machine-bridge-mcp 3.0.0-beta.21 → 3.0.0-beta.26

package/src/local/cli.mjs

@@ -29,6 +29,7 @@ import { workerHealth } from "./worker-health.mjs";
 export { workerHealthUserReason } from "./worker-health.mjs";
 import { activeStateJobs, activeStateLocks, knownProfileStates, knownWorkerNames } from "./state-inventory.mjs";
 import {
+  acquireMachineServiceLockWithWait,
   acquireMaintenanceLock,
   acquireStartupLockWithWait,
   daemonLockPathForState,
@@ -54,7 +55,7 @@ import {
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
 const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
 const approvalCommand = createApprovalCommand({ chooseWorkspace, confirm });
-const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger });
+const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger, acquireMachineServiceLockWithWait, currentPackageVersion });
 const activateCommand = createActivateCommand({
   chooseWorkspace,
   prepareRemoteState,
@@ -190,9 +191,12 @@ async function startCommand(args) {
     const serviceEnvironment = loadServiceEnvironment(state.paths.stateRoot);
     logger.debug?.("Loaded persisted service network environment", { keys: serviceEnvironment.keys });
   }
-  const startupLock = await acquireStartupLockWithWait(state, { operation: "start", logger });
+  let startupLock = null;
+  let serviceLock = null;
 
   try {
+    serviceLock = await acquireRuntimeStartServiceLock(args, acquireMachineServiceLockWithWait, logger);
+    startupLock = await acquireStartupLockWithWait(state, { operation: "start", logger });
     const startMode = await prepareStartMode(args, state, logger);
     const daemonLock = await acquireDaemonLockWithTakeover(state, {
       takeOverServiceOwner: startMode.takeOverServiceOwner,
@@ -206,9 +210,12 @@ async function startCommand(args) {
       reportExistingDaemon(args, state, daemonLock.owner, logger);
       return;
     }
+    serviceLock?.release?.();
+    serviceLock = null;
     await startRemoteRuntime({ args, workspace, state, daemonLock, logger });
   } finally {
-    startupLock.release();
+    serviceLock?.release?.();
+    startupLock?.release?.();
   }
 }
 
@@ -264,6 +271,20 @@ function reportExistingDaemon(args, state, owner, logger) {
   logger.plain(`  Workspace: ${state.workspace.path}`);
 }
 
+export function runtimeStartRequiresMachineServiceLock(args = {}) {
+  return args.daemonOnly !== true;
+}
+
+export async function acquireRuntimeStartServiceLock(args = {}, acquireLock = acquireMachineServiceLockWithWait, logger = console) {
+  if (!runtimeStartRequiresMachineServiceLock(args)) return null;
+  if (typeof acquireLock !== "function") throw new TypeError("runtime start requires a machine-service lock acquirer");
+  const lock = await acquireLock({ operation: "runtime-start", logger });
+  if (!lock?.acquired || typeof lock.release !== "function") {
+    throw new Error("machine-service operation lock could not be acquired for runtime start");
+  }
+  return lock;
+}
+
 export function isIdempotentDaemonOnlyStart(args) {
   if (!args.daemonOnly || args.json) return false;
   return !Boolean(
@@ -286,18 +307,39 @@ async function startRemoteRuntime({ args, workspace, state, daemonLock, logger }
     const readiness = await prepareRemoteState({ args, workspace, state, logger });
     runtime = createRemoteRuntime({ args, workspace, state, daemonLock, deviceSessionIdentity: readiness.deviceSessionIdentity });
     await runtime.start();
+    if (typeof daemonLock.update !== "function") throw new Error("daemon lock cannot publish startup readiness");
+    daemonLock.update({ startupReady: true, startupReadyAt: new Date().toISOString() });
     reportRemoteReady(args, state, readiness, logger);
+    if (args.daemonOnly) {
+      const { startAutostartLogMaintenance } = await import("./autostart-log-maintenance.mjs");
+      startAutostartLogMaintenance(state.paths.stateRoot, {
+        onError(error) {
+          logger.event?.("warn", "service.log_maintenance.failed", {
+            error_class: classifyOperationalError(error),
+          }, "Background log maintenance failed");
+        },
+      });
+    }
     keepProcessAlive({ daemon: runtime, lock: daemonLock, logger });
   } catch (error) {
-    try { runtime?.stop?.(); } catch {}
-    daemonLock.release();
-    throw error;
+    throw cleanupRuntimeStartFailure(error, runtime, daemonLock);
   }
 }
 
-async function prepareRemoteState({ args, workspace, state, logger }) {
+export function cleanupRuntimeStartFailure(error, runtime, daemonLock) {
+  const cleanupErrors = [];
+  try { runtime?.stop?.(); } catch (failure) { cleanupErrors.push(failure); }
+  try { daemonLock?.release?.(); } catch (failure) { cleanupErrors.push(failure); }
+  return cleanupErrors.length
+    ? new AggregateError([error, ...cleanupErrors],
+      "runtime startup failed and local cleanup was incomplete")
+    : error;
+}
+
+async function prepareRemoteState({ args, workspace, state, logger, onRemotePrepared }) {
   if (!args.daemonOnly) {
     await convergeRemoteConfiguration({ args, state });
+    onRemotePrepared?.();
   } else if (!state.worker.url) {
     throw new Error("--daemon-only requires an existing Worker URL; run start once without --daemon-only");
   } else if (state.worker.pendingDeviceIdentity) {
@@ -579,8 +621,11 @@ async function rotateSecretsCommand(args) {
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: false, save: false, allowPositional: true });
   const state = loadState(workspace, { stateDir: args.stateDir });
   const operationLogger = createLogger({ level: args.quiet ? "error" : "warn", component: "service" });
-  const startupLock = await acquireStartupLockWithWait(state, { operation: "rotate-secrets", logger: operationLogger });
+  let startupLock = null;
+  let serviceLock = null;
   try {
+    serviceLock = await acquireMachineServiceLockWithWait({ operation: "rotate-secrets", logger: operationLogger });
+    startupLock = await acquireStartupLockWithWait(state, { operation: "rotate-secrets", logger: operationLogger });
     await stopOwnedPlatformService({
       state,
       inspectWorkspaceDaemon,
@@ -610,14 +655,15 @@ async function rotateSecretsCommand(args) {
     console.log("Prepared a two-phase rotation for account administration, device root, and token-version secrets.");
     console.log("All account access tokens are invalid. Run machine-mcp to deploy, verify, and atomically promote the pending device root.");
   } finally {
-    startupLock.release();
+    startupLock?.release?.();
+    serviceLock?.release?.();
   }
 }
 
 async function installAutostartBestEffort({ workspace, stateRoot, entryScript, logger }) {
   try {
     const { installAutostart } = await import("./service.mjs");
-    const result = await installAutostart({ workspace, stateRoot, entryScript, logger: structuredLogger(true) });
+    const result = await installAutostart({ workspace, stateRoot, entryScript, version: currentPackageVersion(), logger: structuredLogger(true) });
     if (result?.ok) logger.info("Autostart installed for future logins", { provider: result.provider });
     else logger.warn("Autostart installation reported a problem; run `machine-mcp service status` for details", {
       provider: result?.provider || "unknown",
@@ -662,7 +708,9 @@ async function uninstallCommand(args) {
     const pid = maintenance.owner?.pid ? `pid ${maintenance.owner.pid}` : "another process";
     throw new Error(`another state maintenance operation is active (${pid})`);
   }
+  let serviceLock = null;
   try {
+    serviceLock = await acquireMachineServiceLockWithWait({ operation: "uninstall" });
     if (currentValidation.exists) validateStateRootForRemoval(stateRoot);
     assertNoActiveJobsForUninstall(stateRoot);
     const autostartRemoved = await removeAutostartBestEffort(stateRoot);
@@ -679,6 +727,7 @@ async function uninstallCommand(args) {
     console.log("If installed globally, remove the npm package with:");
     console.log("  npm uninstall -g machine-bridge-mcp");
   } finally {
+    serviceLock?.release?.();
     maintenance?.release?.();
   }
 }

package/src/local/daemon-process.mjs

@@ -1,3 +1,4 @@
+import { realpathSync } from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import {
@@ -171,18 +172,27 @@ export function workspaceDaemonOwnsPlatformAutostart(status = {}) {
     && status.mode === "service";
 }
 
-export function inspectWorkspaceDaemon(state) {
+export function inspectWorkspaceDaemon(state, options = {}) {
   const owner = readDaemonLockOwner(daemonLockPathForState(state));
-  if (!owner) return { present: false, alive: false, verified_service_daemon: false };
+  if (!owner) return { present: false, alive: false, verified_service_daemon: false, startup_readiness_verified: false };
   const alive = Boolean(owner.pid && isPidAlive(owner.pid));
-  const identity = alive
+  let identity = alive
     ? inspectWorkspaceDaemonOwner(state, owner)
     : { verified_service_daemon: false, reason: "stale_lock" };
+  if (identity.verified_service_daemon && options.expectedVersion
+      && owner.version !== options.expectedVersion) {
+    identity = { verified_service_daemon: false, reason: "version_mismatch" };
+  }
+  if (identity.verified_service_daemon && options.expectedEntryScript
+      && !sameCanonicalFile(owner.entryScript, options.expectedEntryScript)) {
+    identity = { verified_service_daemon: false, reason: "entrypoint_mismatch" };
+  }
   return {
     present: true,
     alive,
     verified_service_daemon: identity.verified_service_daemon,
     identity_reason: identity.reason,
+    startup_readiness_verified: identity.verified_service_daemon && owner.startupReady === true,
     ...publicDaemonOwner(owner),
   };
 }
@@ -239,6 +249,17 @@ function sameCanonicalPath(left, right) {
   }
 }
 
+function sameCanonicalFile(left, right) {
+  if (typeof left !== "string" || typeof right !== "string") return false;
+  try {
+    const a = realpathSync(left);
+    const b = realpathSync(right);
+    return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+  } catch {
+    return false;
+  }
+}
+
 function publicDaemonOwner(owner) {
   return {
     pid: Number(owner?.pid) || null,

package/src/local/delegated-process-sandbox.mjs

@@ -87,6 +87,7 @@ export function probeMacosDelegatedSandbox(options = {}) {
     const execute = (argv) => run(MACOS_SANDBOX_EXEC, ["-p", profile, ...argv], {
       encoding: "utf8",
       timeout: 5_000,
+      killSignal: "SIGKILL",
       maxBuffer: 64 * 1024,
       windowsHide: true,
       env: { PATH: "/usr/bin:/bin:/usr/sbin:/sbin", HOME: workspace, TMPDIR: runtimeDir, LANG: "C", LC_ALL: "C" },

package/src/local/execution-routing.mjs

@@ -0,0 +1,231 @@
+// @ts-check
+
+import { relevanceScore } from "./capability-ranking.mjs";
+import { toolDefinition, toolNamesForPolicy } from "./policy.mjs";
+
+const MAX_ROUTES = 6;
+const MAX_RANKED_TOOLS = 12;
+const MAX_RECOMMENDED_TOOLS = 18;
+
+const ROUTES = Object.freeze([
+  route("guided-workflow", "Guided workflow", [
+    "load_local_skill", "agent_context", "list_local_skills",
+  ], "Use a project or user skill when a repeatable domain workflow already exists.", [
+    "skill", "workflow", "instructions", "playbook", "guide", "技能", "工作流", "规范", "流程",
+  ]),
+  route("registered-command", "Registered command", [
+    "run_local_command", "list_local_commands",
+  ], "Use a fixed argv/cwd command when the repository already defines the operation.", [
+    "package script", "registered command", "repeatable command", "npm script", "构建脚本", "项目命令", "重复执行",
+  ]),
+  route("shell", "Direct shell", [
+    "exec_command", "run_process",
+  ], "Use Bash or direct argv for efficient ad hoc composition, investigation, and ordinary CLI work. This remains the general escape hatch and is not sandboxed.", [
+    "bash", "shell", "terminal", "cli", "command", "script", "debug", "diagnose", "benchmark", "audit", "probe",
+    "命令", "终端", "脚本", "排查", "调试", "基准", "审查", "测试", "构建",
+  ]),
+  route("process-session", "Interactive process", [
+    "start_process", "read_process", "write_process", "kill_process",
+  ], "Use a retained process session for interactive stdin, incremental output, servers, watchers, and REPL-style work.", [
+    "interactive", "stdin", "repl", "watch", "tail", "stream output", "dev server", "long output", "交互", "实时日志", "输入", "常驻进程",
+  ]),
+  route("managed-job", "Durable managed job", [
+    "stage_job", "start_job", "read_job", "list_jobs", "cancel_job",
+  ], "Use a durable job for long-running or multi-step work that must survive relay interruption and still attempt cleanup.", [
+    "background", "detached", "durable", "long running", "resume", "cleanup", "finally", "overnight", "continuous", "retry",
+    "后台", "持久", "断线", "恢复", "清理", "长时间", "持续", "重试", "多步骤",
+  ]),
+  route("workspace-edit", "Workspace files", [
+    "search_text", "read_file", "list_files", "list_dir", "edit_file", "apply_patch", "write_file", "view_image",
+  ], "Use bounded structured file operations for inspection and precise repository edits; combine with shell when a CLI is more efficient.", [
+    "file", "source", "code", "edit", "write", "patch", "refactor", "search", "inspect", "repository",
+    "文件", "源码", "代码", "修改", "写入", "补丁", "重构", "搜索", "仓库",
+  ]),
+  route("git-review", "Git inspection", [
+    "git_status", "git_diff", "git_log", "git_show",
+  ], "Use Git-specific read surfaces for bounded status, diffs, history, and revision inspection.", [
+    "git", "commit", "diff", "branch", "history", "revision", "提交", "分支", "差异", "历史", "版本",
+  ]),
+  route("browser", "Existing browser profile", [
+    "browser_status", "browser_list_tabs", "browser_manage_tabs", "browser_get_source", "browser_inspect_page",
+    "browser_wait", "browser_action", "browser_fill_form", "browser_screenshot", "browser_upload_files",
+  ], "Use the paired daily browser for authenticated websites, complex forms, DOM inspection, and actions that depend on the user's existing session.", [
+    "browser", "website", "web page", "tab", "dom", "form", "login", "authenticated", "chrome", "网页", "浏览器", "网站", "标签页", "表单", "登录",
+  ]),
+  route("application", "Desktop application", [
+    "list_local_applications", "open_local_application", "inspect_local_application", "operate_local_application",
+  ], "Use structured desktop automation for installed applications and macOS Accessibility surfaces.", [
+    "application", "desktop", "gui", "window", "accessibility", "mac app", "应用", "桌面", "界面", "窗口", "软件",
+  ]),
+  route("protected-resource", "Protected local resource", [
+    "list_local_resources", "generate_ssh_key_resource",
+  ], "Use registered resource aliases for secrets or files that should not be copied into MCP arguments.", [
+    "credential", "secret", "token", "private key", "ssh key", "password", "resource alias", "凭据", "密钥", "令牌", "密码", "资源别名",
+  ]),
+  route("diagnostics", "Runtime diagnostics", [
+    "server_info", "project_overview", "diagnose_runtime",
+  ], "Use fixed diagnostics to distinguish authorization, relay, filesystem, process, shell, and runtime failures.", [
+    "status", "health", "diagnose", "runtime", "relay", "policy", "authorization", "状态", "健康", "诊断", "运行时", "权限", "连接",
+  ]),
+]);
+
+const ROUTE_FALLBACKS = Object.freeze({
+  "guided-workflow": ["registered-command", "shell"],
+  "registered-command": ["shell", "process-session"],
+  shell: ["process-session", "managed-job"],
+  "process-session": ["shell", "managed-job"],
+  "managed-job": ["process-session", "shell"],
+  "workspace-edit": ["shell", "git-review"],
+  "git-review": ["workspace-edit", "shell"],
+  browser: ["diagnostics", "shell"],
+  application: ["diagnostics", "shell"],
+  "protected-resource": ["diagnostics"],
+  diagnostics: ["shell"],
+});
+
+/**
+ * Build advisory, set-level routing for the current task. It never hides tools,
+ * changes policy, or makes shell execution conditional on the recommendation.
+ * @param {unknown} task
+ * @param {{
+ *   policy?: Record<string, unknown>,
+ *   seedTools?: unknown[],
+ *   commandRelevant?: boolean,
+ *   skillRelevant?: boolean,
+ *   applicationMatches?: unknown[],
+ *   browserAvailable?: boolean,
+ * }} [options]
+ */
+export function buildExecutionRouting(task, options = {}) {
+  const text = String(task || "");
+  const availableNames = new Set(toolNamesForPolicy(options.policy || {}));
+  const toolScores = [...availableNames]
+    .map((name) => toolDefinition(name))
+    .filter(Boolean)
+    .map((tool) => ({
+      tool: String(tool.name),
+      score: relevanceScore(text, `${tool.title || ""} ${tool.description || ""}`, tool.name),
+    }))
+    .filter((item) => item.score > 0)
+    .sort((left, right) => right.score - left.score || left.tool.localeCompare(right.tool));
+  const scoreByTool = new Map(toolScores.map((item) => [item.tool, item.score]));
+
+  const scoredRoutes = ROUTES
+    .map((definition) => scoreRoute(definition, text, availableNames, scoreByTool, options))
+    .filter(Boolean)
+    .sort((left, right) => right.score - left.score || left.id.localeCompare(right.id));
+
+  if (!scoredRoutes.length) {
+    const fallback = ROUTES.find((item) => item.id === "shell" && item.tools.some((tool) => availableNames.has(tool)))
+      || ROUTES.find((item) => item.id === "diagnostics" && item.tools.some((tool) => availableNames.has(tool)));
+    if (fallback) scoredRoutes.push(scoreRoute(fallback, text, availableNames, scoreByTool, options, 1));
+  }
+
+  const routes = scoredRoutes.slice(0, MAX_ROUTES);
+  const availableRouteIds = new Set(ROUTES
+    .filter((definition) => definition.tools.some((tool) => availableNames.has(tool)))
+    .map((definition) => definition.id));
+  const primary = routes[0] || null;
+  const second = routes[1] || null;
+  const scoreGap = primary && second ? primary.score - second.score : primary ? primary.score : 0;
+  const ambiguity = !primary
+    ? "none"
+    : second && scoreGap <= 2
+      ? "high"
+      : second && scoreGap <= 5
+        ? "medium"
+        : "low";
+
+  const recommendedTools = unique([
+    ...routes.slice(0, 3).flatMap((item) => item.tools.slice(0, 5)),
+    ...(Array.isArray(options.seedTools) ? options.seedTools : []),
+    ...toolScores.slice(0, MAX_RANKED_TOOLS).map((item) => item.tool),
+  ]).filter((tool) => availableNames.has(tool)).slice(0, MAX_RECOMMENDED_TOOLS);
+
+  return {
+    schema_version: 1,
+    strategy: "set-level advisory routing with direct shell retained as a general escape hatch",
+    score_semantics: "deterministic relative ranking within this response; scores are not probabilities and are not comparable across versions",
+    policy_effective_tool_count: availableNames.size,
+    primary_route: primary ? publicRoute(primary, availableRouteIds) : null,
+    routes: routes.map((routeValue) => publicRoute(routeValue, availableRouteIds)),
+    ranked_tools: toolScores.slice(0, MAX_RANKED_TOOLS),
+    ambiguity: {
+      level: ambiguity,
+      score_gap: scoreGap,
+      competing_routes: ambiguity === "none" ? [] : routes.slice(0, ambiguity === "high" ? 3 : 2).map((item) => item.id),
+    },
+    recommended_tools: recommendedTools,
+    recovery_guidance: [
+      "Diagnose policy, relay, or runtime failures before changing execution surfaces.",
+      "After an ambiguous mutation failure, inspect stable state before retrying; do not assume the side effect did not occur.",
+      "A fallback route is an alternative execution surface, not permission to bypass host or effective-policy denial.",
+    ],
+    enforcement: "advisory_only; the MCP host may choose any tool allowed by the effective policy",
+  };
+}
+
+function route(id, title, tools, guidance, keywords) {
+  return Object.freeze({ id, title, tools: Object.freeze(tools), guidance, keywords: Object.freeze(keywords) });
+}
+
+function scoreRoute(definition, task, availableNames, scoreByTool, options, fallbackScore = 0) {
+  const tools = definition.tools.filter((tool) => availableNames.has(tool));
+  if (!tools.length) return null;
+  let score = relevanceScore(task, `${definition.title} ${definition.guidance} ${definition.keywords.join(" ")}`, definition.id);
+  const reasons = [];
+  const boost = dynamicBoost(definition.id, task, options);
+  score += boost.score;
+  reasons.push(...boost.reasons);
+  const memberScores = tools.map((tool) => scoreByTool.get(tool) || 0).sort((left, right) => right - left);
+  score += Math.min(6, (memberScores[0] || 0) + Math.floor((memberScores[1] || 0) / 2));
+  if (definition.id === "shell") {
+    score += 2;
+    reasons.push("general_escape_hatch_available");
+  }
+  score = Math.max(score, fallbackScore);
+  if (score <= 0) return null;
+  return {
+    id: definition.id,
+    title: definition.title,
+    score,
+    tools,
+    guidance: definition.guidance,
+    reasons: unique(reasons),
+  };
+}
+
+function dynamicBoost(id, task, options) {
+  const lower = String(task || "").toLowerCase();
+  const reasons = [];
+  let score = 0;
+  const add = (amount, reason) => { score += amount; reasons.push(reason); };
+  if (id === "guided-workflow" && options.skillRelevant === true) add(18, "relevant_skill_found");
+  if (id === "registered-command" && options.commandRelevant === true) add(20, "relevant_registered_command_found");
+  if (id === "application" && Array.isArray(options.applicationMatches) && options.applicationMatches.length > 0) add(20, "installed_application_match");
+  if (id === "browser" && options.browserAvailable === true && /browser|chrome|edge|brave|网页|浏览器|表单|网站|登录/.test(lower)) add(14, "browser_intent");
+  if (id === "managed-job" && /background|detached|durable|long[- ]?running|resume|cleanup|finally|overnight|continuous|后台|持久|断线|清理|长时间|持续|重试|多步骤/.test(lower)) add(14, "durability_or_cleanup_intent");
+  if (id === "process-session" && /interactive|stdin|repl|watch|tail|stream|dev server|交互|实时日志|输入|常驻进程/.test(lower)) add(12, "interactive_process_intent");
+  if (id === "shell" && /bash|shell|terminal|cli|command|script|debug|diagnos|benchmark|audit|probe|命令|终端|脚本|排查|调试|基准|审查|测试|构建/.test(lower)) add(10, "shell_or_cli_intent");
+  if (id === "workspace-edit" && /file|source|code|edit|write|patch|refactor|repository|文件|源码|代码|修改|写入|补丁|重构|仓库/.test(lower)) add(10, "workspace_change_intent");
+  if (id === "git-review" && /git|commit|diff|branch|history|revision|提交|分支|差异|历史|版本/.test(lower)) add(12, "git_intent");
+  if (id === "protected-resource" && /credential|secret|token|private key|ssh key|password|凭据|密钥|令牌|密码/.test(lower)) add(14, "protected_data_intent");
+  if (id === "diagnostics" && /status|health|diagnos|runtime|relay|policy|authorization|状态|健康|诊断|运行时|权限|连接/.test(lower)) add(10, "runtime_diagnostic_intent");
+  return { score, reasons };
+}
+
+function publicRoute(routeValue, availableRouteIds) {
+  return {
+    id: routeValue.id,
+    title: routeValue.title,
+    score: routeValue.score,
+    tools: [...routeValue.tools],
+    guidance: routeValue.guidance,
+    reasons: [...routeValue.reasons],
+    fallback_routes: (ROUTE_FALLBACKS[routeValue.id] || []).filter((id) => availableRouteIds.has(id)),
+  };
+}
+
+function unique(values) {
+  return [...new Set(values.map((value) => String(value || "")).filter(Boolean))];
+}

package/src/local/git-service.mjs

@@ -3,6 +3,8 @@ import { dirname, isAbsolute, relative, sep } from "node:path";
 import { BridgeError } from "./errors.mjs";
 import { clampInteger } from "./numbers.mjs";
 
+export const GIT_METADATA_TIMEOUT_MS = 30_000;
+
 export class GitService {
   constructor({ resolveExistingPath, displayPath, runInternalProcess, gitExecutable, maximumBytes }) {
     this.resolveExistingPath = resolveExistingPath;
@@ -64,7 +66,7 @@ export class GitService {
     const target = await this.resolveExistingPath(inputPath, context);
     const info = await stat(target);
     const cwd = info.isDirectory() ? target : dirname(target);
-    const result = await this.runInternalProcess(this.gitExecutable(), ["-c", "core.fsmonitor=false", "-C", cwd, "rev-parse", "--show-toplevel"], 10_000, true, 512 * 1024, context);
+    const result = await this.runInternalProcess(this.gitExecutable(), ["-c", "core.fsmonitor=false", "-C", cwd, "rev-parse", "--show-toplevel"], GIT_METADATA_TIMEOUT_MS, true, 512 * 1024, context);
     if (result.code !== 0) return { ok: false, result, target };
     const root = result.stdout.trim();
     const repoRelative = relative(root, target);

package/src/local/job-runner.mjs

@@ -4,12 +4,15 @@ import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs
 import { basename, join, resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 import { executionEnv } from "./shell.mjs";
+import { childExitedBeforeTimeout, createChildProcessSettlement } from "./child-process-settlement.mjs";
 import { terminateProcessTreeWithEscalation } from "./process-tree.mjs";
-import { createExclusiveFileSync, removeOwnedJsonFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { removeOwnedJsonFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
-import { currentProcessStartTimeMs } from "./process-identity.mjs";
+import { currentProcessStartTimeMs, processState } from "./process-identity.mjs";
 import { readBoundedRegularFileSync } from "./secure-file.mjs";
 import { persistManagedJobTerminal } from "./managed-job-terminal.mjs";
+import { sanitizeLogText } from "./log.mjs";
+import { confirmRunnerClaim } from "./managed-job-runner-claim.mjs";
 
 const RESOURCE_TOKEN = /\{\{resource:([a-z][a-z0-9._-]{0,63})\}\}/g;
 const TEMP_TOKEN = /\{\{temp:([a-z][a-z0-9._-]{0,63})\}\}/g;
@@ -27,7 +30,9 @@ const jobDir = resolve(jobDirInput);
 if (!JOB_ID.test(basename(jobDir))) throw new Error("--job-dir must name a managed job directory");
 const recover = options.recover === true;
 const recoveryLockToken = typeof process.env.MBM_RECOVERY_LOCK_TOKEN === "string" ? process.env.MBM_RECOVERY_LOCK_TOKEN : "";
+const launchToken = typeof process.env.MBM_RUNNER_LAUNCH_TOKEN === "string" ? process.env.MBM_RUNNER_LAUNCH_TOKEN : "";
 delete process.env.MBM_RECOVERY_LOCK_TOKEN;
+delete process.env.MBM_RUNNER_LAUNCH_TOKEN;
 const planFile = join(jobDir, "plan.json");
 const statusFile = join(jobDir, "status.json");
 const resultFile = join(jobDir, "result.json");
@@ -57,7 +62,9 @@ for (const signal of ["SIGTERM", "SIGINT"]) {
 const initial = readJson(statusFile, MAX_STATUS_BYTES);
 assertLaunchState(initial);
 try {
-  createExclusiveFileSync(runnerPidFile, `${JSON.stringify({ pid: process.pid, processStartedAt: RUNNER_PROCESS_STARTED_AT })}\n`, { mode: 0o600 });
+  await confirmRunnerClaim({
+    file: runnerPidFile, pid: process.pid, processStartedAt: RUNNER_PROCESS_STARTED_AT, launchToken,
+  });
   if (recover) await releaseRecoveryClaim();
   const plan = readJson(planFile, 1024 * 1024);
   assertPlanIntegrity(plan, initial);
@@ -67,6 +74,7 @@ try {
   process.exitCode = 1;
 }
 
+
 async function releaseRecoveryClaim() {
   if (!/^[a-f0-9]{32}$/.test(recoveryLockToken)) throw new Error("recovery runner is missing its ownership token");
   const file = join(jobDir, "recovery.lock");
@@ -177,6 +185,9 @@ function assertPlanIntegrity(plan, status) {
 
 function recordFatalRunnerError(error) {
   const now = new Date().toISOString();
+  try {
+    process.stderr.write(`managed job runner fatal: error_class=${classifyError(error)} message=${sanitizeLogText(error?.message || error, 512)}\n`);
+  } catch {}
   let status = {};
   try { status = readJson(statusFile, MAX_STATUS_BYTES); } catch {}
   const finalStatus = recover ? "recovery_failed" : "runner_failed";
@@ -286,6 +297,14 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
     let closed = false;
     let killTimer = null;
     const timer = setTimeout(() => {
+      if (childExitedBeforeTimeout({
+        exitCode: child.exitCode,
+        signalCode: child.signalCode,
+        processState: processState(child.pid),
+      })) {
+        settlement.onExit(child.exitCode, child.signalCode);
+        return;
+      }
       timedOut = true;
       killTimer = terminateProcessTreeWithEscalation(child);
     }, timeoutMs);
@@ -308,28 +327,45 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
       stderr = next.buffer;
       stderrTruncated += next.truncated;
     });
-    child.on("error", (error) => finish(() => rejectPromise(error)));
-    child.on("close", (code, signal) => finish(() => {
-      if (cancellationAware && isCancellationRequested()) {
-        rejectPromise(new JobCancelledError());
-        return;
-      }
-      resolvePromise({
-        code: Number.isInteger(code) ? code : 1,
-        signal: signal ? String(signal) : null,
-        timedOut,
-        stdout,
-        stderr,
-        stdoutTruncated,
-        stderrTruncated,
-      });
-    }));
+    const settlement = createChildProcessSettlement({
+      readExitState: () => ({ code: child.exitCode, signal: child.signalCode }),
+      onFallback() {
+        for (const stream of [child.stdin, child.stdout, child.stderr]) {
+          try { stream?.destroy?.(); } catch {}
+        }
+        try { child.unref(); } catch {}
+      },
+      onSettle(code, signal) {
+        finish(() => {
+          if (cancellationAware && isCancellationRequested()) {
+            rejectPromise(new JobCancelledError());
+            return;
+          }
+          resolvePromise({
+            code: Number.isInteger(code) ? code : 1,
+            signal: signal ? String(signal) : null,
+            timedOut,
+            stdout,
+            stderr,
+            stdoutTruncated,
+            stderrTruncated,
+          });
+        });
+      },
+    });
+    child.on("error", (error) => {
+      settlement.cancel();
+      finish(() => rejectPromise(error));
+    });
+    child.on("exit", (code, signal) => settlement.onExit(code, signal));
+    child.on("close", (code, signal) => settlement.onClose(code, signal));
     if (input && input.length) child.stdin.end(input);
     else child.stdin.end();
 
     function finish(callback) {
       if (closed) return;
       closed = true;
+      settlement.cancel();
       clearTimeout(timer);
       if (killTimer && !timedOut) clearTimeout(killTimer);
       clearInterval(cancellationPoll);

package/src/local/macos-trust-broker.mjs

@@ -216,6 +216,7 @@ export function buildDevelopmentTrustBrokerBinary(profileDir, options = {}) {
   ], {
     encoding: "utf8",
     timeout: 120_000,
+    killSignal: "SIGKILL",
     maxBuffer: MAX_OUTPUT_BYTES,
     env: minimalEnvironment(),
   });
@@ -225,6 +226,7 @@ export function buildDevelopmentTrustBrokerBinary(profileDir, options = {}) {
   const sign = (options.spawnSync || spawnSync)("/usr/bin/codesign", ["--force", "--sign", "-", temporary], {
     encoding: "utf8",
     timeout: 30_000,
+    killSignal: "SIGKILL",
     maxBuffer: MAX_OUTPUT_BYTES,
     env: minimalEnvironment(),
   });
@@ -257,12 +259,16 @@ function runBroker(binary, args, { input, timeoutMs }, options = {}) {
     input,
     encoding: "utf8",
     timeout: timeoutMs,
+    killSignal: "SIGKILL",
     maxBuffer: MAX_OUTPUT_BYTES,
     env: minimalEnvironment(),
     windowsHide: true,
   });
   if (result.status !== 0 || result.error) {
     const diagnostic = boundedDiagnostic(result.stderr || result.error?.message || result.signal || `exit ${result.status}`);
+    if (result.error?.code === "ETIMEDOUT") {
+      throw new MacosTrustBrokerUnavailableError("macOS trust broker timed out");
+    }
     if (/-34018|missing entitlement|required entitlement/i.test(diagnostic)) {
       throw new MacosTrustBrokerUnavailableError(
         "macOS trust broker lacks a provisioning-profile-validated data-protection Keychain entitlement",
@@ -297,6 +303,7 @@ function codesignOptions() {
   return {
     encoding: "utf8",
     timeout: 30_000,
+    killSignal: "SIGKILL",
     maxBuffer: MAX_OUTPUT_BYTES,
     env: minimalEnvironment(),
   };