looply-cli 0.0.0-stage → 0.3.0

package/dist/workspace-quarantine.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.quarantineDir = quarantineDir;
+exports.quarantine = quarantine;
+exports.quarantineOf = quarantineOf;
+exports.listQuarantined = listQuarantined;
+exports.clearQuarantine = clearQuarantine;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const git_driver_1 = require("./git-driver");
+/**
+ * ⚠️ THE DOORWAY, IN THE MANNER `RunRegistry.list` APPLIES TO A RECORD'S PATHS.
+ *
+ * A quarantine is filed under a name derived from the workspace directory, and
+ * that name becomes a filename. A workspace called `../../queue` would make this
+ * a write primitive pointed at the project's own state — which is exactly the
+ * hole Phase 1 closed for run records, measured end to end. So the name is
+ * validated where it enters, and anything that is not a plain segment is
+ * refused rather than sanitised: a name looply had to alter is a name it cannot
+ * later match against the directory it came from.
+ */
+const SAFE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+function quarantineDir(cwd) {
+    return (0, node_path_1.join)((0, git_driver_1.projectStateDir)(cwd), 'quarantine');
+}
+/**
+ * 🔴 AN UNSAFE NAME IS THE CASE THAT MOST NEEDS QUARANTINING, AND IT WAS THE
+ * ONE CASE THAT COULD NOT BE.
+ *
+ * `fileFor` answered null when the basename failed `SAFE`, and both
+ * `quarantine()` and `quarantineOf()` returned null on that — so a checkout
+ * whose name looply distrusts could not be marked, and then read back as NOT
+ * quarantined. Fails open, in the direction of touching a directory nobody
+ * vouched for. MEASURED: a workspace named `..bad name` answered null from
+ * both.
+ *
+ * ⚠️ THE NAME IS STILL NOT SANITISED — it is HASHED. The original rule was
+ * right that a name looply had to alter is a name it cannot match back to its
+ * directory; a hash of the resolved path has no such problem, because the path
+ * is what the record already carries. A safe name keeps its readable filename
+ * so a person can still find the file by eye.
+ */
+function fileFor(cwd, workspace) {
+    const full = (0, node_path_1.resolve)(workspace);
+    const name = (0, node_path_1.basename)(full);
+    const key = SAFE.test(name)
+        ? name
+        : `unsafe-${(0, node_crypto_1.createHash)('sha256').update(full.toLowerCase(), 'utf8').digest('hex').slice(0, 16)}`;
+    return (0, node_path_1.join)(quarantineDir(cwd), `${key}.json`);
+}
+/**
+ * Record that looply must not touch this checkout.
+ *
+ * ⚠️ THE FIRST DECISION STANDS. A later refusal for a different reason does not
+ * overwrite the first: the reason a person needs is the one that started it,
+ * and a record that kept changing would make the history unreadable at exactly
+ * the moment somebody is trying to understand what happened.
+ */
+function quarantine(cwd, workspace, because, noticedBy, now = () => Date.now()) {
+    const path = fileFor(cwd, workspace);
+    const already = quarantineOf(cwd, workspace);
+    if (already !== null)
+        return already;
+    const record = {
+        workspace: (0, node_path_1.resolve)(workspace),
+        because,
+        noticedBy,
+        at: new Date(now()).toISOString(),
+    };
+    try {
+        (0, node_fs_1.mkdirSync)(quarantineDir(cwd), { recursive: true });
+        // Written whole, not appended: there is exactly one of these per workspace
+        // and the first one wins, so there is no concurrent-append problem to have.
+        (0, node_fs_1.writeFileSync)(path, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+    }
+    catch {
+        /**
+         * ⚠️ A QUARANTINE THAT COULD NOT BE WRITTEN IS NOT A REASON TO PROCEED —
+         * but it is also not this function's decision. The caller refuses on the
+         * condition that prompted the quarantine, not on whether the note was
+         * filed, so a read-only project state directory costs a person the record
+         * and never costs them their files.
+         */
+        return null;
+    }
+    return record;
+}
+/** The quarantine on this workspace, or null. Unreadable counts as quarantined. */
+function quarantineOf(cwd, workspace) {
+    const path = fileFor(cwd, workspace);
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+        if (typeof parsed.because !== 'string' || typeof parsed.workspace !== 'string') {
+            return unreadable(path, workspace);
+        }
+        return parsed;
+    }
+    catch {
+        return unreadable(path, workspace);
+    }
+}
+/**
+ * 🔴 FAILS CLOSED. A quarantine file that will not parse is still a file
+ * somebody's machine wrote to say "do not touch this", and reading it as
+ * "nothing is wrong" would let the reaper remove the very checkout it was
+ * written to protect. Deny is the direction every rail in this codebase
+ * defaults to.
+ */
+function unreadable(path, workspace) {
+    return {
+        workspace: (0, node_path_1.resolve)(workspace),
+        because: `a quarantine record exists at ${path} and could not be read, so this is treated as quarantined`,
+        noticedBy: 'quarantine-read',
+        at: '',
+    };
+}
+/** Every quarantined workspace this project knows about. */
+function listQuarantined(cwd) {
+    let names;
+    try {
+        names = (0, node_fs_1.readdirSync)(quarantineDir(cwd)).filter((n) => n.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        const q = quarantineOf(cwd, (0, node_path_1.join)(quarantineDir(cwd), name.replace(/\.json$/, '')));
+        if (q !== null)
+            out.push(q);
+    }
+    return out.sort((a, b) => (a.workspace < b.workspace ? -1 : 1));
+}
+/**
+ * A person says the checkout is theirs to deal with now.
+ *
+ * ⚠️ THE ONLY THING THAT CLEARS ONE, and it removes the RECORD, never the
+ * directory. Whatever made looply refuse is still there; what changed is that
+ * a person has looked at it.
+ */
+function clearQuarantine(cwd, workspace) {
+    const path = fileFor(cwd, workspace);
+    if (path === null)
+        return false;
+    try {
+        (0, node_fs_1.unlinkSync)(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=workspace-quarantine.js.map

package/dist/workspace-quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-quarantine.js","sourceRoot":"","sources":["../src/workspace-quarantine.ts"],"names":[],"mappings":";;AA4DA,sCAEC;AAoCD,gCAiCC;AAGD,oCAYC;AAmBD,0CAaC;AASD,0CASC;AApMD,6CAAyC;AACzC,qCAAsG;AACtG,yCAAoD;AACpD,6CAA+C;AA4C/C;;;;;;;;;;GAUG;AACH,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAElD,SAAgB,aAAa,CAAC,GAAW;IACvC,OAAO,IAAA,gBAAI,EAAC,IAAA,4BAAe,EAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,OAAO,CAAC,GAAW,EAAE,SAAiB;IAC7C,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACnG,OAAO,IAAA,gBAAI,EAAC,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,UAAU,CACxB,GAAW,EACX,SAAiB,EACjB,OAAe,EACf,SAAiB,EACjB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,MAAM,GAAe;QACzB,SAAS,EAAE,IAAA,mBAAO,EAAC,SAAS,CAAC;QAC7B,OAAO;QACP,SAAS;QACT,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP;;;;;;WAMG;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,SAAgB,YAAY,CAAC,GAAW,EAAE,SAAiB;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;QAC7E,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC/E,OAAO,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,SAAiB;IACjD,OAAO;QACL,SAAS,EAAE,IAAA,mBAAO,EAAC,SAAS,CAAC;QAC7B,OAAO,EAAE,iCAAiC,IAAI,2DAA2D;QACzG,SAAS,EAAE,iBAAiB;QAC5B,EAAE,EAAE,EAAE;KACP,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,SAAgB,eAAe,CAAC,GAAW;IACzC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,IAAA,gBAAI,EAAC,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,SAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,IAAA,oBAAU,EAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/workspace-residue-sweep.d.ts

@@ -0,0 +1,113 @@
+import { type ReleaseOutcome } from './shared-grants';
+/**
+ * WHAT AN EXECUTION LEAVES OUTSIDE ITS OWN CHECKOUT, AND WHO CLEARS IT.
+ *
+ * 🔴 A REAP REMOVED THE CHECKOUT AND NOTHING ELSE, AND ONE OF THE THINGS IT
+ * LEFT BEHIND HOLDS A COPY OF THE PROVIDER CREDENTIAL.
+ *
+ * Phase 1 gave every execution its own workspace, and three identity functions
+ * follow the workspace path rather than the project:
+ *
+ *   `providerSessionDir(cwd, role)`  ~/.looply/provider-sessions/<role>-<hex>
+ *   `containedRoot(kind, cwd)`       %TEMP%/looply-contained/<kind>-<hex>
+ *   `containerName(kind, cwd)`       an AppContainer profile — an OS object
+ *
+ * That is right: two executions must not share provider state or a container.
+ * What was missing is the other end. `reapWorkspace` removes the checkout, the
+ * registry record and the slot; it has never removed any of these three. So
+ * every workspace a person ever cut leaves a permanent directory named for a
+ * checkout that no longer exists — and the provider session directory is the
+ * transport's HOME, which is where the provider writes its credential.
+ *
+ * ⚠️ THIS IS CREDENTIAL DESTRUCTION, NOT TIDYING, and it is written that way.
+ * It runs only after `reapVerdict` has agreed the holder is dead and the
+ * checkout is not busy, so no live transport can be using the directory; it
+ * names the exact paths it removed so a person can see what went; and a failure
+ * is never the reap's verdict, because a directory that would not delete is a
+ * smaller problem than a workspace that cannot be retired.
+ *
+ * ⚠️ THE APPCONTAINER PROFILE IS DELIBERATELY NOT TOUCHED. Its only removal
+ * path is `AppContainerBackend.remove()`, which is documented as test-only, is
+ * async, and goes through a PowerShell round trip with a 60-second ceiling.
+ * Making a reap depend on that is a worse trade than leaving the profile, and
+ * ACL saturation is already recorded as the capacity phase's first problem.
+ */
+export interface SweepResult {
+    readonly removed: readonly string[];
+    readonly kept: readonly {
+        path: string;
+        because: string;
+    }[];
+    /** Shared-path grants given back, and the ones that must be retried. */
+    readonly grantsReleased?: readonly {
+        path: string;
+        sid: string;
+    }[];
+    readonly grantsPending?: readonly {
+        path: string;
+        sid: string;
+        because: string;
+    }[];
+}
+/**
+ * Whether this workspace's container identities may be retired at all.
+ *
+ * 🔴 UNKNOWN IS NOT DEAD. The registry classifies a record `active`, `unknown`
+ * or gone, and `unknown` means the probe could not answer — a machine under
+ * load, a pid it may not query. Treating that as "nobody is using it" is how a
+ * cleanup revokes access from a live execution, so it counts as IN USE here and
+ * the grants stay. A grant kept too long costs a DACL entry; a grant removed too
+ * early breaks a running gate.
+ *
+ * ⚠️ AND THE PARENT'S RECORD IS NOT THE WHOLE ANSWER. A run can exit while a
+ * contained child it spawned is still running, so this asks the registry about
+ * the WORKSPACE rather than about one runId — any live record naming this
+ * workspace keeps its identities.
+ */
+export type Liveness = 'retirable' | 'in-use' | 'unknown';
+export interface RetirementDeps {
+    home?: string;
+    /**
+     * Records that still name this workspace, from the durable registry. An
+     * EMPTY array means "asked and nobody does"; `null` means "could not ask",
+     * which is the unknown case and is never treated as empty.
+     */
+    usersOf?: (workspace: string) => readonly string[] | null;
+    release?: (names: readonly string[], home: string) => ReleaseOutcome;
+}
+/**
+ * The residue paths as THUNKS, so naming one cannot lose the others.
+ *
+ * ⚠️ NAMING IS NOT FREE HERE: `providerSessionDir` and `containedRoot` both
+ * `mkdirSync` as a side effect of being called. That is why an eager array was
+ * a hazard rather than a convenience.
+ */
+export declare function residueNames(workspace: string, home?: string): (() => string)[];
+/** Every machine-level directory keyed to one workspace path. */
+export declare function residueOf(workspace: string, home?: string): string[];
+/**
+ * Remove what an execution left outside its checkout.
+ *
+ * Best effort by construction: every failure is reported and none is thrown.
+ */
+/**
+ * Give back the shared-path grants this workspace's identities hold.
+ *
+ * 🔴 THE INTERLOCK IS HERE, BEFORE ANY ACL WORK. Liveness is asked once, from
+ * the durable registry, and anything other than a definite "nobody" leaves every
+ * grant in place. The ACL write itself then happens under the shared-grant lock,
+ * which is the SAME lock a launch takes to add one — locking only the cleanup
+ * would leave the add/remove race open on every launch.
+ *
+ * ⚠️ A NEW CLAIM CANNOT ARRIVE BEHIND THIS. Workspace paths are minted per run
+ * (`ws-<stamp>-<rand>`), and by the time a sweep runs the checkout is gone and
+ * the registry record released, so the identity derived from that path can never
+ * be claimed again. This is the existing lifecycle doing the fencing, not a
+ * second mechanism.
+ */
+export declare function retireWorkspaceGrants(workspace: string, deps?: RetirementDeps): {
+    liveness: Liveness;
+    outcome: ReleaseOutcome;
+};
+export declare function sweepWorkspaceResidue(workspace: string, home?: string, deps?: RetirementDeps): SweepResult;
+//# sourceMappingURL=workspace-residue-sweep.d.ts.map

package/dist/workspace-residue-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-residue-sweep.d.ts","sourceRoot":"","sources":["../src/workspace-residue-sweep.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,cAAc,CAAC;CACtE;AAID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,CAAC,MAAM,MAAM,CAAC,EAAE,CAM1F;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,EAAE,CAY/E;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAYjD;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAAkB,EACxB,IAAI,GAAE,cAAmB,GACxB,WAAW,CAgFb"}

package/dist/workspace-residue-sweep.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.residueNames = residueNames;
+exports.residueOf = residueOf;
+exports.retireWorkspaceGrants = retireWorkspaceGrants;
+exports.sweepWorkspaceResidue = sweepWorkspaceResidue;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const exec_domains_1 = require("./exec-domains");
+const model_transport_1 = require("./model-transport");
+const tool_bridge_1 = require("./tool-bridge");
+const untrusted_exec_1 = require("./untrusted-exec");
+const shared_grants_1 = require("./shared-grants");
+const KINDS = ['gate', 'agent', 'fixture'];
+/**
+ * The residue paths as THUNKS, so naming one cannot lose the others.
+ *
+ * ⚠️ NAMING IS NOT FREE HERE: `providerSessionDir` and `containedRoot` both
+ * `mkdirSync` as a side effect of being called. That is why an eager array was
+ * a hazard rather than a convenience.
+ */
+function residueNames(workspace, home = (0, node_os_1.homedir)()) {
+    const roles = Object.keys(tool_bridge_1.TOOL_POLICIES);
+    return [
+        ...roles.map((role) => () => (0, model_transport_1.providerSessionDir)(workspace, role, home)),
+        ...KINDS.map((kind) => () => (0, exec_domains_1.containedRoot)(kind, workspace)),
+    ];
+}
+/** Every machine-level directory keyed to one workspace path. */
+function residueOf(workspace, home = (0, node_os_1.homedir)()) {
+    const roles = Object.keys(tool_bridge_1.TOOL_POLICIES);
+    return [
+        /**
+         * ⚠️ THESE FUNCTIONS CREATE THE DIRECTORY AS A SIDE EFFECT of naming it.
+         * Calling them to compute a path to DELETE therefore makes the path first —
+         * harmless (an empty directory removed immediately) and worth knowing,
+         * because it means this never reports "nothing was there".
+         */
+        ...roles.map((role) => (0, model_transport_1.providerSessionDir)(workspace, role, home)),
+        ...KINDS.map((kind) => (0, exec_domains_1.containedRoot)(kind, workspace)),
+    ];
+}
+/**
+ * Remove what an execution left outside its checkout.
+ *
+ * Best effort by construction: every failure is reported and none is thrown.
+ */
+/**
+ * Give back the shared-path grants this workspace's identities hold.
+ *
+ * 🔴 THE INTERLOCK IS HERE, BEFORE ANY ACL WORK. Liveness is asked once, from
+ * the durable registry, and anything other than a definite "nobody" leaves every
+ * grant in place. The ACL write itself then happens under the shared-grant lock,
+ * which is the SAME lock a launch takes to add one — locking only the cleanup
+ * would leave the add/remove race open on every launch.
+ *
+ * ⚠️ A NEW CLAIM CANNOT ARRIVE BEHIND THIS. Workspace paths are minted per run
+ * (`ws-<stamp>-<rand>`), and by the time a sweep runs the checkout is gone and
+ * the registry record released, so the identity derived from that path can never
+ * be claimed again. This is the existing lifecycle doing the fencing, not a
+ * second mechanism.
+ */
+function retireWorkspaceGrants(workspace, deps = {}) {
+    const home = deps.home ?? (0, node_os_1.homedir)();
+    const users = deps.usersOf === undefined ? [] : deps.usersOf(workspace);
+    if (users === null) {
+        return { liveness: 'unknown', outcome: { released: [], pending: [] } };
+    }
+    if (users.length > 0) {
+        return { liveness: 'in-use', outcome: { released: [], pending: [] } };
+    }
+    const names = KINDS.map((kind) => (0, untrusted_exec_1.containerName)(kind, workspace));
+    const release = deps.release ?? ((n, h) => (0, shared_grants_1.releaseSharedGrants)(n, { home: h }));
+    return { liveness: 'retirable', outcome: release(names, home) };
+}
+function sweepWorkspaceResidue(workspace, home = (0, node_os_1.homedir)(), deps = {}) {
+    const removed = [];
+    const kept = [];
+    /**
+     * GRANTS FIRST, DIRECTORIES SECOND. A profile deleted before its ACEs are
+     * purged strands entries whose SID no longer resolves to a name, and they
+     * still count against the DACL cap. The numeric SID in the ledger is what
+     * makes the purge work either way, but the order costs nothing and keeps the
+     * readable case readable.
+     */
+    const grants = retireWorkspaceGrants(workspace, { ...deps, home });
+    /**
+     * 🔴 `residueOf` IS INSIDE THE TRY, AND IT WAS THE for-of SUBJECT.
+     *
+     * It looks like a pure name computation and is not: `providerSessionDir` and
+     * `containedRoot` both `mkdirSync` as a side effect of being called, fifteen
+     * directories in all, under `$HOME` and `%TEMP%`. Any one of them throwing —
+     * ENOSPC, EACCES on a locked-down profile, EPERM from a scanner, ENOTDIR from
+     * a stale file where a directory should be — threw straight out of this
+     * function, past the try that was meant to make it best-effort, and out of
+     * the `--reap` loop.
+     *
+     * MEASURED: with one plain file planted at `%TEMP%/looply-contained`,
+     * `looply runs --reap` destroyed the FIRST orphan's checkout, record and slot,
+     * then exited 1 with a bare `ENOTDIR` and never printed a word about what it
+     * had already done — and never touched the second orphan, or any orphan,
+     * again. No attacker needed; `%TEMP%` being world-writable is the same fact
+     * this phase cites as the reason `noHooksDir` had to change.
+     */
+    /**
+     * 🔴 ONE NAME AT A TIME, BECAUSE THE ARRAY WAS BUILT EAGERLY AND ONE THROW
+     * DISCARDED EVERY PATH ALREADY IN IT.
+     *
+     * The previous repair put `residueOf(...)` inside a try, which stopped the
+     * uncaught throw — and traded a loud abort for a silent leak. `residueOf`
+     * builds `[...roles.map(providerSessionDir), ...KINDS.map(containedRoot)]`,
+     * so the FIRST `containedRoot` failure threw out of the whole call and the
+     * three provider-session paths named a moment earlier were never swept.
+     *
+     * MEASURED: one plain file at world-writable `%TEMP%/looply-contained` made
+     * `--reap` report `retired`, exit 0, and leave 3 of 3 provider credentials on
+     * disk — quieter than the crash it replaced, and therefore worse, because
+     * nobody ever learns the sweep has stopped working.
+     *
+     * Each name is now computed and removed on its own. A directory this cannot
+     * even name is reported as kept, exactly like one it cannot remove.
+     */
+    for (const name of residueNames(workspace, home)) {
+        let path;
+        try {
+            path = name();
+        }
+        catch (e) {
+            kept.push({ path: '(a residue path that could not be named)', because: e.message });
+            continue;
+        }
+        try {
+            (0, node_fs_1.rmSync)(path, { recursive: true, force: true });
+            removed.push(path);
+        }
+        catch (e) {
+            kept.push({ path, because: e.message });
+        }
+    }
+    return {
+        removed,
+        kept,
+        grantsReleased: grants.outcome.released,
+        // A pending row is the truthful cleanup-pending state: the ledger still says
+        // `granted`, so the next sweep finds it and tries again. Nothing here ever
+        // reports cleanup it did not do.
+        grantsPending: grants.liveness === 'retirable'
+            ? grants.outcome.pending
+            : [
+                {
+                    path: '(shared grants)',
+                    sid: '(all)',
+                    because: `deferred: this workspace's identities are ${grants.liveness}`,
+                },
+            ],
+    };
+}
+//# sourceMappingURL=workspace-residue-sweep.js.map

package/dist/workspace-residue-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-residue-sweep.js","sourceRoot":"","sources":["../src/workspace-residue-sweep.ts"],"names":[],"mappings":";;AAsFA,oCAMC;AAGD,8BAYC;AAsBD,sDAeC;AAED,sDAoFC;AAtOD,qCAAiC;AACjC,qCAAkC;AAClC,iDAA+C;AAC/C,uDAAuD;AACvD,+CAA6D;AAC7D,qDAAqE;AACrE,mDAA2E;AAuE3E,MAAM,KAAK,GAA6B,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,SAAiB,EAAE,OAAe,IAAA,iBAAO,GAAE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,2BAAa,CAAe,CAAC;IACvD,OAAO;QACL,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAA,oCAAkB,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAA,4BAAa,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,SAAS,CAAC,SAAiB,EAAE,OAAe,IAAA,iBAAO,GAAE;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,2BAAa,CAAe,CAAC;IACvD,OAAO;QACL;;;;;WAKG;QACH,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAkB,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,4BAAa,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;GAcG;AACH,SAAgB,qBAAqB,CACnC,SAAiB,EACjB,OAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,8BAAa,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,mCAAmB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAgB,qBAAqB,CACnC,SAAiB,EACjB,OAAe,IAAA,iBAAO,GAAE,EACxB,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE;;;;;;;;;;;;;;;;;OAiBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0CAA0C,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/F,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO;QACP,IAAI;QACJ,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACvC,6EAA6E;QAC7E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EACX,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;YACxB,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,iBAAiB;oBACvB,GAAG,EAAE,OAAO;oBACZ,OAAO,EAAE,6CAA6C,MAAM,CAAC,QAAQ,EAAE;iBACxE;aACF;KACR,CAAC;AACJ,CAAC"}