pi-agent-browser-native 0.9.3 → 0.9.4

package/dist/extensions/agent-browser/lib/managed-session-policy-lock.js

@@ -1,122 +1,88 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash, randomInt, randomUUID } from "node:crypto";
-import { lstat, mkdir, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { basename, dirname, join } from "node:path";
-import { canonicalizeAgentBrowserNamespace, foldAgentBrowserFilesystemIdentity } from "./argv-grammar.js";
-import { getAgentBrowserSocketDirValidationError, resolveAgentBrowserSocketDir } from "./process.js";
-import { processStartIdentitiesMatch, readProcessStartIdentity } from "./process-identity.js";
-const POLICY_LOCK_WAIT_MS = 1_000;
-const POLICY_LOCK_RETRY_MS = 10;
-const POLICY_LOCK_MAX_BYTES = 1_048_576; // One claim may cover an entire owned-browser cleanup set.
-const LOCK_OWNER_FILE = "owner.json";
-const LOCK_TICKET_FILE = "ticket.json";
-const STALE_CLAIM_MIN_AGE_MS = 30 * 60 * 1_000;
-const POLICY_GC_BATCH_SIZE = 8;
-let lastPolicyGcName;
-function getCoordinationDirectory(platform = process.platform) {
-    if (platform !== "win32") {
-        const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-        return platform === "android"
-            ? join(tmpdir(), `pi-agent-browser-policy${uid === undefined ? "" : `-${uid}`}`)
-            : `/tmp/pi-agent-browser-policy${uid === undefined ? "" : `-${uid}`}`;
-    }
-    const user = process.env.USERNAME ?? process.env.USER ?? "unknown";
-    const suffix = createHash("sha256").update(user).digest("hex").slice(0, 12);
-    return join(tmpdir(), `pi-agent-browser-policy-${suffix}`);
-}
-async function ensureCoordinationDirectory(path, platform) {
-    try {
-        try {
-            await mkdir(path, { mode: 0o700 });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                return false;
-        }
-        const entry = await lstat(path);
-        if (entry.isSymbolicLink() || !entry.isDirectory())
-            return false;
-        if (platform !== "win32") {
-            const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-            if (uid === undefined || entry.uid !== uid || (entry.mode & 0o077) !== 0)
-                return false;
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function resolveBrowserExecutionIdentity(options) {
-    const socketDir = resolveAgentBrowserSocketDir(options);
-    const namespace = canonicalizeAgentBrowserNamespace(options.namespace);
-    let socketContext;
-    if (process.platform === "win32") {
-        // Native Windows can reach the same namespace/session TCP daemon from
-        // different storage roots. Do not split those callers into separate locks.
-        socketContext = `win32-native:${namespace ?? ""}`;
-    }
-    else {
-        if (socketDir === undefined)
-            throw new Error("Browser execution coordination requires the native socket directory.");
-        const error = await getAgentBrowserSocketDirValidationError(socketDir);
-        if (error)
-            throw new Error(`Browser execution coordination cannot use socket storage: ${error}.`);
-        const root = await realpath(socketDir);
-        socketContext = namespace ? join(root, "namespaces", namespace, "run") : root;
-    }
-    return {
-        socketContext: foldAgentBrowserFilesystemIdentity(socketContext, process.platform),
-        ...(options.sessionName !== undefined ? { sessionName: foldAgentBrowserFilesystemIdentity(options.sessionName, process.platform) } : {}),
-    };
-}
-export function getBrowserExecutionLockPath(identity) {
-    const digest = createHash("sha256").update(identity.socketContext).digest("hex");
-    return join(getCoordinationDirectory(), `.pi-agent-browser-policy-${digest}.lock-v4`);
-}
+import { acquireExecutionClaim, } from "./browser-execution-claims.js";
+import { resolveBrowserExecutionIdentity, } from "./browser-execution-identity.js";
+export { resolveBrowserExecutionIdentity, getBrowserExecutionLockPath, } from "./browser-execution-identity.js";
 function groupExecutionIdentities(identities) {
-    if (identities.length === 0)
+    if (identities.length === 0) {
         throw new Error("Browser execution coordination requires at least one identity.");
+    }
     const groups = new Map();
     for (const { socketContext, sessionName } of identities) {
-        if (sessionName === undefined)
+        if (sessionName === undefined) {
             groups.set(socketContext, null);
+        }
         else if (groups.get(socketContext) !== null) {
             const sessions = groups.get(socketContext) ?? new Set();
             sessions.add(sessionName);
             groups.set(socketContext, sessions);
         }
     }
-    return [...groups.keys()].sort().map(socketContext => {
+    return [...groups.keys()].sort().map((socketContext) => {
         const sessions = groups.get(socketContext);
         return { socketContext, sessionNames: sessions ? [...sessions].sort() : null };
     });
 }
 const executionScope = new AsyncLocalStorage();
+function identityCovers(held, identity) {
+    if (held.socketContext !== identity.socketContext) {
+        return false;
+    }
+    const heldSessions = held.sessionNames;
+    if (heldSessions === null) {
+        return true;
+    }
+    const innerSessions = identity.sessionNames;
+    return innerSessions !== null && innerSessions.every((session) => heldSessions.includes(session));
+}
 function scopeCovers(outer, inner) {
-    return inner.every(identity => outer.some(held => held.socketContext === identity.socketContext
-        && (held.sessionNames === null || identity.sessionNames !== null && identity.sessionNames.every(session => held.sessionNames.includes(session)))));
+    return inner.every((identity) => outer.some((held) => identityCovers(held, identity)));
+}
+async function acquireClaimsInOrder(identities, budget, remember) {
+    for (const identity of identities) {
+        // Acquiring sorted native socket contexts in order prevents lock-order cycles.
+        // oxlint-disable-next-line no-await-in-loop
+        const lock = await acquireExecutionClaim({
+            identity,
+            deadline: budget.deadline,
+            signal: budget.signal,
+        });
+        if (lock) {
+            remember(lock);
+        }
+        budget.check();
+        if (!lock) {
+            throw new Error("Browser execution coordination is unavailable or busy; no browser command was run.");
+        }
+    }
+}
+async function runInScope(identities, signal, run) {
+    const scope = { identities, active: true, signal, children: Promise.resolve() };
+    try {
+        return await executionScope.run(scope, () => run(signal));
+    }
+    finally {
+        scope.active = false;
+        await scope.children;
+    }
 }
-/**
- * Hold across every helper and action (or a complete code cell), not each CLI call.
- * Nested siblings are serialized; recursive inner calls and managed policy checks borrow
- * the claims. Declare every old/new identity up front for replacement or multi-browser cleanup;
- * omit sessionName for close --all. Upgrading mid-operation would allow a lock-order cycle.
- * Sessions sharing a socket context use ONE set-valued claim: acquiring them separately
- * could deadlock against a namespace-wide claimant between the first and second session.
- * Cancellation never releases a still-running callback. The callback must pass its signal
- * to subprocesses and await their termination; finally drains started children before release.
- */
+/** Hold across helpers/actions or a complete code cell. Nested siblings serialize and recursive
+ * calls borrow existing claims. Declare every replacement/cleanup identity up front: upgrades
+ * mid-operation would permit lock-order cycles. One set-valued claim per socket context prevents
+ * namespace-wide contenders from deadlocking between individual session acquisitions.
+ * Cancellation does not release running callbacks: they must pass the signal to subprocesses
+ * and await termination. Finally drains started children before releasing the native claims. */
 export async function withBrowserExecutionLocks(options, run) {
-    if (!Number.isFinite(options.deadline))
+    if (!Number.isFinite(options.deadline)) {
         throw new Error("Browser execution coordination requires a finite deadline.");
+    }
     const identities = groupExecutionIdentities(options.identities);
     const parent = executionScope.getStore();
-    if (parent && !parent.active)
+    if (parent && !parent.active) {
         throw new Error("Browser execution scope has already finished.");
-    if (parent && !scopeCovers(parent.identities, identities))
+    }
+    if (parent && !scopeCovers(parent.identities, identities)) {
         throw new Error("Cannot change or upgrade browser identity inside an execution lock; acquire every required identity before starting.");
+    }
     const controller = new AbortController();
     const signals = [controller.signal, options.signal, parent?.signal].filter((signal) => signal !== undefined);
     const signal = AbortSignal.any(signals);
@@ -124,264 +90,51 @@ export async function withBrowserExecutionLocks(options, run) {
     const remaining = options.deadline - Date.now();
     const timer = setTimeout(expire, Math.max(0, Math.min(remaining, 2_147_483_647)));
     const checkBudget = () => {
-        if (Date.now() >= options.deadline)
+        if (Date.now() >= options.deadline) {
             expire();
+        }
         signal.throwIfAborted();
     };
     const locks = [];
     try {
         checkBudget();
         if (!parent) {
-            for (const identity of identities) {
-                const lock = await acquireExecutionClaim({ identity, deadline: options.deadline, signal });
-                if (lock)
-                    locks.push(lock);
-                checkBudget();
-                if (!lock)
-                    throw new Error("Browser execution coordination is unavailable or busy; no browser command was run.");
-            }
+            await acquireClaimsInOrder(identities, { deadline: options.deadline, signal, check: checkBudget }, (lock) => {
+                locks.push(lock);
+            });
         }
         const execute = async () => {
             checkBudget();
-            if (options.waitOnly)
+            if (options.waitOnly === true) {
                 clearTimeout(timer);
-            const scope = { identities: parent?.identities ?? identities, active: true, signal, children: Promise.resolve() };
-            try {
-                return await executionScope.run(scope, () => run(signal));
-            }
-            finally {
-                scope.active = false;
-                await scope.children;
             }
+            return runInScope(parent?.identities ?? identities, signal, run);
         };
-        if (!parent)
+        if (!parent) {
             return await execute();
+        }
         const result = parent.children.then(execute);
+        // The caller owns this result; the parent drains both outcomes before releasing claims.
         parent.children = result.then(() => undefined, () => undefined);
         return await result;
     }
     finally {
         clearTimeout(timer);
-        await Promise.all(locks.reverse().map(lock => lock.release()));
+        await Promise.all(locks.reverse().map((lock) => lock.release()));
     }
 }
 export function withBrowserExecutionLock(options, run) {
-    return withBrowserExecutionLocks({ identities: [options.identity], signal: options.signal, deadline: options.deadline, waitOnly: options.waitOnly }, run);
-}
-function parseOwner(content) {
-    if (Buffer.byteLength(content) > POLICY_LOCK_MAX_BYTES)
-        return undefined;
-    try {
-        const parsed = JSON.parse(content);
-        return parsed.version === 4
-            && (parsed.sessionNames === null || Array.isArray(parsed.sessionNames) && parsed.sessionNames.length > 0 && parsed.sessionNames.every(session => typeof session === "string"))
-            && Number.isSafeInteger(parsed.pid) && (parsed.pid ?? 0) > 0
-            && typeof parsed.startIdentity === "string" && parsed.startIdentity.length > 0
-            && typeof parsed.token === "string" && parsed.token.length > 0
-            && !parsed.token.includes("/") && !parsed.token.includes("\\") && !parsed.token.includes("\0")
-            ? parsed
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function parseTicket(content, token) {
-    if (Buffer.byteLength(content) > POLICY_LOCK_MAX_BYTES)
-        return undefined;
-    try {
-        const parsed = JSON.parse(content);
-        return parsed.version === 4
-            && parsed.token === token
-            && Number.isSafeInteger(parsed.ticket)
-            && (parsed.ticket ?? 0) > 0
-            ? parsed.ticket
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function readClaim(path) {
-    try {
-        const directory = await lstat(path);
-        const ownerPath = join(path, LOCK_OWNER_FILE);
-        const ownerEntry = await lstat(ownerPath);
-        if (!directory.isDirectory() || directory.isSymbolicLink() || !ownerEntry.isFile() || ownerEntry.isSymbolicLink())
-            return undefined;
-        if (ownerEntry.size > POLICY_LOCK_MAX_BYTES)
-            return undefined;
-        if (process.platform !== "win32") {
-            const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-            if (uid === undefined || directory.uid !== uid || ownerEntry.uid !== uid || (directory.mode & 0o077) !== 0 || (ownerEntry.mode & 0o177) !== 0)
-                return undefined;
-        }
-        const owner = parseOwner(await readFile(ownerPath, "utf8"));
-        if (!owner)
-            return undefined;
-        const ticketPath = join(path, LOCK_TICKET_FILE);
-        try {
-            const ticketEntry = await lstat(ticketPath);
-            if (!ticketEntry.isFile() || ticketEntry.isSymbolicLink() || ticketEntry.size > POLICY_LOCK_MAX_BYTES)
-                return undefined;
-            if (process.platform !== "win32") {
-                const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-                if (uid === undefined || ticketEntry.uid !== uid || (ticketEntry.mode & 0o177) !== 0)
-                    return undefined;
-            }
-            const ticket = parseTicket(await readFile(ticketPath, "utf8"), owner.token);
-            return ticket === undefined ? undefined : { owner, path, ticket };
-        }
-        catch (error) {
-            return error.code === "ENOENT" ? { owner, path, ticket: null } : undefined;
-        }
-    }
-    catch {
-        return undefined;
-    }
-}
-async function readClaims(basePath) {
-    const directory = dirname(basePath);
-    const prefix = `${basename(basePath)}.claim-`;
-    let names;
-    try {
-        names = await readdir(directory);
-    }
-    catch {
-        return undefined;
-    }
-    const claims = [];
-    for (const name of names.filter((candidate) => candidate.startsWith(prefix))) {
-        const path = join(directory, name);
-        const claim = await readClaim(path);
-        if (!claim) {
-            try {
-                await lstat(path);
-            }
-            catch (error) {
-                if (error.code === "ENOENT")
-                    continue;
-            }
-            return undefined;
-        }
-        if (name !== `${prefix}${claim.owner.token}`)
-            return undefined;
-        claims.push(claim);
-    }
-    return claims;
-}
-async function ownerAlive(owner, budget) {
-    try {
-        process.kill(owner.pid, 0);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ESRCH")
-            return false;
-        if (code !== "EPERM")
-            return undefined;
-    }
-    const current = await readProcessStartIdentity(owner.pid, process.platform, budget);
-    return current === undefined ? undefined : processStartIdentitiesMatch(owner.startIdentity, current);
-}
-async function removeClaimOwnedBy(path, token, deadline = 0) {
-    const movedPath = join(dirname(path), `.pi-agent-browser-policy-remove-${token}-${randomUUID()}`);
-    while (true) {
-        const current = await readClaim(path);
-        if (current?.owner.token !== token)
-            return false;
-        try {
-            await rename(path, movedPath);
-            break;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === "ENOENT")
-                return true;
-            // Windows may refuse a directory move while a contender reads its
-            // metadata. Revalidate before retrying. Owned-claim cleanup gets
-            // its own bounded window, independent of the acquisition wait.
-            if (process.platform !== "win32" || code !== "EPERM" || Date.now() >= deadline)
-                return false;
-            await waitForRetry();
-            if (Date.now() >= deadline)
-                return false;
-        }
-    }
-    const moved = await readClaim(movedPath);
-    if (moved?.owner.token !== token) {
-        try {
-            await rename(movedPath, path);
-        }
-        catch { }
-        return false;
-    }
-    await rm(movedPath, { force: true, recursive: true });
-    return true;
-}
-async function cleanDeadPolicyArtifacts(directory, budget) {
-    let names;
-    try {
-        names = await readdir(directory);
-    }
-    catch {
-        return;
-    }
-    // ponytail: list/sort all names; stream directories if enumeration becomes the bottleneck.
-    const candidates = names.filter((name) => name.startsWith(".pi-agent-browser-policy-remove-")
-        || /^\.pi-agent-browser-policy-[a-f0-9]{64}\.lock-v4\.(?:candidate|claim)-/.test(name)).sort();
-    if (candidates.length === 0)
-        return;
-    const start = lastPolicyGcName === undefined ? randomInt(candidates.length)
-        : Math.max(0, candidates.findIndex((name) => name > lastPolicyGcName));
-    const batch = Array.from({ length: Math.min(POLICY_GC_BATCH_SIZE, candidates.length) }, (_, offset) => candidates[(start + offset) % candidates.length]);
-    lastPolicyGcName = batch.at(-1);
-    for (const name of batch) {
-        if (budget.signal?.aborted || Date.now() >= (budget.deadline ?? Infinity))
-            return;
-        const path = join(directory, name);
-        const published = name.includes(".lock-v4.claim-");
-        if (published) {
-            const entry = await lstat(path).catch(() => undefined);
-            if (!entry || entry.mtimeMs >= Date.now() - STALE_CLAIM_MIN_AGE_MS)
-                continue;
-        }
-        const claim = await readClaim(path);
-        if (!claim || (published && !name.endsWith(`.claim-${claim.owner.token}`)))
-            continue;
-        if (await ownerAlive(claim.owner, budget) === false)
-            await removeClaimOwnedBy(path, claim.owner.token).catch(() => false);
-    }
-}
-function claimPrecedes(left, right) {
-    if (left.ticket === null)
-        return true;
-    if (right.ticket === null)
-        return false;
-    return left.ticket < right.ticket || (left.ticket === right.ticket && left.owner.token < right.owner.token);
-}
-async function hasPublishedLaterTicket(claim, ownClaim) {
-    if (claim.ticket !== null)
-        return false;
-    const current = await readClaim(claim.path);
-    return current?.owner.token === claim.owner.token && !claimPrecedes(current, ownClaim);
-}
-function waitForRetry(signal) {
-    return new Promise((resolve) => {
-        if (signal?.aborted)
-            return resolve();
-        const timer = setTimeout(done, POLICY_LOCK_RETRY_MS);
-        function done() {
-            clearTimeout(timer);
-            signal?.removeEventListener("abort", done);
-            resolve();
-        }
-        signal?.addEventListener("abort", done, { once: true });
-    });
+    return withBrowserExecutionLocks({
+        identities: [options.identity],
+        signal: options.signal,
+        deadline: options.deadline,
+        waitOnly: options.waitOnly,
+    }, run);
 }
 export async function acquireManagedSessionPolicyLock(options) {
-    if (options.signal?.aborted)
+    if (options.signal?.aborted === true) {
         return undefined;
+    }
     let identity;
     try {
         identity = await resolveBrowserExecutionIdentity({ ...options, ownedManagedSession: true });
@@ -391,108 +144,22 @@ export async function acquireManagedSessionPolicyLock(options) {
     }
     const scope = executionScope.getStore();
     if (scope) {
-        if (!scope.active || !scopeCovers(scope.identities, groupExecutionIdentities([identity])))
+        if (!scope.active || !scopeCovers(scope.identities, groupExecutionIdentities([identity]))) {
             return undefined;
-        return { release: async () => undefined };
-    }
-    return acquireExecutionClaim({ identity: groupExecutionIdentities([identity])[0], signal: options.signal, timeoutMs: options.timeoutMs });
-}
-async function acquireExecutionClaim(options) {
-    if (options.signal?.aborted)
-        return undefined;
-    const deadline = options.deadline ?? Date.now() + (options.timeoutMs ?? POLICY_LOCK_WAIT_MS);
-    // timeoutMs: 0 retains the existing single-attempt policy probe contract.
-    const budget = { signal: options.signal, deadline: options.timeoutMs === 0 ? undefined : deadline };
-    const platform = process.platform;
-    const directory = getCoordinationDirectory(platform);
-    if (!await ensureCoordinationDirectory(directory, platform))
-        return undefined;
-    const basePath = getBrowserExecutionLockPath(options.identity);
-    const token = randomUUID();
-    const startIdentity = await readProcessStartIdentity(process.pid, process.platform, budget);
-    if (!startIdentity)
-        return undefined;
-    const owner = { pid: process.pid, startIdentity, token, sessionNames: options.identity.sessionNames, version: 4 };
-    const ownerContent = JSON.stringify(owner);
-    // Never publish metadata our reader cannot validate and ownership-safely remove.
-    if (Buffer.byteLength(ownerContent) > POLICY_LOCK_MAX_BYTES)
-        return undefined;
-    const candidatePath = `${basePath}.candidate-${token}`;
-    const claimPath = `${basePath}.claim-${token}`;
-    let claimPublished = false;
-    let lockAcquired = false;
-    try {
-        await mkdir(candidatePath, { mode: 0o700 });
-        await writeFile(join(candidatePath, LOCK_OWNER_FILE), ownerContent, { encoding: "utf8", flag: "wx", mode: 0o600 });
-        await rename(candidatePath, claimPath);
-        claimPublished = true;
-        const initialClaims = await readClaims(basePath);
-        if (!initialClaims)
-            return undefined;
-        const maxTicket = initialClaims.reduce((max, claim) => claim.ticket === null ? max : Math.max(max, claim.ticket), 0);
-        if (!Number.isSafeInteger(maxTicket + 1))
-            return undefined;
-        const ticket = { ticket: maxTicket + 1, token, version: 4 };
-        const ticketCandidatePath = join(claimPath, `.ticket-${token}.tmp`);
-        await writeFile(ticketCandidatePath, JSON.stringify(ticket), { encoding: "utf8", flag: "wx", mode: 0o600 });
-        await rename(ticketCandidatePath, join(claimPath, LOCK_TICKET_FILE));
-        while (!options.signal?.aborted) {
-            const claims = await readClaims(basePath);
-            if (!claims)
-                return undefined;
-            const ownClaim = claims.find((claim) => claim.owner.token === token);
-            if (!ownClaim || ownClaim.ticket !== ticket.ticket)
-                return undefined;
-            let blocked = false;
-            for (const claim of claims) {
-                const disjoint = owner.sessionNames !== null && claim.owner.sessionNames !== null
-                    && !owner.sessionNames.some(session => claim.owner.sessionNames.includes(session));
-                if (claim.owner.token === token || disjoint || !claimPrecedes(claim, ownClaim))
-                    continue;
-                // Choosing is transient: a later published ticket must not make
-                // its predecessor wait on it using an earlier null snapshot.
-                if (await hasPublishedLaterTicket(claim, ownClaim))
-                    continue;
-                const alive = await ownerAlive(claim.owner, budget);
-                if (alive === false) {
-                    await removeClaimOwnedBy(claim.path, claim.owner.token);
-                    continue;
-                }
-                // A native identity query can outlive the owner's entire critical
-                // section. Its result (including unknown after exit) does not make
-                // an already released immutable claim a current blocker.
-                try {
-                    await lstat(claim.path);
-                }
-                catch (error) {
-                    if (error.code === "ENOENT")
-                        continue;
-                }
-                // Publication can also complete during the native identity query.
-                if (await hasPublishedLaterTicket(claim, ownClaim))
-                    continue;
-                blocked = true;
-                break;
-            }
-            if (!blocked) {
-                await cleanDeadPolicyArtifacts(directory, budget);
-                if (options.signal?.aborted || (budget.deadline !== undefined && Date.now() >= budget.deadline))
-                    return undefined;
-                lockAcquired = true;
-                return { release: async () => { await removeClaimOwnedBy(claimPath, token, Date.now() + POLICY_LOCK_WAIT_MS); } };
-            }
-            if (Date.now() >= deadline)
-                return undefined;
-            await waitForRetry(options.signal);
         }
-        return undefined;
+        return {
+            release: async () => {
+                /* The outer execution owns release of this borrowed claim. */
+            },
+        };
     }
-    catch {
+    const grouped = groupExecutionIdentities([identity]).at(0);
+    if (grouped === undefined) {
         return undefined;
     }
-    finally {
-        await rm(candidatePath, { force: true, recursive: true }).catch(() => undefined);
-        if (claimPublished && !lockAcquired)
-            await removeClaimOwnedBy(claimPath, token, Date.now() + POLICY_LOCK_WAIT_MS);
-    }
+    return acquireExecutionClaim({
+        identity: grouped,
+        signal: options.signal,
+        timeoutMs: options.timeoutMs,
+    });
 }

package/dist/extensions/agent-browser/lib/managed-session-posix-storage.js

@@ -0,0 +1,58 @@
+import { lstatSync } from "node:fs";
+import { join, parse } from "node:path";
+import { getCurrentProcessUid } from "./process-identity.js";
+function androidSystemAncestor(path, entry, platform) {
+    return (platform === "android" &&
+        (path === "/data" || path === "/data/data") &&
+        entry.uid === 1000 &&
+        (entry.mode & 0o002) === 0);
+}
+function androidAppDirectory(entry, uid, platform) {
+    return (platform === "android" && entry.uid === uid && entry.gid === uid && (entry.mode & 0o002) === 0);
+}
+function ancestorModeTrusted(entry, android) {
+    const rootSticky = entry.uid === 0 && (entry.mode & 0o1000) !== 0;
+    return (entry.mode & 0o022) === 0 || rootSticky || android.system || android.app;
+}
+function ancestorTrusted(path, entry, uid, platform) {
+    if (entry.isSymbolicLink() || !entry.isDirectory()) {
+        return false;
+    }
+    const system = androidSystemAncestor(path, entry, platform);
+    if (!system && entry.uid !== 0 && entry.uid !== uid) {
+        return false;
+    }
+    return ancestorModeTrusted(entry, { system, app: androidAppDirectory(entry, uid, platform) });
+}
+export function isTrustedPosixDirectory(path, requireCurrentOwner, platform = process.platform) {
+    const uid = getCurrentProcessUid();
+    if (uid === undefined) {
+        return false;
+    }
+    const root = parse(path).root;
+    let cursor = root;
+    for (const component of path.slice(root.length).split("/").filter(Boolean)) {
+        cursor = join(cursor, component);
+        try {
+            if (!ancestorTrusted(cursor, lstatSync(cursor), uid, platform)) {
+                return false;
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    try {
+        return !requireCurrentOwner || lstatSync(path).uid === uid;
+    }
+    catch {
+        return false;
+    }
+}
+export function isTrustedCurrentFile(entry, platform, forbiddenMode) {
+    if (platform === "win32") {
+        return true;
+    }
+    const uid = getCurrentProcessUid();
+    return uid !== undefined && entry.uid === uid && (entry.mode & forbiddenMode) === 0;
+}