@co0ontty/wand 4.93.0 → 4.94.0

package/dist/speech-service.js

@@ -1,12 +1,13 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { constants, createReadStream } from "node:fs";
-import { access, mkdir, mkdtemp, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { access, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { buildChildEnv, systemEnvValue } from "./env-utils.js";
 import { SPEECH_MODELS, speechModel, speechModelUrl } from "./speech-models.js";
 import { SPEECH_MAX_SECONDS, SPEECH_MAX_WAV_BYTES, SPEECH_SAMPLE_RATE } from "./speech-types.js";
+import { configTemporaryRoot, createManagedTemporary, registerTemporaryChild } from "./managed-temp.js";
 export const SPEECH_SETTINGS_KEY = "pref:speechRecognition";
 export class SpeechError extends Error {
     code;
@@ -111,8 +112,8 @@ export class SpeechService {
         if (!runtime.executable || !await this.modelReady(model))
             throw new SpeechError("NOT_READY", "请先下载模型并安装语音运行时。", 503);
         signal.throwIfAborted();
-        await mkdir(path.join(this.root, "tmp"), { recursive: true, mode: 0o700 });
-        const directory = await mkdtemp(path.join(this.root, "tmp", "check-"));
+        const temporary = createManagedTemporary("speech-check", configTemporaryRoot(path.dirname(this.root)));
+        const directory = temporary.directory;
         try {
             const wav = Buffer.alloc(8044);
             wav.write("RIFF");
@@ -145,7 +146,7 @@ export class SpeechService {
             this.initialized.add(id);
         }
         finally {
-            await rm(directory, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+            await temporary.closeAsync();
         }
     }
     modelPath(model) { return path.join(this.root, "models", `ggml-${model.id}.bin`); }
@@ -305,6 +306,7 @@ export class SpeechService {
         const cancel = () => abort.abort();
         signal?.addEventListener("abort", cancel, { once: true });
         let directory = null;
+        let temporary = null;
         try {
             const settings = this.settings();
             const model = this.models.find((item) => item.id === settings.model);
@@ -319,8 +321,8 @@ export class SpeechService {
             let backend = settings.acceleration === "cpu" ? "cpu" : runtime.backend;
             if (silent)
                 return { text: "", model: model.id, backend };
-            await mkdir(path.join(this.root, "tmp"), { recursive: true, mode: 0o700 });
-            directory = await mkdtemp(path.join(this.root, "tmp", "voice-"));
+            temporary = createManagedTemporary("speech-voice", configTemporaryRoot(path.dirname(this.root)));
+            directory = temporary.directory;
             const wav = path.join(directory, "audio.wav");
             await writeFile(wav, audio, { mode: 0o600 });
             const output = path.join(directory, "transcript");
@@ -362,8 +364,7 @@ export class SpeechService {
             throw new SpeechError("ENGINE_FAILED", "服务端语音识别失败，请检查运行时、模型与可用磁盘。", 503);
         }
         finally {
-            if (directory)
-                await rm(directory, { recursive: true, force: true }).catch(() => { });
+            await temporary?.closeAsync();
             signal?.removeEventListener("abort", cancel);
             if (this.active === abort)
                 this.active = null;
@@ -379,6 +380,15 @@ export class SpeechService {
                     LD_LIBRARY_PATH: systemEnvValue("LD_LIBRARY_PATH"), DYLD_LIBRARY_PATH: systemEnvValue("DYLD_LIBRARY_PATH"),
                     CUDA_VISIBLE_DEVICES: systemEnvValue("CUDA_VISIBLE_DEVICES"),
                 }), stdio: "ignore", windowsHide: true });
+            try {
+                registerTemporaryChild(cwd, child.pid);
+            }
+            catch {
+                child.on("error", () => { });
+                child.once("close", () => { reject(new SpeechError("ENGINE_FAILED", "临时文件保护失败。", 503)); });
+                child.kill("SIGKILL");
+                return;
+            }
             let failure = null;
             let killTimer;
             const stop = (error) => {

package/dist/storage/mappers.js

@@ -1,7 +1,7 @@
 import { legacyPtyRoleIdentity } from "../default-employee.js";
 import { isRecord } from "../object-utils.js";
 import { parseHarnessExtensionState } from "../core-extension-host.js";
-import { firstLayoutTabId } from "../layout-tree.js";
+import { wrapLegacyTaskLayout } from "../layout-tree.js";
 import { defaultPiSessionSettings, patchPiSessionSettings } from "../pi-session-settings.js";
 import { inferProviderFromCommand, inferProviderFromRunner, isSessionProvider } from "../session-provider.js";
 import { isThinkingEffort } from "../structured-provider-common.js";
@@ -365,12 +365,7 @@ export function mapWorkspaceTaskLayout(raw) {
         return parsed;
     }
     if (record.type === "pane" || record.type === "split") {
-        const legacy = parsed;
-        return {
-            type: "windows",
-            windows: [{ id: "window-legacy", layout: legacy, activeTabId: firstLayoutTabId(legacy) }],
-            activeWindowId: "window-legacy",
-        };
+        return wrapLegacyTaskLayout(parsed);
     }
     return null;
 }
@@ -509,9 +504,10 @@ export function sessionRuntimeMetadataValues(snapshot) {
     ];
 }
 export function mapSessionCore(row) {
-    const provider = isSessionProvider(row.provider)
-        ? row.provider
-        : (inferProviderFromRunner(row.runner) ?? inferProviderFromCommand(row.command));
+    // Durable identity is historical data, not a new executable selection.
+    // Preserve unknown/removed values so execution owners can reject them without
+    // silently inferring a different provider or rewriting the original row.
+    const provider = row.provider ?? inferProviderFromRunner(row.runner) ?? inferProviderFromCommand(row.command);
     const sessionOptions = parseSessionOptions(row.session_options);
     const queuedMessages = parseQueuedMessages(row.queued_messages);
     return {

package/dist/storage/migrations.js

@@ -211,4 +211,18 @@ export const STORAGE_MIGRATIONS = [
     { version: 2, name: "task-records-backfill", up: migrateTaskRecordsV2 },
     { version: 3, name: "auth-token-digests", up: migrateAuthTokensV3 },
     { version: 4, name: "unique-card-per-container", up: uniqueCardPerContainerV4 },
+    { version: 5, name: "managed-upload-provenance", up: db => db.exec(`
+    CREATE TABLE IF NOT EXISTS wand_uploads (
+      file_path TEXT PRIMARY KEY, canonical_path TEXT NOT NULL UNIQUE,
+      cwd TEXT NOT NULL, canonical_cwd TEXT NOT NULL, session_id TEXT NOT NULL,
+      device INTEGER NOT NULL, inode INTEGER NOT NULL, size INTEGER NOT NULL,
+      mtime_ms REAL NOT NULL, ctime_ms REAL NOT NULL, created_at INTEGER NOT NULL,
+      orphaned_at INTEGER, checked_at INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE INDEX IF NOT EXISTS idx_wand_uploads_checked ON wand_uploads(checked_at, created_at);
+    CREATE TABLE IF NOT EXISTS wand_upload_references (
+      file_path TEXT NOT NULL, session_id TEXT NOT NULL, created_at INTEGER NOT NULL,
+      PRIMARY KEY(file_path, session_id)
+    );
+  `) },
 ];

package/dist/storage/uploads-repository.d.ts

@@ -0,0 +1,36 @@
+import { DatabaseSync } from "node:sqlite";
+import type { WandStorage } from "../storage.js";
+export interface ManagedUpload {
+    filePath: string;
+    canonicalPath: string;
+    cwd: string;
+    canonicalCwd: string;
+    sessionId: string;
+    device: number;
+    inode: number;
+    size: number;
+    mtimeMs: number;
+    ctimeMs: number;
+    createdAt: number;
+    orphanedAt: number | null;
+}
+/** Upload receipts are provenance, not a filename/prefix guess or a conversation DTO. */
+export declare class UploadRepository {
+    private readonly db;
+    private readonly owner?;
+    constructor(db: DatabaseSync, owner?: Pick<WandStorage, "transaction"> | undefined);
+    recordManagedUpload(upload: Omit<ManagedUpload, "orphanedAt">): void;
+    recordManagedUploads(uploads: Omit<ManagedUpload, "orphanedAt">[]): void;
+    listManagedUploads(limit?: number): ManagedUpload[];
+    /** Keep original owners, shared workspaces, queues and exact historical file references. */
+    managedUploadReferenced(upload: ManagedUpload): boolean;
+    /** Pin an orphan before PTY/structured dispatch, including unknown delivery; no prompt content is persisted. */
+    retainManagedUploadReferences(sessionId: string, requestJson: string, now?: number): void;
+    observeManagedUpload(upload: ManagedUpload, referenced: boolean, now: number): void;
+    forgetManagedUpload(upload: ManagedUpload): void;
+}
+/** Existing npm installations: no migrations, vault access or new database on CLI preview. */
+export declare function openUploadCleanupStore(dbPath: string, write?: boolean): {
+    uploads: UploadRepository;
+    close(): void;
+} | null;

package/dist/storage/uploads-repository.js

@@ -0,0 +1,98 @@
+import { DatabaseSync } from "node:sqlite";
+import { existsSync } from "node:fs";
+/** Upload receipts are provenance, not a filename/prefix guess or a conversation DTO. */
+export class UploadRepository {
+    db;
+    owner;
+    constructor(db, owner) {
+        this.db = db;
+        this.owner = owner;
+    }
+    recordManagedUpload(upload) {
+        this.db.prepare(`INSERT INTO wand_uploads(file_path, canonical_path, cwd, canonical_cwd, session_id,
+      device, inode, size, mtime_ms, ctime_ms, created_at) VALUES(?,?,?,?,?,?,?,?,?,?,?)`).run(upload.filePath, upload.canonicalPath, upload.cwd, upload.canonicalCwd, upload.sessionId, upload.device, upload.inode, upload.size, upload.mtimeMs, upload.ctimeMs, upload.createdAt);
+    }
+    recordManagedUploads(uploads) {
+        const save = () => { for (const upload of uploads)
+            this.recordManagedUpload(upload); };
+        if (this.owner)
+            this.owner.transaction(save);
+        else
+            save();
+    }
+    listManagedUploads(limit = 100) {
+        return this.db.prepare(`SELECT file_path AS filePath, canonical_path AS canonicalPath, cwd,
+      canonical_cwd AS canonicalCwd, session_id AS sessionId, device, inode, size,
+      mtime_ms AS mtimeMs, ctime_ms AS ctimeMs, created_at AS createdAt,
+      CASE WHEN orphaned_at IS NULL THEN NULL ELSE MAX(orphaned_at, COALESCE((SELECT MAX(created_at)
+        FROM wand_upload_references r WHERE r.file_path=wand_uploads.file_path),0)) END AS orphanedAt
+      FROM wand_uploads ORDER BY checked_at, created_at LIMIT ?`).all(Math.min(100, Math.max(1, limit)));
+    }
+    /** Keep original owners, shared workspaces, queues and exact historical file references. */
+    managedUploadReferenced(upload) {
+        const escaped = JSON.stringify(upload.filePath).slice(1, -1);
+        const canonical = JSON.stringify(upload.canonicalPath).slice(1, -1);
+        if (this.db.prepare(`SELECT 1 FROM wand_upload_references r JOIN command_sessions s ON s.id=r.session_id
+      WHERE r.file_path=? LIMIT 1`).get(upload.filePath))
+            return true;
+        if (this.db.prepare(`SELECT 1 FROM command_sessions WHERE id=? OR cwd IN (?,?) OR (status='running' AND session_kind='structured')
+      OR instr(output,?)>0 OR instr(output,?)>0 OR instr(COALESCE(messages,''),?)>0
+      OR instr(COALESCE(messages,''),?)>0 OR instr(COALESCE(queued_messages,''),?)>0
+      OR instr(COALESCE(queued_messages,''),?)>0 LIMIT 1`).get(upload.sessionId, upload.cwd, upload.canonicalCwd, upload.filePath, upload.canonicalPath, escaped, canonical, escaped, canonical))
+            return true;
+        if (this.db.prepare("SELECT 1 FROM workspace_tasks WHERE cwd IN (?,?) LIMIT 1").get(upload.cwd, upload.canonicalCwd))
+            return true;
+        if (this.db.prepare("SELECT 1 FROM conversation_messages WHERE instr(turn_json,?)>0 OR instr(turn_json,?)>0 LIMIT 1").get(escaped, canonical))
+            return true;
+        // The team run stores delivered reports/attachment references even after its relay session is gone.
+        if (this.db.prepare("SELECT 1 FROM ai_team_runs WHERE cwd IN (?,?) OR instr(objective,?)>0 OR instr(objective,?)>0 LIMIT 1")
+            .get(upload.cwd, upload.canonicalCwd, upload.filePath, upload.canonicalPath))
+            return true;
+        if (this.db.prepare(`SELECT 1 FROM ai_team_steps WHERE instr(report,?)>0 OR instr(report,?)>0
+      OR instr(instructions,?)>0 OR instr(instructions,?)>0 OR report_path IN (?,?)
+      OR instr(COALESCE(dispatch_info_json,''),?)>0 OR instr(COALESCE(dispatch_info_json,''),?)>0 LIMIT 1`)
+            .get(upload.filePath, upload.canonicalPath, upload.filePath, upload.canonicalPath, upload.filePath, upload.canonicalPath, escaped, canonical))
+            return true;
+        return false;
+    }
+    /** Pin an orphan before PTY/structured dispatch, including unknown delivery; no prompt content is persisted. */
+    retainManagedUploadReferences(sessionId, requestJson, now = Date.now()) {
+        this.db.prepare(`INSERT INTO wand_upload_references(file_path,session_id,created_at)
+      SELECT file_path,?,? FROM wand_uploads WHERE orphaned_at IS NOT NULL AND
+      (instr(?,substr(json_quote(file_path),2,length(json_quote(file_path))-2))>0
+        OR instr(?,substr(json_quote(canonical_path),2,length(json_quote(canonical_path))-2))>0)
+      ON CONFLICT(file_path,session_id) DO UPDATE SET created_at=excluded.created_at`).run(sessionId, now, requestJson, requestJson);
+    }
+    observeManagedUpload(upload, referenced, now) {
+        this.db.prepare(`UPDATE wand_uploads SET checked_at=?, orphaned_at=CASE WHEN ? THEN NULL
+      ELSE COALESCE(orphaned_at,?) END WHERE file_path=? AND inode=? AND device=?`).run(now, Number(referenced), now, upload.filePath, upload.inode, upload.device);
+    }
+    forgetManagedUpload(upload) {
+        const remove = () => {
+            this.db.prepare("DELETE FROM wand_uploads WHERE file_path=? AND inode=? AND device=?").run(upload.filePath, upload.inode, upload.device);
+            this.db.prepare("DELETE FROM wand_upload_references WHERE file_path=?").run(upload.filePath);
+        };
+        if (this.owner)
+            this.owner.transaction(remove);
+        else
+            remove();
+    }
+}
+/** Existing npm installations: no migrations, vault access or new database on CLI preview. */
+export function openUploadCleanupStore(dbPath, write = false) {
+    if (!existsSync(dbPath))
+        return null;
+    const db = new DatabaseSync(dbPath, { readOnly: !write });
+    try {
+        db.exec("PRAGMA busy_timeout = 5000");
+        if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='wand_uploads'").get()) {
+            db.close();
+            return null;
+        }
+        return { uploads: new UploadRepository(db), close: () => db.close() };
+    }
+    catch (error) {
+        db.close();
+        throw error;
+    }
+}

package/dist/storage-cleanup.d.ts

@@ -0,0 +1,50 @@
+import { type TempKind } from "./managed-temp.js";
+import type { UploadRepository } from "./storage/uploads-repository.js";
+export declare const STORAGE_CLEANUP_RETENTION_DAYS = 7;
+export interface CleanupReport {
+    applied: boolean;
+    checkedAt: string;
+    retentionDays: number;
+    candidates: number;
+    removed: number;
+    logicalBytes: number;
+    allocatedBytes: number;
+    skipped: number;
+    issues: string[];
+    byKind: Partial<Record<TempKind | "upload" | "diagnostic-log", number>>;
+}
+interface CleanupOptions {
+    roots: string[];
+    now?: () => number;
+    isAlive?: (pid: number, group?: boolean) => boolean;
+    inspectOpenPaths?: () => Promise<string[]>;
+    maxEntries?: number;
+    configDirectory?: string;
+    uploads?: Pick<UploadRepository, "listManagedUploads" | "managedUploadReferenced" | "observeManagedUpload" | "forgetManagedUpload">;
+    uploadsActive?: () => boolean;
+    onUploadRemoved?: (cwd: string) => void;
+}
+/** Runtime-only, explicit ownership. User history, downloads and rollback inputs are never candidates. */
+export declare class StorageCleanup {
+    private readonly options;
+    private busy;
+    private stopped;
+    private timer;
+    private startup;
+    private active;
+    private last;
+    constructor(options: CleanupOptions);
+    status(): {
+        enabled: boolean;
+        running: boolean;
+        retentionDays: number;
+        lastRun: CleanupReport | null;
+    };
+    start(): void;
+    stop(): Promise<void>;
+    run(apply?: boolean): Promise<CleanupReport>;
+    private sweep;
+    private sweepTemporary;
+}
+export declare function createStorageCleanup(configDir: string, options?: Pick<CleanupOptions, "uploads" | "uploadsActive" | "onUploadRemoved">): StorageCleanup;
+export {};

package/dist/storage-cleanup.js

@@ -0,0 +1,344 @@
+import { execFile } from "node:child_process";
+import { lstat, readdir, realpath, rm, unlink } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { TEMP_ROOT_MARKER, configTemporaryRoot, readTemporaryLease, systemTemporaryRoot, testTemporaryRoot, temporaryPidAlive, validateTemporaryRoot } from "./managed-temp.js";
+import { assertPlainTempPath } from "./managed-temp.js";
+import { DIAGNOSTIC_LOG_RETENTION_DAYS, DIAGNOSTIC_RECEIPT_SUFFIX, diagnosticReceiptMatches, isDiagnosticArchive } from "./diagnostic-logs.js";
+export const STORAGE_CLEANUP_RETENTION_DAYS = 7;
+const DAY = 86_400_000;
+const exec = promisify(execFile);
+async function openPaths() {
+    if (process.platform === "win32")
+        throw new Error("Open-file inspection unavailable.");
+    const { stdout, stderr } = await exec("lsof", ["-nP", "-F", "n"], { timeout: 20_000, maxBuffer: 16 * 1024 * 1024 });
+    if (stderr.trim())
+        throw new Error("Open-file inspection incomplete.");
+    return stdout.split("\n").filter(line => line.startsWith("n")).map(line => line.slice(1));
+}
+/** Runtime-only, explicit ownership. User history, downloads and rollback inputs are never candidates. */
+export class StorageCleanup {
+    options;
+    busy = false;
+    stopped = false;
+    timer = null;
+    startup = null;
+    active = null;
+    last = null;
+    constructor(options) {
+        this.options = options;
+    }
+    status() { return { enabled: this.timer !== null, running: this.busy, retentionDays: STORAGE_CLEANUP_RETENTION_DAYS, lastRun: this.last }; }
+    start() {
+        if (this.timer || this.stopped)
+            return;
+        const sweep = () => { if (!this.busy && !this.stopped)
+            void this.run(true).catch(() => { }); };
+        this.startup = setTimeout(sweep, 30_000);
+        this.startup.unref();
+        this.timer = setInterval(sweep, 6 * 60 * 60_000);
+        this.timer.unref();
+    }
+    async stop() {
+        this.stopped = true;
+        if (this.startup)
+            clearTimeout(this.startup);
+        if (this.timer)
+            clearInterval(this.timer);
+        this.startup = this.timer = null;
+        await this.active?.catch(() => { });
+    }
+    async run(apply = false) {
+        if (this.busy || this.stopped)
+            throw new Error("Storage cleanup is busy or stopping.");
+        this.busy = true;
+        const task = this.sweep(apply);
+        this.active = task;
+        try {
+            const report = await task;
+            if (apply)
+                this.last = report;
+            return report;
+        }
+        finally {
+            this.active = null;
+            this.busy = false;
+        }
+    }
+    async sweep(apply) {
+        const report = await this.sweepTemporary(apply);
+        if (this.stopped)
+            return report;
+        const now = (this.options.now ?? Date.now)();
+        const files = [];
+        if (this.options.uploads && !this.options.uploadsActive?.()) {
+            try {
+                for (const upload of this.options.uploads.listManagedUploads()) {
+                    const referenced = this.options.uploads.managedUploadReferenced(upload);
+                    if (apply)
+                        this.options.uploads.observeManagedUpload(upload, referenced, now);
+                    if (referenced || upload.orphanedAt === null || upload.orphanedAt >= now - STORAGE_CLEANUP_RETENTION_DAYS * DAY) {
+                        report.skipped++;
+                        continue;
+                    }
+                    try {
+                        assertPlainTempPath(upload.canonicalPath);
+                        if (path.dirname(upload.canonicalPath) !== path.join(upload.canonicalCwd, ".wand-uploads"))
+                            throw new Error("invalid upload scope");
+                        if (await realpath(upload.canonicalCwd) !== upload.canonicalCwd)
+                            throw new Error("upload cwd changed");
+                        const stat = await lstat(upload.canonicalPath);
+                        if (!stat.isFile() || stat.dev !== upload.device || stat.ino !== upload.inode || stat.size !== upload.size
+                            || stat.mtimeMs !== upload.mtimeMs || stat.ctimeMs !== upload.ctimeMs) {
+                            report.skipped++;
+                            continue;
+                        }
+                        files.push({ file: upload.canonicalPath, kind: "upload", upload, size: stat.size, blocks: stat.blocks });
+                    }
+                    catch {
+                        report.skipped++;
+                    }
+                }
+            }
+            catch {
+                report.issues.push("Upload ownership/reference inspection failed; uploads preserved.");
+            }
+        }
+        if (this.options.configDirectory) {
+            const directory = this.options.configDirectory;
+            const inspect = async (root) => {
+                assertPlainTempPath(root);
+                let entries;
+                try {
+                    entries = await readdir(root, { withFileTypes: true });
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        return;
+                    throw error;
+                }
+                for (const entry of entries) {
+                    if (!entry.isFile() || !isDiagnosticArchive(entry.name))
+                        continue;
+                    const file = path.join(root, entry.name);
+                    try {
+                        if (!diagnosticReceiptMatches(file)) {
+                            report.skipped++;
+                            continue;
+                        }
+                        const stat = await lstat(file);
+                        if (Math.max(stat.ctimeMs, stat.mtimeMs) >= now - DIAGNOSTIC_LOG_RETENTION_DAYS * DAY) {
+                            report.skipped++;
+                            continue;
+                        }
+                        files.push({ file, kind: "diagnostic-log", size: stat.size, blocks: stat.blocks });
+                    }
+                    catch {
+                        report.skipped++;
+                    }
+                }
+            };
+            try {
+                await inspect(directory);
+                const sessionRoot = path.join(directory, "sessions");
+                assertPlainTempPath(sessionRoot);
+                const entries = await readdir(sessionRoot, { withFileTypes: true }).catch(error => {
+                    if (error.code === "ENOENT")
+                        return [];
+                    throw error;
+                });
+                if (entries.length > 1000)
+                    report.issues.push("Diagnostic session scan limit reached; session archives preserved.");
+                else
+                    for (const entry of entries) {
+                        if (entry.isDirectory())
+                            await inspect(path.join(sessionRoot, entry.name));
+                    }
+            }
+            catch {
+                report.issues.push("Diagnostic archive inspection failed; uncertain files preserved.");
+            }
+        }
+        report.candidates += files.length;
+        let opened = [];
+        if (apply && files.length) {
+            try {
+                opened = await (this.options.inspectOpenPaths ?? openPaths)();
+            }
+            catch {
+                report.skipped += files.length;
+                report.issues.push("Open-file inspection failed; uploaded files and diagnostic archives preserved.");
+                return report;
+            }
+        }
+        for (const file of files) {
+            if (this.stopped)
+                break;
+            try {
+                if (opened.some(entry => entry === file.file || entry === path.dirname(file.file))) {
+                    report.skipped++;
+                    continue;
+                }
+                assertPlainTempPath(file.file);
+                const stat = await lstat(file.file);
+                if (file.upload) {
+                    const upload = file.upload;
+                    if (stat.dev !== upload.device || stat.ino !== upload.inode || stat.size !== upload.size
+                        || stat.mtimeMs !== upload.mtimeMs || stat.ctimeMs !== upload.ctimeMs || this.options.uploadsActive?.()
+                        || this.options.uploads.managedUploadReferenced(upload)) {
+                        report.skipped++;
+                        continue;
+                    }
+                }
+                else if (!diagnosticReceiptMatches(file.file) || Math.max(stat.ctimeMs, stat.mtimeMs) >= now - DIAGNOSTIC_LOG_RETENTION_DAYS * DAY) {
+                    report.skipped++;
+                    continue;
+                }
+                if (apply) {
+                    await unlink(file.file);
+                    report.removed++;
+                    if (file.upload) {
+                        this.options.uploads.forgetManagedUpload(file.upload);
+                        this.options.onUploadRemoved?.(file.upload.cwd);
+                    }
+                    else
+                        await unlink(file.file + DIAGNOSTIC_RECEIPT_SUFFIX).catch(() => { });
+                }
+                report.logicalBytes += stat.size;
+                report.allocatedBytes += stat.blocks * 512;
+                report.byKind[file.kind] = (report.byKind[file.kind] ?? 0) + 1;
+            }
+            catch {
+                report.skipped++;
+            }
+        }
+        return report;
+    }
+    async sweepTemporary(apply) {
+        const now = (this.options.now ?? Date.now)();
+        const cutoff = now - STORAGE_CLEANUP_RETENTION_DAYS * DAY;
+        const report = { applied: apply, checkedAt: new Date(now).toISOString(), retentionDays: STORAGE_CLEANUP_RETENTION_DAYS,
+            candidates: 0, removed: 0, logicalBytes: 0, allocatedBytes: 0, skipped: 0, issues: [], byKind: {} };
+        const alive = this.options.isAlive ?? temporaryPidAlive;
+        const active = (lease) => alive(lease.ownerPid) || lease.children.some(child => alive(child.pid, child.group));
+        let visited = 0;
+        const budget = this.options.maxEntries ?? 20_000;
+        const count = () => { if (++visited > budget)
+            throw new Error("scan-limit"); };
+        const stats = async (directory, device, disposableCheckout, depth = 0) => {
+            count();
+            const stat = await lstat(directory);
+            if (depth > 32 || stat.dev !== device || stat.isSymbolicLink())
+                throw new Error("unsafe-tree");
+            const result = { logicalBytes: stat.isFile() ? stat.size : 0, allocatedBytes: stat.blocks * 512,
+                latest: Math.max(stat.mtimeMs, stat.ctimeMs), dev: stat.dev, ino: stat.ino };
+            if (stat.isDirectory()) {
+                for (const entry of await readdir(directory)) {
+                    if (entry === ".git" && !disposableCheckout)
+                        throw new Error("git-metadata");
+                    const child = await stats(path.join(directory, entry), device, disposableCheckout, depth + 1);
+                    result.logicalBytes += child.logicalBytes;
+                    result.allocatedBytes += child.allocatedBytes;
+                    result.latest = Math.max(result.latest, child.latest);
+                }
+            }
+            else if (!stat.isFile())
+                throw new Error("special-file");
+            return result;
+        };
+        const candidates = [];
+        for (const root of new Set(this.options.roots)) {
+            try {
+                validateTemporaryRoot(root);
+                const entries = await readdir(root, { withFileTypes: true });
+                for (const entry of entries) {
+                    count();
+                    if (entry.name === TEMP_ROOT_MARKER)
+                        continue;
+                    const directory = path.join(root, entry.name);
+                    try {
+                        if (!entry.isDirectory()) {
+                            report.skipped++;
+                            continue;
+                        }
+                        const lease = readTemporaryLease(directory);
+                        if (active(lease)) {
+                            report.skipped++;
+                            continue;
+                        }
+                        const stat = await stats(directory, (await lstat(root)).dev, lease.kind === "test-run" || lease.kind === "speech-setup");
+                        if (stat.latest >= cutoff) {
+                            report.skipped++;
+                            continue;
+                        }
+                        candidates.push({ root, directory, lease, stat });
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message === "scan-limit")
+                            throw error;
+                        report.skipped++;
+                    }
+                }
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    continue;
+                // Discovery failure never falls back to prefix-based /tmp deletion.
+                report.issues.push("Temporary root unavailable, unsafe, or scan limit reached.");
+                return report;
+            }
+        }
+        report.candidates = candidates.length;
+        let opened = [];
+        if (apply && candidates.length) {
+            try {
+                opened = await (this.options.inspectOpenPaths ?? openPaths)();
+            }
+            catch {
+                report.skipped += candidates.length;
+                report.issues.push("Open-file inspection failed; nothing removed.");
+                return report;
+            }
+        }
+        for (const candidate of candidates) {
+            if (this.stopped)
+                break;
+            try {
+                validateTemporaryRoot(candidate.root);
+                const lease = readTemporaryLease(candidate.directory);
+                if (lease.id !== candidate.lease.id || active(lease)
+                    || opened.some(file => file === candidate.directory || file.startsWith(candidate.directory + path.sep))) {
+                    report.skipped++;
+                    continue;
+                }
+                const latest = await stats(candidate.directory, candidate.stat.dev, lease.kind === "test-run" || lease.kind === "speech-setup");
+                if (latest.ino !== candidate.stat.ino || latest.latest >= cutoff) {
+                    report.skipped++;
+                    continue;
+                }
+                // The final synchronous lease/PID/path check leaves no await before removal starts.
+                validateTemporaryRoot(candidate.root);
+                const final = readTemporaryLease(candidate.directory);
+                if (final.id !== lease.id || active(final)) {
+                    report.skipped++;
+                    continue;
+                }
+                if (apply) {
+                    await rm(candidate.directory, { recursive: true, force: false });
+                    report.removed++;
+                }
+                report.logicalBytes += latest.logicalBytes;
+                report.allocatedBytes += latest.allocatedBytes;
+                report.byKind[lease.kind] = (report.byKind[lease.kind] ?? 0) + 1;
+            }
+            catch {
+                report.skipped++;
+            }
+        }
+        return report;
+    }
+}
+export function createStorageCleanup(configDir, options = {}) {
+    const root = configTemporaryRoot(configDir);
+    return new StorageCleanup({ roots: [root, systemTemporaryRoot(), testTemporaryRoot()], configDirectory: path.dirname(path.dirname(root)), ...options });
+}