elanous 0.2.31 → 0.2.32

package/src/task-orchestrator/surfaces/pod-command-job.ts

@@ -34,6 +34,8 @@ import {
 
 /** CLI `--deadline` 생략 시 — 기존 Pod Job 수명 상한과 같다. */
 export const POD_COMMAND_DEADLINE_SECONDS = POD_JOB_DEADLINE_SECONDS;
+/** An opt-in shadow cannot let a synchronous kubectl call hide its host deadline for two minutes. */
+export const POD_COMMAND_CANCEL_KUBECTL_TIMEOUT_MS = 15_000;
 
 export const POD_NETWORK_SKILLS = ['omni-crawl', 'omni-digest'] as const;
 export const POD_LITE_IMAGE = 'elanous-harness-lite:local';
@@ -414,6 +416,12 @@ export interface RunPodCommandOptions {
    * elsewhere. Omitted = poll without a bound (unchanged for every caller but the release gate).
    */
   statusUnreadableMs?: number;
+  /** Optional caller cancellation. Omitted callers keep their existing polling behavior. */
+  signal?: AbortSignal;
+  /** Optional host wall-clock deadline; checked even when a synchronous kubectl delayed the abort timer. */
+  hostDeadlineAtMs?: number;
+  /** Clock seam for deadline checks. */
+  nowMs?: () => number;
   kubectl?: Kubectl;
   /** A caller-owned scheduler is self-capped: acquires count only its own Jobs, never cluster occupancy (POOLGLOBAL-REG). */
   poolScheduler?: PodPoolScheduler;
@@ -486,14 +494,35 @@ export function podCommandTargetCommit(o: { remote: boolean; gitHead: () => stri
   return o.localImageCommit();
 }
 
+/** Only opt-in callers can stop waiting on a pre-Job async operation. Late rejections stay observed. */
+function awaitPodCommandAbort<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {
+  if (!signal) return pending;
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = () => { signal.removeEventListener('abort', onAbort); reject(signal.reason ?? new Error('pod command aborted')); };
+    signal.addEventListener('abort', onAbort, { once: true });
+    pending.then(
+      (value) => { signal.removeEventListener('abort', onAbort); resolve(value); },
+      (error) => { signal.removeEventListener('abort', onAbort); reject(error); },
+    );
+    if (signal.aborted) onAbort();
+  });
+}
+
 /** 풀 자리 · 이미지 판 · Job 적용 · 완료 대기 · 산출 회수 · Secret 정리. */
 export async function runPodCommand(options: RunPodCommandOptions): Promise<PodCommandResult> {
+  const nowMs = options.nowMs ?? Date.now;
+  const ensureLive = () => {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error('pod command aborted');
+    if (options.hostDeadlineAtMs !== undefined && nowMs() >= options.hostDeadlineAtMs) throw new Error('pod shadow: host timeout');
+  };
+  ensureLive();
   const command = [...options.command];
   if (command.length === 0) throw new Error('pod command: 명령이 비었다');
   const skills = [...new Set((options.skills ?? []).map((s) => s.trim()).filter(Boolean))];
   const llm = options.llm;
   const log = options.log ?? ((c, e, d) => debug.log(c, e, d));
-  const baseKubectl = options.kubectl ?? defaultKubectl;
+  const baseKubectl = options.kubectl ?? ((args: readonly string[], input?: string) =>
+    defaultKubectl(args, input, options.signal ? POD_COMMAND_CANCEL_KUBECTL_TIMEOUT_MS : undefined));
   const sleep = options.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
   const namespace = options.namespace ?? 'elanous-test';
   const image = options.image ?? podCommandImageFor(skills, options.clone === true, options.lite === true);
@@ -534,18 +563,32 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     // concurrency cap — its Jobs count against the spec caps, not the cluster's goal Pods (#24253 → 0.2.15 gate ran 1 shard).
     const selfCapped = options.poolScheduler !== undefined;
     for (;;) {
-      member = await pool.tryAcquire(undefined, undefined, { selfCapped });
+      ensureLive();
+      const acquiring = pool.tryAcquire(undefined, undefined, { selfCapped, signal: options.signal });
+      try { member = await awaitPodCommandAbort(acquiring, options.signal); }
+      catch (error) {
+        // If cancellation won the await at the same instant acquisition completed, return that lease.
+        void acquiring.then((late) => { if (late) pool!.release(late); }, () => {});
+        throw error;
+      }
       if (member) break;
-      await sleep(options.pollMs ?? 15_000);
+      await awaitPodCommandAbort(sleep(options.pollMs ?? 15_000), options.signal);
     }
   }
+  if (options.signal?.aborted) {
+    if (member && pool) pool.release(member);
+    ensureLive();
+  }
   const currentContext = member || options.kubectl ? null : baseKubectl(['config', 'current-context']);
   const context = member?.context ?? (currentContext?.status === 0 ? currentContext.stdout.trim() : '');
-  const kubectl: Kubectl = (args, stdin) => baseKubectl(context ? ['--context', context, ...args] : [...args], stdin);
-  const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', '-l', own, '--ignore-not-found']); };
+  const kubectlRaw: Kubectl = (args, stdin) => baseKubectl(context ? ['--context', context, ...args] : [...args], stdin);
+  const kubectl: Kubectl = (args, stdin) => { ensureLive(); const result = kubectlRaw(args, stdin); ensureLive(); return result; };
+  const cleanupSecret = () => { kubectlRaw(['-n', namespace, 'delete', 'secret', '-l', own, '--ignore-not-found']); };
   const artifactRoot = options.artifactsRoot ?? `${effectiveInstanceRoot()}/pod-artifacts`;
   const artifactsDir = `${artifactRoot}/${name}`;
+  let jobApplied = false;
   try {
+    ensureLive();
     if (!context && !options.kubectl) throw new Error('pod command: kubectl context 를 확인할 수 없다');
     let grokAuth: string | undefined;
     if (llm === 'grok') {
@@ -573,7 +616,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       const localSkillsDigest = options.kubectl ? null : image === POD_LITE_IMAGE
         ? podSkillsDigest(POD_NETWORK_SKILLS, resolve(import.meta.dir, '../../../skills')).digest
         : podSkillsDigest(resolvePodSkills(env).skills).digest;
-      const syncs = await (options.syncImages ?? syncPoolImages)([member], image, imageCommit, { localSkillsDigest });
+      const syncs = await awaitPodCommandAbort((options.syncImages ?? syncPoolImages)([member], image, imageCommit, { localSkillsDigest }), options.signal);
       const synced = syncs.get(member.context);
       if (synced && !synced.ok) throw new Error(`pod command: 이미지 판을 못 맞췄다: ${synced.detail}`);
       if (synced?.imageRef) member = { ...member, imageRef: synced.imageRef };
@@ -586,8 +629,8 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     const seedMirror = options.seedMirror ?? (options.kubectl ? undefined : seedMirrorOnce);
     if (seedMirror && options.clone && options.source?.kind === 'commit' && hostMirror && member?.sshHost) {
       // Worst case added to a cold start: the push limit (GATE_MIRROR_SEED_LIMIT_MS), once per host·commit.
-      const seed = await seedMirror({ host: member.sshHost, commit: options.source.sha, cwd: options.mirrorSeedCwd ?? process.cwd() })
-        .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) }));
+      const seed = await awaitPodCommandAbort(seedMirror({ host: member.sshHost, commit: options.source.sha, cwd: options.mirrorSeedCwd ?? process.cwd() })
+        .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) })), options.signal);
       log('pod.command-job', 'mirror-seed', { host: member.sshHost, commit: options.source.sha, ok: seed?.ok ?? false, ms: seed?.ms ?? 0, ...(seed?.detail ? { detail: seed.detail } : {}) });
     }
     // GATE-WARM-BOOT-NO-INIT (10-15): the hostPath dirs the uid-1000 child writes are handed over on the node itself, once per
@@ -600,14 +643,15 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       if (!member) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'no-pool-member', paths: hostDirPaths });
       else if (!prepareHostDirs) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'prep-disabled', paths: hostDirPaths });
       else {
-        const prep = await prepareHostDirs({ member, hostPaths: hostDirPaths })
-          .catch((error: unknown) => ({ host: member!.sshHost ?? 'local', ok: false, ms: 0, detail: String(error).slice(0, 300) }));
+        const prep = await awaitPodCommandAbort(prepareHostDirs({ member, hostPaths: hostDirPaths })
+          .catch((error: unknown) => ({ host: member!.sshHost ?? 'local', ok: false, ms: 0, detail: String(error).slice(0, 300) })), options.signal);
         hostDirsPrepared = prep?.ok === true;
         log('pod.command-job', 'host-dirs-prep', { host: prep?.host ?? member.sshHost ?? 'local', ok: prep?.ok ?? false, ms: prep?.ms ?? 0, paths: hostDirPaths, ...(prep?.detail ? { detail: prep.detail } : {}) });
       }
     }
     // Any path where the node-side hand-over did not succeed keeps the old in-Pod hand-over (review mf: uid 1000 could not write).
     const hostDirsInit = hostDirPaths.length > 0 && !hostDirsPrepared;
+    ensureLive();
     const ghToken = options.clone ? (options.ghToken ?? defaultGhToken)() : undefined;
     const secret = commandJobSecret({ name, namespace, launch, skills, skillEnvText, ...(grokAuth !== undefined ? { grokAuth } : {}), ...(ghToken !== undefined ? { ghToken } : {}) });
     if (secret) {
@@ -623,6 +667,8 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       ...(hostDirsInit ? { hostDirsInit: true } : {}),
     });
     kubectl(['-n', namespace, 'delete', 'job', '-l', own, '--ignore-not-found']);
+    // A wall deadline can elapse inside the synchronous apply; cleanup by this launch's name then remains safe.
+    jobApplied = true;
     const applied = kubectl(['apply', '-f', '-'], JSON.stringify(manifest));
     if (applied.status !== 0) {
       cleanupSecret();
@@ -633,6 +679,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     let markerRc: number | null = null;
     const appliedAt = Date.now();
     for (;;) {
+      ensureLive();
       const got = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
       const finished = jobFinished(got.stdout);
       if (finished) { state = finished; break; }
@@ -655,8 +702,9 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
           throw new Error(`pod command: Job 상태를 ${Math.round(options.statusUnreadableMs / 1000)}초 동안 못 읽었다(${context}) — ${(got.stderr ?? '').trim().split('\n').pop()?.slice(0, 200) ?? ''}`);
         }
       } else unreadableSince = null;
-      await sleep(options.pollMs ?? 15_000);
+      await awaitPodCommandAbort(sleep(options.pollMs ?? 15_000), options.signal);
     }
+    ensureLive();
     let logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
     // Marker path returns before the Job condition — a full-log read can hit the same transient window the tail read
     // already survived (container log rotation · API hiccup). Retry it a little before calling the artifacts lost.
@@ -721,6 +769,12 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     });
     return { exitCode, artifactsDir, job: name, image: imageRef ?? image, artifacts };
   } catch (err) {
+    if (jobApplied && options.signal) {
+      // Opt-in bounded callers remove their own failed/Pending Job, including status-unreadable exits.
+      // On an unreachable API this is best effort; the local lease is always released in finally.
+      try { kubectlRaw(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=false']); }
+      catch { /* preserve the cancellation reason */ }
+    }
     cleanupSecret();
     throw err;
   } finally {

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -230,6 +230,13 @@ function runningLimit(spec: Record<string, unknown>): number | null {
 
 /** A short-lived Pod proves cluster DNS from inside the same namespace as harness Jobs. Image pull failures are not DNS failures. */
 export type PoolDnsProbe = 'ready' | 'dns' | 'image' | 'unknown';
+/** Separate, opt-in observation. null means the probe could not measure that step. */
+export interface ExternalGitHubProbe {
+  externalDns: boolean | null;
+  githubHttps: boolean | null;
+  measuredAt: string | null;
+  reason: string | null;
+}
 const DNS_CACHE_MS = 10 * 60_000;
 const DNS_STALE_OK_MS = 30 * 60_000;
 const DNS_LOCK_WAIT_MS = 6 * 60_000;
@@ -240,6 +247,97 @@ const dnsFlock = process.platform === 'linux' || process.platform === 'darwin'
     flock: { args: ['int', 'int'], returns: 'int' },
   }).symbols.flock : null;
 
+/** A disposable Pod in the Job namespace measures GitHub reachability without changing admission. */
+export function probePoolGitHub(context: string, kubectl: PoolKubectl = leaseKubectl, options: { dir?: string; now?: () => number } = {}): ExternalGitHubProbe {
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
+  const now = options.now ?? Date.now;
+  const dir = options.dir ?? hostLeaseBaseDir();
+  const key = createHash('sha256').update(context).digest('hex');
+  const cache = join(dir, `github-egress-${key}.cache`);
+  const lock = join(dir, `github-egress-${key}.flock`);
+  const cached = (): ExternalGitHubProbe | null => {
+    try {
+      const record = object(JSON.parse(readFileSync(cache, 'utf8')));
+      if (typeof record?.at !== 'number' || now() < record.at || now() - record.at >= 60_000) return null;
+      if (typeof record.measuredAt !== 'string' || ![true, false].includes(record.externalDns as boolean) ||
+          ![true, false, null].includes(record.githubHttps as boolean | null) ||
+          !(record.reason === null || typeof record.reason === 'string')) return null;
+      return { externalDns: record.externalDns as boolean, githubHttps: record.githubHttps as boolean | null,
+        measuredAt: record.measuredAt, reason: record.reason as string | null };
+    } catch { return null; }
+  };
+  const fresh = cached();
+  if (fresh) return fresh;
+  try { mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { return unknown('probe cache unavailable'); }
+  if (!dnsFlock) return unknown('probe lock unavailable');
+  let fd: number;
+  try { fd = openSync(lock, 'a', 0o600); } catch { return unknown('probe lock unavailable'); }
+  let held = false;
+  try {
+    const deadline = Date.now() + 2_000;
+    while (!held) {
+      const shared = cached();
+      if (shared) return shared;
+      if (dnsFlock(fd, 2 | 4) === 0) { held = true; break; }
+      if (Date.now() >= deadline) return unknown('probe busy');
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+    }
+    const shared = cached();
+    if (shared) return shared;
+    const result = runPoolGitHubProbe(context, kubectl, new Date(now()).toISOString());
+    if (result.measuredAt !== null) {
+      const temp = `${cache}.${randomUUID()}.tmp`;
+      try { writeFileSync(temp, JSON.stringify({ ...result, at: now() }), { mode: 0o600 }); renameSync(temp, cache); }
+      catch { try { rmSync(temp, { force: true }); } catch { /* observation remains valid without cache */ } }
+    }
+    return result;
+  } finally {
+    if (held) dnsFlock(fd, 8);
+    closeSync(fd);
+  }
+}
+
+function runPoolGitHubProbe(context: string, kubectl: PoolKubectl, measuredAt: string): ExternalGitHubProbe {
+  const name = `elanous-egress-${randomUUID().slice(0, 12)}`;
+  const base = ['--context', context, '--request-timeout=15s'];
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
+  let created = false;
+  try {
+    const manifest = JSON.stringify({ apiVersion: 'v1', kind: 'Pod', metadata: { name, namespace: 'elanous-test', labels: { 'elanous.probe': 'github-egress' } }, spec: {
+      restartPolicy: 'Never', activeDeadlineSeconds: 35, automountServiceAccountToken: false,
+      containers: [{ name: 'probe', image: 'busybox:1.36', command: ['sh', '-c',
+        'if nslookup github.com >/dev/null 2>&1; then echo EXTERNAL_DNS_OK; if wget -q -T 8 -O /dev/null https://github.com/; then echo GITHUB_HTTPS_OK; else echo GITHUB_HTTPS_FAILED; fi; else echo EXTERNAL_DNS_FAILED; fi'],
+      resources: { requests: { cpu: '0', memory: '16Mi' }, limits: { cpu: '100m', memory: '64Mi' } } }],
+    } });
+    if (kubectl([...base, 'create', '-f', '-'], manifest).status !== 0) return unknown('probe create failed');
+    created = true;
+    const waited = kubectl([...base, '-n', 'elanous-test', 'wait', '--for=jsonpath={.status.phase}=Succeeded', `pod/${name}`, '--timeout=25s']);
+    const podResult = kubectl([...base, '-n', 'elanous-test', 'get', `pod/${name}`, '-o', 'json']);
+    if (podResult.status !== 0) return unknown('probe status unavailable');
+    const pod = object(JSON.parse(podResult.stdout));
+    const statuses = object(pod?.status)?.containerStatuses;
+    if (Array.isArray(statuses) && statuses.some((c) =>
+          ['ErrImagePull', 'ImagePullBackOff', 'InvalidImageName'].includes(String(object(object(object(c)?.state)?.waiting)?.reason))))
+      return unknown('probe image unavailable');
+    const logs = kubectl([...base, '-n', 'elanous-test', 'logs', `pod/${name}`]);
+    if (logs.status !== 0) return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+    const markers = logs.stdout.trim().split(/\r?\n/u);
+    const dnsOk = markers.includes('EXTERNAL_DNS_OK');
+    const dnsFail = markers.includes('EXTERNAL_DNS_FAILED');
+    const httpsOk = markers.includes('GITHUB_HTTPS_OK');
+    const httpsFail = markers.includes('GITHUB_HTTPS_FAILED');
+    if (dnsFail && !dnsOk && !httpsOk && !httpsFail)
+      return { externalDns: false, githubHttps: null, measuredAt, reason: 'external DNS failed' };
+    if (dnsOk && !dnsFail && httpsOk !== httpsFail)
+      return { externalDns: true, githubHttps: httpsOk, measuredAt, reason: httpsFail ? 'GitHub HTTPS failed' : null };
+    return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+  } catch { return unknown('probe failed'); }
+  finally {
+    if (created) try { kubectl([...base, '-n', 'elanous-test', 'delete', `pod/${name}`, '--ignore-not-found=true', '--wait=false']); }
+    catch { /* best effort; Kubernetes activeDeadlineSeconds also bounds the Pod */ }
+  }
+}
+
 /** The cache and lock are shared by CLI processes, keyed by context rather than pool composition. */
 export function probePoolDns(context: string, kubectl: PoolKubectl = leaseKubectl, options: { dir?: string; now?: () => number } = {}): PoolDnsProbe {
   const dir = options.dir ?? hostLeaseBaseDir();

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -41,7 +41,7 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
   const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
   const knownSecrets = secretValues(entry);
   const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
-  if (containsCredential(entry.event) || !EVENT_ALLOWED.test(entry.event)) return undefined;
+  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
 
   const data: Record<string, unknown> = { runId };
   let fields = 0;

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -474,7 +474,7 @@ export class PodPoolScheduler {
    * member the 0.2.15 gate launched its shards one at a time.
    * Ties keep the configured member order. Returns null when every readable member is full.
    */
-  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; onPlacement?: (placement: PodPlacement) => void } = {}): Promise<PodPoolMember | null> {
+  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; onPlacement?: (placement: PodPlacement) => void; signal?: AbortSignal } = {}): Promise<PodPoolMember | null> {
     const selfCapped = mode.selfCapped === true;
     const kind = mode.kind ?? null;
     // POOL-LITE: lite goals try the small member first, implementation goals the big one; full → overflow by free share.
@@ -487,6 +487,8 @@ export class PodPoolScheduler {
       const reason = error instanceof Error ? error.message : String(error);
       reading = Object.fromEntries(this.members.map((m) => [m.context, { occupied: null, reason }]));
     }
+    // A caller may abandon a slow occupancy read. Never acquire its lease after cancellation.
+    if (mode.signal?.aborted) throw mode.signal.reason ?? new Error('pod pool acquisition aborted');
     const free: Record<string, number> = {};
     const measured: Record<string, boolean> = {};
     let best: { member: PodPoolMember; slots: number; measured: boolean; preferred: boolean } | null = null;

package/src/task-orchestrator/surfaces/pod-reuse-cleanup.ts

@@ -17,6 +17,8 @@ export interface PodReuseCleanupDecisionInput {
   statusExitCode: number | null;
   statusPorcelain: string;
   remainingPaths?: readonly string[];
+  additionalCleanExclusions?: readonly { name: string; pattern: string }[];
+  statusExclusions?: readonly string[];
 }
 
 export interface PodReuseCleanupDecision {
@@ -30,19 +32,21 @@ export interface PodReuseCleanupDecision {
 }
 
 /**
- * Pure request-boundary decision: return argv for the caller to execute and
- * decide whether the worker can be reused from the command results.
- * Execution/wiring and lifecycle event emission intentionally live in a later slice.
+ * Pure policy: return fixed argv and decide whether the worker can be reused
+ * from actual command results. WarmWorkerRuntime owns execution and lifecycle
+ * event emission at the serialized request boundary.
  */
 export function decidePodReuseCleanup(input: PodReuseCleanupDecisionInput): PodReuseCleanupDecision {
   const remainingPaths = (input.remainingPaths ?? []).slice(0, 5);
   const resetArgs = ['reset', '--hard', input.base] as const;
   const cleanArgs = [
     'clean', '-ffdx',
-    ...POD_REUSE_CLEAN_EXCLUSIONS.flatMap(({ pattern }) => pattern ? ['-e', pattern] : []),
+    ...[...POD_REUSE_CLEAN_EXCLUSIONS, ...(input.additionalCleanExclusions ?? [])]
+      .flatMap(({ pattern }) => pattern ? ['-e', pattern] : []),
   ] as const;
-  const statusArgs = ['status', '--porcelain'] as const;
-  const preserved = POD_REUSE_CLEAN_EXCLUSIONS.map(({ name }) => name);
+  const statusArgs = ['status', '--porcelain', '-z', '--', '.', ...(input.statusExclusions ?? [])
+    .map((path) => `:(exclude,top,literal)${path}`)] as const;
+  const preserved = [...POD_REUSE_CLEAN_EXCLUSIONS, ...(input.additionalCleanExclusions ?? [])].map(({ name }) => name);
 
   let reason: PodReuseCleanupDecision['reason'];
   if (!/^[0-9a-f]{40}$/i.test(input.base)) reason = 'invalid-base';