sensorium-mcp 3.1.0-refactor.9 → 3.1.0

package/dist/services/background-runner.js

@@ -2,7 +2,7 @@ import { rotateAllDailySessions } from "./daily-session.js";
 import { cleanupExpiredWorkers } from "./worker-cleanup.service.js";
 import { errorMessage } from "../lib/utils.js";
 import { getAllThreads } from "../data/memory/thread-registry.js";
-import { isThreadRunning, spawnedThreads, sweepOrphanDescendants } from "./process.service.js";
+import { isThreadAlive, readPidFiles, spawnedThreads } from "./process.service.js";
 import { decommissionWorker } from "./worker-cleanup.service.js";
 import { hasRunToday } from "../data/daily-marker.js";
 const DAILY_ROTATION_INTERVAL_MS = 5 * 60_000;
@@ -50,23 +50,33 @@ export class BackgroundJobRunner {
         catch (err) {
             this.deps.log.error(`Expired worker cleanup error: ${errorMessage(err)}`);
         }
-        // Piggyback the orphan-descendant sweep on the same cadence and (single)
-        // process snapshot budget — no new timer. It records lineage for live threads
-        // and logs (or, behind ORPHAN_SWEEP_KILL, reaps) grandchildren whose middle
-        // parent died on its own. Failures here must not affect worker cleanup.
-        try {
-            await sweepOrphanDescendants();
-        }
-        catch (err) {
-            this.deps.log.error(`Orphan-descendant sweep error: ${errorMessage(err)}`);
-        }
+        // The old orphan-descendant sweep (powershell CIM snapshot + witnessed-lineage
+        // map) is gone with the rest of the Node enumeration machinery (plan §8
+        // Phase 2). Its replacement is job-membership reconciliation in the broker
+        // once Phase 3 spawns agents into named job objects.
     }
     async runDeadWorkerSweep() {
         try {
             const db = this.deps.getMemoryDb();
             const workers = getAllThreads(db).filter((t) => t.type === "worker" && (t.status === "active" || t.status === "exited"));
+            const pidEntries = readPidFiles();
             for (const w of workers) {
-                if (!isThreadRunning(w.threadId)) {
+                // THREAD-scoped liveness (mirror cleanupExpiredWorkers): a broker-spawned
+                // worker's launcher pid reads dead ~20s after spawn while its forked child
+                // lives on in the job. A pid-first isThreadRunning()/findAliveThread here
+                // would BOTH mis-declare that live worker dead AND splice it out of
+                // spawnedThreads — so the inMemory branch below would fall through to a full
+                // decommissionWorker (job-kill + topic delete + note/DB archive) of a running
+                // worker every sweep. Source the fallback pid + startedAt exactly where
+                // cleanupExpiredWorkers does, then ask the broker by threadId; the broker's
+                // job/registry verdict (or treat-alive-on-unreachable) gates the sweep, and
+                // isThreadAlive never mutates spawnedThreads so the inMemory branch stays
+                // correct for a genuinely-dead worker still tracked in memory.
+                const pidEntry = pidEntries.find((e) => e.threadId === w.threadId);
+                const inMemEntry = spawnedThreads.find((t) => t.threadId === w.threadId);
+                const fallbackPid = pidEntry?.pid ?? inMemEntry?.pid;
+                const startedAt = pidEntry?.startedAt ?? inMemEntry?.startedAt;
+                if (!(await isThreadAlive(w.threadId, fallbackPid, startedAt))) {
                     const inMemory = spawnedThreads.some((t) => t.threadId === w.threadId);
                     try {
                         if (inMemory) {

package/dist/services/background-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"background-runner.js","sourceRoot":"","sources":["../../src/services/background-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAc9C,MAAM,OAAO,mBAAmB;IAID;IAHrB,SAAS,GAAqC,EAAE,CAAC;IACjD,oBAAoB,GAAkB,IAAI,CAAC;IAEnD,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D,KAAK;QACH,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAEtC,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAClC,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE/B,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/B,CAAC,EAAE,0BAA0B,CAAC,CAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpC,CAAC,EAAE,0BAA0B,CAAC,CAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjC,CAAC,EAAE,0BAA0B,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI;QACF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,IAAI,CAAC,IAAI,CAAC,eAAe,CAC1B,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,yEAAyE;QACzE,8EAA8E;QAC9E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,kCAAkC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC/E,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACvE,IAAI,CAAC;wBACH,IAAI,QAAQ,EAAE,CAAC;4BACb,iFAAiF;4BACjF,gFAAgF;4BAChF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;wBAC1D,CAAC;6BAAM,CAAC;4BACN,oFAAoF;4BACpF,wEAAwE;4BACxE,MAAM,kBAAkB,CACtB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EACtC;gCACE,EAAE;gCACF,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gCAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gCACxB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;6BAC3C,CACF,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChB,4CAA4C,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CACrE,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChB,yCAAyC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,CAC5E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,mBAAmB;YAAE,OAAO;QAEjD,oEAAoE;QACpE,yEAAyE;QACzE,2DAA2D;QAC3D,IAAI,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,oBAAoB,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACtF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,IAAI,IAAI,CAAC,oBAAoB,KAAK,WAAW;YAAE,OAAO;QACtD,IAAI,CAAC,oBAAoB,GAAG,WAAW,CAAC;QAExC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CACjB,kCAAkC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,EAAE,CACzE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"background-runner.js","sourceRoot":"","sources":["../../src/services/background-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAc9C,MAAM,OAAO,mBAAmB;IAID;IAHrB,SAAS,GAAqC,EAAE,CAAC;IACjD,oBAAoB,GAAkB,IAAI,CAAC;IAEnD,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D,KAAK;QACH,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAEtC,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAClC,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE/B,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/B,CAAC,EAAE,0BAA0B,CAAC,CAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpC,CAAC,EAAE,0BAA0B,CAAC,CAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjC,CAAC,EAAE,0BAA0B,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI;QACF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,IAAI,CAAC,IAAI,CAAC,eAAe,CAC1B,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,+EAA+E;QAC/E,wEAAwE;QACxE,2EAA2E;QAC3E,qDAAqD;IACvD,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC/E,CAAC;YACF,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,oEAAoE;gBACpE,6EAA6E;gBAC7E,8EAA8E;gBAC9E,wEAAwE;gBACxE,4EAA4E;gBAC5E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,+DAA+D;gBAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACnE,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACzE,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,CAAC;gBACrD,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,UAAU,EAAE,SAAS,CAAC;gBAC/D,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC/D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACvE,IAAI,CAAC;wBACH,IAAI,QAAQ,EAAE,CAAC;4BACb,iFAAiF;4BACjF,gFAAgF;4BAChF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;wBAC1D,CAAC;6BAAM,CAAC;4BACN,oFAAoF;4BACpF,wEAAwE;4BACxE,MAAM,kBAAkB,CACtB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EACtC;gCACE,EAAE;gCACF,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gCAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gCACxB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;6BAC3C,CACF,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChB,4CAA4C,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CACrE,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChB,yCAAyC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,CAC5E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,mBAAmB;YAAE,OAAO;QAEjD,oEAAoE;QACpE,yEAAyE;QACzE,2DAA2D;QAC3D,IAAI,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,oBAAoB,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACtF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,IAAI,IAAI,CAAC,oBAAoB,KAAK,WAAW;YAAE,OAAO;QACtD,IAAI,CAAC,oBAAoB,GAAG,WAAW,CAAC;QAExC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CACjB,kCAAkC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,EAAE,CACzE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/services/broker-client.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Thin HTTP client for the supervisor's process broker (plan §4.1, Phase 2).
+ *
+ * Liveness, identity and kill move OFF the Node event loop and OUT of child
+ * processes: the supervisor answers from one native NtQuerySystemInformation
+ * snapshot and kills via native TerminateProcess/TerminateJobObject. Nothing
+ * here ever spawns a process — the EDR-gated tasklist/powershell/taskkill
+ * machinery this replaces was itself the leading event-loop stall generator.
+ *
+ * Degradation contract (the audited-safe direction, same as the old breakers):
+ * every function returns `null` when the broker cannot answer (unreachable,
+ * auth-rejected, timeout) and the caller MUST treat null as "cannot confirm
+ * → assume alive / kill not performed". Communication is strictly one-way
+ * MCP → supervisor.
+ */
+/**
+ * How a failed broker call failed — the distinction the spawn contract pivots on:
+ *   "no-connection"  the TCP connection was never established (refused, host
+ *                    unreachable, connect timeout). The request CANNOT have
+ *                    reached the broker, so no process can have been created —
+ *                    a legacy local spawn is safe.
+ *   "uncertain"      the request may have been received and processed (read
+ *                    timeout, connection dropped mid-flight, unknown error).
+ *                    A process MAY exist broker-side — a blind local spawn
+ *                    could create a duplicate and is forbidden.
+ */
+export type BrokerFetchFailure = "no-connection" | "uncertain";
+export interface BrokerAliveResult {
+    alive: boolean;
+    pidFound: boolean;
+    identityChecked: boolean;
+    identityMismatch: boolean;
+    startTimeMs?: number;
+    /** Exit code from the broker's ledger once the process is gone (spawn-side
+     *  handle-wait recorded it). Undefined while alive / never managed. */
+    exitCode?: number | null;
+    /** Ledger state of the pid's latest row ("running"/"exited"/"killed"/…). */
+    registryState?: string | null;
+}
+/**
+ * Ask the broker whether `pid` is alive AND (when `startedAtMs` is given) still
+ * the same process we spawned (creation-time identity, ±60s tolerance — the
+ * same rule the deleted tasklist/Get-Process snapshots enforced).
+ * `startTimeTicks` (native creation FILETIME from a broker spawn) upgrades the
+ * check to exact identity. Returns null when the broker cannot answer.
+ */
+export declare function brokerCheckAlive(pid: number, startedAtMs?: number, startTimeTicks?: number): Promise<BrokerAliveResult | null>;
+export interface BrokerThreadAliveResult {
+    /** False when the broker has never managed a process for this thread (HTTP 404). */
+    known: boolean;
+    /** Alive iff the thread's job has >=1 live member (kernel truth), or a live
+     *  assign-failed process is still registered for it. */
+    alive: boolean;
+    /** How the verdict was reached ("job" | "registry"). */
+    source?: string;
+    /** Recorded exit code once the worker is truly gone (job drained). */
+    exitCode?: number | null;
+    /** Ledger state of the thread's latest row ("running"/"exited"/"killed"/…). */
+    registryState?: string | null;
+}
+/**
+ * Job-based thread liveness — the single source of truth for a broker-spawned
+ * worker. A launcher CLI (claude.exe/copilot.exe forks the real agent then exits)
+ * makes the originally-spawned pid a lie; the thread's JOB is not. Returns
+ * `known:false` when the broker has no record of the thread, and null when the
+ * broker cannot answer (unreachable → "cannot confirm → treat alive").
+ */
+export declare function brokerCheckAliveByThread(threadId: number): Promise<BrokerThreadAliveResult | null>;
+export interface BrokerKillResult {
+    killed: boolean;
+    alive: boolean;
+    alreadyDead: boolean;
+    identityMismatch: boolean;
+    refused: boolean;
+    error?: string;
+}
+/**
+ * Ask the broker to kill the process tree rooted at `pid` (native, identity-
+ * checked when `startedAtMs` is given; the broker records the outcome in its
+ * on-disk registry). Returns null when the broker cannot answer — the caller
+ * must then fall back / re-verify, never assume the kill happened.
+ *
+ * Pass `pid` as undefined to route the kill by THREAD instead: the broker then
+ * takes the KillByThread path (job kill of every live member, or the registry-
+ * identity survivor when the job assign failed) rather than KillByPid. This is
+ * the correct call for a launcher-forked worker whose recorded pid is the
+ * already-exited launcher — KillByPid(launcher) hits the broker's AlreadyDead
+ * fast-path and never touches the live forked child.
+ */
+export declare function brokerKillTree(pid: number | undefined, opts?: {
+    threadId?: number;
+    killedBy?: string;
+    reason?: string;
+    startedAtMs?: number;
+}): Promise<BrokerKillResult | null>;
+export interface BrokerSpawnSpec {
+    threadId: number;
+    role: string;
+    exe: string;
+    args: string[];
+    env: Record<string, string>;
+    cwd?: string;
+    logFilePath: string;
+    /** Prompt-sized stdin payload for CLIs that read their prompt from stdin
+     *  (Codex). Omitted → the child gets NUL stdin (Node's "ignore"). */
+    stdinData?: string;
+}
+export interface BrokerSpawnSuccess {
+    pid: number;
+    /** Native creation FILETIME — exact process identity for later checks/kills. */
+    startTimeTicks: number;
+    startTimeMs: number;
+    jobName: string | null;
+    /** Launched but job containment failed (Avecto downgrade §4.2) — managed via
+     *  registry identity only. Already logged loudly broker-side. */
+    jobAssignFailed: boolean;
+    /** Idempotent hit: the thread ALREADY had a live managed process and pid
+     *  describes that process — nothing new was spawned. */
+    existing: boolean;
+}
+/**
+ * The four spawn outcomes the caller MUST keep apart:
+ *   success         → a process is running and registered (existing=true when it
+ *                     was already there — the idempotency contract);
+ *   { error }       → the broker answered and the spawn FAILED. No process was
+ *                     created (the broker's idempotency check also found none);
+ *   { unavailable } → the request DEFINITIVELY never spawned anything: the
+ *                     connection was never established, or the broker answered
+ *                     404/401 (endpoint absent on an old binary / bad secret).
+ *                     A legacy local spawn cannot duplicate anything;
+ *   { uncertain }   → timeout or connection lost mid-flight: the broker MAY
+ *                     have created a process. A blind local spawn could
+ *                     duplicate the agent — the caller must reconcile via
+ *                     brokerListThread / an idempotent spawn retry instead.
+ */
+export type BrokerSpawnResult = BrokerSpawnSuccess | {
+    error: string;
+} | {
+    unavailable: string;
+} | {
+    uncertain: string;
+};
+/**
+ * Ask the supervisor to spawn an agent process: CreateProcess(CREATE_SUSPENDED)
+ * → assign to the thread's named job → resume. The supervisor is the process
+ * owner; children (hooks, grandchildren) land in the job automatically.
+ * Spawn is idempotent by threadId server-side (create-or-return), which is what
+ * makes retrying after an uncertain outcome safe.
+ */
+export declare function brokerSpawn(spec: BrokerSpawnSpec): Promise<BrokerSpawnResult>;
+export interface BrokerProcEntry {
+    pid: number;
+    startTimeTicks: number;
+    startTimeMs: number;
+    name: string;
+}
+/**
+ * The broker's live process list for a thread (job members, falling back to the
+ * registry root's tree). This is the reconcile source of truth after an
+ * uncertain spawn: a live entry here means the thread HAS its process — adopt
+ * it, never spawn another. `known:false` → the broker answered and has no
+ * record of the thread. Null → broker could not answer.
+ */
+export declare function brokerListThread(threadId: number): Promise<{
+    known: boolean;
+    processes: BrokerProcEntry[];
+} | null>;
+/**
+ * Ask the broker to adopt an already-running process (spawned before the broker
+ * owned spawning, or during a broker outage) into the thread's job + registry.
+ * Idempotent server-side. Best-effort: null when the broker cannot answer.
+ */
+export declare function brokerAdopt(threadId: number, pid: number, startedAtMs?: number, role?: string): Promise<{
+    adopted: boolean;
+    alreadyManaged: boolean;
+} | null>;
+export type BrokerRestartVerdict = "accepted" | "in-progress";
+/**
+ * Ask the supervisor — the single process-lifecycle owner — to tear down and
+ * respawn THIS server (self-update path). The supervisor answers 202 before
+ * doing anything: the requester is the process about to be killed, so it can
+ * never observe completion. 409 means a restart is already in progress, which
+ * delivers exactly what the caller wants — treat it as success.
+ *
+ * Returns null when the supervisor cannot answer (unreachable, or an old
+ * binary without /restart → 404/401). The caller decides between the flagged
+ * legacy self-spawn fallback and a loud abort — same contract as brokerSpawn.
+ */
+export declare function brokerRequestRestart(reason: string): Promise<BrokerRestartVerdict | null>;
+export interface BrokerKeeperState {
+    threadId: number;
+    retryCount: number;
+    fastExitCount: number;
+    fastExitEscalation: number;
+    cooldownUntilMs: number | null;
+    survivedKillCount: number;
+    lastStartAtMs: number | null;
+}
+/** Load a thread's persisted keeper counters. Null → broker unreachable OR no
+ *  state saved yet (both mean "start from defaults"). */
+export declare function brokerGetKeeperState(threadId: number): Promise<BrokerKeeperState | null>;
+/** Persist a thread's keeper counters (fire-and-forget from the keeper; a lost
+ *  write degrades to today's in-memory behavior, already logged at WARN by the
+ *  unreachable path). */
+export declare function brokerSaveKeeperState(state: BrokerKeeperState): Promise<void>;
+/** Test hook: reset the unreachable-cooldown state. */
+export declare function resetBrokerClientState(): void;
+export declare function brokerSpawnTimeoutForTest(ms: number | null): void;
+//# sourceMappingURL=broker-client.d.ts.map

package/dist/services/broker-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.d.ts","sourceRoot":"","sources":["../../src/services/broker-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2BH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,WAAW,CAAC;AAmG/D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAYnC;AAED,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,KAAK,EAAE,OAAO,CAAC;IACf;4DACwD;IACxD,KAAK,EAAE,OAAO,CAAC;IACf,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAiBzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACzF,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAyBlC;AAID,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;yEACqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;qEACiE;IACjE,eAAe,EAAE,OAAO,CAAC;IACzB;4DACwD;IACxD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAC3B,kBAAkB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoDnF;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAkBlE;AAID;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAsB/D;AAID,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,aAAa,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAU/F;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;yDACyD;AACzD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAS9F;AAED;;yBAEyB;AACzB,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnF;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,IAAI,IAAI,CAI7C;AAKD,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEjE"}

package/dist/services/broker-client.js

@@ -0,0 +1,359 @@
+/**
+ * Thin HTTP client for the supervisor's process broker (plan §4.1, Phase 2).
+ *
+ * Liveness, identity and kill move OFF the Node event loop and OUT of child
+ * processes: the supervisor answers from one native NtQuerySystemInformation
+ * snapshot and kills via native TerminateProcess/TerminateJobObject. Nothing
+ * here ever spawns a process — the EDR-gated tasklist/powershell/taskkill
+ * machinery this replaces was itself the leading event-loop stall generator.
+ *
+ * Degradation contract (the audited-safe direction, same as the old breakers):
+ * every function returns `null` when the broker cannot answer (unreachable,
+ * auth-rejected, timeout) and the caller MUST treat null as "cannot confirm
+ * → assume alive / kill not performed". Communication is strictly one-way
+ * MCP → supervisor.
+ */
+import { log } from "../lib/logger.js";
+import { errorMessage } from "../lib/utils.js";
+const REQUEST_TIMEOUT_MS = 3000;
+// Timeouts here are pure LIVENESS backstops — correctness never depends on
+// their values. A spawn whose request outlives the client timeout is resolved
+// through the reconcile path (query the broker registry, adopt or retry the
+// idempotent spawn — see launchAgent), never by a blind local spawn, so no
+// timeout value can cause a duplicate agent. Spawns are sub-second on this
+// machine; the generous budgets only keep a pathologically slow call from
+// tying up its caller forever. Kill's TerminateJobObject settle loop alone can
+// take ~2.2s server-side, hence the longer mutate budget. Reads keep 3s.
+const SPAWN_TIMEOUT_MS = 30_000;
+const MUTATE_TIMEOUT_MS = 10_000;
+// After a failed broker call, skip further calls for a short window instead of
+// re-paying a connect timeout for every pid in a sweep (the keeper checks many
+// pids per cycle). Connection-refused fails in ~1 ms so this is only load-bearing
+// when the supervisor itself is wedged.
+const UNREACHABLE_COOLDOWN_MS = 5000;
+let unreachableUntil = 0;
+let unreachableLogged = false;
+let lastFailureKind = "uncertain";
+function classifyFetchError(err) {
+    const e = err;
+    // AbortSignal.timeout → the request was sent and the response never arrived.
+    if (e?.name === "TimeoutError" || e?.name === "AbortError")
+        return "uncertain";
+    const code = e?.cause?.code ?? e?.cause?.errors?.find((x) => x?.code)?.code ?? e?.code ?? undefined;
+    switch (code) {
+        case "ECONNREFUSED":
+        case "ENOTFOUND":
+        case "EAI_AGAIN":
+        case "EADDRNOTAVAIL":
+        case "EHOSTUNREACH":
+        case "ENETUNREACH":
+        case "UND_ERR_CONNECT_TIMEOUT":
+            return "no-connection";
+    }
+    // Some undici versions wrap the socket error in a bare Error with only a
+    // message ("connect ECONNREFUSED …", "bad port"). Fall back to the text for
+    // the same connection-never-established classes; anything unrecognized stays
+    // "uncertain" — the safe direction.
+    const msg = e?.cause?.message ?? "";
+    if (/ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|ENETUNREACH|bad port|invalid url/i.test(msg))
+        return "no-connection";
+    return "uncertain";
+}
+function brokerBaseUrl() {
+    const port = Number.parseInt(process.env.SUPERVISOR_HTTP_PORT ?? "", 10) || 8848;
+    return `http://127.0.0.1:${port}`;
+}
+function authHeaders() {
+    const secret = process.env.MCP_HTTP_SECRET;
+    return secret ? { Authorization: `Bearer ${secret}` } : {};
+}
+async function brokerFetchClassified(path, init, timeoutMs = REQUEST_TIMEOUT_MS, opts) {
+    const now = Date.now();
+    // During the cooldown we answer from the LAST observed failure kind: the
+    // spawn contract needs "could the broker have received a request" and a
+    // skipped call inherits the evidence that started the cooldown. The cooldown
+    // exists to protect the keeper's many-pids-per-cycle sweeps from paying a
+    // full timeout each; spawn/reconcile calls are rare and correctness-critical,
+    // so they bypass it — a reconcile probe must never be answered from stale
+    // evidence created by the very spawn it is reconciling.
+    if (!opts?.bypassCooldown && now < unreachableUntil)
+        return { res: null, failure: lastFailureKind };
+    try {
+        const res = await fetch(`${brokerBaseUrl()}${path}`, {
+            ...init,
+            headers: { ...authHeaders(), ...init?.headers },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        unreachableLogged = false;
+        return { res };
+    }
+    catch (err) {
+        const failure = classifyFetchError(err);
+        unreachableUntil = Date.now() + UNREACHABLE_COOLDOWN_MS;
+        lastFailureKind = failure;
+        if (!unreachableLogged) {
+            // WARN, deliberately: every liveness answer during this outage degrades to
+            // "cannot confirm → treat alive" and every kill falls back to best-effort —
+            // a silent fallback must never look like a healthy answer. Logged once per
+            // outage episode (reset on the first successful call) to avoid a warn storm
+            // when the keeper sweeps many pids per cycle.
+            log.warn(`[broker] unreachable (${errorMessage(err)}, ${failure}) — degrading to "cannot confirm": liveness treated as alive, kills fall back to native root-only`);
+            unreachableLogged = true;
+        }
+        return { res: null, failure };
+    }
+}
+async function brokerFetch(path, init, timeoutMs = REQUEST_TIMEOUT_MS) {
+    return (await brokerFetchClassified(path, init, timeoutMs)).res;
+}
+/**
+ * Ask the broker whether `pid` is alive AND (when `startedAtMs` is given) still
+ * the same process we spawned (creation-time identity, ±60s tolerance — the
+ * same rule the deleted tasklist/Get-Process snapshots enforced).
+ * `startTimeTicks` (native creation FILETIME from a broker spawn) upgrades the
+ * check to exact identity. Returns null when the broker cannot answer.
+ */
+export async function brokerCheckAlive(pid, startedAtMs, startTimeTicks) {
+    const params = new URLSearchParams({ pid: String(pid) });
+    if (startTimeTicks !== undefined && startTimeTicks !== 0)
+        params.set("startTicks", String(startTimeTicks));
+    else if (startedAtMs !== undefined)
+        params.set("startMs", String(Math.round(startedAtMs)));
+    const res = await brokerFetch(`/proc/alive?${params}`);
+    if (!res || !res.ok)
+        return null;
+    try {
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Job-based thread liveness — the single source of truth for a broker-spawned
+ * worker. A launcher CLI (claude.exe/copilot.exe forks the real agent then exits)
+ * makes the originally-spawned pid a lie; the thread's JOB is not. Returns
+ * `known:false` when the broker has no record of the thread, and null when the
+ * broker cannot answer (unreachable → "cannot confirm → treat alive").
+ */
+export async function brokerCheckAliveByThread(threadId) {
+    const res = await brokerFetch(`/proc/alive?threadId=${threadId}`);
+    if (!res)
+        return null; // unreachable → cannot confirm
+    if (res.status === 404)
+        return { known: false, alive: false };
+    if (!res.ok)
+        return null;
+    try {
+        const b = (await res.json());
+        return {
+            known: true,
+            alive: b.alive,
+            source: b.source,
+            exitCode: b.exitCode,
+            registryState: b.registryState,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Ask the broker to kill the process tree rooted at `pid` (native, identity-
+ * checked when `startedAtMs` is given; the broker records the outcome in its
+ * on-disk registry). Returns null when the broker cannot answer — the caller
+ * must then fall back / re-verify, never assume the kill happened.
+ *
+ * Pass `pid` as undefined to route the kill by THREAD instead: the broker then
+ * takes the KillByThread path (job kill of every live member, or the registry-
+ * identity survivor when the job assign failed) rather than KillByPid. This is
+ * the correct call for a launcher-forked worker whose recorded pid is the
+ * already-exited launcher — KillByPid(launcher) hits the broker's AlreadyDead
+ * fast-path and never touches the live forked child.
+ */
+export async function brokerKillTree(pid, opts = {}) {
+    const res = await brokerFetch(`/proc/kill`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            pid,
+            threadId: opts.threadId,
+            startMs: opts.startedAtMs !== undefined ? Math.round(opts.startedAtMs) : undefined,
+            killedBy: opts.killedBy ?? "mcp",
+            reason: opts.reason,
+        }),
+    }, MUTATE_TIMEOUT_MS);
+    if (!res)
+        return null;
+    // 403 = the broker REFUSED (self/server protection). That is an answer, not an
+    // outage: report it as not-killed-still-alive so callers never retry-storm.
+    if (!res.ok && res.status !== 403)
+        return null;
+    try {
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Ask the supervisor to spawn an agent process: CreateProcess(CREATE_SUSPENDED)
+ * → assign to the thread's named job → resume. The supervisor is the process
+ * owner; children (hooks, grandchildren) land in the job automatically.
+ * Spawn is idempotent by threadId server-side (create-or-return), which is what
+ * makes retrying after an uncertain outcome safe.
+ */
+export async function brokerSpawn(spec) {
+    const { res, failure } = await brokerFetchClassified(`/proc/spawn`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(spec),
+    }, spawnTimeoutOverride ?? SPAWN_TIMEOUT_MS, { bypassCooldown: true });
+    if (!res) {
+        return failure === "no-connection"
+            ? { unavailable: "broker unreachable — connection never established" }
+            : { uncertain: "spawn request timed out or the connection was lost mid-flight" };
+    }
+    if (res.status === 404 || res.status === 401)
+        return {
+            unavailable: res.status === 404
+                ? "/proc/spawn not available on this supervisor build"
+                : "broker rejected the bearer secret",
+        };
+    try {
+        const body = (await res.json());
+        if (res.ok && body.ok && typeof body.pid === "number" && body.pid > 0) {
+            return {
+                pid: body.pid,
+                startTimeTicks: body.startTimeTicks ?? 0,
+                startTimeMs: body.startTimeMs ?? Date.now(),
+                jobName: body.jobName ?? null,
+                jobAssignFailed: body.jobAssignFailed ?? false,
+                existing: body.existing ?? false,
+            };
+        }
+        return { error: body.error ?? `broker answered HTTP ${res.status} without an error detail` };
+    }
+    catch {
+        // A 200 the broker sent but we could not read — the spawn may well have
+        // happened. Only a non-OK status is a definitive failure.
+        return res.ok
+            ? { uncertain: `broker answered HTTP ${res.status} but the body was unreadable` }
+            : { error: `broker answered HTTP ${res.status} with an unparseable body` };
+    }
+}
+/**
+ * The broker's live process list for a thread (job members, falling back to the
+ * registry root's tree). This is the reconcile source of truth after an
+ * uncertain spawn: a live entry here means the thread HAS its process — adopt
+ * it, never spawn another. `known:false` → the broker answered and has no
+ * record of the thread. Null → broker could not answer.
+ */
+export async function brokerListThread(threadId) {
+    const { res } = await brokerFetchClassified(`/proc/list?threadId=${threadId}`, undefined, REQUEST_TIMEOUT_MS, {
+        bypassCooldown: true,
+    });
+    if (!res)
+        return null;
+    if (res.status === 404)
+        return { known: false, processes: [] };
+    if (!res.ok)
+        return null;
+    try {
+        const body = (await res.json());
+        return { known: true, processes: body.processes ?? [] };
+    }
+    catch {
+        return null;
+    }
+}
+// ── Adopt (safe-cutover migration) ──────────────────────────────────────────
+/**
+ * Ask the broker to adopt an already-running process (spawned before the broker
+ * owned spawning, or during a broker outage) into the thread's job + registry.
+ * Idempotent server-side. Best-effort: null when the broker cannot answer.
+ */
+export async function brokerAdopt(threadId, pid, startedAtMs, role) {
+    const res = await brokerFetch(`/proc/adopt`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            threadId,
+            pid,
+            startMs: startedAtMs !== undefined ? Math.round(startedAtMs) : undefined,
+            role,
+        }),
+    }, 
+    // Adopt walks and job-assigns a whole tree — give it the mutate budget.
+    MUTATE_TIMEOUT_MS);
+    if (!res || !res.ok)
+        return null;
+    try {
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Ask the supervisor — the single process-lifecycle owner — to tear down and
+ * respawn THIS server (self-update path). The supervisor answers 202 before
+ * doing anything: the requester is the process about to be killed, so it can
+ * never observe completion. 409 means a restart is already in progress, which
+ * delivers exactly what the caller wants — treat it as success.
+ *
+ * Returns null when the supervisor cannot answer (unreachable, or an old
+ * binary without /restart → 404/401). The caller decides between the flagged
+ * legacy self-spawn fallback and a loud abort — same contract as brokerSpawn.
+ */
+export async function brokerRequestRestart(reason) {
+    const res = await brokerFetch(`/restart`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ reason }),
+    });
+    if (!res)
+        return null;
+    if (res.status === 202)
+        return "accepted";
+    if (res.status === 409)
+        return "in-progress";
+    return null; // 404 = old supervisor binary; 401 = misconfigured secret
+}
+/** Load a thread's persisted keeper counters. Null → broker unreachable OR no
+ *  state saved yet (both mean "start from defaults"). */
+export async function brokerGetKeeperState(threadId) {
+    const res = await brokerFetch(`/proc/keeper?threadId=${threadId}`);
+    if (!res || !res.ok)
+        return null;
+    try {
+        const body = (await res.json());
+        return body.found && body.state ? body.state : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist a thread's keeper counters (fire-and-forget from the keeper; a lost
+ *  write degrades to today's in-memory behavior, already logged at WARN by the
+ *  unreachable path). */
+export async function brokerSaveKeeperState(state) {
+    await brokerFetch(`/proc/keeper`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(state),
+    });
+}
+/** Test hook: reset the unreachable-cooldown state. */
+export function resetBrokerClientState() {
+    unreachableUntil = 0;
+    unreachableLogged = false;
+    lastFailureKind = "uncertain";
+}
+/** Test hook: shrink the spawn liveness backstop so timeout-class tests don't
+ *  wait 30s. Pass null to restore the default. */
+let spawnTimeoutOverride = null;
+export function brokerSpawnTimeoutForTest(ms) {
+    spawnTimeoutOverride = ms;
+}
+//# sourceMappingURL=broker-client.js.map