@codyswann/lisa 4.81.2 → 4.81.4

package/dist/transaction/backup.js

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import * as os from "node:os";
 import { BackupError, RollbackError } from "../errors/index.js";
 import { generateBackupDirname } from "../utils/file-operations.js";
+import { CreatedPathLedger, occupied } from "./created-paths.js";
 /**
  * Service for backing up and restoring files during operations
  */
@@ -11,6 +12,11 @@ export class BackupService {
     backupDir = null;
     destDir = "";
     persistentBackupDirname = null;
+    /** Files whose pre-apply bytes are already saved; the first copy wins. */
+    backedUp = new Set();
+    /** Files already copied into this apply's `.lisabak/<timestamp>/`. */
+    persisted = new Set();
+    created = new CreatedPathLedger("");
     logger;
     /**
      * Initialize backup service with logger
@@ -21,6 +27,11 @@ export class BackupService {
     }
     async init(destDir) {
         this.destDir = destDir;
+        this.created = new CreatedPathLedger(destDir);
+        // A reused service must not write into an earlier apply's .lisabak dir.
+        this.persistentBackupDirname = null;
+        this.backedUp.clear();
+        this.persisted.clear();
         this.backupDir = await mkdtemp(path.join(os.tmpdir(), "lisa-backup-"));
         this.logger.info(`Backup directory: ${this.backupDir}`);
     }
@@ -28,32 +39,60 @@ export class BackupService {
         if (!this.backupDir) {
             throw new BackupError("backup", "Backup service not initialized");
         }
+        // A second write to the same path must not replace the pre-apply copy
+        // with this apply's own intermediate bytes, and a file this apply created
+        // has no pre-apply bytes at all: rollback removes it instead.
+        if (this.created.has(absolutePath) || this.backedUp.has(absolutePath)) {
+            return;
+        }
         try {
-            if (await fse.pathExists(absolutePath)) {
+            // lstat, not pathExists: a dangling symlink the host already had must
+            // be backed up (as a link), never recorded as created and unlinked.
+            if (await occupied(absolutePath)) {
                 const relativePath = path.relative(this.destDir, absolutePath);
                 const backupPath = path.join(this.backupDir, relativePath);
                 await fse.ensureDir(path.dirname(backupPath));
                 await fse.copy(absolutePath, backupPath);
+                this.backedUp.add(absolutePath);
+            }
+            else {
+                await this.created.record(absolutePath);
             }
         }
         catch (error) {
             throw new BackupError("backup", `Failed to backup ${absolutePath}: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    forgetCreated(absolutePath) {
+        this.created.forget(absolutePath);
+    }
     async persistentBackup(absolutePath) {
+        // Same first-copy-wins rule as backup(): the .lisabak copy must hold the
+        // pre-apply bytes, not this apply's intermediate ones.
+        if (this.created.has(absolutePath) || this.persisted.has(absolutePath)) {
+            return;
+        }
         try {
             if (await fse.pathExists(absolutePath)) {
                 // Generate backup directory name on first call
                 if (!this.persistentBackupDirname) {
-                    this.persistentBackupDirname = generateBackupDirname();
+                    this.persistentBackupDirname = await this.unusedBackupDirname();
                 }
                 // Get relative path from destination directory
                 const relativePath = path.relative(this.destDir, absolutePath);
                 // Create backup in .lisabak/{timestamp}/{relative-path}
                 const backupBaseDir = path.join(this.destDir, ".lisabak", this.persistentBackupDirname);
                 const backupPath = path.join(backupBaseDir, relativePath);
+                // The persistent copy is itself a file this apply creates: rollback
+                // restores the original in place, so the copy would be pure debris.
+                await this.created.record(backupPath);
                 await fse.ensureDir(path.dirname(backupPath));
-                await fse.copy(absolutePath, backupPath);
+                // Never replace an earlier backup's bytes, whoever wrote them.
+                await fse.copy(absolutePath, backupPath, {
+                    overwrite: false,
+                    errorOnExist: false,
+                });
+                this.persisted.add(absolutePath);
                 this.logger.info(`Backup created: .lisabak/${this.persistentBackupDirname}/${relativePath}`);
             }
         }
@@ -61,6 +100,20 @@ export class BackupService {
             throw new BackupError("backup", `Failed to create persistent backup of ${absolutePath}: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    /**
+     * A `.lisabak/` directory name no earlier apply has used. The timestamp has
+     * one-second precision, so two applies in the same second would otherwise
+     * share a directory; a numeric suffix keeps them apart.
+     * @param base - Timestamp name to start from
+     * @param attempt - Suffix counter (0 = no suffix)
+     * @returns An unoccupied directory name under `.lisabak/`
+     */
+    async unusedBackupDirname(base = generateBackupDirname(), attempt = 0) {
+        const candidate = attempt === 0 ? base : `${base}-${attempt}`;
+        return (await occupied(path.join(this.destDir, ".lisabak", candidate)))
+            ? this.unusedBackupDirname(base, attempt + 1)
+            : candidate;
+    }
     async rollback() {
         if (!this.backupDir || !(await fse.pathExists(this.backupDir))) {
             throw new RollbackError("No backup directory available");
@@ -75,6 +128,9 @@ export class BackupService {
                 await fse.copy(backupFile, destFile);
                 this.logger.info(`Restored: ${relativePath}`);
             }
+            for (const relativePath of await this.created.removeAll()) {
+                this.logger.info(`Removed (created by this apply): ${relativePath}`);
+            }
             await this.cleanup();
             this.logger.success("Rollback complete");
         }
@@ -83,6 +139,9 @@ export class BackupService {
         }
     }
     async cleanup() {
+        this.created.clear();
+        this.backedUp.clear();
+        this.persisted.clear();
         if (this.backupDir && (await fse.pathExists(this.backupDir))) {
             await fse.remove(this.backupDir);
             this.backupDir = null;
@@ -119,6 +178,9 @@ export class DryRunBackupService {
     async backup(_absolutePath) {
         // No-op
     }
+    forgetCreated(_absolutePath) {
+        // No-op
+    }
     async persistentBackup(_absolutePath) {
         // No-op
     }

package/dist/transaction/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/transaction/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAsBpE;;GAEG;AACH,MAAM,OAAO,aAAa;IAChB,SAAS,GAAkB,IAAI,CAAC;IAChC,OAAO,GAAW,EAAE,CAAC;IACrB,uBAAuB,GAAkB,IAAI,CAAC;IACrC,MAAM,CAAU;IAEjC;;;OAGG;IACH,YAAY,MAAe;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBAE3D,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,QAAQ,EACR,oBAAoB,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,+CAA+C;gBAC/C,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAClC,IAAI,CAAC,uBAAuB,GAAG,qBAAqB,EAAE,CAAC;gBACzD,CAAC;gBAED,+CAA+C;gBAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAE/D,wDAAwD;gBACxD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,IAAI,CAAC,OAAO,EACZ,UAAU,EACV,IAAI,CAAC,uBAAuB,CAC7B,CAAC;gBACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;gBAE1D,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,IAAI,CAAC,uBAAuB,IAAI,YAAY,EAAE,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,QAAQ,EACR,yCAAyC,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAE5C,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE5D,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAEvD,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,YAAY,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CACrB,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC1B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,aAAqB;QAC1C,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,OAAO;QACX,QAAQ;IACV,CAAC;CACF"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/transaction/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAiCjE;;GAEG;AACH,MAAM,OAAO,aAAa;IAChB,SAAS,GAAkB,IAAI,CAAC;IAChC,OAAO,GAAW,EAAE,CAAC;IACrB,uBAAuB,GAAkB,IAAI,CAAC;IACtD,0EAA0E;IACzD,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,sEAAsE;IACrD,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,OAAO,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAU;IAEjC;;;OAGG;IACH,YAAY,MAAe;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,wEAAwE;QACxE,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBAE3D,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,QAAQ,EACR,oBAAoB,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,aAAa,CAAC,YAAoB;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,+CAA+C;gBAC/C,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAClC,IAAI,CAAC,uBAAuB,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAClE,CAAC;gBAED,+CAA+C;gBAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAE/D,wDAAwD;gBACxD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,IAAI,CAAC,OAAO,EACZ,UAAU,EACV,IAAI,CAAC,uBAAuB,CAC7B,CAAC;gBACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;gBAE1D,oEAAoE;gBACpE,oEAAoE;gBACpE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACtC,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9C,+DAA+D;gBAC/D,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE;oBACvC,SAAS,EAAE,KAAK;oBAChB,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,IAAI,CAAC,uBAAuB,IAAI,YAAY,EAAE,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,QAAQ,EACR,yCAAyC,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAC/B,OAAe,qBAAqB,EAAE,EACtC,OAAO,GAAG,CAAC;QAEX,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAE5C,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE5D,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAEvD,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,YAAY,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CACrB,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC1B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,QAAQ;IACV,CAAC;IAED,aAAa,CAAC,aAAqB;QACjC,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,aAAqB;QAC1C,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,OAAO;QACX,QAAQ;IACV,CAAC;CACF"}

package/dist/transaction/created-paths.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Whether anything (file, directory, or dangling symlink) occupies a path.
+ * @param absolutePath - Path to probe
+ * @returns True when the path is occupied
+ */
+export declare function occupied(absolutePath: string): Promise<boolean>;
+/**
+ * The paths one apply created, recorded explicitly before it wrote them, so a
+ * rollback can undo creation as well as modification (CodySwannGT/lisa#4459).
+ *
+ * Only recorded paths are ever candidates for removal. Nothing is inferred
+ * from the tree, so a file that existed before the apply, or that someone
+ * else writes while it runs, is never touched — including one written into a
+ * directory the apply created: directories are removed only when empty.
+ *
+ * Accepted residual: if another process creates one of the recorded missing
+ * directories mid-apply and leaves it EMPTY, rollback removes that empty
+ * directory. A non-empty one is always kept, so no content can be lost.
+ */
+export declare class CreatedPathLedger {
+    private readonly root;
+    private readonly files;
+    private readonly dirs;
+    /**
+     * Create a ledger confined to one destination tree.
+     * @param root - Destination directory; nothing outside it is ever recorded
+     */
+    constructor(root: string);
+    /**
+     * Record a path about to be created, plus every missing ancestor directory
+     * below the root. Must be called before the write (and before any
+     * `ensureDir`), or the ancestors it creates are indistinguishable from
+     * pre-existing ones.
+     * @param absolutePath - File the caller is about to create
+     */
+    record(absolutePath: string): Promise<void>;
+    /**
+     * Walk up from `dir` collecting missing directories below the root.
+     * @param dir - Directory to probe
+     * @param missing - Missing directories found so far, deepest first
+     * @returns The missing directories and the nearest existing ancestor
+     */
+    private missingAncestors;
+    /**
+     * Whether an existing path, with every symlink resolved, is the root or
+     * lies inside it.
+     * @param existing - Existing ancestor of a path about to be created
+     * @returns True when confined to the root
+     */
+    private resolvesInsideRoot;
+    /**
+     * Whether this apply recorded the path as one it created.
+     * @param absolutePath - Path to test
+     * @returns True when recorded
+     */
+    has(absolutePath: string): boolean;
+    /**
+     * Withdraw a file record whose write did not happen. Directory records
+     * stay: they are removed only when empty, which is always safe.
+     * @param absolutePath - Path to withdraw
+     */
+    forget(absolutePath: string): void;
+    /**
+     * Remove every recorded file that is still a non-directory, then every
+     * recorded directory that is now empty, deepest first.
+     * @returns Root-relative paths of the files removed
+     */
+    removeAll(): Promise<readonly string[]>;
+    /** Forget everything (the apply succeeded; its files are now the host's). */
+    clear(): void;
+}
+//# sourceMappingURL=created-paths.d.ts.map

package/dist/transaction/created-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"created-paths.d.ts","sourceRoot":"","sources":["../../src/transaction/created-paths.ts"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAarE;AA0BD;;;;;;;;;;;;GAYG;AACH,qBAAa,iBAAiB;IAQhB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C;;;OAGG;gBAC0B,IAAI,EAAE,MAAM;IAEzC;;;;;;OAMG;IACG,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjD;;;;;OAKG;YACW,gBAAgB;IAU9B;;;;;OAKG;YACW,kBAAkB;IAUhC;;;;OAIG;IACH,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIlC;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAIlC;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAiB7C,6EAA6E;IAC7E,KAAK,IAAI,IAAI;CAId"}

package/dist/transaction/created-paths.js

@@ -0,0 +1,176 @@
+import { lstat, realpath, rmdir, unlink } from "node:fs/promises";
+import * as path from "node:path";
+/** Errors that mean a rollback removal has nothing (left) to do. */
+const BENIGN_REMOVAL_CODES = new Set(["ENOENT", "ENOTEMPTY", "EEXIST"]);
+/** lstat errors that prove a path is absent. */
+const ABSENCE_CODES = new Set(["ENOENT", "ENOTDIR"]);
+/**
+ * Whether `candidate` lies strictly inside `root`.
+ * @param root - Directory the apply operates on
+ * @param candidate - Absolute path to test
+ * @returns True when candidate is a descendant of root, never root itself
+ */
+function isStrictlyInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return (relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative));
+}
+/**
+ * Whether anything (file, directory, or dangling symlink) occupies a path.
+ * @param absolutePath - Path to probe
+ * @returns True when the path is occupied
+ */
+export async function occupied(absolutePath) {
+    try {
+        await lstat(absolutePath);
+        return true;
+    }
+    catch (error) {
+        // Only proven absence is "missing". EACCES or ELOOP say nothing about
+        // whether the path exists, and reading them as absence would record a
+        // host path for deletion without saving it.
+        if (ABSENCE_CODES.has(error.code ?? "")) {
+            return false;
+        }
+        throw error;
+    }
+}
+/**
+ * Run a removal, treating "already gone" and "not empty" as success.
+ * @param remove - Removal to attempt
+ */
+async function removeIfPossible(remove) {
+    try {
+        await remove();
+    }
+    catch (error) {
+        const code = error.code ?? "";
+        if (!BENIGN_REMOVAL_CODES.has(code)) {
+            throw error;
+        }
+    }
+}
+/**
+ * Number of path segments, used to order directory removal deepest first.
+ * @param dir - Absolute directory path
+ * @returns Segment count
+ */
+function depth(dir) {
+    return dir.split(path.sep).length;
+}
+/**
+ * The paths one apply created, recorded explicitly before it wrote them, so a
+ * rollback can undo creation as well as modification (CodySwannGT/lisa#4459).
+ *
+ * Only recorded paths are ever candidates for removal. Nothing is inferred
+ * from the tree, so a file that existed before the apply, or that someone
+ * else writes while it runs, is never touched — including one written into a
+ * directory the apply created: directories are removed only when empty.
+ *
+ * Accepted residual: if another process creates one of the recorded missing
+ * directories mid-apply and leaves it EMPTY, rollback removes that empty
+ * directory. A non-empty one is always kept, so no content can be lost.
+ */
+export class CreatedPathLedger {
+    root;
+    files = new Set();
+    dirs = new Set();
+    /**
+     * Create a ledger confined to one destination tree.
+     * @param root - Destination directory; nothing outside it is ever recorded
+     */
+    constructor(root) {
+        this.root = root;
+    }
+    /**
+     * Record a path about to be created, plus every missing ancestor directory
+     * below the root. Must be called before the write (and before any
+     * `ensureDir`), or the ancestors it creates are indistinguishable from
+     * pre-existing ones.
+     * @param absolutePath - File the caller is about to create
+     */
+    async record(absolutePath) {
+        // An occupied path is not one this apply is about to create, whoever
+        // put it there.
+        if (!isStrictlyInside(this.root, absolutePath) ||
+            (await occupied(absolutePath))) {
+            return;
+        }
+        const { missing, existing } = await this.missingAncestors(path.dirname(absolutePath));
+        // A lexical check is not confinement: a pre-existing symlinked ancestor
+        // can send the write outside the root, and recording it would let
+        // rollback unlink a file that lives elsewhere.
+        if (!(await this.resolvesInsideRoot(existing))) {
+            return;
+        }
+        missing.forEach(dir => this.dirs.add(dir));
+        this.files.add(absolutePath);
+    }
+    /**
+     * Walk up from `dir` collecting missing directories below the root.
+     * @param dir - Directory to probe
+     * @param missing - Missing directories found so far, deepest first
+     * @returns The missing directories and the nearest existing ancestor
+     */
+    async missingAncestors(dir, missing = []) {
+        if (!isStrictlyInside(this.root, dir) || (await occupied(dir))) {
+            return { missing, existing: dir };
+        }
+        return this.missingAncestors(path.dirname(dir), [...missing, dir]);
+    }
+    /**
+     * Whether an existing path, with every symlink resolved, is the root or
+     * lies inside it.
+     * @param existing - Existing ancestor of a path about to be created
+     * @returns True when confined to the root
+     */
+    async resolvesInsideRoot(existing) {
+        const [resolvedRoot, resolved] = await Promise.all([
+            realpath(this.root),
+            realpath(existing),
+        ]);
+        return (resolved === resolvedRoot || isStrictlyInside(resolvedRoot, resolved));
+    }
+    /**
+     * Whether this apply recorded the path as one it created.
+     * @param absolutePath - Path to test
+     * @returns True when recorded
+     */
+    has(absolutePath) {
+        return this.files.has(absolutePath);
+    }
+    /**
+     * Withdraw a file record whose write did not happen. Directory records
+     * stay: they are removed only when empty, which is always safe.
+     * @param absolutePath - Path to withdraw
+     */
+    forget(absolutePath) {
+        this.files.delete(absolutePath);
+    }
+    /**
+     * Remove every recorded file that is still a non-directory, then every
+     * recorded directory that is now empty, deepest first.
+     * @returns Root-relative paths of the files removed
+     */
+    async removeAll() {
+        const removed = [];
+        for (const file of this.files) {
+            const stat = await lstat(file).catch(() => null);
+            if (stat !== null && !stat.isDirectory()) {
+                await removeIfPossible(() => unlink(file));
+                removed.push(path.relative(this.root, file));
+            }
+        }
+        const deepestFirst = [...this.dirs].sort((a, b) => depth(b) - depth(a));
+        for (const dir of deepestFirst) {
+            await removeIfPossible(() => rmdir(dir));
+        }
+        this.clear();
+        return removed;
+    }
+    /** Forget everything (the apply succeeded; its files are now the host's). */
+    clear() {
+        this.files.clear();
+        this.dirs.clear();
+    }
+}
+//# sourceMappingURL=created-paths.js.map

package/dist/transaction/created-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"created-paths.js","sourceRoot":"","sources":["../../src/transaction/created-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExE,gDAAgD;AAChD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAErD;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,CACL,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,YAAoB;IACjD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,aAAa,CAAC,GAAG,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAA2B;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAiB;IAQC;IAPZ,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1B,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C;;;OAGG;IACH,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,qEAAqE;QACrE,gBAAgB;QAChB,IACE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAC1C,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,EAC9B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACvD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAC3B,CAAC;QACF,wEAAwE;QACxE,kEAAkE;QAClE,+CAA+C;QAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAC5B,GAAW,EACX,UAA6B,EAAE;QAE/B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAC/C,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YACnB,QAAQ,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QACH,OAAO,CACL,QAAQ,KAAK,YAAY,IAAI,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,YAAoB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAoB;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzC,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6EAA6E;IAC7E,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACF"}

package/package.json

@@ -189,7 +189,7 @@
     "qs": "^6.16.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.81.2",
+  "version": "4.81.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -345,7 +345,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "ac1eb852e75586854f2caa7a07d37458aa4232af",
-  "gitHead": "ac1eb852e75586854f2caa7a07d37458aa4232af",
-  "lisaReleaseTag": "v4.81.2"
+  "lisaReleaseCommit": "e9f635e3e13ab6737422426cfe248257a081a4e5",
+  "gitHead": "e9f635e3e13ab6737422426cfe248257a081a4e5",
+  "lisaReleaseTag": "v4.81.4"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.81.2",
+  "version": "4.81.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.81.2",
+  "version": "4.81.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/SKILL.md

@@ -25,9 +25,9 @@ channels (Telegram) and cross-session messaging (`SendMessage`, `crossSessionInb
 | Runtime | lisa-setup-session-manager | lisa-session-manager (manager) | `managedBy=` |
 |---|---|---|---|
 | Claude Code | supported | supported (reference). Needs `claude` ≥ 2.1.224, `tmux`, `bun` | supported |
-| Codex | config, token and runbook are supported. `start` launches a Claude Code manager, so it works when the `claude` CLI is installed | the skill ships, but `cycle` refuses to run here (no `/loop`, channels or `SendMessage`); tell the operator to run `start` | rejected with the gap message |
+| Codex | config, token (prompt or `--from-clipboard`), runbook, `trust-status` and `coexistence` are supported. `trust-status` reads Claude Code's trust record, which is the one that matters (workers are Claude Code); accepting trust needs the `claude` CLI. `coexistence` sees only run logs, so also list Codex automations. `start` launches a Claude Code manager, so it works when the `claude` CLI is installed | the skill ships, but `cycle` refuses to run here (no `/loop`, channels or `SendMessage`); tell the operator to run `start` | rejected with the gap message |
 | Cursor / Antigravity (agy) / Copilot / Devin | same as Codex | same as Codex | rejected |
-| OpenCode | config and token are supported; script resolution relies on the npm rung, so `queue` and `record-cycle` need the npm package | gap | rejected |
+| OpenCode | same setup subcommands as Codex, but script resolution relies on the npm rung: the CLI imports plugin-level scripts the skill-folder copy lacks, so every subcommand needs the npm package | gap | rejected |
 
 On any runtime other than Claude Code, `cycle` stops with: "The session manager runs on Claude Code
 only (background sessions, channels, cross-session messaging). Run `/lisa:session-manager start`

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/scripts/cli-manager.mjs

@@ -1,6 +1,7 @@
 /**
- * Manager and setup subcommands of the session-manager CLI: start, stop,
- * status, repo-dir, validate, init-config and store-token.
+ * Manager subcommands of the session-manager CLI: start, stop, status,
+ * repo-dir and validate. The setup ones (init-config, store-token,
+ * trust-status, coexistence) live in cli-setup.mjs.
  *
  * `start` hosts the manager in tmux. It refuses (exit 2) unless the bot
  * token file exists with owner-only permissions in the project's own state
@@ -11,15 +12,11 @@
  * manager's tmux session: workers hold claimed work and keep running.
  * @module session-manager/cli-manager
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-
 import {
   CliError,
   EXIT,
   GLOBAL_CONFIG_FILE,
   asSetupError,
-  asSetupErrorAsync,
   intFlag,
   listAgents,
   loadProject,
@@ -28,12 +25,8 @@ import {
   requireLisaRepo,
   run,
 } from "./cli-runtime.mjs";
-import { buildDefaultBlock, detectRepos, resolveRepoDir } from "./config.mjs";
-import {
-  defaultProjectSlug,
-  probeOwnSession,
-  sessionSurvives,
-} from "./isolation.mjs";
+import { resolveRepoDir } from "./config.mjs";
+import { probeOwnSession, sessionSurvives } from "./isolation.mjs";
 import {
   assertTokenPresent,
   buildForegroundCommand,
@@ -41,7 +34,6 @@ import {
   buildManagerLaunch,
   buildStopManager,
   resolveStateDir,
-  storeToken as storeTokenFile,
 } from "./launch.mjs";
 import { readLedger } from "./ledger.mjs";
 import { parseWorkerName, scrubWorkerEnv } from "./workers.mjs";
@@ -208,69 +200,6 @@ export function validate(ctx) {
   };
 }
 
-/**
- * `init-config [--slug <slug>] [--write]`: the default block for this
- * project, written to `.lisa.config.json` only with `--write` and only when
- * no block exists. Non-secret fields only; the token never goes here.
- * @param {object} ctx - CLI context
- * @returns {{ json: object }} `{written,block,...}`
- */
-export function initConfig(ctx) {
-  const { global } = loadProject(ctx.root);
-  if (global?.sessionManager) {
-    return {
-      json: { written: false, reason: "exists", block: global.sessionManager },
-    };
-  }
-  const slug =
-    ctx.values.slug ?? defaultProjectSlug(ctx.root, global?.github?.repo);
-  const block = asSetupError(() =>
-    buildDefaultBlock({
-      projectSlug: slug,
-      detectedRepos: detectRepos(ctx.root),
-    })
-  );
-  if (!ctx.values.write) return { json: { written: false, block } };
-
-  const file = path.join(ctx.root, GLOBAL_CONFIG_FILE);
-  if (!existsSync(file)) {
-    throw new CliError(
-      `${file} does not exist; set up Lisa in this project first.`,
-      EXIT.SETUP
-    );
-  }
-  const current = JSON.parse(readFileSync(file, "utf8"));
-  writeFileSync(
-    file,
-    `${JSON.stringify({ ...current, sessionManager: block }, null, 2)}\n`
-  );
-  return { json: { written: true, path: file, block } };
-}
-
-/**
- * `store-token [--replace]`: prompt for the bot token on the operator's
- * terminal and write `<stateDir>/.env`. An existing token is kept (exit 2)
- * unless `--replace` is given. With no TTY it prints the command the operator
- * must run themselves and exits 0 with `stored:false`.
- * @param {object} ctx - CLI context
- * @returns {Promise<{ json: object, exitCode: number }>} Outcome
- */
-export async function storeToken(ctx) {
-  const config = requireConfig(ctx);
-  const result = await asSetupErrorAsync(() =>
-    storeTokenFile({
-      stateDir: config.notify?.stateDir,
-      scriptsDir: ctx.scriptsDir,
-      projectRoot: ctx.root,
-      replace: ctx.values.replace === true,
-      env: ctx.env,
-      homedir: ctx.homedir,
-    })
-  );
-  const refused = result.stored === false && result.reason !== "no-tty";
-  return { json: result, exitCode: refused ? EXIT.SETUP : EXIT.OK };
-}
-
 /**
  * `status`: is the manager's tmux session up, and what does the ledger say
  * about each worker it dispatched.