rea-agents 3.1.0 → 3.2.0

package/dist/application/ProcessCheckpoints.js

@@ -1,4 +1,5 @@
 import { snapshotRoots } from "./FilesystemSnapshot.js";
+import { scheduleProcessDelay } from "./ProcessTimer.js";
 /** Classify path-stable filesystem effects between two bounded states. */
 export const classifyFilesystemEffects = (before, after) => {
     const beforeByPath = new Map(before.map((file) => [file.path, file]));
@@ -8,14 +9,31 @@ export const classifyFilesystemEffects = (before, after) => {
         .map((path) => {
         const beforeFile = beforeByPath.get(path) ?? null;
         const afterFile = afterByPath.get(path) ?? null;
-        const status = beforeFile === null
-            ? "created"
-            : afterFile === null
-                ? "deleted"
-                : JSON.stringify(beforeFile) === JSON.stringify(afterFile)
-                    ? "unchanged"
-                    : "modified";
-        return { path, status, before: beforeFile, after: afterFile };
+        if (beforeFile === null) {
+            if (afterFile === null)
+                throw new TypeError(`Filesystem effect ${path} has no file state`);
+            return {
+                path,
+                status: "created",
+                before: null,
+                after: afterFile,
+            };
+        }
+        if (afterFile === null)
+            return {
+                path,
+                status: "deleted",
+                before: beforeFile,
+                after: null,
+            };
+        return {
+            path,
+            status: JSON.stringify(beforeFile) === JSON.stringify(afterFile)
+                ? "unchanged"
+                : "modified",
+            before: beforeFile,
+            after: afterFile,
+        };
     });
 };
 /** Coordinates named lifecycle filesystem observations without overlapping scans. */
@@ -47,7 +65,7 @@ export class ProcessCheckpoints {
         for (const checkpoint of scenario.checkpoints) {
             if (checkpoint.trigger.type !== "time")
                 continue;
-            const timer = setTimeout(() => this.capture(checkpoint.name), checkpoint.trigger.at_ms);
+            const timer = scheduleProcessDelay(checkpoint.trigger.at_ms, () => this.capture(checkpoint.name));
             this.#timers.add(timer);
         }
     }
@@ -124,7 +142,7 @@ export class ProcessCheckpoints {
     /** Finish pending snapshots and return them in observation order. */
     async finish(after) {
         for (const timer of this.#timers)
-            clearTimeout(timer);
+            timer.cancel();
         await this.#pending;
         const previous = this.#captures.at(-1)?.files ?? [];
         const index = this.#captures.length;
@@ -141,7 +159,7 @@ export class ProcessCheckpoints {
     /** Cancel scheduled captures and await any snapshot already in progress. */
     async dispose() {
         for (const timer of this.#timers)
-            clearTimeout(timer);
+            timer.cancel();
         this.#timers.clear();
         await this.#pending;
     }

package/dist/application/ProcessCli.js

@@ -1,16 +1,16 @@
+import { projectPermissionFailure } from "./PermissionFailure.js";
 import { readFile } from "node:fs/promises";
 import { parseConfig } from "../config.js";
-import { AnalysisError, AnalysisInputError, AnalysisProtocolError, PermissionRequiredError, projectAnalysisError, } from "../domain/errors.js";
+import { AnalysisError, AnalysisInputError, projectAnalysisError, } from "../domain/errors.js";
 import { createEvidence, parseEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { projectInputIssues } from "../domain/inputIssueProjection.js";
 import { processTraceSpecificationSchema } from "../domain/processTraceComparison.js";
-import { compareProcessCaptures, LEGACY_PROCESS_CAPTURE_MESSAGE, parseProcessScenario, parseProcessCapture, } from "../domain/processCapture.js";
+import { compareProcessCaptures, parseProcessScenario, parseProcessCapture, } from "../domain/processCapture.js";
 import { captureProcessScenario } from "./ProcessHarness.js";
 import { processCapturePermissionRequest } from "./ProcessCapturePermission.js";
 import { PROCESS_PROVIDER, createProcessCaptureEvidence, } from "./ProcessEvidence.js";
 import { loadConfiguredPermissionAuthority } from "./PermissionConfiguration.js";
-const MAX_INPUT_BYTES = 64 * 1024 * 1024;
 /** Capture one JSON scenario through the same policy and evidence contract as MCP. */
 export const captureProcessScenarioFile = async (path) => {
     try {
@@ -30,11 +30,7 @@ export const captureProcessScenarioFile = async (path) => {
             return cliAnalysisError(authority.error);
         const authorized = await authority.value.authorize(processCapturePermissionRequest(scenario), "read");
         if (!authorized.ok)
-            return cliAnalysisError(authorized.error instanceof PermissionRequiredError
-                ? authorized.error
-                : new AnalysisProtocolError(authorized.error.message, {
-                    cause: authorized.error,
-                }));
+            return cliAnalysisError(projectPermissionFailure(authorized.error));
         const captured = await captureProcessScenario(scenario, config.value.processExecutionPolicy);
         if (!captured.ok)
             return cliAnalysisError(captured.error);
@@ -58,9 +54,7 @@ export const compareProcessEvidenceFiles = async (leftPath, rightPath, traceSpec
                 traceSpecification,
             });
         return createEvidence(undefined, PROCESS_PROVIDER, {
-            predicateType: traceSpecification === undefined
-                ? "rea.process-comparison/v3"
-                : "rea.process-comparison/v4",
+            predicateType: "rea.process-comparison",
             operation: "compare_process_captures",
             parameters: {
                 left_evidence_id: left.id,
@@ -92,11 +86,9 @@ const parseCaptureEvidence = (input) => {
         throw invalidCaptureEvidence();
     }
     if (evidence.operation !== "capture_process_scenario" ||
-        evidence.predicate_type !== "rea.process-capture/v4" ||
+        evidence.predicate_type !== "rea.process-capture" ||
         evidence.provider.id !== PROCESS_PROVIDER.id ||
         evidence.provider.version !== PROCESS_PROVIDER.version) {
-        if (evidence.predicate_type === "rea.process-capture/v3")
-            throw new ProcessCliFailure("invalid_input", LEGACY_PROCESS_CAPTURE_MESSAGE);
         throw new ProcessCliFailure("invalid_input", "Capture evidence is not from the current process-capture workflow. Create new capture evidence, then try again.");
     }
     try {
@@ -125,8 +117,6 @@ const readJson = async (path) => {
     catch {
         throw new ProcessCliFailure("invalid_input", "Process input file could not be read. Check that the path exists and is readable.");
     }
-    if (bytes.length > MAX_INPUT_BYTES)
-        throw new ProcessCliFailure("truncated", "Process input file is too large. Reduce it below 64 MiB, then try again.");
     try {
         const parsed = JSON.parse(bytes.toString("utf8"));
         return parsed;

package/dist/application/ProcessEvidence.js

@@ -1,7 +1,6 @@
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { parseProcessCapture } from "../domain/processCapture.js";
-/** Provider identity for controlled Process Capture v4 evidence. */
+/** Provider identity for controlled process capture evidence. */
 export const PROCESS_PROVIDER = {
     id: "rea-process",
     name: "REA deterministic process harness",
@@ -17,14 +16,13 @@ const processEvidenceParameters = (scenario) => ({
     command_shim_count: scenario.command_shims.length,
     normalization: scenario.normalization,
 });
-/** Create one canonical observed Process Capture v4 Evidence record. */
+/** Create one canonical observed process capture Evidence record. */
 export const createProcessCaptureEvidence = (scenario, capture) => {
-    const validatedCapture = parseProcessCapture(capture);
     return createEvidence(undefined, PROCESS_PROVIDER, {
-        predicateType: "rea.process-capture/v4",
+        predicateType: "rea.process-capture",
         operation: "capture_process_scenario",
         parameters: processEvidenceParameters(scenario),
-        result: jsonValueSchema.parse(validatedCapture),
+        result: jsonValueSchema.parse(capture),
         confidence: "observed",
         authority: "controlled-replay",
         environment: {
@@ -33,6 +31,6 @@ export const createProcessCaptureEvidence = (scenario, capture) => {
             architecture: process.arch,
             isolation: "process",
         },
-        limitations: validatedCapture.limitations,
+        limitations: capture.limitations,
     });
 };

package/dist/application/ProcessHarness.js

@@ -1,4 +1,4 @@
-import { validateProcessCapture } from "../domain/processCapture.js";
+import { parseProcessCapture } from "../domain/processCapture.js";
 import { err, ok } from "../domain/result.js";
 import { ProcessCaptureError, processCaptureCancelled, } from "./ProcessCaptureError.js";
 export { ProcessCaptureError } from "./ProcessCaptureError.js";
@@ -33,11 +33,35 @@ const createTerminalRenderer = (scenario, temporaryRoot, terminalPid, recordEven
     columns: scenario.terminal.columns,
     rows: scenario.terminal.rows,
     scrollback: scenario.terminal.scrollback,
-    maxFrames: scenario.limits.frames,
     maxBytes: scenario.limits.output_bytes,
     normalize: (value) => normalizeProcessText(value, scenario, temporaryRoot, terminalPid()),
     recordEvent,
 });
+/**
+ * Wait until the capture journal stops growing.
+ *
+ * node-pty reports buffered output through `onData` callbacks rather than an
+ * awaitable read, so chunks can still be in flight after the child exits. The
+ * quiet interval is measured in elapsed time rather than scheduler turns:
+ * consecutive `setImmediate` turns elapse in microseconds, so any fixed number
+ * of them finishes long before a delayed pty callback under host contention,
+ * which is exactly when the trailing chunk matters. `maxWaitMs` bounds the
+ * total wait so a pathological stream cannot stall exit.
+ */
+const settleTrailingJournal = async (journal, quietMs = 25, maxWaitMs = 500) => {
+    const deadline = Date.now() + maxWaitMs;
+    let observed = journal.length;
+    let lastChangeAt = Date.now();
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, 4));
+        if (journal.length !== observed) {
+            observed = journal.length;
+            lastChangeAt = Date.now();
+        }
+        else if (Date.now() - lastChangeAt >= quietMs)
+            return;
+    }
+};
 const reactiveCapture = (options, protocolEvents) => ({
     ...options,
     processSamples: options.samples,
@@ -154,24 +178,28 @@ const finishProcessRun = async (options) => {
         });
     await options.runtime?.reactive?.coordinator.close();
     let { capture, executionFailure } = options;
-    if (capture !== undefined) {
-        capture = {
+    let verifiedCapture;
+    if (capture !== undefined && cleanupFailure === undefined) {
+        const settlement = capture.settlement.state === "quiesced"
+            ? { ...capture.settlement, cleanup_outcome: "not_required" }
+            : { ...capture.settlement, cleanup_outcome: "cleaned" };
+        const completedCapture = {
             ...capture,
             reactive_run: projectProcessReactiveRun(options.runtime?.reactive),
-            settlement: {
-                ...capture.settlement,
-                cleanup_outcome: capture.settlement.state === "quiesced"
-                    ? "not_required"
-                    : cleanupFailure === undefined
-                        ? "cleaned"
-                        : "failed",
+            settlement,
+            cleanup: {
+                owned_process_group: "verified",
+                temporary_root: "removed",
             },
         };
-        const issue = validateProcessCapture(capture)[0];
-        if (issue !== undefined)
-            executionFailure = new ProcessCaptureError(`process capture validation failed: ${issue.path}: ${issue.message}`);
+        try {
+            verifiedCapture = parseProcessCapture(completedCapture);
+        }
+        catch (cause) {
+            executionFailure = new ProcessCaptureError(`process capture validation failed${cause instanceof Error ? `: ${cause.message}` : ""}`, { cause });
+        }
     }
-    return resolveProcessResult(capture, executionFailure, cleanupFailure);
+    return resolveProcessResult(verifiedCapture, executionFailure, cleanupFailure);
 };
 const completeCapture = async (options) => {
     const { runtime, scenario } = options;
@@ -192,6 +220,14 @@ const completeCapture = async (options) => {
         // during settlement after the PTY exits. Make target loss terminal only
         // after that journal has drained, otherwise the coordinator's control
         // priority discards a valid multi-source completion predicate.
+        //
+        // Draining the coordinator is not sufficient on its own: node-pty delivers
+        // buffered output through onData callbacks, which run outside the
+        // coordinator's queue. A trailing chunk that has not been delivered yet has
+        // produced no journal entry, so the drain has nothing to wait for and the
+        // target is declared lost while a terminal trigger is still satisfiable.
+        // Let any trailing chunks land first.
+        await settleTrailingJournal(options.eventJournal);
         await runtime.reactive.coordinator.drain();
         await runtime.reactive.coordinator.submit({ kind: "target_lost" });
         runtime.reactive.unsubscribe();
@@ -215,7 +251,6 @@ const completeCapture = async (options) => {
         exit: { ...options.exit, reason },
         samples: options.samples,
         replay: runtime.replay,
-        reactiveRun: projectProcessReactiveRun(runtime.reactive),
         before: options.before,
         after,
         truncated,
@@ -226,7 +261,7 @@ const completeCapture = async (options) => {
         interactions: options.interactions,
         checkpoints,
         shimEvents: normalizedShimEvents(runtime, scenario, options.temporaryRoot),
-        settlement: { ...settlement, cleanup_outcome: "not_required" },
+        settlement,
         manifest,
         eventJournal: options.eventJournal,
     });

package/dist/application/ProcessReactiveCoordinator.js

@@ -1,9 +1,7 @@
 import { commitProcessReactiveProposal, createProcessReactiveSnapshot, reduceProcessReactiveScenario, } from "../domain/processReactiveRuntime.js";
+import { scheduleProcessDelay } from "./ProcessTimer.js";
 const systemTimerHost = {
-    schedule: (callback, delayMs) => {
-        const timer = setTimeout(callback, delayMs);
-        return { cancel: () => clearTimeout(timer) };
-    },
+    schedule: (callback, delayMs) => scheduleProcessDelay(delayMs, callback),
 };
 /**
  * Serializes live observations, deadlines, and effect commits for one run.

package/dist/application/ProcessReactiveEffects.js

@@ -1,4 +1,5 @@
 import { createProcessObservation } from "../domain/processObservation.js";
+import { normalizeProcessElapsedTime } from "./ProcessNormalization.js";
 const elapsed = (host) => Math.max(0, host.now() - host.startedAtMs);
 const interactionData = (action) => {
     if (action.type === "send_input")
@@ -20,12 +21,17 @@ const interactionType = (action) => {
         return "stdin_close";
     return "signal";
 };
-const performTerminalAction = (terminal, renderer, action, atMs) => {
+const performTerminalAction = (host, terminal, action, atMs) => {
     if (action.type === "send_input")
         terminal.write(action.data);
     else if (action.type === "resize") {
         terminal.resize(action.columns, action.rows);
-        renderer.resize(action.columns, action.rows, atMs);
+        // Rendered frames share the normalized clock used by captured terminal
+        // frames and by the scheduled-event resize path. Passing the raw elapsed
+        // time here stamped this frame on a different clock, so the next bucketed
+        // frame could appear to move backwards and fail capture validation with
+        // "rendered_frames: timestamps must be ordered".
+        host.renderer.resize(action.columns, action.rows, normalizeProcessElapsedTime(atMs, host.timeBucketMs));
     }
     else if (action.type === "close_stdin")
         terminal.closeInput();
@@ -67,7 +73,7 @@ const executeTerminalAction = (host, action) => {
     const atMs = elapsed(host);
     let outcome = "dispatched";
     try {
-        performTerminalAction(terminal, host.renderer, action, atMs);
+        performTerminalAction(host, terminal, action, atMs);
     }
     catch {
         outcome = "failed";

package/dist/application/ProcessReactiveHarness.js

@@ -49,6 +49,7 @@ export const startProcessReactiveHarness = (options) => {
                 journal: options.capture.journal,
                 startedAtMs: options.started,
                 now: Date.now,
+                timeBucketMs: options.scenario.normalization.time_bucket_ms,
             }, actions, signal),
         },
         onDecision: (decision, input) => {
@@ -89,12 +90,17 @@ export const startProcessReactiveHarness = (options) => {
     };
 };
 /** Project internal reducer state into the stable Process Capture shape. */
-export const projectProcessReactiveRun = (harness) => harness === undefined
-    ? null
-    : {
-        status: harness.coordinator.snapshot.status,
-        outcome: harness.coordinator.snapshot.outcome,
-        active_state: harness.coordinator.snapshot.active_state,
-        transitions: harness.coordinator.snapshot.transitions,
+export const projectProcessReactiveRun = (harness) => {
+    if (harness === undefined)
+        return null;
+    const snapshot = harness.coordinator.snapshot;
+    const completion = snapshot.status === "running"
+        ? { status: snapshot.status, outcome: null }
+        : { status: snapshot.status, outcome: snapshot.outcome };
+    return {
+        ...completion,
+        active_state: snapshot.active_state,
+        transitions: snapshot.transitions,
         controls: harness.controls,
     };
+};

package/dist/application/ProcessSampling.js

@@ -1,8 +1,6 @@
-import { execFile } from "node:child_process";
 import { readFile, readdir } from "node:fs/promises";
-import { promisify } from "node:util";
+import { execFileOutput } from "../process/ExecFileOutput.js";
 import { readProcessRunId } from "../process/ProcessOwnership.js";
-const execFileAsync = promisify(execFile);
 const PROC_READ_CONCURRENCY = 64;
 /** Prove that forkpty completed session setup and installed the run token. */
 export const isInitializedPtyRoot = (options) => {
@@ -210,7 +208,7 @@ const sampleLinux = async (context) => {
     return rows;
 };
 const readPsRows = async (signal) => {
-    const { stdout } = await execFileAsync("ps", ["-axo", "pid=,ppid=,pgid=,sess=,command="], { signal });
+    const { stdout } = await execFileOutput("ps", ["-axo", "pid=,ppid=,pgid=,sess=,command="], { signal });
     return stdout
         .split("\n")
         .map((line) => /\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(.*)/u.exec(line))

package/dist/application/ProcessTimer.js

@@ -0,0 +1,39 @@
+const systemTimerScheduler = (callback, delayMs) => {
+    const timer = setTimeout(callback, delayMs);
+    return { cancel: () => clearTimeout(timer) };
+};
+/** Schedule a delay using consecutive Node timers without shortening long waits. */
+export const scheduleProcessDelay = (delayMs, callback, schedule = systemTimerScheduler) => {
+    if (!Number.isSafeInteger(delayMs) || delayMs < 0)
+        throw new RangeError("Process delay must be a nonnegative safe integer");
+    const maximumTimerDelay = 2_147_483_647;
+    let remaining = delayMs;
+    let timer;
+    let cancelled = false;
+    const scheduleNext = () => {
+        if (cancelled)
+            return;
+        const interval = Math.min(remaining, maximumTimerDelay);
+        timer = schedule(() => {
+            if (cancelled)
+                return;
+            remaining -= interval;
+            if (remaining === 0)
+                callback();
+            else
+                scheduleNext();
+        }, interval);
+    };
+    scheduleNext();
+    return {
+        cancel: () => {
+            cancelled = true;
+            timer?.cancel();
+        },
+    };
+};
+/** Create an owned interval that shares process-capture cancellation handling. */
+export const scheduleProcessInterval = (callback, intervalMs) => {
+    const timer = setInterval(callback, intervalMs);
+    return { cancel: () => clearInterval(timer) };
+};

package/dist/application/ProjectPermissionStore.js

@@ -1,32 +1,16 @@
+import { createStoreFileLock, removeStaleStoreFileLock, } from "./StoreFileLock.js";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readFile, realpath, unlink, } from "node:fs/promises";
+import { lstat, mkdir, open, realpath, } from "node:fs/promises";
 import { dirname } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
+import { PERMISSION_CAPABILITIES, } from "../domain/permissionPolicy.js";
 import { err, ok } from "../domain/result.js";
 const grantSchema = z.object({
     grant_id: z.string().min(1),
-    capability: z.enum([
-        "process_capture",
-        "browser_observe",
-        "browser_automate",
-        "electron_observe",
-        "electron_automate",
-        "evidence_read",
-        "evidence_write",
-        "investigation_input",
-        "investigation_workspace_read",
-        "investigation_workspace_write",
-        "snapshot_read",
-        "snapshot_write",
-        "artifact_extract",
-        "native_mount",
-        "reference_read",
-        "javascript_replay",
-        "managed_runtime",
-    ]),
+    capability: z.enum(PERMISSION_CAPABILITIES),
     roots: z.array(z.string()),
     executables: z.array(z.string()),
     environment_names: z.array(z.string()),
@@ -38,10 +22,9 @@ const grantSchema = z.object({
     expires_at: z.iso.datetime().nullable(),
 });
 const storeSchema = z.object({
-    schema_version: z.literal(1),
     project_id: z.string().regex(/^project_[a-f0-9]{64}$/u),
     project_root: z.string(),
-    grants: z.array(grantSchema).max(1_000),
+    grants: z.array(grantSchema),
 });
 /** Owner-only project policy persistence failure. */
 export class ProjectPermissionStoreError extends Error {
@@ -110,7 +93,6 @@ export const writeProjectPermissionStore = async (path, projectRoot, grants) =>
     if (!project.ok)
         return project;
     const candidate = storeSchema.safeParse({
-        schema_version: 1,
         project_id: project.value.id,
         project_root: project.value.root,
         grants,
@@ -119,26 +101,38 @@ export const writeProjectPermissionStore = async (path, projectRoot, grants) =>
         return err(new ProjectPermissionStoreError("invalid", { cause: candidate.error }));
     if (process.getuid === undefined)
         return err(new ProjectPermissionStoreError("not_owner_only"));
-    try {
-        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        await writeFileAtomic(path, `${JSON.stringify(candidate.data, null, 2)}\n`, {
-            encoding: "utf8",
-            mode: 0o600,
-        });
-        const verified = await readProjectPermissionStore(path, projectRoot);
-        if (!verified.ok)
-            return verified;
-        if (verified.value === null ||
-            JSON.stringify(verified.value) !== JSON.stringify(candidate.data))
-            return err(new ProjectPermissionStoreError("invalid"));
-        return ok(candidate.data);
-    }
-    catch (cause) {
-        return err(new ProjectPermissionStoreError("io", { cause }));
-    }
+    return withPermissionStoreLock(path, () => writePreparedPermissionStore(path, projectRoot, candidate.data));
+};
+const writePreparedPermissionStore = async (path, projectRoot, candidate) => {
+    await writeFileAtomic(path, `${JSON.stringify(candidate, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    const verified = await readProjectPermissionStore(path, projectRoot);
+    if (!verified.ok)
+        return verified;
+    if (verified.value === null ||
+        JSON.stringify(verified.value) !== JSON.stringify(candidate))
+        return err(new ProjectPermissionStoreError("invalid"));
+    return ok(candidate);
 };
 /** Revoke one grant while serializing the complete read-modify-write cycle. */
-export const revokeProjectPermissionGrant = async (path, projectRoot, grantId) => {
+export const revokeProjectPermissionGrant = async (path, projectRoot, grantId) => withPermissionStoreLock(path, async () => {
+    const current = await readProjectPermissionStore(path, projectRoot);
+    if (!current.ok)
+        return current;
+    if (current.value === null)
+        return ok(false);
+    const retained = current.value.grants.filter(({ grant_id }) => grant_id !== grantId);
+    if (retained.length === current.value.grants.length)
+        return ok(false);
+    const written = await writePreparedPermissionStore(path, projectRoot, {
+        ...current.value,
+        grants: retained,
+    });
+    return written.ok ? ok(true) : written;
+});
+const withPermissionStoreLock = async (path, action) => {
     let lock;
     try {
         await mkdir(dirname(path), { recursive: true, mode: 0o700 });
@@ -146,34 +140,26 @@ export const revokeProjectPermissionGrant = async (path, projectRoot, grantId) =
         if (!acquired.ok)
             return acquired;
         lock = acquired.value;
-        const current = await readProjectPermissionStore(path, projectRoot);
-        if (!current.ok)
-            return current;
-        const grants = current.value?.grants ?? [];
-        const retained = grants.filter(({ grant_id }) => grant_id !== grantId);
-        if (retained.length === grants.length)
-            return ok(false);
-        const written = await writeProjectPermissionStore(path, projectRoot, retained);
-        return written.ok ? ok(true) : written;
+        return await action();
     }
     catch (cause) {
         return err(new ProjectPermissionStoreError("io", { cause }));
     }
     finally {
         if (lock !== undefined)
-            await releasePermissionStoreLock(lock);
+            await lock.release();
     }
 };
 const acquirePermissionStoreLock = async (destination) => {
     const path = `${destination}.lock`;
     for (let attempt = 0; attempt < 100; attempt += 1) {
         try {
-            return ok(await createPermissionStoreLock(path));
+            return ok(await createStoreFileLock(path));
         }
         catch (cause) {
             if (!isAlreadyExists(cause))
                 return err(new ProjectPermissionStoreError("io", { cause }));
-            if (await removeStalePermissionStoreLock(path))
+            if (await removeStaleStoreFileLock(path))
                 continue;
             if (attempt === 99)
                 return err(new ProjectPermissionStoreError("locked", { cause }));
@@ -182,49 +168,6 @@ const acquirePermissionStoreLock = async (destination) => {
     }
     return err(new ProjectPermissionStoreError("locked"));
 };
-const createPermissionStoreLock = async (path) => {
-    const handle = await open(path, "wx", 0o600);
-    try {
-        await handle.writeFile(`${String(process.pid)}\n`, "utf8");
-        await handle.sync();
-        return { path, handle };
-    }
-    catch (cause) {
-        await handle.close().catch(() => undefined);
-        await unlink(path).catch(() => undefined);
-        throw cause;
-    }
-};
-const removeStalePermissionStoreLock = async (path) => {
-    try {
-        const metadata = await lstat(path);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > 32)
-            return false;
-        const encoded = (await readFile(path, "utf8")).trim();
-        if (!/^[1-9][0-9]{0,9}$/u.test(encoded))
-            return false;
-        if (processIsAlive(Number(encoded)))
-            return false;
-        await unlink(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-const processIsAlive = (pid) => {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (cause) {
-        return errorCode(cause) !== "ESRCH";
-    }
-};
-const releasePermissionStoreLock = async (lock) => {
-    await lock.handle.close().catch(() => undefined);
-    await unlink(lock.path).catch(() => undefined);
-};
 const isNotFound = (cause) => errorCode(cause) === "ENOENT";
 const openPrivateStore = async (path) => {
     let handle;