@elie-laloum/outpost 1.1.4 → 3.0.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,aAAa,EACb,QAAQ,EACR,aAAa,GACd,MAAM,0BAA0B,CAAC;AAoBlC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAevE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAWrD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAItE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AASlE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAI/D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkCnE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC","sourcesContent":["export {\n  attach,\n  createSandbox,\n  dispatch,\n  openWorkspace,\n} from \"./application/outpost.ts\";\n\nexport type {\n  AttachOptions,\n  AttachResult,\n  ContinuationOptions,\n  DispatchResult,\n  Sandbox,\n  SandboxOptions,\n  WarmDispatchResult,\n  Workspace,\n  WorkspaceOptions,\n} from \"./application/outpost.ts\";\n\nexport type {\n  DispatchOptions,\n  Execution,\n  Turn,\n} from \"./application/execution.ts\";\n\nexport { WorkflowFailure, task, workflow } from \"./domain/workflow.ts\";\n\nexport type {\n  Retry,\n  Task,\n  TaskContext,\n  TaskOptions,\n  TaskRecord,\n  TaskStatus,\n  Workflow,\n  WorkflowEvent,\n  WorkflowOptions,\n  WorkflowResult,\n} from \"./domain/workflow.ts\";\n\nexport { agentTask, commandTask, isolatedTask } from \"./application/tasks.ts\";\n\nexport { campaign } from \"./application/campaign.ts\";\n\nexport type {\n  CampaignEvent,\n  CampaignOptions,\n  CampaignResult,\n  IssueOutcome,\n} from \"./application/campaign.ts\";\n\nexport type { Assignment, Backlog, Issue } from \"./domain/backlog.ts\";\n\nexport { beadsBacklog, githubBacklog } from \"./providers/backlogs.ts\";\n\nexport type { BacklogSettings } from \"./providers/backlogs.ts\";\n\nexport { claude, codex } from \"./providers/agents.ts\";\n\nexport { agentVersions } from \"./providers/versions.ts\";\n\nexport { conversations } from \"./infrastructure/conversations.ts\";\n\nexport type {\n  ConversationFormat,\n  ConversationLocation,\n} from \"./infrastructure/conversations.ts\";\n\nexport type { ClaudeSettings, CodexSettings } from \"./providers/agents.ts\";\n\nexport { mountedProvider, remoteProvider } from \"./providers/factories.ts\";\n\nexport { ResponseError, response } from \"./domain/response.ts\";\n\nexport type { ResponseSpec, StandardValidator } from \"./domain/response.ts\";\n\nexport { OutpostError, recoveryDetails } from \"./domain/errors.ts\";\n\nexport type { FaultCode } from \"./domain/errors.ts\";\n\nexport type {\n  AgentAdapter,\n  AgentEvent,\n  AgentInput,\n  AgentObservation,\n  BranchPolicy,\n  Channel,\n  Command,\n  CommandResult,\n  Commit,\n  ConversationContext,\n  ConversationRecord,\n  ConversationStore,\n  Disposal,\n  LifecycleHooks,\n  SandboxContext,\n  SandboxLease,\n  SandboxProvider,\n  StageLimits,\n  TransferOptions,\n  Usage,\n  Variables,\n  Volume,\n  WorkspaceRecord,\n} from \"./domain/ports.ts\";\n\nexport type { Brief, PromptVariables } from \"./domain/prompts.ts\";\n\nexport type { Logging } from \"./infrastructure/journal.ts\";\n\nexport { reporter } from \"./infrastructure/reporter.ts\";\n\nexport type { ReporterOptions } from \"./infrastructure/reporter.ts\";\n\nexport type { VariableQuestion } from \"./application/interactive-brief.ts\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,aAAa,EACb,QAAQ,EACR,aAAa,GACd,MAAM,0BAA0B,CAAC;AAoBlC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,IAAI,EACJ,QAAQ,GACT,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AASlE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAI/D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAoCnE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAMxD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAMhF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAWlE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC","sourcesContent":["export {\n  attach,\n  createSandbox,\n  dispatch,\n  openWorkspace,\n} from \"./application/outpost.ts\";\n\nexport type {\n  AttachOptions,\n  AttachResult,\n  ContinuationOptions,\n  DispatchResult,\n  Sandbox,\n  SandboxOptions,\n  WarmDispatchResult,\n  Workspace,\n  WorkspaceOptions,\n} from \"./application/outpost.ts\";\n\nexport type {\n  DispatchOptions,\n  Execution,\n  Turn,\n} from \"./application/execution.ts\";\n\nexport {\n  WorkflowFailure,\n  WorkflowBudgetExceeded,\n  task,\n  workflow,\n} from \"./domain/workflow.ts\";\n\nexport type {\n  Retry,\n  Task,\n  TaskContext,\n  TaskOptions,\n  TaskRecord,\n  TaskStatus,\n  Workflow,\n  WorkflowEvent,\n  WorkflowOptions,\n  WorkflowBudget,\n  WorkflowUsage,\n  WorkflowResult,\n} from \"./domain/workflow.ts\";\n\nexport { agentTask, commandTask, isolatedTask } from \"./application/tasks.ts\";\n\nexport { claude, codex } from \"./providers/agents.ts\";\n\nexport { agentVersions } from \"./providers/versions.ts\";\n\nexport { conversations } from \"./infrastructure/conversations.ts\";\n\nexport type {\n  ConversationFormat,\n  ConversationLocation,\n} from \"./infrastructure/conversations.ts\";\n\nexport type { ClaudeSettings, CodexSettings } from \"./providers/agents.ts\";\n\nexport { mountedProvider, remoteProvider } from \"./providers/factories.ts\";\n\nexport { ResponseError, response } from \"./domain/response.ts\";\n\nexport type { ResponseSpec, StandardValidator } from \"./domain/response.ts\";\n\nexport { OutpostError, recoveryDetails } from \"./domain/errors.ts\";\n\nexport type { FaultCode } from \"./domain/errors.ts\";\n\nexport type {\n  AgentAdapter,\n  AgentEvent,\n  AgentInput,\n  AgentObservation,\n  BranchPolicy,\n  Channel,\n  Command,\n  CommandResult,\n  Commit,\n  ConversationContext,\n  ConversationRecord,\n  ConversationStore,\n  Disposal,\n  LifecycleHooks,\n  FileManifestEntry,\n  FileTransfers,\n  SandboxContext,\n  SandboxLease,\n  SandboxProvider,\n  StageLimits,\n  TransferOptions,\n  Usage,\n  Variables,\n  Volume,\n  WorkspaceRecord,\n} from \"./domain/ports.ts\";\n\nexport type { Brief, PromptVariables } from \"./domain/prompts.ts\";\n\nexport type { Logging } from \"./infrastructure/journal.ts\";\n\nexport { reporter } from \"./infrastructure/reporter.ts\";\n\nexport type { ReporterOptions } from \"./infrastructure/reporter.ts\";\n\nexport type { VariableQuestion } from \"./application/interactive-brief.ts\";\n\nexport {\n  planRecoveryRetention,\n  pruneRecoveryRetention,\n  assertRecoveryQuota,\n} from \"./application/recovery-retention.ts\";\nexport type {\n  RecoveryRetentionPolicy,\n  RecoveryRetentionOptions,\n  RecoveryRetentionPlan,\n  RecoveryRetentionEntry,\n  RecoveryPruneResult,\n  RecoveryQuotaOptions,\n} from \"./application/recovery-retention.types.ts\";\nexport { verifyRecoveryTransfer } from \"./application/recovery-verification.ts\";\nexport type {\n  RecoveryVerification,\n  RecoveryVerificationOptions,\n} from \"./application/recovery-verification.types.ts\";\n\nexport { diagnoseSandbox } from \"./application/doctor-sandbox.ts\";\nexport type {\n  SandboxDiagnosticOptions,\n  SandboxDiagnosticReport,\n  DiagnosticCapability,\n} from \"./application/doctor-sandbox.types.ts\";\nexport type {\n  DiagnosticCheck,\n  DiagnosticStatus,\n  DoctorAgent,\n} from \"./application/doctor.types.ts\";\nexport { diagnoseAgentProtocol } from \"./application/doctor-protocol.ts\";\nexport type { AgentProtocolReport } from \"./application/doctor-protocol.types.ts\";\n"]}

package/dist/infrastructure/file-manifest.d.ts

@@ -0,0 +1,6 @@
+import type { FileManifestEntry } from "../domain/sandbox.types.ts";
+export declare function fileManifest(root: string, path: string): Promise<FileManifestEntry>;
+export declare function sameFile(left: FileManifestEntry, right: FileManifestEntry): boolean;
+export declare function sameLocalFile(remote: FileManifestEntry, local: FileManifestEntry): boolean;
+export declare function validateFilePaths(paths: readonly string[]): void;
+export declare function parseManifest(value: unknown, paths: readonly string[]): FileManifestEntry[];

package/dist/infrastructure/file-manifest.js

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { lstat, readlink } from "node:fs/promises";
+import { OutpostError } from "../domain/errors.js";
+import { safeDestination } from "./files.js";
+export async function fileManifest(root, path) {
+    const target = await safeDestination(root, path);
+    const info = await lstat(target);
+    if (!info.isFile() && !info.isSymbolicLink())
+        throw new OutpostError("provider", "Unsupported manifest file type", {
+            path,
+        });
+    const hash = createHash("sha256");
+    let size = info.size;
+    if (info.isSymbolicLink()) {
+        const value = Buffer.from(await readlink(target));
+        size = value.length;
+        hash.update(value);
+    }
+    else {
+        for await (const chunk of createReadStream(target))
+            hash.update(chunk);
+    }
+    return {
+        path,
+        kind: info.isSymbolicLink() ? "link" : "file",
+        mode: info.mode & 0o777,
+        size,
+        sha256: hash.digest("hex"),
+    };
+}
+export function sameFile(left, right) {
+    return (left.path === right.path &&
+        left.kind === right.kind &&
+        left.mode === right.mode &&
+        left.size === right.size &&
+        left.sha256 === right.sha256);
+}
+export function sameLocalFile(remote, local) {
+    if (process.platform !== "win32")
+        return sameFile(remote, local);
+    return sameFile({ ...remote, mode: remote.mode & 0o200 }, { ...local, mode: local.mode & 0o200 });
+}
+export function validateFilePaths(paths) {
+    if (new Set(paths).size !== paths.length ||
+        paths.some((path) => !path ||
+            path.includes("\\") ||
+            path.includes("\0") ||
+            path
+                .split("/")
+                .some((part) => !part ||
+                part === "." ||
+                part === ".." ||
+                part.toLowerCase() === ".git")))
+        throw new OutpostError("provider", "Unsafe or duplicate manifest path");
+}
+export function parseManifest(value, paths) {
+    validateFilePaths(paths);
+    if (!Array.isArray(value) || value.length !== paths.length)
+        throw new OutpostError("provider", "Invalid file manifest");
+    return value.map((entry, index) => {
+        if (!entry ||
+            typeof entry !== "object" ||
+            !("path" in entry) ||
+            typeof entry.path !== "string" ||
+            entry.path !== paths[index] ||
+            !("kind" in entry) ||
+            (entry.kind !== "file" && entry.kind !== "link") ||
+            !("mode" in entry) ||
+            typeof entry.mode !== "number" ||
+            !Number.isInteger(entry.mode) ||
+            entry.mode < 0 ||
+            entry.mode > 0o777 ||
+            !("size" in entry) ||
+            typeof entry.size !== "number" ||
+            !Number.isSafeInteger(entry.size) ||
+            entry.size < 0 ||
+            !("sha256" in entry) ||
+            typeof entry.sha256 !== "string" ||
+            !/^[a-f0-9]{64}$/.test(entry.sha256))
+            throw new OutpostError("provider", "Invalid file manifest entry");
+        return {
+            path: entry.path,
+            kind: entry.kind,
+            mode: entry.mode,
+            size: entry.size,
+            sha256: entry.sha256,
+        };
+    });
+}
+//# sourceMappingURL=file-manifest.js.map

package/dist/infrastructure/file-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-manifest.js","sourceRoot":"","sources":["../../src/infrastructure/file-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;QAC1C,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,gCAAgC,EAAE;YACnE,IAAI;SACL,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC7C,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK;QACvB,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAyB,EACzB,KAAwB;IAExB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,OAAO,QAAQ,CACb,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,EACxC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,IACE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI;YACL,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;iBACD,KAAK,CAAC,GAAG,CAAC;iBACV,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI;gBACL,IAAI,KAAK,GAAG;gBACZ,IAAI,KAAK,IAAI;gBACb,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAChC,CACN;QAED,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,mCAAmC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,KAAwB;IAExB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACxD,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,KAAK,EAAE,EAAE;QACzC,IACE,CAAC,KAAK;YACN,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;YAClB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC;YAC3B,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;YAClB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7B,KAAK,CAAC,IAAI,GAAG,CAAC;YACd,KAAK,CAAC,IAAI,GAAG,KAAK;YAClB,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;YAClB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YACjC,KAAK,CAAC,IAAI,GAAG,CAAC;YACd,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAChC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAEpC,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;QACpE,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport { lstat, readlink } from \"node:fs/promises\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { FileManifestEntry } from \"../domain/sandbox.types.ts\";\nimport { safeDestination } from \"./files.ts\";\n\nexport async function fileManifest(\n  root: string,\n  path: string,\n): Promise<FileManifestEntry> {\n  const target = await safeDestination(root, path);\n  const info = await lstat(target);\n  if (!info.isFile() && !info.isSymbolicLink())\n    throw new OutpostError(\"provider\", \"Unsupported manifest file type\", {\n      path,\n    });\n  const hash = createHash(\"sha256\");\n  let size = info.size;\n  if (info.isSymbolicLink()) {\n    const value = Buffer.from(await readlink(target));\n    size = value.length;\n    hash.update(value);\n  } else {\n    for await (const chunk of createReadStream(target)) hash.update(chunk);\n  }\n  return {\n    path,\n    kind: info.isSymbolicLink() ? \"link\" : \"file\",\n    mode: info.mode & 0o777,\n    size,\n    sha256: hash.digest(\"hex\"),\n  };\n}\n\nexport function sameFile(\n  left: FileManifestEntry,\n  right: FileManifestEntry,\n): boolean {\n  return (\n    left.path === right.path &&\n    left.kind === right.kind &&\n    left.mode === right.mode &&\n    left.size === right.size &&\n    left.sha256 === right.sha256\n  );\n}\n\nexport function sameLocalFile(\n  remote: FileManifestEntry,\n  local: FileManifestEntry,\n): boolean {\n  if (process.platform !== \"win32\") return sameFile(remote, local);\n  return sameFile(\n    { ...remote, mode: remote.mode & 0o200 },\n    { ...local, mode: local.mode & 0o200 },\n  );\n}\n\nexport function validateFilePaths(paths: readonly string[]): void {\n  if (\n    new Set(paths).size !== paths.length ||\n    paths.some(\n      (path) =>\n        !path ||\n        path.includes(\"\\\\\") ||\n        path.includes(\"\\0\") ||\n        path\n          .split(\"/\")\n          .some(\n            (part) =>\n              !part ||\n              part === \".\" ||\n              part === \"..\" ||\n              part.toLowerCase() === \".git\",\n          ),\n    )\n  )\n    throw new OutpostError(\"provider\", \"Unsafe or duplicate manifest path\");\n}\n\nexport function parseManifest(\n  value: unknown,\n  paths: readonly string[],\n): FileManifestEntry[] {\n  validateFilePaths(paths);\n  if (!Array.isArray(value) || value.length !== paths.length)\n    throw new OutpostError(\"provider\", \"Invalid file manifest\");\n  return value.map((entry: unknown, index) => {\n    if (\n      !entry ||\n      typeof entry !== \"object\" ||\n      !(\"path\" in entry) ||\n      typeof entry.path !== \"string\" ||\n      entry.path !== paths[index] ||\n      !(\"kind\" in entry) ||\n      (entry.kind !== \"file\" && entry.kind !== \"link\") ||\n      !(\"mode\" in entry) ||\n      typeof entry.mode !== \"number\" ||\n      !Number.isInteger(entry.mode) ||\n      entry.mode < 0 ||\n      entry.mode > 0o777 ||\n      !(\"size\" in entry) ||\n      typeof entry.size !== \"number\" ||\n      !Number.isSafeInteger(entry.size) ||\n      entry.size < 0 ||\n      !(\"sha256\" in entry) ||\n      typeof entry.sha256 !== \"string\" ||\n      !/^[a-f0-9]{64}$/.test(entry.sha256)\n    )\n      throw new OutpostError(\"provider\", \"Invalid file manifest entry\");\n    return {\n      path: entry.path,\n      kind: entry.kind,\n      mode: entry.mode,\n      size: entry.size,\n      sha256: entry.sha256,\n    };\n  });\n}\n"]}

package/dist/infrastructure/git/lock-inspection.constants.d.ts

@@ -0,0 +1,4 @@
+export declare const lockInspectionDefaults: {
+    readonly maxBytes: 4096;
+    readonly maxPid: 2147483647;
+};

package/dist/infrastructure/git/lock-inspection.constants.js

@@ -0,0 +1,5 @@
+export const lockInspectionDefaults = {
+    maxBytes: 4096,
+    maxPid: 2_147_483_647,
+};
+//# sourceMappingURL=lock-inspection.constants.js.map

package/dist/infrastructure/git/lock-inspection.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-inspection.constants.js","sourceRoot":"","sources":["../../../src/infrastructure/git/lock-inspection.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,aAAa;CACb,CAAC","sourcesContent":["export const lockInspectionDefaults = {\n  maxBytes: 4096,\n  maxPid: 2_147_483_647,\n} as const;\n"]}

package/dist/infrastructure/git/lock-inspection.d.ts

@@ -0,0 +1,3 @@
+import type { StorageEntry } from "../storage-inventory.types.ts";
+import type { LockInspection, LockPidProbe } from "./lock-inspection.types.ts";
+export declare function inspectLocks(entries: readonly StorageEntry[], probe?: LockPidProbe): Promise<LockInspection>;

package/dist/infrastructure/git/lock-inspection.js

@@ -0,0 +1,64 @@
+import { observeOwnership } from "./process-identity.js";
+import { readInspectionFile } from "../inspection-file.js";
+import { lockInspectionDefaults } from "./lock-inspection.constants.js";
+async function readPid(path) {
+    const record = JSON.parse((await readInspectionFile(path, lockInspectionDefaults.maxBytes)).toString("utf8"));
+    if (!record || typeof record !== "object" || !("pid" in record))
+        return undefined;
+    const pid = record.pid;
+    if (typeof pid !== "number" ||
+        !Number.isInteger(pid) ||
+        pid <= 0 ||
+        pid > lockInspectionDefaults.maxPid)
+        return undefined;
+    return {
+        pid,
+        ...("identity" in record ? { identity: record.identity } : {}),
+    };
+}
+async function inspectEntry(entry, probe) {
+    if (entry.kind !== "file")
+        return { state: "skipped", reason: "NOT_FILE" };
+    let record;
+    try {
+        record = await readPid(entry.path);
+    }
+    catch {
+        return { state: "unknown", reason: "LOCK_READ_FAILED" };
+    }
+    if (record === undefined)
+        return { state: "unknown", reason: "INVALID_PID" };
+    const { pid, identity } = record;
+    const ownership = await observeOwnership(pid, identity);
+    try {
+        probe(pid);
+        return { state: "present", pid, ownership };
+    }
+    catch (error) {
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ESRCH")
+            return { state: "absent", pid, ownership };
+        return { state: "unknown", pid, reason: "PID_PROBE_FAILED", ownership };
+    }
+}
+export async function inspectLocks(entries, probe = (pid) => {
+    process.kill(pid, 0);
+}) {
+    const locks = [];
+    const issues = [];
+    for (const entry of entries) {
+        const state = await inspectEntry(entry, probe);
+        locks.push({ name: entry.name, path: entry.path, ...state });
+        if (state.state === "unknown")
+            issues.push({ path: entry.path, code: state.reason });
+    }
+    return {
+        scope: "local-pid",
+        complete: issues.length === 0,
+        entries: locks,
+        issues,
+    };
+}
+//# sourceMappingURL=lock-inspection.js.map

package/dist/infrastructure/git/lock-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-inspection.js","sourceRoot":"","sources":["../../../src/infrastructure/git/lock-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AASxE,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAChC,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CACxE,MAAM,CACP,CACF,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACtB,GAAG,IAAI,CAAC;QACR,GAAG,GAAG,sBAAsB,CAAC,MAAM;QAEnC,OAAO,SAAS,CAAC;IACnB,OAAO;QACL,GAAG;QACH,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAmB,EACnB,KAAmB;IAEnB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3E,IAAI,MAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7E,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,OAAO;YAEtB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgC,EAChC,QAAsB,CAAC,GAAG,EAAE,EAAE;IAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;IAED,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC7B,OAAO,EAAE,KAAK;QACd,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import { observeOwnership } from \"./process-identity.ts\";\nimport { readInspectionFile } from \"../inspection-file.ts\";\nimport type { StorageEntry, StorageIssue } from \"../storage-inventory.types.ts\";\nimport { lockInspectionDefaults } from \"./lock-inspection.constants.ts\";\nimport type {\n  LockIdentityRecord,\n  LockInspection,\n  LockInspectionEntry,\n  LockInspectionState,\n  LockPidProbe,\n} from \"./lock-inspection.types.ts\";\n\nasync function readPid(path: string): Promise<LockIdentityRecord | undefined> {\n  const record: unknown = JSON.parse(\n    (await readInspectionFile(path, lockInspectionDefaults.maxBytes)).toString(\n      \"utf8\",\n    ),\n  );\n  if (!record || typeof record !== \"object\" || !(\"pid\" in record))\n    return undefined;\n  const pid = record.pid;\n  if (\n    typeof pid !== \"number\" ||\n    !Number.isInteger(pid) ||\n    pid <= 0 ||\n    pid > lockInspectionDefaults.maxPid\n  )\n    return undefined;\n  return {\n    pid,\n    ...(\"identity\" in record ? { identity: record.identity } : {}),\n  };\n}\n\nasync function inspectEntry(\n  entry: StorageEntry,\n  probe: LockPidProbe,\n): Promise<LockInspectionState> {\n  if (entry.kind !== \"file\") return { state: \"skipped\", reason: \"NOT_FILE\" };\n  let record: LockIdentityRecord | undefined;\n  try {\n    record = await readPid(entry.path);\n  } catch {\n    return { state: \"unknown\", reason: \"LOCK_READ_FAILED\" };\n  }\n  if (record === undefined) return { state: \"unknown\", reason: \"INVALID_PID\" };\n  const { pid, identity } = record;\n  const ownership = await observeOwnership(pid, identity);\n  try {\n    probe(pid);\n    return { state: \"present\", pid, ownership };\n  } catch (error) {\n    if (\n      error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ESRCH\"\n    )\n      return { state: \"absent\", pid, ownership };\n    return { state: \"unknown\", pid, reason: \"PID_PROBE_FAILED\", ownership };\n  }\n}\n\nexport async function inspectLocks(\n  entries: readonly StorageEntry[],\n  probe: LockPidProbe = (pid) => {\n    process.kill(pid, 0);\n  },\n): Promise<LockInspection> {\n  const locks: LockInspectionEntry[] = [];\n  const issues: StorageIssue[] = [];\n  for (const entry of entries) {\n    const state = await inspectEntry(entry, probe);\n    locks.push({ name: entry.name, path: entry.path, ...state });\n    if (state.state === \"unknown\")\n      issues.push({ path: entry.path, code: state.reason });\n  }\n  return {\n    scope: \"local-pid\",\n    complete: issues.length === 0,\n    entries: locks,\n    issues,\n  };\n}\n"]}

package/dist/infrastructure/git/lock-inspection.types.d.ts

@@ -0,0 +1,27 @@
+import type { LockOwnership } from "./process-identity.types.ts";
+import type { StorageEntry, StorageIssue } from "../storage-inventory.types.ts";
+export type LockPidProbe = (pid: number) => void;
+export interface LockIdentityRecord {
+    readonly pid: number;
+    readonly identity?: unknown;
+}
+export type LockInspectionState = {
+    readonly ownership?: LockOwnership;
+} & ({
+    readonly state: "present" | "absent";
+    readonly pid: number;
+} | {
+    readonly state: "unknown";
+    readonly reason: string;
+    readonly pid?: number;
+} | {
+    readonly state: "skipped";
+    readonly reason: "NOT_FILE";
+});
+export type LockInspectionEntry = Pick<StorageEntry, "name" | "path"> & LockInspectionState;
+export interface LockInspection {
+    readonly complete: boolean;
+    readonly scope: "local-pid";
+    readonly entries: readonly LockInspectionEntry[];
+    readonly issues: readonly StorageIssue[];
+}

package/dist/infrastructure/git/lock-inspection.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lock-inspection.types.js.map

package/dist/infrastructure/git/lock-inspection.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-inspection.types.js","sourceRoot":"","sources":["../../../src/infrastructure/git/lock-inspection.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { LockOwnership } from \"./process-identity.types.ts\";\nimport type { StorageEntry, StorageIssue } from \"../storage-inventory.types.ts\";\n\nexport type LockPidProbe = (pid: number) => void;\n\nexport interface LockIdentityRecord {\n  readonly pid: number;\n  readonly identity?: unknown;\n}\n\nexport type LockInspectionState = { readonly ownership?: LockOwnership } & (\n  | { readonly state: \"present\" | \"absent\"; readonly pid: number }\n  | {\n      readonly state: \"unknown\";\n      readonly reason: string;\n      readonly pid?: number;\n    }\n  | { readonly state: \"skipped\"; readonly reason: \"NOT_FILE\" }\n);\n\nexport type LockInspectionEntry = Pick<StorageEntry, \"name\" | \"path\"> &\n  LockInspectionState;\n\nexport interface LockInspection {\n  readonly complete: boolean;\n  readonly scope: \"local-pid\";\n  readonly entries: readonly LockInspectionEntry[];\n  readonly issues: readonly StorageIssue[];\n}\n"]}

package/dist/infrastructure/git/lock.d.ts

@@ -1 +1,2 @@
+export declare function lockPath(root: string, key: string): string;
 export declare function lock(root: string, key: string): Promise<() => Promise<void>>;

package/dist/infrastructure/git/lock.js

@@ -1,36 +1,77 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rm } from "node:fs/promises";
+import { mkdir, open, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { OutpostError } from "../../domain/errors.js";
-export async function lock(root, key) {
-    const folder = join(root, ".outpost", "locks");
-    await mkdir(folder, { recursive: true });
-    const path = join(folder, `${createHash("sha256").update(key).digest("hex").slice(0, 20)}.json`);
-    for (let attempt = 0; attempt < 2; attempt++) {
-        try {
-            const file = await open(path, "wx", 0o600);
-            await file.writeFile(JSON.stringify({ pid: process.pid, nonce: randomUUID() }));
-            await file.close();
-            return () => rm(path, { force: true });
-        }
-        catch (cause) {
-            if (cause.code !== "EEXIST")
-                throw cause;
-            const owner = JSON.parse(await readFile(path, "utf8"));
-            let alive = true;
-            try {
-                if (!owner.pid)
-                    throw new Error();
-                process.kill(owner.pid, 0);
-            }
-            catch (error) {
-                alive = error.code === "EPERM";
-            }
-            if (alive)
-                throw new OutpostError("conflict", `Workspace is already in use: ${key}`, { lock: path, pid: owner.pid });
+import { localProcessIdentity, observeOwnership } from "./process-identity.js";
+import { readInspectionFile } from "../inspection-file.js";
+import { lockInspectionDefaults } from "./lock-inspection.constants.js";
+export function lockPath(root, key) {
+    return join(root, ".outpost", "locks", `${createHash("sha256").update(key).digest("hex").slice(0, 20)}.json`);
+}
+async function readOwner(path) {
+    return JSON.parse((await readInspectionFile(path, lockInspectionDefaults.maxBytes)).toString("utf8"));
+}
+async function createLock(path) {
+    const file = await open(path, "wx", 0o600);
+    const nonce = randomUUID();
+    try {
+        await file.writeFile(JSON.stringify({
+            pid: process.pid,
+            nonce,
+            identity: await localProcessIdentity(),
+        }));
+    }
+    finally {
+        await file.close();
+    }
+    return async () => {
+        const current = await readOwner(path).catch(() => null);
+        if (current &&
+            typeof current === "object" &&
+            "nonce" in current &&
+            current.nonce === nonce)
             await rm(path, { force: true });
-        }
+    };
+}
+export async function lock(root, key) {
+    await mkdir(join(root, ".outpost", "locks"), { recursive: true });
+    const path = lockPath(root, key);
+    try {
+        return await createLock(path);
+    }
+    catch (cause) {
+        if (!(cause &&
+            typeof cause === "object" &&
+            "code" in cause &&
+            cause.code === "EEXIST"))
+            throw cause;
+    }
+    const conflict = () => new OutpostError("conflict", `Workspace is already in use or ownership is unknown: ${key}`, { lock: path });
+    // Serialize stale reclamation so another contender cannot unlink a new owner.
+    const releaseGuard = await createLock(`${path}.reclaim`).catch(() => {
+        throw conflict();
+    });
+    try {
+        const owner = await readOwner(path).catch(() => null);
+        const pid = owner && typeof owner === "object" && "pid" in owner
+            ? owner.pid
+            : undefined;
+        const identity = owner && typeof owner === "object" && "identity" in owner
+            ? owner.identity
+            : undefined;
+        const ownership = typeof pid === "number" &&
+            Number.isSafeInteger(pid) &&
+            pid > 0 &&
+            pid <= lockInspectionDefaults.maxPid
+            ? await observeOwnership(pid, identity)
+            : undefined;
+        if (ownership?.status !== "inactive")
+            throw conflict();
+        await rm(path, { force: true });
+        return await createLock(path);
+    }
+    finally {
+        await releaseGuard();
     }
-    throw new OutpostError("conflict", "Unable to acquire workspace lock");
 }
 //# sourceMappingURL=lock.js.map

package/dist/infrastructure/git/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/infrastructure/git/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAY,EACZ,GAAW;IAEX,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,EACN,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CACtE,CAAC;IACF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,SAAS,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAC1D,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAC;YACpE,IAAI,KAAK,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,GAAI,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;YAC5D,CAAC;YACD,IAAI,KAAK;gBACP,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,gCAAgC,GAAG,EAAE,EACrC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC/B,CAAC;YACJ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,kCAAkC,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { OutpostError } from \"../../domain/errors.ts\";\nimport type { LockOwner } from \"./lock.types.ts\";\n\nexport async function lock(\n  root: string,\n  key: string,\n): Promise<() => Promise<void>> {\n  const folder = join(root, \".outpost\", \"locks\");\n  await mkdir(folder, { recursive: true });\n  const path = join(\n    folder,\n    `${createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 20)}.json`,\n  );\n  for (let attempt = 0; attempt < 2; attempt++) {\n    try {\n      const file = await open(path, \"wx\", 0o600);\n      await file.writeFile(\n        JSON.stringify({ pid: process.pid, nonce: randomUUID() }),\n      );\n      await file.close();\n      return () => rm(path, { force: true });\n    } catch (cause) {\n      if ((cause as NodeJS.ErrnoException).code !== \"EEXIST\") throw cause;\n      const owner = JSON.parse(await readFile(path, \"utf8\")) as LockOwner;\n      let alive = true;\n      try {\n        if (!owner.pid) throw new Error();\n        process.kill(owner.pid, 0);\n      } catch (error) {\n        alive = (error as NodeJS.ErrnoException).code === \"EPERM\";\n      }\n      if (alive)\n        throw new OutpostError(\n          \"conflict\",\n          `Workspace is already in use: ${key}`,\n          { lock: path, pid: owner.pid },\n        );\n      await rm(path, { force: true });\n    }\n  }\n  throw new OutpostError(\"conflict\", \"Unable to acquire workspace lock\");\n}\n"]}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/infrastructure/git/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IAChD,OAAO,IAAI,CACT,IAAI,EACJ,UAAU,EACV,OAAO,EACP,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CACtE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,KAAK,CACf,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CACxE,MAAM,CACP,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK;YACL,QAAQ,EAAE,MAAM,oBAAoB,EAAE;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,IACE,OAAO;YACP,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,IAAI,OAAO;YAClB,OAAO,CAAC,KAAK,KAAK,KAAK;YAEvB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAY,EACZ,GAAW;IAEX,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CACH,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB;YACC,MAAM,KAAK,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI,YAAY,CACd,UAAU,EACV,wDAAwD,GAAG,EAAE,EAC7D,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;IACJ,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAClE,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GACP,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK;YAClD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GACZ,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK;YACvD,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,SAAS,GACb,OAAO,GAAG,KAAK,QAAQ;YACvB,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;YACzB,GAAG,GAAG,CAAC;YACP,GAAG,IAAI,sBAAsB,CAAC,MAAM;YAClC,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,SAAS,EAAE,MAAM,KAAK,UAAU;YAAE,MAAM,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { mkdir, open, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { OutpostError } from \"../../domain/errors.ts\";\nimport { localProcessIdentity, observeOwnership } from \"./process-identity.ts\";\nimport { readInspectionFile } from \"../inspection-file.ts\";\nimport { lockInspectionDefaults } from \"./lock-inspection.constants.ts\";\n\nexport function lockPath(root: string, key: string): string {\n  return join(\n    root,\n    \".outpost\",\n    \"locks\",\n    `${createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 20)}.json`,\n  );\n}\n\nasync function readOwner(path: string): Promise<unknown> {\n  return JSON.parse(\n    (await readInspectionFile(path, lockInspectionDefaults.maxBytes)).toString(\n      \"utf8\",\n    ),\n  );\n}\n\nasync function createLock(path: string): Promise<() => Promise<void>> {\n  const file = await open(path, \"wx\", 0o600);\n  const nonce = randomUUID();\n  try {\n    await file.writeFile(\n      JSON.stringify({\n        pid: process.pid,\n        nonce,\n        identity: await localProcessIdentity(),\n      }),\n    );\n  } finally {\n    await file.close();\n  }\n  return async () => {\n    const current = await readOwner(path).catch(() => null);\n    if (\n      current &&\n      typeof current === \"object\" &&\n      \"nonce\" in current &&\n      current.nonce === nonce\n    )\n      await rm(path, { force: true });\n  };\n}\n\nexport async function lock(\n  root: string,\n  key: string,\n): Promise<() => Promise<void>> {\n  await mkdir(join(root, \".outpost\", \"locks\"), { recursive: true });\n  const path = lockPath(root, key);\n  try {\n    return await createLock(path);\n  } catch (cause) {\n    if (!(\n      cause &&\n      typeof cause === \"object\" &&\n      \"code\" in cause &&\n      cause.code === \"EEXIST\"\n    ))\n      throw cause;\n  }\n  const conflict = () =>\n    new OutpostError(\n      \"conflict\",\n      `Workspace is already in use or ownership is unknown: ${key}`,\n      { lock: path },\n    );\n  // Serialize stale reclamation so another contender cannot unlink a new owner.\n  const releaseGuard = await createLock(`${path}.reclaim`).catch(() => {\n    throw conflict();\n  });\n  try {\n    const owner = await readOwner(path).catch(() => null);\n    const pid =\n      owner && typeof owner === \"object\" && \"pid\" in owner\n        ? owner.pid\n        : undefined;\n    const identity =\n      owner && typeof owner === \"object\" && \"identity\" in owner\n        ? owner.identity\n        : undefined;\n    const ownership =\n      typeof pid === \"number\" &&\n      Number.isSafeInteger(pid) &&\n      pid > 0 &&\n      pid <= lockInspectionDefaults.maxPid\n        ? await observeOwnership(pid, identity)\n        : undefined;\n    if (ownership?.status !== \"inactive\") throw conflict();\n    await rm(path, { force: true });\n    return await createLock(path);\n  } finally {\n    await releaseGuard();\n  }\n}\n"]}

package/dist/infrastructure/git/process-identity.d.ts

@@ -0,0 +1,3 @@
+import type { LocalProcessIdentity, LockOwnership } from "./process-identity.types.ts";
+export declare function localProcessIdentity(pid?: number): Promise<LocalProcessIdentity | undefined>;
+export declare function observeOwnership(pid: number, identity: unknown): Promise<LockOwnership>;

package/dist/infrastructure/git/process-identity.js

@@ -0,0 +1,73 @@
+import { createHash } from "node:crypto";
+import { readFile, readlink } from "node:fs/promises";
+export async function localProcessIdentity(pid = process.pid) {
+    if (process.platform !== "linux")
+        return undefined;
+    try {
+        const [machine, boot, namespace, stat] = await Promise.all([
+            readFile("/etc/machine-id", "utf8"),
+            readFile("/proc/sys/kernel/random/boot_id", "utf8"),
+            readlink(`/proc/${pid}/ns/pid`),
+            readFile(`/proc/${pid}/stat`, "utf8"),
+        ]);
+        const started = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+        if (!machine.trim() || !boot.trim() || !started || !/^\d+$/.test(started))
+            return undefined;
+        return {
+            host: createHash("sha256").update(machine.trim()).digest("hex"),
+            boot: boot.trim(),
+            namespace,
+            started,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function validIdentity(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    return ("host" in value &&
+        typeof value.host === "string" &&
+        value.host.length > 0 &&
+        "boot" in value &&
+        typeof value.boot === "string" &&
+        value.boot.length > 0 &&
+        "namespace" in value &&
+        typeof value.namespace === "string" &&
+        value.namespace.length > 0 &&
+        "started" in value &&
+        typeof value.started === "string" &&
+        /^\d+$/.test(value.started));
+}
+export async function observeOwnership(pid, identity) {
+    if (!validIdentity(identity))
+        return { status: "unknown", reason: "LEGACY_OR_INVALID_IDENTITY" };
+    const local = await localProcessIdentity();
+    if (!local)
+        return { status: "unknown", reason: "LOCAL_IDENTITY_UNAVAILABLE" };
+    if (identity.host !== local.host)
+        return { status: "unknown", reason: "OTHER_HOST" };
+    if (identity.boot !== local.boot)
+        return { status: "unknown", reason: "OTHER_BOOT" };
+    if (identity.namespace !== local.namespace)
+        return { status: "unknown", reason: "OTHER_PID_NAMESPACE" };
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ESRCH")
+            return { status: "inactive", reason: "PROCESS_EXITED" };
+        return { status: "unknown", reason: "PROCESS_INACCESSIBLE" };
+    }
+    const current = await localProcessIdentity(pid);
+    if (!current)
+        return { status: "unknown", reason: "PROCESS_IDENTITY_UNAVAILABLE" };
+    if (current.started !== identity.started)
+        return { status: "unknown", reason: "PID_REUSED" };
+    return { status: "active", reason: "LOCAL_IDENTITY_MATCH" };
+}
+//# sourceMappingURL=process-identity.js.map

package/dist/infrastructure/git/process-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.js","sourceRoot":"","sources":["../../../src/infrastructure/git/process-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAMtD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;YACnC,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC;YACnD,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;YAC/B,QAAQ,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YACvE,OAAO,SAAS,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CACL,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACrB,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACrB,WAAW,IAAI,KAAK;QACpB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC1B,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,QAAiB;IAEjB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrD,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,OAAO;YAEtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACvE,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;AAC9D,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFile, readlink } from \"node:fs/promises\";\nimport type {\n  LocalProcessIdentity,\n  LockOwnership,\n} from \"./process-identity.types.ts\";\n\nexport async function localProcessIdentity(\n  pid = process.pid,\n): Promise<LocalProcessIdentity | undefined> {\n  if (process.platform !== \"linux\") return undefined;\n  try {\n    const [machine, boot, namespace, stat] = await Promise.all([\n      readFile(\"/etc/machine-id\", \"utf8\"),\n      readFile(\"/proc/sys/kernel/random/boot_id\", \"utf8\"),\n      readlink(`/proc/${pid}/ns/pid`),\n      readFile(`/proc/${pid}/stat`, \"utf8\"),\n    ]);\n    const started = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \")[19];\n    if (!machine.trim() || !boot.trim() || !started || !/^\\d+$/.test(started))\n      return undefined;\n    return {\n      host: createHash(\"sha256\").update(machine.trim()).digest(\"hex\"),\n      boot: boot.trim(),\n      namespace,\n      started,\n    };\n  } catch {\n    return undefined;\n  }\n}\n\nfunction validIdentity(value: unknown): value is LocalProcessIdentity {\n  if (!value || typeof value !== \"object\") return false;\n  return (\n    \"host\" in value &&\n    typeof value.host === \"string\" &&\n    value.host.length > 0 &&\n    \"boot\" in value &&\n    typeof value.boot === \"string\" &&\n    value.boot.length > 0 &&\n    \"namespace\" in value &&\n    typeof value.namespace === \"string\" &&\n    value.namespace.length > 0 &&\n    \"started\" in value &&\n    typeof value.started === \"string\" &&\n    /^\\d+$/.test(value.started)\n  );\n}\n\nexport async function observeOwnership(\n  pid: number,\n  identity: unknown,\n): Promise<LockOwnership> {\n  if (!validIdentity(identity))\n    return { status: \"unknown\", reason: \"LEGACY_OR_INVALID_IDENTITY\" };\n  const local = await localProcessIdentity();\n  if (!local)\n    return { status: \"unknown\", reason: \"LOCAL_IDENTITY_UNAVAILABLE\" };\n  if (identity.host !== local.host)\n    return { status: \"unknown\", reason: \"OTHER_HOST\" };\n  if (identity.boot !== local.boot)\n    return { status: \"unknown\", reason: \"OTHER_BOOT\" };\n  if (identity.namespace !== local.namespace)\n    return { status: \"unknown\", reason: \"OTHER_PID_NAMESPACE\" };\n  try {\n    process.kill(pid, 0);\n  } catch (error) {\n    if (\n      error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ESRCH\"\n    )\n      return { status: \"inactive\", reason: \"PROCESS_EXITED\" };\n    return { status: \"unknown\", reason: \"PROCESS_INACCESSIBLE\" };\n  }\n  const current = await localProcessIdentity(pid);\n  if (!current)\n    return { status: \"unknown\", reason: \"PROCESS_IDENTITY_UNAVAILABLE\" };\n  if (current.started !== identity.started)\n    return { status: \"unknown\", reason: \"PID_REUSED\" };\n  return { status: \"active\", reason: \"LOCAL_IDENTITY_MATCH\" };\n}\n"]}

package/dist/infrastructure/git/process-identity.types.d.ts

@@ -0,0 +1,10 @@
+export interface LocalProcessIdentity {
+    readonly host: string;
+    readonly boot: string;
+    readonly namespace: string;
+    readonly started: string;
+}
+export interface LockOwnership {
+    readonly status: "active" | "inactive" | "unknown";
+    readonly reason: string;
+}

package/dist/infrastructure/git/process-identity.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=process-identity.types.js.map

package/dist/infrastructure/git/process-identity.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.types.js","sourceRoot":"","sources":["../../../src/infrastructure/git/process-identity.types.ts"],"names":[],"mappings":"","sourcesContent":["export interface LocalProcessIdentity {\n  readonly host: string;\n  readonly boot: string;\n  readonly namespace: string;\n  readonly started: string;\n}\nexport interface LockOwnership {\n  readonly status: \"active\" | \"inactive\" | \"unknown\";\n  readonly reason: string;\n}\n"]}

package/dist/infrastructure/git/verification-command.d.ts

@@ -0,0 +1 @@
+export declare function verificationGit(directory: string, args: readonly string[]): Promise<string>;

package/dist/infrastructure/git/verification-command.js

@@ -0,0 +1,36 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { gitDefaults } from "./git.constants.js";
+export async function verificationGit(directory, args) {
+    const environment = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith("GIT_")));
+    const result = await promisify(execFile)("git", [
+        "-c",
+        `core.hooksPath=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
+        "-c",
+        "core.fsmonitor=false",
+        "-c",
+        "maintenance.auto=false",
+        "-c",
+        "gc.auto=0",
+        ...args,
+    ], {
+        cwd: directory,
+        env: {
+            ...environment,
+            GIT_CONFIG_NOSYSTEM: "1",
+            GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
+            GIT_ATTR_NOSYSTEM: "1",
+            GIT_NO_LAZY_FETCH: "1",
+            GIT_ALLOW_PROTOCOL: "file",
+            GIT_TERMINAL_PROMPT: "0",
+            GIT_OPTIONAL_LOCKS: "0",
+            LC_ALL: "C",
+        },
+        timeout: gitDefaults.deadlineMs,
+        maxBuffer: gitDefaults.retainBytes,
+        encoding: "utf8",
+        windowsHide: true,
+    });
+    return result.stdout;
+}
+//# sourceMappingURL=verification-command.js.map

package/dist/infrastructure/git/verification-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-command.js","sourceRoot":"","sources":["../../../src/infrastructure/git/verification-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,IAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CACpC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAChC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACjD,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CACtC,KAAK,EACL;QACE,IAAI;QACJ,kBAAkB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE;QACtE,IAAI;QACJ,sBAAsB;QACtB,IAAI;QACJ,wBAAwB;QACxB,IAAI;QACJ,WAAW;QACX,GAAG,IAAI;KACR,EACD;QACE,GAAG,EAAE,SAAS;QACd,GAAG,EAAE;YACH,GAAG,WAAW;YACd,mBAAmB,EAAE,GAAG;YACxB,iBAAiB,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;YACrE,iBAAiB,EAAE,GAAG;YACtB,iBAAiB,EAAE,GAAG;YACtB,kBAAkB,EAAE,MAAM;YAC1B,mBAAmB,EAAE,GAAG;YACxB,kBAAkB,EAAE,GAAG;YACvB,MAAM,EAAE,GAAG;SACZ;QACD,OAAO,EAAE,WAAW,CAAC,UAAU;QAC/B,SAAS,EAAE,WAAW,CAAC,WAAW;QAClC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,IAAI;KAClB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { gitDefaults } from \"./git.constants.ts\";\n\nexport async function verificationGit(\n  directory: string,\n  args: readonly string[],\n): Promise<string> {\n  const environment = Object.fromEntries(\n    Object.entries(process.env).filter(\n      ([key]) => !key.toUpperCase().startsWith(\"GIT_\"),\n    ),\n  );\n  const result = await promisify(execFile)(\n    \"git\",\n    [\n      \"-c\",\n      `core.hooksPath=${process.platform === \"win32\" ? \"NUL\" : \"/dev/null\"}`,\n      \"-c\",\n      \"core.fsmonitor=false\",\n      \"-c\",\n      \"maintenance.auto=false\",\n      \"-c\",\n      \"gc.auto=0\",\n      ...args,\n    ],\n    {\n      cwd: directory,\n      env: {\n        ...environment,\n        GIT_CONFIG_NOSYSTEM: \"1\",\n        GIT_CONFIG_GLOBAL: process.platform === \"win32\" ? \"NUL\" : \"/dev/null\",\n        GIT_ATTR_NOSYSTEM: \"1\",\n        GIT_NO_LAZY_FETCH: \"1\",\n        GIT_ALLOW_PROTOCOL: \"file\",\n        GIT_TERMINAL_PROMPT: \"0\",\n        GIT_OPTIONAL_LOCKS: \"0\",\n        LC_ALL: \"C\",\n      },\n      timeout: gitDefaults.deadlineMs,\n      maxBuffer: gitDefaults.retainBytes,\n      encoding: \"utf8\",\n      windowsHide: true,\n    },\n  );\n  return result.stdout;\n}\n"]}

package/dist/infrastructure/git/workspace-lease.js

@@ -45,6 +45,7 @@ export function workspaceLease(record, options, unlock) {
                         "status",
                         "--porcelain",
                         "--untracked-files=normal",
+                        "--ignored",
                     ]);
                     if (dirty.trim())
                         return { retainedDirectory: workdir };