@nurix/nustack 0.23.12 → 0.23.14

package/dist/lib/harness/hookCheck.js

@@ -0,0 +1,325 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { openLocalStore, openLocalStoreReadOnly } from "../local_store/database.js";
+import { writeRecords } from "../records/recordsTable.js";
+import { RECORD_SCHEMA_VERSION } from "../records/door.js";
+import { idempotencyKeyOf } from "../records/naturalKey.js";
+import { recordCredentialOf } from "../records/environment.js";
+import { readProjectContract, CONTRACT_PATH } from "../project_contract.js";
+import { loadHarness } from "./vendor.js";
+import { readStoreDocumentationWaivers } from "./storeWaivers.js";
+export const HOOK_DEADLINE_MS = 3000;
+export const HOOK_DEADLINE_VARIABLE = "NUSTACK_HOOK_DEADLINE_MS";
+export const ENFORCEMENT_MAP_PATH = ".nustack/enforcement.json";
+export const HOOK_EVENTS = ["pre-tool-use", "stop"];
+export const RULE_UNAVAILABLE_GATE = "hook.rule_unavailable";
+export const DEADLINE_GATE = "hook.deadline";
+const EVENT_NAMESPACE = "3f0c9a52-6d1e-4b7a-9c2f-8e5d4a1b7c60";
+const RECORDS_STORE_VERSION = 9;
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+export const COMMIT_RULES = new Set(["changelog", "commit-gate", "changelog-presence", "harness-checks"]);
+class CannotRun extends Error {
+}
+export function uuidV5(name, namespace = EVENT_NAMESPACE) {
+    const namespaceBytes = Buffer.from(namespace.replace(/-/g, ""), "hex");
+    const hash = createHash("sha1").update(Buffer.concat([namespaceBytes, Buffer.from(name, "utf8")])).digest();
+    const bytes = Uint8Array.prototype.slice.call(hash, 0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x50;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = Buffer.from(bytes).toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function parsePayload(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new CannotRun("the hook payload on stdin is not JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        throw new CannotRun("the hook payload on stdin is not an object");
+    const payload = parsed;
+    return {
+        sessionId: typeof payload.session_id === "string" ? payload.session_id : null,
+        cwd: typeof payload.cwd === "string" && payload.cwd ? payload.cwd : process.cwd(),
+        toolName: typeof payload.tool_name === "string" ? payload.tool_name : null,
+        toolInput: typeof payload.tool_input === "object" && payload.tool_input !== null ? payload.tool_input : {},
+        isStopHookActive: payload.stop_hook_active === true,
+    };
+}
+function boundRootOf(dir) {
+    let current = path.resolve(dir);
+    for (;;) {
+        if (existsSync(path.join(current, CONTRACT_PATH)))
+            return current;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+function readMap(root) {
+    let text;
+    try {
+        text = readFileSync(path.join(root, ENFORCEMENT_MAP_PATH), "utf8");
+    }
+    catch {
+        throw new CannotRun(`no enforcement map at ${ENFORCEMENT_MAP_PATH}; run \`nustack harness mount\``);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new CannotRun(`${ENFORCEMENT_MAP_PATH} is not JSON`);
+    }
+    if (parsed.schemaVersion !== 1 || !Array.isArray(parsed.rules))
+        throw new CannotRun(`${ENFORCEMENT_MAP_PATH} is not a schemaVersion 1 map`);
+    return parsed.rules.filter((row) => typeof row === "object" && row !== null && typeof row.rule === "string" && (row.rung === "flag" || row.rung === "block"));
+}
+function editedPath(root, payload) {
+    const raw = payload.toolInput.file_path ?? payload.toolInput.notebook_path;
+    if (typeof raw !== "string" || raw === "")
+        return null;
+    const absolute = path.isAbsolute(raw) ? raw : path.resolve(payload.cwd, raw);
+    const relative = path.relative(root, absolute);
+    if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative))
+        return null;
+    return relative.split(path.sep).join("/");
+}
+function postEditText(root, relative, payload) {
+    const onDisk = (() => {
+        try {
+            return readFileSync(path.join(root, relative), "utf8");
+        }
+        catch {
+            return null;
+        }
+    })();
+    const input = payload.toolInput;
+    const apply = (text, oldString, newString, isAll) => {
+        if (typeof oldString !== "string" || typeof newString !== "string" || oldString === "")
+            return text;
+        return isAll === true ? text.split(oldString).join(newString) : text.replace(oldString, () => newString);
+    };
+    switch (payload.toolName) {
+        case "Write":
+            return typeof input.content === "string" ? input.content : onDisk;
+        case "Edit":
+            return apply(onDisk ?? "", input.old_string, input.new_string, input.replace_all);
+        case "MultiEdit": {
+            let text = onDisk ?? "";
+            for (const edit of Array.isArray(input.edits) ? input.edits : []) {
+                if (typeof edit === "object" && edit !== null) {
+                    const step = edit;
+                    text = apply(text, step.old_string, step.new_string, step.replace_all);
+                }
+            }
+            return text;
+        }
+        default:
+            return onDisk;
+    }
+}
+function overlaidTree(base, relative, text) {
+    return {
+        read: (candidate) => (candidate === relative ? text : base.read(candidate)),
+        list: (prefix) => {
+            const listed = base.list(prefix).filter((candidate) => candidate !== relative);
+            if (text !== null && relative.startsWith(prefix))
+                listed.push(relative);
+            return listed.sort();
+        },
+    };
+}
+function branchOf(root) {
+    try {
+        return execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return "";
+    }
+}
+function todayOf() {
+    return new Date().toISOString().slice(0, 10);
+}
+function findingsText(verdicts) {
+    return verdicts.map((verdict) => verdict.reason).join("\n");
+}
+function reasonOf(gate, findings) {
+    return findings.length === 0 ? gate : findings.map((finding) => `${gate}: ${finding.message}${finding.path ? ` (${finding.path})` : ""}`).join("\n");
+}
+async function writeVerdicts(root, projectId, payload, target, verdicts) {
+    if (verdicts.length === 0)
+        return null;
+    try {
+        const held = await openLocalStoreReadOnly();
+        const version = held?.version ?? RECORDS_STORE_VERSION;
+        held?.close();
+        if (version < RECORDS_STORE_VERSION)
+            return null;
+        const store = await openLocalStore();
+        try {
+            const now = Date.now();
+            const writes = verdicts.map((verdict) => {
+                const eventId = uuidV5(JSON.stringify([payload.sessionId ?? "", verdict.gate, target ?? "", verdict.reason]));
+                const naturalKey = `event:${eventId}`;
+                return {
+                    kind: "gate_event",
+                    schemaVersion: RECORD_SCHEMA_VERSION,
+                    projectId,
+                    sessionId: payload.sessionId,
+                    planAnchor: null,
+                    naturalKey,
+                    idempotencyKey: idempotencyKeyOf(projectId ?? root, "gate_event", naturalKey),
+                    payload: { eventId, gate: verdict.gate, verdict: verdict.verdict, ...(target ? { target } : {}), reason: verdict.reason.slice(0, 20_000) },
+                    createdAt: now,
+                    repositoryRoot: root,
+                    placement: "server",
+                    credential: recordCredentialOf(),
+                };
+            });
+            writeRecords(store, writes);
+        }
+        finally {
+            store.close();
+        }
+        return null;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+function preToolUseAnswer(fields) {
+    const output = { hookEventName: "PreToolUse" };
+    if (fields.deny !== undefined) {
+        output.permissionDecision = "deny";
+        output.permissionDecisionReason = fields.deny;
+    }
+    if (fields.context !== undefined)
+        output.additionalContext = fields.context;
+    return JSON.stringify({ hookSpecificOutput: output });
+}
+function stopAnswer(fields) {
+    const output = {};
+    if (fields.block !== undefined) {
+        output.decision = "block";
+        output.reason = fields.block;
+    }
+    if (fields.message !== undefined)
+        output.systemMessage = fields.message;
+    return JSON.stringify(output);
+}
+function cannotRunAnswer(event, isProtection, reason) {
+    const line = `NuStack enforcement could not run: ${reason}`;
+    if (isProtection)
+        return { stdout: "", stderr: `${line}\n`, exitCode: 2 };
+    return { stdout: event === "pre-tool-use" ? preToolUseAnswer({ context: line }) : stopAnswer({ message: line }), stderr: "", exitCode: 0 };
+}
+export async function runHookCheck(event, isProtection, stdinText, env = process.env) {
+    const started = Date.now();
+    const lowered = Number(env[HOOK_DEADLINE_VARIABLE]);
+    const deadline = Number.isFinite(lowered) && lowered > 0 ? Math.min(lowered, HOOK_DEADLINE_MS) : HOOK_DEADLINE_MS;
+    let payload;
+    let root;
+    let rows;
+    let rules;
+    let rulesNode;
+    try {
+        payload = parsePayload(stdinText);
+        const bound = boundRootOf(payload.cwd);
+        if (!bound)
+            throw new CannotRun("this folder is not bound to a NuStack Project");
+        root = bound;
+        rows = readMap(root).filter((row) => (isProtection ? row.protection && row.rung === "block" : !(row.protection && row.rung === "block")));
+        try {
+            rules = await loadHarness("rules");
+            rulesNode = await loadHarness("rulesNode");
+        }
+        catch (error) {
+            throw new CannotRun(`the rule library did not load: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    catch (error) {
+        return cannotRunAnswer(event, isProtection, error instanceof Error ? error.message : String(error));
+    }
+    let target = null;
+    if (event === "pre-tool-use") {
+        if (payload.toolName !== null && !EDIT_TOOLS.has(payload.toolName))
+            return { stdout: "", stderr: "", exitCode: 0 };
+        target = editedPath(root, payload);
+        if (target === null)
+            return { stdout: "", stderr: "", exitCode: 0 };
+    }
+    const contract = await readProjectContract(root);
+    const verdicts = [];
+    let isPastDeadline = false;
+    try {
+        const waivers = [...rulesNode.readBookkeepingWaivers(root), ...(await readStoreDocumentationWaivers(contract.projectId))];
+        let context;
+        if (event === "pre-tool-use") {
+            const tree = rulesNode.workingTree(root);
+            const existed = tree.read(target) !== null;
+            context = {
+                head: overlaidTree(tree, target, postEditText(root, target, payload)),
+                base: tree,
+                changes: [{ path: target, status: existed ? "M" : "A" }],
+                commit: { author: "", message: "" },
+                today: todayOf(),
+                pullRequest: { headRef: branchOf(root), baseRef: "" },
+                waivers,
+            };
+        }
+        else {
+            context = { ...rulesNode.nodeRuleContext({ root, baseRef: "HEAD" }), waivers };
+        }
+        for (const row of rows) {
+            if (COMMIT_RULES.has(row.rule))
+                continue;
+            if (!rules.isRuleId(row.rule)) {
+                if (event === "stop")
+                    verdicts.push({ gate: RULE_UNAVAILABLE_GATE, verdict: "flag", findings: [], reason: `${row.rule} is not a rule this CLI serves` });
+                continue;
+            }
+            if (Date.now() - started >= deadline) {
+                isPastDeadline = true;
+                break;
+            }
+            const result = rules.runRule(row.rule, { ...context, rung: row.rung });
+            if (result.verdict === "pass")
+                continue;
+            verdicts.push({ gate: row.rule, verdict: result.verdict, findings: result.findings, reason: reasonOf(row.rule, result.findings) });
+        }
+    }
+    catch (error) {
+        return cannotRunAnswer(event, isProtection, error instanceof Error ? error.message : String(error));
+    }
+    if (isPastDeadline) {
+        for (const verdict of verdicts)
+            verdict.verdict = "flag";
+        verdicts.push({ gate: DEADLINE_GATE, verdict: "flag", findings: [], reason: `the checks did not finish within ${deadline} ms; the call was let through` });
+    }
+    const blocks = verdicts.filter((verdict) => verdict.verdict === "block");
+    const flags = verdicts.filter((verdict) => verdict.verdict === "flag");
+    const shownFlags = flags.filter((verdict) => verdict.gate !== RULE_UNAVAILABLE_GATE);
+    const writeError = await writeVerdicts(root, contract.projectId, payload, target, verdicts);
+    const writeLine = writeError ? `the gate_event record could not be written: ${writeError}` : null;
+    if (event === "pre-tool-use") {
+        if (blocks.length > 0)
+            return { stdout: preToolUseAnswer({ deny: [findingsText(blocks), writeLine].filter(Boolean).join("\n") }), stderr: "", exitCode: 0 };
+        if (flags.length > 0 || writeLine)
+            return { stdout: preToolUseAnswer({ context: [findingsText(flags), writeLine].filter(Boolean).join("\n") }), stderr: "", exitCode: 0 };
+        return { stdout: "", stderr: "", exitCode: 0 };
+    }
+    if (blocks.length > 0) {
+        const reason = [findingsText(blocks), writeLine].filter(Boolean).join("\n");
+        const shown = [reason, findingsText(shownFlags)].filter(Boolean).join("\n");
+        return { stdout: payload.isStopHookActive ? stopAnswer({ message: shown }) : stopAnswer({ block: reason }), stderr: "", exitCode: 0 };
+    }
+    if (shownFlags.length > 0 || writeLine)
+        return { stdout: stopAnswer({ message: [findingsText(shownFlags), writeLine].filter(Boolean).join("\n") }), stderr: "", exitCode: 0 };
+    return { stdout: "", stderr: "", exitCode: 0 };
+}

package/dist/lib/harness/hookEntry.js

@@ -0,0 +1,27 @@
+import { HOOK_EVENTS, runHookCheck } from "./hookCheck.js";
+function readStdin() {
+    return new Promise((resolve) => {
+        if (process.stdin.isTTY) {
+            resolve("");
+            return;
+        }
+        let text = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => (text += chunk));
+        process.stdin.on("end", () => resolve(text));
+        process.stdin.on("error", () => resolve(text));
+    });
+}
+export async function runHookMode(event, isProtection) {
+    if (!HOOK_EVENTS.includes(event)) {
+        console.error(`--hook must be one of ${HOOK_EVENTS.join(", ")}.`);
+        process.exitCode = isProtection ? 2 : 0;
+        return;
+    }
+    const answer = await runHookCheck(event, isProtection, await readStdin());
+    if (answer.stdout)
+        process.stdout.write(`${answer.stdout}\n`);
+    if (answer.stderr)
+        process.stderr.write(answer.stderr);
+    process.exitCode = answer.exitCode;
+}

package/dist/lib/harness/legacyMount.js

@@ -0,0 +1,231 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { mkdir, readFile, rename, rm, rmdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { HarnessError, HARNESS_CODES } from "./codes.js";
+export const LEGACY_MOUNT_RECORD_PATH = ".claude/state/legacy-mount.json";
+export const LEGACY_EXCLUDE_START = "# etna:mount:start";
+export const LEGACY_EXCLUDE_END = "# etna:mount:end";
+const SHA256 = /^[0-9a-f]{64}$/;
+const REQUEST_TIMEOUT_MS = 15_000;
+const FETCH_CONCURRENCY = 8;
+const sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export function isMountedPath(file) {
+    if (file.policy)
+        return file.policy === "mount";
+    const contract = ["CLAUDE.md", "AGENTS.md", ".claude/harness.json", ".claude/settings.json", ".claude/hooks/mount.mjs", ".codex/hooks.json"];
+    if (contract.includes(file.path))
+        return false;
+    return file.path.startsWith(".claude/") || file.path.startsWith(".agents/") || file.path.startsWith(".codex/");
+}
+function isSafePath(file) {
+    return file !== "" && !path.isAbsolute(file) && !file.split(/[\\/]/).includes("..") && !file.split("/").includes(".git") && !file.startsWith(".claude/state/");
+}
+async function readIfPresent(file) {
+    try {
+        return await readFile(file);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeAtomic(target, bytes) {
+    await mkdir(path.dirname(target), { recursive: true });
+    const staging = `${target}.mount-${process.pid}`;
+    await writeFile(staging, bytes);
+    await rename(staging, target);
+}
+async function fetchBytes(url) {
+    const response = await globalThis.fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    if (!response.ok)
+        throw new Error(`${url} answered ${response.status}`);
+    return Buffer.from(await response.arrayBuffer());
+}
+function objectUrlOf(manifestUrl, key) {
+    return `${new URL(manifestUrl).origin}/${key.replace(/^\/+/, "")}`;
+}
+function excludePathOf(root) {
+    try {
+        const relative = execFileSync("git", ["rev-parse", "--git-path", "info/exclude"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        return path.isAbsolute(relative) ? relative : path.join(root, relative);
+    }
+    catch {
+        return null;
+    }
+}
+function withoutLegacyBlock(held) {
+    const start = held.indexOf(LEGACY_EXCLUDE_START);
+    const end = held.indexOf(LEGACY_EXCLUDE_END);
+    if (start < 0 || end <= start)
+        return held;
+    return held.slice(0, start) + held.slice(end + LEGACY_EXCLUDE_END.length).replace(/^\n/, "");
+}
+function ignoredNamesOf(files) {
+    const names = new Set([".claude/state/"]);
+    for (const file of files) {
+        const parts = file.path.split("/");
+        if (parts[0] === ".agents")
+            names.add(".agents/skills/");
+        else if (parts[0] === ".codex")
+            names.add(parts.length > 2 ? `.codex/${parts[1]}/` : `.codex/${parts[1]}`);
+        else if (parts.length > 3)
+            names.add(`${parts.slice(0, 3).join("/")}/`);
+        else
+            names.add(file.path);
+    }
+    return [...names].sort();
+}
+async function writeLegacyExcludeBlock(root, files) {
+    const excludePath = excludePathOf(root);
+    if (!excludePath)
+        return;
+    const outside = withoutLegacyBlock((await readIfPresent(excludePath))?.toString("utf8") ?? "");
+    const block = [LEGACY_EXCLUDE_START, ...ignoredNamesOf(files), LEGACY_EXCLUDE_END].join("\n");
+    await writeAtomic(excludePath, `${outside.replace(/\n*$/, outside ? "\n" : "")}${block}\n`);
+}
+export async function removeLegacyExcludeBlock(root) {
+    const excludePath = excludePathOf(root);
+    if (!excludePath)
+        return;
+    const held = (await readIfPresent(excludePath))?.toString("utf8");
+    if (held === undefined || !held.includes(LEGACY_EXCLUDE_START))
+        return;
+    await writeAtomic(excludePath, withoutLegacyBlock(held));
+}
+function parseLegacyRecord(raw) {
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw.toString());
+        if (typeof parsed.version !== "string" || typeof parsed.digest !== "string")
+            return null;
+        return {
+            version: parsed.version,
+            digest: parsed.digest,
+            mountedAt: typeof parsed.mountedAt === "string" ? parsed.mountedAt : "",
+            source: "legacy",
+            origin: typeof parsed.origin === "string" ? parsed.origin : null,
+            legacyFiles: Array.isArray(parsed.legacyFiles)
+                ? parsed.legacyFiles.filter((file) => typeof file?.path === "string" && typeof file?.sha256 === "string")
+                : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function readLegacyMountRecord(root) {
+    return parseLegacyRecord(await readIfPresent(path.join(root, LEGACY_MOUNT_RECORD_PATH)));
+}
+export function readLegacyMountRecordSync(root) {
+    const file = path.join(root, LEGACY_MOUNT_RECORD_PATH);
+    if (!existsSync(file))
+        return null;
+    try {
+        return parseLegacyRecord(readFileSync(file));
+    }
+    catch {
+        return null;
+    }
+}
+export async function mountLegacyManifest(root, manifestUrl, origin) {
+    const manifestBytes = await fetchBytes(manifestUrl);
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestBytes.toString("utf8"));
+    }
+    catch {
+        throw new HarnessError(HARNESS_CODES.HARNESS_MOUNT_FAILED, `the manifest at ${manifestUrl} is not JSON`);
+    }
+    if (!manifest || !Array.isArray(manifest.files))
+        throw new HarnessError(HARNESS_CODES.HARNESS_MOUNT_FAILED, `the manifest at ${manifestUrl} lists no files`);
+    const mounted = manifest.files.filter(isMountedPath);
+    for (const file of mounted) {
+        if (typeof file.sha256 !== "string" || !SHA256.test(file.sha256)) {
+            throw new HarnessError(HARNESS_CODES.HARNESS_DIGEST_MISMATCH, `the manifest entry ${String(file.path)} carries no verifiable sha256; nothing was written`);
+        }
+        if (typeof file.path !== "string" || !isSafePath(file.path) || typeof file.key !== "string") {
+            throw new HarnessError(HARNESS_CODES.HARNESS_MOUNT_FAILED, `the manifest names an unsafe path: ${String(file.path)}`);
+        }
+    }
+    const toWrite = [];
+    const kept = [];
+    const needed = [];
+    for (const file of mounted) {
+        const held = await readIfPresent(path.join(root, file.path));
+        if (held && sha256Of(held) === file.sha256)
+            kept.push(file.path);
+        else
+            needed.push(file);
+    }
+    const fetched = new Map();
+    let next = 0;
+    const worker = async () => {
+        while (next < needed.length) {
+            const file = needed[next++];
+            const bytes = await fetchBytes(objectUrlOf(manifestUrl, file.key));
+            if (sha256Of(bytes) !== file.sha256) {
+                throw new HarnessError(HARNESS_CODES.HARNESS_DIGEST_MISMATCH, `the object for ${file.path} does not match its sha256; nothing was written`);
+            }
+            fetched.set(file, bytes);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(FETCH_CONCURRENCY, needed.length) }, worker));
+    for (const file of needed)
+        toWrite.push({ file, bytes: fetched.get(file) });
+    for (const { file, bytes } of toWrite)
+        await writeAtomic(path.join(root, file.path), bytes);
+    await writeLegacyExcludeBlock(root, mounted);
+    const stateDir = path.join(root, ".claude", "state");
+    await mkdir(stateDir, { recursive: true });
+    if (!(await readIfPresent(path.join(stateDir, ".gitignore"))))
+        await writeFile(path.join(stateDir, ".gitignore"), "*\n");
+    const record = {
+        version: String(manifest.version ?? ""),
+        digest: sha256Of(manifestBytes),
+        mountedAt: new Date().toISOString(),
+        source: "legacy",
+        origin,
+        legacyFiles: mounted.map((file) => ({ path: file.path, sha256: file.sha256 })),
+    };
+    await writeAtomic(path.join(root, LEGACY_MOUNT_RECORD_PATH), `${JSON.stringify(record, null, 2)}\n`);
+    return { version: record.version, digest: record.digest, written: toWrite.map((item) => item.file.path), kept };
+}
+export async function handOverLegacyMount(root, keptByVersion) {
+    const record = await readLegacyMountRecord(root);
+    if (!record)
+        return null;
+    const removed = [];
+    const editedKept = [];
+    for (const file of record.legacyFiles) {
+        if (keptByVersion.has(file.path) || !isSafePath(file.path))
+            continue;
+        const target = path.join(root, file.path);
+        const held = await readIfPresent(target);
+        if (!held)
+            continue;
+        if (sha256Of(held) !== file.sha256) {
+            editedKept.push(file.path);
+            continue;
+        }
+        await rm(target, { force: true });
+        await removeEmptyParents(root, path.dirname(file.path));
+        removed.push(file.path);
+    }
+    await removeLegacyExcludeBlock(root);
+    await rm(path.join(root, LEGACY_MOUNT_RECORD_PATH), { force: true });
+    return { removed, editedKept };
+}
+async function removeEmptyParents(root, relativeDir) {
+    let dir = relativeDir;
+    while (dir && dir !== "." && dir !== "/") {
+        try {
+            await rmdir(path.join(root, dir));
+        }
+        catch {
+            return;
+        }
+        dir = path.dirname(dir);
+    }
+}