mixdog 0.9.84 → 0.9.86

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -46,6 +46,7 @@ import {
   extractPowerShellCommandInner,
 } from './shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './lib/shell-spawn-retry.mjs';
+import { takePwshStandby } from './lib/pwsh-standby-pool.mjs';
 
 export {
   _maybeEncodePowerShellCommand,
@@ -312,6 +313,11 @@ export function execShellCommand({
     const _isBackground = /(^|[^&|])&$/.test(_trimmed);
 
     let child;
+    let _standby = null;
+    let _viaMarker = false;
+    let _standbyDetach = null;
+    let _markerFilters = null;
+    let _onChildErrorRef = null;
     try {
       resourceLease = await _acquireShellLeaseBounded(admission, {
         abortSignal,
@@ -339,6 +345,25 @@ export function execShellCommand({
       const argv = Array.isArray(shellArgs) && shellArgs.length > 0
         ? [...shellArgs, _spawnCommand]
         : [shellArg, _spawnCommand];
+      const _onChildError = (err) => {
+        spawnError = spawnError || err;
+        failurePhase = 'tool';
+        failureReason = 'spawn failed';
+        if (settle) settle(1, null);
+        else pendingChildError = pendingChildError || err;
+      };
+      _onChildErrorRef = _onChildError;
+      // Warm standby adoption (Windows/pwsh only, see pwsh-standby-pool.mjs):
+      // a pre-spawned pwsh blocked on stdin replaces the cold spawn. The
+      // command is fed via stdin AFTER the stdio/exit wiring below, so no
+      // output can be produced before the capture handlers are attached.
+      // Standby children always use pipe capture — identical to the win32
+      // default (SHELL_DIRECT_CAPTURE is false on win32).
+      _standby = takePwshStandby({ shell, shellArgs, env });
+      if (_standby) {
+        child = _standby.child;
+        child.on('error', _onChildError);
+      } else {
       // Direct capture (CC file-mode parity): the child writes stdout/stderr
       // into the spill files via inherited fds. No parent pipes exist, so
       // 'close' fires with 'exit' and grandchildren cannot hold the capture
@@ -371,13 +396,8 @@ export function execShellCommand({
         },
       });
       child = spawned.child;
-      spawned.adoptErrorHandler((err) => {
-        spawnError = spawnError || err;
-        failurePhase = 'tool';
-        failureReason = 'spawn failed';
-        if (settle) settle(1, null);
-        else pendingChildError = pendingChildError || err;
-      });
+      spawned.adoptErrorHandler(_onChildError);
+      }
       startChildGuardian({
         childPid: child.pid,
         childGroupPid: child.pid,
@@ -385,7 +405,12 @@ export function execShellCommand({
       });
       // Windows has no process-group handle. Begin observing while the owned
       // root still exists so descendants can be proven before root exit.
-      releaseResourceLeaseWhenTreeQuiescent(child.pid, { waitForRootExit: true });
+      // Standby children skip the eager tracker: their root stays ALIVE across
+      // commands (waitForRootExit could never confirm and its CIM polling
+      // would run for the standby's whole lifetime). Marker settle releases
+      // the lease through the recycle path instead; kill/exit fallbacks below
+      // create the tracker lazily once the root is really gone.
+      if (!_standby) releaseResourceLeaseWhenTreeQuiescent(child.pid, { waitForRootExit: true });
     } catch (err) {
       const cleanupError = await releaseResourceLease();
       const spawnText = String((err && err.message) || err);
@@ -418,15 +443,77 @@ export function execShellCommand({
     }
 
     // Pipe-capture wiring only; direct mode has no parent-side streams.
+    // Standby children speak the marker protocol: per-command completion
+    // markers on BOTH streams are stripped from the capture and drive settle()
+    // (the process stays alive for the next command), while kill/exit paths
+    // still settle through 'close' as before.
+    let _stdoutData = (chunk) => { taskOutput.writeStdout(chunk); };
+    let _stderrData = (chunk) => taskOutput.writeStderr(chunk);
+    if (_standby) {
+      const donePrefix = _standby.doneMarkerPrefix;
+      const _mk = { outDone: false, errDone: false, code: 1 };
+      const tryComplete = () => {
+        if (!_mk.outDone || !_mk.errDone) return;
+        if (settled || autoBackgrounded || killed) return;
+        // Both streams delivered their marker — everything the command wrote
+        // is already in the capture. Detach BEFORE settle so late output from
+        // an undiscovered descendant can never pollute this task, then settle
+        // through the marker path (recycle + direct lease release).
+        _standbyDetach?.();
+        _viaMarker = true;
+        settle(_mk.code, null);
+      };
+      const makeFilter = (write, onMarkerLine) => {
+        let tail = '';
+        return {
+          data: (chunk) => {
+            tail += chunk;
+            let idx;
+            let out = '';
+            while ((idx = tail.indexOf('\n')) !== -1) {
+              const line = tail.slice(0, idx + 1);
+              tail = tail.slice(idx + 1);
+              if (line.startsWith(donePrefix)) { onMarkerLine(line); continue; }
+              out += line;
+            }
+            if (out) write(out);
+            // A marker always ends with a newline, so only a pathological
+            // marker-free run can grow the tail; spill it but keep enough to
+            // recognize a marker split across chunks.
+            if (tail.length > 65536) { write(tail.slice(0, -256)); tail = tail.slice(-256); }
+          },
+          flush: () => { if (tail) { write(tail); tail = ''; } },
+        };
+      };
+      const outFilter = makeFilter((s) => taskOutput.writeStdout(s), (line) => {
+        const m = /^:(-?\d+)>>>/.exec(line.slice(donePrefix.length));
+        _mk.code = m ? Number(m[1]) : 1;
+        _mk.outDone = true;
+        tryComplete();
+      });
+      const errFilter = makeFilter((s) => taskOutput.writeStderr(s), () => {
+        _mk.errDone = true;
+        tryComplete();
+      });
+      _markerFilters = [outFilter, errFilter];
+      _stdoutData = outFilter.data;
+      _stderrData = errFilter.data;
+    }
     if (child.stdout) {
       child.stdout.setEncoding('utf-8');
-      child.stdout.on('data', (chunk) => {
-        taskOutput.writeStdout(chunk);
-      });
+      child.stdout.on('data', _stdoutData);
     }
     if (child.stderr) {
       child.stderr.setEncoding('utf-8');
-      child.stderr.on('data', (chunk) => taskOutput.writeStderr(chunk));
+      child.stderr.on('data', _stderrData);
+    }
+
+    // Standby path: the capture handlers are attached — release the command
+    // into the waiting pwsh now. Skipped when a pre-fired abort already
+    // tree-killed the child (its close still settles the call).
+    if (_standby && !killed) {
+      const _spawnCommandForStandby = _maybeEncodePowerShellCommand(command);
+      _standby.run(_spawnCommandForStandby, cwd);
     }
 
     // If the spill writer hits an I/O failure (full disk, EBADF after
@@ -456,6 +543,11 @@ export function execShellCommand({
         autoBgTimer = null;
       }
       detachAbortHandler();
+      // Marker-free paths (kill/exit) may hold a partial last line in the
+      // standby stream filters — flush it so the capture keeps the tail.
+      if (_markerFilters) {
+        for (const f of _markerFilters) { try { f.flush(); } catch { /* best-effort */ } }
+      }
       // getStdout/getStderr can throw on a spilled-file read failure (EBADF
       // after unlink race, EACCES). Without this catch the rejection bubbles
       // up and leaves the outer settle promise unresolved, hanging the call.
@@ -480,12 +572,34 @@ export function execShellCommand({
       } else {
         taskOutput.closeFds();
       }
+      if (_viaMarker && _standby) {
+        // Marker-settled standby: the root pwsh is ALIVE by design, so the
+        // waitForRootExit tracker could never confirm. recycle() probes for
+        // leftover descendants off the result path (returns the standby to the
+        // pool when clean, tree-kills it otherwise) and the lease frees after.
+        const lease = resourceLease;
+        resourceLease = null;
+        void _standby.recycle()
+          .catch(() => false)
+          .then(() => { try { return Promise.resolve(lease?.release()).catch(() => {}); } catch { return null; } });
+      } else {
       const leaseSettlement = resourceLeaseSettlement
         || releaseResourceLeaseWhenTreeQuiescent(child.pid);
       leaseSettlement.tracker?.rootExited?.();
-      await leaseSettlement.tracker?.afterRootExitCheck?.();
-      if (!leaseSettlement.pending) await leaseSettlement.promise;
-      else _armLeaseLingerCap(() => leaseSettlement.lease, taskId);
+      // Decoupled lease settlement: the tool RESULT resolves immediately —
+      // the output is fully captured above and nothing in ExecResult depends
+      // on admission accounting. The quiescence proof (a Windows CIM process
+      // snapshot costing ~200ms per call) and the lease release continue in
+      // the background: exactly-once release is owned by the tracker/lease,
+      // and the linger cap still bounds a stuck descendant tree.
+      void (async () => {
+        try {
+          await leaseSettlement.tracker?.afterRootExitCheck?.();
+          if (!leaseSettlement.pending) await leaseSettlement.promise;
+          else _armLeaseLingerCap(() => leaseSettlement.lease, taskId);
+        } catch { /* background release must never throw */ }
+      })();
+      }
       resolveResult(
         new ExecResult({
           stdout,
@@ -513,14 +627,15 @@ export function execShellCommand({
     // bytes; settling there can lose the tail of the output. 'close' fires
     // after stdio is fully drained, so getStdout()/getStderr() see the
     // complete capture.
-    child.once('close', (code, signal) => settle(code, signal));
+    const _onChildClose = (code, signal) => settle(code, signal);
+    child.once('close', _onChildClose);
     if (pendingChildError) settle(1, null);
     // 'close' only fires after stdio drains; a forked grandchild that
     // inherited stdout/stderr fds can hold them open past direct-child
     // exit and stall settle() until timeoutMs. 'exit' fires on direct
     // child termination regardless — give 'close' a 2 s grace then
     // settle anyway.
-    child.once('exit', (code, signal) => {
+    const _onChildExit = (code, signal) => {
       if (_isBackground) {
         setImmediate(() => settle(code == null ? 1 : code, signal));
         return;
@@ -531,7 +646,21 @@ export function execShellCommand({
         settle(code == null ? 1 : code, signal);
       }, 2000);
       if (grace.unref) grace.unref();
-    });
+    };
+    child.once('exit', _onChildExit);
+    // Standby recycle prerequisite: THIS command's listeners must come off the
+    // long-lived child before it can serve another command (otherwise every
+    // reuse would stack another close/exit/data listener and stale handlers
+    // would keep writing into this task's finished capture).
+    _standbyDetach = () => {
+      try { child.stdout?.removeListener('data', _stdoutData); } catch { /* best-effort */ }
+      try { child.stderr?.removeListener('data', _stderrData); } catch { /* best-effort */ }
+      try { child.removeListener('close', _onChildClose); } catch { /* best-effort */ }
+      try { child.removeListener('exit', _onChildExit); } catch { /* best-effort */ }
+      if (_onChildErrorRef) {
+        try { child.removeListener('error', _onChildErrorRef); } catch { /* best-effort */ }
+      }
+    };
 
     // Auto-background transition (CC startBackgrounding analogue). Two triggers
     // resolve the call immediately with a 'backgrounded' result while the
@@ -552,6 +681,11 @@ export function execShellCommand({
       if (settled || autoBackgrounded || killed || timedOut) return;
       if (child.exitCode != null || child.signalCode != null) return;
       autoBackgrounded = true;
+      // Standby handoff: stop feeding this process. Once the in-flight
+      // command completes, the marker loop reads stdin EOF and exits with
+      // that command's code — the adopted job's close-wired exit file then
+      // records the real command exit, and the standby is never reused.
+      if (_standby) { try { _standby.endStdin(); } catch { /* best-effort */ } }
       // The foreground capture is over; stop the local watchdogs/timers so
       // they cannot treeKill the now-adopted child.
       if (timer) { clearTimeout(timer); timer = null; }

package/src/runtime/agent/orchestrator/tools/token-binary-fetcher.mjs

@@ -0,0 +1,201 @@
+// token-binary-fetcher.mjs — fetches the prebuilt mixdog-token native binary
+// from the GitHub release manifest. Token counting has an in-process WASM
+// fallback, so callers treat fetch failures as a soft degrade (never a tool
+// error). Caches under <dataDir>/token-bin/. Mirrors graph-binary-fetcher.mjs.
+//
+// Public API:
+//   ensureTokenBinary(dataDir) -> absolute path to the verified binary.
+//     Throws on no-asset / download / verify failure.
+//   findCachedTokenBinary(dataDir) -> path | null (sync, no network).
+// Both accept an optional dependency object used by deterministic tests:
+//   { bundledManifest, download }.
+
+import { createHash } from 'node:crypto';
+import {
+  chmodSync, createWriteStream, existsSync, mkdirSync,
+  readFileSync, readdirSync, renameSync, rmSync,
+} from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { pipeline } from 'node:stream/promises';
+
+const BUNDLED_MANIFEST_PATH = fileURLToPath(new URL('./token-manifest.json', import.meta.url));
+const MANIFEST_URL = 'https://raw.githubusercontent.com/tribgames/mixdog/main/src/runtime/agent/orchestrator/tools/token-manifest.json';
+
+function binSuffix() {
+  return process.platform === 'win32' ? '.exe' : '';
+}
+
+function platformKey() {
+  const os = process.platform === 'win32' ? 'win32' : process.platform;
+  return `${os}-${process.arch}`;
+}
+
+function tokenBinDir(dataDir) {
+  return join(dataDir, 'token-bin');
+}
+
+function readJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+function manifestVersion(manifest) {
+  const value = String(manifest?.version || '');
+  if (!/^\d+\.\d+\.\d+$/.test(value)) return null;
+  return value.split('.').map(Number);
+}
+
+function compareManifestVersions(a, b) {
+  const av = manifestVersion(a);
+  const bv = manifestVersion(b);
+  if (!av || !bv) return null;
+  for (let i = 0; i < 3; i++) {
+    if (av[i] !== bv[i]) return av[i] > bv[i] ? 1 : -1;
+  }
+  return 0;
+}
+
+function validSha256(value) {
+  return typeof value === 'string' && /^[a-f0-9]{64}$/i.test(value);
+}
+
+function validCachedUpgrade(manifest, pkey) {
+  if (!manifestVersion(manifest)) return false;
+  const asset = manifest.assets?.[pkey];
+  if (!asset || !validSha256(asset.sha256) || typeof asset.url !== 'string') return false;
+  const expectedUrl = `https://github.com/tribgames/mixdog/releases/download/token-v${manifest.version}`
+    + `/mixdog-token-${pkey}${binSuffix()}`;
+  return asset.url === expectedUrl;
+}
+
+function bundledManifest(options) {
+  if (options.bundledManifest) return options.bundledManifest;
+  return existsSync(BUNDLED_MANIFEST_PATH) ? readJson(BUNDLED_MANIFEST_PATH) : null;
+}
+
+function selectLocalManifest(dataDir, options = {}) {
+  const bundled = bundledManifest(options);
+  const cached = join(tokenBinDir(dataDir), 'manifest.json');
+  const cachedManifest = existsSync(cached) ? readJson(cached) : null;
+  if (bundled) {
+    // The installed manifest is the minimum policy. A cache may advance it,
+    // but only with a strict newer semver and a trusted, fully hashed asset.
+    if (compareManifestVersions(cachedManifest, bundled) === 1
+      && validCachedUpgrade(cachedManifest, platformKey())) {
+      return cachedManifest;
+    }
+    return bundled;
+  }
+  return validCachedUpgrade(cachedManifest, platformKey()) ? cachedManifest : null;
+}
+
+async function loadManifest(dataDir, options = {}) {
+  const local = selectLocalManifest(dataDir, options);
+  if (local) return local;
+  const fetchFn = options.fetch || fetch;
+  const res = await fetchFn(MANIFEST_URL, { signal: AbortSignal.timeout(30_000) });
+  if (!res.ok) {
+    throw new Error(`[token-fetcher] manifest fetch failed: ${res.status} ${res.statusText}`);
+  }
+  return res.json();
+}
+
+async function sha256File(filePath) {
+  return createHash('sha256').update(await readFile(filePath)).digest('hex');
+}
+
+async function downloadWithRetry(url, destPath) {
+  const delays = [1000, 3000, 9000];
+  let lastErr;
+  for (let attempt = 0; attempt < 4; attempt++) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(180_000) });
+      if (res.status >= 400 && res.status < 500) {
+        throw new Error(`[token-fetcher] asset HTTP ${res.status} (terminal) — ${url}`);
+      }
+      if (!res.ok) throw new Error(`[token-fetcher] asset HTTP ${res.status} — ${url}`);
+      await pipeline(res.body, createWriteStream(destPath));
+      return;
+    } catch (err) {
+      lastErr = err;
+      if (String(err?.message || '').includes('(terminal)')) throw err;
+      if (attempt < 3) {
+        process.stderr.write(`[token-fetcher] download attempt ${attempt + 1} failed (${err?.message}), retrying in ${delays[attempt]}ms…\n`);
+        await new Promise((r) => setTimeout(r, delays[attempt]));
+      }
+    }
+  }
+  throw lastErr;
+}
+
+function gcTokenBin(dir, keepFile) {
+  try {
+    for (const name of readdirSync(dir)) {
+      if (name === 'manifest.json' || name === keepFile) continue;
+      if (name.startsWith('mixdog-token')) {
+        try { rmSync(join(dir, name), { force: true }); } catch { /* best-effort */ }
+      }
+    }
+  } catch { /* dir may not exist yet */ }
+}
+
+export function findCachedTokenBinary(dataDir, options = {}) {
+  try {
+    const dir = tokenBinDir(dataDir);
+    const manifest = selectLocalManifest(dataDir, options);
+    const asset = manifest?.assets?.[platformKey()];
+    const version = manifestVersion(manifest);
+    if (!version || !validSha256(asset?.sha256)) return null;
+    const fileName = `mixdog-token-${manifest.version}${binSuffix()}`;
+    const hit = join(dir, fileName);
+    if (!existsSync(hit)) return null;
+    const actual = createHash('sha256').update(readFileSync(hit)).digest('hex');
+    return actual === asset.sha256.toLowerCase() ? hit : null;
+  } catch {
+    return null;
+  }
+}
+
+let _inflight = null;
+
+export function ensureTokenBinary(dataDir, options = {}) {
+  if (_inflight) return _inflight;
+  _inflight = (async () => {
+    const manifest = await loadManifest(dataDir, options);
+    const pkey = platformKey();
+    const asset = manifest.assets?.[pkey];
+    if (!asset || !asset.url || !validSha256(asset.sha256) || !manifestVersion(manifest)) {
+      // Unsupported platform/arch, or no token-v release published yet. The
+      // caller degrades to the in-process WASM worker, so the message only
+      // needs to explain why the accelerator is absent.
+      const supported = Object.keys(manifest.assets || {}).join(', ') || '(none)';
+      throw new Error(
+        `[token-fetcher] no prebuilt mixdog-token binary for platform ${pkey} `
+        + `(token counting degrades to the in-process WASM worker). `
+        + `Manifest platforms: ${supported}. `
+        + `Build it locally: cargo build --release in native/mixdog-token.`,
+      );
+    }
+    const version = String(manifest.version || '0');
+    const dir = tokenBinDir(dataDir);
+    mkdirSync(dir, { recursive: true });
+    const fileName = `mixdog-token-${version}${binSuffix()}`;
+    const destPath = join(dir, fileName);
+    if (existsSync(destPath)) {
+      try { if (await sha256File(destPath) === asset.sha256.toLowerCase()) return destPath; } catch { /* re-download */ }
+    }
+    const tmpPath = `${destPath}.tmp-${process.pid}-${Date.now()}`;
+    await (options.download || downloadWithRetry)(asset.url, tmpPath);
+    const actual = await sha256File(tmpPath);
+    if (actual !== asset.sha256.toLowerCase()) {
+      try { rmSync(tmpPath, { force: true }); } catch { /* best-effort */ }
+      throw new Error(`[token-fetcher] sha256 mismatch for ${pkey}: expected ${asset.sha256}, got ${actual}`);
+    }
+    renameSync(tmpPath, destPath);
+    if (process.platform !== 'win32') { try { chmodSync(destPath, 0o755); } catch { /* best-effort */ } }
+    gcTokenBin(dir, fileName);
+    return destPath;
+  })().finally(() => { _inflight = null; });
+  return _inflight;
+}

package/src/runtime/agent/orchestrator/tools/token-manifest.json

@@ -0,0 +1,5 @@
+{
+  "version": "0.1.0",
+  "_comment": "Synced from immutable token-v release assets. Empty until the first token-v release is published; the runtime falls back to a local cargo build or the in-process WASM worker.",
+  "assets": {}
+}

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -3,6 +3,7 @@ import { loadConfig, createBackend } from "./config.mjs";
 import { WebhookServer } from "./webhook.mjs";
 import { EventPipeline } from "./event-pipeline.mjs";
 import { startSnapshotWriter, stopSnapshotWriter } from "./status-snapshot.mjs";
+import { safeIpcSend } from "../../shared/safe-ipc-send.mjs";
 import { initProviders } from "../../agent/orchestrator/providers/registry.mjs";
 import { loadConfig as loadAgentConfig } from "../../agent/orchestrator/config.mjs";
 import {
@@ -423,14 +424,11 @@ function armBridgeOwnershipTimer() {}
 // error-callback path of ERR_IPC_CHANNEL_CLOSED (channel closing between the
 // connected check and delivery). Log-and-continue — never crash the worker.
 function sendToParent(message) {
-  if (!process.send || process.connected === false) return;
-  try {
-    process.send(message, undefined, undefined, err => {
-      if (err) process.stderr.write(`[channels] parent IPC send failed: ${err?.message || err}\n`);
-    });
-  } catch (err) {
-    process.stderr.write(`[channels] parent IPC send threw: ${err?.message || err}\n`);
-  }
+  safeIpcSend(process, message, {
+    onError: (err) => {
+      try { process.stderr.write(`[channels] parent IPC send failed: ${err?.message || err}\n`); } catch {}
+    },
+  });
 }
 // Tell the parent session this worker ACQUIRED the bridge so it flips remote
 // mode ON (badge/transcript writer). Callers fire this only on a genuine

package/src/runtime/channels/lib/parent-bridge.mjs

@@ -2,6 +2,8 @@
 // (behavior-preserving). Groups the notify-to-parent path and the
 // worker → parent → memory call bridge. Bound to live getters
 // (getInstanceId) so runtime identity stays consistent.
+import { safeIpcSend } from '../../shared/safe-ipc-send.mjs';
+
 function normalizeChannelNotifyParams(method, params) {
   if (method === 'notifications/claude/channel' && params && params.meta) {
     const m = {};
@@ -24,7 +26,7 @@ function setChannelNotifySink(fn) {
   _notifySink = typeof fn === 'function' ? fn : null;
 }
 
-function createParentBridge({ getInstanceId }) {
+function createParentBridge({ getInstanceId, ipcProcess = process }) {
   function sendNotifyToParent(method, params) {
     // CC channel schema requires meta: Record<string,string> (channelNotification.ts).
     // Coerce every meta value to string so a non-string (e.g. a Discord
@@ -37,15 +39,15 @@ function createParentBridge({ getInstanceId }) {
       catch (err) { try { process.stderr.write(`mixdog channels: notify sink failed: ${err && err.message || err}\n`); } catch {} }
       return;
     }
-    if (!process.send) {
+    if (!ipcProcess?.send || ipcProcess.connected !== true) {
       try { process.stderr.write(`mixdog channels: notify dropped (no IPC channel): ${method}\n`); } catch {}
       return;
     }
-    try {
-      process.send({ type: 'notify', method, params: outParams });
-    } catch (err) {
-      try { process.stderr.write(`mixdog channels: notify IPC send failed: ${err && err.message || err}\n`); } catch {}
-    }
+    safeIpcSend(ipcProcess, { type: 'notify', method, params: outParams }, {
+      onError: (err) => {
+        try { process.stderr.write(`mixdog channels: notify IPC send failed: ${err && err.message || err}\n`); } catch {}
+      },
+    });
   }
 
   // ── Memory worker bridge (worker → parent → memory) ─────────────────
@@ -56,10 +58,24 @@ function createParentBridge({ getInstanceId }) {
   // integrated into the main IPC handler below (not a second listener).
   const _memoryCallPending = new Map();
   let _memoryCallSeq = 0;
+  const failMemoryCall = (callId, error) => {
+    const pending = _memoryCallPending.get(callId);
+    if (!pending) return;
+    _memoryCallPending.delete(callId);
+    pending.reject(error instanceof Error ? error : new Error(String(error || 'memory_call IPC failed')));
+  };
+  const rejectAllMemoryCalls = (error) => {
+    for (const callId of Array.from(_memoryCallPending.keys())) failMemoryCall(callId, error);
+  };
+  ipcProcess?.once?.('disconnect', () => {
+    rejectAllMemoryCalls(new Error('memory_call parent IPC disconnected'));
+  });
 
   function callMemoryAction(action, args, timeoutMs) {
     return new Promise((resolve, reject) => {
-      if (!process.send) return reject(new Error('not a worker process'));
+      if (!ipcProcess?.send || ipcProcess.connected !== true) {
+        return reject(new Error('not a connected worker process'));
+      }
       const callId = `mc_${getInstanceId()}_${++_memoryCallSeq}_${Math.random().toString(36).slice(2, 8)}`;
       const timer = setTimeout(() => {
         _memoryCallPending.delete(callId);
@@ -69,13 +85,9 @@ function createParentBridge({ getInstanceId }) {
         resolve: (v) => { clearTimeout(timer); resolve(v); },
         reject: (e) => { clearTimeout(timer); reject(e); },
       });
-      try {
-        process.send({ type: 'memory_call_request', callId, action, args: args || {} });
-      } catch (e) {
-        _memoryCallPending.delete(callId);
-        clearTimeout(timer);
-        reject(e);
-      }
+      safeIpcSend(ipcProcess, { type: 'memory_call_request', callId, action, args: args || {} }, {
+        onError: (error) => failMemoryCall(callId, error),
+      });
     });
   }
 

package/src/runtime/channels/lib/webhook/relay-tunnel.mjs

@@ -28,14 +28,14 @@ export function resolveHookRelayUrl(env = process.env) {
   return raw || DEFAULT_RELAY_URL;
 }
 
-export function hookIdentityPath() {
+function hookIdentityPath() {
   return join(DATA_DIR, "relay-hook-device.json");
 }
 
 // Stable per-install identity (trust-on-first-use at the relay, mirroring
 // the desktop leg). The secret never leaves this machine except toward the
 // relay; the deviceId doubles as the public URL path segment.
-export function loadOrCreateHookIdentity() {
+function loadOrCreateHookIdentity() {
   const path = hookIdentityPath();
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8"));
@@ -58,7 +58,7 @@ export function loadOrCreateHookIdentity() {
   return identity;
 }
 
-export function hookPublicBase(relayUrl, deviceId) {
+function hookPublicBase(relayUrl, deviceId) {
   const url = new URL(relayUrl);
   url.protocol = url.protocol === "wss:" ? "https:" : "http:";
   url.pathname = `/hook/${deviceId}`;

package/src/runtime/channels/lib/worker-ipc.mjs

@@ -1,4 +1,5 @@
 import { performance } from "perf_hooks";
+import { safeIpcSend } from "../../shared/safe-ipc-send.mjs";
 // IPC worker-mode message loop extracted from channels/index.mjs
 // (behavior-preserving). Installs shutdown handlers, the parent->worker message
 // router, and the retrying start() bootstrap. Call once from the worker entry
@@ -19,6 +20,11 @@ export function runWorkerIpc({
   handleToolCallWithBridgeRetry,
   bootProfile,
 }) {
+  const sendToParent = (message) => safeIpcSend(process, message, {
+    onError: (error) => {
+      try { process.stderr.write(`[channels-worker] parent IPC send failed: ${error?.message || error}\n`); } catch {}
+    },
+  });
   // SIGTERM/SIGINT/IPC shutdown handler — mirrors src/memory/index.mjs pattern.
   // Cleans up in-progress webhook/scheduler state, removes runtime files, then exits.
   let _channelsStopInFlight = false
@@ -29,6 +35,10 @@ export function runWorkerIpc({
       return
     }
     _channelsStopInFlight = true
+    for (const controller of _inFlightChannelCalls.values()) {
+      try { controller.abort() } catch {}
+    }
+    _inFlightChannelCalls.clear()
     process.stderr.write(`[channels-worker] received ${sig} — shutting down cleanly\n`)
     _channelsForceExitTimer = setTimeout(() => {
       process.stderr.write(`[channels-worker] stop() timed out after 6000ms — forcing exit(2)\n`)
@@ -47,6 +57,7 @@ export function runWorkerIpc({
   }
   process.on('SIGTERM', () => _channelsShutdownHandler('SIGTERM'))
   process.on('SIGINT',  () => _channelsShutdownHandler('SIGINT'))
+  process.once('disconnect', () => _channelsShutdownHandler('IPC:disconnect'))
 
   // Map of callId → AbortController for in-flight IPC calls.
   const _inFlightChannelCalls = new Map()
@@ -144,7 +155,7 @@ export function runWorkerIpc({
         entry.abort()
         _inFlightChannelCalls.delete(msg.callId)
       }
-      process.send({ type: 'result', callId: msg.callId, error: 'cancelled' })
+      sendToParent({ type: 'result', callId: msg.callId, error: 'cancelled' })
       return
     }
     if (msg.type !== 'call' || !msg.callId) return
@@ -157,9 +168,9 @@ export function runWorkerIpc({
       } finally {
         _inFlightChannelCalls.delete(msg.callId)
       }
-      process.send({ type: 'result', callId: msg.callId, result })
+      sendToParent({ type: 'result', callId: msg.callId, result })
     } catch (e) {
-      process.send({ type: 'result', callId: msg.callId, error: e.message })
+      sendToParent({ type: 'result', callId: msg.callId, error: e.message })
     }
   })
   void (async () => {
@@ -174,7 +185,9 @@ export function runWorkerIpc({
       try {
         await start()
         bootProfile("worker:ready", { ms: (performance.now() - startedAt).toFixed(1), attempt })
-        process.send({ type: 'ready' })
+        if (!sendToParent({ type: 'ready' })) {
+          void _channelsShutdownHandler('IPC:ready-send-failed')
+        }
         return
       } catch (e) {
         lastErr = e