@tea-agent/loop-agent 0.41.0 → 0.42.0-next.1

package/dist/executors/dag-pi-executor.js

@@ -13,8 +13,9 @@ import { captureWorkspaceWriteSnapshot, diffWorkspaceWriteSnapshots, } from "./w
 import { isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "../workflows/dag/retry-policy.js";
 import { assessBackendTestMdPlanCompleteness, assessBackendTestMdWriterCompleteness, assessBackendTestPytestPlanCompleteness, assessBackendTestPytestWriterCompleteness, assessBackendTestShardChildCompleteness, backendTestWriterProgressRoleForTask, classifyBackendTestWriterCompletenessFailure, isBackendTestCompletenessRetryCandidate, isBackendTestMdPlanTask, isBackendTestPytestPlanTask, isBackendTestShardChildTask, writeBackendTestWriterProgressArtifacts, } from "../workflows/dag/backend-test-writer-completeness.js";
 import { resolveBackendTestLayout } from "../workflows/dag/backend-test-layout.js";
-import { frontendTestLayoutFromSpec, } from "../workflows/dag/frontend-test-layout.js";
+import { frontendTestLayoutFromSpec } from "../workflows/dag/frontend-test-layout.js";
 import { redactSecrets, truncateUtf8Preview } from "../shared/preview.js";
+import { writeEffectiveContextReceipt } from "../workflows/dag/context-receipt.js";
 /**
  * Writer classification for a length-stopped thinking-only attempt: the model
  * exhausted its output budget thinking but never issued a write/edit tool call
@@ -516,7 +517,11 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     let playwrightToolContext;
     if (allowsPlaywrightCli && !isWriteTask) {
         return {
-            ok: false, stdout: "", stderr: "pi command capability requires an explicit bounded write tool profile", failureCategory: "tool-policy", durationMs: Date.now() - started,
+            ok: false,
+            stdout: "",
+            stderr: "pi command capability requires an explicit bounded write tool profile",
+            failureCategory: "tool-policy",
+            durationMs: Date.now() - started,
         };
     }
     const strictReadSet = (input.task.readSet?.length ?? 0) > 0;
@@ -642,14 +647,34 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         const piExtensionPaths = piExtensionsResolution && resolvePiBackend() !== "cli-only"
             ? piExtensionsResolution.resolved.flatMap((entry) => entry.entryPaths)
             : undefined;
+        const modelConfig = resolveDagPiModelConfig(input.model, input.thinking ? { thinking: input.thinking } : undefined);
+        const toolNames = resolveDagPiToolNames(input.task);
+        const userMessage = buildDagPiUserMessage(input.task, persona, step);
+        await writeEffectiveContextReceipt({
+            runDir: meta.runDir,
+            runId: meta.runId,
+            nodeId: input.task.id,
+            attempt,
+            task: input.task,
+            spec: meta.spec,
+            repoRoot: input.cwd,
+            systemPrompt: input.prompt,
+            userMessage,
+            resolvedModel: `${modelConfig.provider}/${modelConfig.model}`,
+            resolvedSkills: input.resolvedSkills ?? [],
+            resolvedExtensions: piExtensionsResolution && resolvePiBackend() !== "cli-only"
+                ? piExtensionsResolution.resolved.map((entry) => entry.id)
+                : [],
+            activeTools: toolNames,
+        });
         result = await piStepFn({
             attachedFiles: [],
-            modelConfig: resolveDagPiModelConfig(input.model, input.thinking ? { thinking: input.thinking } : undefined),
+            modelConfig,
             prompt: input.prompt,
             repoRoot: input.cwd,
             step,
-            toolNames: resolveDagPiToolNames(input.task),
-            userMessage: buildDagPiUserMessage(input.task, persona, step),
+            toolNames,
+            userMessage,
             sessionEventsPath: path.join(meta.runDir, input.task.id, "session-events.jsonl"),
             // Absolute max wall clock from adaptive liveness policy (defaults to 4h).
             timeoutMs: input.timeoutMs,
@@ -927,8 +952,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         });
     }
     let completenessFailure;
-    if (writeGuardOk &&
-        isBackendTestCompletenessRetryCandidate(input.task)) {
+    if (writeGuardOk && isBackendTestCompletenessRetryCandidate(input.task)) {
         try {
             const writerRole = backendTestWriterProgressRoleForTask(input.task.id);
             const backendLayout = resolveBackendTestLayout(meta.spec.backendTestLayout
@@ -941,7 +965,9 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             const progress = isBackendTestShardChildTask(input.task)
                 ? await assessBackendTestShardChildCompleteness({
                     workspaceRoot: input.cwd,
-                    role: writerRole === "pytest-generate" ? "pytest-generate" : "md-generate",
+                    role: writerRole === "pytest-generate"
+                        ? "pytest-generate"
+                        : "md-generate",
                     writeSet: input.task.writeSet ?? [],
                 })
                 : isBackendTestMdPlanTask(input.task)
@@ -987,7 +1013,10 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             };
         }
     }
-    if (mapped.ok && writeGuardOk && !writerOutcomeViolation && !completenessFailure) {
+    if (mapped.ok &&
+        writeGuardOk &&
+        !writerOutcomeViolation &&
+        !completenessFailure) {
         return mapped;
     }
     const writerThinkingExhausted = isWriterThinkingExhausted(result, mapped, changeManifestChangedFiles);
@@ -1393,9 +1422,7 @@ async function persistWriterChangeManifest(input) {
         ...(input.approvalSourceNodeId
             ? { approvalSourceNodeId: input.approvalSourceNodeId }
             : {}),
-        ...(input.approvalDigest
-            ? { approvalDigest: input.approvalDigest }
-            : {}),
+        ...(input.approvalDigest ? { approvalDigest: input.approvalDigest } : {}),
         changedFiles: input.changedFiles,
         beforeStatusSha256: createHash("sha256")
             .update(input.beforeStatus)

package/dist/executors/pi-sdk-executor.js

@@ -215,6 +215,9 @@ async function createSdkSession(sdk, input, shared) {
     const model = input.provider && input.model
         ? await resolveModel(modelRuntime, input.provider, input.model)
         : undefined;
+    if (input.provider && input.model && !model) {
+        throw new Error(`pi SDK model unavailable: ${input.provider}/${input.model}; refusing to fall back to the session default`);
+    }
     // Inject rate-limit-tolerant auto-retry settings for the session lifecycle.
     // Prefer SettingsManager.inMemory so harness runs do not depend on ~/.pi or
     // project .pi/settings.json being present/trusted.

package/dist/{worker → infrastructure}/console/app-data.js

@@ -35,6 +35,8 @@ export function openConsoleAppData(options) {
         fingerprint,
         drafts: path.join(repoNamespace, "drafts"),
         operations: path.join(repoNamespace, "operations"),
+        contextExports: path.join(repoNamespace, "context-exports"),
+        artifactRevisions: path.join(repoNamespace, "artifact-revisions"),
         confirmations: path.join(repoNamespace, "confirmations"),
         dagReceipts: path.join(repoNamespace, "dag-receipts"),
         staged: path.join(repoNamespace, "staged"),
@@ -48,6 +50,8 @@ export function openConsoleAppData(options) {
     for (const dir of [
         paths.drafts,
         paths.operations,
+        paths.contextExports,
+        paths.artifactRevisions,
         paths.confirmations,
         paths.dagReceipts,
         paths.staged,

package/dist/infrastructure/console/artifact-revision-store.js

@@ -0,0 +1,430 @@
+import { createHash, randomBytes } from "node:crypto";
+import { lstat, readdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { validateAndDescribeArtifactRevision, } from "../../shared/context-transfer/artifact-revision.js";
+import { artifactRevisionV1Schema, computeOverrideSetHash, } from "../../shared/context-transfer.js";
+import { assertSafeAppDataPath, ensureSecureDir, readJsonIfExists, writeSecureJson, } from "./app-data.js";
+import { acquireDirLock, isDirLockStale, } from "./dir-lock.js";
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+export const DEFAULT_ARTIFACT_REVISION_TTL_MS = 60 * 60 * 1000;
+/** Per-repo staging quota across uploads + staged candidates (M4b). */
+export const ARTIFACT_REVISION_STAGING_QUOTA_BYTES = 200 * 1024 * 1024;
+export const DEFAULT_REVISION_LEASE_TTL_MS = 5 * 60 * 1000;
+/**
+ * Execute holds the revision across an entire child run (potentially hours);
+ * align with the Console default operation timeout instead of the short
+ * staging TTL.
+ */
+export const EXECUTE_REVISION_LEASE_TTL_MS = 4 * 60 * 60 * 1000;
+const STAGING_LOCK_DIR = ".staging-lock";
+const STAGING_LOCK_STALE_MS = 30_000;
+function stagingLockDirPath(appData) {
+    return path.join(root(appData), STAGING_LOCK_DIR);
+}
+function revisionMutationLockDirPath(appData, revisionId) {
+    if (!/^[a-f0-9]{32}$/.test(revisionId))
+        throw new Error("invalid revision id");
+    return assertSafeAppDataPath(root(appData), path.join(root(appData), "locks", `${revisionId}.lock`));
+}
+/**
+ * Cross-process repo-wide mutex around the quota "measure → decide → write"
+ * window. In-process promise chains alone leave a TOCTOU window between the
+ * Console upload route and sibling CLI stage processes; a stale-tolerant
+ * exclusive directory lock closes it.
+ *
+ * Ownership is token-guarded: each holder writes a unique owner file inside
+ * the lock directory and only ever removes a lock whose owner token matches
+ * its own. Release verifies owner + freshness BEFORE touching the path (B2):
+ * a stale lock is never moved by its former holder, so an old holder cannot
+ * race a successor's takeover and a third contender cannot acquire while the
+ * new holder is still in its critical section.
+ */
+export async function acquireRepoStagingLock(appData, options) {
+    return acquireDirLock(stagingLockDirPath(appData), {
+        staleMs: options?.staleMs ?? STAGING_LOCK_STALE_MS,
+        token: options?.token,
+    });
+}
+async function withRepoStagingLock(appData, operation) {
+    const handle = await acquireRepoStagingLock(appData);
+    try {
+        return await operation();
+    }
+    finally {
+        await handle.release();
+    }
+}
+/**
+ * Cross-process per-revision serialization of metadata read-modify-write
+ * (B1). `serializeRevision` only serializes within one process; the Console
+ * and sibling CLI processes are separate processes that can both read
+ * metadata.json, mutate it, and write it back — losing an update (e.g. two
+ * executes, or an execute racing a discard, both "taking over" the lease).
+ * A per-revision directory lock held across the whole read-modify-write
+ * closes that window.
+ */
+async function withRevisionMutationLock(appData, revisionId, operation) {
+    const lockDir = revisionMutationLockDirPath(appData, revisionId);
+    const handle = await acquireDirLock(lockDir);
+    try {
+        return await operation();
+    }
+    finally {
+        await handle.release();
+    }
+}
+function root(appData) {
+    if (!appData.artifactRevisions)
+        throw new Error("artifact revision root unavailable");
+    return assertSafeAppDataPath(appData.root, appData.artifactRevisions);
+}
+function dir(appData, revisionId) {
+    if (!/^[a-f0-9]{32}$/.test(revisionId))
+        throw new Error("invalid revision id");
+    return assertSafeAppDataPath(root(appData), path.join(root(appData), revisionId));
+}
+function metadataPath(appData, revisionId) {
+    return path.join(dir(appData, revisionId), "metadata.json");
+}
+export function artifactRevisionUploadPath(appData, candidateSha256) {
+    if (!/^[a-f0-9]{64}$/.test(candidateSha256)) {
+        throw new Error("invalid candidate upload hash");
+    }
+    const uploadsDir = assertSafeAppDataPath(root(appData), path.join(root(appData), "uploads"));
+    return assertSafeAppDataPath(uploadsDir, path.join(uploadsDir, `${candidateSha256}.bin`));
+}
+export async function totalArtifactRevisionStagingBytes(appData) {
+    let total = 0;
+    const stagingRoot = root(appData);
+    async function addFile(target) {
+        const stat = await lstat(target).catch(() => undefined);
+        if (stat?.isFile())
+            total += stat.size;
+    }
+    const uploadsDir = path.join(stagingRoot, "uploads");
+    const uploadsStat = await lstat(uploadsDir).catch(() => undefined);
+    if (uploadsStat?.isDirectory()) {
+        for (const entry of await readdir(uploadsDir)) {
+            if (!/^[a-f0-9]{64}\.bin$/.test(entry))
+                continue;
+            await addFile(path.join(uploadsDir, entry));
+        }
+    }
+    for (const name of await readdir(stagingRoot)) {
+        if (!/^[a-f0-9]{32}$/.test(name))
+            continue;
+        await addFile(path.join(stagingRoot, name, "candidate.bin"));
+    }
+    return total;
+}
+function assertStagingQuota(input) {
+    const quota = input.quotaBytes ?? ARTIFACT_REVISION_STAGING_QUOTA_BYTES;
+    if (!Number.isSafeInteger(quota) || quota < 1)
+        throw new Error("invalid staging quota");
+    if (input.incomingBytes > quota) {
+        throw new Error("ARTIFACT_REVISION_QUOTA_EXCEEDED: candidate exceeds staging quota");
+    }
+}
+export async function writeArtifactRevisionUpload(input) {
+    return withRepoStagingLock(input.appData, async () => {
+        const actual = createHash("sha256").update(input.candidateBytes).digest("hex");
+        if (actual !== input.candidateSha256) {
+            throw new Error("ARTIFACT_REVISION_DRIFT: candidate hash mismatch");
+        }
+        const uploadPath = artifactRevisionUploadPath(input.appData, input.candidateSha256);
+        // Idempotent upload (SF6): if the exact candidate already exists in the
+        // uploads dir, a retry of the same request must not consume quota again —
+        // the bytes are already accounted for. This prevents a spurious quota
+        // error when an idempotent retry arrives near the staging limit.
+        const existing = await lstat(uploadPath).catch(() => undefined);
+        if (existing) {
+            const existingBytes = await readFileBoundarySafe({
+                boundaryRoot: path.dirname(uploadPath),
+                targetPath: uploadPath,
+                label: "artifact revision upload",
+            });
+            if (createHash("sha256").update(existingBytes).digest("hex") !== input.candidateSha256) {
+                throw new Error("ARTIFACT_REVISION_DRIFT: existing staged upload hash mismatch");
+            }
+            return uploadPath;
+        }
+        assertStagingQuota({
+            appData: input.appData,
+            incomingBytes: input.candidateBytes.byteLength,
+            quotaBytes: input.quotaBytes,
+        });
+        const stagedBytes = await totalArtifactRevisionStagingBytes(input.appData);
+        const quota = input.quotaBytes ?? ARTIFACT_REVISION_STAGING_QUOTA_BYTES;
+        if (stagedBytes + input.candidateBytes.byteLength > quota) {
+            throw new Error("ARTIFACT_REVISION_QUOTA_EXCEEDED: repo staging quota exhausted");
+        }
+        ensureSecureDir(path.dirname(uploadPath));
+        await writeFile(uploadPath, input.candidateBytes, { flag: "wx", mode: 0o600 });
+        return uploadPath;
+    });
+}
+export async function createArtifactRevision(input) {
+    return withRepoStagingLock(input.appData, async () => {
+        const revisionId = randomBytes(16).toString("hex");
+        const revisionDir = dir(input.appData, revisionId);
+        ensureSecureDir(revisionDir);
+        const now = input.now ?? new Date();
+        const ttlMs = input.ttlMs ?? DEFAULT_ARTIFACT_REVISION_TTL_MS;
+        if (!Number.isSafeInteger(ttlMs) || ttlMs < 1)
+            throw new Error("invalid revision TTL");
+        assertStagingQuota({
+            appData: input.appData,
+            incomingBytes: input.candidateBytes.byteLength,
+            quotaBytes: input.quotaBytes,
+        });
+        const stagedBytes = await totalArtifactRevisionStagingBytes(input.appData);
+        const quota = input.quotaBytes ?? ARTIFACT_REVISION_STAGING_QUOTA_BYTES;
+        if (stagedBytes + input.candidateBytes.byteLength > quota) {
+            throw new Error("ARTIFACT_REVISION_QUOTA_EXCEEDED: repo staging quota exhausted");
+        }
+        const stagingPath = `artifact-revisions/${revisionId}/candidate.bin`;
+        const described = validateAndDescribeArtifactRevision({
+            revisionId,
+            parentRunId: input.parentRunId,
+            producerNodeId: input.producerNodeId,
+            declaration: input.declaration,
+            parentSha256: input.parentSha256,
+            parentBytes: input.parentBytes,
+            candidateBytes: input.candidateBytes,
+            mediaType: input.mediaType,
+            stagingPath,
+            uploadedAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+            ...(input.artifactSchemaResolver
+                ? { artifactSchemaResolver: input.artifactSchemaResolver }
+                : {}),
+        });
+        await writeFile(path.join(revisionDir, "candidate.bin"), input.candidateBytes, {
+            flag: "wx",
+            mode: 0o600,
+        });
+        if (described.diffPreview) {
+            await writeFile(path.join(revisionDir, "diff.txt"), described.diffPreview, {
+                flag: "wx",
+                mode: 0o600,
+            });
+        }
+        await writeSecureJson(metadataPath(input.appData, revisionId), described.revision);
+        return described.revision;
+    });
+}
+export async function readArtifactRevision(appData, revisionId) {
+    const raw = await readJsonIfExists(metadataPath(appData, revisionId));
+    if (raw === undefined)
+        return undefined;
+    return artifactRevisionV1Schema.parse(raw);
+}
+/**
+ * Explicit staging lease (M4c). A fresh lease held by another holder blocks
+ * conflicting mutations with LEASE_HELD; the same holder may renew (sliding
+ * TTL); a stale/expired lease is taken over. Recorded in metadata.json so a
+ * crashed holder stays visible until the TTL lapses.
+ */
+export async function acquireArtifactRevisionLease(input) {
+    return withRevisionMutationLock(input.appData, input.revisionId, async () => {
+        const current = await readArtifactRevision(input.appData, input.revisionId);
+        if (!current || current.state !== "validated") {
+            throw new Error("ARTIFACT_REVISION_EXPIRED");
+        }
+        const now = input.now ?? new Date();
+        const ttlMs = input.ttlMs ?? DEFAULT_REVISION_LEASE_TTL_MS;
+        if (!Number.isSafeInteger(ttlMs) || ttlMs < 1)
+            throw new Error("invalid lease TTL");
+        const existing = current.lease;
+        if (existing && Date.parse(existing.expiresAt) > now.getTime() && existing.holder !== input.holder) {
+            throw new Error("LEASE_HELD");
+        }
+        const leased = artifactRevisionV1Schema.parse({
+            ...current,
+            lease: {
+                holder: input.holder,
+                acquiredAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+            },
+        });
+        await writeSecureJson(metadataPath(input.appData, input.revisionId), leased);
+        return leased;
+    });
+}
+export async function releaseArtifactRevisionLease(input) {
+    return withRevisionMutationLock(input.appData, input.revisionId, async () => {
+        const current = await readArtifactRevision(input.appData, input.revisionId);
+        if (!current)
+            throw new Error("ARTIFACT_REVISION_EXPIRED");
+        if (!current.lease)
+            return current;
+        if (current.lease.holder !== input.holder)
+            throw new Error("LEASE_HELD");
+        const { lease: _released, ...withoutLease } = current;
+        const released = artifactRevisionV1Schema.parse(withoutLease);
+        await writeSecureJson(metadataPath(input.appData, input.revisionId), released);
+        return released;
+    });
+}
+export async function readArtifactRevisionCandidate(input) {
+    if (input.revision.state !== "validated")
+        throw new Error("ARTIFACT_REVISION_EXPIRED");
+    if (Date.parse(input.revision.expiresAt) <= (input.now ?? new Date()).getTime()) {
+        throw new Error("ARTIFACT_REVISION_EXPIRED");
+    }
+    const candidatePath = path.join(dir(input.appData, input.revision.revisionId), "candidate.bin");
+    // fd-based TOCTOU-safe read: open with O_NOFOLLOW and verify the opened fd
+    // (regular single-link) instead of lstat-then-readFile on the path. Map any
+    // path-safety rejection back to the stable ARTIFACT_REVISION_PATH_INVALID
+    // contract.
+    let bytes;
+    try {
+        bytes = await readFileBoundarySafe({
+            boundaryRoot: dir(input.appData, input.revision.revisionId),
+            targetPath: candidatePath,
+            label: `revision candidate ${input.revision.revisionId}`,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (/symlink|hardlink|single-link|regular|boundary|escap/i.test(message)) {
+            throw new Error("ARTIFACT_REVISION_PATH_INVALID");
+        }
+        throw error;
+    }
+    const actual = await import("node:crypto").then(({ createHash }) => createHash("sha256").update(bytes).digest("hex"));
+    if (actual !== input.revision.candidate.sha256 || bytes.byteLength !== input.revision.candidate.bytes) {
+        throw new Error("ARTIFACT_REVISION_DRIFT");
+    }
+    return bytes;
+}
+export function buildArtifactOverrideSet(revision) {
+    const overrides = [{
+            revisionId: revision.revisionId,
+            parentArtifact: {
+                runId: revision.parent.runId,
+                nodeId: revision.parent.nodeId,
+                path: revision.parent.artifactPath,
+                sha256: revision.parent.artifactSha256,
+            },
+            replacement: {
+                sha256: revision.candidate.sha256,
+                bytes: revision.candidate.bytes,
+                mediaType: revision.candidate.mediaType,
+            },
+            supersedes: revision.parent.artifactSha256,
+        }];
+    return { schemaVersion: 1, overrides, overrideSetHash: computeOverrideSetHash(overrides) };
+}
+export async function consumeArtifactRevision(input) {
+    return withRevisionMutationLock(input.appData, input.revisionId, async () => {
+        const current = await readArtifactRevision(input.appData, input.revisionId);
+        if (!current || current.state !== "validated")
+            throw new Error("ARTIFACT_REVISION_EXPIRED");
+        const now = input.now ?? new Date();
+        const existing = current.lease;
+        if (existing &&
+            Date.parse(existing.expiresAt) > now.getTime() &&
+            existing.holder !== (input.holder ?? "cli-mutation")) {
+            throw new Error("LEASE_HELD");
+        }
+        if (current.candidate.sha256 !== input.expectedSha256)
+            throw new Error("ARTIFACT_REVISION_DRIFT");
+        // Terminal states must never keep a live staging lock.
+        const consumed = artifactRevisionV1Schema.parse({
+            ...current,
+            state: "consumed",
+            lease: undefined,
+        });
+        await writeSecureJson(metadataPath(input.appData, input.revisionId), consumed);
+        return consumed;
+    });
+}
+export async function discardArtifactRevision(input) {
+    return withRevisionMutationLock(input.appData, input.revisionId, async () => {
+        const current = await readArtifactRevision(input.appData, input.revisionId);
+        if (!current)
+            throw new Error("ARTIFACT_REVISION_EXPIRED");
+        const now = input.now ?? new Date();
+        if (current.state === "discarded")
+            return current;
+        if (current.state === "consumed")
+            throw new Error("ARTIFACT_REVISION_ALREADY_CONSUMED");
+        const existing = current.lease;
+        if (existing &&
+            Date.parse(existing.expiresAt) > now.getTime() &&
+            existing.holder !== (input.holder ?? "cli-mutation")) {
+            throw new Error("LEASE_HELD");
+        }
+        const discarded = artifactRevisionV1Schema.parse({
+            ...current,
+            state: "discarded",
+            lease: undefined,
+        });
+        await writeSecureJson(metadataPath(input.appData, input.revisionId), discarded);
+        await Promise.all([
+            rm(path.join(dir(input.appData, input.revisionId), "candidate.bin"), { force: true }),
+            rm(path.join(dir(input.appData, input.revisionId), "diff.txt"), { force: true }),
+        ]);
+        return discarded;
+    });
+}
+export async function reconcileArtifactRevisions(input) {
+    ensureSecureDir(root(input.appData));
+    const now = input.now ?? new Date();
+    const removed = [];
+    for (const name of await readdir(root(input.appData))) {
+        if (!/^[a-f0-9]{32}$/.test(name))
+            continue;
+        const revision = await readArtifactRevision(input.appData, name).catch(() => undefined);
+        if (!revision || Date.parse(revision.expiresAt) <= now.getTime()) {
+            await rm(dir(input.appData, name), { recursive: true, force: true });
+            removed.push(name);
+        }
+    }
+    const uploadsDir = path.join(root(input.appData), "uploads");
+    const uploadsBefore = await lstat(uploadsDir).catch(() => undefined);
+    if (uploadsBefore?.isDirectory()) {
+        const cutoff = now.getTime() - DEFAULT_ARTIFACT_REVISION_TTL_MS;
+        for (const entry of await readdir(uploadsDir)) {
+            if (!/^[a-f0-9]{64}\.bin$/.test(entry))
+                continue;
+            const stat = await lstat(path.join(uploadsDir, entry)).catch(() => undefined);
+            if (!stat?.isFile() || stat.mtimeMs > cutoff)
+                continue;
+            await rm(path.join(uploadsDir, entry), { force: true });
+            removed.push(`uploads/${entry}`);
+        }
+    }
+    // Sweep orphaned staging-lock tombstones (takeover `.tomb` and release
+    // `.release` dirs left behind by a race) once they are older than the
+    // default TTL. Tombstones are never the live lock path.
+    const cutoff = now.getTime() - DEFAULT_ARTIFACT_REVISION_TTL_MS;
+    for (const entry of await readdir(root(input.appData))) {
+        if (!/^\.staging-lock\..+\.(?:tomb|release)$/.test(entry))
+            continue;
+        const stat = await lstat(path.join(root(input.appData), entry)).catch(() => undefined);
+        if (!stat?.isDirectory() || stat.mtimeMs > cutoff)
+            continue;
+        await rm(path.join(root(input.appData), entry), { recursive: true, force: true });
+        removed.push(`lock/${entry}`);
+    }
+    // Sweep orphaned per-revision mutation lock dirs (crashed holder) once they
+    // are older than the default TTL. The per-revision lock path is stable
+    // (`locks/<revisionId>.lock`); a fresh lock is never swept.
+    const locksDir = path.join(root(input.appData), "locks");
+    const locksStat = await lstat(locksDir).catch(() => undefined);
+    if (locksStat?.isDirectory()) {
+        for (const entry of await readdir(locksDir)) {
+            if (!/^[a-f0-9]{32}\.lock$/.test(entry))
+                continue;
+            const lockPath = path.join(locksDir, entry);
+            const stat = await lstat(lockPath).catch(() => undefined);
+            if (!stat?.isDirectory() || !await isDirLockStale(lockPath, DEFAULT_ARTIFACT_REVISION_TTL_MS, now.getTime()))
+                continue;
+            await rm(lockPath, { recursive: true, force: true });
+            removed.push(`lock/${entry}`);
+        }
+    }
+    return removed;
+}