agentrinse 0.0.0

package/dist/core/mount-boundaries.d.ts

@@ -0,0 +1,21 @@
+export type MountBoundaryResult = {
+    status: "clear";
+    paths: [];
+} | {
+    status: "blocked";
+    paths: string[];
+} | {
+    status: "unknown";
+    paths: [];
+    reason: string;
+};
+export type MountBoundaryOptions = {
+    platform?: NodeJS.Platform;
+    linuxMountInfo?: string;
+    runMount?: () => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+};
+export declare function findMountBoundaries(target: string, options?: MountBoundaryOptions): Promise<MountBoundaryResult>;
+//# sourceMappingURL=mount-boundaries.d.ts.map

package/dist/core/mount-boundaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-boundaries.d.ts","sourceRoot":"","sources":["../../src/core/mount-boundaries.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,EAAE,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D,CAAC;AAyBF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA+C9B"}

package/dist/core/mount-boundaries.js

@@ -0,0 +1,72 @@
+import { execFile } from "node:child_process";
+import { readFile, realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+import { promisify } from "node:util";
+import { isPathInside } from "./safety.js";
+const execFileAsync = promisify(execFile);
+function decodeMountPath(value) {
+    return value.replace(/\\([0-7]{3})/g, (_match, octal) => String.fromCharCode(Number.parseInt(octal, 8)));
+}
+function linuxMountPaths(input) {
+    return input
+        .split("\n")
+        .filter((line) => line !== "")
+        .map((line) => line.split(" ")[4])
+        .filter((path) => path !== undefined)
+        .map(decodeMountPath);
+}
+function darwinMountPaths(input) {
+    return input
+        .split("\n")
+        .map((line) => line.match(/ on (.+) \(/)?.[1])
+        .filter((path) => path !== undefined)
+        .map(decodeMountPath);
+}
+export async function findMountBoundaries(target, options = {}) {
+    const platform = options.platform ?? process.platform;
+    try {
+        const physicalTarget = await realpath(resolve(target));
+        let mountPaths;
+        if (platform === "linux") {
+            const input = options.linuxMountInfo ?? (await readFile("/proc/self/mountinfo", "utf8"));
+            mountPaths = linuxMountPaths(input);
+        }
+        else if (platform === "darwin") {
+            const result = options.runMount === undefined
+                ? await execFileAsync("/sbin/mount", [], {
+                    encoding: "utf8",
+                    maxBuffer: 4 * 1024 * 1024,
+                    timeout: 10_000,
+                })
+                : await options.runMount();
+            if (result.stderr !== "") {
+                return {
+                    status: "unknown",
+                    paths: [],
+                    reason: `mount reported an incomplete scan: ${result.stderr.trim()}`,
+                };
+            }
+            mountPaths = darwinMountPaths(result.stdout);
+        }
+        else {
+            return {
+                status: "unknown",
+                paths: [],
+                reason: `mount inspection is unsupported on ${platform}`,
+            };
+        }
+        const paths = mountPaths
+            .map((path) => resolve(path))
+            .filter((path) => isPathInside(physicalTarget, path))
+            .sort((left, right) => left.localeCompare(right));
+        return paths.length === 0 ? { status: "clear", paths: [] } : { status: "blocked", paths };
+    }
+    catch (error) {
+        return {
+            status: "unknown",
+            paths: [],
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=mount-boundaries.js.map

package/dist/core/mount-boundaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-boundaries.js","sourceRoot":"","sources":["../../src/core/mount-boundaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAa1C,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE,CAC9D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SACjC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACpD,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACpD,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAO,GAAyB,EAAE;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IAAI,UAAoB,CAAC;QAEzB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC;YACzF,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAC5B,CAAC,CAAC,MAAM,aAAa,CAAC,aAAa,EAAE,EAAE,EAAE;oBACrC,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;oBAC1B,OAAO,EAAE,MAAM;iBAChB,CAAC;gBACJ,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,EAAE;oBACT,MAAM,EAAE,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACrE,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,sCAAsC,QAAQ,EAAE;aACzD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU;aACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;aACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/plan-verification.d.ts

@@ -0,0 +1,10 @@
+import type { AgentRinseConfig } from "../config/schema.js";
+import { type CleanupPlan } from "../contracts/plan.js";
+export type PlanVerificationCode = "PLAN_INVALID" | "PLAN_TAMPERED" | "PLAN_CONFIG_CHANGED" | "PLAN_EXPIRED" | "PLAN_TIME_INVALID";
+export declare class PlanVerificationError extends Error {
+    readonly code: PlanVerificationCode;
+    readonly name = "PlanVerificationError";
+    constructor(code: PlanVerificationCode, message: string, options?: ErrorOptions);
+}
+export declare function verifyCleanupPlan(input: unknown, config: AgentRinseConfig, now?: Date): CleanupPlan;
+//# sourceMappingURL=plan-verification.d.ts.map

package/dist/core/plan-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-verification.d.ts","sourceRoot":"","sources":["../../src/core/plan-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAI3E,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,mBAAmB,CAAC;AAExB,qBAAa,qBAAsB,SAAQ,KAAK;IAI5C,QAAQ,CAAC,IAAI,EAAE,oBAAoB;IAHrC,SAAkB,IAAI,2BAA2B;IAEjD,YACW,IAAI,EAAE,oBAAoB,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EAGvB;CACF;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,OAAa,GACf,WAAW,CAqDb"}

package/dist/core/plan-verification.js

@@ -0,0 +1,42 @@
+import { cleanupPlanSchema } from "../contracts/plan.js";
+import { sha256Json } from "./digest.js";
+import { cleanupPlanId } from "./plan.js";
+export class PlanVerificationError extends Error {
+    code;
+    name = "PlanVerificationError";
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+    }
+}
+export function verifyCleanupPlan(input, config, now = new Date()) {
+    const parsed = cleanupPlanSchema.safeParse(input);
+    if (!parsed.success) {
+        throw new PlanVerificationError("PLAN_INVALID", "cleanup plan does not match the supported schema", { cause: parsed.error });
+    }
+    const plan = parsed.data;
+    const { planId, ...content } = plan;
+    if (cleanupPlanId(content) !== planId) {
+        throw new PlanVerificationError("PLAN_TAMPERED", "cleanup plan content does not match its planId");
+    }
+    if (sha256Json(config) !== plan.configDigest) {
+        throw new PlanVerificationError("PLAN_CONFIG_CHANGED", "configuration changed after this cleanup plan was created");
+    }
+    const createdAt = Date.parse(plan.createdAt);
+    const expiresAt = Date.parse(plan.expiresAt);
+    if (!Number.isFinite(createdAt) ||
+        !Number.isFinite(expiresAt) ||
+        createdAt > expiresAt ||
+        createdAt > now.getTime()) {
+        throw new PlanVerificationError("PLAN_TIME_INVALID", "cleanup plan has an invalid authorization window");
+    }
+    const maximumLifetime = config.plan.ttlMinutes * 60_000;
+    if (expiresAt - createdAt > maximumLifetime) {
+        throw new PlanVerificationError("PLAN_TIME_INVALID", "cleanup plan exceeds the configured authorization lifetime");
+    }
+    if (now.getTime() >= expiresAt) {
+        throw new PlanVerificationError("PLAN_EXPIRED", `cleanup plan expired at ${plan.expiresAt}`);
+    }
+    return plan;
+}
+//# sourceMappingURL=plan-verification.js.map

package/dist/core/plan-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-verification.js","sourceRoot":"","sources":["../../src/core/plan-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAS1C,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAInC,IAAI;IAHG,IAAI,GAAG,uBAAuB,CAAC;IAEjD,YACW,IAA0B,EACnC,OAAe,EACf,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAJf,IAAI;IAKf,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAc,EACd,MAAwB,EACxB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,cAAc,EACd,kDAAkD,EAClD,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,qBAAqB,CAC7B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,GAAG,SAAS;QACrB,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,EACzB,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,mBAAmB,EACnB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IACxD,IAAI,SAAS,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAC5C,MAAM,IAAI,qBAAqB,CAC7B,mBAAmB,EACnB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,2BAA2B,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/plan.d.ts

@@ -0,0 +1,6 @@
+import type { AgentRinseConfig } from "../config/schema.js";
+import { type CleanupPlan } from "../contracts/plan.js";
+import type { AuditReport } from "../contracts/report.js";
+export declare function cleanupPlanId(plan: Omit<CleanupPlan, "planId">): string;
+export declare function createCleanupPlan(audit: AuditReport, config: AgentRinseConfig, now?: Date): CleanupPlan;
+//# sourceMappingURL=plan.d.ts.map

package/dist/core/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/core/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAU1D,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEvE;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,gBAAgB,EACxB,GAAG,OAAa,GACf,WAAW,CA4Bb"}

package/dist/core/plan.js

@@ -0,0 +1,40 @@
+import { cleanupPlanSchema } from "../contracts/plan.js";
+import { sha256Json } from "./digest.js";
+const RISK_ORDER = {
+    safe: 0,
+    recoverable: 1,
+    destructive: 2,
+    experimental: 3,
+};
+export function cleanupPlanId(plan) {
+    return sha256Json(plan);
+}
+export function createCleanupPlan(audit, config, now = new Date()) {
+    const createdAt = now.toISOString();
+    const expiresAt = new Date(now.getTime() + config.plan.ttlMinutes * 60_000).toISOString();
+    const configDigest = sha256Json(config);
+    const auditDigest = sha256Json(audit);
+    const actions = audit.findings
+        .filter((finding) => finding.state === "eligible")
+        .flatMap((finding) => finding.candidateActions)
+        .filter((action) => RISK_ORDER[action.risk] <= RISK_ORDER[config.plan.maxRisk])
+        .sort((left, right) => left.actionId.localeCompare(right.actionId));
+    const planWithoutId = {
+        schemaVersion: 1,
+        auditId: audit.auditId,
+        home: audit.home,
+        createdAt,
+        expiresAt,
+        policyVersion: 1,
+        riskCeiling: config.plan.maxRisk,
+        configDigest,
+        auditDigest,
+        actions,
+        expectedReclaimBytes: actions.reduce((total, action) => total + action.expectedReclaimBytes, 0),
+    };
+    return cleanupPlanSchema.parse({
+        ...planWithoutId,
+        planId: cleanupPlanId(planWithoutId),
+    });
+}
+//# sourceMappingURL=plan.js.map

package/dist/core/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/core/plan.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,GAA+B;IAC7C,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;CAChB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAiC;IAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAkB,EAClB,MAAwB,EACxB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1F,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;SAC3B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC;SACjD,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC9E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG;QACpB,aAAa,EAAE,CAAU;QACzB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS;QACT,SAAS;QACT,aAAa,EAAE,CAAU;QACzB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;QAChC,YAAY;QACZ,WAAW;QACX,OAAO;QACP,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC;KAChG,CAAC;IAEF,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC7B,GAAG,aAAa;QAChB,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/process-ownership.d.ts

@@ -0,0 +1,27 @@
+export type ProcessPathMatch = {
+    pid: number;
+    source: "cwd" | "fd";
+    path: string;
+};
+export type ProcessOwnershipResult = {
+    status: "idle";
+    matches: [];
+} | {
+    status: "busy";
+    matches: ProcessPathMatch[];
+} | {
+    status: "unknown";
+    matches: ProcessPathMatch[];
+    reason: string;
+};
+export type ProcessOwnershipOptions = {
+    platform?: NodeJS.Platform;
+    procRoot?: string;
+    uid?: number;
+    runLsof?: (target: string) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+};
+export declare function findProcessesUsingPath(target: string, options?: ProcessOwnershipOptions): Promise<ProcessOwnershipResult>;
+//# sourceMappingURL=process-ownership.d.ts.map

package/dist/core/process-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-ownership.d.ts","sourceRoot":"","sources":["../../src/core/process-ownership.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,EAAE,CAAA;CAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3E,CAAC;AAqJF,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAajC"}

package/dist/core/process-ownership.js

@@ -0,0 +1,140 @@
+import { execFile } from "node:child_process";
+import { readdir, readFile, readlink } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+function isInside(root, candidate) {
+    const result = relative(resolve(root), resolve(candidate));
+    return result === "" || (!result.startsWith("..") && !isAbsolute(result));
+}
+function cleanProcLink(value) {
+    return value.endsWith(" (deleted)") ? value.slice(0, -" (deleted)".length) : value;
+}
+function isGone(error) {
+    return (error instanceof Error &&
+        "code" in error &&
+        ["ENOENT", "ESRCH"].includes(error.code ?? ""));
+}
+async function readProcessUid(statusPath) {
+    const status = await readFile(statusPath, "utf8");
+    const uidLine = status.split("\n").find((line) => line.startsWith("Uid:"));
+    const uid = uidLine?.split(/\s+/)[1];
+    return uid === undefined ? undefined : Number.parseInt(uid, 10);
+}
+async function inspectLinux(target, options) {
+    const procRoot = options.procRoot ?? "/proc";
+    const uid = options.uid ?? process.getuid?.();
+    if (uid === undefined) {
+        return {
+            status: "unknown",
+            matches: [],
+            reason: "current user identity is unavailable",
+        };
+    }
+    const matches = [];
+    let incomplete = false;
+    const entries = await readdir(procRoot, { withFileTypes: true });
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) {
+            continue;
+        }
+        const pid = Number.parseInt(entry.name, 10);
+        const processRoot = resolve(procRoot, entry.name);
+        try {
+            const processUid = await readProcessUid(resolve(processRoot, "status"));
+            if (processUid !== uid) {
+                continue;
+            }
+            const cwd = cleanProcLink(await readlink(resolve(processRoot, "cwd")));
+            if (isInside(target, cwd)) {
+                matches.push({ pid, source: "cwd", path: cwd });
+            }
+            const descriptors = await readdir(resolve(processRoot, "fd"));
+            for (const descriptor of descriptors) {
+                try {
+                    const path = cleanProcLink(await readlink(resolve(processRoot, "fd", descriptor)));
+                    if (isAbsolute(path) && isInside(target, path)) {
+                        matches.push({ pid, source: "fd", path });
+                    }
+                }
+                catch (error) {
+                    if (!isGone(error)) {
+                        incomplete = true;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            if (!isGone(error)) {
+                incomplete = true;
+            }
+        }
+    }
+    if (matches.length > 0) {
+        return { status: "busy", matches };
+    }
+    if (incomplete) {
+        return inspectWithLsof(target, options);
+    }
+    return { status: "idle", matches: [] };
+}
+async function inspectWithLsof(target, options) {
+    try {
+        const result = options.runLsof === undefined
+            ? await execFileAsync("lsof", ["-nP", "+D", target, "-Fpcfn"], {
+                encoding: "utf8",
+                maxBuffer: 4 * 1024 * 1024,
+                timeout: 10_000,
+            })
+            : await options.runLsof(target);
+        if (result.stderr !== "") {
+            return {
+                status: "unknown",
+                matches: [],
+                reason: `lsof reported an incomplete scan: ${result.stderr.trim()}`,
+            };
+        }
+        const matches = [];
+        let pid;
+        for (const line of result.stdout.split("\n")) {
+            if (line.startsWith("p")) {
+                pid = Number.parseInt(line.slice(1), 10);
+            }
+            else if (line.startsWith("n") && pid !== undefined) {
+                const path = line.slice(1);
+                if (isInside(target, path)) {
+                    matches.push({ pid, source: "fd", path });
+                }
+            }
+        }
+        return matches.length > 0 ? { status: "busy", matches } : { status: "idle", matches: [] };
+    }
+    catch (error) {
+        const commandError = error;
+        if (Number(commandError.code) === 1 &&
+            (commandError.stdout ?? "") === "" &&
+            (commandError.stderr ?? "") === "") {
+            return { status: "idle", matches: [] };
+        }
+        return {
+            status: "unknown",
+            matches: [],
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export async function findProcessesUsingPath(target, options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform === "linux") {
+        return inspectLinux(resolve(target), options);
+    }
+    if (platform === "darwin") {
+        return inspectWithLsof(resolve(target), options);
+    }
+    return {
+        status: "unknown",
+        matches: [],
+        reason: `process ownership is unsupported on ${platform}`,
+    };
+}
+//# sourceMappingURL=process-ownership.js.map

package/dist/core/process-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-ownership.js","sourceRoot":"","sources":["../../src/core/process-ownership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAoB1C,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACrF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,CACL,KAAK,YAAY,KAAK;QACtB,MAAM,IAAI,KAAK;QACf,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,sCAAsC;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxE,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;oBACnF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;wBAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnB,UAAU,GAAG,IAAI,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBAC3D,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;gBAC1B,OAAO,EAAE,MAAM;aAChB,CAAC;YACJ,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,qCAAqC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,IAAI,GAAuB,CAAC;QAE5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAIpB,CAAC;QACF,IACE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/B,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,EAAE,EAClC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzC,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,OAAO,GAA4B,EAAE;IAErC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,uCAAuC,QAAQ,EAAE;KAC1D,CAAC;AACJ,CAAC"}

package/dist/core/safety.d.ts

@@ -0,0 +1,7 @@
+export declare class UnsafeAuditRootError extends Error {
+    readonly name = "UnsafeAuditRootError";
+}
+export declare function isPathInside(root: string, candidate: string): boolean;
+export declare function resolvePhysicalPath(candidate: string): Promise<string>;
+export declare function assertAuditRoot(candidate: string, realHome?: string): Promise<string>;
+//# sourceMappingURL=safety.d.ts.map

package/dist/core/safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/core/safety.ts"],"names":[],"mappings":"AAIA,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,0BAA0B;CACjD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B5E;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB9F"}

package/dist/core/safety.js

@@ -0,0 +1,50 @@
+import { homedir } from "node:os";
+import { realpath } from "node:fs/promises";
+import { basename, dirname, isAbsolute, parse, relative, resolve } from "node:path";
+export class UnsafeAuditRootError extends Error {
+    name = "UnsafeAuditRootError";
+}
+export function isPathInside(root, candidate) {
+    const result = relative(resolve(root), resolve(candidate));
+    return result === "" || (!result.startsWith("..") && !isAbsolute(result));
+}
+export async function resolvePhysicalPath(candidate) {
+    let cursor = resolve(candidate);
+    const missing = [];
+    while (true) {
+        try {
+            const existing = await realpath(cursor);
+            return resolve(existing, ...missing.reverse());
+        }
+        catch (error) {
+            if (!(error instanceof Error &&
+                "code" in error &&
+                error.code === "ENOENT")) {
+                throw error;
+            }
+            const parent = dirname(cursor);
+            if (parent === cursor) {
+                throw error;
+            }
+            missing.push(basename(cursor));
+            cursor = parent;
+        }
+    }
+}
+export async function assertAuditRoot(candidate, realHome = homedir()) {
+    if (!isAbsolute(candidate)) {
+        throw new UnsafeAuditRootError("audit home must be an absolute path");
+    }
+    const [resolvedCandidate, resolvedHome] = await Promise.all([
+        realpath(resolve(candidate)),
+        realpath(resolve(realHome)),
+    ]);
+    if (resolvedCandidate === parse(resolvedCandidate).root) {
+        throw new UnsafeAuditRootError("refusing to use the filesystem root");
+    }
+    if (resolvedCandidate !== resolvedHome && isPathInside(resolvedCandidate, resolvedHome)) {
+        throw new UnsafeAuditRootError("refusing to use an ancestor of the real home directory");
+    }
+    return resolvedCandidate;
+}
+//# sourceMappingURL=safety.js.map

package/dist/core/safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/core/safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,sBAAsB,CAAC;CACjD;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,IAAI,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,CAAC,CACC,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACd,KAA+B,CAAC,IAAI,KAAK,QAAQ,CACnD,EACD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAQ,GAAG,OAAO,EAAE;IAC3E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC5B,CAAC,CAAC;IAEH,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB,KAAK,YAAY,IAAI,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,oBAAoB,CAAC,wDAAwD,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { agentRinseConfigSchema, adapterIdSchema, type AdapterId, type AgentRinseConfig, } from "./config/schema.js";
+export { artifactNameSchema, artifactRemoveActionSchema, pathIdentitySchema, plannedActionSchema, type ArtifactName, type ArtifactRemoveAction, type PathIdentity, type PlannedAction, } from "./contracts/action.js";
+export { cleanupPlanSchema, type CleanupPlan } from "./contracts/plan.js";
+export { auditReportSchema, type AdapterProbe, type AuditReport } from "./contracts/report.js";
+export { actionExecutionSchema, cleanupRunSchema, type ActionExecution, type CleanupRun, } from "./contracts/run.js";
+export { runAudit, type RunAuditOptions } from "./core/audit.js";
+export { applyCleanupPlan, type ApplyCleanupPlanOptions, type ApplyResult } from "./core/apply.js";
+export { createCleanupPlan } from "./core/plan.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { agentRinseConfigSchema, adapterIdSchema, } from "./config/schema.js";
+export { artifactNameSchema, artifactRemoveActionSchema, pathIdentitySchema, plannedActionSchema, } from "./contracts/action.js";
+export { cleanupPlanSchema } from "./contracts/plan.js";
+export { auditReportSchema } from "./contracts/report.js";
+export { actionExecutionSchema, cleanupRunSchema, } from "./contracts/run.js";
+export { runAudit } from "./core/audit.js";
+export { applyCleanupPlan } from "./core/apply.js";
+export { createCleanupPlan } from "./core/plan.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,GAKpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAuC,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAwB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAkD,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+export declare function buildProgram(): Command;
+export declare function main(argv?: string[]): Promise<void>;
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,YAAY,IAAI,OAAO,CA6DtC;AAED,wBAAsB,IAAI,CAAC,IAAI,WAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7D"}

package/dist/main.js

@@ -0,0 +1,59 @@
+import { Command } from "commander";
+import { executeAuditCommand } from "./commands/audit.js";
+import { renderAdapters } from "./commands/adapters.js";
+import { executeApplyCommand } from "./commands/apply.js";
+import { executePlanCommand } from "./commands/plan.js";
+import { VERSION } from "./version.js";
+export function buildProgram() {
+    const program = new Command()
+        .name("agentrinse")
+        .description("Safe cleanup for agentic development.")
+        .version(VERSION);
+    program
+        .command("audit")
+        .description("Inventory a home without mutating it.")
+        .requiredOption("--home <path>", "home directory to audit")
+        .option("--config <path>", "explicit JSON config")
+        .option("--json", "emit the versioned JSON report", false)
+        .option("--output <path>", "write the JSON report atomically")
+        .action(async (options) => {
+        const result = await executeAuditCommand(options);
+        process.stdout.write(result.output);
+    });
+    program
+        .command("plan")
+        .description("Create a dry-run cleanup plan from a saved audit.")
+        .requiredOption("--audit <path>", "saved audit JSON")
+        .option("--config <path>", "explicit JSON config")
+        .option("--output <path>", "write the plan atomically")
+        .action(async (options) => {
+        const result = await executePlanCommand(options);
+        process.stdout.write(result.output);
+    });
+    program
+        .command("apply")
+        .description("Apply an authorized cleanup plan after revalidation.")
+        .requiredOption("--plan <path>", "saved cleanup plan JSON")
+        .option("--config <path>", "same explicit JSON config used to create the plan")
+        .option("--state-dir <path>", "override the AgentRinse state directory")
+        .option("--yes", "authorize non-interactive apply", false)
+        .option("--json", "emit the versioned run journal", false)
+        .action(async (options) => {
+        const result = await executeApplyCommand(options);
+        process.stdout.write(result.output);
+        if (["failed", "partial"].includes(result.run.status)) {
+            process.exitCode = 2;
+        }
+    });
+    program
+        .command("adapters")
+        .description("List adapter maturity and ownership.")
+        .action(() => {
+        process.stdout.write(renderAdapters());
+    });
+    return program;
+}
+export async function main(argv = process.argv) {
+    await buildProgram().parseAsync(argv);
+}
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,uCAAuC,CAAC;SACpD,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,uCAAuC,CAAC;SACpD,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gCAAgC,EAAE,KAAK,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,OAA0E,EAAE,EAAE;QAC3F,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mDAAmD,CAAC;SAChE,cAAc,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;SACpD,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;SACjD,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,OAA4D,EAAE,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,sDAAsD,CAAC;SACnE,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,CAAC;SAC9E,MAAM,CAAC,oBAAoB,EAAE,yCAAyC,CAAC;SACvE,MAAM,CAAC,OAAO,EAAE,iCAAiC,EAAE,KAAK,CAAC;SACzD,MAAM,CAAC,QAAQ,EAAE,gCAAgC,EAAE,KAAK,CAAC;SACzD,MAAM,CACL,KAAK,EAAE,OAMN,EAAE,EAAE;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IAC5C,MAAM,YAAY,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/output.d.ts

@@ -0,0 +1,4 @@
+import type { AuditReport } from "./contracts/report.js";
+export declare function formatBytes(bytes: number): string;
+export declare function renderAudit(report: AuditReport): string;
+//# sourceMappingURL=output.d.ts.map

package/dist/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWjD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAkCvD"}

package/dist/output.js

@@ -0,0 +1,35 @@
+const UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
+export function formatBytes(bytes) {
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < UNITS.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    const precision = unit === 0 || value >= 10 ? 0 : 1;
+    return `${value.toFixed(precision)} ${UNITS[unit]}`;
+}
+export function renderAudit(report) {
+    const actionCount = report.findings.reduce((total, finding) => total + finding.candidateActions.length, 0);
+    const lines = [
+        "AgentRinse audit",
+        "",
+        `Home: ${report.home}`,
+        `Adapters: ${report.probes.length}`,
+        `Resources: ${report.findings.length}`,
+        `Eligible actions: ${actionCount}`,
+        "",
+    ];
+    for (const probe of report.probes) {
+        lines.push(`${probe.adapter.padEnd(10)} ${probe.status.padEnd(10)} ${probe.detail}`);
+    }
+    for (const finding of report.findings) {
+        const bytes = finding.measuredBytes === undefined ? "unknown" : formatBytes(finding.measuredBytes);
+        lines.push(`${finding.state.padEnd(10)} ${bytes.padStart(10)}  ${finding.resource.adapter}/${finding.resource.displayName}`);
+    }
+    lines.push("", actionCount === 0
+        ? "No cleanup actions are eligible."
+        : "Save this audit and create a plan before applying.");
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=output.js.map