audit-tools 0.30.48 → 0.30.51

package/dist/shared/quota/fileLock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fileLock.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,eAAO,MAAM,aAAa,QAAS,CAAC;AASpC,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAkGD,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAA2B,EACtC,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,CAAC,CAAC,CAkBZ"}
+{"version":3,"file":"fileLock.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,eAAO,MAAM,aAAa,QAAS,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAUjC,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAkGD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAA2B,EACtC,MAAM,CAAC,EAAE,SAAS,EAClB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,SAAS,EAClB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,CAAC,CAAC,CAkBZ"}

package/dist/shared/quota/fileLock.js

@@ -1,6 +1,7 @@
 import { writeFile, unlink, stat, readFile, mkdir } from "node:fs/promises";
 import { dirname } from "node:path";
 export const STALE_LOCK_MS = 30_000;
+const defaultClock = Date.now;
 // Lock-acquire retry uses exponential backoff (initial → doubling → max) rather
 // than a fixed poll, so a long contention window costs far fewer wakeups. The
 // sleep is always clamped to the time left so backoff never overshoots timeoutMs.
@@ -14,17 +15,17 @@ export class FileLockTimeoutError extends Error {
         this.name = "FileLockTimeoutError";
     }
 }
-function generateOwnerToken() {
-    return `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+function generateOwnerToken(now = defaultClock) {
+    return `${process.pid}-${now()}-${Math.random().toString(36).slice(2)}`;
 }
 // Returns the owner token of a stale lock (older than STALE_LOCK_MS), or null
 // when the lock is fresh or already gone. Returning the token lets stale removal
 // reuse a token-checked delete, so a lock concurrently re-created with a
 // different token is never clobbered.
-async function readStaleLockToken(lockPath) {
+async function readStaleLockToken(lockPath, now) {
     try {
         const info = await stat(lockPath);
-        if (Date.now() - info.mtimeMs <= STALE_LOCK_MS)
+        if (now() - info.mtimeMs <= STALE_LOCK_MS)
             return null;
         return await readFile(lockPath, "utf8");
     }
@@ -69,10 +70,10 @@ async function bestEffortUnlink(path) {
 // reclaimed, mirroring the main lock's staleness recovery. The claim is always
 // removed in a finally on the happy path so it lives only for the brief
 // token-check + unlink window.
-async function stealStaleLock(lockPath, staleToken) {
+async function stealStaleLock(lockPath, staleToken, now) {
     const claimPath = `${lockPath}${STEAL_CLAIM_SUFFIX}`;
     try {
-        await writeFile(claimPath, generateOwnerToken(), { flag: "wx" });
+        await writeFile(claimPath, generateOwnerToken(now), { flag: "wx" });
     }
     catch (err) {
         const code = err.code;
@@ -83,7 +84,7 @@ async function stealStaleLock(lockPath, staleToken) {
             // loop retry the ordinary acquire path.
             try {
                 const claimInfo = await stat(claimPath);
-                if (Date.now() - claimInfo.mtimeMs > STALE_LOCK_MS) {
+                if (now() - claimInfo.mtimeMs > STALE_LOCK_MS) {
                     await bestEffortUnlink(claimPath);
                 }
             }
@@ -112,9 +113,10 @@ async function stealStaleLock(lockPath, staleToken) {
         await bestEffortUnlink(claimPath);
     }
 }
-export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logger) {
-    const token = generateOwnerToken();
-    const deadline = Date.now() + timeoutMs;
+export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logger, options = {}) {
+    const now = options.now ?? defaultClock;
+    const token = generateOwnerToken(now);
+    const deadline = now() + timeoutMs;
     let lastStaleCheckAt = 0;
     let retryInterval = RETRY_INTERVAL_INITIAL_MS;
     // A lock cannot be created in a directory that does not exist — the `wx` create
@@ -138,21 +140,21 @@ export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logg
         }
         // Check the deadline BEFORE any stale-check IO (stat/readFile) or sleep, so a
         // slow filesystem cannot push the actual return time past timeoutMs.
-        if (Date.now() >= deadline) {
+        if (now() >= deadline) {
             logger?.event({ kind: "error", note: "lock_timeout", lock_path: lockPath, timeout_ms: timeoutMs });
             throw new FileLockTimeoutError(lockPath);
         }
-        const now = Date.now();
-        if (now - lastStaleCheckAt >= STALE_CHECK_INTERVAL_MS) {
-            lastStaleCheckAt = now;
-            const staleToken = await readStaleLockToken(lockPath);
+        const checkAt = now();
+        if (checkAt - lastStaleCheckAt >= STALE_CHECK_INTERVAL_MS) {
+            lastStaleCheckAt = checkAt;
+            const staleToken = await readStaleLockToken(lockPath, now);
             if (staleToken !== null) {
                 // Steal the exact stale lock we observed via a lease-style, mutually
                 // exclusive claim (see stealStaleLock). Only the single claim winner ever
                 // unlinks, and only while the lock still carries this stale token — so a
                 // fresh lock another holder created in the gap is never clobbered, and two
                 // concurrent stealers can never both end up holding the lock.
-                await stealStaleLock(lockPath, staleToken);
+                await stealStaleLock(lockPath, staleToken, now);
                 logger?.event({ kind: "step", note: "stale_lock_removed", lock_path: lockPath });
                 // Progress was made (a slot may have opened); retry promptly and reset
                 // the backoff window.
@@ -162,7 +164,7 @@ export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logg
         }
         // Exponential backoff, clamped to the time left so we never sleep past the
         // deadline. Doubles each idle cycle up to RETRY_INTERVAL_MAX_MS.
-        const sleepMs = Math.min(retryInterval, Math.max(0, deadline - Date.now()));
+        const sleepMs = Math.min(retryInterval, Math.max(0, deadline - now()));
         await new Promise((r) => setTimeout(r, sleepMs));
         retryInterval = Math.min(retryInterval * 2, RETRY_INTERVAL_MAX_MS);
     }
@@ -182,8 +184,8 @@ export async function releaseLock(lockPath, ownerToken) {
         // ENOENT: lock already gone — swallow silently
     }
 }
-export async function withFileLock(lockPath, fn, timeoutMs, logger) {
-    const token = await acquireLock(lockPath, timeoutMs, logger);
+export async function withFileLock(lockPath, fn, timeoutMs, logger, options = {}) {
+    const token = await acquireLock(lockPath, timeoutMs, logger, options);
     let hasFnError = false;
     try {
         return await fn();

package/dist/shared/quota/fileLock.js.map

@@ -1 +1 @@
-{"version":3,"file":"fileLock.js","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,kBAAkB;IACzB,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,sCAAsC;AACtC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,2EAA2E;AAC3E,+EAA+E;AAC/E,kDAAkD;AAClD,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,oBAAoB;AACpB,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,+BAA+B;AAC/B,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB;IAChE,MAAM,SAAS,GAAG,GAAG,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,2EAA2E;YAC3E,qEAAqE;YACrE,4EAA4E;YAC5E,wCAAwC;YACxC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBACnD,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,+BAA+B;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,kBAAkB,EACtC,MAAkB;IAElB,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,aAAa,GAAG,yBAAyB,CAAC;IAE9C,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAC5E,CAAC;QAED,8EAA8E;QAC9E,qEAAqE;QACrE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAW,CAAC,CAAC;YAC5G,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,gBAAgB,IAAI,uBAAuB,EAAE,CAAC;YACtD,gBAAgB,GAAG,GAAG,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,0EAA0E;gBAC1E,yEAAyE;gBACzE,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC3C,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC,CAAC;gBAC1F,uEAAuE;gBACvE,sBAAsB;gBACtB,aAAa,GAAG,yBAAyB,CAAC;gBAC1C,SAAS;YACX,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,UAAkB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAAoB,EACpB,SAAkB,EAClB,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,CAAC,UAAU;gBAAE,MAAM,UAAU,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"fileLock.js","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAYpC,MAAM,YAAY,GAAU,IAAI,CAAC,GAAG,CAAC;AACrC,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,MAAa,YAAY;IACnD,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,sCAAsC;AACtC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAAU;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,2EAA2E;AAC3E,+EAA+E;AAC/E,kDAAkD;AAClD,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,oBAAoB;AACpB,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,+BAA+B;AAC/B,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAU;IAC5E,MAAM,SAAS,GAAG,GAAG,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,2EAA2E;YAC3E,qEAAqE;YACrE,4EAA4E;YAC5E,wCAAwC;YACxC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC9C,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,+BAA+B;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,kBAAkB,EACtC,MAAkB,EAClB,UAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,aAAa,GAAG,yBAAyB,CAAC;IAE9C,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAC5E,CAAC;QAED,8EAA8E;QAC9E,qEAAqE;QACrE,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAW,CAAC,CAAC;YAC5G,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,gBAAgB,IAAI,uBAAuB,EAAE,CAAC;YAC1D,gBAAgB,GAAG,OAAO,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,0EAA0E;gBAC1E,yEAAyE;gBACzE,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;gBAChD,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC,CAAC;gBAC1F,uEAAuE;gBACvE,sBAAsB;gBACtB,aAAa,GAAG,yBAAyB,CAAC;gBAC1C,SAAS;YACX,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,UAAkB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAAoB,EACpB,SAAkB,EAClB,MAAkB,EAClB,UAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,CAAC,UAAU;gBAAE,MAAM,UAAU,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/shared/types/providerConfirmation.d.ts

@@ -26,6 +26,15 @@ export interface ConfirmedPoolEntry {
      * (or by self-spawn guard). Excluded entries are recorded but not dispatched.
      */
     excluded: boolean;
+    /**
+     * Machine-readable self-spawn-blocked flag. True when this provider was
+     * detected on PATH but cannot be launched as a fresh subprocess from inside an
+     * active session of that same agent (claude-code under `CLAUDECODE`, codex
+     * under `CODEX`). Such an entry is `excluded: true` by default — and so out of
+     * the dispatchable pool — unless the operator explicitly re-includes it. This
+     * flag is the security signal; `reason` is advisory text only.
+     */
+    self_spawn_blocked?: boolean;
     /** Optional reason for exclusion or detection restriction. */
     reason?: string;
 }

package/dist/shared/types/providerConfirmation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;GAGG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;GAGG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.30.48",
+  "version": "0.30.51",
   "private": false,
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
   "type": "module",
@@ -45,7 +45,8 @@
     "test:shared": "npm run build && node --import tsx/esm --test tests/shared/*.test.mjs",
     "test:remediate": "vitest run",
     "test:single": "npm run build && node --import tsx/esm --test",
-    "verify:release": "npm run check && npm run check:doc-manifest && npm test && npm run verify:hosts && npm run smoke:packaged-audit-code && npm run smoke:packaged-remediate-code",
+    "verify:release": "npm run check && npm run check:deadcode && npm run check:doc-manifest && npm test && npm run verify:hosts && npm run smoke:packaged-audit-code && npm run smoke:packaged-remediate-code",
+    "check:deadcode": "knip --no-config-hints",
     "check:doc-manifest": "node scripts/check-doc-manifest.mjs",
     "verify:hosts": "node scripts/audit/verify-hosts.mjs",
     "smoke:linked-audit-code": "node scripts/audit/smoke-linked-audit-code.mjs",
@@ -75,6 +76,7 @@
   },
   "devDependencies": {
     "@types/node": "^24.3.0",
+    "knip": "^6.23.0",
     "linguist-languages": "^9.3.2",
     "tree-sitter-wasms": "^0.1.13",
     "tsx": "^4.19.0",

package/scripts/audit/postinstall.mjs

@@ -304,22 +304,27 @@ for (const install of installs) {
 
 // Install OpenCode global command and MCP via merged config
 const opencodeGlobalConfig = join(homedir(), '.config', 'opencode', 'opencode.json');
-try {
-  if (!sharedOpenCodePermissions) {
-    throw new Error(
-      'audit-tools/shared is unavailable (build the shared workspace first); skipping OpenCode config deployment',
+if (!sharedOpenCodePermissions) {
+  // Expected when audit-tools/shared isn't built yet — notably during `npm ci`
+  // in CI, where postinstall runs before the shared build step. This is a SKIP,
+  // not a failure: counting it would trip the `failed > 0` exit-1 guard below and
+  // break `npm ci`. Genuine OpenCode write errors are still counted as failures.
+  console.warn(
+    'audit-code: audit-tools/shared is unavailable (build the shared workspace first); skipping OpenCode config deployment',
+  );
+} else {
+  try {
+    const action = installMergedJson(opencodeGlobalConfig, (existing) =>
+      mergeOpenCodeGlobalConfig(existing),
     );
+    console.log(`audit-code: ${action} global OpenCode config in ${opencodeGlobalConfig}`);
+    succeeded++;
+  } catch (err) {
+    console.warn(`audit-code: could not install global OpenCode config (${err.message})`);
+    console.warn(`  To install manually, add the mcp.auditor and command["audit-code"] entries to:`);
+    console.warn(`    ${opencodeGlobalConfig}`);
+    failed++;
   }
-  const action = installMergedJson(opencodeGlobalConfig, (existing) =>
-    mergeOpenCodeGlobalConfig(existing),
-  );
-  console.log(`audit-code: ${action} global OpenCode config in ${opencodeGlobalConfig}`);
-  succeeded++;
-} catch (err) {
-  console.warn(`audit-code: could not install global OpenCode config (${err.message})`);
-  console.warn(`  To install manually, add the mcp.auditor and command["audit-code"] entries to:`);
-  console.warn(`    ${opencodeGlobalConfig}`);
-  failed++;
 }
 
 // Install Antigravity plugin (global skill for Gemini IDE / Antigravity Hub)
@@ -383,3 +388,6 @@ try {
 }
 
 console.log(`audit-code: postinstall complete — ${succeeded} succeeded, ${failed} failed (${Date.now() - postinstallStart}ms)`);
+if (failed > 0) {
+  process.exitCode = 1;
+}