@abelxiaoxing/cadence 1.7.0 → 1.8.1

package/src/workspace-io-worker.mjs

@@ -1,6 +1,5 @@
 // Generated by scripts/build-workspace-io.mjs; edit workspace-io-entry.mjs and its source modules.
 // src/workspace-io-entry.mjs
-import { rmSync as rmSync2 } from "node:fs";
 import { parentPort, workerData } from "node:worker_threads";
 
 // src/artifact-store.ts
@@ -211,28 +210,57 @@ class ArtifactStore {
   }
 }
 
+// src/remove-path.ts
+import { lstatSync as lstatSync2, readdirSync, rmdirSync, rmSync, unlinkSync as unlinkSync2 } from "node:fs";
+import path2 from "node:path";
+function removePathSync(target, options = {}) {
+  if (process.platform !== "win32") {
+    rmSync(target, options);
+    return;
+  }
+  let stat;
+  try {
+    stat = lstatSync2(target);
+  } catch (error) {
+    if (options.force && error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  if (stat.isDirectory() && !stat.isSymbolicLink()) {
+    if (!options.recursive)
+      throw Object.assign(new Error("Path is a directory"), {
+        code: "ERR_FS_EISDIR"
+      });
+    for (const name of readdirSync(target))
+      removePathSync(path2.join(target, name), options);
+    rmdirSync(target);
+  } else
+    unlinkSync2(target);
+}
+
 // src/verification-environment-io.ts
 import {
   constants as constants3,
   cpSync,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
-  readdirSync,
+  readdirSync as readdirSync2,
+  readlinkSync,
   realpathSync,
-  rmSync,
   symlinkSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import path2 from "node:path";
+import path3 from "node:path";
 var CACHES = [".vite", ".vite-temp"];
 function within(root, candidate) {
-  const relative = path2.relative(root, candidate);
-  return relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
+  const relative = path3.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative);
 }
 function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings, profile, environment, checkCancelled, privateRoot) {
-  const cleanup = () => rmSync(privateRoot, { recursive: true, force: true });
+  const cleanup = () => removePathSync(privateRoot, { recursive: true, force: true });
   try {
-    const local = profile.mode === "local-trusted";
+    const local = profile.mode !== "isolated";
+    const native = profile.mode === "host-trusted";
     if (local && realpathSync(root) === realpathSync(dependencyOwner))
       throw new Error("trusted-candidate-required");
     const mounts = [
@@ -245,23 +273,31 @@ function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings,
       "reports",
       "dependencies"
     ]) {
-      mkdirSync2(path2.join(privateRoot, directory), { mode: 448 });
+      mkdirSync2(path3.join(privateRoot, directory), { mode: 448 });
     }
-    writeFileSync2(path2.join(privateRoot, "home/user.npmrc"), "");
-    writeFileSync2(path2.join(privateRoot, "home/global.npmrc"), "");
-    const dependencies = path2.join(dependencyOwner, "node_modules");
-    const stat = lstatSync2(dependencies, { throwIfNoEntry: false });
-    if (stat) {
-      const target = path2.join(root, "node_modules");
-      const targetStat = lstatSync2(target, { throwIfNoEntry: false });
+    if (native) {
+      mkdirSync2(path3.join(privateRoot, "home/AppData/Roaming"), {
+        recursive: true
+      });
+      mkdirSync2(path3.join(privateRoot, "home/AppData/Local"), {
+        recursive: true
+      });
+    }
+    writeFileSync2(path3.join(privateRoot, "home/user.npmrc"), "");
+    writeFileSync2(path3.join(privateRoot, "home/global.npmrc"), "");
+    const dependencies = path3.join(dependencyOwner, "node_modules");
+    const stat = lstatSync3(dependencies, { throwIfNoEntry: false });
+    if (stat && !native) {
+      const target = path3.join(root, "node_modules");
+      const targetStat = lstatSync3(target, { throwIfNoEntry: false });
       if (!stat.isDirectory() || stat.isSymbolicLink() || targetStat && (!targetStat.isDirectory() || targetStat.isSymbolicLink())) {
         throw new Error("dependency-path-unsafe");
       }
       if (!targetStat)
         mkdirSync2(target, { mode: 448 });
-      const view = path2.join(privateRoot, "dependencies");
+      const view = path3.join(privateRoot, "dependencies");
       mounts.push({ source: view, target: "/workspace/node_modules" });
-      const entries = readdirSync(dependencies);
+      const entries = readdirSync2(dependencies);
       if (entries.length > 20000)
         throw new Error("dependency-view-too-large");
       const canonical = realpathSync(dependencies);
@@ -272,25 +308,25 @@ function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings,
           throw new Error("dependency-view-too-large");
         if (CACHES.includes(name))
           return;
-        const source = path2.join(dependencies, name);
-        const placeholder = path2.join(view, name);
-        const entry = lstatSync2(source);
+        const source = path3.join(dependencies, name);
+        const placeholder = path3.join(view, name);
+        const entry = lstatSync3(source);
         if (entry.isSymbolicLink()) {
           const resolved = realpathSync(source);
           if (within(canonical, resolved)) {
-            symlinkSync(path2.relative(path2.dirname(source), resolved), placeholder);
+            symlinkSync(path3.relative(path3.dirname(source), resolved), placeholder);
           } else if (within(realpathSync(dependencyOwner), resolved)) {
-            const relative = path2.relative(realpathSync(dependencyOwner), resolved);
-            const candidate = path2.join(root, relative);
-            if (!lstatSync2(candidate, { throwIfNoEntry: false }))
+            const relative = path3.relative(realpathSync(dependencyOwner), resolved);
+            const candidate = path3.join(root, relative);
+            if (!lstatSync3(candidate, { throwIfNoEntry: false }))
               throw new Error("workspace-dependency-missing");
-            symlinkSync(local ? candidate : `/workspace/${relative.split(path2.sep).join("/")}`, placeholder);
+            symlinkSync(local ? candidate : `/workspace/${relative.split(path3.sep).join("/")}`, placeholder);
           } else
             throw new Error("dependency-path-unsafe");
-        } else if (entry.isDirectory() && name.startsWith("@") && !name.includes(path2.sep)) {
+        } else if (entry.isDirectory() && name.startsWith("@") && !name.includes(path3.sep)) {
           mkdirSync2(placeholder);
-          for (const child of readdirSync(source))
-            projectEntry(path2.join(name, child));
+          for (const child of readdirSync2(source))
+            projectEntry(path3.join(name, child));
         } else {
           if (entry.isDirectory())
             mkdirSync2(placeholder);
@@ -300,15 +336,15 @@ function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings,
             throw new Error("dependency-path-unsafe");
           mounts.push({
             source,
-            target: `/workspace/node_modules/${name.split(path2.sep).join("/")}`
+            target: `/workspace/node_modules/${name.split(path3.sep).join("/")}`
           });
         }
       };
       for (const name of entries)
         projectEntry(name);
       for (const cache of CACHES) {
-        mkdirSync2(path2.join(view, cache));
-        const source = path2.join(privateRoot, "cache", cache);
+        mkdirSync2(path3.join(view, cache));
+        const source = path3.join(privateRoot, "cache", cache);
         mkdirSync2(source);
         mounts.push({
           source,
@@ -317,25 +353,25 @@ function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings,
         });
       }
     }
-    if (local && stat) {
+    if (local && stat && !native) {
       const copyEntry = (name) => {
         checkCancelled();
-        const source = path2.join(dependencies, name);
-        const destination = path2.join(root, "node_modules", name);
+        const source = path3.join(dependencies, name);
+        const destination = path3.join(root, "node_modules", name);
         if (CACHES.includes(name)) {
           mkdirSync2(destination, { recursive: true });
           return;
         }
         removeEntry(destination, checkCancelled);
-        const stat2 = lstatSync2(source);
+        const stat2 = lstatSync3(source);
         if (stat2.isSymbolicLink()) {
           const resolved = realpathSync(source);
-          const translated = within(canonicalRoot(dependencyOwner), resolved) ? path2.join(root, path2.relative(canonicalRoot(dependencyOwner), resolved)) : resolved;
+          const translated = within(canonicalRoot(dependencyOwner), resolved) ? path3.join(root, path3.relative(canonicalRoot(dependencyOwner), resolved)) : resolved;
           symlinkSync(translated, destination);
-        } else if (stat2.isDirectory() && name.startsWith("@") && !name.includes(path2.sep)) {
+        } else if (stat2.isDirectory() && name.startsWith("@") && !name.includes(path3.sep)) {
           mkdirSync2(destination);
-          for (const child of readdirSync(source))
-            copyEntry(path2.join(name, child));
+          for (const child of readdirSync2(source))
+            copyEntry(path3.join(name, child));
         } else
           cpSync(source, destination, {
             recursive: true,
@@ -347,15 +383,67 @@ function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings,
             verbatimSymlinks: true
           });
       };
-      for (const name of readdirSync(path2.join(privateRoot, "dependencies")))
+      for (const name of readdirSync2(path3.join(privateRoot, "dependencies")))
         copyEntry(name);
     }
+    if (native && stat) {
+      const target = path3.join(root, "node_modules");
+      const targetStat = lstatSync3(target, { throwIfNoEntry: false });
+      if (!stat.isDirectory() || stat.isSymbolicLink() || targetStat && (!targetStat.isDirectory() || targetStat.isSymbolicLink()))
+        throw new Error("dependency-path-unsafe");
+      const owner = realpathSync(dependencyOwner);
+      let count = 0;
+      const copy = (source, destination) => {
+        checkCancelled();
+        if (++count > 500000)
+          throw new Error("dependency-view-too-large");
+        const entry = lstatSync3(source);
+        if (entry.isSymbolicLink()) {
+          const resolved = realpathSync(source);
+          if (!within(owner, resolved))
+            throw new Error("dependency-path-unsafe");
+          const candidate = path3.join(root, path3.relative(owner, resolved));
+          if (!within(realpathSync(dependencies), resolved) && !lstatSync3(candidate, { throwIfNoEntry: false }))
+            throw new Error("workspace-dependency-missing");
+          const linked = lstatSync3(resolved);
+          if (linked.isDirectory()) {
+            symlinkSync(candidate, destination, process.platform === "win32" ? "junction" : "dir");
+          } else if (linked.isFile()) {
+            const file = within(realpathSync(dependencies), resolved) ? resolved : candidate;
+            cpSync(file, destination, { mode: constants3.COPYFILE_FICLONE });
+          } else
+            throw new Error("dependency-path-unsafe");
+        } else if (entry.isDirectory()) {
+          mkdirSync2(destination, { recursive: true });
+          for (const name of readdirSync2(source)) {
+            if (source === dependencies && CACHES.includes(name)) {
+              mkdirSync2(path3.join(destination, name));
+              continue;
+            }
+            copy(path3.join(source, name), path3.join(destination, name));
+          }
+        } else if (entry.isFile())
+          cpSync(source, destination, { mode: constants3.COPYFILE_FICLONE });
+        else
+          throw new Error("dependency-path-unsafe");
+      };
+      removeEntry(target, checkCancelled);
+      copy(dependencies, target);
+    }
     const sources = new Map;
     const bindings = runnerBindings.map((binding) => {
+      if (native) {
+        const translate2 = (value) => path3.isAbsolute(value) && within(dependencyOwner, value) ? path3.join(root, path3.relative(dependencyOwner, value)) : value;
+        return {
+          ...binding,
+          executablePath: translate2(binding.executablePath),
+          ...binding.fixedArgs ? { fixedArgs: binding.fixedArgs.map(translate2) } : {}
+        };
+      }
       if (local || !binding.mountSource)
         return { ...binding };
-      const source = path2.resolve(binding.mountSource);
-      const stat2 = lstatSync2(source);
+      const source = path3.resolve(binding.mountSource);
+      const stat2 = lstatSync3(source);
       const executable = realpathSync(binding.executablePath);
       if (!stat2.isDirectory() || stat2.isSymbolicLink() || !within(source, executable)) {
         throw new Error("runner-mount-unavailable");
@@ -366,40 +454,46 @@ function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings,
         sources.set(source, target);
         mounts.push({ source, target });
       }
-      const translate = (file) => path2.posix.join(target, ...path2.relative(source, file).split(path2.sep));
+      const translate = (file) => path3.posix.join(target, ...path3.relative(source, file).split(path3.sep));
       return {
         ...binding,
-        executablePath: translate(executable),
+        executablePath: translate(lstatSync3(binding.executablePath).isSymbolicLink() && !path3.isAbsolute(readlinkSync(binding.executablePath)) ? binding.executablePath : executable),
         ...binding.fixedArgs ? {
-          fixedArgs: binding.fixedArgs.map((arg) => path2.isAbsolute(arg) && within(source, arg) ? translate(arg) : arg)
+          fixedArgs: binding.fixedArgs.map((arg) => path3.isAbsolute(arg) && within(source, arg) ? translate(arg) : arg)
         } : {}
       };
     });
     checkCancelled();
     return {
       privateRoot,
-      mounts,
+      mounts: native ? [] : mounts,
       bindings,
       reportRoot: local ? privateRoot : "/cadence",
       environment: {
         ...local ? Object.fromEntries(profile.inheritEnvironment.flatMap((name) => environment[name] === undefined ? [] : [[name, environment[name] ?? ""]])) : {},
+        ...native ? Object.fromEntries(Object.entries(environment).filter(([key]) => ["SYSTEMROOT", "WINDIR", "COMSPEC", "PATHEXT"].includes(key.toUpperCase()))) : {},
+        ...native ? {
+          USERPROFILE: path3.join(privateRoot, "home"),
+          APPDATA: path3.join(privateRoot, "home", "AppData", "Roaming"),
+          LOCALAPPDATA: path3.join(privateRoot, "home", "AppData", "Local"),
+          TEMP: path3.join(privateRoot, "tmp"),
+          TMP: path3.join(privateRoot, "tmp")
+        } : {},
         CI: "1",
-        HOME: local ? path2.join(privateRoot, "home") : "/cadence/home",
-        XDG_CACHE_HOME: local ? path2.join(privateRoot, "cache") : "/cadence/cache",
-        TMPDIR: local ? path2.join(privateRoot, "tmp") : "/cadence/tmp",
-        npm_config_cache: local ? path2.join(privateRoot, "cache/npm") : "/cadence/cache/npm",
-        npm_config_userconfig: local ? path2.join(privateRoot, "home/user.npmrc") : "/cadence/home/user.npmrc",
-        npm_config_globalconfig: local ? path2.join(privateRoot, "home/global.npmrc") : "/cadence/home/global.npmrc",
+        HOME: local ? path3.join(privateRoot, "home") : "/cadence/home",
+        XDG_CACHE_HOME: local ? path3.join(privateRoot, "cache") : "/cadence/cache",
+        TMPDIR: local ? path3.join(privateRoot, "tmp") : "/cadence/tmp",
+        npm_config_cache: local ? path3.join(privateRoot, "cache/npm") : "/cadence/cache/npm",
+        npm_config_userconfig: local ? path3.join(privateRoot, "home/user.npmrc") : "/cadence/home/user.npmrc",
+        npm_config_globalconfig: local ? path3.join(privateRoot, "home/global.npmrc") : "/cadence/home/global.npmrc",
         PATH: [
           ...new Set([
             ...bindings.filter((binding) => binding.mountSource),
             ...bindings.filter((binding) => !binding.mountSource)
-          ].map((binding) => path2.posix.dirname(binding.executablePath))),
-          ...local ? (environment.PATH ?? "").split(path2.delimiter) : [],
-          "/usr/local/bin",
-          "/usr/bin",
-          "/bin"
-        ].join(":")
+          ].map((binding) => (local ? path3 : path3.posix).dirname(binding.executablePath))),
+          ...local ? (environment.PATH ?? "").split(path3.delimiter) : [],
+          ...native ? [] : ["/usr/local/bin", "/usr/bin", "/bin"]
+        ].join(local ? path3.delimiter : ":")
       }
     };
   } catch (error) {
@@ -412,13 +506,16 @@ function canonicalRoot(root) {
 }
 function removeEntry(file, checkCancelled) {
   checkCancelled();
-  const stat = lstatSync2(file, { throwIfNoEntry: false });
+  const stat = lstatSync3(file, { throwIfNoEntry: false });
   if (!stat)
     return;
-  if (stat.isDirectory())
-    for (const name of readdirSync(file))
-      removeEntry(path2.join(file, name), checkCancelled);
-  rmSync(file, { recursive: stat.isDirectory(), force: true });
+  if (stat.isDirectory() && !stat.isSymbolicLink())
+    for (const name of readdirSync2(file))
+      removeEntry(path3.join(file, name), checkCancelled);
+  removePathSync(file, {
+    recursive: stat.isDirectory() && !stat.isSymbolicLink(),
+    force: true
+  });
 }
 
 // src/verification-identity.ts
@@ -427,13 +524,13 @@ import {
   closeSync as closeSync3,
   constants as constants4,
   fstatSync as fstatSync2,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync4,
   openSync as openSync3,
-  readdirSync as readdirSync2,
-  readlinkSync,
+  readdirSync as readdirSync3,
+  readlinkSync as readlinkSync2,
   readSync
 } from "node:fs";
-import path3 from "node:path";
+import path4 from "node:path";
 function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
   const digest2 = createHash2("sha256");
   let entries = 0;
@@ -444,22 +541,22 @@ function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
     checkCancelled();
     if (++entries > 500000 || Date.now() - started > 60000)
       throw new Error("verification-environment-limit");
-    const stat = lstatSync3(file, { throwIfNoEntry: false });
+    const stat = lstatSync4(file, { throwIfNoEntry: false });
     digest2.update(JSON.stringify([relative, stat ? stat.mode & 511 : null]));
     if (!stat) {
       digest2.update("absent");
       return;
     }
     if (stat.isSymbolicLink()) {
-      digest2.update(JSON.stringify(["link", readlinkSync(file)]));
+      digest2.update(JSON.stringify(["link", readlinkSync2(file)]));
       return;
     }
     if (stat.isDirectory()) {
       digest2.update("directory");
-      for (const name of readdirSync2(file).sort()) {
+      for (const name of readdirSync3(file).sort()) {
         if (dependencyRoot && [".vite", ".vite-temp"].includes(name))
           continue;
-        visit(path3.join(file, name), `${relative}/${name}`, false);
+        visit(path4.join(file, name), `${relative}/${name}`, false);
       }
       return;
     }
@@ -490,7 +587,7 @@ function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
     }
   };
   for (const root of [...new Set(roots)].sort())
-    visit(root, root, path3.basename(root) === "node_modules");
+    visit(root, root, path4.basename(root) === "node_modules");
   return digest2.digest("hex");
 }
 
@@ -502,15 +599,15 @@ import {
   closeSync as closeSync4,
   constants as constants5,
   fsyncSync as fsyncSync3,
-  lstatSync as lstatSync5,
+  lstatSync as lstatSync6,
   mkdirSync as mkdirSync3,
   openSync as openSync4,
   readFileSync as readFileSync2,
   renameSync as renameSync2,
-  unlinkSync as unlinkSync2,
+  unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 import { promisify } from "node:util";
 
 // src/canonical.ts
@@ -629,15 +726,15 @@ function isValidRelativePath(p) {
 }
 
 // src/safe-path.ts
-import { lstatSync as lstatSync4 } from "node:fs";
-import path4 from "node:path";
+import { lstatSync as lstatSync5 } from "node:fs";
+import path5 from "node:path";
 function observeSafePath(root, relative) {
   if (!isValidRelativePath(relative)) {
     return { kind: "unsafe", reason: "invalid-path" };
   }
   try {
-    const resolvedRoot = path4.resolve(root);
-    const rootStat = lstatSync4(resolvedRoot, { throwIfNoEntry: false });
+    const resolvedRoot = path5.resolve(root);
+    const rootStat = lstatSync5(resolvedRoot, { throwIfNoEntry: false });
     if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
       return { kind: "unsafe", reason: "root-unavailable" };
     }
@@ -646,11 +743,11 @@ function observeSafePath(root, relative) {
     let current = resolvedRoot;
     const parts = relative.split("/");
     for (const [index, part] of parts.entries()) {
-      current = path4.join(current, part);
-      if (!current.startsWith(`${resolvedRoot}${path4.sep}`)) {
+      current = path5.join(current, part);
+      if (!current.startsWith(`${resolvedRoot}${path5.sep}`)) {
         return { kind: "unsafe", reason: "invalid-path" };
       }
-      const stat = lstatSync4(current, { throwIfNoEntry: false });
+      const stat = lstatSync5(current, { throwIfNoEntry: false });
       if (!stat)
         return { kind: "absent" };
       if (stat.isSymbolicLink()) {
@@ -753,7 +850,7 @@ function revisionId(parentRevisionId, manifest) {
   return hash("cadence-workspace-revision", parentRevisionId ?? "", manifest);
 }
 function ensureDirectory2(directory) {
-  const stat = lstatSync5(directory, { throwIfNoEntry: false });
+  const stat = lstatSync6(directory, { throwIfNoEntry: false });
   if (stat) {
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       throw new Error("unsafe-workspace-path");
@@ -761,28 +858,28 @@ function ensureDirectory2(directory) {
     chmodSync2(directory, 448);
     return;
   }
-  let cursor = path5.dirname(directory);
-  while (cursor !== path5.dirname(cursor)) {
-    const ancestor = lstatSync5(cursor, { throwIfNoEntry: false });
+  let cursor = path6.dirname(directory);
+  while (cursor !== path6.dirname(cursor)) {
+    const ancestor = lstatSync6(cursor, { throwIfNoEntry: false });
     if (ancestor) {
       if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
         throw new Error("unsafe-workspace-path");
       }
       break;
     }
-    cursor = path5.dirname(cursor);
+    cursor = path6.dirname(cursor);
   }
   mkdirSync3(directory, { recursive: true, mode: 448 });
-  const created = lstatSync5(directory);
+  const created = lstatSync6(directory);
   if (created.isSymbolicLink() || !created.isDirectory()) {
     throw new Error("unsafe-workspace-path");
   }
   chmodSync2(directory, 448);
 }
 function writeAtomic2(target, bytes) {
-  const directory = path5.dirname(target);
+  const directory = path6.dirname(target);
   ensureDirectory2(directory);
-  const temporary = path5.join(directory, `.${path5.basename(target)}.${process.pid}.${randomUUID2()}.tmp`);
+  const temporary = path6.join(directory, `.${path6.basename(target)}.${process.pid}.${randomUUID2()}.tmp`);
   const descriptor = openSync4(temporary, constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY, 384);
   try {
     writeFileSync3(descriptor, bytes);
@@ -796,7 +893,7 @@ function writeAtomic2(target, bytes) {
     syncDirectory(directory);
   } catch (error) {
     try {
-      unlinkSync2(temporary);
+      unlinkSync3(temporary);
     } catch {}
     throw error;
   }
@@ -866,10 +963,10 @@ class WorkspaceStore {
   constructor(root, artifacts, options = {}) {
     this.#checkCancelled = options.checkCancelled ?? (() => {});
     this.#onMetrics = options.onMetrics;
-    if (!path5.isAbsolute(root))
+    if (!path6.isAbsolute(root))
       throw new Error("workspace-store-root-invalid");
-    this.root = path5.resolve(root);
-    this.#revisions = path5.join(this.root, "revisions");
+    this.root = path6.resolve(root);
+    this.#revisions = path6.join(this.root, "revisions");
     this.#artifacts = artifacts;
     ensureDirectory2(this.root);
     ensureDirectory2(this.#revisions);
@@ -877,7 +974,7 @@ class WorkspaceStore {
   #revisionPath(id) {
     if (!SHA2562.test(id))
       throw new Error("workspace-revision-id-invalid");
-    return path5.join(this.#revisions, id.slice(0, 2), `${id}.json`);
+    return path6.join(this.#revisions, id.slice(0, 2), `${id}.json`);
   }
   #storeRevision(parentRevisionId, rawEntries) {
     const entries = stableEntries(rawEntries);
@@ -890,7 +987,7 @@ class WorkspaceStore {
       entries
     };
     const target = this.#revisionPath(id);
-    const existing = lstatSync5(target, { throwIfNoEntry: false });
+    const existing = lstatSync6(target, { throwIfNoEntry: false });
     if (existing) {
       const stored = this.getRevision(id);
       if (JSON.stringify(stored) !== JSON.stringify(revision)) {
@@ -922,8 +1019,8 @@ class WorkspaceStore {
     return false;
   }
   captureBaseline(input) {
-    const consumerRoot = path5.resolve(input.consumerRoot);
-    const rootStat = lstatSync5(consumerRoot, { throwIfNoEntry: false });
+    const consumerRoot = path6.resolve(input.consumerRoot);
+    const rootStat = lstatSync6(consumerRoot, { throwIfNoEntry: false });
     if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
       throw new Error("unsafe-workspace-path");
     }
@@ -936,7 +1033,7 @@ class WorkspaceStore {
     const timeout = input.gitTimeoutMs ?? 30000;
     if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000)
       throw new Error("workspace-git-timeout-invalid");
-    const consumerRoot = path5.resolve(input.consumerRoot);
+    const consumerRoot = path6.resolve(input.consumerRoot);
     let tracked;
     try {
       tracked = parseNullSeparated(execFileSync("git", ["ls-files", "-z", "--cached"], {
@@ -970,10 +1067,10 @@ class WorkspaceStore {
       }
       if (observation.kind !== "file")
         throw new Error("unsafe-workspace-path");
-      const absolute = path5.join(consumerRoot, ...relative.split("/"));
+      const absolute = path6.join(consumerRoot, ...relative.split("/"));
       const bytes = readFileSync2(absolute);
       const artifact = this.#artifacts.put(bytes);
-      const stat = lstatSync5(absolute);
+      const stat = lstatSync6(absolute);
       entries[relative] = {
         kind: "file",
         hash: artifact.hash,
@@ -994,7 +1091,7 @@ class WorkspaceStore {
   }
   getRevision(id) {
     const target = this.#revisionPath(id);
-    const stat = lstatSync5(target, { throwIfNoEntry: false });
+    const stat = lstatSync6(target, { throwIfNoEntry: false });
     if (!stat?.isFile() || stat.isSymbolicLink()) {
       throw new Error("workspace-revision-unavailable");
     }
@@ -1073,7 +1170,7 @@ class WorkspaceStore {
   }
   materialize(revisionIdValue, destination) {
     const revision = this.getRevision(revisionIdValue);
-    const root = path5.resolve(destination);
+    const root = path6.resolve(destination);
     ensureDirectory2(root);
     for (const [relative, entry] of Object.entries(revision.entries)) {
       this.#checkCancelled();
@@ -1092,10 +1189,10 @@ class WorkspaceStore {
       const segments = relative.split("/");
       let parent = root;
       for (const segment of segments.slice(0, -1)) {
-        parent = path5.join(parent, segment);
+        parent = path6.join(parent, segment);
         ensureDirectory2(parent);
       }
-      const target = path5.join(root, ...segments);
+      const target = path6.join(root, ...segments);
       if (observation.kind !== "absent") {
         throw new Error("workspace-materialize-conflict");
       }
@@ -1107,8 +1204,8 @@ class WorkspaceStore {
   }
   async captureBaselineWithGit(input, signal) {
     signal?.throwIfAborted();
-    const consumerRoot = path5.resolve(input.consumerRoot);
-    const stat = lstatSync5(consumerRoot, { throwIfNoEntry: false });
+    const consumerRoot = path6.resolve(input.consumerRoot);
+    const stat = lstatSync6(consumerRoot, { throwIfNoEntry: false });
     if (!stat?.isDirectory() || stat.isSymbolicLink())
       throw new Error("unsafe-workspace-path");
     const excluded = [".git", "node_modules", ...input.excludedPaths ?? []];
@@ -1173,7 +1270,7 @@ try {
     const result = prepareVerificationEnvironmentIo(root, owner, bindings, profile, environment, checkCancelled, scratch);
     parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
   } else if (workerData.operation === "cleanupVerification") {
-    rmSync2(workerData.args[0], { recursive: true, force: true });
+    removePathSync(workerData.args[0], { recursive: true, force: true });
     parentPort.postMessage({ ok: true, files: 0, bytes: 0 });
   } else if (workerData.operation === "verificationIdentity") {
     const result = verificationEnvironmentDigest(workerData.args[0], checkCancelled);