stitchkit 0.103.11 → 0.103.12

package/CHANGELOG.md

@@ -15,6 +15,25 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.103.12] - 2026-10-03
+
+### Fixed
+
+- `stitchkit/primitives`: bounded canonical JSON serializes one admitted snapshot, preserving
+  historical key order and undefined handling while refusing unstable Proxy reads and oversized
+  escaped UTF-8 output before unbounded encoding. Durable JSON predicates avoid copying or encoding.
+- `stitchkit/process`: post-spawn launch failures retain cleanup ownership; process-group cleanup
+  uses proven ownership and monotonic deadlines. Exclusive-lock stale guards have bounded depth.
+- Direct sandbox launchers retain process-group cleanup through leader settlement.
+- Release tooling requires every selected evidence job and remote exact-SHA push CI before tags;
+  CI covers the complete affected tree independently of which packages are published, preserving
+  package paths across renames and Unicode or control characters in filenames.
+- Gate reuse includes tracked inputs matched by ignore rules, fingerprints only selected external
+  inputs, rechecks them after execution and serializes memo mutations. Memory admission reads exact
+  v1/v2 controller paths, including colons and trailing spaces; registry polling
+  bounds requests, bodies and waits with one elapsed deadline.
+
+
 ## [0.103.11] - 2026-10-02
 
 ### Added

package/dist/agent-runtime/coding-shell-process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-shell-process.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-shell-process.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,qBAAqB,EAAqB,MAAM,wBAAwB,CAAC;AAEvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAuCrD,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,UAAU,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CACrE;;;;;;;;;;;;;;;GAkKA"}
+{"version":3,"file":"coding-shell-process.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-shell-process.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,qBAAqB,EAAqB,MAAM,wBAAwB,CAAC;AAEvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAuCrD,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,UAAU,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CACrE;;;;;;;;;;;;;;;GAkKA"}

package/dist/agent-runtime/sandbox-process-owner.d.ts

@@ -1,4 +1,4 @@
-import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
 import type { AgentProcessSandbox } from './sandbox.js';
 /** All entry paths share one command admission limit and one shutdown barrier. */
 export declare function sandboxProcessOwner(assertActive: () => void, maximum: number): {

package/dist/agent-runtime/sandbox-process-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-process-owner.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/sandbox-process-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAIhF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM;;mBAOrD,8BAA8B;;iBA6BrC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;EAkC7D"}
+{"version":3,"file":"sandbox-process-owner.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/sandbox-process-owner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAKzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM;;mBAiBrD,8BAA8B;;iBAmCrC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;EAmB7D"}

package/dist/durability/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/durability/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB,qCAS7B,CAAC"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/durability/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB,qCAQ7B,CAAC"}

package/dist/entrypoints/agent-runtime/coding-tools.js

@@ -7,8 +7,8 @@ import {
   AgentCodingToolAuthorizationSchema2,
   AgentCodingToolPathAuthorizationSchema2,
   createAgentCodingTools2
-} from "../../index-g4jxe7ve.js";
-import"../../index-32jkwkdm.js";
+} from "../../index-806d5phm.js";
+import"../../index-f330qqyg.js";
 import"../../index-ahvsksw5.js";
 import"../../index-tgzhq07n.js";
 export {

package/dist/entrypoints/agent-runtime/harness.js

@@ -5,7 +5,7 @@ import"../../index-8kzct1d6.js";
 import {
   composeAgentPrompt2,
   createAgentRuntime2
-} from "../../index-9jb61j5a.js";
+} from "../../index-zp4jpkp0.js";
 import"../../index-h97tqqp1.js";
 import"../../index-mnkk1ffz.js";
 import"../../index-n53mswt3.js";
@@ -15,7 +15,7 @@ import"../../index-9pw0a51a.js";
 import"../../index-ct75c3at.js";
 import"../../index-x87j7csh.js";
 import"../../index-m2xqkv55.js";
-import"../../index-ary5s7k0.js";
+import"../../index-69nvze1q.js";
 import"../../index-nggfa2yn.js";
 import"../../index-r5hsgkz5.js";
 import"../../index-n5yqxd3d.js";

package/dist/entrypoints/agent-runtime/sandbox.js

@@ -9,12 +9,13 @@ import"../../index-x87j7csh.js";
 import"../../index-b2bz0kdm.js";
 import {
   createAgentCodingTools2
-} from "../../index-g4jxe7ve.js";
+} from "../../index-806d5phm.js";
 import {
   NativeCommandError2,
+  spawnOwnedCommand,
   nativeCommandOwner,
   startNativeCommand
-} from "../../index-32jkwkdm.js";
+} from "../../index-f330qqyg.js";
 import"../../index-tgzhq07n.js";
 
 // src/agent-runtime/sandbox-bubblewrap.ts
@@ -540,7 +541,6 @@ function spawnSandboxProcess(executable, args, limits, options = {}, onSpawn) {
 }
 
 // src/agent-runtime/sandbox-process-owner.ts
-import { spawn } from "node:child_process";
 function sandboxProcessOwner(assertActive, maximum) {
   const children = new Map;
   const admit = () => {
@@ -548,7 +548,19 @@ function sandboxProcessOwner(assertActive, maximum) {
     if (children.size >= maximum)
       throw new SandboxError("SANDBOX_BUSY", "Sandbox command concurrency limit reached");
   };
+  const terminate = (child) => {
+    const owner = nativeCommandOwner(child) ?? startNativeCommand({ executable: "host-owned-command", signal: new AbortController().signal }, undefined, { launch: () => child, group: process.platform !== "win32", force: true });
+    return owner.terminate();
+  };
   const track = (child) => {
+    const settleDirect = () => {
+      if (!nativeCommandOwner(child))
+        terminate(child).catch(() => {
+          return;
+        });
+    };
+    child.once("exit", settleDirect);
+    child.once("error", settleDirect);
     const closed = new Promise((resolve, reject) => {
       child.once("close", () => {
         const settled = nativeCommandOwner(child)?.result ?? Promise.resolve();
@@ -578,11 +590,12 @@ function sandboxProcessOwner(assertActive, maximum) {
     },
     spawn(input) {
       admit();
-      const child = spawn(input.executable, [...input.args], {
+      const child = spawnOwnedCommand({
+        executable: input.executable,
+        args: input.args,
         cwd: input.cwd,
         env: input.environment,
-        detached: true,
-        stdio: ["pipe", "pipe", "pipe"]
+        group: process.platform !== "win32"
       });
       child.stdin.end();
       track(child);
@@ -590,16 +603,7 @@ function sandboxProcessOwner(assertActive, maximum) {
     },
     async stop() {
       const pending = [...children];
-      await Promise.all(pending.map(([child]) => {
-        let owner = nativeCommandOwner(child);
-        if (!owner) {
-          const adopted = startNativeCommand({ executable: "host-owned-command", signal: new AbortController().signal }, undefined, { launch: () => child, group: process.platform !== "win32", force: true });
-          owner = nativeCommandOwner(child);
-          if (!owner)
-            return adopted.stop();
-        }
-        return owner.terminate();
-      }));
+      await Promise.all(pending.map(([child]) => terminate(child)));
       await Promise.all(pending.map(([, closed]) => closed));
     }
   };

package/dist/entrypoints/agent-runtime.js

@@ -110,7 +110,7 @@ import {
   agentGoalStateSlot2,
   agentTodoStateSlot2,
   createAgentRuntime2
-} from "../index-9jb61j5a.js";
+} from "../index-zp4jpkp0.js";
 import {
   AgentConversationSummarySchema2,
   AgentConversationPageSchema2,
@@ -175,7 +175,7 @@ import {
   StepAbortedError2,
   ParkRecordDecodeError2,
   ParkAbortedError2
-} from "../index-ary5s7k0.js";
+} from "../index-69nvze1q.js";
 import {
   AgentSandboxRestrictionSchema2,
   AgentSandboxGradeSchema2,

package/dist/entrypoints/application/diagnostic-journal.js

@@ -16,7 +16,7 @@ import {
 } from "../../index-w0eqdhyd.js";
 import {
   attemptExclusiveLock
-} from "../../index-ttf0y7b8.js";
+} from "../../index-xvdd2rbb.js";
 import"../../index-nybn2err.js";
 import {
   isRecord

package/dist/entrypoints/files.js

@@ -11,7 +11,7 @@ import {
 } from "../index-n53mswt3.js";
 import {
   attemptExclusiveLock
-} from "../index-ttf0y7b8.js";
+} from "../index-xvdd2rbb.js";
 import"../index-nybn2err.js";
 import {
   writeFileAtomic2,

package/dist/entrypoints/primitives.js

@@ -3,7 +3,7 @@ import {
 } from "../index-xqhede6x.js";
 import {
   isJsonData
-} from "../index-c1jmtxa0.js";
+} from "../index-fm1c1a08.js";
 import {
   serializeCanonicalJson
 } from "../index-zsvzhjtk.js";
@@ -91,9 +91,10 @@ var CanonicalJsonOptionsSchema = z3.strictObject({
 });
 function canonicalJson(value, options = {}) {
   const limits = CanonicalJsonOptionsSchema.parse(options);
-  if (!isJsonData(value, { ...limits, omitObjectUndefined: true }))
+  const snapshot = {};
+  if (!isJsonData(value, { ...limits, omitObjectUndefined: true }, snapshot))
     throw new TypeError("Expected bounded plain JSON: dense arrays, finite numbers, no -0, cycles or accessors");
-  return serializeCanonicalJson(value);
+  return serializeCanonicalJson(snapshot.value);
 }
 // src/primitives/deadline.ts
 import { z as z4 } from "zod";

package/dist/entrypoints/process.js

@@ -6,7 +6,7 @@ import {
 import {
   NativeCommandError2,
   startNativeCommand
-} from "../index-32jkwkdm.js";
+} from "../index-f330qqyg.js";
 // src/process/command.ts
 function runNativeCommand(input) {
   return startNativeCommand(input).result;

package/dist/entrypoints/tools.js

@@ -1,7 +1,7 @@
 import {
   EffectUnresolvedError2,
   createLocalStepDurability2
-} from "../index-ary5s7k0.js";
+} from "../index-69nvze1q.js";
 import {
   AppError2,
   STITCH_ERROR_STATUS2

package/dist/{index-ary5s7k0.js → index-69nvze1q.js}

@@ -1,6 +1,6 @@
 import {
   isJsonData
-} from "./index-c1jmtxa0.js";
+} from "./index-fm1c1a08.js";
 import {
   raceAbort
 } from "./index-mbnnw3f2.js";
@@ -103,7 +103,6 @@ import { z as z2 } from "zod";
 var DurableJsonSchema = z2.custom((value) => isJsonData(value, {
   maxDepth: 100,
   maxNodes: Number.MAX_SAFE_INTEGER,
-  maxBytes: Number.MAX_SAFE_INTEGER,
   omitObjectUndefined: false
 }), "Expected lossless JSON data (finite numbers, plain objects and dense arrays; no accessors)");
 

package/dist/{index-g4jxe7ve.js → index-806d5phm.js}

@@ -5,8 +5,9 @@ import {
 import {
   NativeCommandError2,
   stopCommandGroup,
+  ownsCommandGroup,
   startNativeCommand
-} from "./index-32jkwkdm.js";
+} from "./index-f330qqyg.js";
 import {
   probeAgentProcessSandbox2,
   missingSandboxRestrictions2,
@@ -1073,7 +1074,7 @@ async function runCodingShell(input) {
         return;
       exitCode = event.exitCode;
       signal = event.signal;
-      if (process.platform !== "win32")
+      if (process.platform !== "win32" && child && ownsCommandGroup(child))
         await stopCommandGroup(child?.pid, 0, input.terminationGraceMs, true);
     }
   }, (started) => {