null, swapouts_total: null,
+    disk_mb_per_s: null, disk_iops: null, disk_free_bytes: null, disk_total_bytes: null,
+    thermal_warning: false, io_sampled: false, io_sampled_at_ms: null,
+    psi_cpu_some_avg10: null, psi_memory_some_avg10: null, psi_memory_full_avg10: null,
+    psi_io_some_avg10: null, psi_io_full_avg10: null,
+  };
+}
+function cpuCount(options) {
+  return Math.max(1, Number(options.cpuCores ?? availableParallelism()) || 1);
+}
+function cpuTimeTotals(readCpus = cpus) {
+  let total = 0;
+  let idle = 0;
+  for (const cpu of readCpus()) {
+    const times = cpu?.times || {};
+    const values = [times.user, times.nice, times.sys, times.idle, times.irq].map(Number);
+    if (!values.every(Number.isFinite)) return null;
+    total += values.reduce((sum, value) => sum + value, 0);
+    idle += Number(times.idle);
+  }
+  return total > 0 && idle >= 0 && idle <= total ? { total, idle } : null;
+}
+async function sampleCpuBusyCoresAsync(cpuCores, startSample, options) {
+  if (options.previous) {
+    const immediate = cpuBusyWindow(cpuCores, options.previous, { total: startSample.cpu_time_ms_total, idle: startSample.cpu_idle_ms_total });
+    if (immediate.busy !== null) return immediate;
+  }
+  const sleep = options.cpuSampleSleep || ((ms) => new Promise((resolvePromise) => { setTimeout(resolvePromise, ms); }));
+  await sleep(CPU_BUSY_SAMPLE_MS);
+  const end = cpuTimeTotals(options.cpuTimes);
+  return cpuBusyWindow(cpuCores, startSample, end);
+}
+function cpuBusyWindow(cpuCores, startSample, end) {
+  const startTotal = Number(startSample?.cpu_time_ms_total); const startIdle = Number(startSample?.cpu_idle_ms_total);
+  if (!end || !Number.isFinite(startTotal) || !Number.isFinite(startIdle)) return { busy: null, total: end?.total ?? null, idle: end?.idle ?? null };
+  const totalDelta = Number(end.total) - startTotal; const idleDelta = Number(end.idle) - startIdle;
+  const busy = totalDelta > 0 && idleDelta >= 0 && idleDelta <= totalDelta
+    ? Math.max(0, Math.min(cpuCores, cpuCores * (1 - idleDelta / totalDelta))) : null;
+  return { busy, total: Number(end.total), idle: Number(end.idle) };
+}
+function diskStatsSync(cwd) {
+  try {
+    const value = statfsSync(cwd);
+    return { disk_free_bytes: Number(value.bavail) * Number(value.bsize), disk_total_bytes: Number(value.blocks) * Number(value.bsize) };
+  } catch { return { disk_free_bytes: null, disk_total_bytes: null }; }
+}
+async function diskStatsAsync(cwd) {
+  try {
+    const value = await statfs(cwd);
+    return { disk_free_bytes: Number(value.bavail) * Number(value.bsize), disk_total_bytes: Number(value.blocks) * Number(value.bsize) };
+  } catch { return { disk_free_bytes: null, disk_total_bytes: null }; }
+}

package/src/local/resource-lease-accounting.mjs

@@ -0,0 +1,119 @@
+const RESOURCE_KEYS = Object.freeze(["cpu", "io", "memory_mb", "disk_reserve_bytes"]);
+
+export function resourceLeaseAccountingContext(leases, processParents, requesterPid) {
+  const empty = { parentByLeaseId: {}, parentLeaseId: null, ancestorLeaseIds: [] };
+  if (!processParents || typeof processParents !== "object" || Array.isArray(processParents)) return empty;
+  const ownerByPid = new Map();
+  for (const lease of leases || []) {
+    const id = leaseId(lease); const pid = processOwnerPid(lease);
+    if (!id || !pid) continue;
+    if (ownerByPid.has(pid)) return empty;
+    ownerByPid.set(pid, id);
+  }
+  const parentByLeaseId = {};
+  for (const lease of leases || []) {
+    const id = leaseId(lease); const pid = processOwnerPid(lease);
+    if (!id || !pid) continue;
+    const parent = nearestLease(processParents, ownerByPid, parentPid(processParents, pid), id);
+    if (parent) parentByLeaseId[id] = parent;
+  }
+  if (!validParentForest(leases, parentByLeaseId)) return empty;
+  const parentLeaseId = nearestLease(processParents, ownerByPid, normalizePid(requesterPid), null);
+  return {
+    parentByLeaseId,
+    parentLeaseId,
+    ancestorLeaseIds: leaseAncestors(parentByLeaseId, parentLeaseId),
+  };
+}
+
+export function aggregateResourceLeases(leases, accounting = {}) {
+  return aggregateEffective(leases || [], accounting.parentByLeaseId || {});
+}
+
+export function resourceRequestIncrement(leases, request, accounting = {}) {
+  const parentByLeaseId = accounting.parentByLeaseId || {};
+  const before = aggregateEffective(leases || [], parentByLeaseId);
+  const pendingId = "__pending_resource_request__";
+  const pending = { lease_id: pendingId, request };
+  const afterParents = { ...parentByLeaseId };
+  if (accounting.parentLeaseId) afterParents[pendingId] = accounting.parentLeaseId;
+  const after = aggregateEffective([...(leases || []), pending], afterParents);
+  return Object.fromEntries(RESOURCE_KEYS.map((key) => [key, Math.max(0, after[key] - before[key])]));
+}
+
+function aggregateEffective(leases, parentByLeaseId) {
+  const indexed = indexLeases(leases);
+  if (!indexed || !validParentForest(leases, parentByLeaseId)) return naiveAggregate(leases);
+  const children = new Map([...indexed.keys()].map((id) => [id, []]));
+  for (const [child, parent] of Object.entries(parentByLeaseId || {})) {
+    if (children.has(child) && children.has(parent)) children.get(parent).push(child);
+  }
+  const roots = [...indexed.keys()].filter((id) => !parentByLeaseId?.[id] || !indexed.has(parentByLeaseId[id]));
+  const memo = new Map();
+  const effective = (id) => {
+    if (memo.has(id)) return memo.get(id);
+    const own = requestVector(indexed.get(id)?.request);
+    const childSum = emptyVector();
+    for (const child of children.get(id) || []) addVector(childSum, effective(child));
+    const value = Object.fromEntries(RESOURCE_KEYS.map((key) => [key, Math.max(own[key], childSum[key])])) ;
+    memo.set(id, value); return value;
+  };
+  const total = emptyAggregate();
+  for (const root of roots) { addVector(total, effective(root)); total.heavy_leases += 1; }
+  return total;
+}
+
+function indexLeases(leases) {
+  const result = new Map();
+  for (let index = 0; index < leases.length; index += 1) {
+    const lease = leases[index];
+    const id = leaseId(lease) || `__anonymous_${index}`;
+    if (result.has(id)) return null;
+    result.set(id, lease);
+  }
+  return result;
+}
+function naiveAggregate(leases) {
+  const total = emptyAggregate();
+  for (const lease of leases || []) {
+    if (lease?.request?.heavy === false) continue;
+    addVector(total, requestVector(lease?.request)); total.heavy_leases += 1;
+  }
+  return total;
+}
+function validParentForest(leases, parentByLeaseId) {
+  const ids = new Set((leases || []).map(leaseId).filter(Boolean));
+  for (const start of Object.keys(parentByLeaseId || {})) {
+    if (!ids.has(start)) continue;
+    const seen = new Set(); let current = start;
+    while (current && ids.has(current)) {
+      if (seen.has(current)) return false;
+      seen.add(current); current = parentByLeaseId[current] || null;
+    }
+  }
+  return true;
+}
+function nearestLease(parents, ownerByPid, startPid, excludedLeaseId) {
+  let pid = normalizePid(startPid); const seen = new Set();
+  for (let depth = 0; pid && depth < 2048 && !seen.has(pid); depth += 1) {
+    seen.add(pid);
+    const id = ownerByPid.get(pid);
+    if (id && id !== excludedLeaseId) return id;
+    pid = parentPid(parents, pid);
+  }
+  return null;
+}
+function leaseAncestors(parentByLeaseId, first) {
+  const result = []; const seen = new Set(); let current = first;
+  while (current && !seen.has(current)) { seen.add(current); result.push(current); current = parentByLeaseId[current] || null; }
+  return result;
+}
+function processOwnerPid(lease) { return lease?.owner?.kind === "process" ? normalizePid(lease.owner.pid) : 0; }
+function leaseId(lease) { return typeof lease?.lease_id === "string" && lease.lease_id ? lease.lease_id : null; }
+function parentPid(parents, pid) { return normalizePid(parents?.[String(pid)] ?? parents?.[pid]); }
+function normalizePid(value) { const parsed = Number(value); return Number.isInteger(parsed) && parsed > 0 ? parsed : 0; }
+function requestVector(request = {}) { return Object.fromEntries(RESOURCE_KEYS.map((key) => [key, Math.max(0, finite(request[key]))])); }
+function finite(value) { const parsed = Number(value); return Number.isFinite(parsed) ? parsed : 0; }
+function emptyVector() { return { cpu: 0, io: 0, memory_mb: 0, disk_reserve_bytes: 0 }; }
+function emptyAggregate() { return { ...emptyVector(), heavy_leases: 0 }; }
+function addVector(target, value) { for (const key of RESOURCE_KEYS) target[key] += value[key] || 0; return target; }

package/src/local/resource-light-command.mjs

@@ -0,0 +1,6 @@
+const TRUSTED_LIGHT_EXECUTABLES = new Set([
+  "/bin/echo", "/bin/false", "/bin/ps", "/bin/pwd", "/bin/sleep", "/bin/true", "/bin/uptime",
+  "/usr/bin/echo", "/usr/bin/false", "/usr/bin/ps", "/usr/bin/pwd", "/usr/bin/sleep", "/usr/bin/true", "/usr/bin/uptime",
+]);
+
+export function isTrustedLightExecutable(command) { return TRUSTED_LIGHT_EXECUTABLES.has(String(command || "")); }

package/src/local/resource-make-concurrency.mjs

@@ -0,0 +1,42 @@
+export function makeCommandJobPlan(argv, maximum = 1024) {
+  return makeTokensPlan((argv || []).slice(1).map(String), maximum, false).plan;
+}
+
+export function makeFlagsJobPlan(environment = {}, maximum = 1024) {
+  let plan = null; let jobserver = false;
+  for (const key of ["GNUMAKEFLAGS", "MAKEFLAGS"]) {
+    if (!Object.prototype.hasOwnProperty.call(environment || {}, key)) continue;
+    const tokens = words(environment[key]);
+    if (tokens[0] && !tokens[0].startsWith("-") && !tokens[0].includes("=")) tokens[0] = `-${tokens[0]}`;
+    const parsed = makeTokensPlan(tokens, maximum, true);
+    if (parsed.plan) plan = parsed.plan;
+    jobserver ||= parsed.jobserver;
+  }
+  return plan || (jobserver ? unboundedPlan(true) : null);
+}
+
+function makeTokensPlan(tokens, maximum, preserve) {
+  let plan = null; let jobserver = false;
+  for (let index = 0; index < tokens.length; index += 1) {
+    const current = tokens[index];
+    if (["-j", "--jobs"].includes(current)) {
+      const next = tokens[index + 1];
+      if (/^\d+$/.test(next || "")) { plan = numericPlan(next, maximum, preserve); index += 1; }
+      else plan = unboundedPlan(preserve);
+    } else if (current.startsWith("--jobs=")) plan = numericPlan(current.slice("--jobs=".length), maximum, preserve);
+    else if (/^-[A-Za-z]*j/.test(current)) plan = compactPlan(current, maximum, preserve);
+    if (current.startsWith("--jobserver-auth=") || current.startsWith("--jobserver-fds=")) jobserver = true;
+  }
+  return { plan, jobserver };
+}
+function compactPlan(value, maximum, preserve) {
+  const suffix = /^-[A-Za-z]*j(.*)$/.exec(value)?.[1] ?? "";
+  return suffix ? numericPlan(suffix, maximum, preserve) : unboundedPlan(preserve);
+}
+function numericPlan(value, maximum, preserve) {
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 1 && parsed <= maximum
+    ? { jobs: parsed, elastic: false, unbounded: false, preserve } : unboundedPlan(preserve);
+}
+function unboundedPlan(preserve) { return { jobs: null, elastic: false, unbounded: true, preserve }; }
+function words(value) { return String(value || "").trim().split(/\s+/).filter(Boolean); }

package/src/local/resource-maven-concurrency.mjs

@@ -0,0 +1,38 @@
+import { availableParallelism } from "node:os";
+
+export function mavenJobPlan(argv, environment = {}, maximum = 1024) {
+  const envArgs = Object.prototype.hasOwnProperty.call(environment || {}, "MAVEN_ARGS") ? words(environment.MAVEN_ARGS) : [];
+  const envValue = mavenThreadValue(["mvn", ...envArgs]);
+  if (envValue !== null) return mavenThreadPlan(envValue, maximum, true);
+  const cliValue = mavenThreadValue(argv);
+  return cliValue === null ? null : mavenThreadPlan(cliValue, maximum, false);
+}
+
+export function mavenCoreMultiplierPlan(argv, maximum = 1024) {
+  const value = mavenThreadValue(argv);
+  return value?.endsWith("C") ? multiplierPlan(value, maximum, false) : null;
+}
+
+function mavenThreadPlan(value, maximum, preserve) {
+  if (value?.endsWith("C")) return multiplierPlan(value, maximum, preserve);
+  const jobs = Number(value);
+  return Number.isSafeInteger(jobs) && jobs >= 1 && jobs <= maximum
+    ? { jobs, elastic: false, unbounded: false, preserve } : unboundedPlan(preserve);
+}
+function multiplierPlan(value, maximum, preserve) {
+  const multiplier = Number(String(value).slice(0, -1));
+  if (!Number.isFinite(multiplier) || multiplier <= 0) return unboundedPlan(preserve);
+  const jobs = Math.max(1, Math.trunc(multiplier * availableParallelism()));
+  return jobs <= maximum ? { jobs, elastic: false, unbounded: false, preserve } : unboundedPlan(preserve);
+}
+function mavenThreadValue(argv) {
+  for (let index = 1; index < (argv || []).length; index += 1) {
+    const value = String(argv[index] || "");
+    if (["-T", "--threads"].includes(value)) return String(argv[index + 1] || "").trim();
+    if (value.startsWith("--threads=")) return value.slice("--threads=".length).trim();
+    if (value.startsWith("-T") && value.length > 2) return value.slice(2).trim();
+  }
+  return null;
+}
+function unboundedPlan(preserve = false) { return { jobs: null, elastic: false, unbounded: true, preserve }; }
+function words(value) { return String(value || "").trim().split(/\s+/).filter(Boolean); }

package/src/local/resource-ninja-command-concurrency.mjs

@@ -0,0 +1,20 @@
+const NINJA_INT_MAX = 2_147_483_647;
+
+export function ninjaCommandJobPlan(argv, maximum = 1024) {
+  let plan = null;
+  for (let index = 1; index < (argv || []).length; index += 1) {
+    const value = String(argv[index] || ""); if (value === "--" || value === "-t" || value.startsWith("-t")) break;
+    if (value === "-j") { plan = ninjaNumericPlan(argv[index + 1], maximum); index += 1; }
+    else if (value.startsWith("-j") && value.length > 2) plan = ninjaNumericPlan(value.slice(2), maximum);
+    else if (value === "--jobs" || value.startsWith("--jobs=")) return invalidPlan();
+    if (plan?.invalid) return plan;
+  }
+  return plan;
+}
+function ninjaNumericPlan(value, maximum) {
+  const text = String(value ?? ""); if (!/^\d+$/.test(text)) return invalidPlan();
+  const parsed = Number(text); if (!Number.isSafeInteger(parsed) || parsed === 0 || parsed >= NINJA_INT_MAX || parsed > maximum) return unboundedPlan();
+  return { jobs: parsed, elastic: false, unbounded: false, preserve: false };
+}
+function invalidPlan() { return { jobs: null, elastic: false, unbounded: false, preserve: false, invalid: true }; }
+function unboundedPlan() { return { jobs: null, elastic: false, unbounded: true, preserve: false }; }

package/src/local/resource-ninja-concurrency.mjs

@@ -0,0 +1,28 @@
+export function ninjaJobserverPlan(argv, environment = {}, _maximum = 1024, platform = process.platform) {
+  if ((argv || []).slice(1).some((value) => String(value) === "-n")) return null;
+  if (!Object.prototype.hasOwnProperty.call(environment || {}, "MAKEFLAGS")) return null;
+  const flags = String(environment.MAKEFLAGS || "");
+  return validNinjaJobserver(flags, platform) ? cooperativePlan() : null;
+}
+
+function validNinjaJobserver(flags, platform) {
+  const args = String(flags).trim().split(/\s+/).filter(Boolean);
+  if (args[0] && !args[0].startsWith("-") && args[0].includes("n")) return false;
+  let mode = null; let resource = "";
+  for (const arg of args) {
+    if (arg.startsWith("--jobserver-auth=")) [mode, resource] = authMode(arg.slice("--jobserver-auth=".length));
+    else if (arg.startsWith("--jobserver-fds=")) {
+      const pair = descriptorPair(arg.slice("--jobserver-fds=".length)); if (pair === null) return false;
+      mode = pair ? "pipe" : "none"; resource = "";
+    }
+  }
+  return platform === "win32" ? mode === "semaphore" && resource.length > 0 : mode === "fifo" && resource.length > 0;
+}
+function authMode(value) {
+  const pair = descriptorPair(value); if (pair !== null) return [pair ? "pipe" : "none", ""];
+  return value.startsWith("fifo:") ? ["fifo", value.slice(5)] : ["semaphore", value];
+}
+function descriptorPair(value) {
+  const match = /^(-?\d+),(-?\d+)/.exec(value); return match ? Number(match[1]) >= 0 && Number(match[2]) >= 0 : null;
+}
+function cooperativePlan() { return { jobs: null, elastic: false, unbounded: true, preserve: true }; }

package/src/local/resource-operations.mjs

@@ -1,37 +1,52 @@
 import { realpathSync } from "node:fs";
-import { rm } from "node:fs/promises";
 import { resolve } from "node:path";
 import { inspectResourceFile, validateResourceName } from "./managed-jobs.mjs";
-import { generateSshKeyPair } from "./ssh-key.mjs";
+import { generateSshKeyPair, removeGeneratedSshKeyPair } from "./ssh-key.mjs";
 import { acquireStartupLockWithWait, loadState, saveState } from "./state.mjs";
 
-export async function generateRegisteredSshKey({ workspace, stateDir, name: rawName, targetPath, comment = "" }) {
+export async function generateRegisteredSshKey(
+  { workspace, stateDir, name: rawName, targetPath, comment = "" },
+  options = {},
+) {
   const name = validateResourceName(rawName);
   if (typeof targetPath !== "string" || !targetPath.trim()) throw new Error("SSH private key target path is required");
   const target = resolve(targetPath);
-  const state = loadState(workspace, { stateDir });
-  const lock = await acquireStartupLockWithWait(state, { operation: "generate-ssh-key" });
+  const loadStateFn = options.loadState || loadState;
+  const acquireLockFn = options.acquireStartupLockWithWait || acquireStartupLockWithWait;
+  const generateKeyFn = options.generateSshKeyPair || generateSshKeyPair;
+  const inspectResourceFn = options.inspectResourceFile || inspectResourceFile;
+  const saveStateFn = options.saveState || saveState;
+  const rollbackKeyFn = options.removeGeneratedSshKeyPair || removeGeneratedSshKeyPair;
+  const lockState = loadStateFn(workspace, { stateDir });
+  const lock = await acquireLockFn(lockState, { operation: "generate-ssh-key" });
   let key = null;
   try {
+    const state = loadStateFn(workspace, { stateDir });
     state.resources ||= {};
     const existing = Object.hasOwn(state.resources, name) ? state.resources[name] : null;
     if (existing?.path && !samePathIdentity(existing.path, target)) {
       throw new Error(`local resource ${name} is already registered to a different file; remove it first`);
     }
     if (!existing && Object.keys(state.resources).length >= 64) throw new Error("local resource registry limit reached (64)");
-    key = await generateSshKeyPair({
+    key = await generateKeyFn({
       privateKeyPath: target,
       type: "ed25519",
       comment: comment || `machine-mcp:${name}`,
     });
-    const inspected = inspectResourceFile(key.privateKeyPath);
+    const inspected = inspectResourceFn(key.privateKeyPath);
     state.resources[name] = inspected;
     try {
-      saveState(state);
+      saveStateFn(state);
     } catch (error) {
       if (key.created) {
-        await rm(key.privateKeyPath, { force: true }).catch(() => {});
-        await rm(key.publicKeyPath, { force: true }).catch(() => {});
+        try {
+          await rollbackKeyFn(key);
+        } catch (cleanupError) {
+          throw new AggregateError(
+            [error, cleanupError],
+            "SSH key registration failed and generated-key rollback was incomplete",
+          );
+        }
       }
       throw error;
     }
@@ -53,6 +68,7 @@ export async function generateRegisteredSshKey({ workspace, stateDir, name: rawN
   }
 }
 
+
 function samePathIdentity(left, right) {
   const a = canonicalIfExisting(left);
   const b = canonicalIfExisting(right);

package/src/local/resource-pressure.mjs

@@ -0,0 +1,67 @@
+import { resourceDiskHardFloorBytes, resourceDiskSoftFloorBytes } from "./resource-disk-headroom.mjs";
+
+export function resourcePressureState(host, used) {
+  const cores = Math.max(1, Number(host?.cpu_cores) || 1);
+  const reasons = [];
+  const criticalReasons = [];
+  let level = 0;
+  const mark = (next, reason) => {
+    if (next > level) level = next;
+    reasons.push(reason);
+    if (next === 2) criticalReasons.push(reason);
+  };
+  if (host?.thermal_warning === true) mark(2, "thermal_warning");
+  thresholdPressure(optionalResourceNumber(host?.memory_free_percent), { critical: 8, warning: 18, lowerIsWorse: true }, mark, "memory_pressure");
+  thresholdPressure(optionalResourceNumber(host?.disk_mb_per_s), { critical: 220, warning: 100 }, mark, "disk_throughput");
+  thresholdPressure(optionalResourceNumber(host?.disk_iops), { critical: 5000, warning: 2500 }, mark, "disk_iops");
+  thresholdPressure(optionalResourceNumber(host?.pageouts_per_s), { critical: 1024, warning: 256 }, mark, "pageout_rate");
+  thresholdPressure(optionalResourceNumber(host?.swapouts_per_s), { critical: 512, warning: 128 }, mark, "swapout_rate");
+  markDiskHeadroom(host, mark);
+  markPsiPressure(host, mark);
+  markCpuLoadPressure(host, cores, mark);
+  if (used.heavy_leases > cores * 2) mark(1, "heavy_root_count");
+  return { state: level === 2 ? "red" : level === 1 ? "yellow" : "green", reasons, critical_reasons: criticalReasons };
+}
+
+export function optionalResourceNumber(value) {
+  if (value === null || value === undefined || value === "") return null;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function markDiskHeadroom(host, mark) {
+  const free = optionalResourceNumber(host?.disk_free_bytes); const total = optionalResourceNumber(host?.disk_total_bytes);
+  if (free === null || total === null || total <= 0) return;
+  const hardFloor = resourceDiskHardFloorBytes(total); const softFloor = resourceDiskSoftFloorBytes(total);
+  if (free < hardFloor) mark(2, "disk_free_headroom_critical");
+  else if (free < softFloor) mark(1, "disk_free_headroom");
+}
+
+function markPsiPressure(host, mark) {
+  const memoryFull = optionalResourceNumber(host?.psi_memory_full_avg10);
+  thresholdPressure(memoryFull, { critical: 60, warning: 10 }, mark, "psi_memory_full");
+  for (const [value, reason] of [
+    [host?.psi_cpu_some_avg10, "psi_cpu_some"], [host?.psi_memory_some_avg10, "psi_memory_some"],
+    [host?.psi_io_some_avg10, "psi_io_some"], [host?.psi_io_full_avg10, "psi_io_full"],
+  ]) if ((optionalResourceNumber(value) ?? 0) >= 10) mark(1, reason);
+}
+
+function markCpuLoadPressure(host, cores, mark) {
+  const cpu = optionalResourceNumber(host?.cpu_busy_cores); const load = optionalResourceNumber(host?.load1);
+  const ioMb = optionalResourceNumber(host?.disk_mb_per_s); const iops = optionalResourceNumber(host?.disk_iops);
+  if (cpu !== null && cpu >= cores * 0.9) mark(1, "cpu_busy");
+  if (load === null) return;
+  const psiBacklog = [host?.psi_cpu_some_avg10, host?.psi_memory_some_avg10, host?.psi_io_some_avg10, host?.psi_io_full_avg10]
+    .some((value) => (optionalResourceNumber(value) ?? 0) >= 10);
+  const corroborated = (cpu ?? 0) >= cores * 0.70 || (ioMb ?? 0) >= 50 || (iops ?? 0) >= 1250 || psiBacklog;
+  if (load >= cores * 1.25 && (host?.platform !== "darwin" || corroborated)) mark(1, "load_backlog");
+  if (load >= cores * 2 && ((cpu ?? 0) >= cores * 0.75 || (ioMb ?? 0) >= 100 || (iops ?? 0) >= 2500)) mark(2, "load_backlog_critical");
+}
+
+function thresholdPressure(value, thresholds, mark, label) {
+  if (value === null) return;
+  const critical = thresholds.lowerIsWorse ? value < thresholds.critical : value >= thresholds.critical;
+  if (critical) { mark(2, `${label}_critical`); return; }
+  const warning = thresholds.lowerIsWorse ? value < thresholds.warning : value >= thresholds.warning;
+  if (warning) mark(1, label);
+}

package/src/local/resource-probe-command.mjs

@@ -0,0 +1,35 @@
+import { execFile, spawnSync } from "node:child_process";
+
+export function runResourceProbeSync(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    timeout: positive(options.timeoutMs, 2_500),
+    killSignal: "SIGKILL",
+    maxBuffer: positive(options.maxOutputBytes, 256 * 1024),
+    windowsHide: true,
+    env: probeEnvironment(),
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  return { ok: !result.error && result.status === 0, stdout: String(result.stdout || "") };
+}
+
+export function runResourceProbeAsync(command, args, options = {}) {
+  return new Promise((resolvePromise) => {
+    execFile(command, args, {
+      encoding: "utf8",
+      timeout: positive(options.timeoutMs, 2_500),
+      killSignal: "SIGKILL",
+      maxBuffer: positive(options.maxOutputBytes, 256 * 1024),
+      windowsHide: true,
+      env: probeEnvironment(),
+    }, (error, stdout) => resolvePromise({ ok: !error, stdout: String(stdout || "") }));
+  });
+}
+
+function probeEnvironment() {
+  return process.platform === "win32" ? process.env : { ...process.env, LC_ALL: "C", LANG: "C" };
+}
+function positive(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}

package/src/local/resource-process-admission.mjs

@@ -0,0 +1,59 @@
+import { applyResourceProfileEnv, resourceCommandEffectiveCwd, resourceCommandProfile } from "./resource-command-profile.mjs";
+import { ResourceAdmissionError } from "./resource-admission.mjs";
+import { BridgeError } from "./errors.mjs";
+import { prepareResourceBuildCommand } from "./resource-build-root.mjs";
+import { applyResourceProcessPriority } from "./resource-process-priority.mjs";
+import { releaseControlWorkspaceForCommand } from "./resource-release-control-workspace.mjs";
+export async function acquireProcessResources(coordinator, command, args, environment, options = {}) {
+  if (!coordinator) return { lease: null, environment, request: null, command, args };
+  const request = resourceCommandProfile(command, args, { priority: options.priority, environment, releaseControlWorkspace: await releaseControlWorkspaceForCommand(command, args, options.cwd, environment) });
+  const resourceCwd = resourceCommandEffectiveCwd(command, args, options.cwd, request);
+  let lease;
+  try {
+    lease = await coordinator.acquire(request, {
+      cwd: resourceCwd,
+      waitMs: options.waitMs,
+      signal: options.signal,
+      cancelCheck: options.cancelCheck,
+    });
+  } catch (error) {
+    const coordinatorBusy = ["MBM_RESOURCE_TRANSACTION_BUSY", "MBM_RESOURCE_STAGING_BUSY"].includes(error?.code);
+    if (!(error instanceof ResourceAdmissionError) && !coordinatorBusy) throw error;
+    const decision = error instanceof ResourceAdmissionError ? error.decision : { state: "unknown", reason: "coordinator_busy" };
+    const retryable = error instanceof ResourceAdmissionError ? error.retryable !== false : true;
+    const message = retryable ? "local heavy-resource capacity is temporarily unavailable" : "local heavy-resource request exceeds the configured launch capacity; reduce explicit parallelism or resource demand";
+    throw new BridgeError("unavailable", message, {
+      retryable,
+      details: {
+        reason: "resource_admission",
+        pressure_state: decision?.state || "unknown",
+        admission_reason: decision?.reason || "resource_busy",
+      },
+    });
+  }
+  const effectiveRequest = lease?.request ? { ...request, ...lease.request } : request;
+  try {
+    const buildRoot = environment?.AGENT_BUILD_ROOT || process.env.AGENT_BUILD_ROOT || "";
+    const prepared = prepareResourceBuildCommand(
+      command, args, applyResourceProfileEnv(environment, effectiveRequest), effectiveRequest, resourceCwd,
+      buildRoot ? { root: buildRoot } : {},
+    );
+    const prioritized = applyResourceProcessPriority(prepared.command, prepared.args, effectiveRequest);
+    return { lease, request: effectiveRequest, ...prepared, ...prioritized };
+  } catch (error) {
+    await releaseProcessResources(lease);
+    throw error;
+  }
+}
+export function bindProcessResources(lease, child) {
+  return lease?.bindProcess?.(child, { processGroupIsolated: process.platform !== "win32" }) ?? Promise.resolve();
+}
+
+export function releaseProcessResources(lease) {
+  return lease?.release?.() ?? Promise.resolve(false);
+}
+
+export async function releaseProcessResourcesQuietly(lease) {
+  try { return await releaseProcessResources(lease); }
+  catch { return false; }
+}