@savvy-web/silk-effects 5.3.0 → 5.4.0

package/README.md

@@ -13,7 +13,7 @@ Shared [Effect](https://effect.website/) library providing Silk Suite convention
 - Supply the Silk commitlint config, its prompt and formatter, and the `silk/body-no-markdown` rule
 - Run the lint-staged handlers and the `savvy lint fmt` formatters from a single implementation so the hook and the CLI cannot drift
 - Inspect a Turborepo read-only — diagnose per-package cache hits, derive the task graph and compute affected packages, all over `turbo --dry`
-- Manage the vendored reference repos declared in `.repos/config.json`, including submodule sync, pinning and drift reporting
+- Manage the vendored reference repos declared in `.repos/config.json` — submodule status, sync, pinning and notes — and keep every vendored tree read-only between mutations
 - Locate config files and keep Biome schema URLs in sync across workspaces
 
 ## Install
@@ -364,6 +364,33 @@ const diagnosis = await Effect.runPromise(
 // => CacheDiagnosis: per-package HIT/MISS breakdown for the task
 ```
 
+#### ReposManager and ReposLockdown
+
+The `Repos` namespace drives vendored reference repos — upstream sources checked out as git submodules under `.repos/`, declared in a `.repos/config.json` manifest. `ReposConfigStore` reads and writes that manifest, and `ReposManager` does the git work: `status(root)` reports presence, the pinned commit, working-tree dirtiness and stale notes, `sync(root)` initializes missing submodules and applies each entry's sparse-checkout, `pin(root, name, ref)` moves an entry to a new ref, `add(root, options)` vendors a new one, and `note(root, name, op)` adds, removes or promotes an agent note.
+
+`ReposLockdown` is the permissions boundary around all of that. `lock(root, name)` chmods a vendored worktree and its submodule git metadata to files `0444` and directories `0555`; `unlock` reverses it; `withUnlocked(root, name, effect)` brackets an effect between the two. `ReposManager`'s `sync`, `add` and `pin` run their git mutations inside that bracket and re-lock afterwards, so a vendored tree is read-only whenever the manager is not mid-write. Reads are unaffected — a locked tree needs no special handling to open a file.
+
+Two consequences for callers: `ReposManager.layer` now requires `ReposLockdown` alongside `ReposConfigStore`, `Git`, `FileSystem` and `Path`, and `sync`, `add` and `pin` widen their error channel with `ReposLockdownError`, which carries the offending `path` and a `reason`.
+
+```typescript
+import { Effect, Layer } from "effect";
+import { NodeServices } from "@effect/platform-node";
+import { Git } from "@effected/git";
+import { Repos } from "@savvy-web/silk-effects";
+
+const report = await Effect.runPromise(
+  Effect.gen(function* () {
+    const repos = yield* Repos.ReposManager;
+    return yield* repos.sync(process.cwd());
+  }).pipe(
+    Effect.provide(Repos.ReposManager.layer),
+    Effect.provide(Layer.mergeAll(Repos.ReposConfigStore.layer, Repos.ReposLockdown.layer, Git.layer)),
+    Effect.provide(NodeServices.layer),
+  ),
+);
+// => ReposSyncReport: per-repo initialization and sparse-checkout outcome, trees left read-only
+```
+
 ## Documentation
 
 - [Overview](./docs/01-overview.md) — what the library is, its design philosophy and platform-layer model

package/index.d.ts

@@ -289,7 +289,7 @@ declare class Categories {
   static isValidHeading(heading: string): boolean;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@changesets+types@7.0.0-next.8/node_modules/@changesets/types/dist/index.d.mts
+//#region ../../node_modules/.pnpm/@changesets+types@7.0.0-next.9/node_modules/@changesets/types/dist/index.d.mts
 //#region src/index.d.ts
 type MaybePromise<T> = T | Promise<T>;
 type VersionType$1 = "major" | "minor" | "patch" | "none";
@@ -417,7 +417,6 @@ type ChangelogFunctions = {
 type PreState = {
   mode: "pre" | "exit";
   tag: string;
-  changesets: string[];
 };
 //#endregion
 //#region src/changesets/api/changelog.d.ts
@@ -8282,6 +8281,20 @@ declare class NoteNotFoundError extends NoteNotFoundErrorBase<{
 }> {
   get message(): string;
 }
+/** @internal */
+declare const ReposLockdownErrorBase: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ReposLockdownError";
+} & Readonly<A>;
+/**
+ * A permissions (lockdown) operation on a vendored repo failed.
+ * @public
+ */
+declare class ReposLockdownError extends ReposLockdownErrorBase<{
+  readonly path: string;
+  readonly reason: string;
+}> {
+  get message(): string;
+}
 //#endregion
 //#region src/repos/schemas/manifest.d.ts
 /**
@@ -8475,6 +8488,52 @@ declare class ReposConfigStore extends ReposConfigStore_base {
   static readonly layer: Layer.Layer<ReposConfigStore, never, FileSystem.FileSystem | Path.Path>;
 }
 //#endregion
+//#region src/repos/services/lockdown.d.ts
+/**
+ * The {@link ReposLockdown} service shape.
+ * @public
+ */
+interface ReposLockdownShape {
+  readonly lock: (root: string, name: string) => Effect.Effect<void, ReposLockdownError>;
+  readonly unlock: (root: string, name: string) => Effect.Effect<void, ReposLockdownError>;
+  readonly withUnlocked: <A, E, R>(root: string, name: string, effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | ReposLockdownError, R>;
+}
+/**
+ * Derives a submodule's git metadata directory (`.git/modules/...`) from the
+ * checkout itself rather than assuming it is named after the manifest key.
+ *
+ * A submodule worktree's `<root>/.repos/<name>/.git` is normally a FILE
+ * containing a single `gitdir: <path>` line pointing at the real metadata
+ * directory, which git names after whatever path/name the submodule was
+ * REGISTERED under — not necessarily the manifest key (e.g. this repo's own
+ * `effect` entry has gitdir `.git/modules/.repos/effect-smol`). This helper
+ * reads that pointer and resolves it (relative pointers are relative to the
+ * directory containing the `.git` file) so callers always land on the real
+ * metadata directory.
+ *
+ * Falls back to the name-based path `<root>/.git/modules/<REPOS_DIR>/<name>`
+ * whenever the pointer can't be read (submodule not initialized, `.git`
+ * missing) — this never fails, it only degrades to prior behavior. If
+ * `<root>/.repos/<name>/.git` is itself a directory (a plain, non-submodule
+ * checkout), it is used directly as the metadata directory.
+ *
+ * @internal
+ */
+declare const resolveModuleDir: (fs: FileSystem.FileSystem, path: Path.Path, root: string, name: string) => Effect.Effect<string>;
+declare const ReposLockdown_base: Context.ServiceClass<ReposLockdown, "@savvy-web/silk-effects/ReposLockdown", ReposLockdownShape>;
+/**
+ * Enforces OS-level read-only permissions on vendored repos so they cannot
+ * be accidentally edited outside the sync flow.
+ * @public
+ */
+declare class ReposLockdown extends ReposLockdown_base {
+  /**
+   * Production layer over the core FileSystem.
+   * @public
+   */
+  static readonly layer: Layer.Layer<ReposLockdown, never, FileSystem.FileSystem | Path.Path>;
+}
+//#endregion
 //#region src/repos/services/manager.d.ts
 /**
  * Minimum age (in milliseconds) a `.lock` file must reach before `sync` will
@@ -8499,15 +8558,15 @@ declare const STALE_LOCK_MAX_AGE_MS: number;
  */
 interface ReposManagerShape {
   readonly status: (root: string) => Effect.Effect<ReposStatusReport, ReposConfigError | GitSubmoduleError>;
-  readonly sync: (root: string) => Effect.Effect<ReposSyncReport, ReposConfigError | GitSubmoduleError>;
+  readonly sync: (root: string) => Effect.Effect<ReposSyncReport, ReposConfigError | GitSubmoduleError | ReposLockdownError>;
   readonly add: (root: string, options: {
     readonly url: string;
     readonly ref: string;
     readonly purpose: string;
     readonly name?: string;
     readonly sparse?: ReadonlyArray<string>;
-  }) => Effect.Effect<ReposAddResult, ReposConfigError | GitSubmoduleError>;
-  readonly pin: (root: string, name: string, ref: string) => Effect.Effect<ReposPinResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError>;
+  }) => Effect.Effect<ReposAddResult, ReposConfigError | GitSubmoduleError | ReposLockdownError>;
+  readonly pin: (root: string, name: string, ref: string) => Effect.Effect<ReposPinResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError | ReposLockdownError>;
   readonly note: (root: string, name: string, op: {
     readonly op: "add";
     readonly note: string;
@@ -8540,10 +8599,10 @@ declare class ReposManager extends ReposManager_base {
    * this module's {@link GitSubmoduleError} to keep the declared error unions.
    * @public
    */
-  static readonly layer: Layer.Layer<ReposManager, never, ReposConfigStore | Git | FileSystem.FileSystem | Path.Path>;
+  static readonly layer: Layer.Layer<ReposManager, never, ReposConfigStore | Git | FileSystem.FileSystem | Path.Path | ReposLockdown>;
 }
 declare namespace index_d_exports$3 {
-  export { GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NOTE_LIMIT, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposConfigStoreShape, ReposManager, ReposManagerShape, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS };
+  export { GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NOTE_LIMIT, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposConfigStoreShape, ReposLockdown, ReposLockdownError, ReposLockdownErrorBase, ReposLockdownShape, ReposManager, ReposManagerShape, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS, resolveModuleDir };
 }
 //#endregion
 //#region src/schemas/BiomeConfig.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/silk-effects",
-	"version": "5.3.0",
+	"version": "5.4.0",
 	"private": false,
 	"description": "Shared Effect library for Silk Suite conventions",
 	"homepage": "https://github.com/savvy-web/systems/tree/main/packages/silk-effects",
@@ -33,14 +33,14 @@
 		"@changesets/config": "^4.0.0-next.6",
 		"@changesets/get-github-info": "^1.0.0-next.4",
 		"@changesets/get-release-plan": "^5.0.0-next.9",
-		"@effected/commands": "^0.2.1",
+		"@effected/commands": "^0.3.1",
 		"@effected/git": "^0.5.2",
 		"@effected/glob": "^0.2.2",
 		"@effected/jsonc": "^0.5.2",
-		"@effected/package-json": "^0.7.2",
+		"@effected/package-json": "^0.7.3",
 		"@effected/templates": "^0.1.1",
 		"@effected/walker": "^0.3.4",
-		"@effected/workspaces": "^0.9.4",
+		"@effected/workspaces": "^0.10.0",
 		"@effected/yaml": "^0.6.1",
 		"@manypkg/get-packages": "^3.1.0",
 		"mdast-util-heading-range": "^4.0.0",

package/repos/errors.js

@@ -45,6 +45,17 @@ var NoteNotFoundError = class extends NoteNotFoundErrorBase {
 		return `no note "${this.id}" on vendored repo "${this.name}"`;
 	}
 };
+/** @internal */
+const ReposLockdownErrorBase = Data.TaggedError("ReposLockdownError");
+/**
+* A permissions (lockdown) operation on a vendored repo failed.
+* @public
+*/
+var ReposLockdownError = class extends ReposLockdownErrorBase {
+	get message() {
+		return `repos lockdown failed at ${this.path}: ${this.reason}`;
+	}
+};
 
 //#endregion
-export { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase };
+export { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase, ReposLockdownError, ReposLockdownErrorBase };

package/repos/index.js

@@ -1,9 +1,10 @@
 import { __exportAll } from "../_virtual/_rolldown/runtime.js";
 import { MANIFEST_PATH, REPOS_DIR } from "./constants.js";
-import { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase } from "./errors.js";
+import { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase, ReposLockdownError, ReposLockdownErrorBase } from "./errors.js";
 import { RepoEntry, RepoName, RepoNote, RepoOrientation, ReposManifestFile } from "./schemas/manifest.js";
 import { RepoStatusEntry, ReposAddResult, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport } from "./schemas/reports.js";
 import { ReposConfigStore } from "./services/config-store.js";
+import { ReposLockdown, resolveModuleDir } from "./services/lockdown.js";
 import { ReposManager, STALE_LOCK_MAX_AGE_MS } from "./services/manager.js";
 
 //#region src/repos/index.ts
@@ -26,14 +27,18 @@ var repos_exports = /* @__PURE__ */ __exportAll({
 	ReposConfigError: () => ReposConfigError,
 	ReposConfigErrorBase: () => ReposConfigErrorBase,
 	ReposConfigStore: () => ReposConfigStore,
+	ReposLockdown: () => ReposLockdown,
+	ReposLockdownError: () => ReposLockdownError,
+	ReposLockdownErrorBase: () => ReposLockdownErrorBase,
 	ReposManager: () => ReposManager,
 	ReposManifestFile: () => ReposManifestFile,
 	ReposNoteResult: () => ReposNoteResult,
 	ReposPinResult: () => ReposPinResult,
 	ReposStatusReport: () => ReposStatusReport,
 	ReposSyncReport: () => ReposSyncReport,
-	STALE_LOCK_MAX_AGE_MS: () => STALE_LOCK_MAX_AGE_MS
+	STALE_LOCK_MAX_AGE_MS: () => STALE_LOCK_MAX_AGE_MS,
+	resolveModuleDir: () => resolveModuleDir
 });
 
 //#endregion
-export { GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposManager, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS, repos_exports };
+export { GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposLockdown, ReposLockdownError, ReposLockdownErrorBase, ReposManager, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS, repos_exports, resolveModuleDir };

package/repos/services/lockdown.js

@@ -0,0 +1,119 @@
+import { REPOS_DIR } from "../constants.js";
+import { ReposLockdownError } from "../errors.js";
+import { Context, Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
+
+//#region src/repos/services/lockdown.ts
+const FILE_LOCKED_BASE_MODE = 292;
+const DIR_LOCKED_MODE = 365;
+const FILE_UNLOCKED_BASE_MODE = 420;
+const DIR_UNLOCKED_MODE = 493;
+const EXEC_BITS = 73;
+/**
+* Preserves the executable bit through a lock/unlock transition: a file
+* whose current mode has any of the owner/group/other execute bits set
+* locks to `0o555` and unlocks to `0o755` instead of stripping execute
+* permission entirely.
+*/
+const fileModeFor = (baseMode, currentMode) => baseMode | (currentMode & EXEC_BITS ? EXEC_BITS : 0);
+/**
+* Derives a submodule's git metadata directory (`.git/modules/...`) from the
+* checkout itself rather than assuming it is named after the manifest key.
+*
+* A submodule worktree's `<root>/.repos/<name>/.git` is normally a FILE
+* containing a single `gitdir: <path>` line pointing at the real metadata
+* directory, which git names after whatever path/name the submodule was
+* REGISTERED under — not necessarily the manifest key (e.g. this repo's own
+* `effect` entry has gitdir `.git/modules/.repos/effect-smol`). This helper
+* reads that pointer and resolves it (relative pointers are relative to the
+* directory containing the `.git` file) so callers always land on the real
+* metadata directory.
+*
+* Falls back to the name-based path `<root>/.git/modules/<REPOS_DIR>/<name>`
+* whenever the pointer can't be read (submodule not initialized, `.git`
+* missing) — this never fails, it only degrades to prior behavior. If
+* `<root>/.repos/<name>/.git` is itself a directory (a plain, non-submodule
+* checkout), it is used directly as the metadata directory.
+*
+* @internal
+*/
+const resolveModuleDir = (fs, path, root, name) => Effect.gen(function* () {
+	const fallback = path.join(root, ".git", "modules", REPOS_DIR, name);
+	const dotGit = path.join(root, REPOS_DIR, name, ".git");
+	const info = yield* fs.stat(dotGit).pipe(Effect.option);
+	if (Option.isNone(info)) return fallback;
+	if (info.value.type === "Directory") return dotGit;
+	const content = yield* fs.readFileString(dotGit).pipe(Effect.option);
+	if (Option.isNone(content)) return fallback;
+	const match = /^gitdir:\s*(.+)$/m.exec(content.value);
+	if (!match?.[1]) return fallback;
+	const pointer = match[1].trim();
+	const resolved = path.isAbsolute(pointer) ? pointer : path.resolve(path.dirname(dotGit), pointer);
+	const relative = path.relative(root, resolved);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) return fallback;
+	return resolved;
+});
+/**
+* Enforces OS-level read-only permissions on vendored repos so they cannot
+* be accidentally edited outside the sync flow.
+* @public
+*/
+var ReposLockdown = class extends Context.Service()("@savvy-web/silk-effects/ReposLockdown") {
+	/**
+	* Production layer over the core FileSystem.
+	* @public
+	*/
+	static layer = Layer.effect(this, Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const chmod = (entryPath, mode) => fs.chmod(entryPath, mode).pipe(Effect.mapError((cause) => new ReposLockdownError({
+			path: entryPath,
+			reason: `chmod failed: ${String(cause)}`
+		})));
+		const isSymlink = (entryPath) => fs.readLink(entryPath).pipe(Effect.option, Effect.map(Option.isSome));
+		const walk = (dir, fileBaseMode, dirMode, order) => Effect.gen(function* () {
+			if (order === "unlock") yield* chmod(dir, dirMode);
+			const entries = yield* fs.readDirectory(dir).pipe(Effect.mapError((cause) => new ReposLockdownError({
+				path: dir,
+				reason: `readDirectory failed: ${String(cause)}`
+			})));
+			for (const entry of entries) {
+				const entryPath = path.join(dir, entry);
+				if (yield* isSymlink(entryPath)) continue;
+				const maybeInfo = yield* fs.stat(entryPath).pipe(Effect.option);
+				if (Option.isNone(maybeInfo)) continue;
+				const info = maybeInfo.value;
+				if (info.type === "Directory") yield* walk(entryPath, fileBaseMode, dirMode, order);
+				else yield* chmod(entryPath, fileModeFor(fileBaseMode, info.mode));
+			}
+			if (order === "lock") yield* chmod(dir, dirMode);
+		});
+		const walkRoot = (root, name, fileBaseMode, dirMode, order) => Effect.gen(function* () {
+			const moduleDir = yield* resolveModuleDir(fs, path, root, name);
+			for (const dir of [path.join(root, REPOS_DIR, name), moduleDir]) {
+				if (!(yield* fs.exists(dir).pipe(Effect.mapError((cause) => new ReposLockdownError({
+					path: dir,
+					reason: `stat failed: ${String(cause)}`
+				}))))) continue;
+				yield* walk(dir, fileBaseMode, dirMode, order);
+			}
+		});
+		const lock = (root, name) => walkRoot(root, name, FILE_LOCKED_BASE_MODE, DIR_LOCKED_MODE, "lock");
+		const unlock = (root, name) => walkRoot(root, name, FILE_UNLOCKED_BASE_MODE, DIR_UNLOCKED_MODE, "unlock");
+		const withUnlocked = (root, name, effect) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+			const unlockExit = yield* Effect.exit(unlock(root, name));
+			const resultExit = Exit.isFailure(unlockExit) ? Exit.failCause(unlockExit.cause) : yield* Effect.exit(restore(effect));
+			const relockExit = yield* Effect.exit(lock(root, name));
+			if (Exit.isFailure(resultExit)) return yield* Exit.failCause(resultExit.cause);
+			if (Exit.isFailure(relockExit)) return yield* Exit.failCause(relockExit.cause);
+			return resultExit.value;
+		}));
+		return {
+			lock,
+			unlock,
+			withUnlocked
+		};
+	}));
+};
+
+//#endregion
+export { ReposLockdown, resolveModuleDir };

package/repos/services/manager.js

@@ -2,6 +2,7 @@ import { MANIFEST_PATH, REPOS_DIR } from "../constants.js";
 import { GitSubmoduleError, NoteNotFoundError, RepoNotFoundError, ReposConfigError } from "../errors.js";
 import { RepoName } from "../schemas/manifest.js";
 import { ReposConfigStore } from "./config-store.js";
+import { ReposLockdown, resolveModuleDir } from "./lockdown.js";
 import { Clock, Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { Git } from "@effected/git";
 import { createHash } from "node:crypto";
@@ -49,6 +50,7 @@ var ReposManager = class extends Context.Service()("@savvy-web/silk-effects/Repo
 		const fs = yield* FileSystem.FileSystem;
 		const path = yield* Path.Path;
 		const git = yield* Git;
+		const lockdown = yield* ReposLockdown;
 		/** Map any typed `@effected/git` failure onto this module's `GitSubmoduleError`. */
 		const asSubmoduleError = (command, cwd) => (error) => new GitSubmoduleError({
 			command,
@@ -88,33 +90,35 @@ var ReposManager = class extends Context.Service()("@savvy-web/silk-effects/Repo
 			const clearedLocks = [];
 			for (const [name, entry] of Object.entries(manifest.repos)) {
 				const repoPath = path.join(root, REPOS_DIR, name);
-				const moduleDir = path.join(root, ".git", "modules", REPOS_DIR, name);
-				let clearedAnyLock = false;
-				for (const lock of STALE_LOCKS) {
-					const lockPath = path.join(moduleDir, lock);
-					const info = yield* fs.stat(lockPath).pipe(Effect.option);
-					if (Option.isNone(info)) continue;
-					const mtime = info.value.mtime;
-					if (Option.isNone(mtime)) continue;
-					if ((yield* Clock.currentTimeMillis) - mtime.value.getTime() < 6e5) continue;
-					if (yield* fs.remove(lockPath).pipe(Effect.match({
-						onSuccess: () => true,
-						onFailure: () => false
-					}))) clearedAnyLock = true;
-				}
-				if (clearedAnyLock) clearedLocks.push(name);
-				if (!(yield* isPresent(repoPath))) {
-					yield* git.submoduleUpdate(root, {
-						init: true,
-						depth: 1,
-						paths: [`${REPOS_DIR}/${name}`]
-					}).pipe(Effect.mapError(asSubmoduleError(`git submodule update --init --depth 1 -- ${REPOS_DIR}/${name}`, root)));
-					initialized.push(name);
-				} else upToDate.push(name);
-				if (entry.sparse && entry.sparse.length > 0) {
-					yield* git.sparseCheckoutSet(repoPath, entry.sparse, { cone: false }).pipe(Effect.mapError(asSubmoduleError("git sparse-checkout set --no-cone", repoPath)));
-					sparseApplied.push(name);
-				}
+				const moduleDir = yield* resolveModuleDir(fs, path, root, name);
+				yield* lockdown.withUnlocked(root, name, Effect.gen(function* () {
+					let clearedAnyLock = false;
+					for (const lock of STALE_LOCKS) {
+						const lockPath = path.join(moduleDir, lock);
+						const info = yield* fs.stat(lockPath).pipe(Effect.option);
+						if (Option.isNone(info)) continue;
+						const mtime = info.value.mtime;
+						if (Option.isNone(mtime)) continue;
+						if ((yield* Clock.currentTimeMillis) - mtime.value.getTime() < 6e5) continue;
+						if (yield* fs.remove(lockPath).pipe(Effect.match({
+							onSuccess: () => true,
+							onFailure: () => false
+						}))) clearedAnyLock = true;
+					}
+					if (clearedAnyLock) clearedLocks.push(name);
+					if (!(yield* isPresent(repoPath))) {
+						yield* git.submoduleUpdate(root, {
+							init: true,
+							depth: 1,
+							paths: [`${REPOS_DIR}/${name}`]
+						}).pipe(Effect.mapError(asSubmoduleError(`git submodule update --init --depth 1 -- ${REPOS_DIR}/${name}`, root)));
+						initialized.push(name);
+					} else upToDate.push(name);
+					if (entry.sparse && entry.sparse.length > 0) {
+						yield* git.sparseCheckoutSet(repoPath, entry.sparse, { cone: false }).pipe(Effect.mapError(asSubmoduleError("git sparse-checkout set --no-cone", repoPath)));
+						sparseApplied.push(name);
+					}
+				}));
 			}
 			return {
 				initialized,
@@ -157,15 +161,17 @@ var ReposManager = class extends Context.Service()("@savvy-web/silk-effects/Repo
 			}));
 			const repoPath = `${REPOS_DIR}/${name}`;
 			const subPath = path.join(root, repoPath);
-			yield* git.submoduleAdd(root, {
-				url: options.url,
-				path: repoPath,
-				depth: 1
-			}).pipe(Effect.mapError(asSubmoduleError(`git submodule add --depth 1 ${options.url} ${repoPath}`, root)));
-			yield* git.configSet(root, `submodule.${repoPath}.shallow`, "true", { file: ".gitmodules" }).pipe(Effect.mapError(asSubmoduleError(`git config -f .gitmodules submodule.${repoPath}.shallow true`, root)));
-			yield* fetchRef(subPath, options.ref);
-			yield* git.checkout(subPath, "FETCH_HEAD", { detach: true }).pipe(Effect.mapError(asSubmoduleError("git checkout --detach FETCH_HEAD", subPath)));
-			if (options.sparse && options.sparse.length > 0) yield* git.sparseCheckoutSet(subPath, options.sparse, { cone: false }).pipe(Effect.mapError(asSubmoduleError("git sparse-checkout set --no-cone", subPath)));
+			yield* lockdown.withUnlocked(root, name, Effect.gen(function* () {
+				yield* git.submoduleAdd(root, {
+					url: options.url,
+					path: repoPath,
+					depth: 1
+				}).pipe(Effect.mapError(asSubmoduleError(`git submodule add --depth 1 ${options.url} ${repoPath}`, root)));
+				yield* git.configSet(root, `submodule.${repoPath}.shallow`, "true", { file: ".gitmodules" }).pipe(Effect.mapError(asSubmoduleError(`git config -f .gitmodules submodule.${repoPath}.shallow true`, root)));
+				yield* fetchRef(subPath, options.ref);
+				yield* git.checkout(subPath, "FETCH_HEAD", { detach: true }).pipe(Effect.mapError(asSubmoduleError("git checkout --detach FETCH_HEAD", subPath)));
+				if (options.sparse && options.sparse.length > 0) yield* git.sparseCheckoutSet(subPath, options.sparse, { cone: false }).pipe(Effect.mapError(asSubmoduleError("git sparse-checkout set --no-cone", subPath)));
+			}));
 			const entry = {
 				url: options.url,
 				ref: options.ref,
@@ -193,10 +199,15 @@ var ReposManager = class extends Context.Service()("@savvy-web/silk-effects/Repo
 			if (!entry) return yield* Effect.fail(new RepoNotFoundError({ name }));
 			const repoPath = `${REPOS_DIR}/${name}`;
 			const subPath = path.join(root, repoPath);
-			const oldCommit = yield* git.revParse(subPath, "HEAD").pipe(Effect.orElseSucceed(() => null));
-			yield* fetchRef(subPath, ref);
-			yield* git.checkout(subPath, "FETCH_HEAD", { detach: true }).pipe(Effect.mapError(asSubmoduleError("git checkout --detach FETCH_HEAD", subPath)));
-			const newCommit = yield* git.revParse(subPath, "HEAD").pipe(Effect.mapError(asSubmoduleError("git rev-parse HEAD", subPath)));
+			const { oldCommit, newCommit } = yield* lockdown.withUnlocked(root, name, Effect.gen(function* () {
+				const oldCommit = yield* git.revParse(subPath, "HEAD").pipe(Effect.orElseSucceed(() => null));
+				yield* fetchRef(subPath, ref);
+				yield* git.checkout(subPath, "FETCH_HEAD", { detach: true }).pipe(Effect.mapError(asSubmoduleError("git checkout --detach FETCH_HEAD", subPath)));
+				return {
+					oldCommit,
+					newCommit: yield* git.revParse(subPath, "HEAD").pipe(Effect.mapError(asSubmoduleError("git rev-parse HEAD", subPath)))
+				};
+			}));
 			yield* configStore.write(root, { repos: {
 				...manifest.repos,
 				[name]: {