stitchkit 0.103.10 → 0.103.11

package/dist/{index-a4ajxwmb.js → index-g4jxe7ve.js}

@@ -2,6 +2,11 @@ import {
   forbidden2,
   conflict2
 } from "./index-n53mswt3.js";
+import {
+  NativeCommandError2,
+  stopCommandGroup,
+  startNativeCommand
+} from "./index-32jkwkdm.js";
 import {
   probeAgentProcessSandbox2,
   missingSandboxRestrictions2,
@@ -981,7 +986,6 @@ function createSearchAndPatchCodingTools(config, limits) {
 import { realpath as realpath5, stat } from "node:fs/promises";
 
 // src/agent-runtime/coding-shell-process.ts
-import { spawn } from "node:child_process";
 function preview(data, budget) {
   if (data.byteLength <= budget) {
     return { data, headBytes: data.byteLength, tailBytes: 0, omittedBytes: 0 };
@@ -1024,140 +1028,118 @@ async function runCodingShell(input) {
       outcome: "cancelled"
     });
   }
-  return await new Promise((resolve, reject) => {
-    const ownsProcessGroup = process.platform !== "win32";
-    const child = input.spawn ? input.spawn() : spawn(input.executable, input.args, {
-      cwd: input.cwd,
-      env: input.environment,
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: ownsProcessGroup
-    });
-    const stdout = [];
-    const stderr = [];
-    const artifactStdout = [];
-    const artifactStderr = [];
-    let retained = 0;
-    let artifactBytes = 0;
-    let outcome = "exited";
-    let settled = false;
-    let settlementTimer;
-    const cancel = () => terminate("cancelled");
-    const cleanup = () => {
-      clearTimeout(timer);
-      if (settlementTimer)
-        clearTimeout(settlementTimer);
-      input.signal?.removeEventListener("abort", cancel);
-    };
-    const persistAndResolve = async (exitCode, signal) => {
-      if (settled)
-        return;
-      settled = true;
-      cleanup();
-      try {
-        const hasArtifact = input.artifacts && artifactBytes > input.maxOutputBytes;
-        const completeStdout = Buffer.concat(artifactStdout);
-        const completeStderr = Buffer.concat(artifactStderr);
-        const artifactData = hasArtifact ? Buffer.concat([stdoutHeader, completeStdout, stderrHeader, completeStderr]) : undefined;
-        const stdoutBudget = completeStderr.byteLength === 0 ? input.maxOutputBytes : Math.ceil(input.maxOutputBytes / 2);
-        const stderrBudget = completeStdout.byteLength === 0 ? input.maxOutputBytes : Math.floor(input.maxOutputBytes / 2);
-        const stdoutPreview = hasArtifact ? preview(completeStdout, stdoutBudget) : retainedPreview(Buffer.concat(stdout));
-        const stderrPreview = hasArtifact ? preview(completeStderr, stderrBudget) : retainedPreview(Buffer.concat(stderr));
-        const persisted = hasArtifact ? await input.artifacts?.write({
-          mediaType: "text/plain; charset=utf-8",
-          data: artifactData ?? new Uint8Array,
-          ...input.authorization && { authorization: input.authorization }
-        }) : undefined;
-        resolve(ShellOutputSchema.parse({
-          executable: input.executableName,
-          exitCode,
-          signal,
-          stdout: stdoutPreview.data.toString("utf8"),
-          stderr: stderrPreview.data.toString("utf8"),
-          outcome,
-          ...persisted && {
-            artifact: {
-              reference: persisted.reference,
-              bytes: artifactData?.byteLength ?? 0,
-              truncated: outcome === "output-limit",
-              headBytes: stdoutPreview.headBytes + stderrPreview.headBytes,
-              tailBytes: stdoutPreview.tailBytes + stderrPreview.tailBytes,
-              omittedBytes: stdoutPreview.omittedBytes + stderrPreview.omittedBytes
-            }
-          }
-        }));
-      } catch (error) {
-        reject(error);
-      }
-    };
-    const killOwnedProcessGroup = () => {
-      if (!ownsProcessGroup || child.pid === undefined)
-        return false;
-      try {
-        process.kill(-child.pid, "SIGKILL");
-        return true;
-      } catch {
-        return false;
+  const stdout = [];
+  const stderr = [];
+  const artifactStdout = [];
+  const artifactStderr = [];
+  let retained = 0;
+  let artifactBytes = 0;
+  let outcome = "exited";
+  let child;
+  let exitCode = null;
+  let signal = null;
+  const outputLimit = new Error("Coding command output retention budget exceeded");
+  const launch = input.spawn;
+  const retain = (target, artifactTarget, chunk) => {
+    const remaining = Math.max(0, input.maxOutputBytes - retained);
+    if (remaining > 0) {
+      const kept = Buffer.from(chunk.subarray(0, remaining));
+      target.push(kept);
+      retained += kept.byteLength;
+    }
+    if (input.artifacts) {
+      const artifactRemaining = Math.max(0, artifactPayloadLimit - artifactBytes);
+      if (artifactRemaining > 0) {
+        const kept = Buffer.from(chunk.subarray(0, artifactRemaining));
+        artifactTarget.push(kept);
+        artifactBytes += kept.byteLength;
       }
-    };
-    const boundStreamSettlement = () => {
-      if (settlementTimer)
-        return;
-      settlementTimer = setTimeout(() => {
-        child.stdout.destroy();
-        child.stderr.destroy();
-        persistAndResolve(child.exitCode, child.signalCode);
-      }, input.terminationGraceMs);
-    };
-    const terminate = (reason) => {
-      if (settled || outcome !== "exited")
+      if (chunk.byteLength > artifactRemaining)
+        throw outputLimit;
+    } else if (chunk.byteLength > remaining)
+      throw outputLimit;
+  };
+  const command = startNativeCommand({
+    executable: input.executable,
+    args: [...input.args],
+    cwd: input.cwd,
+    env: { ...input.environment },
+    envPolicy: "declared-only",
+    signal: input.signal ?? new AbortController().signal,
+    killGraceMs: 0,
+    onOutput: (bytes, channel) => retain(channel === "stdout" ? stdout : stderr, channel === "stdout" ? artifactStdout : artifactStderr, bytes),
+    onLeaderSettled: async (event) => {
+      if (event.kind !== "exit")
         return;
-      outcome = reason;
-      if (!killOwnedProcessGroup())
-        child.kill("SIGKILL");
-      boundStreamSettlement();
-    };
-    const timer = setTimeout(() => terminate("timeout"), input.timeoutMs);
-    timer.unref();
-    const retain = (target, artifactTarget, chunk) => {
-      const remaining = Math.max(0, input.maxOutputBytes - retained);
-      if (remaining > 0) {
-        const kept = chunk.subarray(0, remaining);
-        target.push(kept);
-        retained += kept.byteLength;
+      exitCode = event.exitCode;
+      signal = event.signal;
+      if (process.platform !== "win32")
+        await stopCommandGroup(child?.pid, 0, input.terminationGraceMs, true);
+    }
+  }, (started) => {
+    child = started;
+  }, {
+    group: process.platform !== "win32",
+    force: true,
+    timeoutMs: input.timeoutMs,
+    cleanupTimeoutMs: input.terminationGraceMs,
+    closeTimeoutMs: input.terminationGraceMs,
+    ...launch ? {
+      launch: () => {
+        child = launch();
+        return child;
       }
-      if (input.artifacts) {
-        const artifactRemaining = Math.max(0, artifactPayloadLimit - artifactBytes);
-        if (artifactRemaining > 0) {
-          const kept = chunk.subarray(0, artifactRemaining);
-          artifactTarget.push(kept);
-          artifactBytes += kept.byteLength;
-        }
-        if (chunk.byteLength > artifactRemaining)
-          terminate("output-limit");
-      } else if (chunk.byteLength > remaining)
-        terminate("output-limit");
-    };
-    child.stdout.on("data", (chunk) => retain(stdout, artifactStdout, Buffer.from(chunk)));
-    child.stderr.on("data", (chunk) => retain(stderr, artifactStderr, Buffer.from(chunk)));
-    child.on("error", (error) => {
-      if (settled)
-        return;
-      settled = true;
-      cleanup();
-      reject(error);
-    });
-    child.on("exit", (exitCode, signal) => {
-      if (outcome === "exited")
-        killOwnedProcessGroup();
-      boundStreamSettlement();
-      if (child.stdout.destroyed && child.stderr.destroyed) {
-        persistAndResolve(exitCode, signal);
+    } : {},
+    maxBufferedBytes: Math.max(64 * 1024, input.maxOutputBytes, input.artifacts ? artifactPayloadLimit : 0)
+  });
+  try {
+    const result = await command.result;
+    exitCode = result.exitCode;
+    signal = result.signal;
+  } catch (error) {
+    if (error === outputLimit)
+      outcome = "output-limit";
+    else if (input.signal?.aborted && error === input.signal.reason)
+      outcome = "cancelled";
+    else if (error instanceof NativeCommandError2 && error.code === "COMMAND_LIMIT" && (error.reason === "deadline" || error.reason === "output-budget"))
+      outcome = error.reason === "deadline" ? "timeout" : "output-limit";
+    else if (error instanceof DOMException && error.name === "AbortError" && error.message === "Command stopped")
+      outcome = "cancelled";
+    else
+      throw error;
+    exitCode = child?.exitCode ?? exitCode;
+    signal = child?.signalCode ?? signal;
+  }
+  const hasArtifact = input.artifacts && artifactBytes > input.maxOutputBytes;
+  const completeStdout = Buffer.concat(artifactStdout);
+  const completeStderr = Buffer.concat(artifactStderr);
+  const artifactData = hasArtifact ? Buffer.concat([stdoutHeader, completeStdout, stderrHeader, completeStderr]) : undefined;
+  const stdoutBudget = completeStderr.byteLength === 0 ? input.maxOutputBytes : Math.ceil(input.maxOutputBytes / 2);
+  const stderrBudget = completeStdout.byteLength === 0 ? input.maxOutputBytes : Math.floor(input.maxOutputBytes / 2);
+  const stdoutPreview = hasArtifact ? preview(completeStdout, stdoutBudget) : retainedPreview(Buffer.concat(stdout));
+  const stderrPreview = hasArtifact ? preview(completeStderr, stderrBudget) : retainedPreview(Buffer.concat(stderr));
+  const persisted = hasArtifact ? await input.artifacts?.write({
+    mediaType: "text/plain; charset=utf-8",
+    data: artifactData ?? new Uint8Array,
+    ...input.authorization && { authorization: input.authorization }
+  }) : undefined;
+  return ShellOutputSchema.parse({
+    executable: input.executableName,
+    exitCode,
+    signal,
+    stdout: stdoutPreview.data.toString("utf8"),
+    stderr: stderrPreview.data.toString("utf8"),
+    outcome,
+    ...persisted && {
+      artifact: {
+        reference: persisted.reference,
+        bytes: artifactData?.byteLength ?? 0,
+        truncated: outcome === "output-limit",
+        headBytes: stdoutPreview.headBytes + stderrPreview.headBytes,
+        tailBytes: stdoutPreview.tailBytes + stderrPreview.tailBytes,
+        omittedBytes: stdoutPreview.omittedBytes + stderrPreview.omittedBytes
       }
-    });
-    child.on("close", (exitCode, signal) => void persistAndResolve(exitCode, signal));
-    input.signal?.addEventListener("abort", cancel, { once: true });
-    if (input.signal?.aborted)
-      cancel();
+    }
   });
 }
 

package/dist/{index-ga597cvy.js → index-ttf0y7b8.js}

@@ -9,10 +9,63 @@ import {
 } from "./index-9jfdm5tg.js";
 
 // src/internal/exclusive-lock.ts
-import { constants } from "node:fs";
-import { lstat, open, unlink } from "node:fs/promises";
+import { lstat, open as open2, unlink } from "node:fs/promises";
 import { hostname } from "node:os";
 import { z } from "zod";
+
+// src/internal/exclusive-lock-read.ts
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+var OWNER_RECORD_BYTES = 16 * 1024;
+
+class LockRecordError extends Error {
+  code;
+  name = "LockRecordError";
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+async function readLockRecord(path, openDescriptor = open, signal) {
+  signal?.throwIfAborted();
+  if (!constants.O_NOFOLLOW || !constants.O_NONBLOCK) {
+    throw new LockRecordError("LOCK_UNSAFE_RECORD", "Safe lock descriptor flags are unavailable");
+  }
+  const handle = await openDescriptor(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    signal?.throwIfAborted();
+    const before = await handle.stat();
+    signal?.throwIfAborted();
+    if (!before.isFile() || before.nlink !== 1) {
+      throw new LockRecordError("LOCK_UNSAFE_RECORD", "Lock record must be a regular file with one link");
+    }
+    if (before.size > OWNER_RECORD_BYTES) {
+      throw new LockRecordError("LOCK_RECORD_TOO_LARGE", "Lock owner record exceeds its byte cap");
+    }
+    const bytes = Buffer.alloc(OWNER_RECORD_BYTES + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      signal?.throwIfAborted();
+      const read = await handle.read(bytes, length, bytes.length - length, length);
+      if (read.bytesRead === 0)
+        break;
+      length += read.bytesRead;
+    }
+    if (length > OWNER_RECORD_BYTES) {
+      throw new LockRecordError("LOCK_RECORD_TOO_LARGE", "Lock owner record grew beyond its byte cap");
+    }
+    const after = await handle.stat();
+    signal?.throwIfAborted();
+    if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || before.nlink !== after.nlink || length !== after.size) {
+      throw new LockRecordError("LOCK_RECORD_CHANGED", "Lock owner record changed during its read");
+    }
+    return { text: bytes.subarray(0, length).toString("utf8"), info: after };
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/internal/exclusive-lock.ts
 var ExclusiveLockOwnerSchema = z.object({
   pid: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
   host: z.string().min(1),
@@ -47,29 +100,25 @@ async function diagnose(owner, declaredIdentity) {
     return { attribution, liveness: "not-probed", owner };
   return { attribution, ...await probeProcessOwner2(owner.pid, owner.process), owner };
 }
-async function readLockFile(path, onFailure) {
-  let handle;
+async function readLockFile(path, onFailure, signal) {
   try {
-    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    const info = await handle.stat();
+    const record = await readLockRecord(path, undefined, signal);
     return {
-      owner: readOwner(await handle.readFile("utf8")),
-      ino: info.ino,
-      mtimeMs: info.mtimeMs
+      owner: readOwner(record.text),
+      ino: record.info.ino,
+      dev: record.info.dev,
+      mtimeMs: record.info.mtimeMs
     };
   } catch (cause) {
     if (!isCode(cause, "ENOENT"))
       onFailure?.(cause);
     return;
-  } finally {
-    await handle?.close().catch(() => {
-      return;
-    });
   }
 }
-async function unlinkIfSame(path, ino) {
+async function unlinkIfSame(path, ino, dev) {
   try {
-    if ((await lstat(path)).ino !== ino)
+    const current = await lstat(path);
+    if (current.ino !== ino || current.dev !== dev || !current.isFile() || current.nlink !== 1)
       return;
     await unlink(path);
   } catch (error) {
@@ -80,7 +129,7 @@ async function unlinkIfSame(path, ino) {
 async function createOwned(path, options, reclaimed) {
   const identity = await machineIdentity(options.machineIdentity);
   const instance = await readProcessInstance(process.pid);
-  const handle = await open(path, "wx", options.mode);
+  const handle = await open2(path, "wx", options.mode);
   const owner = {
     pid: process.pid,
     process: instance,
@@ -89,8 +138,11 @@ async function createOwned(path, options, reclaimed) {
     ...identity !== null && { machine: identity }
   };
   let ino;
+  let dev;
   try {
-    ino = (await handle.stat()).ino;
+    const info = await handle.stat();
+    ino = info.ino;
+    dev = info.dev;
     await handle.chmod(options.mode);
     await handle.writeFile(`${JSON.stringify(owner)}
 `, "utf8");
@@ -98,13 +150,14 @@ async function createOwned(path, options, reclaimed) {
     await handle.close().catch(() => {
       return;
     });
-    if (ino !== undefined)
-      await unlinkIfSame(path, ino).catch(() => {
+    if (ino !== undefined && dev !== undefined)
+      await unlinkIfSame(path, ino, dev).catch(() => {
         return;
       });
     throw error;
   }
   const ownedInode = ino;
+  const ownedDevice = dev;
   let released = false;
   return {
     path,
@@ -117,7 +170,7 @@ async function createOwned(path, options, reclaimed) {
       try {
         await handle.close();
       } finally {
-        await unlinkIfSame(path, ownedInode);
+        await unlinkIfSame(path, ownedInode, ownedDevice);
       }
     }
   };
@@ -137,12 +190,19 @@ async function reclaimUnderGuard(path, options) {
     return;
   const guard = acquired.held;
   try {
-    const state = await readLockFile(path);
+    let unsafe = false;
+    const state = await readLockFile(path, () => {
+      unsafe = true;
+    }, options.signal);
+    if (unsafe)
+      return "refused";
     if (state) {
       const diagnosis = await diagnose(state.owner, options.machineIdentity);
+      if (options.signal?.aborted)
+        return "refused";
       if (!reclaimable(state, diagnosis, options.ownerlessGraceMs))
         return "refused";
-      await unlinkIfSame(path, state.ino);
+      await unlinkIfSame(path, state.ino, state.dev);
     }
     return await createOwned(path, options, state !== undefined).catch((error) => {
       if (isCode(error, "EEXIST"))
@@ -166,11 +226,13 @@ async function attemptExclusiveLock(path, options) {
     let readFailure;
     const state = await readLockFile(path, (cause) => {
       readFailure = cause;
-    });
+    }, options.signal);
     const diagnosis = {
       ...await diagnose(state?.owner, options.machineIdentity),
       ...readFailure !== undefined && { cause: readFailure }
     };
+    if (options.signal?.aborted)
+      return { error, diagnosis };
     if (!state || !reclaimable(state, diagnosis, options.ownerlessGraceMs)) {
       return { error, diagnosis };
     }

package/dist/internal/exclusive-lock-read.d.ts

@@ -0,0 +1,20 @@
+import { type Stats } from 'node:fs';
+interface LockRecordDescriptor {
+    stat(): Promise<Stats>;
+    read(buffer: Buffer, offset: number, length: number, position: number): Promise<{
+        bytesRead: number;
+    }>;
+    close(): Promise<void>;
+}
+export declare class LockRecordError extends Error {
+    readonly code: 'LOCK_UNSAFE_RECORD' | 'LOCK_RECORD_CHANGED' | 'LOCK_RECORD_TOO_LARGE';
+    name: string;
+    constructor(code: 'LOCK_UNSAFE_RECORD' | 'LOCK_RECORD_CHANGED' | 'LOCK_RECORD_TOO_LARGE', message: string);
+}
+/** A descriptor-bound observation, never a pathname stat followed by an unbounded read. */
+export declare function readLockRecord(path: string, openDescriptor?: (path: string, flags: number) => Promise<LockRecordDescriptor>, signal?: AbortSignal): Promise<{
+    text: string;
+    info: Stats;
+}>;
+export {};
+//# sourceMappingURL=exclusive-lock-read.d.ts.map

package/dist/internal/exclusive-lock-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-lock-read.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAMhD,UAAU,oBAAoB;IAC5B,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,uBAAuB;IAF9E,IAAI,SAAqB;IAClC,YACW,IAAI,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,uBAAuB,EACrF,OAAO,EAAE,MAAM,EAGhB;CACF;AAED,2FAA2F;AAC3F,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAQ,EACrF,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA8DxC"}

package/dist/internal/exclusive-lock.d.ts

@@ -35,6 +35,7 @@ export interface HeldExclusiveLock {
     release(): Promise<void>;
 }
 export interface ExclusiveLockAttemptOptions {
+    readonly signal?: AbortSignal;
     readonly mode: number;
     /** Take a lock whose owner is provably gone. `false` refuses every present lock. */
     readonly reclaim: boolean;

package/dist/internal/exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAK5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAmLN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}
+{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAG5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAkMN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CA0B/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}

package/dist/internal/with-exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AAyCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CA4DZ"}
+{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AAyCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CAuEZ"}

package/dist/process/command-owner.d.ts

@@ -1,13 +1,18 @@
-import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type NativeCommandOptions } from './contract.js';
+import { type NativeCommandLaunchDriver } from './launch.js';
 /** One-shot native execution; sandbox policy/admission is composed above this owner. */
-export declare function startNativeCommand(input: NativeCommandOptions, onSpawn?: (child: ChildProcessWithoutNullStreams) => void): {
+export declare function startNativeCommand(input: NativeCommandOptions, onSpawn?: (child: ChildProcessWithoutNullStreams) => void, driver?: NativeCommandLaunchDriver): {
+    result: Promise<never>;
+    stop(): Promise<void>;
+} | {
     result: Promise<{
         exitCode: number | null;
         signal: string | null;
         stdout: Uint8Array<ArrayBuffer>;
         stderr: Uint8Array<ArrayBuffer>;
     }>;
+    terminate(): Promise<void>;
     stop(): Promise<void>;
 };
 //# sourceMappingURL=command-owner.d.ts.map

package/dist/process/command-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAGhF,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAIpB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI;;;;;;;;EA+J1D"}
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,YAAY,CAAC;AAOpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAIlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,EACzD,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;;;EA+LnC"}

package/dist/process/contract.d.ts

@@ -37,9 +37,20 @@ declare const NativeCommandResultSchema: z.ZodObject<{
     stderr: z.ZodInstanceOf<Uint8Array<ArrayBuffer>>;
 }, z.core.$strip>;
 export type NativeCommandResult = z.infer<typeof NativeCommandResultSchema>;
+declare const NativeCommandLimitReasonSchema: z.ZodEnum<{
+    deadline: "deadline";
+    "output-budget": "output-budget";
+}>;
 export declare class NativeCommandError extends Error {
     readonly code: 'COMMAND_LIMIT' | 'COMMAND_UNAVAILABLE' | 'COMMAND_CLEANUP';
-    constructor(code: 'COMMAND_LIMIT' | 'COMMAND_UNAVAILABLE' | 'COMMAND_CLEANUP', message: string, options?: ErrorOptions);
+    /** Observed owner limit; absent on non-limit and caller-constructed errors without evidence. */
+    readonly reason: z.infer<typeof NativeCommandLimitReasonSchema> | undefined;
+    constructor(code: 'COMMAND_LIMIT', message: string, options?: ErrorOptions & {
+        reason?: z.infer<typeof NativeCommandLimitReasonSchema>;
+    });
+    constructor(code: 'COMMAND_LIMIT' | 'COMMAND_UNAVAILABLE' | 'COMMAND_CLEANUP', message: string, options?: ErrorOptions & {
+        reason?: never;
+    });
 }
 export {};
 //# sourceMappingURL=contract.d.ts.map

package/dist/process/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,6BAA6B;;;;;;;2BAOjC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAoBtB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;;;kBAiBvF,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IADnF,YACkB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjF,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,6BAA6B;;;;;;;2BAOjC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAoBtB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;;;kBAiBvF,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,gGAAgG;IAChG,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAeH"}

package/dist/process/group.d.ts

@@ -1,6 +1,11 @@
 import { NativeCommandError } from './contract.js';
+/** Chain native-sized timers; internal callers retain their declared safe-integer deadline. */
+export declare function createCommandDeadline(timeoutMs: number, reason: unknown): {
+    signal: AbortSignal;
+    cancel(): void;
+};
 export declare function signalGroup(pid: number | undefined, signal: NodeJS.Signals): void;
-export declare function stopCommandGroup(pid: number | undefined, graceMs: number, cleanupTimeoutMs?: number): Promise<void>;
+export declare function stopCommandGroup(pid: number | undefined, graceMs: number, cleanupTimeoutMs?: number, force?: boolean): Promise<void>;
 export declare function commandCleanupError(cause: unknown): NativeCommandError;
 export declare function waitForCommandClose<T>(closed: Promise<T>, timeoutMs: number): Promise<T>;
 //# sourceMappingURL=group.d.ts.map

package/dist/process/group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/process/group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWhD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAOjF;AAiCD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,MAAM,EACf,gBAAgB,SAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAItE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAExF"}
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/process/group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,+FAA+F;AAC/F,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAapE,MAAM;IACN,MAAM;EAIT;AAWD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAOjF;AAiCD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,MAAM,EACf,gBAAgB,SAAO,EACvB,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAItE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAMxF"}