@litfamily/litopencode 1.0.1 → 1.0.2

package/dist/skill-loop/storage.js

@@ -1,817 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { spawnSync } from "node:child_process";
-import fs from "node:fs/promises";
-import { constants as fsConstants } from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import { sameStableDirectoryIdentity, sameStableStatIdentity, stableStatIdentity } from "../stable-identity.js";
-const noFollowRead = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0);
-const lockRetryMs = 10;
-const lockTimeoutMs = 5_000;
-const ownerlessLockGraceMs = 250;
-const capabilityBrand = Symbol("skill-loop-lock-capability");
-const capabilities = new WeakMap();
-function errorCode(error) {
-    return error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : undefined;
-}
-function unsafe() {
-    throw new Error("SKILL_LOOP_PATH_UNSAFE");
-}
-function isContained(base, target) {
-    const relative = path.relative(path.resolve(base), path.resolve(target));
-    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
-}
-async function lstat(file) {
-    try {
-        return await fs.lstat(file);
-    }
-    catch (error) {
-        if (errorCode(error) === "ENOENT")
-            return undefined;
-        throw error;
-    }
-}
-function assertDirectory(stat) {
-    if (stat === undefined || stat.isSymbolicLink() || !stat.isDirectory())
-        unsafe();
-}
-function assertRegular(stat) {
-    if (stat === undefined || stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1)
-        unsafe();
-}
-async function assertNoUserControlledSymlinkAncestor(target) {
-    const resolved = path.resolve(target);
-    const parsed = path.parse(resolved);
-    let current = parsed.root;
-    for (const component of resolved.slice(parsed.root.length).split(path.sep).filter(Boolean)) {
-        const candidate = path.join(current, component);
-        const observed = await lstat(candidate);
-        if (observed === undefined)
-            break;
-        if (observed.isSymbolicLink()) {
-            const parent = await fs.lstat(current);
-            const trustedSystemLink = observed.uid === 0 && parent.uid === 0 && (parent.mode & 0o022) === 0;
-            if (!trustedSystemLink)
-                unsafe();
-        }
-        current = candidate;
-    }
-}
-async function createDirectoryWithoutUserSymlinks(target) {
-    const resolved = path.resolve(target);
-    const parsed = path.parse(resolved);
-    let current = parsed.root;
-    for (const component of resolved.slice(parsed.root.length).split(path.sep).filter(Boolean)) {
-        const candidate = path.join(current, component);
-        const observed = await lstat(candidate);
-        if (observed === undefined) {
-            try {
-                await fs.mkdir(candidate, { mode: 0o700 });
-            }
-            catch (error) {
-                if (errorCode(error) !== "EEXIST")
-                    throw error;
-            }
-            assertDirectory(await lstat(candidate));
-        }
-        else if (observed.isSymbolicLink()) {
-            const parent = await fs.lstat(current);
-            if (observed.uid !== 0 || parent.uid !== 0 || (parent.mode & 0o022) !== 0)
-                unsafe();
-        }
-        else {
-            assertDirectory(observed);
-        }
-        current = candidate;
-    }
-}
-export async function pinPhysicalDirectory(directory, create = false) {
-    const lexical = path.resolve(directory);
-    await assertNoUserControlledSymlinkAncestor(lexical);
-    if (create)
-        await createDirectoryWithoutUserSymlinks(lexical);
-    const physical = await fs.realpath(lexical).catch((error) => {
-        if (errorCode(error) === "ENOENT")
-            unsafe();
-        throw error;
-    });
-    const observed = await fs.lstat(physical);
-    assertDirectory(observed);
-    const identity = stableStatIdentity(observed);
-    return Object.freeze({ lexical, physical, ...identity, dev: Number(identity.dev), ino: Number(identity.ino) });
-}
-export async function pinPhysicalDirectoryIfPresent(directory) {
-    const lexical = path.resolve(directory);
-    await assertNoUserControlledSymlinkAncestor(lexical);
-    if (await lstat(lexical) === undefined)
-        return undefined;
-    return pinPhysicalDirectory(lexical);
-}
-export async function canonicalPhysicalPath(target) {
-    const lexical = path.resolve(target);
-    await assertNoUserControlledSymlinkAncestor(lexical);
-    let existing = lexical;
-    const suffix = [];
-    while (await lstat(existing) === undefined) {
-        const parent = path.dirname(existing);
-        if (parent === existing)
-            unsafe();
-        suffix.unshift(path.basename(existing));
-        existing = parent;
-    }
-    const pin = await pinPhysicalDirectory(existing);
-    return path.join(pin.physical, ...suffix);
-}
-export async function assertPhysicalDirectoryPin(pin) {
-    await assertNoUserControlledSymlinkAncestor(pin.lexical);
-    const physical = await fs.realpath(pin.lexical).catch(() => unsafe());
-    const observed = await fs.lstat(pin.physical).catch(() => unsafe());
-    assertDirectory(observed);
-    if (physical !== pin.physical || !sameStableDirectoryIdentity(stableStatIdentity(observed), pin))
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-export async function pinPhysicalSkillLoopRoots(projectRoot, configRoot) {
-    const project = await pinPhysicalDirectory(projectRoot);
-    const config = await pinPhysicalDirectory(configRoot, true);
-    const skills = await pinPhysicalDirectory(path.join(config.physical, "skills"), true);
-    await assertPhysicalDirectoryPin(project);
-    await assertPhysicalDirectoryPin(config);
-    await assertPhysicalDirectoryPin(skills);
-    return Object.freeze({ project, config, skills });
-}
-async function runtimeLocation(projectRoot, target) {
-    const lexicalProject = path.resolve(projectRoot);
-    const lexicalRuntime = path.join(lexicalProject, ".litopencode");
-    const lexicalTarget = path.resolve(target);
-    const project = await pinPhysicalDirectory(lexicalProject);
-    const physicalRuntime = path.join(project.physical, ".litopencode");
-    if (!isContained(lexicalRuntime, lexicalTarget) && !isContained(physicalRuntime, lexicalTarget))
-        unsafe();
-    const relative = isContained(lexicalRuntime, lexicalTarget)
-        ? path.relative(lexicalProject, lexicalTarget)
-        : path.relative(project.physical, lexicalTarget);
-    return { project, runtime: path.join(project.physical, ".litopencode"), target: path.join(project.physical, relative) };
-}
-export async function ensureSafeRuntimeDirectory(projectRoot, directory) {
-    const location = await runtimeLocation(projectRoot, directory);
-    let current = location.project.physical;
-    for (const component of path.relative(location.project.physical, location.target).split(path.sep).filter(Boolean)) {
-        current = path.join(current, component);
-        const observed = await lstat(current);
-        if (observed !== undefined) {
-            assertDirectory(observed);
-            continue;
-        }
-        try {
-            await fs.mkdir(current, { mode: 0o700 });
-        }
-        catch (error) {
-            if (errorCode(error) !== "EEXIST")
-                throw error;
-        }
-        assertDirectory(await lstat(current));
-    }
-    await assertPhysicalDirectoryPin(location.project);
-}
-async function safeRuntimeDirectoryExists(projectRoot, directory) {
-    const location = await runtimeLocation(projectRoot, directory);
-    let current = location.project.physical;
-    for (const component of path.relative(location.project.physical, location.target).split(path.sep).filter(Boolean)) {
-        current = path.join(current, component);
-        const observed = await lstat(current);
-        if (observed === undefined)
-            return { exists: false, target: location.target };
-        assertDirectory(observed);
-    }
-    await assertPhysicalDirectoryPin(location.project);
-    return { exists: true, target: location.target };
-}
-export async function assertSafeRuntimeFileForWrite(projectRoot, file) {
-    const location = await runtimeLocation(projectRoot, file);
-    await ensureSafeRuntimeDirectory(projectRoot, path.dirname(file));
-    const observed = await lstat(location.target);
-    if (observed !== undefined)
-        assertRegular(observed);
-    await assertPhysicalDirectoryPin(location.project);
-}
-export async function readSafeRuntimeFile(projectRoot, file, options = {}) {
-    const directory = await safeRuntimeDirectoryExists(projectRoot, path.dirname(file));
-    if (!directory.exists) {
-        if (options.allowMissing !== false)
-            return undefined;
-        throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
-    }
-    const target = path.join(directory.target, path.basename(file));
-    const observed = await lstat(target);
-    if (observed === undefined) {
-        if (options.allowMissing !== false)
-            return undefined;
-        throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
-    }
-    assertRegular(observed);
-    if (options.maxBytes !== undefined && observed.size > options.maxBytes)
-        throw new Error("SKILL_LOOP_FILE_TOO_LARGE");
-    let handle;
-    try {
-        handle = await fs.open(target, noFollowRead);
-    }
-    catch (error) {
-        if (errorCode(error) === "ELOOP")
-            unsafe();
-        throw error;
-    }
-    try {
-        const descriptor = await handle.stat();
-        if (!descriptor.isFile() || descriptor.nlink !== 1 || !sameStableStatIdentity(stableStatIdentity(descriptor), stableStatIdentity(observed)))
-            unsafe();
-        const bytes = await handle.readFile();
-        if (options.maxBytes !== undefined && bytes.byteLength > options.maxBytes)
-            throw new Error("SKILL_LOOP_FILE_TOO_LARGE");
-        const final = await lstat(target);
-        if (final === undefined || final.isSymbolicLink() || !final.isFile() || final.nlink !== 1 ||
-            !sameStableStatIdentity(stableStatIdentity(final), stableStatIdentity(descriptor)))
-            unsafe();
-        return bytes;
-    }
-    finally {
-        await handle.close();
-    }
-}
-export async function writeSafeRuntimeFile(projectRoot, file, bytes) {
-    const location = await runtimeLocation(projectRoot, file);
-    const target = location.target;
-    await ensureSafeRuntimeDirectory(projectRoot, path.dirname(file));
-    const parentBefore = await fs.lstat(path.dirname(target));
-    assertDirectory(parentBefore);
-    const before = await lstat(target);
-    if (before !== undefined)
-        assertRegular(before);
-    const temporary = path.join(path.dirname(target), `.${path.basename(target)}.${randomUUID()}.tmp`);
-    let handle;
-    try {
-        handle = await fs.open(temporary, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | (fsConstants.O_NOFOLLOW ?? 0), 0o600);
-        await handle.writeFile(bytes);
-        await handle.sync();
-        await handle.chmod(0o600);
-        await handle.close();
-        handle = undefined;
-        await assertPhysicalDirectoryPin(location.project);
-        const parentAfter = await fs.lstat(path.dirname(target));
-        if (!sameStableDirectoryIdentity(stableStatIdentity(parentAfter), stableStatIdentity(parentBefore)))
-            throw new Error("SKILL_LOOP_CONFLICT");
-        const current = await lstat(target);
-        if ((before === undefined) !== (current === undefined) ||
-            (before !== undefined && current !== undefined && !sameStableStatIdentity(stableStatIdentity(before), stableStatIdentity(current)))) {
-            throw new Error("SKILL_LOOP_CONFLICT");
-        }
-        if (current !== undefined)
-            assertRegular(current);
-        await fs.rename(temporary, target);
-        await syncDirectory(path.dirname(target));
-    }
-    catch (error) {
-        if (handle !== undefined)
-            await handle.close().catch(() => undefined);
-        await fs.rm(temporary, { force: true }).catch(() => undefined);
-        throw error;
-    }
-}
-export async function removeSafeRuntimeFile(projectRoot, file) {
-    const directory = await safeRuntimeDirectoryExists(projectRoot, path.dirname(file));
-    if (!directory.exists)
-        return;
-    const target = path.join(directory.target, path.basename(file));
-    const observed = await lstat(target);
-    if (observed === undefined)
-        return;
-    assertRegular(observed);
-    await fs.unlink(target);
-    await syncDirectory(path.dirname(target));
-}
-export async function syncDirectory(directory) {
-    const stat = await fs.lstat(directory);
-    assertDirectory(stat);
-    const handle = await fs.open(directory, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
-    try {
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-const anchoredSkillMutationWorker = String.raw `
-const fs = require("node:fs");
-const path = require("node:path");
-const crypto = require("node:crypto");
-function fail() { process.exit(70); }
-function relativeName(value) {
-  if (typeof value !== "string" || value === "" || path.isAbsolute(value) || path.basename(value) !== value || value === "." || value === "..") fail();
-  return value;
-}
-function safeTreeEntry(file) {
-  const stat = fs.lstatSync(file);
-  if (stat.isSymbolicLink()) fail();
-  return stat;
-}
-function sameIdentity(left, right) {
-  return Number(left.dev) === Number(right.dev) && Number(left.ino) === Number(right.ino) &&
-    Number(left.ctimeMs) === Number(right.ctimeMs) && Number(left.birthtimeMs) === Number(right.birthtimeMs);
-}
-function sameDirectoryIdentity(left, right) {
-  return Number(left.dev) === Number(right.dev) && Number(left.ino) === Number(right.ino) &&
-    Number(left.birthtimeMs) === Number(right.birthtimeMs);
-}
-function identityOf(stat) {
-  return { dev: Number(stat.dev), ino: Number(stat.ino), ctimeMs: Number(stat.ctimeMs), birthtimeMs: Number(stat.birthtimeMs) };
-}
-function expectedFiles(request) {
-  if (!Array.isArray(request.files) || request.files.length > 4096) fail();
-  const result = new Map();
-  for (const item of request.files) {
-    if (!item || typeof item.file !== "string" || path.isAbsolute(item.file) || item.file.split(/[\\/]/u).some((part) => !part || part === "." || part === "..") ||
-      typeof item.digest !== "string" || !/^[a-f0-9]{64}$/u.test(item.digest) || !Number.isInteger(item.size) || item.size < 0 || result.has(item.file)) fail();
-    result.set(item.file, item);
-  }
-  return result;
-}
-function copyTree(source, destination, budget, expected, prefix = "") {
-  const stat = safeTreeEntry(source);
-  if (!stat.isDirectory()) fail();
-  fs.mkdirSync(destination, { mode: 0o700 });
-  const entries = fs.readdirSync(source, { withFileTypes: true });
-  budget.entries += entries.length;
-  if (budget.entries > 4096) fail();
-  for (const entry of entries) {
-    const from = path.join(source, entry.name);
-    const to = path.join(destination, entry.name);
-    const item = safeTreeEntry(from);
-    if (item.isDirectory()) {
-      copyTree(from, to, budget, expected, prefix === "" ? entry.name : path.posix.join(prefix, entry.name));
-      continue;
-    }
-    if (!item.isFile() || item.nlink !== 1 || item.size > 8 * 1024 * 1024) fail();
-    budget.bytes += item.size;
-    if (budget.bytes > 32 * 1024 * 1024) fail();
-    const input = fs.openSync(from, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-    const output = fs.openSync(to, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
-    try {
-      const opened = fs.fstatSync(input);
-      if (!opened.isFile() || opened.nlink !== 1 || !sameIdentity(opened, item) || opened.size !== item.size) fail();
-      const buffer = Buffer.allocUnsafe(64 * 1024);
-      let offset = 0;
-      const hash = crypto.createHash("sha256");
-      while (offset < item.size) {
-        const read = fs.readSync(input, buffer, 0, Math.min(buffer.length, item.size - offset), offset);
-        if (read <= 0) fail();
-        hash.update(buffer.subarray(0, read));
-        let written = 0;
-        while (written < read) written += fs.writeSync(output, buffer, written, read - written);
-        offset += read;
-      }
-      const fileName = prefix === "" ? entry.name : path.posix.join(prefix, entry.name);
-      const expectedFile = expected.get(fileName);
-      if (!expectedFile || expectedFile.size !== item.size || expectedFile.digest !== hash.digest("hex")) fail();
-      budget.seen.add(fileName);
-      const final = safeTreeEntry(from);
-      if (!sameIdentity(final, opened) || final.size !== opened.size) fail();
-      fs.fsyncSync(output);
-    } finally {
-      fs.closeSync(input);
-      fs.closeSync(output);
-    }
-  }
-  const descriptor = fs.openSync(destination, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-  try { fs.fsyncSync(descriptor); } finally { fs.closeSync(descriptor); }
-}
-function verifyTree(root, expected, prefix = "", seen = new Set()) {
-  const rootStat = safeTreeEntry(root);
-  if (!rootStat.isDirectory()) fail();
-  const entries = fs.readdirSync(root, { withFileTypes: true });
-  for (const entry of entries) {
-    const target = path.join(root, entry.name);
-    const relative = prefix === "" ? entry.name : path.posix.join(prefix, entry.name);
-    const stat = safeTreeEntry(target);
-    if (stat.isDirectory()) { verifyTree(target, expected, relative, seen); continue; }
-    if (!stat.isFile() || stat.nlink !== 1 || stat.size > 8 * 1024 * 1024) fail();
-    const descriptor = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-    try {
-      const opened = fs.fstatSync(descriptor);
-      if (!sameIdentity(opened, stat) || opened.size !== stat.size) fail();
-      const bytes = fs.readFileSync(descriptor);
-      const final = safeTreeEntry(target);
-      const expectedFile = expected.get(relative);
-      if (!expectedFile || expectedFile.size !== bytes.length || expectedFile.digest !== crypto.createHash("sha256").update(bytes).digest("hex") ||
-        !sameIdentity(final, opened) || final.size !== opened.size) fail();
-      seen.add(relative);
-    } finally { fs.closeSync(descriptor); }
-  }
-  if (prefix === "" && seen.size !== expected.size) fail();
-}
-try {
-  const request = JSON.parse(process.argv[1]);
-  const root = fs.statSync(".");
-  if (!sameDirectoryIdentity(root, request)) fail();
-  let response = "ok";
-  if (request.action === "rename") {
-    const source = relativeName(request.source);
-    const destination = relativeName(request.destination);
-    safeTreeEntry(source);
-    try { fs.lstatSync(destination); fail(); } catch (error) { if (!error || error.code !== "ENOENT") fail(); }
-    fs.renameSync(source, destination);
-  } else if (request.action === "remove") {
-    const target = relativeName(request.target);
-    try {
-      const stat = safeTreeEntry(target);
-      if (!stat.isDirectory()) fail();
-      fs.rmSync(target, { recursive: true, force: false });
-    } catch (error) {
-      if (!error || error.code !== "ENOENT") fail();
-    }
-  } else if (request.action === "copy") {
-    const destination = relativeName(request.destination);
-    if (typeof request.source !== "string" || !path.isAbsolute(request.source)) fail();
-    try { fs.lstatSync(destination); fail(); } catch (error) { if (!error || error.code !== "ENOENT") fail(); }
-    const expected = expectedFiles(request);
-    const budget = { entries: 0, bytes: 0, seen: new Set() };
-    copyTree(request.source, destination, budget, expected);
-    if (budget.seen.size !== expected.size) fail();
-  } else if (request.action === "verify") {
-    const target = relativeName(request.target);
-    verifyTree(target, expectedFiles(request));
-  } else if (request.action === "absent") {
-    const target = relativeName(request.target);
-    try { fs.lstatSync(target); fail(); } catch (error) { if (!error || error.code !== "ENOENT") fail(); }
-  } else if (request.action === "read-file") {
-    const target = relativeName(request.target);
-    let observed;
-    try { observed = safeTreeEntry(target); } catch (error) {
-      if (error && error.code === "ENOENT") response = JSON.stringify({ missing: true });
-      else fail();
-    }
-    if (observed) {
-      if (!observed.isFile() || observed.nlink !== 1 || observed.size > request.maxBytes || (observed.mode & 0o077) !== 0) fail();
-      const descriptor = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-      try {
-        const current = fs.fstatSync(descriptor);
-        if (!sameIdentity(current, observed) || current.size !== observed.size) fail();
-        const bytes = fs.readFileSync(descriptor);
-        if (bytes.length > request.maxBytes) fail();
-        const final = safeTreeEntry(target);
-        if (!sameIdentity(final, current) || final.size !== current.size) fail();
-        response = JSON.stringify({ missing: false, ...identityOf(current), bytes: bytes.toString("base64") });
-      } finally { fs.closeSync(descriptor); }
-    }
-  } else if (request.action === "write-file") {
-    const target = relativeName(request.target);
-    const temporary = relativeName(request.temporary);
-    const bytes = Buffer.from(request.bytes, "base64");
-    if (bytes.length > 4096) fail();
-    let before;
-    try { before = safeTreeEntry(target); } catch (error) { if (!error || error.code !== "ENOENT") fail(); }
-    if (before && (!before.isFile() || before.nlink !== 1 || (before.mode & 0o077) !== 0)) fail();
-    if ((request.expected === null) !== (before === undefined) ||
-      (before && !sameIdentity(before, request.expected))) fail();
-    const descriptor = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
-    try { fs.writeFileSync(descriptor, bytes); fs.fsyncSync(descriptor); } finally { fs.closeSync(descriptor); }
-    let current;
-    try { current = safeTreeEntry(target); } catch (error) { if (!error || error.code !== "ENOENT") fail(); }
-    if ((request.expected === null) !== (current === undefined) ||
-      (current && !sameIdentity(current, request.expected))) fail();
-    fs.renameSync(temporary, target);
-  } else fail();
-  const descriptor = fs.openSync(".", fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-  try { fs.fsyncSync(descriptor); } finally { fs.closeSync(descriptor); }
-  process.stdout.write(response);
-} catch { fail(); }
-`;
-async function runAnchoredSkillMutation(capability, request) {
-    const scope = capabilities.get(capability);
-    if (scope?.rootPins === undefined)
-        throw new Error("SKILL_LOOP_LOCK_CAPABILITY_INVALID");
-    await assertSkillLoopRootPins(capability);
-    const result = spawnSync(process.execPath, ["-e", anchoredSkillMutationWorker, JSON.stringify({
-            ...request,
-            dev: scope.rootPins.skills.dev,
-            ino: scope.rootPins.skills.ino,
-            ctimeMs: scope.rootPins.skills.ctimeMs,
-            birthtimeMs: scope.rootPins.skills.birthtimeMs
-        })], {
-        cwd: scope.rootPins.skills.physical,
-        env: { PATH: "", NO_COLOR: "1" },
-        encoding: "utf8",
-        timeout: 30_000,
-        maxBuffer: 16 * 1024
-    });
-    if (result.status !== 0)
-        throw new Error("SKILL_LOOP_CONFLICT");
-    return result.stdout;
-}
-export async function anchoredRenameInSkillsRoot(capability, source, destination) {
-    const response = await runAnchoredSkillMutation(capability, { action: "rename", source, destination });
-    if (response !== "ok")
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-export async function anchoredRemoveFromSkillsRoot(capability, target) {
-    const response = await runAnchoredSkillMutation(capability, { action: "remove", target });
-    if (response !== "ok")
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-export async function anchoredCopyIntoSkillsRoot(capability, source, destination, files) {
-    const response = await runAnchoredSkillMutation(capability, {
-        action: "copy",
-        source: path.resolve(source),
-        destination,
-        files: files.map((item) => ({ file: item.file, digest: item.blob.digest, size: item.blob.size }))
-    });
-    if (response !== "ok")
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-export async function anchoredVerifySkillTree(capability, target, files) {
-    const response = await runAnchoredSkillMutation(capability, {
-        action: "verify",
-        target,
-        files: files.map((item) => ({ file: item.file, digest: item.blob.digest, size: item.blob.size }))
-    });
-    if (response !== "ok")
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-export async function anchoredAssertSkillPathAbsent(capability, target) {
-    const response = await runAnchoredSkillMutation(capability, { action: "absent", target });
-    if (response !== "ok")
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-export async function anchoredReadFileFromSkillsRoot(capability, target, maxBytes) {
-    const response = await runAnchoredSkillMutation(capability, { action: "read-file", target, maxBytes });
-    let parsed;
-    try {
-        parsed = JSON.parse(response);
-    }
-    catch {
-        throw new Error("SKILL_LOOP_CONFLICT");
-    }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
-        throw new Error("SKILL_LOOP_CONFLICT");
-    const record = parsed;
-    if (record.missing === true && Object.keys(record).length === 1)
-        return undefined;
-    if (record.missing !== false || typeof record.bytes !== "string" || !Number.isInteger(record.dev) || !Number.isInteger(record.ino) ||
-        typeof record.ctimeMs !== "number" || typeof record.birthtimeMs !== "number") {
-        throw new Error("SKILL_LOOP_CONFLICT");
-    }
-    return {
-        bytes: Buffer.from(record.bytes, "base64"),
-        dev: Number(record.dev),
-        ino: Number(record.ino),
-        ctimeMs: Number(record.ctimeMs),
-        birthtimeMs: Number(record.birthtimeMs)
-    };
-}
-export async function anchoredWriteFileToSkillsRoot(capability, target, bytes, expected) {
-    const response = await runAnchoredSkillMutation(capability, {
-        action: "write-file",
-        target,
-        temporary: `.${target}.${randomUUID()}.tmp`,
-        bytes: Buffer.from(bytes).toString("base64"),
-        expected
-    });
-    if (response !== "ok")
-        throw new Error("SKILL_LOOP_CONFLICT");
-}
-function delay(milliseconds) {
-    return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-export function processBirthIdentityForPlatform(pid, platform, probe = (command, args) => spawnSync(command, args, {
-    encoding: "utf8",
-    env: { PATH: platform === "win32" ? "C:\\Windows\\System32\\WindowsPowerShell\\v1.0;C:\\Windows\\System32" : "/usr/bin:/bin", LANG: "C" },
-    timeout: 1_000,
-    maxBuffer: 1024
-})) {
-    if (platform === "win32")
-        return undefined;
-    const result = probe("ps", ["-o", "lstart=", "-p", String(pid)]);
-    const value = result.status === 0 ? result.stdout.trim() : "";
-    return value.length > 0 && value.length <= 128 ? value : undefined;
-}
-export function assertSkillLoopGlobalBoundarySupported(platform = process.platform) {
-    if (platform === "win32")
-        throw new Error("WINDOWS_SKILL_LOOP_UNSUPPORTED");
-}
-function processIdentity(pid) {
-    return processBirthIdentityForPlatform(pid, process.platform);
-}
-function processIsSame(pid, identity) {
-    try {
-        process.kill(pid, 0);
-    }
-    catch (error) {
-        if (errorCode(error) === "ESRCH")
-            return false;
-        return true;
-    }
-    if (identity === null)
-        return true;
-    const current = processIdentity(pid);
-    return current === undefined || current === identity;
-}
-async function readLockOwner(ownerFile) {
-    const stat = await lstat(ownerFile);
-    assertRegular(stat);
-    if (Number(stat.size) > 1024 || (Number(stat.mode) & 0o077) !== 0)
-        unsafe();
-    const handle = await fs.open(ownerFile, noFollowRead);
-    try {
-        const descriptor = await handle.stat();
-        if (!descriptor.isFile() || descriptor.nlink !== 1 ||
-            !sameStableStatIdentity(stableStatIdentity(descriptor), stableStatIdentity(stat)))
-            unsafe();
-        const parsed = JSON.parse((await handle.readFile()).toString("utf8"));
-        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) ||
-            Object.keys(parsed).some((key) => key !== "pid" && key !== "token" && key !== "processIdentity") ||
-            !Number.isInteger(parsed.pid) || Number(parsed.pid) < 1 ||
-            typeof parsed.token !== "string" || !/^[a-f0-9-]{36}$/u.test(parsed.token) ||
-            (parsed.processIdentity !== null &&
-                (typeof parsed.processIdentity !== "string" || parsed.processIdentity.length < 1)))
-            unsafe();
-        return parsed;
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function retireDeadLock(lock) {
-    const lockStat = await lstat(lock);
-    if (lockStat === undefined)
-        return true;
-    assertDirectory(lockStat);
-    const ownerFile = path.join(lock, "owner.json");
-    const ownerStat = await lstat(ownerFile);
-    if (ownerStat === undefined) {
-        if (Date.now() - Number(lockStat.mtimeMs) < ownerlessLockGraceMs)
-            return false;
-        const entries = await fs.readdir(lock, { withFileTypes: true });
-        if (entries.length > 1 || entries.some((entry) => !entry.isFile() || !/^\.owner\.[a-f0-9-]{36}\.tmp$/u.test(entry.name)))
-            return false;
-        if (entries.length === 1) {
-            const temporary = path.join(lock, entries[0].name);
-            const before = await lstat(temporary);
-            assertRegular(before);
-            const currentLock = await lstat(lock);
-            const current = await lstat(temporary);
-            if (currentLock === undefined || current === undefined ||
-                !sameStableDirectoryIdentity(stableStatIdentity(currentLock), stableStatIdentity(lockStat)) ||
-                !sameStableStatIdentity(stableStatIdentity(current), stableStatIdentity(before)))
-                throw new Error("SKILL_LOOP_CONFLICT");
-            await fs.unlink(temporary);
-        }
-        try {
-            await fs.rmdir(lock);
-            await syncDirectory(path.dirname(lock));
-            return true;
-        }
-        catch (error) {
-            if (errorCode(error) === "ENOENT")
-                return true;
-            if (errorCode(error) === "ENOTEMPTY")
-                return false;
-            throw error;
-        }
-    }
-    const owner = await readLockOwner(ownerFile);
-    if (processIsSame(owner.pid, owner.processIdentity))
-        return false;
-    const currentLock = await lstat(lock);
-    const currentOwner = await lstat(ownerFile);
-    if (currentLock === undefined || currentOwner === undefined ||
-        !sameStableDirectoryIdentity(stableStatIdentity(currentLock), stableStatIdentity(lockStat)) ||
-        !sameStableStatIdentity(stableStatIdentity(currentOwner), stableStatIdentity(ownerStat)))
-        throw new Error("SKILL_LOOP_CONFLICT");
-    await fs.unlink(ownerFile);
-    await fs.rmdir(lock);
-    await syncDirectory(path.dirname(lock));
-    return true;
-}
-async function withOwnerTokenLock(parent, name, run) {
-    const lock = path.join(parent, name);
-    const token = randomUUID();
-    const identity = processIdentity(process.pid) ?? null;
-    const deadline = Date.now() + lockTimeoutMs;
-    while (true) {
-        try {
-            await fs.mkdir(lock, { mode: 0o700 });
-            break;
-        }
-        catch (error) {
-            if (errorCode(error) !== "EEXIST")
-                throw error;
-            assertDirectory(await lstat(lock));
-            if (await retireDeadLock(lock))
-                continue;
-            if (Date.now() >= deadline)
-                throw new Error("SKILL_LOOP_BUSY");
-            await delay(lockRetryMs);
-        }
-    }
-    const ownerFile = path.join(lock, "owner.json");
-    const temporaryOwnerFile = path.join(lock, `.owner.${token}.tmp`);
-    try {
-        const owner = await fs.open(temporaryOwnerFile, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | (fsConstants.O_NOFOLLOW ?? 0), 0o600);
-        try {
-            await owner.writeFile(`${JSON.stringify({ pid: process.pid, token, processIdentity: identity })}\n`);
-            await owner.sync();
-        }
-        finally {
-            await owner.close();
-        }
-        await fs.rename(temporaryOwnerFile, ownerFile);
-        await syncDirectory(lock);
-        await syncDirectory(parent);
-    }
-    catch (error) {
-        await fs.unlink(temporaryOwnerFile).catch(() => undefined);
-        await fs.unlink(ownerFile).catch(() => undefined);
-        await fs.rmdir(lock).catch(() => undefined);
-        throw error;
-    }
-    try {
-        return await run(token);
-    }
-    finally {
-        assertDirectory(await lstat(lock));
-        const owner = await readLockOwner(ownerFile);
-        if (owner.token !== token || owner.pid !== process.pid || owner.processIdentity !== identity)
-            unsafe();
-        await fs.unlink(ownerFile);
-        await syncDirectory(lock);
-        await fs.rmdir(lock);
-        await syncDirectory(parent);
-    }
-}
-function createCapability(scope) {
-    const capability = Object.freeze({ [capabilityBrand]: true });
-    capabilities.set(capability, scope);
-    return capability;
-}
-export function assertSkillLoopLockCapability(capability, projectRoot, skillsRoot) {
-    if (typeof capability !== "object" || capability === null)
-        throw new Error("SKILL_LOOP_LOCK_CAPABILITY_INVALID");
-    const scope = capabilities.get(capability);
-    if (scope === undefined || !scope.projectRoots.includes(path.resolve(projectRoot)) ||
-        (skillsRoot !== undefined && scope.skillsRoot !== path.resolve(skillsRoot))) {
-        throw new Error("SKILL_LOOP_LOCK_CAPABILITY_INVALID");
-    }
-}
-export async function assertSkillLoopRootPins(capability) {
-    const scope = capabilities.get(capability);
-    if (scope?.rootPins === undefined)
-        throw new Error("SKILL_LOOP_LOCK_CAPABILITY_INVALID");
-    await assertPhysicalDirectoryPin(scope.rootPins.project);
-    await assertPhysicalDirectoryPin(scope.rootPins.config);
-    await assertPhysicalDirectoryPin(scope.rootPins.skills);
-}
-export async function withSkillLoopMutationLock(projectRoot, run) {
-    const project = await pinPhysicalDirectory(projectRoot);
-    const runtime = path.join(project.physical, ".litopencode");
-    await ensureSafeRuntimeDirectory(project.physical, runtime);
-    return withOwnerTokenLock(runtime, "skill-loop-mutation.lock", async () => {
-        const capability = createCapability({ projectRoots: [...new Set([project.lexical, project.physical])] });
-        try {
-            return await run(capability);
-        }
-        finally {
-            capabilities.delete(capability);
-        }
-    });
-}
-export async function withSkillRootsMutationLock(projectRoot, configRoot, run) {
-    assertSkillLoopGlobalBoundarySupported();
-    const roots = await pinPhysicalSkillLoopRoots(projectRoot, configRoot);
-    const uid = process.getuid?.();
-    if (uid === undefined)
-        throw new Error("SKILL_LOOP_LOCK_IDENTITY_UNAVAILABLE");
-    const lockParent = path.join(await fs.realpath(os.tmpdir()), `.litopencode-skill-root-locks-${uid}`);
-    await createDirectoryWithoutUserSymlinks(lockParent);
-    const lockParentStat = await fs.lstat(lockParent);
-    if (!lockParentStat.isDirectory() || lockParentStat.isSymbolicLink() || lockParentStat.uid !== uid || (lockParentStat.mode & 0o077) !== 0)
-        unsafe();
-    const lockKey = createHash("sha256")
-        .update(`${roots.skills.physical}\0${roots.skills.dev}:${roots.skills.ino}:${roots.skills.birthtimeMs}`, "utf8")
-        .digest("hex");
-    return withOwnerTokenLock(lockParent, `${lockKey}.lock`, async () => {
-        await assertPhysicalDirectoryPin(roots.project);
-        await assertPhysicalDirectoryPin(roots.config);
-        await assertPhysicalDirectoryPin(roots.skills);
-        const capability = createCapability({
-            projectRoots: [...new Set([roots.project.lexical, roots.project.physical])],
-            skillsRoot: roots.skills.physical,
-            rootPins: roots
-        });
-        try {
-            const result = await run(capability, roots);
-            await assertSkillLoopRootPins(capability);
-            return result;
-        }
-        finally {
-            capabilities.delete(capability);
-        }
-    });
-}