sensorium-mcp 3.1.0-refactor.17 → 3.1.0-refactor.18

package/dist/services/broker-client.js

@@ -1,323 +0,0 @@
-/**
- * Thin HTTP client for the supervisor's process broker (plan §4.1, Phase 2).
- *
- * Liveness, identity and kill move OFF the Node event loop and OUT of child
- * processes: the supervisor answers from one native NtQuerySystemInformation
- * snapshot and kills via native TerminateProcess/TerminateJobObject. Nothing
- * here ever spawns a process — the EDR-gated tasklist/powershell/taskkill
- * machinery this replaces was itself the leading event-loop stall generator.
- *
- * Degradation contract (the audited-safe direction, same as the old breakers):
- * every function returns `null` when the broker cannot answer (unreachable,
- * auth-rejected, timeout) and the caller MUST treat null as "cannot confirm
- * → assume alive / kill not performed". Communication is strictly one-way
- * MCP → supervisor.
- */
-import { log } from "../lib/logger.js";
-import { errorMessage } from "../lib/utils.js";
-const REQUEST_TIMEOUT_MS = 3000;
-// Timeouts here are pure LIVENESS backstops — correctness never depends on
-// their values. A spawn whose request outlives the client timeout is resolved
-// through the reconcile path (query the broker registry, adopt or retry the
-// idempotent spawn — see launchAgent), never by a blind local spawn, so no
-// timeout value can cause a duplicate agent. Spawns are sub-second on this
-// machine; the generous budgets only keep a pathologically slow call from
-// tying up its caller forever. Kill's TerminateJobObject settle loop alone can
-// take ~2.2s server-side, hence the longer mutate budget. Reads keep 3s.
-const SPAWN_TIMEOUT_MS = 30_000;
-const MUTATE_TIMEOUT_MS = 10_000;
-// After a failed broker call, skip further calls for a short window instead of
-// re-paying a connect timeout for every pid in a sweep (the keeper checks many
-// pids per cycle). Connection-refused fails in ~1 ms so this is only load-bearing
-// when the supervisor itself is wedged.
-const UNREACHABLE_COOLDOWN_MS = 5000;
-let unreachableUntil = 0;
-let unreachableLogged = false;
-let lastFailureKind = "uncertain";
-function classifyFetchError(err) {
-    const e = err;
-    // AbortSignal.timeout → the request was sent and the response never arrived.
-    if (e?.name === "TimeoutError" || e?.name === "AbortError")
-        return "uncertain";
-    const code = e?.cause?.code ?? e?.cause?.errors?.find((x) => x?.code)?.code ?? e?.code ?? undefined;
-    switch (code) {
-        case "ECONNREFUSED":
-        case "ENOTFOUND":
-        case "EAI_AGAIN":
-        case "EADDRNOTAVAIL":
-        case "EHOSTUNREACH":
-        case "ENETUNREACH":
-        case "UND_ERR_CONNECT_TIMEOUT":
-            return "no-connection";
-    }
-    // Some undici versions wrap the socket error in a bare Error with only a
-    // message ("connect ECONNREFUSED …", "bad port"). Fall back to the text for
-    // the same connection-never-established classes; anything unrecognized stays
-    // "uncertain" — the safe direction.
-    const msg = e?.cause?.message ?? "";
-    if (/ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|ENETUNREACH|bad port|invalid url/i.test(msg))
-        return "no-connection";
-    return "uncertain";
-}
-function brokerBaseUrl() {
-    const port = Number.parseInt(process.env.SUPERVISOR_HTTP_PORT ?? "", 10) || 8848;
-    return `http://127.0.0.1:${port}`;
-}
-function authHeaders() {
-    const secret = process.env.MCP_HTTP_SECRET;
-    return secret ? { Authorization: `Bearer ${secret}` } : {};
-}
-async function brokerFetchClassified(path, init, timeoutMs = REQUEST_TIMEOUT_MS, opts) {
-    const now = Date.now();
-    // During the cooldown we answer from the LAST observed failure kind: the
-    // spawn contract needs "could the broker have received a request" and a
-    // skipped call inherits the evidence that started the cooldown. The cooldown
-    // exists to protect the keeper's many-pids-per-cycle sweeps from paying a
-    // full timeout each; spawn/reconcile calls are rare and correctness-critical,
-    // so they bypass it — a reconcile probe must never be answered from stale
-    // evidence created by the very spawn it is reconciling.
-    if (!opts?.bypassCooldown && now < unreachableUntil)
-        return { res: null, failure: lastFailureKind };
-    try {
-        const res = await fetch(`${brokerBaseUrl()}${path}`, {
-            ...init,
-            headers: { ...authHeaders(), ...init?.headers },
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-        unreachableLogged = false;
-        return { res };
-    }
-    catch (err) {
-        const failure = classifyFetchError(err);
-        unreachableUntil = Date.now() + UNREACHABLE_COOLDOWN_MS;
-        lastFailureKind = failure;
-        if (!unreachableLogged) {
-            // WARN, deliberately: every liveness answer during this outage degrades to
-            // "cannot confirm → treat alive" and every kill falls back to best-effort —
-            // a silent fallback must never look like a healthy answer. Logged once per
-            // outage episode (reset on the first successful call) to avoid a warn storm
-            // when the keeper sweeps many pids per cycle.
-            log.warn(`[broker] unreachable (${errorMessage(err)}, ${failure}) — degrading to "cannot confirm": liveness treated as alive, kills fall back to native root-only`);
-            unreachableLogged = true;
-        }
-        return { res: null, failure };
-    }
-}
-async function brokerFetch(path, init, timeoutMs = REQUEST_TIMEOUT_MS) {
-    return (await brokerFetchClassified(path, init, timeoutMs)).res;
-}
-/**
- * Ask the broker whether `pid` is alive AND (when `startedAtMs` is given) still
- * the same process we spawned (creation-time identity, ±60s tolerance — the
- * same rule the deleted tasklist/Get-Process snapshots enforced).
- * `startTimeTicks` (native creation FILETIME from a broker spawn) upgrades the
- * check to exact identity. Returns null when the broker cannot answer.
- */
-export async function brokerCheckAlive(pid, startedAtMs, startTimeTicks) {
-    const params = new URLSearchParams({ pid: String(pid) });
-    if (startTimeTicks !== undefined && startTimeTicks !== 0)
-        params.set("startTicks", String(startTimeTicks));
-    else if (startedAtMs !== undefined)
-        params.set("startMs", String(Math.round(startedAtMs)));
-    const res = await brokerFetch(`/proc/alive?${params}`);
-    if (!res || !res.ok)
-        return null;
-    try {
-        return (await res.json());
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Ask the broker to kill the process tree rooted at `pid` (native, identity-
- * checked when `startedAtMs` is given; the broker records the outcome in its
- * on-disk registry). Returns null when the broker cannot answer — the caller
- * must then fall back / re-verify, never assume the kill happened.
- */
-export async function brokerKillTree(pid, opts = {}) {
-    const res = await brokerFetch(`/proc/kill`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            pid,
-            threadId: opts.threadId,
-            startMs: opts.startedAtMs !== undefined ? Math.round(opts.startedAtMs) : undefined,
-            killedBy: opts.killedBy ?? "mcp",
-            reason: opts.reason,
-        }),
-    }, MUTATE_TIMEOUT_MS);
-    if (!res)
-        return null;
-    // 403 = the broker REFUSED (self/server protection). That is an answer, not an
-    // outage: report it as not-killed-still-alive so callers never retry-storm.
-    if (!res.ok && res.status !== 403)
-        return null;
-    try {
-        return (await res.json());
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Ask the supervisor to spawn an agent process: CreateProcess(CREATE_SUSPENDED)
- * → assign to the thread's named job → resume. The supervisor is the process
- * owner; children (hooks, grandchildren) land in the job automatically.
- * Spawn is idempotent by threadId server-side (create-or-return), which is what
- * makes retrying after an uncertain outcome safe.
- */
-export async function brokerSpawn(spec) {
-    const { res, failure } = await brokerFetchClassified(`/proc/spawn`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(spec),
-    }, spawnTimeoutOverride ?? SPAWN_TIMEOUT_MS, { bypassCooldown: true });
-    if (!res) {
-        return failure === "no-connection"
-            ? { unavailable: "broker unreachable — connection never established" }
-            : { uncertain: "spawn request timed out or the connection was lost mid-flight" };
-    }
-    if (res.status === 404 || res.status === 401)
-        return {
-            unavailable: res.status === 404
-                ? "/proc/spawn not available on this supervisor build"
-                : "broker rejected the bearer secret",
-        };
-    try {
-        const body = (await res.json());
-        if (res.ok && body.ok && typeof body.pid === "number" && body.pid > 0) {
-            return {
-                pid: body.pid,
-                startTimeTicks: body.startTimeTicks ?? 0,
-                startTimeMs: body.startTimeMs ?? Date.now(),
-                jobName: body.jobName ?? null,
-                jobAssignFailed: body.jobAssignFailed ?? false,
-                existing: body.existing ?? false,
-            };
-        }
-        return { error: body.error ?? `broker answered HTTP ${res.status} without an error detail` };
-    }
-    catch {
-        // A 200 the broker sent but we could not read — the spawn may well have
-        // happened. Only a non-OK status is a definitive failure.
-        return res.ok
-            ? { uncertain: `broker answered HTTP ${res.status} but the body was unreadable` }
-            : { error: `broker answered HTTP ${res.status} with an unparseable body` };
-    }
-}
-/**
- * The broker's live process list for a thread (job members, falling back to the
- * registry root's tree). This is the reconcile source of truth after an
- * uncertain spawn: a live entry here means the thread HAS its process — adopt
- * it, never spawn another. `known:false` → the broker answered and has no
- * record of the thread. Null → broker could not answer.
- */
-export async function brokerListThread(threadId) {
-    const { res } = await brokerFetchClassified(`/proc/list?threadId=${threadId}`, undefined, REQUEST_TIMEOUT_MS, {
-        bypassCooldown: true,
-    });
-    if (!res)
-        return null;
-    if (res.status === 404)
-        return { known: false, processes: [] };
-    if (!res.ok)
-        return null;
-    try {
-        const body = (await res.json());
-        return { known: true, processes: body.processes ?? [] };
-    }
-    catch {
-        return null;
-    }
-}
-// ── Adopt (safe-cutover migration) ──────────────────────────────────────────
-/**
- * Ask the broker to adopt an already-running process (spawned before the broker
- * owned spawning, or during a broker outage) into the thread's job + registry.
- * Idempotent server-side. Best-effort: null when the broker cannot answer.
- */
-export async function brokerAdopt(threadId, pid, startedAtMs, role) {
-    const res = await brokerFetch(`/proc/adopt`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            threadId,
-            pid,
-            startMs: startedAtMs !== undefined ? Math.round(startedAtMs) : undefined,
-            role,
-        }),
-    }, 
-    // Adopt walks and job-assigns a whole tree — give it the mutate budget.
-    MUTATE_TIMEOUT_MS);
-    if (!res || !res.ok)
-        return null;
-    try {
-        return (await res.json());
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Ask the supervisor — the single process-lifecycle owner — to tear down and
- * respawn THIS server (self-update path). The supervisor answers 202 before
- * doing anything: the requester is the process about to be killed, so it can
- * never observe completion. 409 means a restart is already in progress, which
- * delivers exactly what the caller wants — treat it as success.
- *
- * Returns null when the supervisor cannot answer (unreachable, or an old
- * binary without /restart → 404/401). The caller decides between the flagged
- * legacy self-spawn fallback and a loud abort — same contract as brokerSpawn.
- */
-export async function brokerRequestRestart(reason) {
-    const res = await brokerFetch(`/restart`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ reason }),
-    });
-    if (!res)
-        return null;
-    if (res.status === 202)
-        return "accepted";
-    if (res.status === 409)
-        return "in-progress";
-    return null; // 404 = old supervisor binary; 401 = misconfigured secret
-}
-/** Load a thread's persisted keeper counters. Null → broker unreachable OR no
- *  state saved yet (both mean "start from defaults"). */
-export async function brokerGetKeeperState(threadId) {
-    const res = await brokerFetch(`/proc/keeper?threadId=${threadId}`);
-    if (!res || !res.ok)
-        return null;
-    try {
-        const body = (await res.json());
-        return body.found && body.state ? body.state : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Persist a thread's keeper counters (fire-and-forget from the keeper; a lost
- *  write degrades to today's in-memory behavior, already logged at WARN by the
- *  unreachable path). */
-export async function brokerSaveKeeperState(state) {
-    await brokerFetch(`/proc/keeper`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(state),
-    });
-}
-/** Test hook: reset the unreachable-cooldown state. */
-export function resetBrokerClientState() {
-    unreachableUntil = 0;
-    unreachableLogged = false;
-    lastFailureKind = "uncertain";
-}
-/** Test hook: shrink the spawn liveness backstop so timeout-class tests don't
- *  wait 30s. Pass null to restore the default. */
-let spawnTimeoutOverride = null;
-export function brokerSpawnTimeoutForTest(ms) {
-    spawnTimeoutOverride = ms;
-}
-//# sourceMappingURL=broker-client.js.map

package/dist/services/broker-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"broker-client.js","sourceRoot":"","sources":["../../src/services/broker-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,+EAA+E;AAC/E,+EAA+E;AAC/E,kFAAkF;AAClF,wCAAwC;AACxC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,IAAI,gBAAgB,GAAG,CAAC,CAAC;AACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,eAAe,GAAuB,WAAW,CAAC;AAetD,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,CAAC,GAAG,GAIT,CAAC;IACF,6EAA6E;IAC7E,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,WAAW,CAAC;IAC/E,MAAM,IAAI,GACR,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC;IACzF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC;QACpB,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW,CAAC;QACjB,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc,CAAC;QACpB,KAAK,aAAa,CAAC;QACnB,KAAK,yBAAyB;YAC5B,OAAO,eAAe,CAAC;IAC3B,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,GAAG,GAAI,CAAsC,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;IAC1E,IAAI,uEAAuE,CAAC,IAAI,CAAC,GAAG,CAAC;QACnF,OAAO,eAAe,CAAC;IACzB,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IACjF,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAQD,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,IAAkB,EAClB,YAAoB,kBAAkB,EACtC,IAAmC;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,yEAAyE;IACzE,wEAAwE;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,CAAC,IAAI,EAAE,cAAc,IAAI,GAAG,GAAG,gBAAgB;QACjD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,EAAE;YACnD,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,GAAI,IAAI,EAAE,OAA8C,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,iBAAiB,GAAG,KAAK,CAAC;QAC1B,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,CAAC;QACxD,eAAe,GAAG,OAAO,CAAC;QAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,4EAA4E;YAC5E,8CAA8C;YAC9C,GAAG,CAAC,IAAI,CACN,yBAAyB,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,mGAAmG,CAC1J,CAAC;YACF,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,IAAkB,EAClB,YAAoB,kBAAkB;IAEtC,OAAO,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AAClE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,WAAoB,EACpB,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;SAC9C,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAwF,EAAE;IAE1F,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,YAAY,EACZ;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG;YACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAClF,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;KACH,EACD,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoDD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAClD,aAAa,EACb;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,EACD,oBAAoB,IAAI,gBAAgB,EACxC,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,OAAO,KAAK,eAAe;YAChC,CAAC,CAAC,EAAE,WAAW,EAAE,mDAAmD,EAAE;YACtE,CAAC,CAAC,EAAE,SAAS,EAAE,+DAA+D,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAC1C,OAAO;YACL,WAAW,EACT,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,mCAAmC;SAC1C,CAAC;IACJ,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAS7B,CAAC;QACF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC;gBACxC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;gBAC7B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,KAAK;gBAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;aACjC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,wBAAwB,GAAG,CAAC,MAAM,0BAA0B,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,0DAA0D;QAC1D,OAAO,GAAG,CAAC,EAAE;YACX,CAAC,CAAC,EAAE,SAAS,EAAE,wBAAwB,GAAG,CAAC,MAAM,8BAA8B,EAAE;YACjF,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,GAAG,CAAC,MAAM,2BAA2B,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB;IAEhB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,QAAQ,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE;QAC5G,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,GAAW,EACX,WAAoB,EACpB,IAAa;IAEb,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,aAAa,EACb;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ;YACR,GAAG;YACH,OAAO,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACxE,IAAI;SACL,CAAC;KACH;IACD,wEAAwE;IACxE,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAMD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IAC7C,OAAO,IAAI,CAAC,CAAC,0DAA0D;AACzE,CAAC;AAcD;yDACyD;AACzD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwD,CAAC;QACvF,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;yBAEyB;AACzB,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAwB;IAClE,MAAM,WAAW,CAAC,cAAc,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB;IACpC,gBAAgB,GAAG,CAAC,CAAC;IACrB,iBAAiB,GAAG,KAAK,CAAC;IAC1B,eAAe,GAAG,WAAW,CAAC;AAChC,CAAC;AAED;kDACkD;AAClD,IAAI,oBAAoB,GAAkB,IAAI,CAAC;AAC/C,MAAM,UAAU,yBAAyB,CAAC,EAAiB;IACzD,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC"}

package/dist/services/spawn-exit-watcher.d.ts

@@ -1,32 +0,0 @@
-/**
- * Exit watching for broker-spawned agents (Phase 3).
- *
- * A locally-spawned child reports its death through `child.on("exit")`; a
- * broker-spawned process is the SUPERVISOR's child, so the MCP has no handle to
- * wait on. Communication is strictly one-way (MCP → supervisor — hard
- * criterion), so the supervisor cannot push the event either. Instead this
- * watcher polls: a cheap local `process.kill(pid, 0)` syscall first (no broker
- * traffic while the child is alive and no child process ever spawned), then the
- * broker for the identity-checked verdict + the exit code its handle-wait
- * recorded in the registry.
- *
- * Degradation: broker unreachable → the local syscall still detects "pid gone"
- * (exit code then unknown → null), and a locally-alive pid is treated as alive
- * (the audited-safe direction). A watched pid is only resolved ONCE.
- */
-export interface WatchedSpawn {
-    pid: number;
-    threadId: number;
-    /** Broker-reported creation time (ms) — identity for the alive checks. */
-    startedAtMs: number;
-    /** Native creation FILETIME when known — exact identity. */
-    startTimeTicks?: number;
-    onExit: (exitCode: number | null) => void;
-}
-/** Register a broker-spawned pid for exit detection. */
-export declare function watchBrokerSpawnExit(entry: WatchedSpawn): void;
-/** Test hooks. */
-export declare function stopExitWatcher(): void;
-export declare function sweepOnceForTest(): Promise<void>;
-export declare function watchedCountForTest(): number;
-//# sourceMappingURL=spawn-exit-watcher.d.ts.map

package/dist/services/spawn-exit-watcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawn-exit-watcher.d.ts","sourceRoot":"","sources":["../../src/services/spawn-exit-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;CAC3C;AAMD,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAM9D;AAyDD,kBAAkB;AAClB,wBAAgB,eAAe,IAAI,IAAI,CAMtC;AACD,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AACD,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/services/spawn-exit-watcher.js

@@ -1,102 +0,0 @@
-/**
- * Exit watching for broker-spawned agents (Phase 3).
- *
- * A locally-spawned child reports its death through `child.on("exit")`; a
- * broker-spawned process is the SUPERVISOR's child, so the MCP has no handle to
- * wait on. Communication is strictly one-way (MCP → supervisor — hard
- * criterion), so the supervisor cannot push the event either. Instead this
- * watcher polls: a cheap local `process.kill(pid, 0)` syscall first (no broker
- * traffic while the child is alive and no child process ever spawned), then the
- * broker for the identity-checked verdict + the exit code its handle-wait
- * recorded in the registry.
- *
- * Degradation: broker unreachable → the local syscall still detects "pid gone"
- * (exit code then unknown → null), and a locally-alive pid is treated as alive
- * (the audited-safe direction). A watched pid is only resolved ONCE.
- */
-import { log } from "../lib/logger.js";
-import { errorMessage } from "../lib/utils.js";
-import { brokerCheckAlive } from "./broker-client.js";
-const SWEEP_INTERVAL_MS = 20_000;
-const watched = new Map();
-let timer = null;
-let sweepInFlight = false;
-/** Register a broker-spawned pid for exit detection. */
-export function watchBrokerSpawnExit(entry) {
-    watched.set(entry.pid, entry);
-    if (timer === null) {
-        timer = setInterval(() => void sweep(), SWEEP_INTERVAL_MS);
-        timer.unref();
-    }
-}
-async function sweep() {
-    if (sweepInFlight)
-        return; // a slow broker must not stack sweeps
-    sweepInFlight = true;
-    try {
-        for (const entry of [...watched.values()]) {
-            try {
-                await checkOne(entry);
-            }
-            catch (err) {
-                log.warn(`[exit-watch] sweep failed for pid ${entry.pid} (thread ${entry.threadId}): ${errorMessage(err)}`);
-            }
-        }
-    }
-    finally {
-        sweepInFlight = false;
-        if (watched.size === 0 && timer !== null) {
-            clearInterval(timer);
-            timer = null;
-        }
-    }
-}
-async function checkOne(entry) {
-    // 1. Local syscall: ESRCH is a definitive "gone" even with the broker down.
-    let locallyDead = false;
-    try {
-        process.kill(entry.pid, 0);
-    }
-    catch (err) {
-        if (err.code !== "EPERM")
-            locallyDead = true;
-    }
-    // 2. Broker verdict — identity-checked, and carries the recorded exit code.
-    const verdict = await brokerCheckAlive(entry.pid, entry.startedAtMs, entry.startTimeTicks);
-    if (verdict !== null) {
-        if (verdict.alive)
-            return; // definitely alive (kill(0) can lie on Windows; this can't)
-        resolveExit(entry, verdict.exitCode ?? null, verdict.registryState ?? undefined);
-        return;
-    }
-    // Broker unreachable: only the local definitive signal may resolve the watch —
-    // "cannot confirm" must never count as an exit.
-    if (locallyDead)
-        resolveExit(entry, null, "broker-unreachable");
-}
-function resolveExit(entry, exitCode, source) {
-    if (!watched.delete(entry.pid))
-        return; // already resolved
-    log.info(`[exit-watch] broker-spawned PID=${entry.pid} (thread ${entry.threadId}) exited: code ${exitCode ?? "unknown"}${source ? ` (${source})` : ""}`);
-    try {
-        entry.onExit(exitCode);
-    }
-    catch (err) {
-        log.warn(`[exit-watch] onExit handler failed for thread ${entry.threadId}: ${errorMessage(err)}`);
-    }
-}
-/** Test hooks. */
-export function stopExitWatcher() {
-    if (timer !== null) {
-        clearInterval(timer);
-        timer = null;
-    }
-    watched.clear();
-}
-export function sweepOnceForTest() {
-    return sweep();
-}
-export function watchedCountForTest() {
-    return watched.size;
-}
-//# sourceMappingURL=spawn-exit-watcher.js.map

package/dist/services/spawn-exit-watcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawn-exit-watcher.js","sourceRoot":"","sources":["../../src/services/spawn-exit-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAYjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;AAChD,IAAI,KAAK,GAA0B,IAAI,CAAC;AACxC,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,wDAAwD;AACxD,MAAM,UAAU,oBAAoB,CAAC,KAAmB;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC3D,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,aAAa;QAAE,OAAO,CAAC,sCAAsC;IACjE,aAAa,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qCAAqC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,aAAa,GAAG,KAAK,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACzC,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAmB;IACzC,4EAA4E;IAC5E,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;YAAE,WAAW,GAAG,IAAI,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,4DAA4D;QACvF,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,OAAO,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,+EAA+E;IAC/E,gDAAgD;IAChD,IAAI,WAAW;QAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB,EAAE,QAAuB,EAAE,MAAe;IAChF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,mBAAmB;IAC3D,GAAG,CAAC,IAAI,CACN,mCAAmC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,QAAQ,kBAAkB,QAAQ,IAAI,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/I,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,iDAAiD,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AACD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,CAAC;AACjB,CAAC;AACD,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC"}