@dharma-ai-labs/agent-fabric 0.2.153 → 0.2.154

package/dist/repositoryPackage.js

@@ -1,8 +1,10 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { link, lstat, mkdir, open, opendir, realpath, rename, rmdir, unlink } from 'node:fs/promises';
+import { link as nativeLink, lstat as nativeLstat, mkdir as nativeMkdir, open, opendir, realpath as nativeRealpath, rename as nativeRename, rmdir as nativeRmdir, unlink as nativeUnlink } from 'node:fs/promises';
 import { isAbsolute, posix, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { types } from 'node:util';
+import { currentBootstrapHostScope } from './bootstrapHostScope.js';
 import { canonicalize, validateContract } from '@dharma-ai-labs/agent-fabric-contracts';
 import { redactValue } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
 import { readRepositoryKnowledgeSource, validateRepositoryKnowledgeCatalog, validateRepositoryKnowledgeRetention, REPOSITORY_KNOWLEDGE_CATALOG_PATH, REPOSITORY_KNOWLEDGE_RELEASE_MANIFEST_PATH } from './repositoryKnowledge.js';
@@ -14,7 +16,130 @@ const DEFAULT_LIMITS = { maximumEntries: 4096, maximumFiles: 512, maximumFileByt
     maximumScannedSourceEntries: 65_536 };
 function digest(value) { return `sha256:${createHash('sha256').update(value).digest('hex')}`; }
 function compare(a, b) { return a < b ? -1 : a > b ? 1 : 0; }
-function missing(error) { return ['ENOENT', 'ENOTDIR'].includes(String(error.code)); }
+function errorCode(error) {
+    if (!error || typeof error !== 'object' || types.isProxy(error))
+        return undefined;
+    const field = Object.getOwnPropertyDescriptor(error, 'code');
+    return field && Object.hasOwn(field, 'value') && typeof field.value === 'string' ? field.value : undefined;
+}
+function missing(error) { return ['ENOENT', 'ENOTDIR'].includes(errorCode(error) || ''); }
+async function packageEffect(scope, operation) {
+    if (!scope)
+        return operation();
+    try {
+        return await scope.step(operation);
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && cleanupFailures.has(error))
+            throw error;
+        await scope.assert();
+        const code = errorCode(error);
+        throw Object.assign(new Error('repository_package_storage_unavailable'), ['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM', 'EEXIST', 'ENOTEMPTY', 'ESRCH'].includes(code || '') ? { code } : {});
+    }
+}
+function admitted(operation) {
+    return ((...args) => packageEffect(currentBootstrapHostScope(), () => operation(...args)));
+}
+const lstat = admitted(nativeLstat), realpath = admitted(nativeRealpath), mkdir = admitted(nativeMkdir), link = admitted(nativeLink), rename = admitted(nativeRename), rmdir = admitted(nativeRmdir), unlink = admitted(nativeUnlink);
+const cleanupFailures = new WeakSet();
+function cleanupFailure() {
+    const failure = new Error('repository_package_cleanup_unconfirmed');
+    cleanupFailures.add(failure);
+    return failure;
+}
+async function closeReadHandle(handle, scope) {
+    try {
+        await handle?.close();
+    }
+    catch (error) {
+        if (!scope)
+            throw error;
+        throw cleanupFailure();
+    }
+}
+async function* directoryEntries(source) {
+    const scope = currentBootstrapHostScope();
+    let directory;
+    try {
+        await packageEffect(scope, async () => { directory = await opendir(source); });
+        for (;;) {
+            const entry = await packageEffect(scope, () => directory.read());
+            if (!entry)
+                break;
+            yield entry;
+        }
+    }
+    finally {
+        await closeReadHandle(directory, scope);
+    }
+}
+function snapshotPackageInput(input, scope, keys) {
+    if (!scope)
+        return input;
+    let nodes = 0, bytes = 0;
+    const invalid = () => new Error('repository_package_input_invalid');
+    const clone = (value, depth) => {
+        if (++nodes > 65_536 || depth > 16)
+            throw invalid();
+        if (value === null || value === undefined || typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number') {
+            if (!Number.isFinite(value))
+                throw invalid();
+            return value;
+        }
+        if (typeof value === 'string') {
+            bytes += Buffer.byteLength(value);
+            if (bytes > 16_777_216)
+                throw invalid();
+            return value;
+        }
+        if (typeof value !== 'object' || types.isProxy(value))
+            throw invalid();
+        if (types.isDate(value)) {
+            const time = Date.prototype.getTime.call(value);
+            if (!Number.isFinite(time))
+                throw invalid();
+            return new Date(time);
+        }
+        if (Buffer.isBuffer(value)) {
+            const length = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(value);
+            bytes += length;
+            if (bytes > 16_777_216)
+                throw invalid();
+            const copy = Buffer.alloc(length);
+            Uint8Array.prototype.set.call(copy, value);
+            return copy;
+        }
+        const array = Array.isArray(value), prototype = Object.getPrototypeOf(value);
+        if (!array && prototype !== null && (types.isProxy(prototype) || Object.getPrototypeOf(prototype) !== null))
+            throw invalid();
+        const fields = Object.getOwnPropertyDescriptors(value), result = array ? [] : Object.create(null);
+        if (Object.getOwnPropertySymbols(value).length || array && (fields.length.value > 8192
+            || Object.keys(fields).length !== fields.length.value + 1))
+            throw invalid();
+        for (const [key, field] of Object.entries(fields)) {
+            if (array && key === 'length')
+                continue;
+            if (!Object.hasOwn(field, 'value') || array && !/^(?:0|[1-9][0-9]*)$/.test(key))
+                throw invalid();
+            Object.defineProperty(result, key, { value: clone(field.value, depth + 1), enumerable: true });
+        }
+        return Object.freeze(result);
+    };
+    if (!input || typeof input !== 'object' || types.isProxy(input))
+        throw invalid();
+    const result = {};
+    for (const key of keys) {
+        const field = Object.getOwnPropertyDescriptor(input, key);
+        if (!field)
+            continue;
+        if (!Object.hasOwn(field, 'value'))
+            throw invalid();
+        result[key] = clone(field.value, 0);
+    }
+    return Object.freeze(result);
+}
 function pathKey(value) {
     if (!value || value.includes('\\') || isAbsolute(value) || /^[A-Za-z]:/.test(value))
         throw new Error('Invalid repository package path.');
@@ -96,12 +221,14 @@ async function checkedPath(workspace, path) {
     return current;
 }
 async function readStable(workspace, path, maximumBytes) {
+    const scope = currentBootstrapHostScope();
     const source = await checkedPath(workspace, path);
     if (!(await lstat(source)).isFile())
         throw new Error('Repository package requires regular files.');
-    const handle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    let handle;
     try {
-        const before = await handle.stat();
+        await packageEffect(scope, async () => { handle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0)); });
+        const before = await packageEffect(scope, () => handle.stat());
         if (!before.isFile())
             throw new Error('Repository package requires regular files.');
         if (before.size > maximumBytes)
@@ -109,12 +236,12 @@ async function readStable(workspace, path, maximumBytes) {
         const buffer = Buffer.alloc(before.size + 1);
         let size = 0;
         while (size < buffer.length) {
-            const result = await handle.read(buffer, size, buffer.length - size, size);
+            const result = await packageEffect(scope, () => handle.read(buffer, size, buffer.length - size, size));
             if (!result.bytesRead)
                 break;
             size += result.bytesRead;
         }
-        const after = await handle.stat();
+        const after = await packageEffect(scope, () => handle.stat());
         const current = await lstat(await checkedPath(workspace, path));
         if (size !== before.size || before.size !== after.size || before.mtimeMs !== after.mtimeMs
             || before.ctimeMs !== after.ctimeMs || current.ino !== before.ino || current.dev !== before.dev
@@ -123,7 +250,7 @@ async function readStable(workspace, path, maximumBytes) {
         return buffer.subarray(0, size);
     }
     finally {
-        await handle.close();
+        await closeReadHandle(handle, scope);
     }
 }
 function dependencies(text) {
@@ -140,6 +267,11 @@ function sourceContentType(path) {
         || /^(?:README|LICENSE|Makefile|Dockerfile)$/i.test(posix.basename(path));
 }
 export async function inventoryRepositoryPackage(input) {
+    const scope = currentBootstrapHostScope();
+    input = snapshotPackageInput(input, scope, ['workspace', 'organizationId', 'workspaceId', 'repositoryAgentId', 'repositoryBindingId',
+        'sourceAuthorization', 'approvedOutputs', 'observations', 'limits', 'now', 'retainedKnowledge']);
+    if (scope)
+        await scope.assert();
     if (![input.organizationId, input.workspaceId].every(value => /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(value))) {
         throw new Error('Repository package requires bounded organization and workspace identities.');
     }
@@ -201,8 +333,7 @@ export async function inventoryRepositoryPackage(input) {
             const metadata = await lstat(source);
             if (metadata.isDirectory()) {
                 const names = [];
-                const directory = await opendir(source);
-                for await (const entry of directory) {
+                for await (const entry of directoryEntries(source)) {
                     const child = `${path}/${entry.name}`;
                     if (generated(child))
                         continue;
@@ -226,6 +357,8 @@ export async function inventoryRepositoryPackage(input) {
                 exclude(path, 'not_regular_file');
         }
         catch (error) {
+            if (scope)
+                await scope.assert();
             if (missing(error))
                 return;
             if (String(error).includes('symlink')) {
@@ -234,7 +367,7 @@ export async function inventoryRepositoryPackage(input) {
             }
             if (String(error).includes('limit'))
                 throw error;
-            if (['EACCES', 'EPERM'].includes(String(error.code))) {
+            if (['EACCES', 'EPERM'].includes(errorCode(error) || '')) {
                 exclude(path, 'unavailable');
                 return;
             }
@@ -266,6 +399,8 @@ export async function inventoryRepositoryPackage(input) {
                 source = path === '.' ? workspace : await checkedPath(workspace, path);
             }
             catch (error) {
+                if (scope)
+                    await scope.assert();
                 if (missing(error)) {
                     witnesses.set(path, 'missing');
                     return false;
@@ -280,8 +415,7 @@ export async function inventoryRepositoryPackage(input) {
             const metadata = await lstat(source);
             if (metadata.isDirectory()) {
                 const names = [];
-                const directory = await opendir(source);
-                for await (const entry of directory) {
+                for await (const entry of directoryEntries(source)) {
                     if (++scanned > limits.maximumScannedSourceEntries)
                         throw new Error('Repository source scan limit exceeded.');
                     const child = path === '.' ? entry.name : `${path}/${entry.name}`;
@@ -385,6 +519,10 @@ export async function inventoryRepositoryPackage(input) {
             content = await readStable(workspace, path, limits.maximumFileBytes);
         }
         catch (error) {
+            if (error && typeof error === 'object' && cleanupFailures.has(error))
+                throw error;
+            if (scope)
+                await scope.assert();
             if (String(error).includes('limit') || String(error).includes('changed during'))
                 throw error;
             exclude(path, missing(error) ? 'missing_dependency' : String(error).includes('symlink') ? 'symlink' : 'unavailable');
@@ -531,6 +669,8 @@ export async function inventoryRepositoryPackage(input) {
         ...(knowledge ? { knowledge } : {}), ...(authorization ? { sourceAuthorization: authorization } : {}) };
     const fingerprinted = authorization ? { ...base, sourceFingerprint: sourceFingerprint(base) } : base;
     const snapshotHash = digest(canonicalize(fingerprinted));
+    if (scope)
+        await scope.assert();
     return { schema: 'dharma.repository-package-snapshot/v1', capturedAt: (input.now || new Date()).toISOString(),
         manifest: { ...fingerprinted, snapshotHash, snapshotId: `repository-package-${snapshotHash.slice(7)}` },
         blobs: [...blobs].sort(([a], [b]) => compare(a, b)).map(([sha256, contentBase64]) => ({ sha256, contentBase64 })) };
@@ -701,8 +841,11 @@ export function serializeRepositoryPackageSnapshot(snapshot) {
     return `${canonicalize({ manifest: snapshot.manifest, blobs: snapshot.blobs })}\n`;
 }
 async function persistSnapshot(input, workspace) {
+    const scope = currentBootstrapHostScope();
+    if (scope)
+        await scope.assert();
     const serialized = serializeRepositoryPackageSnapshot(input.snapshot);
-    const validated = await validateContract(fileURLToPath(new URL('./schemas/', import.meta.url)), `https://schemas.dharma-ai.io/repository-package/${input.snapshot.manifest.schema.split('/')[1]}`, input.snapshot.manifest);
+    const validated = await packageEffect(scope, () => validateContract(fileURLToPath(new URL('./schemas/', import.meta.url)), `https://schemas.dharma-ai.io/repository-package/${input.snapshot.manifest.schema.split('/')[1]}`, input.snapshot.manifest));
     if (!validated.ok)
         throw new Error('Repository package manifest schema is invalid.');
     const activeManifestPath = `${GENERATED_ROOT}/MANIFEST.json`;
@@ -723,6 +866,8 @@ async function persistSnapshot(input, workspace) {
             marker = JSON.parse((await readStable(workspace, `${GENERATED_ROOT}/.dharma-agent-fabric.json`, 4096)).toString('utf8'));
         }
         catch (error) {
+            if (scope)
+                await scope.assert();
             if (String(error).includes('symlink'))
                 throw error;
             throw new Error('Refusing to write into an unmanaged repository skill.');
@@ -748,7 +893,7 @@ async function persistSnapshot(input, workspace) {
             await mkdir(resolve(workspace, current), { mode: 0o700 });
         }
         catch (error) {
-            if (error.code !== 'EEXIST')
+            if (errorCode(error) !== 'EEXIST')
                 throw error;
         }
         await checkedPath(workspace, current);
@@ -756,21 +901,16 @@ async function persistSnapshot(input, workspace) {
     await checkedPath(workspace, posix.dirname(snapshotPath));
     for (const [path, content] of [[snapshotPath, serialized], [candidateManifestPath, `${canonicalize(input.snapshot.manifest)}\n`]]) {
         const stagedSnapshot = `${snapshotRoot}/.snapshot-${randomUUID()}.tmp`;
+        let identity;
         try {
-            const handle = await open(resolve(workspace, stagedSnapshot), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
-            try {
-                await handle.writeFile(content);
-                await handle.sync();
-            }
-            finally {
-                await handle.close();
-            }
+            identity = await freshFile(workspace, stagedSnapshot, content);
             await checkedPath(workspace, snapshotRoot);
+            await verifyStaging(workspace, stagedSnapshot, identity);
             try {
                 await link(resolve(workspace, stagedSnapshot), resolve(workspace, path));
             }
             catch (error) {
-                if (error.code !== 'EEXIST')
+                if (errorCode(error) !== 'EEXIST')
                     throw error;
                 const existing = await readStable(workspace, path, 8_388_608);
                 if (existing.toString('utf8') !== content)
@@ -778,8 +918,8 @@ async function persistSnapshot(input, workspace) {
             }
         }
         finally {
-            await unlink(resolve(workspace, stagedSnapshot)).catch(error => { if (!missing(error))
-                throw error; });
+            if (identity)
+                await cleanupStaging(workspace, stagedSnapshot, identity);
         }
     }
     await syncDirectory(workspace, posix.dirname(snapshotPath));
@@ -790,6 +930,8 @@ async function persistSnapshot(input, workspace) {
             await prepareCopies(workspace, input.snapshot, input.onCopyCheckpoint);
         });
     }
+    if (scope)
+        await scope.assert();
     return { manifestPath, snapshotPath, snapshotHash: input.snapshot.manifest.snapshotHash,
         managedCopiesPath: candidateOnly ? null : `${GENERATED_ROOT}/skills/source`,
         disposition: candidateOnly ? 'candidate_only' : 'local_bootstrap_inventory',
@@ -797,9 +939,20 @@ async function persistSnapshot(input, workspace) {
 }
 const writers = new Map();
 export async function writeRepositoryPackageSnapshot(input) {
+    const scope = currentBootstrapHostScope();
+    if (scope) {
+        const copied = snapshotPackageInput(input, scope, ['workspace', 'snapshot', 'candidateOnly']);
+        const field = Object.getOwnPropertyDescriptor(input, 'onCopyCheckpoint');
+        if (field && (!Object.hasOwn(field, 'value') || field.value !== undefined
+            && (typeof field.value !== 'function' || types.isProxy(field.value))))
+            throw new Error('repository_package_input_invalid');
+        input = Object.freeze({ ...copied, onCopyCheckpoint: field?.value });
+        await scope.assert();
+    }
     const workspace = await realpath(input.workspace);
     const previous = writers.get(workspace) || Promise.resolve();
-    const operation = previous.catch(() => { }).then(() => persistSnapshot(input, workspace));
+    const operation = previous.catch(() => { }).then(async () => { if (scope)
+        await scope.assert(); return persistSnapshot(input, workspace); });
     writers.set(workspace, operation);
     try {
         return await operation;
@@ -854,7 +1007,7 @@ async function directories(workspace, path) {
             await mkdir(resolve(workspace, current), { mode: 0o700 });
         }
         catch (error) {
-            if (error.code !== 'EEXIST')
+            if (errorCode(error) !== 'EEXIST')
                 throw error;
         }
         if (!(await lstat(await checkedPath(workspace, current))).isDirectory())
@@ -862,40 +1015,92 @@ async function directories(workspace, path) {
     }
 }
 async function syncDirectory(workspace, path) {
+    const scope = currentBootstrapHostScope();
+    if (scope)
+        await scope.assert();
     if (process.platform === 'win32')
         return; // Windows does not support opening directories for fsync.
-    const handle = await open(await checkedPath(workspace, path), constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const source = await checkedPath(workspace, path);
+    let handle;
     try {
-        await handle.sync();
+        await packageEffect(scope, async () => { handle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0)); });
+        await packageEffect(scope, () => handle.sync());
     }
     finally {
-        await handle.close();
+        await closeReadHandle(handle, scope);
     }
 }
 async function freshFile(workspace, path, bytes) {
+    const scope = currentBootstrapHostScope();
+    const content = Buffer.from(bytes);
     await directories(workspace, posix.dirname(path));
-    const handle = await open(resolve(workspace, path), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const parent = await lstat(await checkedPath(workspace, posix.dirname(path)), { bigint: true });
+    let handle, identity;
     try {
-        await handle.writeFile(bytes);
-        await handle.sync();
+        await packageEffect(scope, async () => {
+            handle = await open(resolve(workspace, path), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+        });
+        const metadata = await packageEffect(scope, () => handle.stat({ bigint: true }));
+        if (!metadata.isFile() || metadata.ino === 0n || metadata.nlink !== 1n)
+            throw cleanupFailure();
+        identity = { dev: metadata.dev, ino: metadata.ino, parentDev: parent.dev, parentIno: parent.ino,
+            sizeBytes: content.length, sha256: digest(content) };
+        await packageEffect(scope, () => handle.writeFile(content));
+        await packageEffect(scope, () => handle.sync());
     }
     finally {
-        await handle.close();
+        await closeReadHandle(handle, scope);
     }
     await syncDirectory(workspace, posix.dirname(path));
+    return identity;
+}
+async function verifyStaging(workspace, path, identity) {
+    const parent = await lstat(await checkedPath(workspace, posix.dirname(path)), { bigint: true });
+    const metadata = await lstat(await checkedPath(workspace, path), { bigint: true });
+    if (!parent.isDirectory() || parent.dev !== identity.parentDev || parent.ino !== identity.parentIno
+        || !ownedLockMetadata(metadata, identity) || metadata.size !== BigInt(identity.sizeBytes))
+        throw cleanupFailure();
+    const bytes = await readStable(workspace, path, identity.sizeBytes);
+    const current = await lstat(await checkedPath(workspace, path), { bigint: true });
+    if (!ownedLockMetadata(current, identity) || bytes.length !== identity.sizeBytes || digest(bytes) !== identity.sha256)
+        throw cleanupFailure();
+}
+async function cleanupStaging(workspace, path, identity) {
+    const scope = currentBootstrapHostScope();
+    if (scope && !await scope.current())
+        return; // Interrupted generated evidence is retained.
+    try {
+        const parent = await lstat(await checkedPath(workspace, posix.dirname(path)), { bigint: true });
+        if (parent.dev !== identity.parentDev || parent.ino !== identity.parentIno)
+            throw cleanupFailure();
+        const metadata = await lstat(resolve(workspace, path), { bigint: true }).catch(error => { if (missing(error))
+            return null; throw error; });
+        if (!metadata)
+            return;
+        if (metadata.isSymbolicLink() || !metadata.isFile() || metadata.dev !== identity.dev || metadata.ino !== identity.ino
+            || metadata.nlink < 1n || metadata.nlink > 2n)
+            throw cleanupFailure();
+        await verifyStaging(workspace, path, identity);
+        await unlink(resolve(workspace, path));
+    }
+    catch (error) {
+        if (scope)
+            await scope.assert();
+        throw cleanupFailure();
+    }
 }
 async function atomicMetadata(workspace, path, value) {
     const temporary = `${GENERATED_ROOT}/.metadata-${randomUUID()}.tmp`;
-    await freshFile(workspace, temporary, `${canonicalize(value)}\n`);
+    const identity = await freshFile(workspace, temporary, `${canonicalize(value)}\n`);
     try {
         await checkedPath(workspace, GENERATED_ROOT);
         await optionalBytes(workspace, path);
+        await verifyStaging(workspace, temporary, identity);
         await rename(resolve(workspace, temporary), resolve(workspace, path));
         await syncDirectory(workspace, GENERATED_ROOT);
     }
     finally {
-        await unlink(resolve(workspace, temporary)).catch(error => { if (!missing(error))
-            throw error; });
+        await cleanupStaging(workspace, temporary, identity);
     }
 }
 async function snapshotFor(workspace, hash) {
@@ -907,7 +1112,7 @@ async function snapshotFor(workspace, hash) {
     if (snapshot.manifest.snapshotHash !== hash || serializeRepositoryPackageSnapshot(snapshot) !== bytes.toString('utf8')) {
         throw new Error('Managed copies snapshot integrity failed.');
     }
-    const validated = await validateContract(fileURLToPath(new URL('./schemas/', import.meta.url)), `https://schemas.dharma-ai.io/repository-package/${snapshot.manifest.schema.split('/')[1]}`, snapshot.manifest);
+    const validated = await packageEffect(currentBootstrapHostScope(), () => validateContract(fileURLToPath(new URL('./schemas/', import.meta.url)), `https://schemas.dharma-ai.io/repository-package/${snapshot.manifest.schema.split('/')[1]}`, snapshot.manifest));
     if (!validated.ok)
         throw new Error('Managed copies snapshot schema integrity failed.');
     return snapshot;
@@ -1014,7 +1219,7 @@ async function prepareCopies(workspace, snapshot, checkpoint) {
             await freshFile(workspace, staged, blobs.get(operation.after.sha256));
     }
     await atomicMetadata(workspace, JOURNAL_PATH, journal);
-    await checkpoint?.('journal_prepared');
+    await copyCheckpoint(checkpoint, 'journal_prepared');
     await applyJournal(workspace, journal, snapshot, checkpoint);
 }
 async function recoverCopies(workspace) {
@@ -1090,7 +1295,7 @@ async function applyJournal(workspace, journal, snapshot, checkpoint) {
                 await rename(resolve(workspace, target), resolve(workspace, backup));
                 await syncDirectory(workspace, posix.dirname(target));
                 await syncDirectory(workspace, posix.dirname(backup));
-                await checkpoint?.('file_backed_up');
+                await copyCheckpoint(checkpoint, 'file_backed_up');
             }
             else if (operation.before && !saved && !installed)
                 throw new Error('Managed copies missing backup conflict.');
@@ -1102,21 +1307,21 @@ async function applyJournal(workspace, journal, snapshot, checkpoint) {
                     await link(resolve(workspace, staged), resolve(workspace, target));
                 }
                 catch (error) {
-                    if (error.code === 'EEXIST')
+                    if (errorCode(error) === 'EEXIST')
                         throw new Error('Managed copies unmanaged destination conflict.');
                     throw error;
                 }
                 await syncDirectory(workspace, posix.dirname(target));
-                await checkpoint?.('file_installed');
+                await copyCheckpoint(checkpoint, 'file_installed');
             }
         }
         await verifyCopies(workspace, journal);
         await verifyMetadata(workspace, journal, desiredManifest);
         await atomicMetadata(workspace, INDEX_PATH, journal.desired);
-        await checkpoint?.('copies_index_written');
+        await copyCheckpoint(checkpoint, 'copies_index_written');
         await verifyMetadata(workspace, journal, desiredManifest);
         await atomicMetadata(workspace, `${GENERATED_ROOT}/MANIFEST.json`, snapshot.manifest);
-        await checkpoint?.('manifest_written');
+        await copyCheckpoint(checkpoint, 'manifest_written');
     }
     await verifyCopies(workspace, journal);
     for (const [number, operation] of operations.entries()) {
@@ -1125,7 +1330,7 @@ async function applyJournal(workspace, journal, snapshot, checkpoint) {
             if (await matches(workspace, path, file)) {
                 await unlink(resolve(workspace, path));
                 await syncDirectory(workspace, posix.dirname(path));
-                await checkpoint?.('cleanup_file_removed');
+                await copyCheckpoint(checkpoint, 'cleanup_file_removed');
             }
         }
     }
@@ -1148,7 +1353,7 @@ async function applyJournal(workspace, journal, snapshot, checkpoint) {
             await rmdir(await checkedPath(workspace, folder));
         }
         catch (error) {
-            if (!missing(error) && !['ENOTEMPTY', 'EEXIST'].includes(String(error.code)))
+            if (!missing(error) && !['ENOTEMPTY', 'EEXIST'].includes(errorCode(error) || ''))
                 throw error;
         }
     }
@@ -1158,21 +1363,88 @@ async function applyJournal(workspace, journal, snapshot, checkpoint) {
     await unlink(resolve(workspace, JOURNAL_PATH));
     await syncDirectory(workspace, GENERATED_ROOT);
 }
+async function copyCheckpoint(checkpoint, point) {
+    await packageEffect(currentBootstrapHostScope(), async () => { await checkpoint?.(point); });
+}
+function ownedLockMetadata(metadata, identity) {
+    return metadata.isFile() && !metadata.isSymbolicLink() && metadata.dev === identity.dev && metadata.ino === identity.ino
+        && metadata.nlink >= 1n && metadata.nlink <= 2n;
+}
+// Cooperative release can inspect/delete only this acquired inode and nonce,
+// even after ordinary setup admission closes. It never resumes journal work.
+async function releaseLockFile(workspace, path, identity, text) {
+    const scope = currentBootstrapHostScope(), parentPath = resolve(workspace, posix.dirname(path)), source = resolve(workspace, path);
+    try {
+        const parent = await nativeLstat(parentPath, { bigint: true });
+        if (!parent.isDirectory() || parent.isSymbolicLink() || parent.dev !== identity.parentDev || parent.ino !== identity.parentIno)
+            throw cleanupFailure();
+        const metadata = await nativeLstat(source, { bigint: true }).catch(error => { if (missing(error))
+            return null; throw error; });
+        if (!metadata)
+            return;
+        if (!ownedLockMetadata(metadata, identity))
+            throw cleanupFailure();
+        const expected = Buffer.from(text), bytes = Buffer.alloc(expected.length + 1);
+        let handle, before;
+        try {
+            handle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+            before = await handle.stat({ bigint: true });
+            if (!ownedLockMetadata(before, identity) || before.size !== BigInt(expected.length))
+                throw cleanupFailure();
+            let size = 0;
+            while (size < bytes.length) {
+                const result = await handle.read(bytes, size, bytes.length - size, size);
+                if (!result.bytesRead)
+                    break;
+                size += result.bytesRead;
+            }
+            const after = await handle.stat({ bigint: true });
+            if (!ownedLockMetadata(after, identity) || size !== expected.length || !bytes.subarray(0, size).equals(expected)
+                || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+                throw cleanupFailure();
+        }
+        finally {
+            await closeReadHandle(handle, scope);
+        }
+        const current = await nativeLstat(source, { bigint: true });
+        if (!ownedLockMetadata(current, identity) || before.size !== current.size
+            || before.mtimeNs !== current.mtimeNs || before.ctimeNs !== current.ctimeNs)
+            throw cleanupFailure();
+        await nativeUnlink(source);
+        if (process.platform !== 'win32') {
+            let directory;
+            try {
+                directory = await open(parentPath, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+                const currentParent = await directory.stat({ bigint: true });
+                if (!currentParent.isDirectory() || currentParent.dev !== identity.parentDev || currentParent.ino !== identity.parentIno)
+                    throw cleanupFailure();
+                await directory.sync();
+            }
+            finally {
+                await closeReadHandle(directory, scope);
+            }
+        }
+    }
+    catch {
+        throw cleanupFailure();
+    }
+}
 async function withCopyLock(workspace, action) {
+    const scope = currentBootstrapHostScope();
     const lock = { schema: 'dharma.repository-package-copy-lock/v1', platform: process.platform, pid: process.pid, nonce: randomUUID() };
     const text = `${canonicalize(lock)}\n`;
     const temporary = `${GENERATED_ROOT}/.lock-${lock.nonce}.tmp`;
-    await freshFile(workspace, temporary, text);
+    const identity = await freshFile(workspace, temporary, text);
     let acquired = false;
     try {
+        await verifyStaging(workspace, temporary, identity);
         for (let attempt = 0; attempt < 2; attempt++) {
             try {
-                await link(resolve(workspace, temporary), resolve(workspace, LOCK_PATH));
-                acquired = true;
+                await packageEffect(scope, async () => { await nativeLink(resolve(workspace, temporary), resolve(workspace, LOCK_PATH)); acquired = true; });
                 break;
             }
             catch (error) {
-                if (error.code !== 'EEXIST')
+                if (errorCode(error) !== 'EEXIST')
                     throw error;
                 const bytes = await readStable(workspace, LOCK_PATH, 4096);
                 const existing = JSON.parse(bytes.toString('utf8'));
@@ -1180,11 +1452,11 @@ async function withCopyLock(workspace, action) {
                     throw new Error('Managed copies lock conflict.');
                 }
                 try {
-                    process.kill(existing.pid, 0);
+                    await packageEffect(scope, async () => { process.kill(existing.pid, 0); });
                     throw new Error('Managed copies writer is active; retry later.');
                 }
                 catch (error) {
-                    if (error.code !== 'ESRCH')
+                    if (errorCode(error) !== 'ESRCH')
                         throw error;
                 }
                 if (!(await readStable(workspace, LOCK_PATH, 4096)).equals(bytes))
@@ -1194,16 +1466,25 @@ async function withCopyLock(workspace, action) {
         }
         if (!acquired)
             throw new Error('Managed copies lock conflict.');
-        await action();
+        await packageEffect(scope, action);
     }
     finally {
-        if (acquired) {
-            if ((await readStable(workspace, LOCK_PATH, 4096)).toString('utf8') !== text)
-                throw new Error('Managed copies lock conflict.');
-            await unlink(resolve(workspace, LOCK_PATH));
-            await syncDirectory(workspace, GENERATED_ROOT);
+        let failed = false;
+        if (acquired)
+            try {
+                await releaseLockFile(workspace, LOCK_PATH, identity, text);
+            }
+            catch {
+                failed = true;
+            }
+        try {
+            await releaseLockFile(workspace, temporary, identity, text);
+        }
+        catch {
+            failed = true;
         }
-        await unlink(resolve(workspace, temporary));
+        if (failed)
+            throw cleanupFailure();
     }
 }
 //# sourceMappingURL=repositoryPackage.js.map