@tangle-network/agent-app 0.60.216 → 0.60.217

package/dist/{chunk-J3N6RNMH.js → chunk-WDY47GBR.js}

@@ -561,19 +561,303 @@ async function importConfig(abs) {
 }
 
 // src/signoff/run.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync8 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync9 } from "fs";
 import { availableParallelism, homedir } from "os";
-import { basename as basename2, join as join8, resolve as resolve3 } from "path";
+import { basename as basename4, join as join9, resolve as resolve4 } from "path";
+
+// src/signoff/cache.ts
+import { randomUUID } from "crypto";
+import { spawnSync as spawnSync3 } from "child_process";
+import {
+  existsSync as existsSync4,
+  lstatSync,
+  mkdirSync,
+  readFileSync as readFileSync3,
+  readdirSync,
+  renameSync,
+  rmSync as rmSync2,
+  readlinkSync,
+  realpathSync,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { hostname } from "os";
+import { basename as basename2, join as join4, relative, resolve as resolve2, sep } from "path";
+import lockfile from "proper-lockfile";
+var SIGNOFF_CACHE_MAX_AGE_MS = 3 * 24 * 60 * 60 * 1e3;
+var SIGNOFF_CACHE_MAX_BYTES = 4 * 1024 ** 3;
+function processStart(pid) {
+  try {
+    const stat = readFileSync3(`/proc/${pid}/stat`, "utf8");
+    return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19] ?? null;
+  } catch {
+    return null;
+  }
+}
+function hasRunProcesses(run) {
+  if (process.platform !== "linux") return true;
+  try {
+    for (const entry of readdirSync("/proc")) {
+      if (!/^\d+$/.test(entry)) continue;
+      const proc = join4("/proc", entry);
+      try {
+        const start = processStart(Number(entry));
+        if (run.processStart && start && BigInt(start) < BigInt(run.processStart)) continue;
+        const cwd = readlinkSync(join4(proc, "cwd"));
+        if (cwd === run.tree || cwd.startsWith(run.tree + sep)) return true;
+        const env = readFileSync3(join4(proc, "environ"), "utf8").split("\0");
+        if (env.includes(`SIGNOFF_TREE=${run.tree}`)) return true;
+      } catch (error) {
+        if (["ENOENT", "ESRCH"].includes(error.code ?? "")) continue;
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return true;
+  }
+}
+function alive(run) {
+  if (run.host !== hostname()) return true;
+  try {
+    process.kill(run.pid, 0);
+  } catch (error) {
+    if (error.code === "ESRCH") return hasRunProcesses(run);
+    return true;
+  }
+  const currentStart = processStart(run.pid);
+  return !run.processStart || !currentStart || currentStart === run.processStart || hasRunProcesses(run);
+}
+function cacheRoot(cacheDir) {
+  mkdirSync(cacheDir, { recursive: true });
+  return realpathSync(cacheDir);
+}
+async function withCacheLock(cacheDir, action) {
+  const release = await lockfile.lock(cacheRoot(cacheDir), {
+    realpath: false,
+    stale: 3e5,
+    update: 3e4,
+    retries: { retries: 100, factor: 1, minTimeout: 100, maxTimeout: 100 }
+  });
+  try {
+    return await action();
+  } finally {
+    await release();
+  }
+}
+function markerDir(cacheDir) {
+  return join4(cacheDir, "active");
+}
+function writeMarker(path, run) {
+  const temp = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temp, `${JSON.stringify(run)}
+`, { flag: "wx" });
+  renameSync(temp, path);
+}
+function protectedPaths(cacheDir) {
+  const paths = /* @__PURE__ */ new Set();
+  const root = markerDir(cacheDir);
+  if (!existsSync4(root)) return { paths, unknown: false };
+  let unknown = false;
+  for (const entry of readdirSync(root)) {
+    if (!entry.endsWith(".json")) continue;
+    const file = join4(root, entry);
+    let run;
+    try {
+      run = JSON.parse(readFileSync3(file, "utf8"));
+      if (!Number.isSafeInteger(run.pid) || run.pid <= 0 || typeof run.host !== "string" || typeof run.tree !== "string" || !run.tree.startsWith(resolve2(cacheDir) + sep) || run.processStart !== null && (typeof run.processStart !== "string" || !/^\d+$/.test(run.processStart)) || run.storeKey !== null && (typeof run.storeKey !== "string" || !/^[a-f0-9]{64}$/.test(run.storeKey))) {
+        unknown = true;
+        continue;
+      }
+    } catch {
+      unknown = true;
+      continue;
+    }
+    if (!alive(run)) {
+      unlinkSync(file);
+      continue;
+    }
+    const tree = resolve2(run.tree);
+    if (tree.startsWith(resolve2(cacheDir) + sep)) paths.add(tree);
+    if (run.storeKey && /^[a-f0-9]{64}$/.test(run.storeKey)) {
+      paths.add(join4(cacheDir, "stores", run.storeKey));
+    }
+  }
+  return { paths, unknown };
+}
+function protectLegacyRuns(cacheDir, active) {
+  const trees = join4(cacheDir, "trees");
+  if (!existsSync4(trees)) return;
+  for (const entry of readdirSync(trees, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const tree = join4(trees, entry.name);
+    if (active.paths.has(tree) || !existsSync4(join4(tree, ".git"))) continue;
+    const match = /-(\d+)$/.exec(entry.name);
+    if (!match) continue;
+    const pid = Number(match[1]);
+    if (alive({ pid, host: hostname(), processStart: null, tree, storeKey: null })) {
+      active.paths.add(tree);
+      active.unknown = true;
+    }
+  }
+}
+async function openSignoffCacheSession(cacheDir, tree) {
+  const root = cacheRoot(cacheDir);
+  const treePath = resolve2(root, relative(resolve2(cacheDir), resolve2(tree)));
+  const file = join4(markerDir(root), `${process.pid}-${randomUUID()}.json`);
+  let run = {
+    pid: process.pid,
+    host: hostname(),
+    processStart: processStart(process.pid),
+    tree: treePath,
+    storeKey: null
+  };
+  await withCacheLock(root, () => {
+    mkdirSync(markerDir(root), { recursive: true });
+    writeMarker(file, run);
+  });
+  return {
+    cacheDir: root,
+    protectStore: async (cacheKey) => {
+      if (!/^[a-f0-9]{64}$/.test(cacheKey)) throw new Error("signoff: invalid store cache key");
+      await withCacheLock(root, () => {
+        run = { ...run, storeKey: cacheKey };
+        writeMarker(file, run);
+      });
+    },
+    close: async () => {
+      await withCacheLock(root, () => {
+        if (existsSync4(file)) unlinkSync(file);
+      });
+    }
+  };
+}
+function activeStoreKeys(cacheDir) {
+  cacheDir = cacheRoot(cacheDir);
+  const active = protectedPaths(cacheDir);
+  protectLegacyRuns(cacheDir, active);
+  const { paths, unknown } = active;
+  if (unknown && existsSync4(join4(cacheDir, "stores"))) return new Set(readdirSync(join4(cacheDir, "stores"), { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name));
+  return new Set([...paths].filter((path) => path.startsWith(join4(cacheDir, "stores") + sep)).map((path) => basename2(path)));
+}
+function allocatedBytes(stat) {
+  return process.platform === "win32" ? stat.size : stat.blocks * 512;
+}
+function collectInodes(path, keys, sizes) {
+  let stat;
+  try {
+    stat = lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  const key = `${stat.dev}:${stat.ino}`;
+  keys.add(key);
+  sizes.set(key, allocatedBytes(stat));
+  if (!stat.isDirectory() || stat.isSymbolicLink()) return;
+  let children;
+  try {
+    children = readdirSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  for (const child of children) collectInodes(join4(path, child), keys, sizes);
+}
+function entries(cacheDir, protectedSet, unknown) {
+  const found = [];
+  for (const [kind, child] of [["tree", "trees"], ["store", "stores"]]) {
+    const root = join4(cacheDir, child);
+    if (!existsSync4(root)) continue;
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const path = join4(root, entry.name);
+      const recognized = kind === "store" ? /^[a-f0-9]{64}$/.test(entry.name) : existsSync4(join4(path, ".git"));
+      let mtimeMs;
+      try {
+        mtimeMs = statSync2(path).mtimeMs;
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw error;
+      }
+      found.push({
+        path,
+        kind,
+        mtimeMs,
+        protected: unknown || protectedSet.has(path) || !recognized,
+        inodes: /* @__PURE__ */ new Set()
+      });
+    }
+  }
+  return found;
+}
+function removeEntry(entry) {
+  if (entry.kind === "store") {
+    rmSync2(entry.path, { recursive: true, force: true });
+    return;
+  }
+  const git2 = spawnSync3("git", ["-C", entry.path, "worktree", "remove", "--force", entry.path], { encoding: "utf8" });
+  if (git2.status !== 0) throw new Error(`signoff: cannot retire cached worktree ${entry.path}: ${git2.stderr.trim()}`);
+}
+async function pruneSignoffCache(cacheDir, options = {}) {
+  const root = cacheRoot(cacheDir);
+  const nowMs = options.nowMs ?? Date.now();
+  const maxAgeMs = options.maxAgeMs ?? SIGNOFF_CACHE_MAX_AGE_MS;
+  const maxBytes = options.maxBytes ?? SIGNOFF_CACHE_MAX_BYTES;
+  if (!Number.isFinite(maxAgeMs) || maxAgeMs < 0 || !Number.isFinite(maxBytes) || maxBytes < 0) {
+    throw new Error("signoff: cache limits must be non-negative finite numbers");
+  }
+  return withCacheLock(root, () => {
+    const active = protectedPaths(root);
+    protectLegacyRuns(root, active);
+    for (const path of options.keepPaths ?? []) active.paths.add(resolve2(path));
+    const candidates = entries(root, active.paths, active.unknown);
+    const sizes = /* @__PURE__ */ new Map();
+    const references = /* @__PURE__ */ new Map();
+    for (const entry of candidates) {
+      collectInodes(entry.path, entry.inodes, sizes);
+      for (const key of entry.inodes) references.set(key, (references.get(key) ?? 0) + 1);
+    }
+    let bytes = [...sizes.values()].reduce((sum, size) => sum + size, 0);
+    const beforeBytes = bytes;
+    const selected = [];
+    const select = (entry) => {
+      selected.push(entry);
+      for (const key of entry.inodes) {
+        const remaining = (references.get(key) ?? 1) - 1;
+        references.set(key, remaining);
+        if (remaining === 0) bytes -= sizes.get(key) ?? 0;
+      }
+    };
+    const eligible = candidates.filter((entry) => !entry.protected).sort((a, b) => a.mtimeMs - b.mtimeMs);
+    for (const entry of eligible) {
+      if (nowMs - entry.mtimeMs >= maxAgeMs) select(entry);
+    }
+    for (const entry of eligible) {
+      if (bytes <= maxBytes) break;
+      if (!selected.includes(entry)) select(entry);
+    }
+    for (const entry of selected) removeEntry(entry);
+    return {
+      beforeBytes,
+      afterBytes: bytes,
+      removed: selected.map((entry) => entry.path),
+      overBudgetBytes: Math.max(0, bytes - maxBytes)
+    };
+  });
+}
 
 // src/signoff/node-version.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 
 // src/signoff/workflow-pin.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
-var WORKFLOW_DIR = join4(".github", "workflows");
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+var WORKFLOW_DIR = join5(".github", "workflows");
 function scalarValue(raw) {
   const withoutComment = raw.replace(/\s+#.*$/, "").trim();
   const quoted = /^(['"])(.*)\1$/.exec(withoutComment);
@@ -623,24 +907,24 @@ function pinsInWorkflow(repoRoot, file, source) {
       pins.push({ file, value, via: "node-version" });
       continue;
     }
-    const target = join4(repoRoot, value);
-    if (!existsSync4(target)) {
+    const target = join5(repoRoot, value);
+    if (!existsSync5(target)) {
       throw new Error(
         `signoff: ${file} reads its Node pin from "${value}" (node-version-file) and that file does not exist. The workflow this gate replaces cannot itself run, so there is nothing to verify against.`
       );
     }
-    const declared = readFileSync3(target, "utf8").split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
+    const declared = readFileSync4(target, "utf8").split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
     if (declared !== void 0) pins.push({ file, value: declared, via: `node-version-file ${value}` });
   }
   return pins;
 }
 function scanMergeGateNodePins(repoRoot) {
-  const dir = join4(repoRoot, WORKFLOW_DIR);
-  if (!existsSync4(dir)) return [];
+  const dir = join5(repoRoot, WORKFLOW_DIR);
+  if (!existsSync5(dir)) return [];
   const pins = [];
-  const files = readdirSync(dir).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).sort();
+  const files = readdirSync2(dir).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).sort();
   for (const name of files) {
-    const source = readFileSync3(join4(dir, name), "utf8");
+    const source = readFileSync4(join5(dir, name), "utf8");
     if (!triggersOnPullRequest(source)) continue;
     pins.push(...pinsInWorkflow(repoRoot, `${WORKFLOW_DIR}/${name}`, source));
   }
@@ -690,9 +974,9 @@ function resolveNodeRequirement(repoRoot, configured) {
     return { major, declared: configured.trim(), source: "signoff config `nodeVersion`" };
   }
   let fromNvmrc = null;
-  const nvmrc = join5(repoRoot, ".nvmrc");
-  if (existsSync5(nvmrc)) {
-    const raw = readFileSync4(nvmrc, "utf8").trim();
+  const nvmrc = join6(repoRoot, ".nvmrc");
+  if (existsSync6(nvmrc)) {
+    const raw = readFileSync5(nvmrc, "utf8").trim();
     const major = majorOf(raw);
     if (major !== null) fromNvmrc = { major, declared: raw, source: ".nvmrc" };
   }
@@ -716,9 +1000,9 @@ function assertNodeVersion(requirement, running = process.version) {
 }
 function assertNodeTypesVersion(repoRoot, requirement) {
   if (!requirement) return;
-  const packagePath = join5(repoRoot, "package.json");
-  if (!existsSync5(packagePath)) return;
-  const manifest = JSON.parse(readFileSync4(packagePath, "utf8"));
+  const packagePath = join6(repoRoot, "package.json");
+  if (!existsSync6(packagePath)) return;
+  const manifest = JSON.parse(readFileSync5(packagePath, "utf8"));
   const declared = manifest.devDependencies?.["@types/node"] ?? manifest.dependencies?.["@types/node"] ?? manifest.optionalDependencies?.["@types/node"];
   if (!declared) return;
   const declaredMajor = /^[~^]?v?(\d+)(?:\.|$)/.exec(declared.trim())?.[1];
@@ -727,11 +1011,11 @@ function assertNodeTypesVersion(repoRoot, requirement) {
       `signoff: this repo pins Node ${requirement.declared} but declares @types/node ${declared}. Use the latest @types/node ${requirement.major}.x release.`
     );
   }
-  const installedPath = join5(repoRoot, "node_modules", "@types", "node", "package.json");
-  if (!existsSync5(installedPath)) {
+  const installedPath = join6(repoRoot, "node_modules", "@types", "node", "package.json");
+  if (!existsSync6(installedPath)) {
     throw new Error(`signoff: @types/node is declared but missing after install in ${repoRoot}.`);
   }
-  const installed = JSON.parse(readFileSync4(installedPath, "utf8"));
+  const installed = JSON.parse(readFileSync5(installedPath, "utf8"));
   const installedMajor = majorOf(installed.version ?? "");
   if (installedMajor !== requirement.major) {
     throw new Error(
@@ -798,7 +1082,7 @@ function runCommand(options) {
     killGraceMs = DEFAULT_KILL_GRACE_MS,
     onData
   } = options;
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const startedAt = Date.now();
     const buffer = new BoundedOutput(maxOutputBytes);
     let timedOut = false;
@@ -848,7 +1132,7 @@ function runCommand(options) {
     });
     child.on("close", (code, sig) => {
       cleanup();
-      resolve7({
+      resolve8({
         command,
         cwd,
         // A signalled process reports code `null`; 128+n is the shell's own
@@ -1015,8 +1299,8 @@ function planAttempts(step, seedBase, overrideRuns) {
 
 // src/signoff/store.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync6, mkdirSync, readFileSync as readFileSync5, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, utimesSync, writeFileSync } from "fs";
-import { join as join6, relative, sep } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync6, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync3, utimesSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename3, join as join7, relative as relative2, sep as sep2 } from "path";
 var MANIFEST_FILES = [
   "pnpm-lock.yaml",
   "pnpm-workspace.yaml",
@@ -1029,12 +1313,12 @@ var MANIFEST_FILES = [
 ];
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", ".wrangler", ".react-router"]);
 function collectManifests(dir, root, out) {
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name)) continue;
-      collectManifests(join6(dir, entry.name), root, out);
+      collectManifests(join7(dir, entry.name), root, out);
     } else if (MANIFEST_FILES.includes(entry.name)) {
-      out.push(relative(root, join6(dir, entry.name)).split(sep).join("/"));
+      out.push(relative2(root, join7(dir, entry.name)).split(sep2).join("/"));
     }
   }
 }
@@ -1048,26 +1332,27 @@ function manifestCacheKey(treePath, files) {
   for (const rel of files) {
     hash.update(rel);
     hash.update("\0");
-    hash.update(createHash2("sha256").update(readFileSync5(join6(treePath, rel))).digest("hex"));
+    hash.update(createHash2("sha256").update(readFileSync6(join7(treePath, rel))).digest("hex"));
     hash.update("\n");
   }
   return hash.digest("hex");
 }
-function pruneStores(storesRoot, keep) {
-  if (!existsSync6(storesRoot)) return [];
-  const entries = readdirSync2(storesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const full = join6(storesRoot, entry.name);
-    return { full, mtimeMs: statSync2(full).mtimeMs };
+function pruneStores(storesRoot, keep, protectedKeys) {
+  if (!existsSync7(storesRoot)) return [];
+  const entries2 = readdirSync3(storesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^[a-f0-9]{64}$/.test(entry.name)).map((entry) => {
+    const full = join7(storesRoot, entry.name);
+    return { full, mtimeMs: statSync3(full).mtimeMs };
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   const pruned = [];
-  for (const stale of entries.slice(keep)) {
-    rmSync2(stale.full, { recursive: true, force: true });
+  for (const stale of entries2.slice(keep)) {
+    if (protectedKeys.has(basename3(stale.full))) continue;
+    rmSync3(stale.full, { recursive: true, force: true });
     pruned.push(stale.full);
   }
   return pruned;
 }
 function resolveStore(options) {
-  const { treePath, cacheDir, generations = 4 } = options;
+  const { treePath, cacheDir, generations = 4, protectedStoreKeys = /* @__PURE__ */ new Set() } = options;
   const files = manifestFiles(treePath);
   if (files.length === 0) {
     throw new Error(
@@ -1075,25 +1360,25 @@ function resolveStore(options) {
     );
   }
   const cacheKey = manifestCacheKey(treePath, files);
-  const storesRoot = join6(cacheDir, "stores");
-  const storeDir = join6(storesRoot, cacheKey);
-  const marker = join6(storeDir, ".signoff-store.json");
-  const hit = existsSync6(storeDir) && readdirSync2(storeDir).some((entry) => entry !== ".signoff-store.json");
-  mkdirSync(storeDir, { recursive: true });
-  writeFileSync(marker, `${JSON.stringify({ cacheKey, keyedOn: files, usedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+  const storesRoot = join7(cacheDir, "stores");
+  const storeDir = join7(storesRoot, cacheKey);
+  const marker = join7(storeDir, ".signoff-store.json");
+  const hit = existsSync7(storeDir) && readdirSync3(storeDir).some((entry) => entry !== ".signoff-store.json");
+  mkdirSync2(storeDir, { recursive: true });
+  writeFileSync2(marker, `${JSON.stringify({ cacheKey, keyedOn: files, usedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
   const now = /* @__PURE__ */ new Date();
   utimesSync(storeDir, now, now);
-  return { storeDir, cacheKey, hit, keyedOn: files, pruned: pruneStores(storesRoot, generations) };
+  return { storeDir, cacheKey, hit, keyedOn: files, pruned: pruneStores(storesRoot, generations, protectedStoreKeys) };
 }
 
 // src/signoff/workspace.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, join as join7, resolve as resolve2 } from "path";
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, isAbsolute, join as join8, resolve as resolve3 } from "path";
 function git(args, cwd) {
-  const result = spawnSync3("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  const result = spawnSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
   if (result.error) throw new Error(`signoff: git ${args.join(" ")} failed to start: ${result.error.message}`);
   if (result.status !== 0) {
     throw new Error(`signoff: git ${args.join(" ")} exited ${result.status}
@@ -1113,8 +1398,8 @@ function materializeCleanTree(options) {
   const head = git(["rev-parse", "HEAD"], root).trim();
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"], root).trim();
   git(["worktree", "prune"], root);
-  mkdirSync2(dirname2(dest), { recursive: true });
-  if (existsSync7(dest)) rmSync3(dest, { recursive: true, force: true });
+  mkdirSync3(dirname2(dest), { recursive: true });
+  if (existsSync8(dest)) rmSync4(dest, { recursive: true, force: true });
   git(["worktree", "add", "--detach", "--quiet", dest, head], root);
   let diffSha256 = null;
   let untrackedFiles = [];
@@ -1122,29 +1407,29 @@ function materializeCleanTree(options) {
     const patch = git(["diff", "HEAD", "--binary", "--no-color", "--no-ext-diff"], root);
     if (patch.length > 0) {
       diffSha256 = createHash3("sha256").update(patch).digest("hex");
-      const patchFile = join7(dirname2(dest), `${dest.split("/").pop() ?? "tree"}.patch`);
-      writeFileSync2(patchFile, patch);
+      const patchFile = join8(dirname2(dest), `${dest.split("/").pop() ?? "tree"}.patch`);
+      writeFileSync3(patchFile, patch);
       git(["apply", "--binary", "--whitespace=nowarn", patchFile], dest);
-      rmSync3(patchFile, { force: true });
+      rmSync4(patchFile, { force: true });
     }
     untrackedFiles = zsplit(git(["ls-files", "--others", "--exclude-standard", "-z"], root));
     for (const rel of untrackedFiles) {
-      const target = join7(dest, rel);
-      mkdirSync2(dirname2(target), { recursive: true });
-      copyFileSync(join7(root, rel), target);
+      const target = join8(dest, rel);
+      mkdirSync3(dirname2(target), { recursive: true });
+      copyFileSync(join8(root, rel), target);
     }
   }
   const carried = [];
   for (const rel of carryFiles) {
     if (isAbsolute(rel)) throw new Error(`signoff: carryFiles must be repo-relative; got "${rel}"`);
-    const from = resolve2(root, rel);
-    if (!existsSync7(from)) {
+    const from = resolve3(root, rel);
+    if (!existsSync8(from)) {
       throw new Error(
         `signoff: carryFiles names "${rel}", which does not exist at ${from}. Remove it from the config or create the file \u2014 installing without it would resolve against a different registry than the one you think you are verifying.`
       );
     }
-    const target = join7(dest, rel);
-    mkdirSync2(dirname2(target), { recursive: true });
+    const target = join8(dest, rel);
+    mkdirSync3(dirname2(target), { recursive: true });
     copyFileSync(from, target);
     carried.push(rel);
   }
@@ -1165,9 +1450,9 @@ function removeCleanTree(tree) {
 }
 
 // src/signoff/run.ts
-var DEFAULT_CACHE_DIR = join8(homedir(), ".cache", "agent-app-signoff");
+var DEFAULT_CACHE_DIR = join9(homedir(), ".cache", "agent-app-signoff");
 function hostFacts(treePath, requirement) {
-  const pm = spawnSync4("pnpm", ["--version"], { cwd: treePath, encoding: "utf8" });
+  const pm = spawnSync5("pnpm", ["--version"], { cwd: treePath, encoding: "utf8" });
   return {
     node: process.version,
     nodePinned: requirement?.declared ?? null,
@@ -1205,17 +1490,35 @@ function withStoreDir(command, flag, storeDir) {
 async function runSignoff(options = {}) {
   const startedAt = /* @__PURE__ */ new Date();
   const wallStart = Date.now();
-  const repoDir = resolve3(options.repoDir ?? process.cwd());
+  const repoDir = resolve4(options.repoDir ?? process.cwd());
   const repoRoot = repoRootOf(repoDir);
   const source = options.source ?? "working-tree";
-  let cacheDir = resolve3(options.cacheDir ?? DEFAULT_CACHE_DIR);
-  const treePath = () => join8(cacheDir, "trees", `${basename2(repoRoot)}-${process.pid}`);
+  let cacheDir = resolve4(options.cacheDir ?? DEFAULT_CACHE_DIR);
+  const treeName = `${basename4(repoRoot)}-${process.pid}-${randomUUID2()}`;
+  const treePath = () => join9(cacheDir, "trees", treeName);
   let tree = null;
+  const sessions = [];
+  let session = await openSignoffCacheSession(cacheDir, treePath());
+  sessions.push(session);
+  cacheDir = session.cacheDir;
+  const prune = async (root, keepPaths = []) => {
+    const result = await pruneSignoffCache(root, { keepPaths });
+    if (result.removed.length || result.overBudgetBytes) {
+      options.onEvent?.({ kind: "cache-prune", ...result });
+    }
+  };
   try {
+    await prune(cacheDir);
     tree = materializeCleanTree({ repoDir: repoRoot, dest: treePath(), source });
     let loaded = await loadSignoffConfig({ repoRoot: tree.path, configPath: options.configPath });
-    cacheDir = resolve3(options.cacheDir ?? loaded.config.cacheDir ?? DEFAULT_CACHE_DIR);
+    cacheDir = resolve4(options.cacheDir ?? loaded.config.cacheDir ?? DEFAULT_CACHE_DIR);
     if (tree.path !== treePath() || (loaded.config.carryFiles?.length ?? 0) > 0) {
+      if (session.cacheDir !== cacheDir) {
+        session = await openSignoffCacheSession(cacheDir, treePath());
+        sessions.push(session);
+        cacheDir = session.cacheDir;
+        await prune(cacheDir);
+      }
       removeCleanTree(tree);
       tree = materializeCleanTree({ repoDir: repoRoot, dest: treePath(), source, carryFiles: loaded.config.carryFiles });
       loaded = await loadSignoffConfig({ repoRoot: tree.path, configPath: options.configPath });
@@ -1226,10 +1529,16 @@ async function runSignoff(options = {}) {
     const nodeRequirement = resolveNodeRequirement(tree.path, config.nodeVersion);
     assertNodeVersion(nodeRequirement);
     options.onEvent?.({ kind: "tree", path: tree.path, head: tree.head, dirty: tree.dirty });
-    const store = resolveStore({ treePath: tree.path, cacheDir, generations: config.storeGenerations });
+    await session.protectStore(manifestCacheKey(tree.path, manifestFiles(tree.path)));
+    const store = await withCacheLock(cacheDir, () => resolveStore({
+      treePath: tree.path,
+      cacheDir,
+      generations: config.storeGenerations,
+      protectedStoreKeys: activeStoreKeys(cacheDir)
+    }));
     options.onEvent?.({ kind: "store", storeDir: store.storeDir, cacheHit: store.hit, cacheKey: store.cacheKey });
     const installSpec = config.install ?? {};
-    const installCwd = join8(tree.path, installSpec.cwd ?? ".");
+    const installCwd = join9(tree.path, installSpec.cwd ?? ".");
     const installCommand = withStoreDir(
       installSpec.run ?? "pnpm install --frozen-lockfile",
       installSpec.storeDirFlag,
@@ -1306,7 +1615,7 @@ async function runSignoff(options = {}) {
           options.onEvent?.({ kind: "step-start", name: step.name, command: plan.command, seed: plan.seed });
           const result = await runCommand({
             command: plan.command,
-            cwd: join8(treeRoot, step.cwd ?? "."),
+            cwd: join9(treeRoot, step.cwd ?? "."),
             env: buildEnv(sharedEnv, [step.env]),
             timeoutMs: step.timeoutMs,
             signal
@@ -1340,7 +1649,14 @@ async function runSignoff(options = {}) {
       options
     });
   } finally {
-    if (tree && !options.keepWorkspace && existsSync8(tree.path)) removeCleanTree(tree);
+    try {
+      if (tree && !options.keepWorkspace && existsSync9(tree.path)) removeCleanTree(tree);
+    } finally {
+      for (const active of sessions) {
+        await active.close();
+        await prune(active.cacheDir, options.keepWorkspace && tree ? [tree.path] : []);
+      }
+    }
   }
 }
 function runWorkerDefaults(treeRoot, workerConfigs, options) {
@@ -1772,8 +2088,8 @@ function round(value) {
 }
 
 // src/signoff/shell-alignment-cli.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, resolve as resolve4 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, resolve as resolve5 } from "path";
 function shellAlignmentUsage() {
   return [
     "Usage: agent-app-signoff shell-alignment --base-url <url> --route <path> [--route <path> ...] [options]",
@@ -1823,10 +2139,10 @@ function parseShellAlignmentArgs(argv) {
         });
         break;
       case "--storage-state":
-        out.storageState = resolve4(take());
+        out.storageState = resolve5(take());
         break;
       case "--theme-script":
-        out.themeScript = readFileSync6(resolve4(take()), "utf8");
+        out.themeScript = readFileSync7(resolve5(take()), "utf8");
         break;
       case "--ready":
         out.readySelector = take();
@@ -1838,7 +2154,7 @@ function parseShellAlignmentArgs(argv) {
         break;
       }
       case "--screenshots":
-        out.screenshotDir = resolve4(take());
+        out.screenshotDir = resolve5(take());
         break;
       case "--json":
         out.jsonPath = take();
@@ -1868,12 +2184,12 @@ ${shellAlignmentUsage()}
 `);
     return 2;
   }
-  if (options.screenshotDir) mkdirSync3(options.screenshotDir, { recursive: true });
+  if (options.screenshotDir) mkdirSync4(options.screenshotDir, { recursive: true });
   const report = await checkShellAlignment(options);
   if (options.jsonPath) {
-    const abs = resolve4(options.jsonPath);
-    mkdirSync3(dirname3(abs), { recursive: true });
-    writeFileSync3(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve5(options.jsonPath);
+    mkdirSync4(dirname3(abs), { recursive: true });
+    writeFileSync4(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${formatShellAlignmentReport(report)}
@@ -2165,8 +2481,8 @@ function formatSurfaceLadderReport(report) {
 }
 
 // src/signoff/surface-ladder-cli.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, resolve as resolve5 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, resolve as resolve6 } from "path";
 function surfaceLadderUsage() {
   return [
     "Usage: agent-app-signoff surface-ladder --base-url <url> --route <path> [--route <path> ...] [options]",
@@ -2224,10 +2540,10 @@ function parseSurfaceLadderArgs(argv) {
         });
         break;
       case "--storage-state":
-        out.storageState = resolve5(take());
+        out.storageState = resolve6(take());
         break;
       case "--theme-script":
-        out.themeScript = readFileSync7(resolve5(take()), "utf8");
+        out.themeScript = readFileSync8(resolve6(take()), "utf8");
         break;
       case "--ready":
         out.readySelector = take();
@@ -2245,10 +2561,10 @@ function parseSurfaceLadderArgs(argv) {
         break;
       }
       case "--inject-css":
-        out.injectCss = readFileSync7(resolve5(take()), "utf8");
+        out.injectCss = readFileSync8(resolve6(take()), "utf8");
         break;
       case "--screenshots":
-        out.screenshotDir = resolve5(take());
+        out.screenshotDir = resolve6(take());
         break;
       case "--json":
         out.jsonPath = take();
@@ -2278,12 +2594,12 @@ ${surfaceLadderUsage()}
 `);
     return 2;
   }
-  if (options.screenshotDir) mkdirSync4(options.screenshotDir, { recursive: true });
+  if (options.screenshotDir) mkdirSync5(options.screenshotDir, { recursive: true });
   const report = await checkSurfaceLadder(options);
   if (options.jsonPath) {
-    const abs = resolve5(options.jsonPath);
-    mkdirSync4(dirname4(abs), { recursive: true });
-    writeFileSync4(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve6(options.jsonPath);
+    mkdirSync5(dirname4(abs), { recursive: true });
+    writeFileSync5(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${formatSurfaceLadderReport(report)}
@@ -2376,8 +2692,8 @@ function formatWorkspaceSurfaceReport(report) {
 }
 
 // src/signoff/workspace-surface-cli.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname5, resolve as resolve6 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, resolve as resolve7 } from "path";
 var USAGE = [
   "Usage: agent-app-signoff workspace-surface --base-url <url> --route <path> [--route <path> ...] [options]",
   "",
@@ -2406,12 +2722,12 @@ ${USAGE}
 `);
     return 2;
   }
-  if (options.screenshotDir) mkdirSync5(options.screenshotDir, { recursive: true });
+  if (options.screenshotDir) mkdirSync6(options.screenshotDir, { recursive: true });
   const report = await checkWorkspaceSurface(options);
   if (options.jsonPath) {
-    const abs = resolve6(options.jsonPath);
-    mkdirSync5(dirname5(abs), { recursive: true });
-    writeFileSync5(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve7(options.jsonPath);
+    mkdirSync6(dirname5(abs), { recursive: true });
+    writeFileSync6(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${formatWorkspaceSurfaceReport(report)}
@@ -2469,4 +2785,4 @@ export {
   formatWorkspaceSurfaceReport,
   runWorkspaceSurfaceCli
 };
-//# sourceMappingURL=chunk-J3N6RNMH.js.map
+//# sourceMappingURL=chunk-WDY47GBR.js.map