@git.zone/tsdisk 1.1.0 → 1.2.1

package/dist_ts/tsdisk.plugins.d.ts

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
-import { createReadStream, type ReadStream } from 'node:fs';
+import { constants, createReadStream, type ReadStream } from 'node:fs';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { createInterface } from 'node:readline/promises';
-export { createInterface, createReadStream, fs, path, spawn, type ReadStream, };
+export { constants, createInterface, createReadStream, fs, path, spawn, type ReadStream, };

package/dist_ts/tsdisk.plugins.js

@@ -1,8 +1,8 @@
 // node native
 import { spawn } from 'node:child_process';
-import { createReadStream } from 'node:fs';
+import { constants, createReadStream } from 'node:fs';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { createInterface } from 'node:readline/promises';
-export { createInterface, createReadStream, fs, path, spawn, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHNkaXNrLnBsdWdpbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy90c2Rpc2sucGx1Z2lucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjO0FBQ2QsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzNDLE9BQU8sRUFBRSxnQkFBZ0IsRUFBbUIsTUFBTSxTQUFTLENBQUM7QUFDNUQsT0FBTyxLQUFLLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUN2QyxPQUFPLEtBQUssSUFBSSxNQUFNLFdBQVcsQ0FBQztBQUNsQyxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFFekQsT0FBTyxFQUNMLGVBQWUsRUFDZixnQkFBZ0IsRUFDaEIsRUFBRSxFQUNGLElBQUksRUFDSixLQUFLLEdBRU4sQ0FBQyJ9
+export { constants, createInterface, createReadStream, fs, path, spawn, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHNkaXNrLnBsdWdpbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy90c2Rpc2sucGx1Z2lucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjO0FBQ2QsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzNDLE9BQU8sRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQW1CLE1BQU0sU0FBUyxDQUFDO0FBQ3ZFLE9BQU8sS0FBSyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDdkMsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFDbEMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRXpELE9BQU8sRUFDTCxTQUFTLEVBQ1QsZUFBZSxFQUNmLGdCQUFnQixFQUNoQixFQUFFLEVBQ0YsSUFBSSxFQUNKLEtBQUssR0FFTixDQUFDIn0=

package/dist_ts/tsdisk.scan.d.ts

@@ -0,0 +1,19 @@
+import { type IToolCacheFinding } from './tsdisk.toolcaches.js';
+export interface IWorkspaceScanOptions {
+    maxDepth: number;
+    timeoutMs: number;
+    maxEntries: number;
+}
+export interface IScanIssue {
+    path: string;
+    reason: 'read-error' | 'invalid-marker' | 'depth-limit' | 'entry-limit' | 'timeout' | 'mount-boundary' | 'symlink' | 'size-unavailable';
+    detail: string;
+}
+export interface IWorkspaceScanResult {
+    root: string;
+    findings: IToolCacheFinding[];
+    issues: IScanIssue[];
+    complete: boolean;
+    visitedEntries: number;
+}
+export declare function scanWorkspace(root: string, options: IWorkspaceScanOptions): Promise<IWorkspaceScanResult>;

package/dist_ts/tsdisk.scan.js

@@ -0,0 +1,118 @@
+import * as plugins from './tsdisk.plugins.js';
+import { classifyToolCachePath, parseToolCacheMarker, toolCacheMarkerFile } from './tsdisk.toolcaches.js';
+const excludedDirectories = new Set(['.git', 'node_modules', 'dist_ts', 'dist_ts_web', 'coverage', '.pnpm-store']);
+export async function scanWorkspace(root, options) {
+    for (const name of ['maxDepth', 'timeoutMs', 'maxEntries']) {
+        const value = options[name];
+        if (!Number.isSafeInteger(value) || value < (name === 'maxDepth' ? 0 : 1)) {
+            throw new Error(`Invalid scan option ${name}: ${value}`);
+        }
+    }
+    const result = { root: plugins.path.resolve(root), findings: [], issues: [], complete: true, visitedEntries: 0 };
+    const deadline = Date.now() + options.timeoutMs;
+    let stopped = false;
+    const issue = (path, reason, detail) => {
+        result.complete = false;
+        result.issues.push({ path, reason, detail });
+    };
+    const limited = (path) => {
+        if (stopped)
+            return true;
+        if (Date.now() >= deadline || result.visitedEntries >= options.maxEntries) {
+            issue(path, Date.now() >= deadline ? 'timeout' : 'entry-limit', 'Scan stopped before visiting all entries.');
+            stopped = true;
+        }
+        return stopped;
+    };
+    let rootDev;
+    try {
+        const stat = await plugins.fs.lstat(result.root);
+        if (stat.isSymbolicLink() || await plugins.fs.realpath(result.root) !== result.root) {
+            issue(result.root, 'symlink', 'Scan roots must not contain symbolic links.');
+            return result;
+        }
+        if (!stat.isDirectory())
+            throw new Error('Scan root is not a directory.');
+        rootDev = stat.dev;
+    }
+    catch (error) {
+        issue(result.root, 'read-error', error instanceof Error ? error.message : String(error));
+        return result;
+    }
+    const visit = async (directory, depth) => {
+        if (limited(directory))
+            return;
+        result.visitedEntries++;
+        try {
+            const stat = await plugins.fs.lstat(directory);
+            if (stat.isSymbolicLink()) {
+                issue(directory, 'symlink', 'Symbolic link skipped.');
+                return;
+            }
+            if (stat.dev !== rootDev) {
+                issue(directory, 'mount-boundary', 'Different filesystem skipped.');
+                return;
+            }
+            const entries = await plugins.fs.readdir(directory, { withFileTypes: true });
+            let marker;
+            if (entries.some((entry) => entry.name === toolCacheMarkerFile)) {
+                const markerPath = plugins.path.join(directory, toolCacheMarkerFile);
+                const markerStat = await plugins.fs.lstat(markerPath);
+                if (!markerStat.isFile() || markerStat.size > 65536) {
+                    issue(markerPath, 'invalid-marker', 'Marker must be a regular file of at most 64 KiB.');
+                }
+                else {
+                    marker = parseToolCacheMarker(await plugins.fs.readFile(markerPath, 'utf8'));
+                    if (!marker)
+                        issue(markerPath, 'invalid-marker', 'Invalid cache ownership marker.');
+                }
+            }
+            const heuristic = classifyToolCachePath(directory);
+            const classification = classifyToolCachePath(directory, marker);
+            if (classification)
+                result.findings.push({ path: directory, ...classification });
+            // Cache contents are not workspaces. Registry session directories can carry their own markers.
+            if (classification && heuristic?.kind !== 'docker-registry-cache')
+                return;
+            const children = entries.filter((entry) => !excludedDirectories.has(entry.name));
+            if (depth >= options.maxDepth) {
+                if (children.some((entry) => entry.isDirectory() || entry.isSymbolicLink()))
+                    issue(directory, 'depth-limit', `Maximum scan depth ${options.maxDepth} reached.`);
+                return;
+            }
+            for (const child of children) {
+                const childPath = plugins.path.join(directory, child.name);
+                if (limited(childPath))
+                    return;
+                if (!child.isDirectory() && !child.isSymbolicLink()) {
+                    result.visitedEntries++;
+                    continue;
+                }
+                if (child.isSymbolicLink()) {
+                    result.visitedEntries++;
+                    issue(childPath, 'symlink', 'Symbolic link skipped.');
+                    continue;
+                }
+                if (heuristic?.kind === 'docker-registry-cache') {
+                    // Only direct sessions, never registry blob trees.
+                    const sessionMarker = await plugins.fs.lstat(plugins.path.join(childPath, toolCacheMarkerFile)).catch((error) => {
+                        if (error.code === 'ENOENT')
+                            return undefined;
+                        throw error;
+                    });
+                    if (!sessionMarker) {
+                        result.visitedEntries++;
+                        continue;
+                    }
+                }
+                await visit(childPath, depth + 1);
+            }
+        }
+        catch (error) {
+            issue(directory, 'read-error', error instanceof Error ? error.message : String(error));
+        }
+    };
+    await visit(result.root, 0);
+    return result;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHNkaXNrLnNjYW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy90c2Rpc2suc2Nhbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxvQkFBb0IsRUFBRSxtQkFBbUIsRUFBMEIsTUFBTSx3QkFBd0IsQ0FBQztBQXNCbEksTUFBTSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztBQUVuSCxNQUFNLENBQUMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxJQUFZLEVBQUUsT0FBOEI7SUFDOUUsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsWUFBWSxDQUFVLEVBQUUsQ0FBQztRQUNwRSxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDNUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzFFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUJBQXVCLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQzNELENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQXlCLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxDQUFDLEVBQUUsQ0FBQztJQUN2SSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQztJQUNoRCxJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUM7SUFDcEIsTUFBTSxLQUFLLEdBQUcsQ0FBQyxJQUFZLEVBQUUsTUFBNEIsRUFBRSxNQUFjLEVBQUUsRUFBRTtRQUMzRSxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztRQUN4QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUMvQyxDQUFDLENBQUM7SUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLElBQVksRUFBRSxFQUFFO1FBQy9CLElBQUksT0FBTztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ3pCLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxJQUFJLFFBQVEsSUFBSSxNQUFNLENBQUMsY0FBYyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUMxRSxLQUFLLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsSUFBSSxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsYUFBYSxFQUFFLDJDQUEyQyxDQUFDLENBQUM7WUFDN0csT0FBTyxHQUFHLElBQUksQ0FBQztRQUNqQixDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQyxDQUFDO0lBQ0YsSUFBSSxPQUFlLENBQUM7SUFDcEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDakQsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLElBQUksTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3BGLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSw2Q0FBNkMsQ0FBQyxDQUFDO1lBQzdFLE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUMxRSxPQUFPLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQztJQUNyQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUN6RixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsS0FBSyxFQUFFLFNBQWlCLEVBQUUsS0FBYSxFQUFpQixFQUFFO1FBQ3RFLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQztZQUFFLE9BQU87UUFDL0IsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQ3hCLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDL0MsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztnQkFDMUIsS0FBSyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztnQkFDdEQsT0FBTztZQUNULENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxHQUFHLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQ3pCLEtBQUssQ0FBQyxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsK0JBQStCLENBQUMsQ0FBQztnQkFDcEUsT0FBTztZQUNULENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQzdFLElBQUksTUFBTSxDQUFDO1lBQ1gsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztnQkFDaEUsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLG1CQUFtQixDQUFDLENBQUM7Z0JBQ3JFLE1BQU0sVUFBVSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7Z0JBQ3RELElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLElBQUksVUFBVSxDQUFDLElBQUksR0FBRyxLQUFLLEVBQUUsQ0FBQztvQkFDcEQsS0FBSyxDQUFDLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxrREFBa0QsQ0FBQyxDQUFDO2dCQUMxRixDQUFDO3FCQUFNLENBQUM7b0JBQ04sTUFBTSxHQUFHLG9CQUFvQixDQUFDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7b0JBQzdFLElBQUksQ0FBQyxNQUFNO3dCQUFFLEtBQUssQ0FBQyxVQUFVLEVBQUUsZ0JBQWdCLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztnQkFDdEYsQ0FBQztZQUNILENBQUM7WUFDRCxNQUFNLFNBQVMsR0FBRyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuRCxNQUFNLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDaEUsSUFBSSxjQUFjO2dCQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxHQUFHLGNBQWMsRUFBRSxDQUFDLENBQUM7WUFDakYsK0ZBQStGO1lBQy9GLElBQUksY0FBYyxJQUFJLFNBQVMsRUFBRSxJQUFJLEtBQUssdUJBQXVCO2dCQUFFLE9BQU87WUFDMUUsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDakYsSUFBSSxLQUFLLElBQUksT0FBTyxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUM5QixJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQUUsSUFBSSxLQUFLLENBQUMsY0FBYyxFQUFFLENBQUM7b0JBQUUsS0FBSyxDQUFDLFNBQVMsRUFBRSxhQUFhLEVBQUUsc0JBQXNCLE9BQU8sQ0FBQyxRQUFRLFdBQVcsQ0FBQyxDQUFDO2dCQUNoSyxPQUFPO1lBQ1QsQ0FBQztZQUNELEtBQUssTUFBTSxLQUFLLElBQUksUUFBUSxFQUFFLENBQUM7Z0JBQzdCLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBQzNELElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQztvQkFBRSxPQUFPO2dCQUMvQixJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUM7b0JBQ3BELE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztvQkFDeEIsU0FBUztnQkFDWCxDQUFDO2dCQUNELElBQUksS0FBSyxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUM7b0JBQzNCLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztvQkFDeEIsS0FBSyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztvQkFDdEQsU0FBUztnQkFDWCxDQUFDO2dCQUNELElBQUksU0FBUyxFQUFFLElBQUksS0FBSyx1QkFBdUIsRUFBRSxDQUFDO29CQUNoRCxtREFBbUQ7b0JBQ25ELE1BQU0sYUFBYSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLG1CQUFtQixDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUE0QixFQUFFLEVBQUU7d0JBQ3JJLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFROzRCQUFFLE9BQU8sU0FBUyxDQUFDO3dCQUM5QyxNQUFNLEtBQUssQ0FBQztvQkFDZCxDQUFDLENBQUMsQ0FBQztvQkFDSCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7d0JBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO3dCQUFDLFNBQVM7b0JBQUMsQ0FBQztnQkFDNUQsQ0FBQztnQkFDRCxNQUFNLEtBQUssQ0FBQyxTQUFTLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3BDLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLEtBQUssQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7SUFDSCxDQUFDLENBQUM7SUFDRixNQUFNLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzVCLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMifQ==

package/dist_ts/tsdisk.toolcaches.js

@@ -1,12 +1,12 @@
-import * as path from 'node:path';
+import { path } from './tsdisk.plugins.js';
 export const toolCacheMarkerFile = '.gitzone-tool-cache.json';
 export function parseToolCacheMarker(rawArg) {
     try {
         const marker = JSON.parse(rawArg);
-        if (typeof marker.owner === 'string' &&
-            typeof marker.kind === 'string' &&
-            marker.safeToPrune === true &&
-            typeof marker.createdAt === 'string' &&
+        if (typeof marker.owner === 'string' && marker.owner.length > 0 &&
+            typeof marker.kind === 'string' && marker.kind.length > 0 &&
+            typeof marker.safeToPrune === 'boolean' &&
+            typeof marker.createdAt === 'string' && Number.isFinite(Date.parse(marker.createdAt)) &&
             marker.schemaVersion === 1) {
             return marker;
         }
@@ -48,8 +48,10 @@ export function classifyToolCachePath(pathArg, markerArg) {
         return {
             ownerGuess: markerArg.owner,
             kind: markerArg.kind,
-            risk: markerArg.safeToPrune ? 'safe-marked' : 'review',
-            suggestedCleanupCommand: `rm -rf ${quotePath(pathArg)}`,
+            risk: 'review',
+            suggestedCleanupCommand: markerArg.safeToPrune
+                ? `report-only: ownership marker is not proof of inactivity; use the owning tool to review ${quotePath(pathArg)}`
+                : `protected: owner explicitly disallows pruning ${quotePath(pathArg)}`,
             marker: markerArg,
         };
     }
@@ -69,7 +71,7 @@ export function classifyToolCachePath(pathArg, markerArg) {
             suggestedCleanupCommand: `report-only: verify ownership before removing ${quotePath(path.dirname(pathArg))}`,
         };
     }
-    if (normalized.endsWith('/.nogit/tsbundle-temp')) {
+    if (/\/\.nogit\/tsbundle-temp(?:-[^/]+)?$/.test(normalized)) {
         return {
             ownerGuess: '@git.zone/tsbundle',
             kind: 'bundle-temp-workspace',
@@ -77,6 +79,22 @@ export function classifyToolCachePath(pathArg, markerArg) {
             suggestedCleanupCommand: `report-only: verify ownership before removing ${quotePath(pathArg)}`,
         };
     }
+    if (/\/\.nogit\/tsrust-matrix(?:-archive|-probes)?$/.test(normalized)) {
+        return {
+            ownerGuess: '@git.zone/tsrust',
+            kind: 'rust-matrix-artifacts',
+            risk: 'report-only',
+            suggestedCleanupCommand: `report-only: retained matrix runs may be needed for recovery; inspect ${quotePath(pathArg)}`,
+        };
+    }
+    if (/\/\.nogit\/(?:docker-registry\.[^/]+|docker-registry-v1-cache|dockerimagestore)$/.test(normalized)) {
+        return {
+            ownerGuess: '@git.zone/tsdocker',
+            kind: 'legacy-docker-registry-cache',
+            risk: 'report-only',
+            suggestedCleanupCommand: `report-only: verify release recovery requirements before removing ${quotePath(pathArg)}`,
+        };
+    }
     if (normalized.endsWith('/.nogit/docker-registry') || normalized.includes('/.nogit/docker-registry/')) {
         return {
             ownerGuess: '@git.zone/tsdocker',
@@ -103,4 +121,4 @@ export function classifyToolCachePath(pathArg, markerArg) {
     }
     return undefined;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHNkaXNrLnRvb2xjYWNoZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy90c2Rpc2sudG9vbGNhY2hlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssSUFBSSxNQUFNLFdBQVcsQ0FBQztBQUVsQyxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRywwQkFBMEIsQ0FBQztBQXlCOUQsTUFBTSxVQUFVLG9CQUFvQixDQUFDLE1BQWM7SUFDakQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQThCLENBQUM7UUFDL0QsSUFDRSxPQUFPLE1BQU0sQ0FBQyxLQUFLLEtBQUssUUFBUTtZQUNoQyxPQUFPLE1BQU0sQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUMvQixNQUFNLENBQUMsV0FBVyxLQUFLLElBQUk7WUFDM0IsT0FBTyxNQUFNLENBQUMsU0FBUyxLQUFLLFFBQVE7WUFDcEMsTUFBTSxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQzFCLENBQUM7WUFDRCxPQUFPLE1BQTBCLENBQUM7UUFDcEMsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLE9BQWU7SUFDaEMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUM7QUFDdEQsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLE9BQWU7SUFDckMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7QUFDbkQsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsT0FBZTtJQUN2QyxNQUFNLFVBQVUsR0FBRyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDM0MsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNsRCxJQUFJLFVBQVUsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuQixPQUFPLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFDRCxNQUFNLGVBQWUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQzNELElBQUksZUFBZSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE9BQU8sVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUNELE1BQU0saUJBQWlCLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hFLElBQUksaUJBQWlCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDeEQsSUFBSSxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEIsT0FBTyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQy9CLENBQUM7QUFFRCxNQUFNLFVBQVUscUJBQXFCLENBQUMsT0FBZSxFQUFFLFNBQTRCO0lBQ2pGLE1BQU0sVUFBVSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUMzQyxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ2QsT0FBTztZQUNMLFVBQVUsRUFBRSxTQUFTLENBQUMsS0FBSztZQUMzQixJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUk7WUFDcEIsSUFBSSxFQUFFLFNBQVMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsUUFBUTtZQUN0RCx1QkFBdUIsRUFBRSxVQUFVLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRTtZQUN2RCxNQUFNLEVBQUUsU0FBUztTQUNsQixDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksZ0VBQWdFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDdEYsT0FBTztZQUNMLFVBQVUsRUFBRSxrQkFBa0I7WUFDOUIsSUFBSSxFQUFFLDhCQUE4QjtZQUNwQyxJQUFJLEVBQUUsYUFBYTtZQUNuQix1QkFBdUIsRUFBRSxpREFBaUQsU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRTtTQUM3RyxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksMkVBQTJFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDakcsT0FBTztZQUNMLFVBQVUsRUFBRSxrQkFBa0I7WUFDOUIsSUFBSSxFQUFFLHNDQUFzQztZQUM1QyxJQUFJLEVBQUUsYUFBYTtZQUNuQix1QkFBdUIsRUFBRSxpREFBaUQsU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRTtTQUM3RyxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLENBQUM7UUFDakQsT0FBTztZQUNMLFVBQVUsRUFBRSxvQkFBb0I7WUFDaEMsSUFBSSxFQUFFLHVCQUF1QjtZQUM3QixJQUFJLEVBQUUsYUFBYTtZQUNuQix1QkFBdUIsRUFBRSxpREFBaUQsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1NBQy9GLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLHlCQUF5QixDQUFDLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLENBQUM7UUFDdEcsT0FBTztZQUNMLFVBQVUsRUFBRSxvQkFBb0I7WUFDaEMsSUFBSSxFQUFFLHVCQUF1QjtZQUM3QixJQUFJLEVBQUUsYUFBYTtZQUNuQix1QkFBdUIsRUFBRSxnREFBZ0QsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFDLG9DQUFvQztTQUNsSixDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUNsRixPQUFPO1lBQ0wsVUFBVSxFQUFFLHdCQUF3QjtZQUNwQyxJQUFJLEVBQUUsbUJBQW1CO1lBQ3pCLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLDhDQUE4QyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUMsNENBQTRDO1NBQ3hKLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLHVCQUF1QixDQUFDLEVBQUUsQ0FBQztRQUNqRCxPQUFPO1lBQ0wsVUFBVSxFQUFFLGtCQUFrQjtZQUM5QixJQUFJLEVBQUUsbUJBQW1CO1lBQ3pCLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLDhDQUE4QyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUMsNENBQTRDO1NBQ3hKLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHNkaXNrLnRvb2xjYWNoZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy90c2Rpc2sudG9vbGNhY2hlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsSUFBSSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFM0MsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsMEJBQTBCLENBQUM7QUF5QjlELE1BQU0sVUFBVSxvQkFBb0IsQ0FBQyxNQUFjO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUE4QixDQUFDO1FBQy9ELElBQ0UsT0FBTyxNQUFNLENBQUMsS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQzNELE9BQU8sTUFBTSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUN6RCxPQUFPLE1BQU0sQ0FBQyxXQUFXLEtBQUssU0FBUztZQUN2QyxPQUFPLE1BQU0sQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDckYsTUFBTSxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQzFCLENBQUM7WUFDRCxPQUFPLE1BQTBCLENBQUM7UUFDcEMsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLE9BQWU7SUFDaEMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUM7QUFDdEQsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLE9BQWU7SUFDckMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7QUFDbkQsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsT0FBZTtJQUN2QyxNQUFNLFVBQVUsR0FBRyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDM0MsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNsRCxJQUFJLFVBQVUsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuQixPQUFPLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFDRCxNQUFNLGVBQWUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQzNELElBQUksZUFBZSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE9BQU8sVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUNELE1BQU0saUJBQWlCLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hFLElBQUksaUJBQWlCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDeEQsSUFBSSxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEIsT0FBTyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQy9CLENBQUM7QUFFRCxNQUFNLFVBQVUscUJBQXFCLENBQUMsT0FBZSxFQUFFLFNBQTRCO0lBQ2pGLE1BQU0sVUFBVSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUMzQyxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ2QsT0FBTztZQUNMLFVBQVUsRUFBRSxTQUFTLENBQUMsS0FBSztZQUMzQixJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUk7WUFDcEIsSUFBSSxFQUFFLFFBQVE7WUFDZCx1QkFBdUIsRUFBRSxTQUFTLENBQUMsV0FBVztnQkFDNUMsQ0FBQyxDQUFDLDJGQUEyRixTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUU7Z0JBQ2pILENBQUMsQ0FBQyxpREFBaUQsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQ3pFLE1BQU0sRUFBRSxTQUFTO1NBQ2xCLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxnRUFBZ0UsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUN0RixPQUFPO1lBQ0wsVUFBVSxFQUFFLGtCQUFrQjtZQUM5QixJQUFJLEVBQUUsOEJBQThCO1lBQ3BDLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLGlEQUFpRCxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxFQUFFO1NBQzdHLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSwyRUFBMkUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNqRyxPQUFPO1lBQ0wsVUFBVSxFQUFFLGtCQUFrQjtZQUM5QixJQUFJLEVBQUUsc0NBQXNDO1lBQzVDLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLGlEQUFpRCxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxFQUFFO1NBQzdHLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxzQ0FBc0MsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUM1RCxPQUFPO1lBQ0wsVUFBVSxFQUFFLG9CQUFvQjtZQUNoQyxJQUFJLEVBQUUsdUJBQXVCO1lBQzdCLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLGlEQUFpRCxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUU7U0FDL0YsQ0FBQztJQUNKLENBQUM7SUFFRCxJQUFJLGdEQUFnRCxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3RFLE9BQU87WUFDTCxVQUFVLEVBQUUsa0JBQWtCO1lBQzlCLElBQUksRUFBRSx1QkFBdUI7WUFDN0IsSUFBSSxFQUFFLGFBQWE7WUFDbkIsdUJBQXVCLEVBQUUseUVBQXlFLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRTtTQUN2SCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksa0ZBQWtGLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDeEcsT0FBTztZQUNMLFVBQVUsRUFBRSxvQkFBb0I7WUFDaEMsSUFBSSxFQUFFLDhCQUE4QjtZQUNwQyxJQUFJLEVBQUUsYUFBYTtZQUNuQix1QkFBdUIsRUFBRSxxRUFBcUUsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1NBQ25ILENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLHlCQUF5QixDQUFDLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLENBQUM7UUFDdEcsT0FBTztZQUNMLFVBQVUsRUFBRSxvQkFBb0I7WUFDaEMsSUFBSSxFQUFFLHVCQUF1QjtZQUM3QixJQUFJLEVBQUUsYUFBYTtZQUNuQix1QkFBdUIsRUFBRSxnREFBZ0QsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFDLG9DQUFvQztTQUNsSixDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUNsRixPQUFPO1lBQ0wsVUFBVSxFQUFFLHdCQUF3QjtZQUNwQyxJQUFJLEVBQUUsbUJBQW1CO1lBQ3pCLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLDhDQUE4QyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUMsNENBQTRDO1NBQ3hKLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLHVCQUF1QixDQUFDLEVBQUUsQ0FBQztRQUNqRCxPQUFPO1lBQ0wsVUFBVSxFQUFFLGtCQUFrQjtZQUM5QixJQUFJLEVBQUUsbUJBQW1CO1lBQ3pCLElBQUksRUFBRSxhQUFhO1lBQ25CLHVCQUF1QixFQUFFLDhDQUE4QyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUMsNENBQTRDO1NBQ3hKLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@git.zone/tsdisk",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "private": false,
   "description": "A disk usage diagnostic CLI for finding large files, caches, logs, and Docker storage.",
   "main": "dist_ts/index.js",
@@ -20,9 +20,9 @@
     "license.md"
   ],
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tstest": "^3.6.6",
-    "@types/node": "^25.9.3"
+    "@git.zone/tsbuild": "^4.5.0",
+    "@git.zone/tstest": "^6.1.1",
+    "@types/node": "^26.5.1"
   },
   "scripts": {
     "test": "(pnpm run build && tstest test/ --verbose)",

package/readme.md

@@ -26,7 +26,7 @@ tsdisk
 
 The tool prints a structured report covering filesystem usage, top-level `du` breakdowns, known user and system cache paths, project-local tool caches on mounted workspaces such as `/mnt/data`, systemd journal usage, deleted open files, and Docker context storage.
 
-It asks for `sudo` because root-owned filesystem paths and deleted open files require elevated permissions. Cleanup commands are printed as suggestions only; `tsdisk` does not delete caches or prune Docker data.
+It asks for `sudo` because root-owned filesystem paths and deleted open files require elevated permissions. The default diagnostic command does not delete caches or prune Docker data. The explicit `cleanup` command previews owning-tool cleanup and requires `--apply` to execute it.
 
 ### Project Tool Cache Diagnostics
 
@@ -34,13 +34,14 @@ It asks for `sudo` because root-owned filesystem paths and deleted open files re
 
 - Deno self-extracting staging such as `dist/binaries/.*/.deno_compile_node_modules`
 - Release binary staging under `.nogit/release-binaries/.*/.deno_compile_node_modules`
-- tsbundle temp workspaces under `.nogit/tsbundle-temp`
+- tsbundle temp workspaces under `.nogit/tsbundle-temp` and `.nogit/tsbundle-temp-*`
+- Retained Rust matrix directories and renamed legacy Docker registries (report-only)
 - tsdocker local registry caches under `.nogit/docker-registry`
 - Rust target caches under `rust/target`, `ts_rust/target`, and marked `.nogit/tsrust-target`
 - Stopped `tsdocker-registry-*` containers and their bind mounts
 - Docker buildx state volumes with zero container links, as report-only findings
 
-Marked caches using `.gitzone-tool-cache.json` are classified as tool-owned. Unmarked legacy paths are report-only and do not receive destructive cleanup commands.
+Markers identify ownership, never prove inactivity. Marked caches require review; `safeToPrune: false` remains explicitly protected. No cache finding receives a raw `rm -rf` command. Unmarked legacy paths, bundle intermediates, and retained matrix runs remain report-only. Bundle cleanup belongs to tsbundle’s own stale-workspace lifecycle.
 
 ## Environment
 
@@ -53,31 +54,49 @@ Marked caches using `.gitzone-tool-cache.json` are classified as tool-owned. Unm
 | `TSDISK_KEEP_NCDU_EXPORT` | Keep the `ncdu` export for later browsing | unset |
 | `TSDISK_INSTALL_NCDU` | Install `ncdu` with `apt-get` if missing | prompt |
 
-## Commands
+## Structured Diagnostics
 
 ```bash
+tsdisk scan --root /mnt/data/foss.global --json
+tsdisk scan --root /mnt/data/project-a --root /mnt/data/project-b
 tsdisk --json
 tsdisk --help
 tsdisk --version
 ```
 
-`tsdisk --json` prints the project tool-cache diagnostics as structured JSON:
-
-```json
-{
-  "toolCaches": [
-    {
-      "path": "/mnt/data/project/.nogit/tsbundle-temp",
-      "ownerGuess": "@git.zone/tsbundle",
-      "kind": "bundle-temp-workspace",
-      "risk": "report-only",
-      "suggestedCleanupCommand": "report-only: verify ownership before removing \"/mnt/data/project/.nogit/tsbundle-temp\"",
-      "bytes": 123456
-    }
-  ]
-}
+`scan` and `--json` run bounded, noninteractive diagnostics without requesting sudo or installing tools. `--root` selects project-cache discovery and workspace size roots; host filesystem, home/cache, journal, deleted-open-file, and Docker diagnostics are still included. Without roots, discovery uses `/mnt/data` when present and the current directory. The original `tsdisk` human report remains available.
+
+The JSON object includes `schemaVersion`, `generatedAt`, `roots`, `toolCaches`, `issues`, `sections`, and `complete`. Each command section records its command, arguments, exit code, stdout, stderr, and completeness. Missing tools and insufficient permissions remain visible. JSON output contains one document; diagnostics never print progress into it.
+
+Cache discovery records read failures, invalid markers, symlinks, filesystem boundaries, and exhausted depth, entry, or time budgets. Unknown sizes stay absent rather than becoming zero. Symlink roots and roots with symlink ancestors are rejected. Standard dependency and generated-code directories are intentionally excluded. Cache byte sizes are allocated disk usage, not a promise of reclaimable space: parent/child findings and hardlinks may overlap.
+
+Discovery is bounded to depth 8, 50,000 visited entries, and 45 seconds per root. Sizing has a 45-second budget and a 500-cache limit. Additional command diagnostics have a 120-second total budget, with at most 15 seconds per command. Limits are cooperative between filesystem operations. `scan` exits `0` for a complete report, `2` for an incomplete report, or `1` for invalid input/failure. Consumers of the earlier `--json` shape can still read `toolCaches`.
+
+## Cleanup
+
+```bash
+# Project paths are explicit; cleanup never recurses across a workspace.
+tsdisk cleanup --root /mnt/data/project --only=docker
+# pnpm has no prune dry-run: preview identifies its configured store.
+tsdisk cleanup --root /mnt/data/project --only=pnpm --json
+# Execute only after reviewing the command and its scope.
+tsdisk cleanup --root /mnt/data/project --only=pnpm --apply --yes
 ```
 
+Cleanup defaults to a preview of `rust,docker` for the current project. `--dry-run` explicitly selects preview mode. Repeat `--root` to select multiple projects, and use `--only=rust,docker,pnpm` to choose categories. `pnpm` is opt-in because the configured store may be shared. Tsdisk never deletes a pnpm store directory.
+
+Rust requires `@git.zone/tsrust` 1.13.2 or later; Docker requires `@git.zone/tsdocker` 3.6.0 or later. Rust and Docker use their project-installed `node_modules/.bin/tsrust` and `tsdocker`; missing tools block the batch without downloading anything. Rust previews pass `--days 14` by default; `--days N` changes only Rust retention. Docker cleanup uses the owning tool’s identity, mount, and build checks; its abandoned-container scope can span projects in the current Docker context. Registry directories are project-local. Bundle, matrix, and legacy registry findings do not become execution targets.
+
+Rust rechecks retention, markers, cache identity, and active use at execution time. Active Rust tools or inaccessible process state (including protected same-user processes) block removal. Linux tsrust builds and pruning share a cache guard.
+
+All owner previews must succeed without truncated output before any execution. `--apply` prints the plan and asks for confirmation; noninteractive or JSON execution additionally requires `--yes`. Each apply invokes the owning tool again so its safety checks run at execution time. A failed command stops subsequent actions and returns a nonzero exit code; completed actions are not rolled back. Commands time out after 120 seconds for preview or 240 seconds for apply, with a five-second termination grace period. Review owning-tool state before retrying an interrupted operation.
+
+Cleanup runs as the project owner, without sudo, and refuses filesystem roots and symlink project paths. No plans or application state are persisted. This is a Linux CLI and uses `du`, `df`, `findmnt`, and GNU `timeout` from the host.
+
+## Library API
+
+`scanWorkspace(root, { maxDepth, maxEntries, timeoutMs })` returns findings, issues, completion status, and the visited-entry count. `collectProjectToolCacheReport(context, roots?)` adds sizing. `collectDiskReport(context, roots?)` adds host command diagnostics. The existing classification and byte-formatting exports remain available. `parseCliOptions(args)` and `createCleanupPlan(options)` expose validated CLI options and cleanup command plans; creating a plan does not execute cleanup.
+
 ## License and Legal Information
 
 This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository license file.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@git.zone/tsdisk',
-  version: '1.1.0',
+  version: '1.2.1',
   description: 'A disk usage diagnostic CLI for finding large files, caches, logs, and Docker storage.'
 }

package/ts/index.ts

@@ -1,8 +1,13 @@
 export { commitinfo } from './00_commitinfo_data.js';
 export {
   formatBytes,
+  collectDiskReport,
+  collectProjectToolCacheReport,
   main,
   parseDuOutput,
   runCli,
 } from './tsdisk.cli.js';
 export * from './tsdisk.toolcaches.js';
+export * from './tsdisk.scan.js';
+export * from './tsdisk.cleanup.js';
+export type { IRuntimeContext, IDiagnosticSection } from './tsdisk.cli.js';

package/ts/tsdisk.cleanup.ts

@@ -0,0 +1,120 @@
+import * as plugins from './tsdisk.plugins.js';
+
+export type TCleanupCategory = 'rust' | 'docker' | 'pnpm';
+
+export interface ICleanupAction {
+  category: TCleanupCategory;
+  cwd: string;
+  command: string;
+  previewArgs?: string[];
+  applyArgs: string[];
+  scope: string;
+  blocked?: string;
+}
+
+export interface ICleanupPlan {
+  dryRun: boolean;
+  actions: ICleanupAction[];
+}
+
+export interface ICliOptions {
+  command: 'diagnose' | 'scan' | 'cleanup' | 'help' | 'version';
+  roots: string[];
+  categories: TCleanupCategory[];
+  json: boolean;
+  apply: boolean;
+  yes: boolean;
+  days: number;
+}
+
+export function parseCliOptions(args: string[]): ICliOptions {
+  const options: ICliOptions = { command: 'diagnose', roots: [], categories: ['rust', 'docker'], json: false, apply: false, yes: false, days: 14 };
+  let commandSeen = false;
+  let dryRun = false;
+  let cleanupOption = false;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === '--help' || arg === '-h') { options.command = 'help'; return options; }
+    if (arg === '--version' || arg === '-v') { options.command = 'version'; return options; }
+    if (arg === 'scan' || arg === 'cleanup') {
+      if (commandSeen) throw new Error('Specify one command: scan or cleanup.');
+      options.command = arg;
+      commandSeen = true;
+    } else if (arg === '--json') options.json = true;
+    else if (arg === '--apply') { options.apply = true; cleanupOption = true; }
+    else if (arg === '--yes' || arg === '-y') { options.yes = true; cleanupOption = true; }
+    else if (arg === '--dry-run' || arg === '-n') { dryRun = true; cleanupOption = true; }
+    else if (['--root', '--only', '--days'].some((flag) => arg === flag || arg.startsWith(`${flag}=`))) {
+      const separator = arg.indexOf('=');
+      const name = separator < 0 ? arg : arg.slice(0, separator);
+      const value = separator < 0 ? args[++index] : arg.slice(separator + 1);
+      if (!value || value.startsWith('--')) throw new Error(`Missing value for ${name}.`);
+      if (name === '--root') options.roots.push(plugins.path.resolve(value));
+      else if (name === '--only') {
+        cleanupOption = true;
+        const values = value.split(',');
+        if (values.some((category) => !['rust', 'docker', 'pnpm'].includes(category))) throw new Error('Cleanup categories: rust,docker,pnpm.');
+        options.categories = [...new Set(values)] as TCleanupCategory[];
+      } else {
+        cleanupOption = true;
+        options.days = Number(value);
+        if (!Number.isSafeInteger(options.days) || options.days < 1) throw new Error('--days must be a positive integer.');
+      }
+    } else throw new Error(`Unknown argument: ${arg}`);
+  }
+  if (cleanupOption && options.command !== 'cleanup') throw new Error('Cleanup options require the cleanup command.');
+  if (dryRun && options.apply) throw new Error('--dry-run and --apply cannot be combined.');
+  if (options.yes && !options.apply) throw new Error('--yes requires --apply.');
+  if (options.command === 'diagnose' && (options.roots.length || options.json)) options.command = 'scan';
+  options.roots = [...new Set(options.roots)];
+  return options;
+}
+
+/** Build project-scoped owner commands. No discovered marker authorizes deletion. */
+export async function createCleanupPlan(options: ICliOptions): Promise<ICleanupPlan> {
+  if (options.command !== 'cleanup') throw new Error('Cleanup command required.');
+  if (!Number.isSafeInteger(options.days) || options.days < 1) throw new Error('Invalid retention period.');
+  if (!options.categories.length || options.categories.some((category) => !['rust', 'docker', 'pnpm'].includes(category))) throw new Error('Invalid cleanup category.');
+  const plan: ICleanupPlan = { dryRun: !options.apply, actions: [] };
+  for (const root of new Set(options.roots.length ? options.roots : [process.cwd()])) {
+    const cwd = plugins.path.resolve(root);
+    const stat = await plugins.fs.lstat(cwd);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || await plugins.fs.realpath(cwd) !== cwd || cwd === plugins.path.parse(cwd).root) {
+      throw new Error(`Cleanup requires a real project directory: ${cwd}`);
+    }
+    // Running project-installed tools as root would grant project code host-wide authority.
+    if (process.getuid?.() === 0) throw new Error('Run cleanup as the project owner, without sudo.');
+    if (process.getuid && stat.uid !== process.getuid()) throw new Error(`Cleanup root is not owned by the current user: ${cwd}`);
+    for (const category of new Set(options.categories)) {
+      if (category === 'pnpm') {
+        plan.actions.push({ category, cwd, command: 'pnpm', applyArgs: ['store', 'prune'], scope: 'Prune unreferenced packages from the pnpm store configured for this project. The store may be shared. pnpm provides no prune dry-run.' });
+        continue;
+      }
+      const binary = category === 'rust' ? 'tsrust' : 'tsdocker';
+      const command = plugins.path.join(cwd, 'node_modules', '.bin', binary);
+      const args = category === 'rust' ? ['prune', '--days', String(options.days)] : ['prune'];
+      const action: ICleanupAction = {
+        category, cwd, command, previewArgs: args, applyArgs: [...args, '--apply'],
+        scope: category === 'rust'
+          ? `Project's marked managed Rust targets; newest-file retention ${options.days} days, revalidated by tsrust.`
+          : 'Project registry caches and tsdocker-owned abandoned containers in the current Docker context; container scope may include other projects. tsdocker revalidates owner identity and active mounts.',
+      };
+      try {
+        await plugins.fs.access(command, plugins.constants.X_OK);
+        const packagePath = plugins.path.join(cwd, 'node_modules', '@git.zone', binary, 'package.json');
+        const manifest = JSON.parse(await plugins.fs.readFile(packagePath, 'utf8')) as { name?: string; version?: string };
+        if (manifest.name !== `@git.zone/${binary}`) throw new Error('Unexpected owning package.');
+        const version = /^(\d+)\.(\d+)\.(\d+)$/.exec(manifest.version ?? '')?.slice(1).map(Number);
+        const minimum = category === 'docker' ? [3, 6, 0] : [1, 13, 2];
+        const different = version?.findIndex((part, index) => part !== minimum[index]);
+        if (!version || (different !== undefined && different !== -1 && version[different] < minimum[different])) {
+          action.blocked = `@git.zone/${binary} ${minimum.join('.')} or later is required for the documented prune contract.`;
+        }
+      } catch {
+        action.blocked = `Install a current @git.zone/${binary} in this project before cleanup. No tool is downloaded automatically.`;
+      }
+      plan.actions.push(action);
+    }
+  }
+  return plan;
+}