opencode-swarm 7.164.0 → 7.164.2

package/dist/cli/index-mmngnxev.js

@@ -1,883 +0,0 @@
-// @bun
-import {
-  PrReviewRunIdSchema
-} from "./index-w7ekntej.js";
-import {
-  validateSwarmPath
-} from "./index-dtn0pne5.js";
-import {
-  require_proper_lockfile
-} from "./index-7g4c7s5r.js";
-import {
-  exports_external,
-  init_zod
-} from "./index-bpmtbmy9.js";
-import {
-  __toESM
-} from "./index-a76rekgs.js";
-
-// src/pr-review/authorization.ts
-init_zod();
-var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { randomUUID as randomUUID2 } from "crypto";
-import * as fsp2 from "fs/promises";
-import * as path2 from "path";
-
-// src/pr-review/persistence.ts
-import { createHash, randomUUID } from "crypto";
-import * as fsp from "fs/promises";
-import * as path from "path";
-function normalizeSessionID(sessionID) {
-  const normalized = sessionID.trim();
-  if (!normalized) {
-    throw new Error("BLOCKED: PR workflow gate requires a non-empty sessionID");
-  }
-  return normalized;
-}
-function prWorkflowSessionFileStem(sessionID) {
-  const normalized = normalizeSessionID(sessionID);
-  const slug = normalized.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 80) || "session";
-  const digest = createHash("sha256").update(normalized).digest("hex").slice(0, 12);
-  return `${slug}-${digest}`;
-}
-var WORKFLOW_GATE_DIR = "pr-workflow-gates";
-function workflowGateStateRelativePath(sessionID) {
-  return path.join(WORKFLOW_GATE_DIR, `${prWorkflowSessionFileStem(sessionID)}.json`);
-}
-function workflowGateStateLockRelativePath(sessionID) {
-  return path.join(WORKFLOW_GATE_DIR, `${prWorkflowSessionFileStem(sessionID)}.lock`);
-}
-function workflowCheckoutMutationLockRelativePath() {
-  return path.join(WORKFLOW_GATE_DIR, "checkout.lock");
-}
-function workflowGateStatePath(directory, sessionID) {
-  return validateSwarmPath(directory, workflowGateStateRelativePath(sessionID));
-}
-function workflowGateStateLockPath(directory, sessionID) {
-  return validateSwarmPath(directory, workflowGateStateLockRelativePath(sessionID));
-}
-function workflowCheckoutMutationLockPath(directory) {
-  return validateSwarmPath(directory, workflowCheckoutMutationLockRelativePath());
-}
-var MAX_TRACKED_SESSIONS = 200;
-var MAX_COMPLETED_CHECKOUT_LOCK_OWNERS = 64;
-var WINDOWS_RENAME_MAX_RETRIES = 3;
-var RENAME_RETRY_DELAY_MS = 10;
-var STATE_MUTATION_LOCK_MAX_ATTEMPTS = 50;
-var STATE_MUTATION_LOCK_RETRY_DELAY_MS = 10;
-var STATE_MUTATION_LOCK_UNINITIALIZED_STALE_MS = 30000;
-var CHECKOUT_MUTATION_ACTION_TIMEOUT_MS = 5 * 60000;
-var trackedStatesByProjectSession = new Map;
-var pendingStateMutationsByProjectSession = new Map;
-var pendingCheckoutMutationsByProject = new Map;
-var completedCheckoutLockOwners = new Map;
-function isoNow() {
-  return new Date().toISOString();
-}
-function delay(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-function sameBigIntFileIdentity(left, right) {
-  return left.dev === right.dev && left.ino === right.ino;
-}
-function normalizeComparableFsPath(value) {
-  const normalized = path.normalize(path.resolve(value));
-  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
-}
-function stateCacheKey(directory, sessionID) {
-  const resolved = path.normalize(path.resolve(directory));
-  const canonicalDirectory = process.platform === "win32" ? resolved.toLowerCase() : resolved;
-  return `${canonicalDirectory}\x00${normalizeSessionID(sessionID)}`;
-}
-function rememberState(directory, state) {
-  const cacheKey = stateCacheKey(directory, state.sessionID);
-  trackedStatesByProjectSession.delete(cacheKey);
-  trackedStatesByProjectSession.set(cacheKey, state);
-  while (trackedStatesByProjectSession.size > MAX_TRACKED_SESSIONS) {
-    const oldestKey = trackedStatesByProjectSession.keys().next().value;
-    if (!oldestKey)
-      break;
-    trackedStatesByProjectSession.delete(oldestKey);
-  }
-}
-function forgetTrackedPrWorkflowState(directory, sessionID) {
-  trackedStatesByProjectSession.delete(stateCacheKey(directory, sessionID));
-}
-function resetPrReviewPersistenceCaches() {
-  trackedStatesByProjectSession.clear();
-  pendingStateMutationsByProjectSession.clear();
-  pendingCheckoutMutationsByProject.clear();
-  completedCheckoutLockOwners.clear();
-}
-function defaultIsProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code !== "ESRCH";
-  }
-}
-var defaultPersistenceHooks = {
-  nowMs: () => Date.now(),
-  isProcessAlive: defaultIsProcessAlive,
-  openCheckoutLock: (lockPath) => fsp.open(lockPath, "wx"),
-  removeCheckoutLock: (lockPath) => fsp.rm(lockPath),
-  checkoutMutationActionTimeoutMs: CHECKOUT_MUTATION_ACTION_TIMEOUT_MS,
-  rename: (from, to) => fsp.rename(from, to)
-};
-var hooks = defaultPersistenceHooks;
-function bindPrReviewPersistenceHooks(nextHooks) {
-  hooks = nextHooks;
-}
-var codec;
-function bindPrReviewStateCodec(nextCodec) {
-  codec = nextCodec;
-}
-function requireCodec() {
-  if (!codec) {
-    throw new Error("BLOCKED: PR workflow persistence codec is not bound (the gate must bind it at module init)");
-  }
-  return codec;
-}
-async function ensurePrWorkflowSafeParentDirectory(directory, filePath) {
-  const swarmRoot = path.resolve(directory, ".swarm");
-  const parentPath = path.dirname(path.resolve(filePath));
-  const relativeParent = path.relative(swarmRoot, parentPath);
-  if (relativeParent === ".." || relativeParent.startsWith(`..${path.sep}`) || path.isAbsolute(relativeParent)) {
-    throw new Error("BLOCKED: PR workflow atomic destination escapes the project .swarm directory");
-  }
-  await fsp.mkdir(swarmRoot, { recursive: true });
-  let currentPath = swarmRoot;
-  let currentIdentity = await assertSafeDirectory(currentPath, undefined);
-  for (const segment of relativeParent.split(path.sep).filter(Boolean)) {
-    const nextPath = path.join(currentPath, segment);
-    await hooks.beforeSafeDirectoryCreate?.(currentPath, nextPath);
-    await assertSafeDirectory(currentPath, currentIdentity);
-    try {
-      await fsp.mkdir(nextPath);
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw error;
-    }
-    await assertSafeDirectory(currentPath, currentIdentity);
-    const nextIdentity = await assertSafeDirectory(nextPath, undefined);
-    const [realCurrent, realNext] = await Promise.all([
-      fsp.realpath(currentPath),
-      fsp.realpath(nextPath)
-    ]);
-    if (normalizeComparableFsPath(path.dirname(realNext)) !== normalizeComparableFsPath(realCurrent)) {
-      throw new Error("BLOCKED: PR workflow directory creation escaped the project .swarm tree");
-    }
-    currentPath = nextPath;
-    currentIdentity = nextIdentity;
-  }
-  const realRoot = await fsp.realpath(swarmRoot);
-  const realParent = await fsp.realpath(parentPath);
-  const relativeRealParent = path.relative(realRoot, realParent);
-  if (relativeRealParent === ".." || relativeRealParent.startsWith(`..${path.sep}`) || path.isAbsolute(relativeRealParent)) {
-    throw new Error("BLOCKED: PR workflow atomic parent escapes the project .swarm directory");
-  }
-  return realParent;
-}
-async function assertSafeDirectory(directoryPath, expectedIdentity) {
-  const stat2 = await fsp.lstat(directoryPath, { bigint: true });
-  if (stat2.isSymbolicLink() || !stat2.isDirectory() || expectedIdentity && !sameBigIntFileIdentity(stat2, expectedIdentity)) {
-    throw new Error("BLOCKED: PR workflow .swarm path must be a real directory and must not change during the operation");
-  }
-  return { dev: stat2.dev, ino: stat2.ino };
-}
-async function assertOpenedSwarmFileIdentity(directory, filePath, handle, expectedParent, label) {
-  const openedStat = await handle.stat({ bigint: true });
-  if (!openedStat.isFile())
-    throw new Error(`BLOCKED: ${label} is not a file`);
-  await assertClosedSwarmFileIdentity(directory, filePath, openedStat, expectedParent, label);
-  return { dev: openedStat.dev, ino: openedStat.ino };
-}
-async function assertClosedSwarmFileIdentity(directory, filePath, expectedIdentity, expectedParent, label) {
-  if (!expectedIdentity)
-    throw new Error(`BLOCKED: ${label} has no identity`);
-  const [stat2, realRoot, realFile, realParent] = await Promise.all([
-    fsp.lstat(filePath, { bigint: true }),
-    fsp.realpath(path.resolve(directory, ".swarm")),
-    fsp.realpath(filePath),
-    fsp.realpath(path.dirname(filePath))
-  ]);
-  const relativeFile = path.relative(realRoot, realFile);
-  if (stat2.isSymbolicLink() || !stat2.isFile() || !sameBigIntFileIdentity(stat2, expectedIdentity) || normalizeComparableFsPath(realParent) !== normalizeComparableFsPath(expectedParent) || relativeFile === "" || relativeFile === ".." || relativeFile.startsWith(`..${path.sep}`) || path.isAbsolute(relativeFile)) {
-    throw new Error(`BLOCKED: ${label} changed or escaped .swarm`);
-  }
-}
-async function writeAtomicJson(directory, filePath, value) {
-  const safeParent = await ensurePrWorkflowSafeParentDirectory(directory, filePath);
-  const tempPath = `${filePath}.tmp.${process.pid}.${randomUUID()}`;
-  let tempIdentity;
-  let lastError;
-  try {
-    const handle = await fsp.open(tempPath, "wx");
-    try {
-      await hooks.beforeAtomicTempWrite?.();
-      tempIdentity = await assertOpenedSwarmFileIdentity(directory, tempPath, handle, safeParent, "PR workflow atomic temporary file");
-      await handle.writeFile(JSON.stringify(value, null, 2), "utf-8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    await hooks.beforeAtomicRename?.();
-    await assertClosedSwarmFileIdentity(directory, tempPath, tempIdentity, safeParent, "PR workflow atomic temporary file");
-    for (let attempt = 0;attempt < WINDOWS_RENAME_MAX_RETRIES; attempt++) {
-      try {
-        await hooks.rename(tempPath, filePath);
-        lastError = undefined;
-        break;
-      } catch (error) {
-        lastError = error;
-        const code = error.code;
-        if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY") {
-          break;
-        }
-        if (attempt < WINDOWS_RENAME_MAX_RETRIES - 1) {
-          await delay(RENAME_RETRY_DELAY_MS);
-        }
-      }
-    }
-    if (lastError) {
-      throw lastError;
-    }
-    await assertClosedSwarmFileIdentity(directory, filePath, tempIdentity, safeParent, "PR workflow atomic destination file");
-  } finally {
-    try {
-      await fsp.rm(tempPath, { force: true });
-    } catch {}
-  }
-}
-async function readPrWorkflowGateStateFromDisk(directory, sessionID) {
-  const filePath = workflowGateStatePath(directory, sessionID);
-  return readPrWorkflowGateStateFileFromDisk(filePath, sessionID);
-}
-async function readPrWorkflowGateStateFileFromDisk(filePath, stateLabel) {
-  let raw;
-  try {
-    raw = await fsp.readFile(filePath, "utf-8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw error;
-  }
-  let parsedJson;
-  try {
-    parsedJson = JSON.parse(raw);
-  } catch {
-    throw new Error(`BLOCKED: PR workflow gate state for session "${stateLabel}" is not valid JSON`);
-  }
-  const bound = requireCodec();
-  const parsed = bound.safeParse(parsedJson);
-  if (!parsed.success) {
-    throw new Error(`BLOCKED: PR workflow gate state for session "${stateLabel}" is invalid`);
-  }
-  return parsed.data;
-}
-async function writeStateWhileLocked(directory, state, options = {}) {
-  const bound = requireCodec();
-  const validated = bound.parse(state);
-  const current = await readPrWorkflowGateStateFromDisk(directory, validated.sessionID);
-  if (current ? current.revision !== validated.revision : validated.revision !== 0) {
-    throw new Error("BLOCKED: PR workflow gate state changed concurrently; reload the active session state before retrying");
-  }
-  if (current?.workflowInstanceId && validated.workflowInstanceId !== current.workflowInstanceId && options.replaceWorkflowInstanceId !== current.workflowInstanceId) {
-    throw new Error("BLOCKED: PR workflow gate state changed concurrently; reload the active session state before retrying");
-  }
-  const nextState = bound.parse({
-    ...validated,
-    revision: validated.revision + 1
-  });
-  const filePath = workflowGateStatePath(directory, validated.sessionID);
-  await writeAtomicJson(directory, filePath, nextState);
-  rememberState(directory, nextState);
-  return nextState;
-}
-function checkoutMutationProjectKey(directory) {
-  return normalizeComparableFsPath(directory);
-}
-
-class PrWorkflowCheckoutMutationTimeoutError extends Error {
-  phase;
-  code = "PR_WORKFLOW_CHECKOUT_MUTATION_TIMEOUT";
-  retryable = false;
-  constructor(phase) {
-    super(phase === "queue" ? "BLOCKED: timed out waiting for the active PR workflow checkout mutation; the existing owner still holds serialization and must settle before retrying" : "BLOCKED: PR workflow checkout mutation exceeded its execution deadline; serialization remains held until the in-flight action actually settles");
-    this.phase = phase;
-    this.name = "PrWorkflowCheckoutMutationTimeoutError";
-  }
-}
-async function withCheckoutMutationDeadline(promise, phase) {
-  let timeout;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((resolve2) => {
-        timeout = setTimeout(() => {
-          resolve2({
-            status: "timeout",
-            error: new PrWorkflowCheckoutMutationTimeoutError(phase)
-          });
-        }, hooks.checkoutMutationActionTimeoutMs);
-      })
-    ]);
-  } finally {
-    if (timeout)
-      clearTimeout(timeout);
-  }
-}
-async function withPrWorkflowCheckoutMutationLock(directory, action) {
-  const key = checkoutMutationProjectKey(directory);
-  const previous = pendingCheckoutMutationsByProject.get(key) ?? Promise.resolve();
-  let release;
-  const current = new Promise((resolve2) => {
-    release = resolve2;
-  });
-  const queued = previous.then(() => current);
-  pendingCheckoutMutationsByProject.set(key, queued);
-  const previousResult = await withCheckoutMutationDeadline(previous.then(() => ({ status: "ready" })), "queue");
-  if (previousResult.status === "timeout") {
-    release();
-    queued.then(() => {
-      if (pendingCheckoutMutationsByProject.get(key) === queued) {
-        pendingCheckoutMutationsByProject.delete(key);
-      }
-    });
-    throw previousResult.error;
-  }
-  let lock;
-  try {
-    lock = await acquireCheckoutMutationLock(directory);
-  } catch (error) {
-    release();
-    if (pendingCheckoutMutationsByProject.get(key) === queued) {
-      pendingCheckoutMutationsByProject.delete(key);
-    }
-    throw error;
-  }
-  const actionOutcome = Promise.resolve().then(action).then((value) => ({ status: "fulfilled", value }), (error) => ({ status: "rejected", error }));
-  const outcome = await withCheckoutMutationDeadline(actionOutcome, "action");
-  if (outcome.status === "timeout") {
-    actionOutcome.then(async () => {
-      try {
-        await releaseCheckoutMutationLock(lock);
-      } catch {} finally {
-        release();
-        if (pendingCheckoutMutationsByProject.get(key) === queued) {
-          pendingCheckoutMutationsByProject.delete(key);
-        }
-      }
-    });
-    throw outcome.error;
-  }
-  try {
-    if (outcome.status === "rejected")
-      throw outcome.error;
-    return outcome.value;
-  } finally {
-    try {
-      await releaseCheckoutMutationLock(lock);
-    } finally {
-      release();
-      if (pendingCheckoutMutationsByProject.get(key) === queued) {
-        pendingCheckoutMutationsByProject.delete(key);
-      }
-    }
-  }
-}
-async function acquireCheckoutMutationLock(directory) {
-  const lockPath = workflowCheckoutMutationLockPath(directory);
-  const verifiedParent = await ensurePrWorkflowSafeParentDirectory(directory, lockPath);
-  for (let attempt = 0;attempt < STATE_MUTATION_LOCK_MAX_ATTEMPTS; attempt++) {
-    try {
-      const handle = await hooks.openCheckoutLock(lockPath);
-      const lock = {
-        ownerToken: randomUUID(),
-        pid: process.pid,
-        createdAtMs: hooks.nowMs()
-      };
-      let lockIdentity;
-      let writeError;
-      try {
-        const openedStat = await handle.stat({ bigint: true });
-        lockIdentity = { dev: openedStat.dev, ino: openedStat.ino };
-        lockIdentity = await assertOpenedSwarmFileIdentity(directory, lockPath, handle, verifiedParent, "PR workflow checkout mutation lock");
-        await hooks.beforeCheckoutLockWrite?.();
-        await handle.writeFile(JSON.stringify(lock), "utf-8");
-      } catch (error) {
-        writeError = error;
-      } finally {
-        await handle.close().catch(() => {
-          return;
-        });
-      }
-      if (writeError) {
-        if (lockIdentity) {
-          await removeCheckoutMutationLockByIdentity(directory, lockPath, lockIdentity, verifiedParent);
-        }
-        throw writeError;
-      }
-      return { path: lockPath, ownerToken: lock.ownerToken };
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw error;
-      if (await reclaimAbandonedCheckoutMutationLock(lockPath))
-        continue;
-      if (attempt < STATE_MUTATION_LOCK_MAX_ATTEMPTS - 1) {
-        await delay(STATE_MUTATION_LOCK_RETRY_DELAY_MS);
-      }
-    }
-  }
-  throw new Error("BLOCKED: PR workflow checkout mutation is being handled by another process; retry after that checkout settles");
-}
-async function releaseCheckoutMutationLock(lock) {
-  let lastError;
-  for (let attempt = 0;attempt < WINDOWS_RENAME_MAX_RETRIES; attempt++) {
-    try {
-      if (await removeCheckoutMutationLockIfOwned(lock.path, lock.ownerToken)) {
-        completedCheckoutLockOwners.delete(lock.path);
-        return;
-      }
-      lastError = new Error("PR workflow checkout mutation lock ownership changed before release");
-    } catch (error) {
-      lastError = error;
-    }
-    if (attempt < WINDOWS_RENAME_MAX_RETRIES - 1) {
-      await delay(RENAME_RETRY_DELAY_MS);
-    }
-  }
-  rememberCompletedCheckoutLockOwner(lock.path, lock.ownerToken);
-  throw lastError instanceof Error ? lastError : new Error("PR workflow checkout mutation lock release failed");
-}
-async function reclaimAbandonedCheckoutMutationLock(lockPath) {
-  const lock = await readCheckoutMutationLock(lockPath);
-  if (lock) {
-    if (lock.pid === process.pid && completedCheckoutLockOwners.get(lockPath) === lock.ownerToken) {
-      const removed = await removeCheckoutMutationLockIfOwned(lockPath, lock.ownerToken);
-      if (removed)
-        completedCheckoutLockOwners.delete(lockPath);
-      return removed;
-    }
-    if (hooks.isProcessAlive(lock.pid))
-      return false;
-    return removeCheckoutMutationLockIfOwned(lockPath, lock.ownerToken);
-  }
-  try {
-    const stat2 = await fsp.stat(lockPath);
-    if (hooks.nowMs() - stat2.mtimeMs < STATE_MUTATION_LOCK_UNINITIALIZED_STALE_MS) {
-      return false;
-    }
-    await fsp.rm(lockPath, { force: true });
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return true;
-    throw error;
-  }
-}
-async function readCheckoutMutationLock(lockPath) {
-  let raw;
-  try {
-    raw = await fsp.readFile(lockPath, "utf-8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw error;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null && typeof parsed.ownerToken === "string" && parsed.ownerToken.length > 0 && typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && typeof parsed.createdAtMs === "number" && Number.isFinite(parsed.createdAtMs)) {
-      return parsed;
-    }
-  } catch {}
-  return null;
-}
-async function removeCheckoutMutationLockIfOwned(lockPath, ownerToken) {
-  const lock = await readCheckoutMutationLock(lockPath);
-  if (!lock || lock.ownerToken !== ownerToken)
-    return false;
-  try {
-    await hooks.removeCheckoutLock(lockPath);
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return false;
-    throw error;
-  }
-}
-async function removeCheckoutMutationLockByIdentity(directory, lockPath, identity, verifiedParent) {
-  let lastError;
-  for (let attempt = 0;attempt < WINDOWS_RENAME_MAX_RETRIES; attempt++) {
-    try {
-      await assertClosedSwarmFileIdentity(directory, lockPath, identity, verifiedParent, "PR workflow checkout mutation lock");
-      await hooks.removeCheckoutLock(lockPath);
-      return;
-    } catch (error) {
-      if (error.code === "ENOENT")
-        return;
-      lastError = error;
-      if (attempt < WINDOWS_RENAME_MAX_RETRIES - 1) {
-        await delay(RENAME_RETRY_DELAY_MS);
-      }
-    }
-  }
-  throw lastError instanceof Error ? lastError : new Error("PR workflow checkout mutation lock cleanup failed");
-}
-function rememberCompletedCheckoutLockOwner(lockPath, ownerToken) {
-  completedCheckoutLockOwners.delete(lockPath);
-  completedCheckoutLockOwners.set(lockPath, ownerToken);
-  while (completedCheckoutLockOwners.size > MAX_COMPLETED_CHECKOUT_LOCK_OWNERS) {
-    const oldest = completedCheckoutLockOwners.keys().next().value;
-    if (oldest === undefined)
-      break;
-    completedCheckoutLockOwners.delete(oldest);
-  }
-}
-async function withSessionStateMutation(directory, sessionID, action) {
-  const key = stateCacheKey(directory, sessionID);
-  const previous = pendingStateMutationsByProjectSession.get(key) ?? Promise.resolve();
-  let release;
-  const current = new Promise((resolve2) => {
-    release = resolve2;
-  });
-  const queued = previous.then(() => current);
-  pendingStateMutationsByProjectSession.set(key, queued);
-  await previous;
-  try {
-    const lock = await acquireSessionStateMutationLock(directory, sessionID);
-    try {
-      return await action();
-    } finally {
-      await releaseSessionStateMutationLock(lock);
-    }
-  } finally {
-    release();
-    if (pendingStateMutationsByProjectSession.get(key) === queued) {
-      pendingStateMutationsByProjectSession.delete(key);
-    }
-  }
-}
-async function acquireSessionStateMutationLock(directory, sessionID) {
-  const lockPath = workflowGateStateLockPath(directory, sessionID);
-  const verifiedParent = await ensurePrWorkflowSafeParentDirectory(directory, lockPath);
-  for (let attempt = 0;attempt < STATE_MUTATION_LOCK_MAX_ATTEMPTS; attempt++) {
-    try {
-      const handle = await fsp.open(lockPath, "wx");
-      const lock = {
-        ownerToken: randomUUID(),
-        pid: process.pid,
-        createdAtMs: hooks.nowMs()
-      };
-      let writeError;
-      try {
-        await hooks.beforeSessionStateLockWrite?.();
-        await assertOpenedSwarmFileIdentity(directory, lockPath, handle, verifiedParent, "PR workflow state mutation lock");
-        await handle.writeFile(JSON.stringify(lock), "utf-8");
-      } catch (error) {
-        writeError = error;
-      } finally {
-        await handle.close().catch(() => {
-          return;
-        });
-      }
-      if (writeError) {
-        await removeSessionStateMutationLockIfOwned(lockPath, lock.ownerToken);
-        throw writeError;
-      }
-      return { path: lockPath, ownerToken: lock.ownerToken };
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw error;
-      if (await reclaimAbandonedSessionStateMutationLock(lockPath))
-        continue;
-      if (attempt < STATE_MUTATION_LOCK_MAX_ATTEMPTS - 1) {
-        await delay(STATE_MUTATION_LOCK_RETRY_DELAY_MS);
-      }
-    }
-  }
-  throw new Error("BLOCKED: PR workflow gate state is being mutated by another process; retry after that session transition finishes");
-}
-async function releaseSessionStateMutationLock(lock) {
-  try {
-    await removeSessionStateMutationLockIfOwned(lock.path, lock.ownerToken);
-  } catch {}
-}
-async function reclaimAbandonedSessionStateMutationLock(lockPath) {
-  const lock = await readSessionStateMutationLock(lockPath);
-  if (lock) {
-    if (hooks.isProcessAlive(lock.pid))
-      return false;
-    return removeSessionStateMutationLockIfOwned(lockPath, lock.ownerToken);
-  }
-  try {
-    const stat2 = await fsp.stat(lockPath);
-    if (hooks.nowMs() - stat2.mtimeMs < STATE_MUTATION_LOCK_UNINITIALIZED_STALE_MS) {
-      return false;
-    }
-    await fsp.rm(lockPath, { force: true });
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return true;
-    throw error;
-  }
-}
-async function readSessionStateMutationLock(lockPath) {
-  let raw;
-  try {
-    raw = await fsp.readFile(lockPath, "utf-8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw error;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null && typeof parsed.ownerToken === "string" && parsed.ownerToken.length > 0 && typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && typeof parsed.createdAtMs === "number" && Number.isFinite(parsed.createdAtMs)) {
-      return parsed;
-    }
-  } catch {}
-  return null;
-}
-async function removeSessionStateMutationLockIfOwned(lockPath, ownerToken) {
-  const lock = await readSessionStateMutationLock(lockPath);
-  if (!lock || lock.ownerToken !== ownerToken)
-    return false;
-  try {
-    await fsp.rm(lockPath);
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return false;
-    throw error;
-  }
-}
-
-// src/pr-review/authorization.ts
-var AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
-var MAX_ACTIVE_AUTHORIZATIONS = 8;
-var MAX_PERSISTED_AUTHORIZATIONS = 32;
-var REENTRY_AUTHORIZATIONS_MAX_BYTES = 64 * 1024;
-var bindingReader;
-function bindPrReviewReentryBindingReader(reader) {
-  bindingReader = reader;
-}
-async function currentBinding(directory, sessionID) {
-  if (!bindingReader) {
-    throw new Error("BLOCKED: re-entry authorization binding reader is not bound (the PR workflow gate must bind it at module init)");
-  }
-  return bindingReader(directory, sessionID);
-}
-var PrReviewReentryAuthorizationRecordSchema = exports_external.object({
-  schemaVersion: exports_external.literal(1),
-  authorizationId: exports_external.string().min(1).max(64),
-  sessionId: exports_external.string().min(1).max(256),
-  workflowInstanceId: exports_external.string().min(1).max(128).optional(),
-  runId: PrReviewRunIdSchema.optional(),
-  prHeadSha: exports_external.string().regex(/^[0-9a-f]{6,64}$/i),
-  revisionDigest: exports_external.string().min(1).max(256),
-  role: exports_external.enum(["reviewer", "test_engineer"]),
-  generation: exports_external.number().int().nonnegative(),
-  createdAt: exports_external.string().datetime(),
-  expiresAt: exports_external.string().datetime(),
-  consumedAt: exports_external.string().datetime().optional(),
-  consumedCallId: exports_external.string().min(1).max(128).optional()
-}).strict();
-var AuthorizationFileSchema = exports_external.object({
-  schemaVersion: exports_external.literal(1),
-  sessionId: exports_external.string().min(1).max(256),
-  authorizations: exports_external.array(PrReviewReentryAuthorizationRecordSchema).max(MAX_PERSISTED_AUTHORIZATIONS)
-}).strict();
-function reentryAuthorizationFilePath(directory, sessionID) {
-  const relative2 = path2.join("pr-review", "reentry-authorizations", `${prWorkflowSessionFileStem(sessionID)}.json`);
-  return validateSwarmPath(directory, relative2);
-}
-async function readAuthorizationFile(filePath) {
-  let raw;
-  try {
-    const stat3 = await fsp2.stat(filePath);
-    if (!stat3.isFile() || stat3.size > REENTRY_AUTHORIZATIONS_MAX_BYTES) {
-      throw new Error("reentry authorization store is not a bounded regular file");
-    }
-    raw = await fsp2.readFile(filePath, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw error;
-  }
-  const decoded = JSON.parse(raw);
-  const parsed = AuthorizationFileSchema.safeParse(decoded);
-  if (!parsed.success) {
-    throw new Error(`reentry authorization store is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
-  }
-  return parsed.data;
-}
-var RENAME_RETRY_DELAYS_MS = [10, 25, 50, 100, 200];
-var RETRYABLE_RENAME_CODES = new Set(["EPERM", "EBUSY", "EACCES", "EEXIST"]);
-async function renameWithRetryAsync(tempPath, targetPath) {
-  let lastError;
-  for (let attempt = 0;attempt <= _internals.renameRetryDelaysMs.length; attempt++) {
-    try {
-      await _internals.renameImpl(tempPath, targetPath);
-      return;
-    } catch (err) {
-      lastError = err;
-      const code = err?.code;
-      if (!code || !RETRYABLE_RENAME_CODES.has(code))
-        throw err;
-      if (attempt < _internals.renameRetryDelaysMs.length) {
-        await new Promise((resolve2) => setTimeout(resolve2, _internals.renameRetryDelaysMs[attempt]));
-      }
-    }
-  }
-  throw lastError;
-}
-async function writeAuthorizationFile(filePath, file) {
-  const serialized = `${JSON.stringify(file, null, 2)}
-`;
-  if (Buffer.byteLength(serialized, "utf8") > REENTRY_AUTHORIZATIONS_MAX_BYTES) {
-    throw new Error("reentry authorization store exceeds its write bound");
-  }
-  await fsp2.mkdir(path2.dirname(filePath), { recursive: true });
-  const tempPath = path2.join(path2.dirname(filePath), `.${path2.basename(filePath)}.${randomUUID2()}.tmp`);
-  try {
-    await fsp2.writeFile(tempPath, serialized, { encoding: "utf8", flag: "wx" });
-    await renameWithRetryAsync(tempPath, filePath);
-  } finally {
-    await fsp2.rm(tempPath, { force: true }).catch(() => {
-      return;
-    });
-  }
-}
-function pruneAuthorizations(records, nowMs) {
-  const kept = [];
-  for (const record of [...records].sort((left, right) => right.createdAt.localeCompare(left.createdAt)).slice(0, MAX_PERSISTED_AUTHORIZATIONS)) {
-    if (record.consumedAt)
-      continue;
-    if (Date.parse(record.expiresAt) <= nowMs)
-      continue;
-    kept.push(record);
-  }
-  return kept;
-}
-var lf = import_proper_lockfile.default;
-async function withAuthorizationLock(filePath, write) {
-  await fsp2.mkdir(path2.dirname(filePath), { recursive: true });
-  const release = await lf.lock(path2.dirname(filePath), {
-    lockfilePath: `${filePath}.lock`,
-    retries: { retries: 8, minTimeout: 10, maxTimeout: 100 },
-    stale: 1e4,
-    update: 1000,
-    realpath: false
-  });
-  try {
-    return await write();
-  } finally {
-    await release().catch(() => {
-      return;
-    });
-  }
-}
-async function issuePrReviewReentryAuthorization(directory, sessionID, request) {
-  const trimmedSession = sessionID.trim();
-  if (!trimmedSession) {
-    throw new Error("BLOCKED: re-entry authorization requires an active sessionID");
-  }
-  const binding = await currentBinding(directory, trimmedSession);
-  if (!binding || binding.prHeadSha !== request.prHeadSha.toLowerCase()) {
-    throw new Error(`BLOCKED: re-entry authorization requires an active PR_REVIEW workflow bound to the declared head (active: ${binding?.prHeadSha ?? "(none)"})`);
-  }
-  if (request.runId && binding.runId && request.runId !== binding.runId) {
-    throw new Error("BLOCKED: re-entry authorization run does not match the active PR-review run");
-  }
-  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
-  return withAuthorizationLock(filePath, async () => {
-    const existing = await readAuthorizationFile(filePath);
-    const nowMs = Date.now();
-    const now = new Date(nowMs).toISOString();
-    const records = pruneAuthorizations(existing?.authorizations ?? [], nowMs);
-    const active = records.filter((record2) => !record2.consumedAt && record2.role === request.role && record2.generation === binding.generation);
-    if (active.length > 0) {
-      throw new Error(`BLOCKED: an unconsumed re-entry authorization for role "${request.role}" at generation ${binding.generation} already exists; use it (one immediate Task dispatch) before issuing another`);
-    }
-    if (records.length >= MAX_ACTIVE_AUTHORIZATIONS) {
-      throw new Error(`BLOCKED: re-entry authorization store is at its bound of ${MAX_ACTIVE_AUTHORIZATIONS} active authorizations`);
-    }
-    const record = {
-      schemaVersion: 1,
-      authorizationId: randomUUID2(),
-      sessionId: trimmedSession,
-      ...binding.workflowInstanceId ? { workflowInstanceId: binding.workflowInstanceId } : {},
-      ...binding.runId ? { runId: binding.runId } : {},
-      prHeadSha: binding.prHeadSha,
-      revisionDigest: binding.revisionDigest,
-      role: request.role,
-      generation: binding.generation,
-      createdAt: now,
-      expiresAt: new Date(nowMs + AUTHORIZATION_TTL_MS).toISOString()
-    };
-    await writeAuthorizationFile(filePath, {
-      schemaVersion: 1,
-      sessionId: trimmedSession,
-      authorizations: [record, ...records]
-    });
-    return record;
-  });
-}
-async function consumePrReviewReentryAuthorization(directory, sessionID, request) {
-  const trimmedSession = sessionID.trim();
-  if (!trimmedSession)
-    return null;
-  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
-  try {
-    return await withAuthorizationLock(filePath, async () => {
-      const existing = await readAuthorizationFile(filePath);
-      if (!existing)
-        return null;
-      const nowMs = Date.now();
-      const records = pruneAuthorizations(existing.authorizations, nowMs);
-      const index = records.findIndex((record) => !record.consumedAt && record.role === request.role && record.sessionId === trimmedSession && Date.parse(record.expiresAt) > nowMs);
-      if (index < 0) {
-        if (records.length !== existing.authorizations.length) {
-          await writeAuthorizationFile(filePath, {
-            ...existing,
-            authorizations: records
-          });
-        }
-        return null;
-      }
-      const binding = await currentBinding(directory, trimmedSession);
-      const candidate = records[index];
-      if (!binding || binding.prHeadSha !== candidate.prHeadSha || binding.revisionDigest !== candidate.revisionDigest || binding.generation !== candidate.generation || candidate.workflowInstanceId !== undefined && binding.workflowInstanceId !== candidate.workflowInstanceId || candidate.workflowInstanceId === undefined && binding.workflowInstanceId !== undefined) {
-        return null;
-      }
-      const consumed = {
-        ...candidate,
-        consumedAt: new Date(nowMs).toISOString(),
-        consumedCallId: request.callID
-      };
-      records[index] = consumed;
-      await writeAuthorizationFile(filePath, {
-        ...existing,
-        authorizations: records
-      });
-      return consumed;
-    });
-  } catch {
-    return null;
-  }
-}
-var _internals = {
-  AUTHORIZATION_TTL_MS,
-  MAX_ACTIVE_AUTHORIZATIONS,
-  reentryAuthorizationFilePath,
-  pruneAuthorizations,
-  renameImpl: (from, to) => fsp2.rename(from, to),
-  renameRetryDelaysMs: RENAME_RETRY_DELAYS_MS,
-  renameWithRetryAsync,
-  writeAuthorizationFile
-};
-
-export { normalizeSessionID, workflowGateStateRelativePath, workflowGateStateLockRelativePath, workflowCheckoutMutationLockRelativePath, workflowGateStatePath, MAX_TRACKED_SESSIONS, CHECKOUT_MUTATION_ACTION_TIMEOUT_MS, isoNow, sameBigIntFileIdentity, normalizeComparableFsPath, rememberState, forgetTrackedPrWorkflowState, resetPrReviewPersistenceCaches, defaultPersistenceHooks, bindPrReviewPersistenceHooks, bindPrReviewStateCodec, writeAtomicJson, readPrWorkflowGateStateFromDisk, writeStateWhileLocked, withPrWorkflowCheckoutMutationLock, withSessionStateMutation, bindPrReviewReentryBindingReader, issuePrReviewReentryAuthorization, consumePrReviewReentryAuthorization, _internals };