@agent-vm/agent-vm 0.0.31 → 0.0.33

package/dist/controller/leases/agent-sandbox-seeding.js

@@ -0,0 +1,178 @@
+import { lstat, mkdir, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { parseAgentScopeKey } from './lease-scope.js';
+function isNodeErrorCode(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+function isPathWithin(candidatePath, rootPath) {
+    const relativePath = path.relative(rootPath, candidatePath);
+    return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));
+}
+function toSecretRef(seed) {
+    return seed.source.source === 'environment'
+        ? {
+            source: 'environment',
+            ref: seed.source.envVar,
+        }
+        : {
+            source: '1password',
+            ref: seed.source.ref,
+        };
+}
+async function writeSeedFileIfAbsent(options) {
+    let fileHandle;
+    try {
+        const targetParentPath = await ensureSeedParentDirectoryInsideWorkspace({
+            targetPath: options.targetPath,
+            workspaceDir: options.workspaceDir,
+        });
+        const safeTargetPath = path.join(targetParentPath, path.basename(options.targetPath));
+        fileHandle = await open(safeTargetPath, 'wx', options.mode);
+        await fileHandle.chmod(options.mode);
+        await fileHandle.writeFile(options.content, 'utf8');
+        await fileHandle.close();
+        fileHandle = undefined;
+        return 'written';
+    }
+    catch (error) {
+        if (fileHandle) {
+            await fileHandle.close();
+        }
+        if (isNodeErrorCode(error, 'EEXIST')) {
+            return 'already-existed';
+        }
+        throw error;
+    }
+}
+async function ensureSeedParentDirectoryInsideWorkspace(options) {
+    const targetParentPath = path.dirname(options.targetPath);
+    const relativeParentPath = path.relative(options.workspaceDir, targetParentPath);
+    if (relativeParentPath !== '' &&
+        (relativeParentPath.startsWith('..') || path.isAbsolute(relativeParentPath))) {
+        throw new Error(`Agent sandbox seed target parent '${targetParentPath}' resolves outside workspace '${options.workspaceDir}'.`);
+    }
+    let currentPath = options.workspaceDir;
+    /* oxlint-disable no-await-in-loop -- each path segment must be validated before the next segment can be trusted */
+    for (const segment of relativeParentPath.split(path.sep).filter((part) => part.length > 0)) {
+        currentPath = path.join(currentPath, segment);
+        let entry = await lstat(currentPath).catch((error) => {
+            if (isNodeErrorCode(error, 'ENOENT')) {
+                return null;
+            }
+            throw error;
+        });
+        if (!entry) {
+            await mkdir(currentPath, { mode: 0o700 });
+            entry = await lstat(currentPath);
+        }
+        if (entry.isSymbolicLink()) {
+            throw new Error(`Agent sandbox seed parent '${currentPath}' must not be a symlink.`);
+        }
+        if (!entry.isDirectory()) {
+            throw new Error(`Agent sandbox seed parent '${currentPath}' is not a directory.`);
+        }
+        const resolvedPath = await realpath(currentPath);
+        if (!isPathWithin(resolvedPath, options.workspaceDir)) {
+            throw new Error(`Agent sandbox seed parent '${currentPath}' resolves outside workspace '${options.workspaceDir}'.`);
+        }
+        currentPath = resolvedPath;
+    }
+    /* oxlint-enable no-await-in-loop */
+    return currentPath;
+}
+export async function seedAgentSandboxWorkspace(options) {
+    if (options.zone.gateway.type !== 'openclaw') {
+        return { kind: 'not-openclaw-zone', zoneId: options.zone.id };
+    }
+    const parsedScope = parseAgentScopeKey(options.scopeKey);
+    if (parsedScope.kind === 'non-agent-scope') {
+        return { kind: 'non-agent-scope', scopeKey: options.scopeKey, zoneId: options.zone.id };
+    }
+    if (parsedScope.kind === 'malformed-agent-scope') {
+        return {
+            kind: 'malformed-agent-scope',
+            reason: parsedScope.reason,
+            scopeKey: options.scopeKey,
+            zoneId: options.zone.id,
+        };
+    }
+    const agentId = parsedScope.agentId;
+    const seeds = options.zone.agentSandboxSeeds?.[agentId] ?? [];
+    if (seeds.length === 0) {
+        return {
+            agentId,
+            kind: 'no-seeds-configured',
+            scopeKey: options.scopeKey,
+            zoneId: options.zone.id,
+        };
+    }
+    const sandboxRootPath = path.join(options.zone.gateway.stateDir, 'sandboxes');
+    let sandboxRoot;
+    try {
+        sandboxRoot = await realpath(sandboxRootPath);
+    }
+    catch (error) {
+        if (isNodeErrorCode(error, 'ENOENT')) {
+            return {
+                agentId,
+                kind: 'sandbox-root-missing',
+                sandboxRoot: sandboxRootPath,
+                scopeKey: options.scopeKey,
+                zoneId: options.zone.id,
+            };
+        }
+        throw error;
+    }
+    let workspaceDir;
+    try {
+        workspaceDir = await realpath(options.workspaceDir);
+    }
+    catch (error) {
+        if (isNodeErrorCode(error, 'ENOENT')) {
+            return {
+                agentId,
+                kind: 'workspace-missing',
+                scopeKey: options.scopeKey,
+                workspaceDir: options.workspaceDir,
+                zoneId: options.zone.id,
+            };
+        }
+        throw error;
+    }
+    if (!isPathWithin(workspaceDir, sandboxRoot)) {
+        return {
+            agentId,
+            kind: 'workspace-outside-sandbox',
+            sandboxRoot,
+            scopeKey: options.scopeKey,
+            workspaceDir,
+            zoneId: options.zone.id,
+        };
+    }
+    const seedResults = await Promise.all(seeds.map(async (seed) => {
+        const targetPath = path.resolve(workspaceDir, seed.target);
+        if (!isPathWithin(targetPath, workspaceDir)) {
+            throw new Error(`Agent sandbox seed target '${seed.target}' resolves outside workspace '${workspaceDir}'.`);
+        }
+        await ensureSeedParentDirectoryInsideWorkspace({
+            targetPath,
+            workspaceDir,
+        });
+        const content = await options.secretResolver.resolve(toSecretRef(seed));
+        return await writeSeedFileIfAbsent({
+            content,
+            mode: seed.mode,
+            targetPath,
+            workspaceDir,
+        });
+    }));
+    return {
+        agentId,
+        alreadyExisted: seedResults.filter((result) => result === 'already-existed').length,
+        kind: 'seeded',
+        scopeKey: options.scopeKey,
+        written: seedResults.filter((result) => result === 'written').length,
+        zoneId: options.zone.id,
+    };
+}
+//# sourceMappingURL=agent-sandbox-seeding.js.map

package/dist/controller/leases/agent-sandbox-seeding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-sandbox-seeding.js","sourceRoot":"","sources":["../../../src/controller/leases/agent-sandbox-seeding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AA0DtD,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACpD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,aAAqB,EAAE,QAAgB;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB;IAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa;QAC1C,CAAC,CAAC;YACA,MAAM,EAAE,aAAa;YACrB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SACvB;QACF,CAAC,CAAC;YACA,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;SACpB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAKpC;IACA,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CAAC;YACvE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QACzB,UAAU,GAAG,SAAS,CAAC;QACvB,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,iBAAiB,CAAC;QAC1B,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,OAGvD;IACA,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACjF,IACC,kBAAkB,KAAK,EAAE;QACzB,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,EAC3E,CAAC;QACF,MAAM,IAAI,KAAK,CACd,qCAAqC,gBAAgB,iCAAiC,OAAO,CAAC,YAAY,IAAI,CAC9G,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IACvC,mHAAmH;IACnH,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC7D,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,0BAA0B,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,uBAAuB,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACd,8BAA8B,WAAW,iCAAiC,OAAO,CAAC,YAAY,IAAI,CAClG,CAAC;QACH,CAAC;QACD,WAAW,GAAG,YAAY,CAAC;IAC5B,CAAC;IACD,oCAAoC;IAEpC,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAK/C;IACA,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAClD,OAAO;YACN,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;SACvB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACN,OAAO;YACP,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;SACvB,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO;gBACN,OAAO;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,eAAe;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;aACvB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO;gBACN,OAAO;gBACP,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;aACvB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;YACN,OAAO;YACP,IAAI,EAAE,2BAA2B;YACjC,WAAW;YACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY;YACZ,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;SACvB,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACd,8BAA8B,IAAI,CAAC,MAAM,iCAAiC,YAAY,IAAI,CAC1F,CAAC;QACH,CAAC;QACD,MAAM,wCAAwC,CAAC;YAC9C,UAAU;YACV,YAAY;SACZ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,qBAAqB,CAAC;YAClC,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU;YACV,YAAY;SACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;IACF,OAAO;QACN,OAAO;QACP,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,MAAM;QACnF,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QACpE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;KACvB,CAAC;AACH,CAAC"}

package/dist/controller/leases/idle-reaper.d.ts

@@ -2,10 +2,15 @@ export declare function createIdleReaper(options: {
     readonly getLeases: () => {
         readonly id: string;
         readonly lastUsedAt: number;
+        readonly scopeKey: string;
     }[];
     readonly now: () => number;
-    readonly releaseLease: (leaseId: string) => Promise<void>;
-    readonly ttlMs: number;
+    readonly releaseLease: (leaseId: string, options?: {
+        readonly ifLastUsedAtBeforeOrAt?: number;
+    }) => Promise<void>;
+    readonly ttlForLease: (lease: {
+        readonly scopeKey: string;
+    }) => number;
 }): {
     reapExpiredLeases(): Promise<void>;
 };

package/dist/controller/leases/idle-reaper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idle-reaper.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/idle-reaper.ts"],"names":[],"mappings":"AAAA,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM;QACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB,GAAG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC,CAaA"}
+{"version":3,"file":"idle-reaper.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/idle-reaper.ts"],"names":[],"mappings":"AAAA,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM;QACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC1B,EAAE,CAAC;IACJ,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,CACtB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;KAAE,KAClD,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CACvE,GAAG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC,CA2BA"}

package/dist/controller/leases/idle-reaper.js

@@ -1,13 +1,25 @@
 export function createIdleReaper(options) {
     return {
         async reapExpiredLeases() {
-            const expiredLeaseIds = options
-                .getLeases()
-                .filter((lease) => options.now() - lease.lastUsedAt > options.ttlMs)
-                .map((lease) => lease.id);
-            for (const leaseId of expiredLeaseIds) {
-                // oxlint-disable-next-line eslint/no-await-in-loop -- release must stay sequential to avoid TCP pool races
-                await options.releaseLease(leaseId);
+            const now = options.now();
+            const expiredLeases = options.getLeases().flatMap((lease) => {
+                const expirationCutoff = now - options.ttlForLease(lease);
+                return lease.lastUsedAt < expirationCutoff ? [{ expirationCutoff, leaseId: lease.id }] : [];
+            });
+            const releaseErrors = [];
+            for (const expiredLease of expiredLeases) {
+                try {
+                    // oxlint-disable-next-line eslint/no-await-in-loop -- release must stay sequential to avoid TCP pool races
+                    await options.releaseLease(expiredLease.leaseId, {
+                        ifLastUsedAtBeforeOrAt: expiredLease.expirationCutoff,
+                    });
+                }
+                catch (error) {
+                    releaseErrors.push(error instanceof Error ? error : new Error(String(error)));
+                }
+            }
+            if (releaseErrors.length > 0) {
+                throw new AggregateError(releaseErrors, `Failed to release ${String(releaseErrors.length)} expired lease(s).`);
             }
         },
     };

package/dist/controller/leases/idle-reaper.js.map

@@ -1 +1 @@
-{"version":3,"file":"idle-reaper.js","sourceRoot":"","sources":["../../../src/controller/leases/idle-reaper.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,gBAAgB,CAAC,OAQhC;IAGA,OAAO;QACN,KAAK,CAAC,iBAAiB;YACtB,MAAM,eAAe,GAAG,OAAO;iBAC7B,SAAS,EAAE;iBACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;iBACnE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACvC,2GAA2G;gBAC3G,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"idle-reaper.js","sourceRoot":"","sources":["../../../src/controller/leases/idle-reaper.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,gBAAgB,CAAC,OAYhC;IAGA,OAAO;QACN,KAAK,CAAC,iBAAiB;YACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3D,MAAM,gBAAgB,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC1D,OAAO,KAAK,CAAC,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAY,EAAE,CAAC;YAClC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACJ,2GAA2G;oBAC3G,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE;wBAChD,sBAAsB,EAAE,YAAY,CAAC,gBAAgB;qBACrD,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,aAAa,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/E,CAAC;YACF,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,cAAc,CACvB,aAAa,EACb,qBAAqB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,oBAAoB,CACrE,CAAC;YACH,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/controller/leases/lease-idle-policy.d.ts

@@ -0,0 +1,12 @@
+export declare const leaseScopeKinds: readonly ["agent", "discord", "project", "session", "shared", "workspace"];
+export type LeaseScopeKind = (typeof leaseScopeKinds)[number];
+export interface LeaseIdleTtlPolicy {
+    readonly defaultMs: number;
+    readonly byScopeKind: Partial<Readonly<Record<LeaseScopeKind, number>>>;
+    readonly byScopePrefix: Readonly<Record<string, number>>;
+}
+export declare function ttlForLeaseScope(options: {
+    readonly policy: LeaseIdleTtlPolicy;
+    readonly scopeKey: string;
+}): number;
+//# sourceMappingURL=lease-idle-policy.d.ts.map

package/dist/controller/leases/lease-idle-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-idle-policy.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/lease-idle-policy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4EAOlB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAWD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B,GAAG,MAAM,CAWT"}

package/dist/controller/leases/lease-idle-policy.js

@@ -0,0 +1,28 @@
+export const leaseScopeKinds = [
+    'agent',
+    'discord',
+    'project',
+    'session',
+    'shared',
+    'workspace',
+];
+function scopePrefixes(scopeKey) {
+    const segments = scopeKey.split(':').filter((segment) => segment.length > 0);
+    return segments.map((_segment, index) => segments.slice(0, index + 1).join(':')).toReversed();
+}
+function isLeaseScopeKind(scopeKind) {
+    return leaseScopeKinds.some((candidate) => candidate === scopeKind);
+}
+export function ttlForLeaseScope(options) {
+    for (const prefix of scopePrefixes(options.scopeKey)) {
+        const ttl = options.policy.byScopePrefix[prefix];
+        if (ttl !== undefined) {
+            return ttl;
+        }
+    }
+    const scopeKind = options.scopeKey.split(':')[0] ?? '';
+    return isLeaseScopeKind(scopeKind)
+        ? (options.policy.byScopeKind[scopeKind] ?? options.policy.defaultMs)
+        : options.policy.defaultMs;
+}
+//# sourceMappingURL=lease-idle-policy.js.map

package/dist/controller/leases/lease-idle-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-idle-policy.js","sourceRoot":"","sources":["../../../src/controller/leases/lease-idle-policy.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,OAAO;IACP,SAAS;IACT,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;CACF,CAAC;AAUX,SAAS,aAAa,CAAC,QAAgB;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IAC1C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAGhC;IACA,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC;QACZ,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,gBAAgB,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;AAC7B,CAAC"}

package/dist/controller/leases/lease-manager.d.ts

@@ -1,13 +1,12 @@
 import type { ManagedVm } from '@agent-vm/gondolin-adapter';
 import type { TcpPool } from './tcp-pool.js';
-export interface ToolProfile {
+export interface ToolVmProfile {
     readonly cpus: number;
     readonly imageProfile: string;
     readonly memory: string;
-    readonly workspaceRoot: string;
 }
 export interface Lease {
-    readonly cleanWorkspace?: () => Promise<void>;
+    readonly agentWorkspaceDir: string;
     readonly createdAt: number;
     readonly id: string;
     readonly lastUsedAt: number;
@@ -22,30 +21,40 @@ export interface Lease {
     };
     readonly tcpSlot: number;
     readonly vm: ManagedVm;
+    readonly workspaceDir: string;
     readonly zoneId: string;
 }
+export interface LeaseRenewal {
+    readonly kind: 'renewed';
+    readonly lastUsedAt: number;
+    readonly lease: Lease;
+}
+export interface LeaseSnapshot {
+    readonly kind: 'snapshot';
+    readonly lease: Lease;
+}
 export interface LeaseManager {
     createLease(options: {
         readonly agentWorkspaceDir: string;
-        readonly profile: ToolProfile;
+        readonly profile: ToolVmProfile;
         readonly profileId: string;
         readonly scopeKey: string;
         readonly workspaceDir: string;
         readonly zoneId: string;
     }): Promise<Lease>;
-    getLease(leaseId: string): Lease | undefined;
+    keepLeaseAlive(leaseId: string): LeaseRenewal | undefined;
     listLeases(): Lease[];
-    releaseLease(leaseId: string): Promise<void>;
+    peekLease(leaseId: string): LeaseSnapshot | undefined;
+    releaseLease(leaseId: string, options?: {
+        readonly ifLastUsedAtBeforeOrAt?: number;
+    }): Promise<void>;
+}
+export declare class LeaseScopeConflictError extends Error {
 }
 export declare function createLeaseManager(options: {
-    readonly cleanWorkspace?: (leaseOptions: {
-        readonly profile: ToolProfile;
-        readonly tcpSlot: number;
-        readonly zoneId: string;
-    }) => Promise<void>;
     readonly createManagedVm: (leaseOptions: {
         readonly agentWorkspaceDir: string;
-        readonly profile: ToolProfile;
+        readonly profile: ToolVmProfile;
         readonly profileId: string;
         readonly scopeKey: string;
         readonly tcpSlot: number;

package/dist/controller/leases/lease-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lease-manager.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/lease-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,KAAK;IACrB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC5B,WAAW,CAAC,OAAO,EAAE;QACpB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7C,UAAU,IAAI,KAAK,EAAE,CAAC;IACtB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QACxC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,QAAQ,CAAC,eAAe,EAAE,CAAC,YAAY,EAAE;QACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B,GAAG,YAAY,CAiFf"}
+{"version":3,"file":"lease-manager.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/lease-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,KAAK;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC5B,WAAW,CAAC,OAAO,EAAE;QACpB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IAC1D,UAAU,IAAI,KAAK,EAAE,CAAC;IACtB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACtD,YAAY,CACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AA6CrD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,eAAe,EAAE,CAAC,YAAY,EAAE;QACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B,GAAG,YAAY,CAyKf"}

package/dist/controller/leases/lease-manager.js

@@ -1,80 +1,178 @@
+export class LeaseScopeConflictError extends Error {
+}
+function assertReusableScopeLease(existingLease, requestedLease) {
+    if (existingLease.profileId !== requestedLease.profileId) {
+        throw new LeaseScopeConflictError(`Tool VM lease scope conflict for zone '${requestedLease.zoneId}' scopeKey '${requestedLease.scopeKey}': existing profileId '${existingLease.profileId}' does not match requested profileId '${requestedLease.profileId}'.`);
+    }
+    if (existingLease.workspaceDir !== requestedLease.workspaceDir) {
+        throw new LeaseScopeConflictError(`Tool VM lease scope conflict for zone '${requestedLease.zoneId}' scopeKey '${requestedLease.scopeKey}': existing workspaceDir '${existingLease.workspaceDir}' does not match requested workspaceDir '${requestedLease.workspaceDir}'.`);
+    }
+    if (existingLease.agentWorkspaceDir !== requestedLease.agentWorkspaceDir) {
+        throw new LeaseScopeConflictError(`Tool VM lease scope conflict for zone '${requestedLease.zoneId}' scopeKey '${requestedLease.scopeKey}': existing agentWorkspaceDir '${existingLease.agentWorkspaceDir}' does not match requested agentWorkspaceDir '${requestedLease.agentWorkspaceDir}'.`);
+    }
+}
+async function isLeaseVmLive(lease) {
+    try {
+        const result = await lease.vm.exec('true');
+        return result.exitCode === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function scopeIndexKey(scopeRequest) {
+    return `${scopeRequest.zoneId}\0${scopeRequest.scopeKey}`;
+}
 export function createLeaseManager(options) {
     const leases = new Map();
+    const leaseIdsByScope = new Map();
+    const scopeLocks = new Map();
+    function storeLease(lease) {
+        leases.set(lease.id, lease);
+        leaseIdsByScope.set(scopeIndexKey(lease), lease.id);
+    }
+    function deleteLease(lease) {
+        leases.delete(lease.id);
+        const indexKey = scopeIndexKey(lease);
+        // Only clear the scope index if it still points at this exact lease.
+        if (leaseIdsByScope.get(indexKey) === lease.id) {
+            leaseIdsByScope.delete(indexKey);
+        }
+    }
+    function findLeaseForScope(scopeRequest) {
+        const leaseId = leaseIdsByScope.get(scopeIndexKey(scopeRequest));
+        return leaseId ? leases.get(leaseId) : undefined;
+    }
+    function touchLease(lease) {
+        const touchedLease = {
+            ...lease,
+            lastUsedAt: options.now(),
+        };
+        storeLease(touchedLease);
+        return touchedLease;
+    }
+    async function withScopeLock(scopeRequest, fn) {
+        const lockKey = `${scopeRequest.zoneId}\0${scopeRequest.scopeKey}`;
+        const previousLock = scopeLocks.get(lockKey) ?? Promise.resolve();
+        let releaseCurrentLock;
+        const currentLock = new Promise((resolve) => {
+            releaseCurrentLock = resolve;
+        });
+        scopeLocks.set(lockKey, currentLock);
+        await previousLock.catch(() => { });
+        try {
+            return await fn();
+        }
+        finally {
+            releaseCurrentLock?.();
+            if (scopeLocks.get(lockKey) === currentLock) {
+                scopeLocks.delete(lockKey);
+            }
+        }
+    }
+    async function evictLease(lease) {
+        deleteLease(lease);
+        options.tcpPool.release(lease.tcpSlot);
+        await lease.vm.close().catch(() => { });
+    }
     return {
         async createLease(leaseOptions) {
-            const tcpSlot = options.tcpPool.allocate();
-            try {
-                const vm = await options.createManagedVm({
-                    ...leaseOptions,
-                    tcpSlot,
+            return await withScopeLock(leaseOptions, async () => {
+                const existingLease = findLeaseForScope({
+                    scopeKey: leaseOptions.scopeKey,
+                    zoneId: leaseOptions.zoneId,
                 });
+                if (existingLease) {
+                    assertReusableScopeLease(existingLease, leaseOptions);
+                    if (await isLeaseVmLive(existingLease)) {
+                        return touchLease(existingLease);
+                    }
+                    await evictLease(existingLease);
+                }
+                const tcpSlot = options.tcpPool.allocate();
                 try {
-                    const sshAccess = await vm.enableSsh({
-                        listenPort: options.tcpPool.portForSlot(tcpSlot),
-                    });
-                    const createdAt = options.now();
-                    const lease = {
-                        ...(options.cleanWorkspace
-                            ? {
-                                cleanWorkspace: async () => await options.cleanWorkspace?.({
-                                    profile: leaseOptions.profile,
-                                    tcpSlot,
-                                    zoneId: leaseOptions.zoneId,
-                                }),
-                            }
-                            : {}),
-                        createdAt,
-                        id: `${leaseOptions.zoneId}-${leaseOptions.scopeKey}-${createdAt}`,
-                        lastUsedAt: createdAt,
-                        profileId: leaseOptions.profileId,
-                        scopeKey: leaseOptions.scopeKey,
-                        sshAccess,
+                    const vm = await options.createManagedVm({
+                        ...leaseOptions,
                         tcpSlot,
-                        vm,
-                        zoneId: leaseOptions.zoneId,
-                    };
-                    leases.set(lease.id, lease);
-                    return lease;
+                    });
+                    try {
+                        const sshAccess = await vm.enableSsh({
+                            listenPort: options.tcpPool.portForSlot(tcpSlot),
+                        });
+                        const createdAt = options.now();
+                        const lease = {
+                            agentWorkspaceDir: leaseOptions.agentWorkspaceDir,
+                            createdAt,
+                            id: `${leaseOptions.zoneId}-${leaseOptions.scopeKey}-${createdAt}`,
+                            lastUsedAt: createdAt,
+                            profileId: leaseOptions.profileId,
+                            scopeKey: leaseOptions.scopeKey,
+                            sshAccess,
+                            tcpSlot,
+                            vm,
+                            workspaceDir: leaseOptions.workspaceDir,
+                            zoneId: leaseOptions.zoneId,
+                        };
+                        storeLease(lease);
+                        return lease;
+                    }
+                    catch (error) {
+                        await vm.close().catch(() => { });
+                        throw error;
+                    }
                 }
                 catch (error) {
-                    await vm.close().catch(() => { });
+                    options.tcpPool.release(tcpSlot);
                     throw error;
                 }
-            }
-            catch (error) {
-                options.tcpPool.release(tcpSlot);
-                throw error;
-            }
+            });
         },
-        getLease(leaseId) {
-            return leases.get(leaseId);
+        keepLeaseAlive(leaseId) {
+            const lease = leases.get(leaseId);
+            if (!lease) {
+                return undefined;
+            }
+            const renewedLease = touchLease(lease);
+            return {
+                kind: 'renewed',
+                lastUsedAt: renewedLease.lastUsedAt,
+                lease: renewedLease,
+            };
         },
         listLeases() {
             return [...leases.values()];
         },
-        async releaseLease(leaseId) {
+        peekLease(leaseId) {
+            const lease = leases.get(leaseId);
+            return lease ? { kind: 'snapshot', lease } : undefined;
+        },
+        async releaseLease(leaseId, releaseOptions) {
             const lease = leases.get(leaseId);
             if (!lease) {
                 return;
             }
-            let releaseError;
-            try {
-                await lease.vm.close();
-            }
-            catch (error) {
-                releaseError = error instanceof Error ? error : new Error(String(error));
-            }
-            try {
-                await lease.cleanWorkspace?.();
-            }
-            catch (error) {
-                releaseError ??= error instanceof Error ? error : new Error(String(error));
-            }
-            leases.delete(leaseId);
-            options.tcpPool.release(lease.tcpSlot);
-            if (releaseError) {
-                throw releaseError;
-            }
+            await withScopeLock(lease, async () => {
+                const currentLease = leases.get(leaseId);
+                if (!currentLease) {
+                    return;
+                }
+                if (releaseOptions?.ifLastUsedAtBeforeOrAt !== undefined &&
+                    currentLease.lastUsedAt > releaseOptions.ifLastUsedAtBeforeOrAt) {
+                    return;
+                }
+                let releaseError;
+                try {
+                    await currentLease.vm.close();
+                }
+                catch (error) {
+                    releaseError = error instanceof Error ? error : new Error(String(error));
+                }
+                deleteLease(currentLease);
+                options.tcpPool.release(currentLease.tcpSlot);
+                if (releaseError) {
+                    throw releaseError;
+                }
+            });
         },
     };
 }