labgate 0.5.39 → 0.5.42

package/dist/lib/slurm-cli-passthrough.js

@@ -2,9 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stageSlurmCliPassthrough = stageSlurmCliPassthrough;
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const path_1 = require("path");
+const os_1 = require("os");
 const config_js_1 = require("./config.js");
+const startup_stage_lock_js_1 = require("./startup-stage-lock.js");
 const DEFAULT_SLURM_COMMANDS = [
     'srun',
     'sbatch',
@@ -14,6 +17,12 @@ const DEFAULT_SLURM_COMMANDS = [
     'sinfo',
     'scontrol',
 ];
+const SLURM_STAGE_SCHEMA_VERSION = 3;
+const SLURM_STAGE_CURRENT_LINK = 'current';
+const SLURM_STAGE_STORE_DIR = '.stage-store';
+const SLURM_STAGE_LOCK_DIR = 'startup-stage.lock';
+const SLURM_STAGE_MANIFEST_FILE = 'manifest.json';
+const SLURM_STAGE_ROOT_IN_CONTAINER = '/home/sandbox/.labgate/slurm/current';
 const SKIP_LIB_BASENAMES = new Set([
     'linux-vdso.so.1',
     'libc.so.6',
@@ -94,6 +103,77 @@ function copyFileBestEffort(src, dst) {
         // Best effort
     }
 }
+function sha256File(path) {
+    const hash = (0, crypto_1.createHash)('sha256');
+    hash.update((0, fs_1.readFileSync)(path));
+    return hash.digest('hex');
+}
+function fingerprintPath(path, options = {}) {
+    try {
+        const st = (0, fs_1.statSync)(path);
+        if (!st.isFile())
+            return null;
+        const fingerprint = {
+            path,
+            size: st.size,
+            mtimeMs: Math.floor(st.mtimeMs),
+        };
+        if (options.hashContent) {
+            fingerprint.sha256 = sha256File(path);
+        }
+        return fingerprint;
+    }
+    catch {
+        return null;
+    }
+}
+function updateDirectoryHashRecursive(rootDir, relativeDir, hash) {
+    const dirPath = relativeDir ? (0, path_1.join)(rootDir, relativeDir) : rootDir;
+    let entryCount = 0;
+    const entries = (0, fs_1.readdirSync)(dirPath).sort((a, b) => a.localeCompare(b));
+    for (const entry of entries) {
+        const relativePath = relativeDir ? (0, path_1.join)(relativeDir, entry) : entry;
+        const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+        const absPath = (0, path_1.join)(rootDir, relativePath);
+        const st = (0, fs_1.lstatSync)(absPath);
+        if (st.isDirectory()) {
+            hash.update(`dir:${normalizedRelativePath}\n`);
+            entryCount += 1 + updateDirectoryHashRecursive(rootDir, relativePath, hash);
+            continue;
+        }
+        if (st.isSymbolicLink()) {
+            hash.update(`link:${normalizedRelativePath}\n`);
+            hash.update((0, fs_1.readlinkSync)(absPath));
+            hash.update('\n');
+            entryCount += 1;
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        hash.update(`file:${normalizedRelativePath}:${st.size}:${Math.floor(st.mtimeMs)}\n`);
+        entryCount += 1;
+    }
+    return entryCount;
+}
+function fingerprintDirectory(path) {
+    if (!path)
+        return null;
+    try {
+        const st = (0, fs_1.statSync)(path);
+        if (!st.isDirectory())
+            return null;
+        const hash = (0, crypto_1.createHash)('sha256');
+        const entryCount = updateDirectoryHashRecursive(path, '', hash);
+        return {
+            path,
+            entryCount,
+            sha256: hash.digest('hex'),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 function collectLinkedLibs(filePath, out) {
     try {
         const lddOut = (0, child_process_1.execFileSync)('ldd', [filePath], { encoding: 'utf-8' });
@@ -195,9 +275,10 @@ function buildHostProxyClientScript() {
         'import { createConnection } from "net";',
         '',
         'const [socketPath, command, ...args] = process.argv.slice(2);',
+        'const UNAVAILABLE_EXIT_CODE = 245;',
         'if (!socketPath || !command) {',
         '  console.error("[labgate] host proxy usage: <socket> <command> [args...]");',
-        '  process.exit(2);',
+        `  process.exit(UNAVAILABLE_EXIT_CODE);`,
         '}',
         '',
         'const readStdin = async () => {',
@@ -223,7 +304,7 @@ function buildHostProxyClientScript() {
         '  sock.on("data", (d) => { raw += d; });',
         '  sock.on("error", (err) => {',
         '    console.error(`[labgate] host SLURM proxy error: ${err.message}`);',
-        '    process.exit(127);',
+        `    process.exit(UNAVAILABLE_EXIT_CODE);`,
         '  });',
         '  sock.on("end", () => {',
         '    try {',
@@ -234,7 +315,7 @@ function buildHostProxyClientScript() {
         '      process.exit(code);',
         '    } catch (err) {',
         '      console.error(`[labgate] invalid proxy response: ${err?.message ?? String(err)}`);',
-        '      process.exit(1);',
+        `      process.exit(UNAVAILABLE_EXIT_CODE);`,
         '    }',
         '  });',
         '  sock.write(JSON.stringify(req));',
@@ -243,17 +324,18 @@ function buildHostProxyClientScript() {
         '',
         'main().catch((err) => {',
         '  console.error(`[labgate] host SLURM proxy failure: ${err?.message ?? String(err)}`);',
-        '  process.exit(1);',
+        `  process.exit(UNAVAILABLE_EXIT_CODE);`,
         '});',
         '',
     ].join('\n');
 }
-function buildSlurmWrapperScript(cmd, stageRootInContainer, hostProxySocketInContainer) {
+function buildSlurmWrapperScript(cmd, stageRootInContainer, hostProxySocketInContainer, options = {}) {
+    const proxyOnly = options.proxyOnly ?? false;
     const real = `${stageRootInContainer}/bin/${cmd}`;
     const lib = `${stageRootInContainer}/lib`;
     const conf = `${stageRootInContainer}/etc/slurm.conf`;
     const proxyClient = `${stageRootInContainer}/host-proxy-client.mjs`;
-    return [
+    const lines = [
         '#!/usr/bin/env bash',
         'set -euo pipefail',
         `REAL="${real}"`,
@@ -262,25 +344,102 @@ function buildSlurmWrapperScript(cmd, stageRootInContainer, hostProxySocketInCon
         `PROXY_SOCKET="${hostProxySocketInContainer || ''}"`,
         `PROXY_CLIENT="${proxyClient}"`,
         'if [ -n "$PROXY_SOCKET" ] && [ -S "$PROXY_SOCKET" ] && [ -f "$PROXY_CLIENT" ] && command -v node >/dev/null 2>&1; then',
-        `  if node "$PROXY_CLIENT" "$PROXY_SOCKET" "${cmd}" "$@"; then`,
+        '  if node "$PROXY_CLIENT" "$PROXY_SOCKET" "${cmd}" "$@"; then',
         '    exit 0',
+        '  else',
+        '    proxy_exit_code=$?',
+        '    if [ "$proxy_exit_code" -ne 245 ]; then',
+        '      exit "$proxy_exit_code"',
+        '    fi',
         '  fi',
-        '  echo "[labgate] host SLURM proxy unavailable; falling back to staged CLI." >&2',
-        'fi',
-        'if [ ! -x "$REAL" ]; then',
-        `  echo "[labgate] SLURM CLI '${cmd}' is not staged in this sandbox." >&2`,
-        '  echo "[labgate] Fix: ensure SLURM is available on the host (e.g. login node), then restart the LabGate session." >&2',
-        '  exit 127',
-        'fi',
-        'if [ -d "$LIBDIR" ]; then',
-        '  export LD_LIBRARY_PATH="$LIBDIR${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',
-        'fi',
-        'if [ -z "${SLURM_CONF:-}" ] && [ -f "$CONF" ]; then',
-        '  export SLURM_CONF="$CONF"',
-        'fi',
-        'exec "$REAL" "$@"',
-        '',
-    ].join('\n');
+    ];
+    if (proxyOnly) {
+        lines.push('fi', `echo "[labgate] host SLURM proxy unavailable for '${cmd}' in proxy-only mode." >&2`, 'echo "[labgate] Fix: ensure the LabGate host proxy is running and host SLURM commands are available, then restart the session." >&2', 'exit 127', '');
+        return lines.join('\n');
+    }
+    lines.push('  echo "[labgate] host SLURM proxy unavailable; falling back to staged CLI." >&2', 'fi', 'if [ ! -x "$REAL" ]; then', `  echo "[labgate] SLURM CLI '${cmd}' is not staged in this sandbox." >&2`, '  echo "[labgate] Fix: ensure SLURM is available on the host (e.g. login node), then restart the LabGate session." >&2', '  exit 127', 'fi', 'if [ -d "$LIBDIR" ]; then', '  export LD_LIBRARY_PATH="$LIBDIR${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"', 'fi', 'if [ -z "${SLURM_CONF:-}" ] && [ -f "$CONF" ]; then', '  export SLURM_CONF="$CONF"', 'fi', 'exec "$REAL" "$@"', '');
+    return lines.join('\n');
+}
+function removeSlurmPath(path) {
+    try {
+        (0, fs_1.rmSync)(path, { recursive: true, force: true });
+    }
+    catch {
+        // Best effort cleanup.
+    }
+}
+function cleanupSlurmWrappers(wrapperDir, keep, candidates) {
+    const keepSet = new Set(keep);
+    for (const cmd of new Set(candidates)) {
+        if (keepSet.has(cmd))
+            continue;
+        removeSlurmPath((0, path_1.join)(wrapperDir, cmd));
+    }
+}
+function readSlurmStageManifest(stageRoot) {
+    try {
+        const raw = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(stageRoot, SLURM_STAGE_MANIFEST_FILE), 'utf-8'));
+        if (!raw || typeof raw !== 'object')
+            return null;
+        if (Number(raw.schema_version) !== SLURM_STAGE_SCHEMA_VERSION)
+            return null;
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+function getSlurmStageLockPath(sandboxHome) {
+    return (0, path_1.join)(sandboxHome, '.labgate', 'locks', SLURM_STAGE_LOCK_DIR);
+}
+function computeStageFingerprint(input) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify(input)).digest('hex');
+}
+function ensureStageStoreLink(stageRoot, targetDir) {
+    const currentLink = (0, path_1.join)(stageRoot, SLURM_STAGE_CURRENT_LINK);
+    const tempLink = (0, path_1.join)(stageRoot, `.${SLURM_STAGE_CURRENT_LINK}.tmp-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+    let currentExists = false;
+    let currentIsSymlink = false;
+    try {
+        currentIsSymlink = (0, fs_1.lstatSync)(currentLink).isSymbolicLink();
+        currentExists = true;
+    }
+    catch {
+        currentExists = false;
+        currentIsSymlink = false;
+    }
+    (0, fs_1.symlinkSync)(targetDir, tempLink, 'dir');
+    if (currentExists && currentIsSymlink) {
+        try {
+            const currentTarget = (0, path_1.resolve)(stageRoot, (0, fs_1.readlinkSync)(currentLink));
+            if (currentTarget === targetDir) {
+                removeSlurmPath(tempLink);
+                return;
+            }
+        }
+        catch {
+            // Fall through to replace.
+        }
+    }
+    if (!currentExists || currentIsSymlink) {
+        (0, fs_1.renameSync)(tempLink, currentLink);
+        return;
+    }
+    const legacyDir = (0, path_1.join)(stageRoot, `.${SLURM_STAGE_CURRENT_LINK}.legacy-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+    (0, fs_1.renameSync)(currentLink, legacyDir);
+    try {
+        (0, fs_1.renameSync)(tempLink, currentLink);
+    }
+    catch (err) {
+        (0, fs_1.renameSync)(legacyDir, currentLink);
+        throw err;
+    }
+    removeSlurmPath(legacyDir);
+}
+function cleanupLegacyStageLayout(stageRoot) {
+    for (const name of ['bin', 'lib', 'etc', 'plugins', 'host-proxy-client.mjs']) {
+        removeSlurmPath((0, path_1.join)(stageRoot, name));
+    }
 }
 function tryExtractPluginDir(slurmConfText) {
     for (const raw of slurmConfText.split('\n')) {
@@ -335,33 +494,35 @@ function rewriteDaemonUsers(slurmConfText) {
  * in $HOME/.labgate-bin so they are available inside the container even when the image
  * does not ship with SLURM.
  *
- * This is intentionally simple: copy binaries + ldd libraries + slurm.conf (if found).
- * The host-side session launcher is responsible for bind-mounting /run/munge when present.
+ * When host proxy mode is preferred, this writes proxy-only wrappers without paying the
+ * binary/plugin copy cost on every startup. Otherwise it stages binaries + ldd libraries
+ * + slurm.conf (if found). The host-side session launcher is responsible for bind-mounting
+ * /run/munge when present.
  */
 function stageSlurmCliPassthrough(options) {
     const env = options.env ?? process.env;
     const commands = options.commands ?? [...DEFAULT_SLURM_COMMANDS];
     const installMissingWrappers = options.installMissingWrappers ?? true;
     const hostProxySocketInContainer = options.hostProxySocketInContainer ?? null;
+    const preferHostProxy = options.preferHostProxy ?? false;
     const stageRoot = (0, path_1.join)(options.sandboxHome, '.labgate', 'slurm');
-    const binDir = (0, path_1.join)(stageRoot, 'bin');
-    const libDir = (0, path_1.join)(stageRoot, 'lib');
-    const etcDir = (0, path_1.join)(stageRoot, 'etc');
+    const storeRoot = (0, path_1.join)(stageRoot, SLURM_STAGE_STORE_DIR);
     const wrapperDir = (0, path_1.join)(options.sandboxHome, '.labgate-bin');
-    const errors = [];
-    const staged = [];
+    const lockPath = getSlurmStageLockPath(options.sandboxHome);
     const skipped = [];
     try {
         (0, config_js_1.ensurePrivateDir)((0, path_1.join)(options.sandboxHome, '.labgate'));
+        (0, config_js_1.ensurePrivateDir)((0, path_1.join)(options.sandboxHome, '.labgate', 'locks'));
         (0, config_js_1.ensurePrivateDir)(stageRoot);
-        (0, config_js_1.ensurePrivateDir)(binDir);
-        (0, config_js_1.ensurePrivateDir)(libDir);
-        (0, config_js_1.ensurePrivateDir)(etcDir);
+        (0, config_js_1.ensurePrivateDir)(storeRoot);
         (0, config_js_1.ensurePrivateDir)(wrapperDir);
     }
     catch (err) {
         return {
             ok: false,
+            mode: 'staged',
+            reused: false,
+            hostCommands: [],
             staged: [],
             skipped: commands,
             errors: [`Failed to initialize SLURM stage directories: ${err?.message ?? String(err)}`],
@@ -369,7 +530,7 @@ function stageSlurmCliPassthrough(options) {
             stageRoot,
         };
     }
-    // 1) Resolve host command paths and copy binaries
+    // 1) Resolve host command paths.
     const hostPaths = new Map();
     for (const cmd of commands) {
         const hostPath = which(cmd, env);
@@ -378,134 +539,231 @@ function stageSlurmCliPassthrough(options) {
             continue;
         }
         hostPaths.set(cmd, hostPath);
-        const target = (0, path_1.join)(binDir, cmd);
+    }
+    const hostCommands = Array.from(hostPaths.keys());
+    const proxyOnly = !!hostProxySocketInContainer && preferHostProxy && hostCommands.length > 0;
+    const sampleCmd = hostPaths.get('squeue') ?? hostPaths.get('scontrol') ?? hostPaths.get('sbatch') ?? null;
+    const slurmConfPath = proxyOnly ? null : resolveSlurmConf(sampleCmd, env);
+    let slurmConfText = '';
+    if (slurmConfPath) {
         try {
-            (0, fs_1.copyFileSync)(hostPath, target);
-            // Strip any unexpected setuid/setgid bits from host binaries.
-            try {
-                (0, fs_1.chmodSync)(target, 0o755);
-            }
-            catch { /* ignore */ }
-            staged.push(cmd);
+            slurmConfText = (0, fs_1.readFileSync)(slurmConfPath, 'utf-8');
         }
-        catch (err) {
-            skipped.push(cmd);
-            errors.push(`Failed to stage ${cmd} from ${hostPath}: ${err?.message ?? String(err)}`);
+        catch {
+            slurmConfText = '';
         }
     }
-    // 2) Stage shared libraries for staged commands (best effort)
-    const libsToCopy = new Set();
-    for (const cmd of staged) {
+    const pluginDir = proxyOnly ? null : resolvePluginDir(sampleCmd, slurmConfText, env);
+    const slurmConfFingerprint = (proxyOnly || !slurmConfPath) ? null : fingerprintPath(slurmConfPath, { hashContent: true });
+    const pluginDirFingerprint = proxyOnly ? null : fingerprintDirectory(pluginDir);
+    const commandFingerprints = hostCommands
+        .map((cmd) => {
         const hostPath = hostPaths.get(cmd);
         if (!hostPath)
-            continue;
-        collectLinkedLibs(hostPath, libsToCopy);
-    }
-    // 3) Stage slurm.conf (best effort)
-    const sampleCmd = hostPaths.get('squeue') ?? hostPaths.get('scontrol') ?? hostPaths.get('sbatch') ?? null;
-    const slurmConfPath = resolveSlurmConf(sampleCmd, env);
-    let stagedPluginDir = null;
-    if (slurmConfPath) {
-        try {
-            const confText = (0, fs_1.readFileSync)(slurmConfPath, 'utf-8');
-            const stageRootInContainer = '/home/sandbox/.labgate/slurm';
-            const pluginDirInContainer = `${stageRootInContainer}/plugins`;
-            let rewritten = rewritePluginDir(confText, pluginDirInContainer);
-            rewritten = rewriteDaemonUsers(rewritten);
-            const pluginDir = resolvePluginDir(sampleCmd, confText, env);
-            (0, config_js_1.ensurePrivateDir)((0, path_1.join)(stageRoot, 'plugins'));
-            if (pluginDir) {
+            return null;
+        const fp = fingerprintPath(hostPath);
+        if (!fp)
+            return null;
+        return { command: cmd, ...fp };
+    })
+        .filter((entry) => !!entry);
+    const fingerprint = computeStageFingerprint({
+        schema_version: SLURM_STAGE_SCHEMA_VERSION,
+        host: (0, os_1.hostname)(),
+        mode: proxyOnly ? 'proxy-only' : 'staged',
+        requested_commands: commands,
+        host_commands: commandFingerprints,
+        slurm_conf: slurmConfFingerprint,
+        plugin_dir: pluginDirFingerprint,
+        host_proxy_socket: hostProxySocketInContainer,
+    });
+    try {
+        return (0, startup_stage_lock_js_1.withStartupStageLock)(lockPath, 'slurm-stage', () => {
+            (0, config_js_1.ensurePrivateDir)(stageRoot);
+            (0, config_js_1.ensurePrivateDir)(storeRoot);
+            (0, config_js_1.ensurePrivateDir)(wrapperDir);
+            cleanupLegacyStageLayout(stageRoot);
+            const stageMode = proxyOnly ? 'proxy-only' : 'staged';
+            const storeId = fingerprint;
+            const storeDir = (0, path_1.join)(storeRoot, storeId);
+            const existingManifest = readSlurmStageManifest(stageRoot);
+            let reused = false;
+            let staged = [];
+            let errors = [];
+            let libCount = 0;
+            const reuseExistingStore = (existingManifest &&
+                existingManifest.fingerprint === fingerprint &&
+                existingManifest.mode === stageMode &&
+                existingManifest.store_id === storeId &&
+                (0, fs_1.existsSync)(storeDir));
+            if (!reuseExistingStore && !(0, fs_1.existsSync)(storeDir)) {
+                const tempStoreDir = (0, path_1.join)(storeRoot, `.tmp-${storeId}-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+                removeSlurmPath(tempStoreDir);
+                (0, fs_1.mkdirSync)(tempStoreDir, { recursive: true, mode: 0o700 });
                 try {
-                    // Copy plugin directory tree into the sandbox; many clusters set PluginDir in slurm.conf.
-                    const stagedPluginRoot = (0, path_1.join)(stageRoot, 'plugins');
-                    (0, fs_1.cpSync)(pluginDir, stagedPluginRoot, { recursive: true, force: true });
-                    stagedPluginDir = pluginDir;
-                    // Also stage transitive shared libs required by plugins (e.g. libmunge).
-                    for (const so of listSharedObjects(stagedPluginRoot)) {
-                        collectLinkedLibs(so, libsToCopy);
+                    if (!proxyOnly) {
+                        const binDir = (0, path_1.join)(tempStoreDir, 'bin');
+                        const libDir = (0, path_1.join)(tempStoreDir, 'lib');
+                        const etcDir = (0, path_1.join)(tempStoreDir, 'etc');
+                        (0, fs_1.mkdirSync)(binDir, { recursive: true, mode: 0o700 });
+                        (0, fs_1.mkdirSync)(libDir, { recursive: true, mode: 0o700 });
+                        (0, fs_1.mkdirSync)(etcDir, { recursive: true, mode: 0o700 });
+                        for (const [cmd, hostPath] of hostPaths) {
+                            const target = (0, path_1.join)(binDir, cmd);
+                            try {
+                                (0, fs_1.copyFileSync)(hostPath, target);
+                                try {
+                                    (0, fs_1.chmodSync)(target, 0o755);
+                                }
+                                catch { /* ignore */ }
+                                staged.push(cmd);
+                            }
+                            catch (err) {
+                                skipped.push(cmd);
+                                errors.push(`Failed to stage ${cmd} from ${hostPath}: ${err?.message ?? String(err)}`);
+                            }
+                        }
+                        const libsToCopy = new Set();
+                        for (const cmd of staged) {
+                            const hostPath = hostPaths.get(cmd);
+                            if (!hostPath)
+                                continue;
+                            collectLinkedLibs(hostPath, libsToCopy);
+                        }
+                        if (slurmConfPath) {
+                            try {
+                                const pluginDirInContainer = `${SLURM_STAGE_ROOT_IN_CONTAINER}/plugins`;
+                                let rewritten = rewritePluginDir(slurmConfText, pluginDirInContainer);
+                                rewritten = rewriteDaemonUsers(rewritten);
+                                const stagedPluginRoot = (0, path_1.join)(tempStoreDir, 'plugins');
+                                (0, fs_1.mkdirSync)(stagedPluginRoot, { recursive: true, mode: 0o700 });
+                                if (pluginDir) {
+                                    try {
+                                        (0, fs_1.cpSync)(pluginDir, stagedPluginRoot, { recursive: true, force: true });
+                                        for (const so of listSharedObjects(stagedPluginRoot)) {
+                                            collectLinkedLibs(so, libsToCopy);
+                                        }
+                                    }
+                                    catch (err) {
+                                        errors.push(`Failed to stage SLURM plugins from ${pluginDir}: ${err?.message ?? String(err)}`);
+                                    }
+                                }
+                                else {
+                                    errors.push('Could not detect a host SLURM plugin directory to stage. ' +
+                                        'In-container SLURM commands may fail if plugins are required.');
+                                }
+                                (0, startup_stage_lock_js_1.writeTextFileAtomic)((0, path_1.join)(etcDir, 'slurm.conf'), `${rewritten.replace(/\n?$/, '\n')}`, { mode: 0o644 });
+                            }
+                            catch (err) {
+                                errors.push(`Failed to stage slurm.conf from ${slurmConfPath}: ${err?.message ?? String(err)}`);
+                            }
+                        }
+                        for (const lib of libsToCopy) {
+                            const target = (0, path_1.join)(libDir, (0, path_1.basename)(lib));
+                            if ((0, fs_1.existsSync)(target))
+                                continue;
+                            copyFileBestEffort(lib, target);
+                        }
+                        libCount = libsToCopy.size;
+                    }
+                    if (hostProxySocketInContainer) {
+                        try {
+                            (0, startup_stage_lock_js_1.writeTextFileAtomic)((0, path_1.join)(tempStoreDir, 'host-proxy-client.mjs'), `${buildHostProxyClientScript()}\n`, { mode: 0o755 });
+                        }
+                        catch (err) {
+                            errors.push(`Failed to write host SLURM proxy client: ${err?.message ?? String(err)}`);
+                        }
                     }
+                    (0, fs_1.renameSync)(tempStoreDir, storeDir);
                 }
                 catch (err) {
-                    errors.push(`Failed to stage SLURM plugins from ${pluginDir}: ${err?.message ?? String(err)}`);
+                    removeSlurmPath(tempStoreDir);
+                    throw err;
                 }
             }
             else {
-                errors.push('Could not detect a host SLURM plugin directory to stage. ' +
-                    'In-container SLURM commands may fail if plugins are required.');
+                reused = true;
             }
-            // Ensure staged slurm.conf always points to the in-container plugin path.
-            try {
-                if (!(0, fs_1.existsSync)((0, path_1.join)(stageRoot, 'plugins'))) {
-                    (0, config_js_1.ensurePrivateDir)((0, path_1.join)(stageRoot, 'plugins'));
+            if (reused && existingManifest) {
+                staged = [...existingManifest.commands];
+                errors = [...existingManifest.errors];
+                libCount = existingManifest.lib_count;
+            }
+            else if (reused) {
+                staged = proxyOnly ? [] : [...hostCommands];
+            }
+            const effectiveSkipped = reused && existingManifest
+                ? [...new Set([...skipped, ...existingManifest.skipped])]
+                : [...new Set(skipped)];
+            ensureStageStoreLink(stageRoot, storeDir);
+            const wrapperCommands = proxyOnly
+                ? hostCommands
+                : (installMissingWrappers ? commands : staged);
+            cleanupSlurmWrappers(wrapperDir, wrapperCommands, [...DEFAULT_SLURM_COMMANDS, ...commands]);
+            for (const cmd of wrapperCommands) {
+                const wrapperPath = (0, path_1.join)(wrapperDir, cmd);
+                try {
+                    const script = buildSlurmWrapperScript(cmd, SLURM_STAGE_ROOT_IN_CONTAINER, hostProxySocketInContainer, { proxyOnly });
+                    (0, startup_stage_lock_js_1.writeTextFileAtomic)(wrapperPath, `${script.replace(/\n?$/, '\n')}`, { mode: 0o755 });
+                }
+                catch (err) {
+                    errors.push(`Failed to write wrapper for ${cmd}: ${err?.message ?? String(err)}`);
                 }
             }
-            catch { /* ignore */ }
-            if (!stagedPluginDir && !pluginDir) {
-                rewritten = rewritePluginDir(confText, pluginDirInContainer);
-                rewritten = rewriteDaemonUsers(rewritten);
+            const manifest = {
+                schema_version: SLURM_STAGE_SCHEMA_VERSION,
+                fingerprint,
+                mode: stageMode,
+                host: (0, os_1.hostname)(),
+                requested_commands: [...commands],
+                host_commands: [...hostCommands],
+                commands: [...staged],
+                skipped: effectiveSkipped,
+                errors: [...errors],
+                slurm_conf: slurmConfFingerprint,
+                plugin_dir: pluginDirFingerprint,
+                host_proxy_socket: hostProxySocketInContainer,
+                lib_count: libCount,
+                store_id: storeId,
+                stage_root_in_container: SLURM_STAGE_ROOT_IN_CONTAINER,
+                staged_at: new Date().toISOString(),
+                notes: proxyOnly
+                    ? 'Host SLURM CLI routed exclusively through the LabGate host proxy.'
+                    : reused
+                        ? 'Host SLURM CLI stage reused from cached manifest and fingerprint.'
+                        : 'Host SLURM CLI staged by LabGate for in-container use.',
+            };
+            try {
+                (0, startup_stage_lock_js_1.writeTextFileAtomic)((0, path_1.join)(stageRoot, SLURM_STAGE_MANIFEST_FILE), JSON.stringify(manifest, null, 2) + '\n', { mode: 0o644 });
             }
-            (0, fs_1.writeFileSync)((0, path_1.join)(etcDir, 'slurm.conf'), rewritten, { encoding: 'utf-8', mode: 0o644 });
-        }
-        catch (err) {
-            errors.push(`Failed to stage slurm.conf from ${slurmConfPath}: ${err?.message ?? String(err)}`);
-        }
-    }
-    // Copy all collected shared libraries (command + plugin deps).
-    for (const lib of libsToCopy) {
-        const target = (0, path_1.join)(libDir, (0, path_1.basename)(lib));
-        if ((0, fs_1.existsSync)(target))
-            continue;
-        copyFileBestEffort(lib, target);
-    }
-    // 4) Install wrappers.
-    // Legacy default is to install for all requested commands; optional mode
-    // installs wrappers only for successfully staged commands.
-    const stageRootInContainer = '/home/sandbox/.labgate/slurm';
-    if (hostProxySocketInContainer) {
-        try {
-            (0, fs_1.writeFileSync)((0, path_1.join)(stageRoot, 'host-proxy-client.mjs'), buildHostProxyClientScript(), {
-                encoding: 'utf-8',
-                mode: 0o755,
-            });
-        }
-        catch (err) {
-            errors.push(`Failed to write host SLURM proxy client: ${err?.message ?? String(err)}`);
-        }
-    }
-    const wrapperCommands = installMissingWrappers ? commands : staged;
-    for (const cmd of wrapperCommands) {
-        const wrapperPath = (0, path_1.join)(wrapperDir, cmd);
-        try {
-            const script = buildSlurmWrapperScript(cmd, stageRootInContainer, hostProxySocketInContainer);
-            (0, fs_1.writeFileSync)(wrapperPath, script, { encoding: 'utf-8', mode: 0o755 });
-        }
-        catch (err) {
-            errors.push(`Failed to write wrapper for ${cmd}: ${err?.message ?? String(err)}`);
-        }
+            catch {
+                // Best effort only.
+            }
+            return {
+                ok: proxyOnly ? hostCommands.length > 0 : staged.length > 0,
+                mode: stageMode,
+                reused,
+                hostCommands,
+                staged,
+                skipped: effectiveSkipped,
+                errors,
+                slurmConfPath: slurmConfFingerprint?.path ?? null,
+                stageRoot,
+            };
+        });
     }
-    // 5) Write a small manifest for debugging
-    try {
-        const manifest = {
-            staged_at: new Date().toISOString(),
-            commands: staged,
-            slurm_conf: slurmConfPath,
-            plugin_dir: stagedPluginDir,
-            host_proxy_socket: hostProxySocketInContainer,
-            lib_count: libsToCopy.size,
-            notes: 'Host SLURM CLI staged by LabGate for in-container use.',
+    catch (err) {
+        return {
+            ok: false,
+            mode: proxyOnly ? 'proxy-only' : 'staged',
+            reused: false,
+            hostCommands,
+            staged: [],
+            skipped: [...new Set(skipped)],
+            errors: [`SLURM passthrough staging failed: ${err?.message ?? String(err)}`],
+            slurmConfPath: slurmConfFingerprint?.path ?? null,
+            stageRoot,
         };
-        (0, fs_1.writeFileSync)((0, path_1.join)(stageRoot, 'manifest.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
     }
-    catch {
-        // ignore
-    }
-    return {
-        ok: staged.length > 0,
-        staged,
-        skipped,
-        errors,
-        slurmConfPath,
-        stageRoot,
-    };
 }
 //# sourceMappingURL=slurm-cli-passthrough.js.map