imprint-mcp 0.7.0 → 0.7.2

package/src/imprint/compile-tools.ts

@@ -1,3 +1,4 @@
+import { abortSignalError } from './concurrency.ts';
 /**
  * Shared compile-agent tool implementations.
  *
@@ -67,6 +68,7 @@ import {
   type Workflow,
   WorkflowSchema,
 } from './types.ts';
+import { userInteractionTools } from './user-interaction.ts';
 
 const REPO_ROOT = pathJoin(import.meta.dir, '..', '..');
 const MAX_SHARED_MODULE_SOURCE_CHARS = 50_000;
@@ -126,6 +128,7 @@ export function buildCompileTools(
       isIrreversibleRequest(request) && (!candidateSeqs || candidateSeqs.has(request.seq)),
   );
   const tools = [
+    ...userInteractionTools(context.signal),
     buildReadSessionSummaryTool(session, context, toolDir),
     buildReadRequestTool(session),
     buildInspectBodyStructureTool(session),
@@ -157,6 +160,8 @@ export function buildCompileTools(
 }
 
 export interface CompileToolContext {
+  /** Run/assignment lifetime; individual adapters also forward their request signal. */
+  signal?: AbortSignal;
   candidate?: ToolCandidate;
   sharedContext?: SharedCompileContext;
   teachCredentials?: { site: string; values: Record<string, string> };
@@ -2064,6 +2069,7 @@ async function runCommand(
 export async function typecheckArtifacts(
   dir: string,
   includes: string[],
+  signal?: AbortSignal,
 ): Promise<{ stdout: string; stderr: string; exitCode: number; timedOut: boolean }> {
   const configPath = pathJoin(dir, '.imprint-typecheck.tsconfig.json');
   const rootTsconfig = realpathSync(pathJoin(REPO_ROOT, 'tsconfig.json'));
@@ -2096,6 +2102,9 @@ export async function typecheckArtifacts(
       'bunx tsc --noEmit -p .imprint-typecheck.tsconfig.json',
       dir,
       120000,
+      undefined,
+      undefined,
+      signal,
     );
     return JSON.parse(result.result) as {
       stdout: string;
@@ -2133,7 +2142,9 @@ export function buildRunTestsTool(
       properties: {},
       required: [],
     },
-    handler: async () => {
+    handler: async (_input, request) => {
+      const signal = request?.signal;
+      if (signal?.aborted) throw abortSignalError(signal);
       const testNames = ['parser.test.ts', 'request.test.ts'].filter((name) =>
         existsSync(pathJoin(toolDir, name)),
       );
@@ -2170,9 +2181,17 @@ export function buildRunTestsTool(
           isError: true,
         };
       }
-      const cmdResult = await runCommand(testCommand, toolDir, 120000, {
-        [SESSION_PATH_ENV]: sessionPath,
-      });
+      const cmdResult = await runCommand(
+        testCommand,
+        toolDir,
+        120000,
+        {
+          [SESSION_PATH_ENV]: sessionPath,
+        },
+        undefined,
+        signal,
+      );
+      if (signal?.aborted) throw abortSignalError(signal);
 
       const output = JSON.parse(cmdResult.result) as {
         stdout: string;
@@ -2193,7 +2212,7 @@ export function buildRunTestsTool(
       );
       const typecheck =
         typecheckIncludes.length > 0
-          ? await typecheckArtifacts(toolDir, typecheckIncludes)
+          ? await typecheckArtifacts(toolDir, typecheckIncludes, signal)
           : { stdout: '', stderr: '', exitCode: 0, timedOut: false };
       const typecheckFailed = typecheck.exitCode !== 0 || typecheck.timedOut;
 
@@ -2971,6 +2990,7 @@ export async function externalVerification(
   session: Session,
   sessionPath: string,
   opts: {
+    signal?: AbortSignal;
     expectedToolName?: string;
     candidateRequestSeqs?: number[];
     /** Build-plan-declared dependency seqs included in exact effect provenance. */
@@ -3001,6 +3021,7 @@ export async function externalVerification(
    * integration run. The caller hands these to the independent semantic agent. */
   integrationEvidence: LiveIntegrationEvidence[];
 }> {
+  if (opts.signal?.aborted) throw abortSignalError(opts.signal);
   const failures: string[] = [];
   const warnings: string[] = [];
   let integrationEvidence: LiveIntegrationEvidence[] = [];
@@ -3203,6 +3224,7 @@ export async function externalVerification(
       },
       {
         networkDisabled: safetyBlocked,
+        signal: opts.signal,
       },
     );
     if (run.exitCode !== 0) {
@@ -3234,6 +3256,7 @@ export async function externalVerification(
         },
         {
           networkDisabled: safetyBlocked,
+          signal: opts.signal,
         },
       );
       if (run.exitCode !== 0) {
@@ -3264,9 +3287,15 @@ export async function externalVerification(
     } catch {
       // Best-effort cleanup before the run.
     }
-    const run = await runBunTestWithResults(integrationTestPath, toolDir, verifierTimeoutMs, {
-      [LIVE_EVIDENCE_PATH_ENV]: evidencePath,
-    });
+    const run = await runBunTestWithResults(
+      integrationTestPath,
+      toolDir,
+      verifierTimeoutMs,
+      {
+        [LIVE_EVIDENCE_PATH_ENV]: evidencePath,
+      },
+      { signal: opts.signal },
+    );
     try {
       integrationEvidence = readLiveIntegrationEvidence(evidencePath);
     } catch (error) {
@@ -3292,7 +3321,11 @@ export async function externalVerification(
   }
 
   if (existsSync(parserPath) || existsSync(parserTestPath)) {
-    const output = await typecheckArtifacts(toolDir, ['parser.ts', 'request-transform.ts']);
+    const output = await typecheckArtifacts(
+      toolDir,
+      ['parser.ts', 'request-transform.ts'],
+      opts.signal,
+    );
     if (output.exitCode !== 0 || output.timedOut) {
       failures.push(
         `generated TypeScript artifacts failed typecheck (bunx tsc --noEmit -p .imprint-typecheck.tsconfig.json) exited ${output.exitCode}${output.timedOut ? ' after timing out' : ''}\nstdout:\n${output.stdout}\nstderr:\n${output.stderr}`,

package/src/imprint/compile-verification.ts

@@ -33,6 +33,7 @@ export interface LiveIntegrationEvidence {
   result: LadderRun['result'];
   usedBackend: LadderRun['usedBackend'];
   attempts: LadderRun['attempts'];
+  responseObservations?: LadderRun['responseObservations'];
   durationMs: number;
 }
 
@@ -182,6 +183,7 @@ export async function runCapturedIntegrationCase(opts: {
       result: run.result,
       usedBackend: run.usedBackend,
       attempts: run.attempts,
+      responseObservations: run.responseObservations,
       durationMs: Date.now() - startedAt,
     };
     appendFileSync(evidencePath, `${JSON.stringify(evidence)}\n`, { mode: 0o600 });

package/src/imprint/compile.ts

@@ -46,6 +46,7 @@ import {
   type Workflow,
   WorkflowSchema,
 } from './types.ts';
+import type { OnUserPrompt } from './user-interaction.ts';
 
 const PROMPTS_DIR = pathJoin(import.meta.dir, '..', '..', 'prompts');
 const log = createLog('compile');
@@ -81,6 +82,7 @@ interface CompileOptions {
 // ─── generate (workflow.json) ────────────────────────────────────────────────
 
 interface GenerateOptions extends CompileOptions {
+  onPrompt?: OnUserPrompt;
   /** Hard wall-clock budget for the agent. Default 30 minutes. */
   maxDurationMs?: number;
   /** Progress callback with verification cycle information. */
@@ -146,6 +148,7 @@ export async function generate(opts: GenerateOptions): Promise<GenerateResult> {
       const outDir = opts.outDir ?? (opts.outPath ? dirname(opts.outPath) : undefined);
       const result = await compileAgent({
         sessionPath: opts.sessionPath,
+        onPrompt: opts.onPrompt,
         maxDurationMs: opts.maxDurationMs,
         deadlineMs: opts.deadlineMs,
         runDeadline: opts.runDeadline,

package/src/imprint/compiler-log.ts

@@ -10,3 +10,19 @@ export function recordCompilerHostError(conversationLogPath: string, message: st
     writeFileSync(conversationLogPath, JSON.stringify(log, null, 2), 'utf8');
   } catch {}
 }
+
+/** Error facts for private compiler journals, without exception messages/values. */
+export function compilerToolFailure(error: unknown): { name: string; code?: string | number } {
+  const value =
+    error && typeof error === 'object' ? (error as { name?: unknown; code?: unknown }) : {};
+  return {
+    name:
+      typeof value.name === 'string' && /^[A-Za-z][A-Za-z0-9]*Error$/.test(value.name)
+        ? value.name
+        : 'Error',
+    ...(typeof value.code === 'number' ||
+    (typeof value.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(value.code))
+      ? { code: value.code }
+      : {}),
+  };
+}

package/src/imprint/component-recovery.ts

@@ -0,0 +1,120 @@
+import { abortSignalError, withAbortSignal } from './concurrency.ts';
+import type { ToolResult } from './types.ts';
+
+interface RecoveryComponent {
+  id: string;
+  kind: string;
+  label: string;
+  /** Explicit consumers; an empty list does not make an owner global. */
+  toolIds: readonly string[];
+}
+
+export interface ComponentRecoveryOwner extends RecoveryComponent {
+  /** Repair and verify owned state before reporting success. Artifact owners
+   * also commit their dependency/build changes through their normal host. */
+  recover: (input: {
+    failure: Extract<ToolResult<unknown>, { ok: false }>;
+    previousRecoveries: number;
+    reason: string;
+  }) => Promise<boolean>;
+}
+
+/** Ownership and change observations are scoped to an explicit component id. */
+export class ComponentRecoveryQueue {
+  private readonly tails = new Map<string, Promise<void>>();
+  private readonly revisions = new Map<string, number>();
+
+  snapshot(): ReadonlyMap<string, number> {
+    return new Map(this.revisions);
+  }
+  revision(id: string): number {
+    return this.revisions.get(id) ?? 0;
+  }
+  recovered(id: string): void {
+    this.revisions.set(id, this.revision(id) + 1);
+  }
+
+  async run<T>(id: string, work: () => Promise<T>, signal?: AbortSignal): Promise<T> {
+    const previous = this.tails.get(id) ?? Promise.resolve();
+    let release = () => {};
+    const finished = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const tail = previous.then(() => finished);
+    this.tails.set(id, tail);
+    try {
+      await withAbortSignal(() => previous, signal);
+      if (signal?.aborted) throw abortSignalError(signal);
+      return await work();
+    } finally {
+      release();
+      void tail.then(() => {
+        if (this.tails.get(id) === tail) this.tails.delete(id);
+      });
+    }
+  }
+}
+
+/** Agents select declared owners. The engine never infers cause from a site,
+ * error code, message, cookie name, module name, or HTTP status. */
+export async function runWithComponentRecovery<T extends { result: ToolResult<unknown> }>(options: {
+  invoke: () => Promise<T>;
+  select: (
+    failed: T,
+    previousRecoveries: number,
+  ) => Promise<
+    | {
+        owner: ComponentRecoveryOwner;
+        reason: string;
+      }
+    | undefined
+  >;
+  onAttempt: (observed: T, previousRecoveries: number) => void;
+  queue?: ComponentRecoveryQueue;
+  signal?: AbortSignal;
+}): Promise<T> {
+  const queue = options.queue ?? new ComponentRecoveryQueue();
+  let previousRecoveries = 0;
+  let observedRevisions = queue.snapshot();
+  const invoke = async () => {
+    if (options.signal?.aborted) throw abortSignalError(options.signal);
+    observedRevisions = queue.snapshot();
+    const result = await options.invoke();
+    options.onAttempt(result, previousRecoveries);
+    return result;
+  };
+  let observed = await invoke();
+  while (!observed.result.ok) {
+    const selection = await options.select(observed, previousRecoveries);
+    if (!selection) return observed;
+    const revision = observedRevisions.get(selection.owner.id) ?? 0;
+    let declined = false;
+    await queue.run(
+      selection.owner.id,
+      async () => {
+        if (queue.revision(selection.owner.id) !== revision) {
+          previousRecoveries += queue.revision(selection.owner.id) - revision;
+          observed = await invoke();
+          return;
+        }
+        if (observed.result.ok) return;
+        if (
+          !(await selection.owner.recover({
+            failure: observed.result,
+            previousRecoveries,
+            reason: selection.reason,
+          }))
+        ) {
+          declined = true;
+          return;
+        }
+        queue.recovered(selection.owner.id);
+        previousRecoveries++;
+        observed = await invoke();
+      },
+      options.signal,
+    );
+    if (declined) return observed;
+  }
+  return observed;
+}

package/src/imprint/cookie-jar.ts

@@ -10,6 +10,8 @@
  * scope for v1.
  */
 
+import { createHash } from 'node:crypto';
+
 export interface RuntimeCookie {
   name: string;
   value: string;
@@ -21,6 +23,8 @@ export interface RuntimeCookie {
   sameSite?: string;
   hostOnly?: boolean;
   creationIndex?: number;
+  /** Exact browser observation when an independent HTTP response changed this scope. */
+  httpResponse?: { browserSnapshotHash: string | null; deleted?: boolean };
 }
 
 export interface CookieLookupConstraints {
@@ -52,14 +56,95 @@ export class RuntimeCookieJar {
     return this.cookies.map((c) => ({ ...c }));
   }
 
+  /** Reconcile a complete browser snapshot, including cookies it removed. */
+  replace(cookies: RuntimeCookie[]): void {
+    this.cookies = [];
+    for (const cookie of cookies) this.setCookie(cookie);
+  }
+
+  /** Restore actual browser state while retaining HTTP changes whose browser
+   * baseline has not changed since that response, including deletion markers. */
+  restoreBrowserSnapshot(cookies: RuntimeCookie[]): void {
+    const observed = new RuntimeCookieJar(cookies);
+    const independent = this.cookies.filter(
+      (cookie) =>
+        cookie.httpResponse !== undefined &&
+        cookie.httpResponse.browserSnapshotHash === observed.scopeHash(cookie),
+    );
+    this.replace([...cookies, ...independent]);
+  }
+
+  private scopeHash(cookie: RuntimeCookie): string | null {
+    const matching = this.cookies.find((entry) => cookieScopeKey(entry) === cookieScopeKey(cookie));
+    if (!matching) return null;
+    const { name, value, domain, path, expires, sameSite, hostOnly } = matching;
+    return createHash('sha256')
+      .update(
+        JSON.stringify({
+          name,
+          value,
+          domain,
+          path,
+          expires,
+          sameSite,
+          hostOnly,
+          secure: Boolean(matching.secure),
+          httpOnly: Boolean(matching.httpOnly),
+        }),
+      )
+      .digest('hex');
+  }
+
+  /** Reconcile browser changes while retaining independent HTTP Set-Cookie
+   * changes that the browser has not observed. The caller owns the previous
+   * browser snapshot separately from this mixed-transport jar. */
+  reconcileBrowserSnapshot(cookies: RuntimeCookie[], previous: RuntimeCookieJar): void {
+    const next = new RuntimeCookieJar(cookies);
+    const scope = cookieScopeKey;
+    const before = new Map(previous.cookies.map((cookie) => [scope(cookie), cookie]));
+    const after = new Map(next.cookies.map((cookie) => [scope(cookie), cookie]));
+    const current = new Map(this.cookies.map((cookie) => [scope(cookie), cookie]));
+    const equal = (a: RuntimeCookie | undefined, b: RuntimeCookie | undefined) => {
+      const fields: (keyof RuntimeCookie)[] = [
+        'name',
+        'value',
+        'domain',
+        'path',
+        'expires',
+        'httpOnly',
+        'secure',
+        'sameSite',
+        'hostOnly',
+      ];
+      return (
+        a === b ||
+        Boolean(
+          a &&
+            b &&
+            fields.every((field) =>
+              field === 'secure' || field === 'httpOnly'
+                ? Boolean(a[field]) === Boolean(b[field])
+                : a[field] === b[field],
+            ),
+        )
+      );
+    };
+    this.cookies = this.cookies.filter((cookie) => {
+      const key = scope(cookie);
+      return !before.has(key) || after.has(key) || !equal(cookie, before.get(key));
+    });
+    for (const [key, cookie] of after) {
+      if (!equal(cookie, before.get(key)) || equal(current.get(key), before.get(key)))
+        this.setCookie(cookie);
+    }
+    previous.replace(cookies);
+  }
+
   setCookie(cookie: RuntimeCookie): void {
     const normalized = normalizeCookie(cookie);
-    const idx = this.cookies.findIndex(
-      (c) =>
-        c.name === normalized.name && c.domain === normalized.domain && c.path === normalized.path,
-    );
+    const idx = this.cookies.findIndex((c) => cookieScopeKey(c) === cookieScopeKey(normalized));
 
-    if (isExpired(normalized)) {
+    if (isExpired(normalized) && !normalized.httpResponse?.deleted) {
       if (idx >= 0) this.cookies.splice(idx, 1);
       return;
     }
@@ -75,9 +160,20 @@ export class RuntimeCookieJar {
     }
   }
 
-  setCookieFromHeader(setCookie: string, requestUrl: string): void {
+  setCookieFromHeader(
+    setCookie: string,
+    requestUrl: string,
+    browserSnapshot?: RuntimeCookieJar,
+  ): void {
     const parsed = parseSetCookie(setCookie, requestUrl);
-    if (parsed) this.setCookie(parsed);
+    if (parsed) {
+      if (browserSnapshot)
+        parsed.httpResponse = {
+          browserSnapshotHash: browserSnapshot.scopeHash(parsed),
+          ...(isExpired(parsed) ? { deleted: true } : {}),
+        };
+      this.setCookie(parsed);
+    }
   }
 
   getCookieHeader(url: string): string | null {
@@ -129,6 +225,7 @@ export class RuntimeCookieJar {
     const nowSeconds = Date.now() / 1000;
 
     return this.cookies.filter((c) => {
+      if (c.httpResponse?.deleted) return false;
       if (c.expires !== undefined && c.expires <= nowSeconds) return false;
       if (c.secure && !secure) return false;
       if (!domainMatches(c, host)) return false;
@@ -199,6 +296,19 @@ function parseSetCookie(setCookie: string, requestUrl: string): RuntimeCookie |
   return normalizeCookie(cookie);
 }
 
+/** Chromium stores host-only and domain cookies as distinct scopes even when
+ * their names, normalized domains, and paths match. */
+export function cookieScopeKey(
+  cookie: Pick<RuntimeCookie, 'name' | 'domain' | 'path' | 'hostOnly'>,
+): string {
+  return JSON.stringify([
+    normalizeDomain(cookie.domain),
+    cookie.hostOnly ?? !cookie.domain.startsWith('.'),
+    cookie.path || '/',
+    cookie.name,
+  ]);
+}
+
 function normalizeCookie(cookie: RuntimeCookie): RuntimeCookie {
   const expires = cookie.expires === -1 ? undefined : cookie.expires;
   return {

package/src/imprint/credential-extract.ts

@@ -57,6 +57,11 @@ interface ExtractionResult {
   replacements: Replacement[];
 }
 
+/** Existing workflow references are not newly recorded secret values. */
+export function isCredentialReference(value: string): boolean {
+  return /^\$\{credential\.[^}]+\}$/.test(value);
+}
+
 /** Parsers are tried in this order on every request that has a body. Each
  *  one is side-effect-free and returns `null` when its input doesn't fit
  *  its expected framing — so trying JSON first on a form body, or form on
@@ -112,7 +117,7 @@ export function extractCredentials(session: Session): ExtractionResult {
       confirmedByDom,
     });
 
-    replacements.push(
+    for (const replacement of [
       {
         requestSeq: req.seq,
         location: found.usernameLocation,
@@ -125,7 +130,9 @@ export function extractCredentials(session: Session): ExtractionResult {
         originalValue: found.passwordValue,
         placeholder: '${credential.password}',
       },
-    );
+    ]) {
+      if (!isCredentialReference(replacement.originalValue)) replacements.push(replacement);
+    }
   }
 
   return { findings, replacements };

package/src/imprint/credential-lock.ts

@@ -0,0 +1,147 @@
+import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import {
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { abortableDelay } from './concurrency.ts';
+
+interface Ticket {
+  pid: number;
+  started: string | null;
+  nonce: string;
+  /** null means the contender is still choosing its ticket number. */
+  ticket: number | null;
+}
+
+function processStart(pid: number): string | null {
+  if (process.platform === 'win32') return null;
+  try {
+    return (
+      execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 2_000,
+      }).trim() || null
+    );
+  } catch {
+    return null;
+  }
+}
+
+const ownStart = processStart(process.pid);
+
+function ownerIsGone(owner: Ticket): boolean {
+  if (owner.pid === process.pid)
+    return owner.started !== null && ownStart !== null && owner.started !== ownStart;
+  try {
+    process.kill(owner.pid, 0);
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'ESRCH';
+  }
+  if (!owner.started) return false;
+  const currentStart = processStart(owner.pid);
+  return currentStart !== null && currentStart !== owner.started;
+}
+
+function removeOwned(path: string, nonce: string): void {
+  try {
+    const value = JSON.parse(readFileSync(path, 'utf8')) as Ticket;
+    if (value.nonce === nonce) unlinkSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+}
+
+function readTickets(directory: string): Ticket[] {
+  const tickets: Ticket[] = [];
+  for (const name of readdirSync(directory)) {
+    if (!name.endsWith('.json')) continue;
+    const path = join(directory, name);
+    let owner: Ticket;
+    try {
+      owner = JSON.parse(readFileSync(path, 'utf8')) as Ticket;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    if (
+      !Number.isSafeInteger(owner.pid) ||
+      owner.pid <= 0 ||
+      !(owner.started === null || typeof owner.started === 'string') ||
+      name !== `${owner.nonce}.json` ||
+      !(owner.ticket === null || (Number.isSafeInteger(owner.ticket) && owner.ticket > 0))
+    ) {
+      throw new Error('Invalid credential lock owner metadata');
+    }
+    if (ownerIsGone(owner)) {
+      // Each owner has a unique path. Recovering this dead owner cannot delete
+      // a replacement owner's lock, even when several processes notice it.
+      removeOwned(path, owner.nonce);
+    } else tickets.push(owner);
+  }
+  return tickets;
+}
+
+/** A cross-process mutex for one durable credential namespace. Unique ticket
+ * paths avoid stale-owner cleanup racing a new lock holder. There is no lease
+ * timeout: a live owner keeps the lock until it finishes or is cancelled. */
+export async function withCredentialLock<T>(
+  directory: string,
+  signal: AbortSignal | undefined,
+  work: () => Promise<T>,
+  pollMs = 20,
+): Promise<T> {
+  signal?.throwIfAborted();
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const nonce = randomUUID();
+  const path = join(directory, `${nonce}.json`);
+  const temporary = join(directory, `${nonce}.tmp`);
+  const owner: Ticket = { pid: process.pid, started: ownStart, nonce, ticket: null };
+  const publish = () => {
+    writeFileSync(temporary, JSON.stringify(owner), { mode: 0o600 });
+    renameSync(temporary, path);
+  };
+  let result: T | undefined;
+  let failure: { error: unknown } | undefined;
+  try {
+    publish();
+    const tickets = readTickets(directory);
+    owner.ticket = Math.max(0, ...tickets.map(({ ticket }) => ticket ?? 0)) + 1;
+    publish();
+    while (true) {
+      signal?.throwIfAborted();
+      const ahead = readTickets(directory).some(
+        (other) =>
+          other.nonce !== nonce &&
+          (other.ticket === null ||
+            other.ticket < (owner.ticket ?? 0) ||
+            (other.ticket === owner.ticket && other.nonce < nonce)),
+      );
+      if (!ahead) break;
+      await abortableDelay(pollMs, signal);
+    }
+    signal?.throwIfAborted();
+    result = await work();
+  } catch (error) {
+    failure = { error };
+  } finally {
+    try {
+      removeOwned(path, nonce);
+    } catch (error) {
+      failure ??= { error };
+    }
+    try {
+      unlinkSync(temporary);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') failure ??= { error };
+    }
+  }
+  if (failure) throw failure.error;
+  return result as T;
+}