@fitlab-ai/agent-infra 0.12.0 → 0.12.2

package/dist/lib/sandbox/removal.js

@@ -1,25 +1,22 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { createHash } from 'node:crypto';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel, sandboxTaskIdLabel, sandboxWorkspaceModeLabel, shareBranchDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
-import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedVm } from './engine.js';
-import { pruneSandboxDanglingImages } from './image-prune.js';
-import { assertManagedPath, removeManagedDir, removeWorktreeDir } from './managed-fs.js';
-import { run, runEngine, runOk, runOkEngine, runSafe, runSafeEngine } from './shell.js';
-import { parseSandboxWorkspaceIdentity, resolveSandboxCleanupTarget, resolveSandboxTarget, sameSandboxWorkspaceIdentity } from './workspace-identity.js';
+import { detectEngine } from './engine.js';
+import './image-prune.js';
+import { assertManagedPath, removeWorktreeDir } from './managed-fs.js';
+import { runEngine, runOk, runSafe, runSafeEngine } from './shell.js';
+import { resolveSandboxCleanupTarget, resolveSandboxTarget } from './workspace-identity.js';
 import { sandboxControlPaths, sandboxWorkspaceViewPaths } from './workspace-view.js';
-import { advanceSandboxRemovalJournalToPhase, advanceSandboxRemovalJournalPhase, claimSandboxRemovalJournal, clearSandboxRemovalJournalRecord, isDefaultSandboxRemovalJournal, listSandboxRemovalJournals, removeSandboxControlRoot, readSandboxControlManifest, sandboxRemovalPhaseIndex } from './control/lifecycle.js';
-import { inspectSandboxControlContainer } from './control/container-identity.js';
-import { commandForSandboxAuthority } from './engines/authority.js';
-import { acquireSandboxResourceLock } from './control/native-file-lock.js';
+import './control/lifecycle.js';
+import './control/container-identity.js';
 import { toolConfigDirCandidates, toolProjectDirCandidates } from './tools.js';
-import { getProcessStartTime } from '../server/process-state.js';
+import '../server/process-state.js';
 import { releaseStaleShortIdRegistry } from '../task/short-id.js';
 import { fetchSandboxRows } from './commands/list-running.js';
-import { createSandboxControlBindingEvidence } from './task-cleanup.js';
-import { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectRecoveredWorktree, inspectWorktrees, verifyWorktreePermit } from './worktree-safety.js';
+import './task-cleanup.js';
+import { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectRecoveredWorktree, inspectWorktrees } from './worktree-safety.js';
 function projectToolDirs(config, tools) {
     return tools.flatMap((tool) => toolProjectDirCandidates(tool, config.project));
 }
@@ -27,104 +24,39 @@ function isMissingPathError(error) {
     return Boolean(error && typeof error === 'object' && 'code' in error
         && error.code === 'ENOENT');
 }
-function canonicalPath(input) {
-    try {
-        return fs.realpathSync.native(input);
-    }
-    catch {
-        return path.resolve(input);
-    }
-}
-function isMissingTaskRecordError(error) {
-    return error instanceof Error && /^Task not found: TASK-\d{8}-\d{6}$/.test(error.message);
-}
-function digestCleanupValue(value) {
-    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
-}
-function removalTargetDigest(config, target) {
-    return digestCleanupValue({
-        project: config.project,
-        branch: target.effectiveBranch,
-        workspace: target.workspace,
-        controlRoots: target.controlRoots.map((candidate) => path.resolve(candidate)),
-        workspaceViewRoots: target.workspaceViewRoots.map((candidate) => path.resolve(candidate)),
-        managedPathCandidates: (target.managedPathCandidates ?? []).map((candidate) => path.resolve(candidate)).sort()
-    });
-}
-function removalPermitDigest(permits) {
-    return digestCleanupValue([...permits.entries()]
-        .map(([worktree, permit]) => [path.resolve(worktree), permit.mode, permit.snapshot.identity])
-        .sort(([left], [right]) => String(left).localeCompare(String(right))));
-}
-function removalPermitCommits(permits) {
-    return [...permits.entries()]
-        .map(([worktree, permit]) => ({
-        path: path.resolve(worktree),
-        mode: permit.mode,
-        snapshot: permit.snapshot
-    }))
-        .sort((left, right) => left.path.localeCompare(right.path));
-}
-function removalTargetCommit(config, target, permits, removeWorktree, removeBranch, removeShare) {
-    return {
-        branch: target.effectiveBranch,
-        project: config.project,
-        controlRoot: path.resolve(target.controlRoots[0] ?? path.join(config.controlBase, config.project)),
-        targetDigest: removalTargetDigest(config, target),
-        permitDigest: removalPermitDigest(permits),
-        removeWorktree,
-        removeBranch,
-        removeShare,
-        worktreePaths: target.existingWorktrees.map((candidate) => path.resolve(candidate)).sort(),
-        workspaceViewPaths: target.workspaceViewRoots.map((candidate) => path.resolve(candidate)).sort(),
-        toolPaths: target.toolCandidates.flatMap(({ candidates }) => candidates.map((candidate) => path.resolve(candidate))).sort(),
-        shellPaths: shellConfigDirCandidates(config, target.effectiveBranch).map((candidate) => path.resolve(candidate)).sort(),
-        sharePath: path.resolve(shareBranchDir(config, target.effectiveBranch)),
-        permits: removalPermitCommits(permits)
-    };
-}
-function assertRemovalSelectionMatches(expected, actual) {
-    const normalize = (value) => ({
-        ...value,
-        controlRoot: '',
-        permits: value.permits
-    });
-    if (JSON.stringify(normalize(expected)) !== JSON.stringify(normalize(actual))) {
-        throw new Error('SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH');
+function removalErrorCode(error) {
+    return error && typeof error === 'object' && 'code' in error
+        && typeof error.code === 'string'
+        ? error.code
+        : null;
+}
+function removalErrorMessage(error) {
+    const code = removalErrorCode(error);
+    const message = error instanceof Error ? error.message : String(error);
+    return code ? `${code}: ${message}` : message;
+}
+function addOwnerWriteToDirectories(root) {
+    const pending = [root];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (error) {
+            if (isMissingPathError(error))
+                continue;
+            throw error;
+        }
+        if (!stat.isDirectory())
+            continue;
+        fs.chmodSync(current, stat.mode | 0o200);
+        for (const entry of fs.readdirSync(current))
+            pending.push(path.join(current, entry));
     }
 }
-function advanceRemovalJournals(project, target, targetDigest, phase, resourceLocks) {
-    return listSandboxRemovalJournals({ branch: target.effectiveBranch, project, targetDigest }).map((journal) => {
-        if (sandboxRemovalPhaseIndex(journal.phase) >= sandboxRemovalPhaseIndex(phase))
-            return journal;
-        const lock = resourceLocks.get(journal.target.controlRoot);
-        if (!lock)
-            throw new Error('SANDBOX_CONTROL_REMOVAL_LOCK_MISMATCH');
-        return advanceSandboxRemovalJournalToPhase(journal, phase, lock);
-    });
-}
-function prepareRemovalAction(project, target, targetDigest, startPhase, completedPhase, resourceLocks) {
-    const journals = listSandboxRemovalJournals({
-        branch: target.effectiveBranch,
-        project,
-        targetDigest
-    });
-    const startIndex = sandboxRemovalPhaseIndex(startPhase);
-    const completedIndex = sandboxRemovalPhaseIndex(completedPhase);
-    const shouldRun = journals.length === 0
-        || journals.some((journal) => sandboxRemovalPhaseIndex(journal.phase) < completedIndex);
-    const recovering = journals.some((journal) => {
-        const index = sandboxRemovalPhaseIndex(journal.phase);
-        return index >= startIndex && index < completedIndex;
-    });
-    advanceRemovalJournals(project, target, targetDigest, startPhase, resourceLocks);
-    return { run: shouldRun, recovering };
-}
-function assertRemovalPathsAbsent(paths) {
-    const remaining = paths.filter((candidate) => fs.existsSync(candidate));
-    if (remaining.length > 0) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${remaining[0]}`);
-    }
+function isPermissionRemovalError(error) {
+    return ['EACCES', 'EPERM', 'ENOTEMPTY'].includes(removalErrorCode(error) ?? '');
 }
 function assertBranchRemovalIdentity(config, branch, permits) {
     if (!runOk('git', ['-C', config.repoRoot, 'show-ref', '--verify', `refs/heads/${branch}`]))
@@ -140,412 +72,6 @@ function assertBranchRemovalIdentity(config, branch, permits) {
         throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
     }
 }
-function removalTombstonePath(targetDigest, kind, source) {
-    const sourceDigest = createHash('sha256')
-        .update(`${kind}\0${path.resolve(source)}`)
-        .digest('hex')
-        .slice(0, 24);
-    return path.join(path.dirname(path.resolve(source)), `.agent-infra-removal-${targetDigest.slice(0, 16)}-${kind}-${sourceDigest}`);
-}
-const REMOVAL_TOMBSTONE_MARKER = '.agent-infra-removal-ownership.json';
-const REMOVAL_TOMBSTONE_PAYLOAD = 'payload';
-function removalSourceClaimPath(source, ownership) {
-    const claimDigest = createHash('sha256')
-        .update(JSON.stringify(ownership))
-        .digest('hex')
-        .slice(0, 24);
-    return path.join(source, `.agent-infra-removal-source-${claimDigest}.json`);
-}
-function removalSourceIdentity(source) {
-    const stat = fs.lstatSync(source, { bigint: true });
-    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.dev === 0n || stat.ino === 0n) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-    }
-    return { dev: String(stat.dev), ino: String(stat.ino) };
-}
-function sameRemovalSourceIdentity(left, right) {
-    return left.dev === right.dev && left.ino === right.ino;
-}
-function removalSourceClaimMatches(source, ownership, identity) {
-    try {
-        const claimPath = removalSourceClaimPath(source, ownership);
-        const claimStat = fs.lstatSync(claimPath);
-        if (!claimStat.isFile() || claimStat.isSymbolicLink())
-            return false;
-        const record = JSON.parse(fs.readFileSync(claimPath, 'utf8'));
-        return record.version === ownership.version
-            && record.targetDigest === ownership.targetDigest
-            && record.permitDigest === ownership.permitDigest
-            && record.kind === ownership.kind
-            && typeof record.source === 'string'
-            && path.resolve(record.source) === path.resolve(ownership.source)
-            && record.sourceIdentity?.dev === identity.dev
-            && record.sourceIdentity?.ino === identity.ino;
-    }
-    catch {
-        return false;
-    }
-}
-function isOwnedRemovalSourceClaim(source, ownership) {
-    try {
-        const claimPath = removalSourceClaimPath(source, ownership);
-        const claimStat = fs.lstatSync(claimPath);
-        if (!claimStat.isFile() || claimStat.isSymbolicLink())
-            return false;
-        const record = JSON.parse(fs.readFileSync(claimPath, 'utf8'));
-        return record.version === ownership.version
-            && record.targetDigest === ownership.targetDigest
-            && record.permitDigest === ownership.permitDigest
-            && record.kind === ownership.kind
-            && typeof record.source === 'string'
-            && path.resolve(record.source) === path.resolve(ownership.source);
-    }
-    catch {
-        return false;
-    }
-}
-function removeOwnedSourceClaim(source, ownership) {
-    try {
-        const claimPath = removalSourceClaimPath(source, ownership);
-        if (isOwnedRemovalSourceClaim(source, ownership))
-            fs.unlinkSync(claimPath);
-    }
-    catch {
-        // Preserve the source when the claim cannot be revalidated.
-    }
-}
-function readRemovalTombstoneRecord(root, tombstone) {
-    assertManagedPath(root, tombstone);
-    try {
-        const tombstoneStat = fs.lstatSync(tombstone);
-        const markerStat = fs.lstatSync(removalTombstoneMarker(tombstone));
-        if (!tombstoneStat.isDirectory() || tombstoneStat.isSymbolicLink()
-            || !markerStat.isFile() || markerStat.isSymbolicLink())
-            return null;
-        const record = JSON.parse(fs.readFileSync(removalTombstoneMarker(tombstone), 'utf8'));
-        if (record.version !== 1
-            || typeof record.targetDigest !== 'string'
-            || typeof record.permitDigest !== 'string'
-            || typeof record.kind !== 'string'
-            || typeof record.source !== 'string'
-            || record.sourceIdentity?.dev === undefined
-            || record.sourceIdentity.ino === undefined)
-            return null;
-        return record;
-    }
-    catch {
-        return null;
-    }
-}
-function removalTombstonePayload(tombstone) {
-    return path.join(tombstone, REMOVAL_TOMBSTONE_PAYLOAD);
-}
-function removalTombstoneMarker(tombstone) {
-    return path.join(tombstone, REMOVAL_TOMBSTONE_MARKER);
-}
-function isOwnedRemovalTombstone(root, tombstone, ownership) {
-    const record = readRemovalTombstoneRecord(root, tombstone);
-    return record !== null
-        && record.version === 1
-        && record.targetDigest === ownership.targetDigest
-        && record.permitDigest === ownership.permitDigest
-        && record.kind === ownership.kind
-        && typeof record.source === 'string'
-        && path.resolve(record.source) === path.resolve(ownership.source);
-}
-function isOwnedRemovalPayload(root, tombstone, ownership) {
-    const record = readRemovalTombstoneRecord(root, tombstone);
-    if (!record || record.targetDigest !== ownership.targetDigest
-        || record.permitDigest !== ownership.permitDigest
-        || record.kind !== ownership.kind
-        || path.resolve(record.source) !== path.resolve(ownership.source))
-        return false;
-    try {
-        const payload = removalTombstonePayload(tombstone);
-        const payloadIdentity = removalSourceIdentity(payload);
-        return sameRemovalSourceIdentity(payloadIdentity, record.sourceIdentity)
-            && removalSourceClaimMatches(payload, ownership, record.sourceIdentity);
-    }
-    catch {
-        return false;
-    }
-}
-function assertOwnedRemovalTombstone(root, tombstone, ownership) {
-    if (!isOwnedRemovalTombstone(root, tombstone, ownership)) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${ownership.source}`);
-    }
-}
-function shouldStageManagedRemoval(source, tombstone, recovering) {
-    return fs.existsSync(source) || (recovering && fs.existsSync(tombstone));
-}
-function stageManagedRemoval(root, source, tombstone, recovering, ownership) {
-    assertManagedPath(root, source);
-    assertManagedPath(root, tombstone);
-    const sourceExists = fs.existsSync(source);
-    const tombstoneExists = fs.existsSync(tombstone);
-    if (tombstoneExists) {
-        assertOwnedRemovalTombstone(root, tombstone, ownership);
-        if (sourceExists) {
-            throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-        }
-        if (recovering) {
-            if (!isOwnedRemovalPayload(root, tombstone, ownership)) {
-                throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-            }
-            return;
-        }
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-    }
-    if (recovering) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_ACTION_OUTCOME_UNKNOWN: ${source}`);
-    }
-    if (!sourceExists)
-        return;
-    // The operator authorizes cleanup of this managed target after execution stops.
-    // Path checks detect conflicts; they do not provide an atomic source-instance move.
-    const expectedIdentity = removalSourceIdentity(source);
-    const claimPath = removalSourceClaimPath(source, ownership);
-    try {
-        fs.writeFileSync(claimPath, `${JSON.stringify({ ...ownership, sourceIdentity: expectedIdentity })}\n`, {
-            encoding: 'utf8',
-            mode: 0o600,
-            flag: 'wx'
-        });
-    }
-    catch {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-    }
-    if (!sameRemovalSourceIdentity(expectedIdentity, removalSourceIdentity(source))) {
-        removeOwnedSourceClaim(source, ownership);
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-    }
-    let moved = false;
-    try {
-        fs.mkdirSync(tombstone, { mode: 0o700 });
-        fs.writeFileSync(removalTombstoneMarker(tombstone), `${JSON.stringify({ ...ownership, sourceIdentity: expectedIdentity })}\n`, {
-            encoding: 'utf8',
-            mode: 0o600,
-            flag: 'wx'
-        });
-        fs.renameSync(source, removalTombstonePayload(tombstone));
-        moved = true;
-        if (!isOwnedRemovalPayload(root, tombstone, ownership)) {
-            throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-        }
-    }
-    catch (error) {
-        if (!moved)
-            removeOwnedSourceClaim(source, ownership);
-        throw error;
-    }
-}
-function cleanupManagedTombstones(root, targetDigest, permitDigest, kind, sources) {
-    for (const source of sources) {
-        const tombstone = removalTombstonePath(targetDigest, kind, source);
-        if (!fs.existsSync(tombstone))
-            continue;
-        const ownership = { version: 1, targetDigest, permitDigest, kind, source };
-        if (!isOwnedRemovalTombstone(root, tombstone, ownership))
-            continue;
-        if (!isOwnedRemovalPayload(root, tombstone, ownership)) {
-            throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${source}`);
-        }
-        removeManagedDir(root, tombstone);
-    }
-}
-function branchRemovalTombstoneRef(targetDigest) {
-    return `refs/agent-infra/sandbox-removal/${targetDigest}/branch`;
-}
-function branchPermitHead(branch, permits) {
-    const heads = new Set([...permits.values()]
-        .filter((permit) => permit.snapshot.branch === branch)
-        .map((permit) => permit.snapshot.head));
-    return heads.size === 1 ? [...heads][0] : null;
-}
-function stageBranchRemoval(config, branch, targetDigest, permits, recovering) {
-    const expectedHead = branchPermitHead(branch, permits);
-    if (!expectedHead)
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-    const branchName = `refs/heads/${branch}`;
-    const tombstone = branchRemovalTombstoneRef(targetDigest);
-    const branchExists = runOk('git', ['-C', config.repoRoot, 'show-ref', '--verify', branchName]);
-    const tombstoneExists = runOk('git', ['-C', config.repoRoot, 'show-ref', '--verify', tombstone]);
-    if (branchExists && tombstoneExists) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-    }
-    if (recovering) {
-        if (branchExists && !tombstoneExists) {
-            throw new Error(`SANDBOX_CONTROL_REMOVAL_ACTION_OUTCOME_UNKNOWN: ${branch}`);
-        }
-        if (tombstoneExists && runSafe('git', ['-C', config.repoRoot, 'rev-parse', tombstone]) !== expectedHead) {
-            throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-        }
-        return;
-    }
-    if (!branchExists)
-        return;
-    assertBranchRemovalIdentity(config, branch, permits);
-    const actualHead = runSafe('git', ['-C', config.repoRoot, 'rev-parse', branchName]);
-    if (!runOk('git', ['-C', config.repoRoot, 'update-ref', tombstone, actualHead, '0'.repeat(40)])) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-    }
-    if (!runOk('git', ['-C', config.repoRoot, 'update-ref', '-d', branchName, actualHead])) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-    }
-}
-function cleanupBranchTombstone(config, branch, targetDigest, permits) {
-    const tombstone = branchRemovalTombstoneRef(targetDigest);
-    if (!runOk('git', ['-C', config.repoRoot, 'show-ref', '--verify', tombstone]))
-        return;
-    const expectedHead = branchPermitHead(branch, permits);
-    if (!expectedHead || runSafe('git', ['-C', config.repoRoot, 'rev-parse', tombstone]) !== expectedHead) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-    }
-    if (!runOk('git', ['-C', config.repoRoot, 'update-ref', '-d', tombstone, expectedHead])) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${branch}`);
-    }
-}
-function worktreeRegistration(config, worktree) {
-    const lines = runSafe('git', ['-C', config.repoRoot, 'worktree', 'list', '--porcelain']).split('\n');
-    let current = null;
-    const flush = () => {
-        if (!current || path.resolve(current.path) !== path.resolve(worktree))
-            return null;
-        return { head: current.head, branch: current.branch };
-    };
-    for (const line of lines) {
-        if (line.startsWith('worktree ')) {
-            const previous = flush();
-            if (previous)
-                return previous;
-            current = { path: line.slice('worktree '.length), head: '', branch: null };
-        }
-        else if (current && line.startsWith('HEAD ')) {
-            current.head = line.slice('HEAD '.length);
-        }
-        else if (current && line.startsWith('branch ')) {
-            current.branch = line.slice('branch '.length);
-        }
-    }
-    return flush();
-}
-function assertWorktreeRegistrationIdentity(config, worktree, permit) {
-    const registration = worktreeRegistration(config, worktree);
-    if (!registration)
-        return;
-    if (registration.head !== permit.snapshot.head
-        || registration.branch !== `refs/heads/${permit.snapshot.branch}`) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${worktree}`);
-    }
-}
-function pruneWorktreeRegistration(config, worktree) {
-    runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
-    if (worktreeRegistration(config, worktree)) {
-        throw new Error(`SANDBOX_CONTROL_REMOVAL_ACTION_OUTCOME_UNKNOWN: ${worktree}`);
-    }
-}
-function stageWorktreeRemoval(config, worktree, permit, tombstone, recovering, ownership) {
-    assertManagedPath(config.worktreeBase, worktree);
-    assertManagedPath(config.worktreeBase, tombstone);
-    const worktreeExists = fs.existsSync(worktree);
-    const tombstoneExists = fs.existsSync(tombstone);
-    if (worktreeExists || !recovering)
-        verifyWorktreePermit(permit);
-    if (recovering) {
-        if (worktreeExists || !tombstoneExists) {
-            if (worktreeExists && tombstoneExists) {
-                throw new Error(`SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH: ${worktree}`);
-            }
-            throw new Error(`SANDBOX_CONTROL_REMOVAL_ACTION_OUTCOME_UNKNOWN: ${worktree}`);
-        }
-        assertOwnedRemovalTombstone(config.worktreeBase, tombstone, ownership);
-        assertWorktreeRegistrationIdentity(config, worktree, permit);
-        pruneWorktreeRegistration(config, worktree);
-        return;
-    }
-    if (!worktreeExists)
-        return;
-    stageManagedRemoval(config.worktreeBase, worktree, tombstone, false, ownership);
-    pruneWorktreeRegistration(config, worktree);
-}
-function cleanupCompletedRemovalArtifacts(config, target, committedTarget, targetDigest) {
-    const journals = listSandboxRemovalJournals({
-        branch: target.effectiveBranch,
-        project: config.project,
-        targetDigest
-    });
-    if (journals.length === 0)
-        return;
-    const completed = (phase) => journals.every((journal) => (sandboxRemovalPhaseIndex(journal.phase) >= sandboxRemovalPhaseIndex(phase)));
-    if (completed('workspace-removed')) {
-        cleanupManagedTombstones(config.workspaceViewBase, targetDigest, committedTarget.permitDigest, 'workspace', target.workspaceViewRoots);
-        cleanupManagedTombstones(path.join(config.controlBase, config.project), targetDigest, committedTarget.permitDigest, 'workspace', target.controlRoots);
-        cleanupManagedTombstones(config.worktreeBase, targetDigest, committedTarget.permitDigest, 'worktree', committedTarget.worktreePaths);
-    }
-    if (completed('branch-removed')) {
-        cleanupBranchTombstone(config, target.effectiveBranch, targetDigest, new Map(committedTarget.permits.map((permit) => [path.resolve(permit.path), {
-                mode: permit.mode,
-                snapshot: permit.snapshot
-            }])));
-    }
-    if (completed('tool-removed')) {
-        cleanupManagedTombstones(config.home, targetDigest, committedTarget.permitDigest, 'tool', committedTarget.toolPaths);
-    }
-    if (completed('shell-removed')) {
-        cleanupManagedTombstones(config.shellConfigBase, targetDigest, committedTarget.permitDigest, 'shell', committedTarget.shellPaths);
-    }
-    if (completed('share-removed')) {
-        cleanupManagedTombstones(config.shareBase, targetDigest, committedTarget.permitDigest, 'share', [committedTarget.sharePath]);
-    }
-}
-function removalActionPaths(target, config, phase) {
-    if (phase === 'workspace-removed') {
-        return [...target.workspaceViewRoots, ...target.controlRoots];
-    }
-    if (phase === 'tool-removed') {
-        return target.toolCandidates.flatMap(({ candidates }) => candidates);
-    }
-    if (phase === 'shell-removed') {
-        return shellConfigDirCandidates(config, target.effectiveBranch);
-    }
-    if (phase === 'share-removed') {
-        return [shareBranchDir(config, target.effectiveBranch)];
-    }
-    return [];
-}
-function permitsFromJournal(journals, target, expectedTargetDigest) {
-    const permits = new Map();
-    for (const journal of journals) {
-        if (journal.target.targetDigest !== expectedTargetDigest)
-            continue;
-        if (journal.target.branch !== target.effectiveBranch) {
-            throw new Error('SANDBOX_CONTROL_REMOVAL_TARGET_MISMATCH');
-        }
-        for (const entry of journal.target.permits) {
-            if (path.resolve(entry.path) !== path.resolve(entry.snapshot.worktree)) {
-                throw new Error('SANDBOX_CONTROL_REMOVAL_PERMIT_MISMATCH');
-            }
-            permits.set(path.resolve(entry.path), {
-                mode: entry.mode,
-                snapshot: entry.snapshot
-            });
-        }
-    }
-    return permits;
-}
-export function sandboxManagedPathKey(candidate, platform = process.platform, resolveExistingPath = (resolved) => fs.realpathSync.native(resolved)) {
-    const resolved = path.resolve(candidate);
-    let identity = resolved;
-    try {
-        identity = resolveExistingPath(resolved);
-    }
-    catch (error) {
-        if (!isMissingPathError(error)) {
-            throw new Error(`SANDBOX_CLEANUP_BATCH_PREFLIGHT_FAILED: unable to determine managed path identity for '${resolved}'`);
-        }
-    }
-    return platform === 'win32' ? identity.toLowerCase() : identity;
-}
 function resolveRmTarget(config, tools, cleanupTarget, options = {}) {
     assertValidBranchName(cleanupTarget.branch);
     const engine = detectEngine(config);
@@ -718,8 +244,28 @@ async function removeUncheckedSandbox(config, target, options) {
         fs.rmSync(root, { recursive: true, force: true });
         removeEmptyManagedParent(path.join(config.workspaceViewBase, config.project), root);
     }
-    for (const candidate of toolCandidates.flatMap(({ candidates }) => candidates))
-        fs.rmSync(candidate, { recursive: true, force: true });
+    const toolRemovalFailures = [];
+    for (const candidate of toolCandidates.flatMap(({ candidates }) => candidates)) {
+        try {
+            fs.rmSync(candidate, { recursive: true, force: true });
+            continue;
+        }
+        catch (initialError) {
+            if (isPermissionRemovalError(initialError)) {
+                try {
+                    addOwnerWriteToDirectories(candidate);
+                    fs.rmSync(candidate, { recursive: true, force: true });
+                    continue;
+                }
+                catch (retryError) {
+                    toolRemovalFailures.push(`${candidate}: ${removalErrorMessage(initialError)}; retry failed: ${removalErrorMessage(retryError)}`);
+                }
+            }
+            else {
+                toolRemovalFailures.push(`${candidate}: ${removalErrorMessage(initialError)}`);
+            }
+        }
+    }
     for (const shell of shellConfigDirCandidates(config, effectiveBranch))
         fs.rmSync(shell, { recursive: true, force: true });
     if (shouldRemoveShare)
@@ -736,6 +282,9 @@ async function removeUncheckedSandbox(config, target, options) {
         assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
         runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
     }
+    if (toolRemovalFailures.length > 0) {
+        throw new Error(`SANDBOX_TOOL_CLEANUP_INCOMPLETE:\n${toolRemovalFailures.map((failure) => `  - ${failure}`).join('\n')}`);
+    }
     releaseTaskBoundSandboxIdentity(config.repoRoot, target.workspace);
     if (!options.quiet)
         p.outro('Sandbox removed');
@@ -884,7 +433,7 @@ async function rmUnbound(config, tools, options) {
         p.outro(`Dry run: ${targets.length} sandbox(es) found, nothing deleted`);
         return;
     }
-    for (const { row, cleanupTarget, target } of targets) {
+    for (const { cleanupTarget, target } of targets) {
         await runRmOne(config, tools, cleanupTarget.branch, {
             assumeYes: options.assumeYes,
             target,