@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/session/history-storage.ts

@@ -1,6 +1,5 @@
 import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs";
-import * as fsPromises from "node:fs/promises";
 import * as path from "node:path";
 import { getHistoryDbPath, logger } from "@gajae-code/utils";
 
@@ -26,6 +25,155 @@ function escapeLikePattern(text: string): string {
 	return text.replace(/[\\%_]/g, "\\$&");
 }
 
+const HISTORY_SUFFIXES = ["", "-wal", "-shm"] as const;
+let openingHistory: Database | undefined;
+
+function secureHistoryPath(pathname: string, kind: "directory" | "file"): void {
+	if (process.platform !== "win32") return;
+	const native = require("@gajae-code/natives") as typeof import("@gajae-code/natives");
+	const applied = native.applyOwnerOnlyPathSecurity(pathname, kind);
+	const verified = native.verifyOwnerOnlyPathSecurity(pathname, kind);
+	if (applied?.ok !== true || verified?.ok !== true) {
+		throw new Error("history database owner-only protection could not be established");
+	}
+}
+
+function historyErrno(error: unknown): string | undefined {
+	return (error as NodeJS.ErrnoException | undefined)?.code;
+}
+
+function historyLeaf(dbPath: string, suffix: string): fs.BigIntStats | undefined {
+	try {
+		return fs.lstatSync(`${dbPath}${suffix}`, { bigint: true });
+	} catch (error) {
+		if (historyErrno(error) !== "ENOENT") throw error;
+		return undefined;
+	}
+}
+
+function assertRegularHistoryLeaf(existing: fs.BigIntStats | undefined): void {
+	if (existing && (existing.isSymbolicLink() || !existing.isFile())) {
+		throw new Error("history database path is not a regular file");
+	}
+}
+
+function assertHistoryLeaves(dbPath: string): Set<string> {
+	const present = new Set<string>();
+	for (const suffix of HISTORY_SUFFIXES) {
+		const existing = historyLeaf(dbPath, suffix);
+		assertRegularHistoryLeaf(existing);
+		if (existing) present.add(suffix);
+	}
+	return present;
+}
+
+function removeNewHistoryLeaves(): void {
+	// A WAL reader can stay live while BEGIN EXCLUSIVE succeeds, so failure
+	// cleanup must not unlink a database another opener has adopted.
+	try {
+		openingHistory?.close();
+	} catch {
+		// The caller reports the original open failure.
+	}
+	openingHistory = undefined;
+}
+
+function readHistoryDirectory(dir: string): fs.Stats | undefined {
+	let existing: fs.Stats;
+	try {
+		existing = fs.lstatSync(dir);
+	} catch (error) {
+		if (historyErrno(error) !== "ENOENT") throw error;
+		return undefined;
+	}
+	if (existing.isSymbolicLink() || !existing.isDirectory()) {
+		throw new Error("history database directory is not a real directory");
+	}
+	return existing;
+}
+
+function tightenHistoryDirectory(dir: string): void {
+	let existing = readHistoryDirectory(dir);
+	if (!existing) {
+		try {
+			fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+		} catch (error) {
+			if (historyErrno(error) !== "EEXIST") throw error;
+		}
+		existing = readHistoryDirectory(dir);
+		if (!existing) throw new Error("history database directory is not a real directory");
+	}
+	secureHistoryPath(dir, "directory");
+	if (process.platform === "win32") return;
+	// 0300/0700 are already owner-only. Sticky directories are shared and stay as they are.
+	// chmod(2) needs no read bit, so mode 0333 becomes 0700. A symlink swap is
+	// followed by chmod; the recheck then refuses and no database file is created.
+	if ((existing.mode & 0o077) === 0 || (existing.mode & 0o1000) !== 0) return;
+	try {
+		fs.chmodSync(dir, 0o700);
+	} catch (error) {
+		if (historyErrno(error) === "ELOOP") throw new Error("history database directory is not a real directory");
+		throw error;
+	}
+	const after = readHistoryDirectory(dir);
+	if (!after || (after.mode & 0o077) !== 0) {
+		throw new Error("history database directory could not be tightened to mode 0700");
+	}
+}
+
+function sameHistoryFile(left: fs.BigIntStats, right: fs.BigIntStats): boolean {
+	return left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+}
+
+function restrictHistoryFiles(dbPath: string, createMissingDb: boolean): void {
+	const noFollow = process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0);
+	for (const suffix of HISTORY_SUFFIXES) {
+		const target = `${dbPath}${suffix}`;
+		let existing = historyLeaf(dbPath, suffix);
+		assertRegularHistoryLeaf(existing);
+		if (!existing && suffix === "" && createMissingDb) {
+			let created: number | undefined;
+			try {
+				created = fs.openSync(
+					target,
+					fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | noFollow,
+					0o600,
+				);
+				fs.fchmodSync(created, 0o600);
+			} catch (error) {
+				if (historyErrno(error) === "ELOOP") throw new Error("history database path is not a regular file");
+				if (historyErrno(error) !== "EEXIST") throw error;
+			} finally {
+				if (created !== undefined) fs.closeSync(created);
+			}
+			existing = historyLeaf(dbPath, suffix);
+			assertRegularHistoryLeaf(existing);
+			if (!existing) throw new Error("history database path is not a regular file");
+		}
+		if (!existing) continue;
+		secureHistoryPath(target, "file");
+		if (process.platform === "win32" || (Number(existing.mode) & 0o077) === 0) continue;
+		let fd: number | undefined;
+		try {
+			fd = fs.openSync(target, fs.constants.O_RDONLY | noFollow);
+			const opened = fs.fstatSync(fd, { bigint: true });
+			const again = historyLeaf(dbPath, suffix);
+			if (!again || !opened.isFile() || !sameHistoryFile(existing, opened) || !sameHistoryFile(opened, again)) {
+				throw new Error("history database path is not a regular file");
+			}
+			fs.fchmodSync(fd, 0o600);
+			if ((Number(fs.fstatSync(fd, { bigint: true }).mode) & 0o777) !== 0o600) {
+				throw new Error("history database path could not be tightened to mode 0600");
+			}
+		} catch (error) {
+			if (historyErrno(error) === "ELOOP") throw new Error("history database path is not a regular file");
+			throw error;
+		} finally {
+			if (fd !== undefined) fs.closeSync(fd);
+		}
+	}
+}
+
 class AsyncDrain<T> {
 	#queue?: T[];
 	#promise = Promise.resolve();
@@ -83,6 +231,7 @@ export class HistoryStorage {
 
 	private constructor(dbPath: string) {
 		this.#db = new Database(dbPath);
+		openingHistory = this.#db;
 
 		const hasFts = this.#db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='history_fts'").get();
 
@@ -137,12 +286,32 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 
 		const last = this.#lastPromptStmt.get() as { prompt?: string } | undefined;
 		this.#lastPromptCache = last?.prompt ?? null;
+		try {
+			restrictHistoryFiles(dbPath, false);
+		} catch (error) {
+			this.#db.close();
+			throw error;
+		}
+		openingHistory = undefined;
+	}
+
+	static #openNew(dbPath: string): HistoryStorage {
+		openingHistory = undefined;
+		assertHistoryLeaves(dbPath);
+		try {
+			tightenHistoryDirectory(path.dirname(dbPath));
+			assertHistoryLeaves(dbPath);
+			restrictHistoryFiles(dbPath, true);
+			return new HistoryStorage(dbPath);
+		} catch (error) {
+			removeNewHistoryLeaves();
+			throw error;
+		}
 	}
 
 	static open(dbPath: string = getHistoryDbPath()): HistoryStorage {
 		if (!HistoryStorage.#instance) {
-			fs.mkdirSync(path.dirname(dbPath), { recursive: true });
-			HistoryStorage.#instance = new HistoryStorage(dbPath);
+			HistoryStorage.#instance = HistoryStorage.#openNew(dbPath);
 		}
 		return HistoryStorage.#instance;
 	}
@@ -150,16 +319,17 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 	static async openAsync(dbPath: string = getHistoryDbPath()): Promise<HistoryStorage> {
 		if (HistoryStorage.#instance) return HistoryStorage.#instance;
 		if (!HistoryStorage.#opening) {
-			HistoryStorage.#opening = (async () => {
-				await fsPromises.mkdir(path.dirname(dbPath), { recursive: true });
-				const storage = new HistoryStorage(dbPath);
-				HistoryStorage.#instance ??= storage;
-				return HistoryStorage.#instance;
-			})().finally(() => {
-				HistoryStorage.#opening = undefined;
-			});
+			HistoryStorage.#opening = Promise.resolve()
+				.then(() => {
+					const storage = HistoryStorage.#openNew(dbPath);
+					HistoryStorage.#instance ??= storage;
+					return HistoryStorage.#instance;
+				})
+				.finally(() => {
+					HistoryStorage.#opening = undefined;
+				});
 		}
-		return await HistoryStorage.#opening;
+		return HistoryStorage.#opening;
 	}
 
 	/** @internal Reset the singleton — test-only. */

package/src/session/internal/managed-session-scope.ts

@@ -228,14 +228,22 @@ function bindManagedWriteAuthority(scope: ManagedScope, authority: ManagedCandid
 function assertRetainedManagedDirectoryIdentity(scope: ManagedScope): void {
 	const expected = managedDirectoryIdentities.get(scope);
 	if (!expected) return;
-	const current = fs.lstatSync(scope.directoryPath, { bigint: true });
-	if (
-		!current.isDirectory() ||
-		current.isSymbolicLink() ||
-		current.dev !== expected.dev ||
-		current.ino !== expected.ino
-	)
-		throw new Error("Managed session directory changed");
+	assertSameManagedDirectoryIdentity(fs.lstatSync(scope.directoryPath, { bigint: true }), expected);
+}
+
+/**
+ * Fence a managed directory to the identity it was bound with. The decision is
+ * the same for every mismatch; only the reported reason differs. The same
+ * inode on a different `dev` is the shape a remount, drive-letter change or
+ * volume-serial change leaves behind (#6750). It is still refused, because an
+ * inode is only unique within one volume, but it is named so an operator is
+ * not sent looking for a corrupted binding.
+ */
+function assertSameManagedDirectoryIdentity(current: fs.BigIntStats, expected: { dev: bigint; ino: bigint }): void {
+	if (!current.isDirectory() || current.isSymbolicLink()) throw new Error("Managed session directory changed");
+	if (current.dev === expected.dev && current.ino === expected.ino) return;
+	if (current.ino === expected.ino) throw new Error("volume_identity_changed");
+	throw new Error("Managed session directory changed");
 }
 
 export function managedDirectoryAuthorityForScope(scope: ManagedScope): RecoveryFsRoot | undefined {
@@ -299,6 +307,7 @@ export type ManagedScopeErrorCode =
 	| "managed_gc_journal_capacity_exceeded"
 	| "atomic_unavailable"
 	| "invalid_request"
+	| "permission_denied"
 	| "durability_failed"
 	| "durability_not_provable"
 	| "capacity_exceeded";
@@ -318,7 +327,22 @@ export type ManagedScopeResolution =
  * propagating them keeps startup redaction intact while telling the operator
  * which invariant actually failed instead of a blanket `binding_invalid`.
  */
-const managedScopeIdentityFailureCodes = new Set(["identity_mismatch", "reparse_point", "not_directory", "not_file"]);
+const managedScopeIdentityFailureCodes = new Set([
+	"identity_mismatch",
+	"volume_identity_changed",
+	"reparse_point",
+	"not_directory",
+	"not_file",
+]);
+
+/**
+ * Fixed, path-free tokens from the replacement-cleanup receipt preflight that
+ * runs before every no-replace publish. A stale receipt the preflight refuses
+ * (for example one whose filename encodes a device number that changed after a
+ * reboot, #6820) blocks an otherwise healthy binding publish; reporting it as
+ * `binding_invalid` sends operators to the binding instead of the receipt.
+ */
+const managedScopeReceiptFailureCodes = new Set(["managed_replace_cleanup_receipt_invalid"]);
 
 /**
  * Fixed, path-free errno tokens. A managed scope that fails to prepare because
@@ -342,6 +366,7 @@ const managedScopeErrnoFailureCodes = new Set([
 const managedScopeFailureCodes = new Set<ManagedScopeErrorCode>([
 	"atomic_unavailable",
 	"invalid_request",
+	"permission_denied",
 	"durability_failed",
 	"durability_not_provable",
 	"migration_busy",
@@ -374,6 +399,7 @@ function isManagedScopeCapacityMessage(message: string): boolean {
 function managedScopeResidualClassification(error: unknown): string | undefined {
 	if (!(error instanceof Error)) return undefined;
 	if (managedScopeIdentityFailureCodes.has(error.message)) return error.message;
+	if (managedScopeReceiptFailureCodes.has(error.message)) return error.message;
 	const errno = (error as NodeJS.ErrnoException).code;
 	return errno !== undefined && managedScopeErrnoFailureCodes.has(errno) ? errno : undefined;
 }
@@ -441,6 +467,7 @@ export type ManagedOpenFailure =
 	| "managed_gc_journal_capacity_exceeded"
 	| "durability_failed"
 	| "atomic_unavailable"
+	| "permission_denied"
 	| "invalid_request"
 	| "durability_not_provable"
 	| "migration_retired"
@@ -505,6 +532,7 @@ type NativeIdentity =
 type CanonicalNativeIdentity = Extract<NativeIdentity, { ok: true }>;
 
 type NativeIdentityFailureCode =
+	| "access_denied"
 	| "not_found"
 	| "not_directory"
 	| "not_utf8"
@@ -615,6 +643,12 @@ function nativeFailure(code: NativeIdentityFailureCode): ManagedScopeResolution
 		return { kind: "error", code: "cwd_missing", message: "The workspace directory does not exist." };
 	if (code === "not_directory")
 		return { kind: "error", code: "cwd_not_directory", message: "The workspace path is not a directory." };
+	if (code === "access_denied")
+		return {
+			kind: "error",
+			code: "permission_denied",
+			message: "Permission was denied while identifying the workspace directory.",
+		};
 	if (code === "network_unsupported") {
 		return {
 			kind: "error",
@@ -625,6 +659,10 @@ function nativeFailure(code: NativeIdentityFailureCode): ManagedScopeResolution
 	return { kind: "error", code: "identity_unavailable", message: "Workspace directory identity is unavailable." };
 }
 
+function nativeIdentityDiagnosticCode(code: NativeIdentityFailureCode): string {
+	return code === "access_denied" ? "permission_denied" : `cwd_${code}`;
+}
+
 function bindingFor(scope: ManagedScope): Binding {
 	return {
 		schemaVersion: 1,
@@ -1104,7 +1142,7 @@ function inspectCandidate(
 		if (header.type !== "session" || typeof header.id !== "string" || typeof header.cwd !== "string")
 			return { code: "invalid_header" };
 		const cwdIdentity = identityFor(header.cwd);
-		if (!cwdIdentity.ok) return { code: `cwd_${cwdIdentity.code}` };
+		if (!cwdIdentity.ok) return { code: nativeIdentityDiagnosticCode(cwdIdentity.code) };
 		const named = fs.lstatSync(filePath, { bigint: true });
 		if (
 			!named.isFile() ||
@@ -1166,7 +1204,8 @@ function listDirectoryCandidates(
 	try {
 		directoryStat = fs.lstatSync(directory);
 	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT" || (provenance === "legacy" && code === "ENAMETOOLONG")) return [];
 		throw error;
 	}
 	if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new Error("unsafe directory");
@@ -1868,13 +1907,7 @@ export function prepareManagedSessionScopeForWriteSync(
 		managedDirectoryAuthorities.set(scope, retainedAuthority);
 		stage = "scope_revalidate";
 		const directoryStat = fs.lstatSync(scope.directoryPath, { bigint: true });
-		if (
-			!directoryStat.isDirectory() ||
-			directoryStat.isSymbolicLink() ||
-			directoryStat.dev !== preparedDirectory.dev ||
-			directoryStat.ino !== preparedDirectory.ino
-		)
-			throw new Error("Managed session directory changed");
+		assertSameManagedDirectoryIdentity(directoryStat, preparedDirectory);
 		managedDirectoryIdentities.set(scope, { dev: preparedDirectory.dev, ino: preparedDirectory.ino });
 		if (validated) {
 			if (validated.kind !== "error") throw new Error("Unexpected managed scope binding result");
@@ -1950,7 +1983,7 @@ export function listManagedCandidates(scope: ManagedScope): ManagedCandidateList
 				const candidateIdentity = identityFor(candidate.cwd);
 				if (!candidateIdentity.ok) {
 					invalid.push({
-						code: `cwd_${candidateIdentity.code}`,
+						code: nativeIdentityDiagnosticCode(candidateIdentity.code),
 						...(safeManagedCandidateSessionId(candidate.sessionId) === undefined
 							? {}
 							: { sessionId: candidate.sessionId }),
@@ -1970,7 +2003,8 @@ export function listManagedCandidates(scope: ManagedScope): ManagedCandidateList
 				}
 			}
 		}
-		const visible = owned.filter(candidate => !isRetired(scope, candidate));
+		const retired = owned.length > 0 ? retiredTargetKeys(scope) : new Set<string>();
+		const visible = owned.filter(candidate => !isRetiredIn(retired, candidate));
 		const active = visible.filter(
 			candidate =>
 				candidate.provenance === "v2" ||
@@ -2041,6 +2075,7 @@ function expectedFailure(error: unknown): ManagedOpenFailure {
 		message === "managed_gc_journal_capacity_exceeded" ||
 		message === "durability_failed" ||
 		message === "atomic_unavailable" ||
+		message === "permission_denied" ||
 		message === "invalid_request" ||
 		message === "durability_not_provable" ||
 		message === "migration_retired"
@@ -2692,11 +2727,14 @@ function managedGcStreamDirectoryInventory(
 	countEntry: (entry: fs.Dirent) => boolean,
 	retain: (entry: fs.Dirent) => boolean,
 	operation: ManagedGcInventoryOperation,
+	verificationBaseline?: ManagedGcDirectoryInventory,
 ): ManagedGcDirectoryInventory {
 	managedGcReserveInventoryWork(operation);
 	const beforeStat = fs.lstatSync(pathname, { bigint: true });
 	if (!beforeStat.isDirectory() || beforeStat.isSymbolicLink()) throw new Error("managed_gc_scope_authority_mismatch");
 	const before = managedGcDirectoryEvidence(beforeStat);
+	if (verificationBaseline && !managedGcSameDirectoryEvidence(before, verificationBaseline.evidence))
+		throw new Error("managed_gc_scope_authority_mismatch");
 	const scan = (collect: boolean): { count: number; physicalEntryCount: number; entries: fs.Dirent[] } => {
 		managedGcReserveInventoryWork(operation);
 		const entries: fs.Dirent[] = [];
@@ -2742,7 +2780,9 @@ function managedGcStreamDirectoryInventory(
 		managedGcReserveInventoryWork(operation);
 		return { count, physicalEntryCount, entries };
 	};
-	const counted = scan(false);
+	const counted = verificationBaseline
+		? { count: verificationBaseline.entryCount, physicalEntryCount: verificationBaseline.physicalEntryCount }
+		: scan(false);
 	managedGcReserveInventoryWork(operation);
 	const afterCount = fs.lstatSync(pathname, { bigint: true });
 	if (
@@ -2776,6 +2816,7 @@ function managedGcReceiptDirectoryInventory(
 	scope: ManagedScope,
 	store: ManagedSessionDescendantStore,
 	operation: ManagedGcInventoryOperation,
+	verificationBaseline?: ManagedGcDirectoryInventory,
 ): ManagedGcDirectoryInventory {
 	const relativePath = MANAGED_GC_RETIREMENT_RECEIPTS;
 	managedGcReserveInventoryWork(
@@ -2789,6 +2830,7 @@ function managedGcReceiptDirectoryInventory(
 		entry => entry.name.startsWith(MANAGED_GC_RETIREMENT_PREFIX),
 		entry => entry.name.startsWith(MANAGED_GC_RETIREMENT_PREFIX),
 		operation,
+		verificationBaseline,
 	);
 	managedGcReserveInventoryWork(operation);
 	const after = store.captureDirectoryIdentity(relativePath);
@@ -3606,14 +3648,20 @@ export async function readManagedGcSessionRetirementReceiptReadOnly(
 			if (!hasFsCode(error, "ENOENT")) throw error;
 			receiptDirectoryPresent = false;
 		}
-		if (receiptDirectoryPresent)
+		if (receiptDirectoryPresent) {
+			const inventory = managedGcReceiptDirectoryInventory(scope, store, operation);
 			receipt = readManagedGcSessionRetirementReceiptUnlocked(
 				scope,
 				transcriptPath,
 				trusted,
 				store,
 				operation,
+				inventory,
 			).receipt;
+			const after = managedGcReceiptDirectoryInventory(scope, store, operation, inventory);
+			if (!managedGcSameReceiptDirectoryInventory(inventory, after))
+				throw new Error("task_artifact_owner_continuation_authority_mismatch");
+		}
 	} catch (error) {
 		primaryError = error;
 		hasPrimaryError = true;
@@ -6282,8 +6330,96 @@ function tombstonePathContaining(scope: ManagedScope, candidate: ManagedCandidat
 	return undefined;
 }
 
-function isRetired(scope: ManagedScope, candidate: ManagedCandidate): boolean {
+/**
+ * Identity fields a retired tombstone target must match exactly for a candidate
+ * to be hidden. `dev`, `ino`, and `mtimeNs` are persisted as decimal strings.
+ */
+type RetiredTargetIdentity = readonly [
+	path: string,
+	sessionId: string,
+	cwd: string,
+	canonicalPath: string,
+	dev: string,
+	ino: string,
+	size: number,
+	mtimeNs: string,
+	sha256: string,
+];
+
+function candidateRetiredIdentity(candidate: ManagedCandidate): RetiredTargetIdentity {
+	return [
+		candidate.path,
+		candidate.sessionId,
+		candidate.cwd,
+		candidate.identity.canonicalPath,
+		String(candidate.identity.dev),
+		String(candidate.identity.ino),
+		candidate.identity.size,
+		String(candidate.identity.mtimeNs),
+		candidate.identity.sha256,
+	];
+}
+
+/** Returns the target's identity only when every field has the type a candidate can carry. */
+function parseRetiredTargetIdentity(target: unknown): RetiredTargetIdentity | undefined {
+	if (!target || typeof target !== "object") return undefined;
+	const value = target as { path?: unknown; sessionId?: unknown; cwd?: unknown; identity?: unknown };
+	if (!value.identity || typeof value.identity !== "object") return undefined;
+	const identity = value.identity as {
+		canonicalPath?: unknown;
+		dev?: unknown;
+		ino?: unknown;
+		size?: unknown;
+		mtimeNs?: unknown;
+		sha256?: unknown;
+	};
+	if (
+		typeof value.path !== "string" ||
+		typeof value.sessionId !== "string" ||
+		typeof value.cwd !== "string" ||
+		typeof identity.canonicalPath !== "string" ||
+		typeof identity.dev !== "string" ||
+		typeof identity.ino !== "string" ||
+		typeof identity.size !== "number" ||
+		typeof identity.mtimeNs !== "string" ||
+		typeof identity.sha256 !== "string"
+	)
+		return undefined;
+	return [
+		value.path,
+		value.sessionId,
+		value.cwd,
+		identity.canonicalPath,
+		identity.dev,
+		identity.ino,
+		identity.size,
+		identity.mtimeNs,
+		identity.sha256,
+	];
+}
+
+/**
+ * Key equality matches strict equality of every member: strings and finite
+ * numbers encode distinctly. A non-finite tombstone `size` encodes as `null`,
+ * which no candidate produces.
+ */
+function retiredIdentityKey(identity: RetiredTargetIdentity): string {
+	return JSON.stringify(identity);
+}
+
+/**
+ * Snapshot of the identities retired by a scope's tombstones.
+ *
+ * Tombstones are visited in directory order and the walk stops at the first
+ * unreadable or malformed one: it grants no retirement authority, and neither do
+ * the tombstones after it. Listing builds this once and checks every candidate
+ * against it, so its cost is linear in tombstones rather than in
+ * candidates x tombstones.
+ */
+function retiredTargetKeys(scope: ManagedScope): ReadonlySet<string> {
+	const keys = new Set<string>();
 	const directory = path.join(managedInternalDirectory(scope), MANAGED_TOMBSTONES_DIRECTORY);
+	const digest = scopeDigest(scope.platform, scope.canonicalCwd);
 	try {
 		for (const name of fs.readdirSync(directory)) {
 			const pathname = path.join(directory, name);
@@ -6293,47 +6429,27 @@ function isRetired(scope: ManagedScope, candidate: ManagedCandidate): boolean {
 			if (
 				record.schemaVersion !== 2 ||
 				record.state !== "retired" ||
-				record.scope !== scopeDigest(scope.platform, scope.canonicalCwd) ||
+				record.scope !== digest ||
 				!Array.isArray(record.targets)
 			)
 				continue;
-			if (
-				record.targets.some(target => {
-					if (!target || typeof target !== "object") return false;
-					const value = target as {
-						path?: unknown;
-						sessionId?: unknown;
-						cwd?: unknown;
-						identity?: {
-							canonicalPath?: unknown;
-							dev?: unknown;
-							ino?: unknown;
-							size?: unknown;
-							mtimeNs?: unknown;
-							sha256?: unknown;
-						};
-					};
-					const identity = value.identity;
-					if (!identity) return false;
-					return (
-						value.path === candidate.path &&
-						value.sessionId === candidate.sessionId &&
-						value.cwd === candidate.cwd &&
-						identity.canonicalPath === candidate.identity.canonicalPath &&
-						identity.dev === String(candidate.identity.dev) &&
-						identity.ino === String(candidate.identity.ino) &&
-						identity.size === candidate.identity.size &&
-						identity.mtimeNs === String(candidate.identity.mtimeNs) &&
-						identity.sha256 === candidate.identity.sha256
-					);
-				})
-			)
-				return true;
+			for (const target of record.targets) {
+				const identity = parseRetiredTargetIdentity(target);
+				if (identity) keys.add(retiredIdentityKey(identity));
+			}
 		}
 	} catch {
 		/* a missing/malformed tombstone grants no retirement authority */
 	}
-	return false;
+	return keys;
+}
+
+function isRetiredIn(retired: ReadonlySet<string>, candidate: ManagedCandidate): boolean {
+	return retired.has(retiredIdentityKey(candidateRetiredIdentity(candidate)));
+}
+
+function isRetired(scope: ManagedScope, candidate: ManagedCandidate): boolean {
+	return isRetiredIn(retiredTargetKeys(scope), candidate);
 }
 
 type ArtifactManifestEntry =