@wjarka/cezarion 0.14.8 → 0.14.9-dev.1004

package/dist/artifacts/resolve.js

@@ -0,0 +1,102 @@
+import { constants } from 'node:fs';
+import { open, realpath, lstat } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { FILE_CONTENT_CAP, imageMimeType, isOsOpenableImage } from '../server/git-changes.js';
+import { artifactDirectory, listArtifacts, readArtifact } from './store.js';
+const IMAGE_CAP = 10 * 1024 * 1024;
+const contained = (root, path) => path === root || path.startsWith(root + sep);
+function privatePath(root, target) {
+    const segments = relative(root, target).split(sep);
+    return segments.includes('.git') || segments.some((part, i) => part === '.ai' && segments[i + 1] === 'cezar');
+}
+export function rasterMime(path) { return isOsOpenableImage(path) ? imageMimeType(path) : null; }
+export function artifactPreview(artifact, bytes) {
+    const binary = bytes.subarray(0, 8192).includes(0);
+    const tooLarge = bytes.length > FILE_CONTENT_CAP;
+    return { type: 'file', source: 'artifact', artifact, path: artifact.name, size: bytes.length, binary, tooLarge,
+        ...(!binary && !tooLarge ? { content: bytes.toString('utf8') } : {}) };
+}
+/** No outside source is opened or even stat'ed: it can only match a published snapshot. */
+export async function loadFileLink(ctx) {
+    const unavailable = (reason) => ({ preview: { type: 'unavailable', path: ctx.path, reason } });
+    let path;
+    try {
+        if (!ctx.path || ctx.path.length > 8192 || /[\u0000-\u001f]/.test(ctx.path))
+            return unavailable('Invalid file path.');
+        if (/^file:/i.test(ctx.path))
+            path = fileURLToPath(new URL(ctx.path));
+        else {
+            if (/^[a-z][a-z\d+.-]*:/i.test(ctx.path) && !/^[a-z]:[\\/]/i.test(ctx.path))
+                return unavailable('Not a local file path.');
+            // Query decoding has already happened. This is a literal filesystem path;
+            // decoding it again would turn a filename containing %20 into a space.
+            path = ctx.path;
+        }
+        if (/[\u0000-\u001f]/.test(path) || path.startsWith('//') || path.startsWith('\\\\'))
+            return unavailable('Network file paths are not supported.');
+        if (process.platform !== 'win32' && /^[a-z]:[\\/]/i.test(path))
+            return unavailable('This path belongs to a different operating system.');
+    }
+    catch {
+        return unavailable('Invalid local file URL or encoding.');
+    }
+    if (!isAbsolute(path) && !ctx.workingDirectory)
+        return unavailable('This task has no working directory.');
+    const target = resolve(ctx.workingDirectory ?? ctx.projectRoot, path);
+    const working = ctx.workingDirectory ? resolve(ctx.workingDirectory) : undefined;
+    const project = resolve(ctx.projectRoot);
+    const root = working && contained(working, target) ? working : contained(project, target) ? project : undefined;
+    if (!root) {
+        const directory = artifactDirectory(ctx.dataDir, ctx.runId);
+        const matches = (await listArtifacts(directory, ctx.runId)).filter(item => item.sourcePath === target)
+            .sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.id.localeCompare(a.id));
+        const entry = matches[0] ? await readArtifact(directory, ctx.runId, matches[0].id) : null;
+        if (entry)
+            return { preview: artifactPreview(entry.metadata, entry.bytes), ...(rasterMime(entry.metadata.name) ? { imageBytes: entry.bytes } : {}) };
+        return { preview: { type: 'unpublished', path: ctx.path, reason: 'This file is outside the project. Ask the agent to publish it with cez artifact publish <path> and share the returned link.' } };
+    }
+    if (privatePath(root, target)) {
+        return unavailable('Git internals and private Cezar state are not available through file links.');
+    }
+    try {
+        const info = await lstat(target);
+        if (info.isDirectory())
+            return unavailable('Choose a file inside this directory.');
+        if (!info.isFile() || info.isSymbolicLink())
+            return unavailable('Only regular files can be previewed; symlinks are not served.');
+        const [realRoot, actual] = await Promise.all([realpath(root), realpath(target)]);
+        if (!contained(realRoot, actual) || privatePath(realRoot, actual))
+            return unavailable('The file resolves outside the permitted directory or into private state.');
+        const handle = await open(actual, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile())
+                return unavailable('Not a regular file.');
+            const raster = rasterMime(target);
+            const cap = raster ? IMAGE_CAP : FILE_CONTENT_CAP;
+            const bytes = Buffer.alloc(Math.min(stat.size, cap) + 1);
+            let length = 0;
+            while (length < bytes.length) {
+                const { bytesRead } = await handle.read(bytes, length, bytes.length - length, length);
+                if (!bytesRead)
+                    break;
+                length += bytesRead;
+            }
+            const sample = bytes.subarray(0, length);
+            const binary = sample.subarray(0, 8192).includes(0);
+            const tooLarge = stat.size > FILE_CONTENT_CAP || length > FILE_CONTENT_CAP;
+            const preview = { type: 'file', source: root === working ? 'worktree' : 'project', path: target, size: stat.size, binary, tooLarge,
+                ...(!binary && !tooLarge ? { content: sample.toString('utf8') } : {}) };
+            return { preview, ...(raster && stat.size <= IMAGE_CAP && length <= IMAGE_CAP ? { imageBytes: sample } : {}) };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return unavailable('The file or its working directory is missing or cannot be read.');
+    }
+}
+export async function resolveFileLink(ctx) { return (await loadFileLink(ctx)).preview; }
+//# sourceMappingURL=resolve.js.map

package/dist/artifacts/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/artifacts/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC/F,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;AAChH,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,IAAmB,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAExH,MAAM,UAAU,eAAe,CAAC,QAA2B,EAAE,KAAa;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ;QAC5G,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAKD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAY;IAC7C,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/G,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;QACtH,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;aACjE,CAAC;YACJ,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;YAC1H,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC,uCAAuC,CAAC,CAAC;QAClJ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC,oDAAoD,CAAC,CAAC;IAC3I,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC;aACnG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrJ,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,6HAA6H,EAAE,EAAE,CAAC;IACrM,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,WAAW,CAAC,sCAAsC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACjI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC,0EAA0E,CAAC,CAAC;QAClK,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACpG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtF,IAAI,CAAC,SAAS;oBAAE,MAAM;gBACtB,MAAM,IAAI,SAAS,CAAC;YACtB,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,GAAG,gBAAgB,IAAI,MAAM,GAAG,gBAAgB,CAAC;YAC3E,MAAM,OAAO,GAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ;gBACjJ,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjH,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,iEAAiE,CAAC,CAAC;IAAC,CAAC;AACpG,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY,IAA6B,OAAO,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC"}

package/dist/artifacts/store.d.ts

@@ -0,0 +1,8 @@
+import { type PublishedArtifact } from '../contract/index.js';
+export declare function artifactDirectory(dataDir: string, runId: string): string;
+export declare function publishArtifact(directory: string, runId: string, source: string): Promise<PublishedArtifact>;
+export declare function readArtifact(directory: string, runId: string, id: string): Promise<{
+    metadata: PublishedArtifact;
+    bytes: Buffer;
+} | null>;
+export declare function listArtifacts(directory: string, runId: string): Promise<PublishedArtifact[]>;

package/dist/artifacts/store.js

@@ -0,0 +1,323 @@
+import { randomUUID, createHash } from 'node:crypto';
+import { constants, realpathSync } from 'node:fs';
+import { mkdir, open, opendir, realpath, lstat, rename, rm, writeFile } from 'node:fs/promises';
+import { basename, isAbsolute, join, parse, resolve, sep } from 'node:path';
+import { hostname } from 'node:os';
+import { setTimeout as delay } from 'node:timers/promises';
+import { z } from 'zod';
+import { publishedArtifactSchema } from '../contract/index.js';
+const MAX_FILE_BYTES = 10 * 1024 * 1024;
+const MAX_METADATA_BYTES = 32 * 1024;
+const MAX_RUN_BYTES = 64 * 1024 * 1024;
+const MAX_ARTIFACTS = 64;
+const MAX_DIRECTORY_ENTRIES = 1024;
+const readFlags = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+function validateContext(directory, runId) {
+    z.uuid().parse(runId);
+    if (!isAbsolute(directory) || basename(directory) !== `${runId}-artifacts`)
+        throw new Error('Invalid artifact task directory');
+}
+export function artifactDirectory(dataDir, runId) {
+    z.uuid().parse(runId);
+    // The server's trusted data root may have an OS alias (e.g. macOS /var).
+    // Only canonicalize that root; runs/task entry redirects remain forbidden.
+    let root = resolve(dataDir);
+    try {
+        root = realpathSync(root);
+    }
+    catch { /* absent storage reads as unavailable */ }
+    return join(root, 'runs', `${runId}-artifacts`);
+}
+function sameFile(a, b) {
+    return a.dev === b.dev && a.ino === b.ino;
+}
+function sameSnapshot(a, b) {
+    return sameFile(a, b) && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs && a.nlink === b.nlink;
+}
+/** Never use readFile on untrusted descriptors: a growing file otherwise bypasses the size check. */
+async function boundedRead(path, limit, stored = false) {
+    const file = await open(path, readFlags);
+    try {
+        const before = await file.stat({ bigint: true });
+        if (!before.isFile() || before.size > BigInt(limit) || (stored && before.nlink !== 1n))
+            throw new Error('Artifact must be a bounded regular file');
+        const buffer = Buffer.alloc(Number(before.size) + 1);
+        let count = 0;
+        while (count < buffer.length) {
+            const { bytesRead } = await file.read(buffer, count, buffer.length - count, count);
+            if (bytesRead === 0)
+                break;
+            count += bytesRead;
+        }
+        const after = await file.stat({ bigint: true });
+        const current = await lstat(path, { bigint: true });
+        if (count !== Number(before.size) || !sameSnapshot(before, after) || !sameFile(after, current) || current.isSymbolicLink())
+            throw new Error('File changed while publishing or reading artifact');
+        return buffer.subarray(0, count);
+    }
+    finally {
+        await file.close();
+    }
+}
+/** Reject symlinks in every storage component. Linux operations stay anchored to open directory
+ * descriptors; other platforms revalidate identity before/after use, not a same-user sandbox. */
+async function storageDirectory(path, create = false) {
+    const absolute = resolve(path);
+    let file;
+    const root = parse(absolute).root;
+    let current = root;
+    try {
+        file = await open(root, readFlags | constants.O_DIRECTORY);
+        for (const part of absolute.slice(root.length).split(sep).filter(Boolean)) {
+            current = join(current, part);
+            const anchored = process.platform === 'linux' ? join(`/proc/self/fd/${file.fd}`, part) : current;
+            if (create)
+                await mkdir(anchored, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+                    throw error; });
+            const next = await open(anchored, readFlags | constants.O_DIRECTORY);
+            await file.close();
+            file = next;
+        }
+        const handle = file;
+        const original = await handle.stat({ bigint: true });
+        const check = async () => {
+            if (await realpath(absolute) !== absolute || !sameFile(original, await lstat(absolute, { bigint: true })))
+                throw new Error('Redirected artifact storage');
+        };
+        await check();
+        return { path: process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : absolute, check, close: () => handle.close() };
+    }
+    catch (error) {
+        await file?.close();
+        throw error;
+    }
+}
+async function* entries(path) {
+    const stream = await opendir(path);
+    let count = 0;
+    for await (const entry of stream) {
+        if (++count > MAX_DIRECTORY_ENTRIES)
+            throw new Error('Artifact directory entry limit exceeded');
+        yield entry.name;
+    }
+}
+const ownerSchema = z.object({ pid: z.number().int().positive().max(2147483647), host: z.string().min(1).max(255) }).strict();
+async function reclaimDeadLock(root) {
+    let lock;
+    try {
+        const path = join(root.path, '.publish.lock');
+        lock = await open(path, readFlags | constants.O_DIRECTORY);
+        const pinned = process.platform === 'linux' ? `/proc/self/fd/${lock.fd}` : path;
+        const owner = ownerSchema.parse(JSON.parse((await boundedRead(join(pinned, 'owner.json'), 1024, true)).toString('utf8')));
+        if (owner.host !== hostname())
+            return;
+        try {
+            process.kill(owner.pid, 0);
+            return;
+        }
+        catch (error) {
+            if (error.code !== 'ESRCH')
+                return;
+        }
+        // Only one reaper can claim this inode. Keep its marker through the rename, so another
+        // observer of the old lock cannot remove a newly acquired lock (the stale-unlink race).
+        await mkdir(join(pinned, '.reaping'), { mode: 0o700 });
+        if (!sameFile(await lock.stat({ bigint: true }), await lstat(path, { bigint: true })))
+            return;
+        await root.check();
+        const retired = join(root.path, `.retired-lock-${randomUUID()}`);
+        await rename(path, retired);
+        await rm(retired, { recursive: true, force: true });
+    }
+    catch { /* Unknown owner, permission failure, or another reaper: fail closed and retry. */ }
+    finally {
+        await lock?.close();
+    }
+}
+async function acquireLock(root) {
+    const candidate = join(root.path, `.lock-candidate-${randomUUID()}`);
+    const path = join(root.path, '.publish.lock');
+    await mkdir(candidate, { mode: 0o700 });
+    try {
+        await writeFile(join(candidate, 'owner.json'), JSON.stringify({ pid: process.pid, host: hostname() }), { flag: 'wx', mode: 0o600 });
+        const identity = await lstat(candidate, { bigint: true });
+        const deadline = performance.now() + 5000;
+        for (;;) {
+            await root.check();
+            try {
+                // rename may replace an empty directory; an existing ownerless lock is not permission
+                // to publish. Cooperating publishers only introduce non-empty locks atomically.
+                const exists = await lstat(path).then(() => true, (error) => {
+                    if (error.code === 'ENOENT')
+                        return false;
+                    throw error;
+                });
+                if (!exists) {
+                    await rename(candidate, path);
+                    return async () => {
+                        if (sameFile(identity, await lstat(path, { bigint: true })))
+                            await rm(path, { recursive: true, force: true });
+                    };
+                }
+            }
+            catch (error) {
+                if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
+                    throw error;
+            }
+            if (performance.now() >= deadline)
+                throw new Error('Artifact publication lock is busy or has an unverifiable owner');
+            await reclaimDeadLock(root);
+            await delay(20);
+        }
+    }
+    finally {
+        await rm(candidate, { recursive: true, force: true });
+    }
+}
+async function checkCapacity(root, incomingBytes) {
+    let count = 0;
+    let bytes = 0;
+    for await (const id of entries(root.path)) {
+        if (!z.uuid().safeParse(id).success && !/^\.pending-[0-9a-f-]{36}$/i.test(id))
+            continue;
+        if (++count >= MAX_ARTIFACTS)
+            throw new Error('Artifact count limit exceeded');
+        let entry;
+        try {
+            entry = await open(join(root.path, id), readFlags | constants.O_DIRECTORY);
+            const pinned = process.platform === 'linux' ? `/proc/self/fd/${entry.fd}` : join(root.path, id);
+            const stat = await lstat(join(pinned, 'content'), { bigint: true });
+            if (!stat.isFile() || stat.nlink !== 1n || stat.size > BigInt(MAX_FILE_BYTES))
+                throw new Error('Unsafe stored artifact');
+            bytes += Number(stat.size);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        finally {
+            await entry?.close();
+        }
+        if (bytes + incomingBytes > MAX_RUN_BYTES)
+            throw new Error('Artifact task byte limit exceeded');
+    }
+}
+export async function publishArtifact(directory, runId, source) {
+    validateContext(directory, runId);
+    const root = await storageDirectory(directory, true);
+    let release;
+    let pending;
+    let staging;
+    try {
+        release = await acquireLock(root);
+        // With the publication lock held, no cooperating writer can own a temporary entry.
+        // Completed UUID entries are never evicted, even if their metadata is corrupt.
+        for await (const id of entries(root.path)) {
+            if (/^\.pending-[0-9a-f-]{36}$/i.test(id))
+                await rm(join(root.path, id), { recursive: true, force: true });
+        }
+        const bytes = await boundedRead(source, MAX_FILE_BYTES);
+        // A same-size rewrite inside one timestamp tick leaves the stat snapshot above
+        // unchanged, so reread and compare: any mutation that landed before this second
+        // read surfaces as differing bytes. Later mutations stay covered by the snapshot.
+        const reread = await boundedRead(source, MAX_FILE_BYTES);
+        if (!bytes.equals(reread))
+            throw new Error('File changed while publishing or reading artifact');
+        await checkCapacity(root, bytes.length);
+        const metadata = publishedArtifactSchema.parse({ id: randomUUID(), runId, name: basename(source), sourcePath: resolve(source), createdAt: new Date().toISOString(), size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex') });
+        pending = join(root.path, `.pending-${metadata.id}`);
+        await root.check();
+        await mkdir(pending, { mode: 0o700 });
+        staging = await open(pending, readFlags | constants.O_DIRECTORY);
+        const pinned = process.platform === 'linux' ? `/proc/self/fd/${staging.fd}` : pending;
+        await writeFile(join(pinned, 'content'), bytes, { mode: 0o600, flag: 'wx' });
+        await writeFile(join(pinned, 'metadata.json'), JSON.stringify(metadata), { mode: 0o600, flag: 'wx' });
+        if (!sameFile(await staging.stat({ bigint: true }), await lstat(pending, { bigint: true })))
+            throw new Error('Redirected artifact staging');
+        await root.check();
+        await rename(pending, join(root.path, metadata.id));
+        await root.check();
+        return metadata;
+    }
+    finally {
+        try {
+            await staging?.close();
+            if (pending)
+                await rm(pending, { recursive: true, force: true });
+        }
+        finally {
+            try {
+                await release?.();
+            }
+            finally {
+                await root.close();
+            }
+        }
+    }
+}
+async function readEntry(root, runId, id) {
+    if (!z.uuid().safeParse(id).success)
+        return null;
+    let entry;
+    try {
+        await root.check();
+        entry = await open(join(root.path, id), readFlags | constants.O_DIRECTORY);
+        const path = process.platform === 'linux' ? `/proc/self/fd/${entry.fd}` : join(root.path, id);
+        const metadata = publishedArtifactSchema.parse(JSON.parse((await boundedRead(join(path, 'metadata.json'), MAX_METADATA_BYTES, true)).toString('utf8')));
+        if (metadata.runId !== runId || metadata.id !== id || metadata.size > MAX_FILE_BYTES)
+            return null;
+        const bytes = await boundedRead(join(path, 'content'), MAX_FILE_BYTES, true);
+        if (bytes.length !== metadata.size || createHash('sha256').update(bytes).digest('hex') !== metadata.sha256)
+            return null;
+        if (!sameFile(await entry.stat({ bigint: true }), await lstat(join(root.path, id), { bigint: true })))
+            return null;
+        await root.check();
+        return { metadata, bytes };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        await entry?.close();
+    }
+}
+export async function readArtifact(directory, runId, id) {
+    let root;
+    try {
+        validateContext(directory, runId);
+        root = await storageDirectory(directory);
+        return await readEntry(root, runId, id);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        await root?.close();
+    }
+}
+export async function listArtifacts(directory, runId) {
+    let root;
+    try {
+        validateContext(directory, runId);
+        root = await storageDirectory(directory);
+        const artifacts = [];
+        let bytes = 0;
+        for await (const id of entries(root.path)) {
+            const entry = await readEntry(root, runId, id);
+            if (entry) {
+                bytes += entry.metadata.size;
+                artifacts.push(entry.metadata);
+                if (artifacts.length > MAX_ARTIFACTS || bytes > MAX_RUN_BYTES)
+                    return [];
+            }
+        }
+        return artifacts.sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.id.localeCompare(b.id));
+    }
+    catch {
+        return [];
+    }
+    finally {
+        await root?.close();
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/artifacts/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/artifacts/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAoB,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAmB,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAA0B,MAAM,8BAA8B,CAAC;AAE/F,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;AAEnF,SAAS,eAAe,CAAC,SAAiB,EAAE,KAAa;IACvD,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACjI,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,KAAa;IAC9D,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC;QAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;AAClD,CAAC;AACD,SAAS,QAAQ,CAAC,CAAc,EAAE,CAAc;IAC9C,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AACD,SAAS,YAAY,CAAC,CAAc,EAAE,CAAc;IAClD,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC;AAC1H,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,MAAM,GAAG,KAAK;IACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACnJ,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;YACnF,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,KAAK,IAAI,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACjM,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC;AAGD;iGACiG;AACjG,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAM,GAAG,KAAK;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAA4B,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAClC,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjG,IAAI,MAAM;gBAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;YACvB,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5J,CAAC,CAAC;QACF,MAAM,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACvD,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,EAAE,KAAK,GAAG,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChG,MAAM,KAAK,CAAC,IAAI,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9H,KAAK,UAAU,eAAe,CAAC,IAAe;IAC5C,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC9C,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1H,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE;YAAE,OAAO;QACtC,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3C,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO;QAAC,CAAC;QAChF,uFAAuF;QACvF,wFAAwF;QACxF,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO;QAC9F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,UAAU,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC,CAAC,kFAAkF,CAAC,CAAC;YACtF,CAAC;QAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AAClC,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAe;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpI,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1C,SAAS,CAAC;YACR,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,sFAAsF;gBACtF,gFAAgF;gBAChF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAA4B,EAAE,EAAE;oBACjF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,KAAK,CAAC;oBAC1C,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC9B,OAAO,KAAK,IAAI,EAAE;wBAChB,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;4BAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChH,CAAC,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC;YAClG,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACrH,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACtE,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAe,EAAE,aAAqB;IACjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACxF,IAAI,EAAE,KAAK,IAAI,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/E,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACzH,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;gBAChF,CAAC;YAAC,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QACjC,IAAI,KAAK,GAAG,aAAa,GAAG,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,KAAa,EAAE,MAAc;IACpF,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,OAA0C,CAAC;IAC/C,IAAI,OAA2B,CAAC;IAChC,IAAI,OAA+B,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAClC,mFAAmF;QACnF,+EAA+E;QAC/E,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACxD,+EAA+E;QAC/E,gFAAgF;QAChF,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAChG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpP,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACtF,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5I,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;YAAC,IAAI,OAAO;gBAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;gBACzF,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,OAAO,EAAE,EAAE,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAe,EAAE,KAAa,EAAE,EAAU;IACjE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,KAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxJ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACxH,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AAC5D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,KAAa,EAAE,EAAU;IAC7E,IAAI,IAA2B,CAAC;IAChC,IAAI,CAAC;QACH,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AAC3D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAa;IAClE,IAAI,IAA2B,CAAC;IAChC,IAAI,CAAC;QACH,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,SAAS,GAAwB,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC7B,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,IAAI,KAAK,GAAG,aAAa;oBAAE,OAAO,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AACzD,CAAC"}

package/dist/automations/scheduler.d.ts

@@ -15,11 +15,16 @@ export interface ProjectAutomationHandle {
     launch?: AutomationLauncher;
     onChange?: (automationId: string, revision: number) => void;
 }
+/** A different process currently owns this project's poll lock. */
+export declare class LeaseHeldError extends Error {
+    constructor();
+}
 export declare class ProjectAutomationScheduler {
     private readonly handle;
     constructor(handle: ProjectAutomationHandle);
     check(definition: AutomationDefinition, mode?: 'preview' | 'execute'): Promise<GithubPollResult>;
     private launch;
+    private recordSkip;
     private recordFailure;
 }
 export interface WorkspaceAutomationSchedulerOptions {
@@ -33,6 +38,7 @@ export declare class WorkspaceAutomationScheduler {
     private timer?;
     private stopped;
     private scheduleGeneration;
+    private readonly retryAfter;
     constructor(options: WorkspaceAutomationSchedulerOptions);
     start(): Promise<void>;
     reschedule(): Promise<void>;

package/dist/automations/scheduler.js

@@ -9,6 +9,10 @@ class GithubRequestArbiter {
     }
 }
 const githubRequests = new GithubRequestArbiter();
+/** A different process currently owns this project's poll lock. */
+export class LeaseHeldError extends Error {
+    constructor() { super('automation polling lease is held by another process'); }
+}
 export class ProjectAutomationScheduler {
     handle;
     constructor(handle) {
@@ -19,12 +23,13 @@ export class ProjectAutomationScheduler {
         if (detectionOnly)
             mode = 'preview';
         const { store } = this.handle;
-        const lease = store.acquireLease();
-        if (!lease)
-            throw new Error('automation polling lease is held by another process');
         const started = Date.now();
         let completion;
+        let lease;
         try {
+            lease = store.acquireLease();
+            if (!lease)
+                throw new LeaseHeldError();
             const state = store.state(definition.id) ?? {};
             if (state.backoffUntil && Date.parse(state.backoffUntil) > Date.now()) {
                 throw new Error(`automation is backed off until ${state.backoffUntil}`);
@@ -76,39 +81,53 @@ export class ProjectAutomationScheduler {
             return { ...result, candidates: eligible };
         }
         catch (error) {
-            if (mode === 'execute')
-                this.recordFailure(definition, error);
+            if (error instanceof LeaseHeldError)
+                await this.recordSkip(definition, error);
+            else if (mode === 'execute')
+                await this.recordFailure(definition, error);
             else
-                store.appendLog({ automationId: definition.id, revision: definition.revision, result: 'error', reason: error instanceof Error ? error.message : String(error) });
+                await store.appendLog({ automationId: definition.id, revision: definition.revision, result: 'error', reason: error instanceof Error ? error.message : String(error) });
             throw error;
         }
         finally {
-            if (completion)
-                store.appendLog({ automationId: definition.id, revision: definition.revision, ...completion, durationMs: Date.now() - started });
             try {
-                store.maybeCompact();
+                if (completion)
+                    await store.appendLog({ automationId: definition.id, revision: definition.revision, ...completion, durationMs: Date.now() - started });
+                if (lease) {
+                    try {
+                        await store.maybeCompact();
+                    }
+                    catch { /* append-only state remains readable; next check retries */ }
+                }
+            }
+            finally {
+                lease?.release();
             }
-            catch { /* append-only state remains readable; next check retries */ }
-            lease.release();
         }
     }
     async launch(definition, candidate) {
         const receipt = this.handle.store.reserveReceipt({ automationId: definition.id, revision: definition.revision, eventId: candidate.eventId, candidate });
         if (!receipt) {
-            this.handle.store.appendLog({ automationId: definition.id, revision: definition.revision, event: candidate.event, result: 'duplicate', reason: 'A durable receipt already exists for this automation and event.', githubNumber: candidate.number, githubTitle: candidate.title, githubUrl: candidate.url });
+            await this.handle.store.appendLog({ automationId: definition.id, revision: definition.revision, event: candidate.event, result: 'duplicate', reason: 'A durable receipt already exists for this automation and event.', githubNumber: candidate.number, githubTitle: candidate.title, githubUrl: candidate.url });
             return;
         }
         try {
             const launched = await this.handle.launch(definition, candidate, receipt.receiptId);
             this.handle.store.appendReceipt({ ...receipt, status: 'launched', runId: launched.runId, updatedAt: new Date().toISOString() });
-            this.handle.store.appendLog({ automationId: definition.id, revision: definition.revision, event: candidate.event, result: 'launched', receiptId: receipt.receiptId, runId: launched.runId, githubNumber: candidate.number, githubTitle: candidate.title, githubUrl: candidate.url });
+            await this.handle.store.appendLog({ automationId: definition.id, revision: definition.revision, event: candidate.event, result: 'launched', receiptId: receipt.receiptId, runId: launched.runId, githubNumber: candidate.number, githubTitle: candidate.title, githubUrl: candidate.url });
         }
         catch (error) {
             this.handle.store.appendReceipt({ ...receipt, status: 'launch-error', error: error instanceof Error ? error.message : String(error), updatedAt: new Date().toISOString() });
             throw error;
         }
     }
-    recordFailure(definition, error) {
+    async recordSkip(definition, error) {
+        const { store } = this.handle;
+        await store.appendLog({ automationId: definition.id, revision: definition.revision, result: 'skipped', reason: error.message });
+        // The lease owner may be writing state. The workspace retry floor handles our next attempt.
+        this.handle.onChange?.(definition.id, definition.revision);
+    }
+    async recordFailure(definition, error) {
         const state = this.handle.store.state(definition.id) ?? {};
         const failures = (state.consecutiveFailures ?? 0) + 1;
         const delay = Math.min(6 * 60 * 60_000, 60_000 * 2 ** (failures - 1));
@@ -118,7 +137,7 @@ export class ProjectAutomationScheduler {
             backoffUntil: new Date(Date.now() + delay).toISOString(),
             nextCheckAt: new Date(Date.now() + delay).toISOString(),
         });
-        this.handle.store.appendLog({ automationId: definition.id, revision: definition.revision, result: 'error', reason: error instanceof Error ? error.message : String(error) });
+        await this.handle.store.appendLog({ automationId: definition.id, revision: definition.revision, result: 'error', reason: error instanceof Error ? error.message : String(error) });
         this.handle.onChange?.(definition.id, definition.revision);
     }
 }
@@ -131,12 +150,14 @@ function laterCursor(current, observed) {
         || observed.tieBreaker.localeCompare(current.tieBreaker ?? '');
     return order > 0 ? observed : current;
 }
+const MIN_RETRY_MS = 60_000;
 /** One workspace timer, created only while at least one enabled definition exists. */
 export class WorkspaceAutomationScheduler {
     options;
     timer;
     stopped = true;
     scheduleGeneration = 0;
+    retryAfter = new Map();
     constructor(options) {
         this.options = options;
     }
@@ -168,6 +189,7 @@ export class WorkspaceAutomationScheduler {
         if (this.stopped)
             return;
         const due = [];
+        const live = new Set();
         for (const projectId of this.options.coordinator.enabledProjectIds()) {
             const store = this.options.coordinator.store(projectId);
             if (!store)
@@ -176,16 +198,22 @@ export class WorkspaceAutomationScheduler {
             if (!handle)
                 continue;
             for (const definition of store.list().filter((item) => item.enabled)) {
-                due.push({ at: Date.parse(store.state(definition.id)?.nextCheckAt ?? new Date().toISOString()), definition, scheduler: new ProjectAutomationScheduler(handle) });
+                const key = `${projectId}:${definition.id}`;
+                live.add(key);
+                const at = Date.parse(store.state(definition.id)?.nextCheckAt ?? new Date().toISOString());
+                due.push({ key, at: Math.max(at, this.retryAfter.get(key) ?? 0), retryAfterMs: Math.max(definition.intervalSeconds * 1_000, MIN_RETRY_MS), definition, scheduler: new ProjectAutomationScheduler(handle) });
             }
         }
+        for (const key of this.retryAfter.keys())
+            if (!live.has(key))
+                this.retryAfter.delete(key);
         if (!due.length)
             return;
         due.sort((a, b) => a.at - b.at);
         const next = due[0];
         this.timer = setTimeout(() => {
             this.timer = undefined;
-            void next.scheduler.check(next.definition).catch(() => undefined).finally(() => this.schedule());
+            void next.scheduler.check(next.definition).then(() => { this.retryAfter.delete(next.key); }, () => { this.retryAfter.set(next.key, (this.options.now?.() ?? Date.now()) + next.retryAfterMs); }).finally(() => this.schedule());
         }, Math.max(0, next.at - (this.options.now?.() ?? Date.now())));
     }
 }