disk-space-saviour 0.15.2 → 0.16.0

package/src/docker/writable.js

@@ -3,11 +3,13 @@ import { DockerCli } from './cli.js';
 import { isWithin } from '../paths.js';
 import { trace } from '../exec.js';
 import { resetDiffSnapshots } from './snapshots.js';
+import { rootUpperdir, upperdirBytes } from './upperdir.js';
 
 let measurementQueue = Promise.resolve();
 const layers = new WeakMap();
 
 export function sharedWritableLayer(executor, id) {
+  executor = executor.unscoped ?? executor;
   if (!layers.has(executor)) {
     layers.set(executor, new Map());
   }
@@ -19,12 +21,14 @@ export function sharedWritableLayer(executor, id) {
 }
 
 export function resetWritableLayers(executor) {
+  executor = executor.unscoped ?? executor;
   layers.delete(executor);
   resetDiffSnapshots(executor);
 }
 
 /** Overlay without an authoritative upper layer must never count merged bytes. */
 export class UnknownWritableLayer {
+  source = 'unknown-overlay';
   measure(env, usages) {
     return Promise.resolve(
       new Map(
@@ -67,14 +71,14 @@ export class WritableLayer {
         if (!container) {
           return { diff: null, container };
         }
-        const upperdir =
-          container.GraphDriver?.Data?.UpperDir ?? this.upperdirCandidate;
+        const { upperdir, source } = await this.upperdir(container);
         if (upperdir?.startsWith('/')) {
           const result = await this.docker.executor
             .run(['stat', '-c', '%F', '--', upperdir])
             .catch(() => null);
           if (result?.code === 0 && result.stdout.trim() === 'directory') {
             trace('using authoritative upperdir', this.id);
+            this.source = source;
             return { container, upperdir, diff: null };
           }
         }
@@ -86,6 +90,7 @@ export class WritableLayer {
           return { diff: null, container };
         }
         const diff = await this.docker.diff(this.id);
+        this.source = diff === null ? 'unknown' : 'docker-diff';
         trace('finished measuring container', this.id);
         // Bound the retained change set; unknown is safer than a partial result.
         return {
@@ -102,6 +107,27 @@ export class WritableLayer {
     return this.snapshotPromise;
   }
 
+  async upperdir(container) {
+    if (container.GraphDriver?.Data?.UpperDir) {
+      return {
+        upperdir: container.GraphDriver.Data.UpperDir,
+        source: 'graphdriver-upperdir',
+      };
+    }
+    const pid = container.State?.Pid;
+    if (Number.isInteger(pid) && pid > 0) {
+      const info = await this.docker.executor.run([
+        'cat',
+        `/proc/${pid}/mountinfo`,
+      ]);
+      const upperdir = info.code === 0 ? rootUpperdir(info.stdout) : null;
+      if (upperdir) {
+        return { upperdir, source: 'mountinfo-upperdir' };
+      }
+    }
+    return { upperdir: this.upperdirCandidate, source: 'overlay-upperdir' };
+  }
+
   forget(target, pathApi) {
     this.removed.add(target);
     for (const file of this.stats.keys()) {
@@ -111,11 +137,55 @@ export class WritableLayer {
     }
   }
 
+  /** Allocated upper blocks before/after deletion, independent of merged data. */
+  async allocatedBytes(paths, pathApi) {
+    const { container, upperdir } = await this.snapshot();
+    if (
+      !upperdir ||
+      (container.Mounts ?? []).some((mount) =>
+        paths.some(
+          (target) =>
+            isWithin(target, mount.Destination, pathApi) ||
+            isWithin(mount.Destination, target, pathApi)
+        )
+      )
+    ) {
+      return null;
+    }
+    const measured = await upperdirBytes(
+      this.docker.executor,
+      paths.map((target) => `${upperdir}/${target.replace(/^\/+/, '')}`)
+    );
+    const values = [...measured.values()];
+    return values.length === paths.length &&
+      values.every((value) => value !== null)
+      ? values.reduce((sum, value) => sum + value, 0)
+      : null;
+  }
+
   async measureUpperdir(env, usages, container, upperdir) {
     const result = new Map();
     const mounts = (container.Mounts ?? [])
       .map((mount) => mount.Destination)
       .filter(Boolean);
+    const upperPath = (target) => `${upperdir}/${target.replace(/^\/+/, '')}`;
+    const targets = [...usages.keys()].filter(
+      (target) => !mounts.some((mount) => isWithin(target, mount, env.path))
+    );
+    const measurements = await upperdirBytes(
+      this.docker.executor,
+      targets.map(upperPath)
+    );
+    const mountRoots = mounts.filter(
+      (mount) =>
+        targets.some((target) => isWithin(mount, target, env.path)) &&
+        !mounts.some(
+          (other) => other !== mount && isWithin(mount, other, env.path)
+        )
+    );
+    const mountedUsage = mountRoots.length
+      ? await env.rawUsageMany(mountRoots)
+      : new Map();
     for (const [target, usage] of usages) {
       if (mounts.some((mount) => isWithin(target, mount, env.path))) {
         result.set(target, {
@@ -125,17 +195,24 @@ export class WritableLayer {
         });
         continue;
       }
-      const measured = await this.docker.executor.run([
-        'du',
-        '-skx',
-        '--',
-        `${upperdir}/${target.replace(/^\/+/, '')}`,
-      ]);
-      const kib = Number(/^([0-9]+)\s/m.exec(measured.stdout)?.[1]);
-      // Missing upperdir leaf means image-only. Other errors remain unknown.
-      const absent = /no such file|not found/i.test(measured.stderr);
-      const known = (measured.code === 0 && Number.isFinite(kib)) || absent;
-      const bytes = known ? Math.min(usage.bytes, absent ? 0 : kib * 1024) : 0;
+      const measured = measurements.get(upperPath(target));
+      const contained = mountRoots.filter((mount) =>
+        isWithin(mount, target, env.path)
+      );
+      const known =
+        measured !== null &&
+        measured !== undefined &&
+        contained.every((mount) => mountedUsage.has(mount));
+      const bytes = known
+        ? Math.min(
+            usage.bytes,
+            measured +
+              contained.reduce(
+                (sum, mount) => sum + mountedUsage.get(mount).bytes,
+                0
+              )
+          )
+        : 0;
       result.set(target, {
         ...usage,
         bytes,

package/src/env/batches.js

@@ -0,0 +1,20 @@
+/** Bound argument count and encoded size below common exec limits. */
+export function batches(items, size = 200, maxBytes = 48000) {
+  const result = [];
+  let batch = [],
+    bytes = 0;
+  for (const item of items) {
+    const length = Buffer.byteLength(String(item)) + 1;
+    if (batch.length && (batch.length >= size || bytes + length > maxBytes)) {
+      result.push(batch);
+      batch = [];
+      bytes = 0;
+    }
+    batch.push(item);
+    bytes += length;
+  }
+  if (batch.length) {
+    result.push(batch);
+  }
+  return result;
+}

package/src/env/cache-roots.js

@@ -0,0 +1,138 @@
+/** Resolve cache configuration once per environment, using only that user's tools. */
+export const CACHE_VARIABLES = [
+  'LOCALAPPDATA',
+  'APPDATA',
+  'TMPDIR',
+  'XDG_CACHE_HOME',
+  'CARGO_HOME',
+  'RUSTUP_HOME',
+  'GRADLE_USER_HOME',
+  'DENO_DIR',
+  'BUN_INSTALL_CACHE_DIR',
+  'GOMODCACHE',
+  'GOCACHE',
+  'GOPATH',
+  'NVM_DIR',
+  'SDKMAN_DIR',
+  'PERLBREW_ROOT',
+  'RBENV_ROOT',
+  'GEM_HOME',
+  'GEM_PATH',
+  'npm_config_cache',
+  'NPM_CONFIG_CACHE',
+  'PIP_CACHE_DIR',
+  'YARN_CACHE_FOLDER',
+  'PNPM_STORE_DIR',
+];
+
+const ROOTS = [
+  ['~/.cargo', 'CARGO_HOME'],
+  ['~/.rustup', 'RUSTUP_HOME'],
+  ['~/.gradle', 'GRADLE_USER_HOME'],
+  ['~/.nvm', 'NVM_DIR'],
+  ['~/.sdkman', 'SDKMAN_DIR'],
+  ['~/.perl5', 'PERLBREW_ROOT'],
+  ['~/perl5/perlbrew', 'PERLBREW_ROOT'],
+  ['~/.rbenv', 'RBENV_ROOT'],
+  ['~/.bun/install/cache', 'BUN_INSTALL_CACHE_DIR'],
+  ['~/.cache/deno', 'DENO_DIR'],
+  ['~/.npm', 'npm_config_cache', 'NPM_CONFIG_CACHE'],
+  ['~/.cache/pip', 'PIP_CACHE_DIR'],
+  ['~/.cache/yarn', 'YARN_CACHE_FOLDER'],
+  ['~/.local/share/pnpm/store', 'PNPM_STORE_DIR'],
+  ['~/go/pkg/mod', 'GOMODCACHE'],
+  ['~/.cache/go-build', 'GOCACHE'],
+  ['~/Library/Caches/go-build', 'GOCACHE'],
+  ['{LOCALAPPDATA}/go-build', 'GOCACHE'],
+  ['~/Library/Caches/deno', 'DENO_DIR'],
+  ['{LOCALAPPDATA}/deno', 'DENO_DIR'],
+  ['{LOCALAPPDATA}/npm-cache', 'npm_config_cache', 'NPM_CONFIG_CACHE'],
+  ['~/Library/Caches/pip', 'PIP_CACHE_DIR'],
+  ['{LOCALAPPDATA}/pip/Cache', 'PIP_CACHE_DIR'],
+  ['~/Library/Caches/Yarn', 'YARN_CACHE_FOLDER'],
+  ['{LOCALAPPDATA}/Yarn/Cache', 'YARN_CACHE_FOLDER'],
+  ['~/Library/pnpm/store', 'PNPM_STORE_DIR'],
+  ['~/.pnpm-store', 'PNPM_STORE_DIR'],
+  ['{LOCALAPPDATA}/pnpm/store', 'PNPM_STORE_DIR'],
+  ['~/.cache', 'XDG_CACHE_HOME'],
+];
+
+export function configuredPattern(env, home, pattern) {
+  if (home !== env.currentHome) {
+    return pattern;
+  }
+  for (const [prefix, ...keys] of ROOTS) {
+    if (pattern !== prefix && !pattern.startsWith(`${prefix}/`)) {
+      continue;
+    }
+    const root = keys
+      .map((key) => env.vars?.[key])
+      .find((value) => value && env.path.isAbsolute(value));
+    if (root) {
+      return env.path.join(root, pattern.slice(prefix.length));
+    }
+  }
+  return pattern;
+}
+
+function applyQuery(vars, keys, values, pathApi) {
+  for (const key of keys) {
+    if (
+      !vars[key] &&
+      typeof values[key] === 'string' &&
+      pathApi.isAbsolute(values[key])
+    ) {
+      vars[key] = values[key];
+    }
+  }
+}
+
+export async function configureCacheRoots(env, homes) {
+  if (env.variables) {
+    Object.assign(env.vars, await env.variables(CACHE_VARIABLES));
+  }
+  if (!homes.includes(env.currentHome)) {
+    return;
+  }
+  const vars = env.vars;
+  if (!vars.GOMODCACHE && vars.GOPATH) {
+    vars.GOMODCACHE = env.path.join(
+      vars.GOPATH.split(env.platform === 'win32' ? ';' : ':')[0],
+      'pkg/mod'
+    );
+  }
+  const queries = [
+    [
+      'go',
+      ['go', 'env', '-json', 'GOMODCACHE', 'GOCACHE'],
+      ['GOMODCACHE', 'GOCACHE'],
+    ],
+    ['npm', ['npm', 'config', 'get', 'cache'], ['npm_config_cache']],
+    ['pip', ['pip', 'cache', 'dir'], ['PIP_CACHE_DIR']],
+    ['yarn', ['yarn', 'cache', 'dir'], ['YARN_CACHE_FOLDER']],
+    ['pnpm', ['pnpm', 'store', 'path'], ['PNPM_STORE_DIR']],
+  ];
+  for (const [tool, argv, keys] of queries) {
+    if (
+      keys.every((key) => vars[key]) ||
+      (tool === 'npm' && vars.NPM_CONFIG_CACHE) ||
+      !(await env.which(tool))
+    ) {
+      continue;
+    }
+    const result = await env.run(argv, { timeoutMs: 5000 });
+    if (result.code !== 0) {
+      continue;
+    }
+    let values;
+    try {
+      values =
+        tool === 'go'
+          ? JSON.parse(result.stdout)
+          : { [keys[0]]: result.stdout.trim().split('\n').at(-1) };
+    } catch {
+      continue;
+    }
+    applyQuery(vars, keys, values, env.path);
+  }
+}

package/src/env/inspection.js

@@ -0,0 +1,100 @@
+import { OPEN_PATHS_SCRIPT } from './process-scripts.js';
+import { trace } from '../exec.js';
+
+export function parseProcessProbe(result) {
+  const gids = new Map(
+    result.stderr
+      .split('\n')
+      .filter((line) => line.startsWith('DSS_GID|'))
+      .map((line) => {
+        const [, pid, gid] = line.split('|');
+        return [Number(pid), gid ? Number(gid) : null];
+      })
+  );
+  return {
+    paths: new Set(
+      result.stdout
+        .split('\n')
+        .filter((line) => line.startsWith('/'))
+        .map((line) => line.replace(/ \(deleted\)$/, ''))
+    ),
+    unreadable: result.stderr
+      .split('\n')
+      .filter((line) => line.startsWith('DSS_UNREADABLE|'))
+      .map((line) => {
+        const [, pid, uid, name, ...command] = line.split('|');
+        return {
+          pid: Number(pid),
+          uid: uid ? Number(uid) : null,
+          gid: gids.get(Number(pid)) ?? null,
+          name,
+          command: command.join('|'),
+        };
+      }),
+  };
+}
+
+/** Root without ptrace can often inspect a dumpable process as its own UID/GID. */
+export async function retryProcessOwners(executor, evidence) {
+  const groups = new Map();
+  for (const proc of evidence.unreadable) {
+    if (
+      !Number.isInteger(proc.uid) ||
+      !Number.isInteger(proc.gid) ||
+      proc.uid === 0
+    ) {
+      continue;
+    }
+    const key = `${proc.uid}:${proc.gid}`;
+    groups.set(key, [...(groups.get(key) ?? []), proc]);
+  }
+  const unresolved = new Map(
+    evidence.unreadable.map((proc) => [proc.pid, proc])
+  );
+  for (const [identity, procs] of groups) {
+    const [uid, gid] = identity.split(':');
+    trace(
+      'process inspection as owning uid/gid',
+      identity,
+      procs.map((proc) => proc.pid)
+    );
+    const result = await executor.run([
+      'setpriv',
+      `--reuid=${uid}`,
+      `--regid=${gid}`,
+      '--clear-groups',
+      'sh',
+      '-c',
+      OPEN_PATHS_SCRIPT,
+      'dss',
+      ...procs.map((proc) => `/proc/${proc.pid}`),
+    ]);
+    const retried = parseProcessProbe(result);
+    for (const target of retried.paths) {
+      evidence.paths.add(target);
+    }
+    if (result.code === 0 || retried.unreadable.length) {
+      for (const proc of procs) {
+        unresolved.delete(proc.pid);
+      }
+      for (const proc of retried.unreadable) {
+        unresolved.set(proc.pid, proc);
+      }
+    }
+  }
+  return { paths: evidence.paths, unreadable: [...unresolved.values()] };
+}
+
+export function inspectionHint(unreadable) {
+  if (!unreadable.length) {
+    return null;
+  }
+  const identities = unreadable
+    .slice(0, 5)
+    .map(
+      (proc) =>
+        `${proc.name || 'unknown'} pid ${proc.pid} uid ${proc.uid ?? '?'} gid ${proc.gid ?? '?'}`
+    )
+    .join('; ');
+  return `${unreadable.length} processes are unreadable (${identities}). Activity uncertainty is scoped to daemon storage and accessible paths. Inspect as the owning UID/GID (setpriv), or grant CAP_SYS_PTRACE for read-only inspection; root alone may lack that capability.`;
+}

package/src/env/local.js

@@ -1,3 +1,5 @@
+import { checkSignal } from './scope.js';
+import { retryProcessOwners, inspectionHint } from './inspection.js';
 /**
  * Base names of a process's executable and `argv[0]`, without duplicates
  * and without the ` (deleted)` suffix of replaced binaries.
@@ -58,6 +60,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { URL, fileURLToPath } from 'node:url';
 import { procIdentity, procOpenPaths } from './proc.js';
+import { CACHE_VARIABLES } from './cache-roots.js';
 
 import { hostExecutor } from '../exec.js';
 import { matchesGlob } from '../paths.js';
@@ -189,11 +192,11 @@ export class LocalEnv {
     this.protectedPaths = [fileURLToPath(new URL('../../', import.meta.url))];
     this.currentHome = os.homedir();
     this.skipNames = new Set(options.skipNames ?? DEFAULT_SKIP_NAMES);
-    this.vars = options.vars ?? {
-      LOCALAPPDATA: process.env.LOCALAPPDATA,
-      APPDATA: process.env.APPDATA,
-      TMPDIR: process.env.TMPDIR,
-    };
+    this.vars =
+      options.vars ??
+      Object.fromEntries(
+        CACHE_VARIABLES.map((name) => [name, process.env[name]])
+      );
   }
 
   recordAccessError(target, error) {
@@ -251,21 +254,26 @@ export class LocalEnv {
       mtimeMs: stats.mtimeMs,
       inode: `${stats.dev}:${stats.ino}`,
       uid: stats.uid,
+      gid: stats.gid,
+      mode: stats.mode,
       device: stats.dev,
     };
   }
 
   async readText(target, maxBytes = 1024 * 1024) {
+    checkSignal(this.signal);
     try {
       const handle = await fsp.open(target, 'r');
       try {
         const buffer = Buffer.alloc(maxBytes);
         const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
+        checkSignal(this.signal);
         return buffer.subarray(0, bytesRead).toString('utf8');
       } finally {
         await handle.close();
       }
     } catch {
+      checkSignal(this.signal);
       return null;
     }
   }
@@ -394,6 +402,7 @@ export class LocalEnv {
     };
     let frontier = root.isDirectory() ? [target] : [];
     while (frontier.length > 0) {
+      checkSignal(this.signal);
       const next = [];
       for (let index = 0; index < frontier.length; index += WALK_BATCH) {
         const found = await Promise.all(
@@ -475,6 +484,7 @@ export class LocalEnv {
       roots.map(async (root) => [root, 0, await this.deviceId(root)])
     );
     while (queue.length > 0) {
+      checkSignal(this.signal);
       const [dir, depth, device] = queue.shift();
       if (visited.has(dir)) {
         continue;
@@ -613,11 +623,15 @@ export class LocalEnv {
 
   async #linuxProcesses() {
     const io = this.options.procFs ?? fsp;
+    this.mountNamespace = await io
+      .readlink('/proc/self/ns/mnt')
+      .catch(() => null);
     const pids = (await io.readdir('/proc')).filter((name) =>
       /^\d+$/.test(name)
     );
     const processes = [];
     for (const pid of pids) {
+      checkSignal(this.signal);
       const base = `/proc/${pid}`;
       const stat = parseProcStat(
         await io.readFile(`${base}/stat`, 'utf8').catch(() => '')
@@ -641,6 +655,7 @@ export class LocalEnv {
         ...(await procIdentity(base, io)),
         name,
         startTime: stat.startTime,
+        mountNamespace: await io.readlink(`${base}/ns/mnt`).catch(() => null),
         cwd,
         aliases: processAliases(exe, cmdline.split('\0')[0]),
         command: cmdline.replaceAll('\0', ' '),
@@ -658,29 +673,8 @@ export class LocalEnv {
   async openPaths({ strict = true } = {}) {
     try {
       let paths = await this.rawOpenPaths({ strict });
-      if (strict && this.unreadableProcesses?.length && this.processInspector) {
-        const privileged = await this.processInspector.openPaths();
-        if (privileged) {
-          this.unreadableProcesses =
-            this.processInspector.unreadableProcesses ?? [];
-          paths = privileged;
-        }
-      }
-      if (strict && this.unreadableProcesses?.length) {
-        const { OPEN_PATHS_SCRIPT } = await import('./shell.js');
-        const elevated = await this.run([
-          'sudo',
-          '-n',
-          'sh',
-          '-c',
-          OPEN_PATHS_SCRIPT,
-        ]);
-        if (elevated.code === 0) {
-          paths = new Set(
-            elevated.stdout.split('\n').filter((line) => line.startsWith('/'))
-          );
-          this.unreadableProcesses = [];
-        }
+      if (strict) {
+        paths = await this.#completeInspection(paths);
       }
       this.#processHint();
       return paths;
@@ -688,6 +682,9 @@ export class LocalEnv {
       if (this.processInspector) {
         const paths = await this.processInspector.openPaths();
         this.probeDiagnostic = this.processInspector.probeDiagnostic;
+        this.unreadableProcesses =
+          this.processInspector.unreadableProcesses ?? [];
+        this.#processHint();
         return paths;
       }
       this.probeDiagnostic = error.message;
@@ -695,16 +692,56 @@ export class LocalEnv {
     }
   }
 
+  async #completeInspection(paths) {
+    paths = await this.#inspectOwners(paths);
+    if (this.unreadableProcesses?.length && this.processInspector) {
+      const privileged = await this.processInspector.openPaths();
+      if (privileged) {
+        this.unreadableProcesses =
+          this.processInspector.unreadableProcesses ?? [];
+        paths = new Set([...(paths ?? []), ...privileged]);
+      }
+    }
+    if (this.unreadableProcesses?.length) {
+      const { OPEN_PATHS_SCRIPT } = await import('./shell.js');
+      const elevated = await this.run([
+        'sudo',
+        '-n',
+        'sh',
+        '-c',
+        OPEN_PATHS_SCRIPT,
+      ]);
+      if (elevated.code === 0) {
+        paths = new Set(
+          elevated.stdout.split('\n').filter((line) => line.startsWith('/'))
+        );
+        this.unreadableProcesses = [];
+      }
+    }
+    return paths;
+  }
+
   #processHint() {
-    this.probeHint = this.unreadableProcesses?.length
-      ? `${this.unreadableProcesses.length} processes are unreadable; uncertainty is scoped to their paths and UID. Re-run as root for complete inspection (docker exec -u 0 -e HOME=<user-home> <container> dss scan).`
-      : null;
+    this.probeHint = inspectionHint(this.unreadableProcesses ?? []);
+  }
+
+  async #inspectOwners(paths) {
+    if (!this.unreadableProcesses?.length || !(await this.isRoot())) {
+      return paths;
+    }
+    const evidence = await retryProcessOwners(this.executor, {
+      paths,
+      unreadable: this.unreadableProcesses,
+    });
+    this.unreadableProcesses = evidence.unreadable;
+    return evidence.paths;
   }
 
   async rawOpenPaths({ strict = true } = {}) {
     if (this.platform === 'linux') {
       const { paths, unreadable } = await procOpenPaths(
-        this.options.procFs ?? fsp
+        this.options.procFs ?? fsp,
+        this.signal
       );
       this.unreadableProcesses = strict ? unreadable : [];
       return paths;

package/src/env/proc.js

@@ -1,5 +1,6 @@
 /** Linux proc inspection preserves evidence when only some PIDs are denied. */
 import { promises as fsp } from 'node:fs';
+import { checkSignal } from './scope.js';
 
 export async function procIdentity(base, io = fsp) {
   const read = (name) => io.readFile(`${base}/${name}`, 'utf8').catch(() => '');
@@ -9,20 +10,30 @@ export async function procIdentity(base, io = fsp) {
     read('cmdline'),
   ]);
   const uid = /^Uid:\s+(\d+)/m.exec(status)?.[1];
+  const gid = /^Gid:\s+(\d+)/m.exec(status)?.[1];
   return {
     pid: Number(base.split('/').at(-1)),
     uid: uid === undefined ? null : Number(uid),
+    gid: gid === undefined ? null : Number(gid),
+    groups:
+      /^Groups:\s*(.*)$/m
+        .exec(status)?.[1]
+        .trim()
+        .split(/\s+/)
+        .filter(Boolean)
+        .map(Number) ?? null,
     name: comm.trim(),
     argv: command.split('\0').filter(Boolean),
     command: command.replaceAll('\0', ' '),
   };
 }
 
-export async function procOpenPaths(io = fsp) {
+export async function procOpenPaths(io = fsp, signal) {
   const paths = new Set();
   const unreadable = [];
   const pids = (await io.readdir('/proc')).filter((pid) => /^\d+$/.test(pid));
   for (const pid of pids) {
+    checkSignal(signal);
     const base = `/proc/${pid}`;
     const stat = await io.readFile(`${base}/stat`, 'utf8').catch(() => '');
     if (stat.slice(stat.lastIndexOf(')') + 2).startsWith('Z ')) {
@@ -40,6 +51,7 @@ export async function procOpenPaths(io = fsp) {
       return [];
     });
     for (const link of ['cwd', 'exe', ...fds.map((fd) => `fd/${fd}`)]) {
+      checkSignal(signal);
       const target = await io.readlink(`${base}/${link}`).catch(failure);
       if (target.startsWith('/')) {
         paths.add(target.replace(/ \(deleted\)$/, ''));