ttsc 0.31.3 → 0.31.4

package/src/compiler/internal/build/runExternalEmitProvenance.ts

@@ -37,6 +37,12 @@ import { PassthroughFlags } from "./PassthroughFlags";
  * supported upstream naming subset; this adapter does not certify arbitrary
  * compiler behavior.
  *
+ * A foreign compiler host that cannot report its writes, a plugin library's own
+ * executable built before ttsc required provenance, is observed instead: the
+ * selected tsgo answers the same read-only probes, the host runs unchanged, and
+ * its writes are the predicted outputs whose metadata moved across the run.
+ * Requiring provenance must never reject such a host outright.
+ *
  * Normally reported ownerless outputs carry their actual failed proof boundary
  * in emittedSourceProofFailures. These explanations preserve compiler streams
  * and status; they do not replace missing ownership with a successful claim.
@@ -63,6 +69,16 @@ export function runExternalEmitProvenance(options: {
   /** Same child environment used by the emitting command. */
   env: NodeJS.ProcessEnv;
 
+  /**
+   * How the emitting command's writes are known. `reported` (the default) reads
+   * the producer's own `TSFILE:` rows. `observed` serves a foreign compiler
+   * host that cannot report them, a plugin library's own executable such as
+   * typia's: `binary` and `args` then only drive the read-only probes, the
+   * callback runs that host unchanged, and a write is a predicted output whose
+   * metadata moved across the run.
+   */
+  writes?: "reported" | "observed";
+
   /**
    * Execute the single emitting command, preserving raw output and whether the
    * child exited normally rather than being killed during reporting.
@@ -79,15 +95,22 @@ export function runExternalEmitProvenance(options: {
   const probe = prepareProbe(options, (reason) => {
     refusal = reason;
   });
+  const observed = options.writes === "observed";
+  const outputsBefore =
+    observed && probe !== undefined
+      ? observePredictedOutputs(probe)
+      : undefined;
   const { result, completedNormally } = options.run(
-    probe === undefined
+    probe === undefined || observed
       ? options.args
       : [...options.args, "--listFiles", "true", "--listEmittedFiles", "true"],
   );
   const lines = result.stdout.split(/\r?\n/);
   const sourceLines = new Set(probe?.files);
   const stdout =
-    probe === undefined || probe.config.compilerOptions.listFiles === true
+    probe === undefined ||
+    observed ||
+    probe.config.compilerOptions.listFiles === true
       ? result.stdout
       : result.stdout
           .split(/(?<=\n)/)
@@ -100,7 +123,12 @@ export function runExternalEmitProvenance(options: {
       emittedSourceProofFailures: undefined,
       stdout,
     };
-  const written = writtenJavaScript(result.stdout, options.cwd);
+  const written =
+    outputsBefore !== undefined
+      ? movedOutputs(outputsBefore)
+      : observed
+        ? []
+        : writtenJavaScript(result.stdout, options.cwd);
   const emittedSources: Record<string, readonly string[]> = Object.create(null);
   const emittedSourceProofFailures: Record<string, string> =
     Object.create(null);
@@ -115,7 +143,11 @@ export function runExternalEmitProvenance(options: {
     };
   }
 
-  const listed = compilerSourceList(lines, options.cwd);
+  // An observed host lists nothing; it compiles the same selected tsconfig, and
+  // the source observations below still prove that selection held still.
+  const listed = observed
+    ? probe.files
+    : compilerSourceList(lines, options.cwd);
   const sameSelection = JSON.stringify(listed) === JSON.stringify(probe.files);
 
   let stable = sameSelection;
@@ -554,6 +586,54 @@ function createOutputPrediction(
   };
 }
 
+/**
+ * Every output the selected sources predict, with its metadata before an
+ * observed host runs.
+ */
+function observePredictedOutputs(probe: {
+  base: string;
+  config: { compilerOptions: Record<string, unknown> };
+  files: readonly string[];
+}): Map<string, string> {
+  const predict = createOutputPrediction(probe.config, probe.base);
+  const outputs = new Map<string, string>();
+  for (const source of probe.files)
+    for (const output of predict(source))
+      outputs.set(output, outputObservation(output));
+  return outputs;
+}
+
+/**
+ * The predicted outputs an observed host wrote: present now, with metadata
+ * other than before. A rewrite inside one clock tick at the same size and inode
+ * stays invisible, which is why a host that can report its writes must declare
+ * `emitProvenance` instead.
+ */
+function movedOutputs(before: ReadonlyMap<string, string>): string[] {
+  const written: string[] = [];
+  for (const [output, observation] of before) {
+    const after = outputObservation(output);
+    if (after !== "missing" && after !== observation) written.push(output);
+  }
+  return written;
+}
+
+/** Device, inode, size and both clocks of one output, or `missing`. */
+function outputObservation(file: string): string {
+  try {
+    const stats = fs.lstatSync(file, { bigint: true });
+    return [
+      stats.dev,
+      stats.ino,
+      stats.size,
+      stats.mtimeNs,
+      stats.ctimeNs,
+    ].join(":");
+  } catch {
+    return "missing";
+  }
+}
+
 /** The writer's TSFILE report, rather than existing files, establishes writes. */
 function writtenJavaScript(stdout: string, cwd: string): string[] {
   const outputs = new Set<string>();

package/src/internal/probeLocalProcess.ts

@@ -0,0 +1,56 @@
+import fs from "node:fs";
+
+/**
+ * Observe whether process `pid` on this host is still running.
+ *
+ * Signal zero answers whether the kernel still holds a process with that id.
+ * Only `ESRCH` proves absence; `EPERM` and other failures remain unknown. On
+ * Linux a successful probe can still name a zombie: a process that has exited
+ * and holds its id only until its parent collects its status. A parent that
+ * never collects, such as a container's PID 1 that is not an init or a
+ * subreaper that collects only when its own command ends, keeps the zombie
+ * indefinitely, so its `/proc` status reports it absent too. A leader whose own
+ * thread exited also reads as a zombie while its other threads run, so the
+ * zombie must be the process's last thread. Its id cannot be reused while the
+ * zombie holds it, so this never names a live process absent.
+ *
+ * @evidence contracts/common.md#principled-implementation ESRCH, or a Linux /proc status of zombie or dead with no other thread, proves the process exited; success with any other status is presence, and every other failure stays unknown.
+ * @evidence contracts/common.md#clear-and-simple-design One probe gives the ttsx run, dependency-lock and plugin-lock owners the same exit decision.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The native signal-zero probe and the kernel's own process status decide; no PID list, timeout or error-to-absent fallback substitutes for them.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why a zombie answers signal zero, which parents leave one behind, why a zombie leader with running threads is not one, and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Node's signal-zero probe works on every platform; only Linux exposes zombies through /proc, and elsewhere the probe's answer stands.
+ * @evidence contracts/performance.md#efficient-algorithms One syscall, plus one small /proc read on Linux when the process exists.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached as proof for a later decision.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The probe retains no handle; the status text becomes reclaimable on return.
+ */
+export function probeLocalProcess(pid: number): {
+  result: "present" | "absent" | "unknown";
+  errorCode?: string;
+} {
+  try {
+    process.kill(pid, 0);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException | null)?.code;
+    return { result: code === "ESRCH" ? "absent" : "unknown", errorCode: code };
+  }
+  if (process.platform !== "linux") return { result: "present" };
+  let status: string;
+  try {
+    status = fs.readFileSync(`/proc/${pid}/status`, "utf8");
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException | null)?.code;
+    // The process was collected between the probe and the read.
+    if (code === "ENOENT" || code === "ESRCH") return { result: "absent" };
+    return { result: "unknown", errorCode: code };
+  }
+  // A leader whose own thread exited reads as a zombie while its other threads
+  // still run; only a zombie that is the process's last thread has exited.
+  const state = /^State:\s*(\S)/m.exec(status)?.[1];
+  const threads = /^Threads:\s*(\d+)/m.exec(status)?.[1];
+  return {
+    result:
+      (state === "Z" || state === "X") && threads === "1"
+        ? "absent"
+        : "present",
+  };
+}

package/src/launcher/internal/runtime/isLocalProcessGone.ts

@@ -1,15 +1,17 @@
 import os from "node:os";
 
+import { probeLocalProcess } from "../../../internal/probeLocalProcess";
+
 /**
  * Whether the process an owner record names has certainly exited: it ran on
  * this host, and no process with its pid is alive.
  *
  * A record from another host proves nothing, because its pid names a process
  * this machine cannot see, so it is never reported gone. An `EPERM` from the
- * probe does not establish absence, so it counts as alive. Only `ESRCH` proves
- * absence; other probe failures remain unknown. A recycled pid makes the answer
- * err toward "alive": a caller that reclaims on "gone" never takes a live
- * owner's state.
+ * probe does not establish absence, so it counts as alive. Only `ESRCH`, or a
+ * Linux zombie that has exited but was never collected, proves absence; other
+ * probe failures remain unknown. A recycled pid makes the answer err toward
+ * "alive": a caller that reclaims on "gone" never takes a live owner's state.
  *
  * Callers supply a validated positive process id, not a process-group selector.
  * Hostname comparison is a host-label convention, not machine authentication:
@@ -18,13 +20,13 @@ import os from "node:os";
  * An optional diagnostic receives this same observation without another probe;
  * a diagnostic failure cannot change the ownership decision.
  *
- * @evidence contracts/common.md#principled-implementation Reclamation requires both the recorded local hostname and ESRCH from the native pid probe; permission, invalid-pid and unknown failures cannot establish that an owner is gone.
- * @evidence contracts/common.md#clear-and-simple-design One conservative predicate supplies the same owner-liveness decision to lock recovery and directory sweeping.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts Native process existence is queried through process.kill(pid, 0); no fixture pid or broad error-to-dead fallback substitutes for ownership evidence.
- * @evidence contracts/common.md#meaningful-documentation The native explanation distinguishes a remote host, a denied or unknown probe and pid recycling, stating why ambiguity protects a live owner's state.
+ * @evidence contracts/common.md#principled-implementation Reclamation requires both the recorded local hostname and probeLocalProcess's absence proof, ESRCH or an uncollected Linux zombie; permission, invalid-pid and unknown failures cannot establish that an owner is gone.
+ * @evidence contracts/common.md#clear-and-simple-design One conservative predicate supplies the same owner-liveness decision to lock recovery and directory sweeping, and shares its probe with plugin build locks.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Native process existence is queried through process.kill(pid, 0) and the kernel's /proc state; no fixture pid or broad error-to-dead fallback substitutes for ownership evidence.
+ * @evidence contracts/common.md#meaningful-documentation The native explanation distinguishes a remote host, a denied or unknown probe, an uncollected zombie and pid recycling, stating why ambiguity protects a live owner's state.
  * @evidence contracts/portability.md#os-neutral-implementation Node exposes the host's process-existence probe and portable error codes; hostname comparison scopes pid identity to this host without assuming POSIX signals can terminate Windows processes.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This observation retains no handle, historical state or cache; temporary lowercase hostname strings become reclaimable after return.
- * @evidence contracts/performance.md#efficient-algorithms Native hostname lookup and two lowercase string constructions/comparison process host-label text before at most one native pid probe; the fixed probe count is not a fixed text or operating-system cost.
+ * @evidence contracts/performance.md#efficient-algorithms Native hostname lookup and two lowercase string constructions/comparison process host-label text before at most one native pid probe and, on Linux, one /proc state read; the fixed probe count is not a fixed text or operating-system cost.
  * @evidenceExclude contracts/performance.md#reuse-equivalent-work Host labels and native process existence are current observations; this predicate coordinates no cross-call cache or reusable liveness proof.
  */
 export function isLocalProcessGone(
@@ -54,14 +56,7 @@ export function isLocalProcessGone(
     report("remote");
     return false;
   }
-  try {
-    process.kill(owner.pid, 0);
-    report("present");
-    return false;
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException | null)?.code;
-    const absent = code === "ESRCH";
-    report(absent ? "absent" : "unknown", code);
-    return absent;
-  }
+  const { result, errorCode } = probeLocalProcess(owner.pid);
+  report(result, errorCode);
+  return result === "absent";
 }

package/src/plugin/internal/load/loadProjectPlugins.ts

@@ -529,17 +529,16 @@ export function loadProjectPlugins(options: {
       records[candidate.index]!.kind === "executable" &&
       !proposals[candidate.index]!.ownModule,
   );
+  const buildDirectories = pluginBuildDirectories(
+    records,
+    effectiveEnv,
+    watchReplacements,
+    packageReaders,
+  );
   // Admission can now narrow the provisional interests without restamping the
   // retained package/module baselines. Final host errors still keep these roots.
-  options.onWatchInputs?.(
-    pluginBuildDirectories(
-      records,
-      effectiveEnv,
-      watchReplacements,
-      packageReaders,
-    ),
-    sourceIdentities,
-  );
+  options.onWatchInputs?.(buildDirectories, sourceIdentities);
+  const keyedDirectories = new Set(buildDirectories);
   const linkedContributors = records
     .filter((record) => record.stage === "transform")
     .flatMap((record) =>
@@ -781,10 +780,12 @@ export function loadProjectPlugins(options: {
       ? { observationsComplete: false as const }
       : {}),
     // The directories the watch inputs named before the builds, as the builds
-    // read them.
+    // read them. Package selection shares these readings and also reads a
+    // linked plugin's module root, which no build keys on, so only the build
+    // directories are reported.
     pluginSources: Object.fromEntries(
       [...sourceDigests]
-        .filter(([directory]) => reportsPluginSource(directory))
+        .filter(([directory]) => keyedDirectories.has(directory))
         .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
         .map(([directory, sourceDigest]) => [
           directory,

package/src/plugin/internal/source/GoBuildCacheCoordination.ts

@@ -322,6 +322,9 @@ export namespace GoBuildCacheCoordination {
     // the child process required for `go build`. The fallback inherits only the
     // low standard descriptors and checks its parent PID. An IPC channel would
     // allocate another high descriptor and recreate Darwin's spawn EBADF limit.
+    // A dead parent that nobody collects stays a zombie and still answers
+    // signal zero, but POSIX reparents the heartbeat when its parent exits, so
+    // a changed parent id ends it as well; Windows never reparents.
     const ready = `${file}.heartbeat-${crypto.randomBytes(16).toString("hex")}`;
     let heartbeatChild: ReturnType<typeof spawn> | undefined;
     try {
@@ -334,7 +337,7 @@ export namespace GoBuildCacheCoordination {
           "const parent = Number(process.argv[3]);",
           "const ready = process.argv[4];",
           "const timer = setInterval(() => {",
-          "  try { process.kill(parent, 0); } catch { clearInterval(timer); process.exit(0); }",
+          "  try { if (process.ppid !== parent) throw 0; process.kill(parent, 0); } catch { clearInterval(timer); process.exit(0); }",
           "  try {",
           '    if (JSON.parse(fs.readFileSync(file, "utf8")).status === "complete") {',
           "      clearInterval(timer); process.exit(0);",

package/src/plugin/internal/source/PluginBuildLockOwner.ts

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { probeLocalProcess } from "../../../internal/probeLocalProcess";
 import { PluginBuildLockProtocol } from "./PluginBuildLockProtocol";
 
 /**
@@ -177,15 +178,16 @@ export namespace PluginBuildLockOwner {
    * process with its id exists. A holder on another host, or one whose id is
    * alive (possibly reused), is not proven gone.
    *
-   * Only ESRCH proves absence. Permission errors, invalid probe arguments and
-   * other failures remain inconclusive and must not authorize reclamation.
+   * Only ESRCH, or a Linux zombie that exited but was never collected, proves
+   * absence. Permission errors, invalid probe arguments and other failures
+   * remain inconclusive and must not authorize reclamation.
    *
-   * @evidence contracts/common.md#principled-implementation Signal zero checks existence without terminating the process; same-host ESRCH establishes absence, while success or any other error does not.
-   * @evidence contracts/common.md#clear-and-simple-design Host comparison and one native probe express the proof boundary directly, without a second process-discovery mechanism.
+   * @evidence contracts/common.md#principled-implementation probeLocalProcess checks existence without terminating the process; same-host ESRCH or an uncollected zombie establishes absence, while presence or any other error does not.
+   * @evidence contracts/common.md#clear-and-simple-design Host comparison and the shared probe express the proof boundary directly, without a second process-discovery mechanism.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Unexpected probe failures are not converted to a dead-owner special case or hidden behind retries.
-   * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners and each inconclusive failure class before the tags.
-   * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code authorizes absence.
-   * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall avoid enumerating native processes; string comparison costs grow only with hostname length.
+   * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners, uncollected zombies and each inconclusive failure class before the tags.
+   * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code, or Linux's own zombie state, authorizes absence.
+   * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall, plus one /proc read on Linux, avoid enumerating native processes; string comparison costs grow only with hostname length.
    *
    * @evidenceExclude contracts/performance.md#reuse-equivalent-work Liveness is a time-sensitive observation; a previously absent or present PID cannot be cached as proof for a later reclamation.
    * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The query owns no retained handle or running task and returns only its immediate proof decision.
@@ -193,12 +195,7 @@ export namespace PluginBuildLockOwner {
   export function gone(owner: IRecord): boolean {
     if (owner.hostname.toLowerCase() !== os.hostname().toLowerCase())
       return false;
-    try {
-      process.kill(owner.pid, 0);
-      return false;
-    } catch (error) {
-      return (error as NodeJS.ErrnoException).code === "ESRCH";
-    }
+    return probeLocalProcess(owner.pid).result === "absent";
   }
 
   /**