totemlayer 0.1.63 → 0.1.66

package/bin/worker-core/adapters.mjs

@@ -63,6 +63,9 @@ export function createCommandAdapter(config) {
   const maxOutputBytes = integer(config.maxOutputBytes, 1024 * 1024, 16 * 1024 * 1024);
   const parseResult = config.parseResult ?? ((output) => ({ status: "completed", output }));
   if (typeof parseResult !== "function") throw new WorkerError("INVALID_ADAPTER_CONFIG");
+  const supervised = config.managedLifecycle === "darwin-coalition";
+  if (config.managedLifecycle !== undefined && (!supervised || process.platform !== "darwin"))
+    throw new WorkerError("INVALID_ADAPTER_CONFIG");
 
   return {
     async run({ prompt, signal }) {
@@ -97,7 +100,8 @@ export function createCommandAdapter(config) {
         // Also remove surviving descendants if the parent exits before escalation.
         const kill = (kind) => {
           try {
-            if (process.platform !== "win32" && child?.pid) process.kill(-child.pid, kind);
+            if (supervised) child?.kill("SIGTERM");
+            else if (process.platform !== "win32" && child?.pid) process.kill(-child.pid, kind);
             else if (child?.pid) {
               // A Windows shim can outlive its parent and keep stdio open.
               const killer = spawn("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], {
@@ -119,8 +123,10 @@ export function createCommandAdapter(config) {
           failure = new WorkerError(code);
           // Kill the complete child process group on POSIX, including spawned tools.
           kill("SIGTERM");
-          killTimer = setTimeout(() => kill("SIGKILL"), 1000);
-          killTimer.unref();
+          if (!supervised) {
+            killTimer = setTimeout(() => kill("SIGKILL"), 1000);
+            killTimer.unref();
+          }
         };
         const cancel = () => stop("RUN_CANCELLED");
         try {
@@ -130,7 +136,7 @@ export function createCommandAdapter(config) {
             shell: false,
             detached: process.platform !== "win32",
             windowsHide: true,
-            stdio: ["pipe", "pipe", "pipe"],
+            stdio: supervised ? ["pipe", "pipe", "pipe", "pipe"] : ["pipe", "pipe", "pipe"],
           });
         } catch (error) {
           reject(Object.assign(new WorkerError("AGENT_START_FAILED"), { cause: error }));
@@ -155,6 +161,21 @@ export function createCommandAdapter(config) {
         child.stdin.on("error", () => {
           /* A failed child can close stdin early. */
         });
+        if (supervised) {
+          let reported = false;
+          child.stdio[3].on("data", (status) => {
+            if (!reported && status.includes(83)) {
+              reported = true;
+              process.emitWarning(
+                "Native process cleanup is delayed; Totem is retrying and has not completed the turn.",
+                { code: "AGENT_CLEANUP_STALLED" },
+              );
+            }
+          });
+          child.stdio[3].on("error", () => {
+            /* Supervisor exit closes the private channel. */
+          });
+        }
         child.on("error", (error) => {
           failure ??= Object.assign(new WorkerError("AGENT_START_FAILED"), { cause: error });
         });
@@ -163,9 +184,9 @@ export function createCommandAdapter(config) {
           clearTimeout(killTimer);
           signal?.removeEventListener("abort", cancel);
           // A successful foreground turn cannot leave background tools behind.
-          if (config.inheritSystemEnvironment === false) kill("SIGKILL");
+          if (!supervised && config.inheritSystemEnvironment === false) kill("SIGKILL");
           if (failure) {
-            kill("SIGKILL");
+            if (!supervised) kill("SIGKILL");
             return reject(diagnosticFailure(failure, code));
           }
           if (code !== 0) {

package/bin/worker-core/errors.mjs

@@ -1,4 +1,8 @@
 const SAFE_CODES = new Set([
+  "INSPECTION_BLOCKED",
+  "INSPECTION_UNAVAILABLE",
+  "INSPECTION_LIMIT",
+  "INSPECTION_UNSUPPORTED_FILE",
   "INTERNAL_ERROR",
   "PRIVACY_REVIEW_REQUIRED",
   "ISOLATION_UNAVAILABLE",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.63",
+  "version": "0.1.66",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
     "bin",
     "LICENSE.md",
     "README.md",
-    "scripts/prepare.mjs"
+    "scripts/prepare.mjs",
+    "scripts/build-native.mjs"
   ],
   "engines": {
     "node": ">=22.14.0"

package/scripts/build-native.mjs

@@ -0,0 +1,60 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+
+const source = new URL("../native/darwin-lifetime.c", import.meta.url);
+const binary = new URL("../bin/native/darwin-lifetime", import.meta.url);
+const manifest = new URL("../bin/native/darwin-lifetime.json", import.meta.url);
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const sourceSha256 = digest(await readFile(source));
+
+if (process.platform === "win32")
+  throw new Error(
+    "Build the universal CLI tarball on macOS or Linux to preserve the native executable mode; Windows can install that tarball.",
+  );
+
+if (process.platform === "darwin") {
+  await mkdir(new URL("../bin/native/", import.meta.url), { recursive: true });
+  const temporary = `${fileURLToPath(binary)}.${process.pid}.tmp`;
+  try {
+    execFileSync(
+      "/usr/bin/clang",
+      [
+        "-std=c11",
+        "-D_DARWIN_C_SOURCE",
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        "-O2",
+        "-arch",
+        "arm64",
+        "-arch",
+        "x86_64",
+        "-mmacosx-version-min=13.0",
+        fileURLToPath(source),
+        "-o",
+        temporary,
+      ],
+      { stdio: "inherit", timeout: 60_000 },
+    );
+    await rename(temporary, binary);
+    await writeFile(
+      manifest,
+      JSON.stringify({
+        sourceSha256,
+        binarySha256: digest(await readFile(binary)),
+        architectures: ["arm64", "x86_64"],
+        minimumMacOS: "13.0",
+      }) + "\n",
+    );
+  } finally {
+    await rm(temporary, { force: true });
+  }
+} else {
+  // Every published tarball supports both Mac architectures. Build this small
+  // artifact on macOS before packing elsewhere; never ship a stale or missing one.
+  const built = JSON.parse(await readFile(manifest, "utf8"));
+  if (built.sourceSha256 !== sourceSha256 || built.binarySha256 !== digest(await readFile(binary)))
+    throw new Error("Build the current macOS lifetime supervisor on macOS before packing.");
+}

package/scripts/prepare.mjs

@@ -1,5 +1,6 @@
 import { access, readdir, readFile, writeFile } from "node:fs/promises";
 import { transform } from "esbuild";
+import "./build-native.mjs";
 import { generateNetworkContract } from "../../../scripts/generate-network-contract.mjs";
 await generateNetworkContract();
 // This candidate rebases coordination on the immutable published 0.1.21 bundle.