sneakoscope 8.1.2 → 8.2.0

package/dist/core/release/stage-publish.js

@@ -1,10 +1,14 @@
+import crypto from 'node:crypto';
 import path from 'node:path';
 import fs from 'node:fs';
 import { RELEASE_ORIGIN_IDENTITY, releaseOriginIdentity } from './release-origin.js';
 import { exactNpmStageCliInvocation, localNpmStageReviewEnvironmentBlocker, REQUIRED_NPM_STAGE_CLI_VERSION } from './npm-stage-contract.js';
+import { PHYSICAL_RELEASE_EVIDENCE_REPOSITORY } from './physical-release-gates.js';
+import { NPM_STAGE_PUBLISH_RECEIPT_SCHEMA, STAGE_DISPATCH_NONCE_PATTERN } from './npm-stage-tarball-verifier-support.js';
 export const STAGE_PUBLISH_SCHEMA = 'sks.release-stage-publish.v1';
 export const STAGE_WORKFLOW_FILE = 'publish-npm.yml';
 export const RELEASE_BRANCH = 'main';
+export const STAGE_RUN_NAME_PREFIX = 'npm-stage';
 const NPM_REGISTRY = 'https://registry.npmjs.org/';
 const STAGE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export function stagePublish(opts) {
@@ -12,20 +16,27 @@ export function stagePublish(opts) {
     const steps = [];
     const packageIdentity = readPackageIdentity(opts.root, readJsonFile);
     const version = String(opts.version || packageIdentity.version || '').trim();
+    const physicalEvidenceRunId = String(opts.physicalEvidenceRunId || '').trim();
     const confirmed = opts.confirm === true;
     let commit = null;
     let runId = null;
     let stageId = null;
+    let dispatchNonce = null;
     const preflight = runPreflight(opts, packageIdentity.name, version);
     steps.push(...preflight.steps);
     commit = preflight.commit;
     if (!preflight.ok)
         return finish();
     if (!confirmed) {
-        steps.push(skipped('push', 'confirm_required'), skipped('run_snapshot', 'confirm_required'), skipped('dispatch', 'confirm_required'));
+        steps.push(skipped('dispatch_nonce', 'confirm_required'), skipped('push', 'confirm_required'), skipped('run_snapshot', 'confirm_required'), skipped('dispatch', 'confirm_required'));
         steps.push(skipped('watch', 'confirm_required'), skipped('download', 'confirm_required'), skipped('verify', 'confirm_required'));
         return finish();
     }
+    dispatchNonce = String((opts.generateDispatchNonce || defaultDispatchNonce)()).trim();
+    const dispatchNonceOk = STAGE_DISPATCH_NONCE_PATTERN.test(dispatchNonce);
+    steps.push(step('dispatch_nonce', dispatchNonceOk, dispatchNonceOk ? dispatchNonce : null, dispatchNonceOk ? null : 'stage_dispatch_nonce_invalid'));
+    if (!dispatchNonceOk)
+        return finish();
     const push = opts.run('git', ['push', 'origin', RELEASE_BRANCH]);
     steps.push(step('push', push.status === 0, `git push origin ${RELEASE_BRANCH}`, push.status === 0 ? null : 'stage_push_failed'));
     if (push.status !== 0)
@@ -38,13 +49,16 @@ export function stagePublish(opts) {
         'workflow', 'run', STAGE_WORKFLOW_FILE,
         '--ref', RELEASE_BRANCH,
         '-f', `version=${version}`,
+        '-f', `dispatch_nonce=${dispatchNonce}`,
+        '-f', `physical_evidence_run_id=${physicalEvidenceRunId}`,
         '-f', 'confirm_stage=true'
     ]);
-    steps.push(step('dispatch', dispatch.status === 0, `gh workflow run ${STAGE_WORKFLOW_FILE} version=${version} confirm_stage=true`, dispatch.status === 0 ? null : 'stage_dispatch_failed'));
+    steps.push(step('dispatch', dispatch.status === 0, `gh workflow run ${STAGE_WORKFLOW_FILE} version=${version} dispatch_nonce=${dispatchNonce} physical_evidence_run_id=${physicalEvidenceRunId} confirm_stage=true`, dispatch.status === 0 ? null : 'stage_dispatch_failed'));
     if (dispatch.status !== 0)
         return finish();
-    runId = resolveRunId(opts, commit, priorRuns.ids);
-    steps.push(step('resolve_run', Boolean(runId), runId ? `run ${runId}` : null, runId ? null : 'stage_run_not_found'));
+    const resolvedRun = resolveRunId(opts, commit, priorRuns.ids, stageRunDisplayTitle(version, dispatchNonce, physicalEvidenceRunId));
+    runId = resolvedRun.runId;
+    steps.push(step('resolve_run', Boolean(runId), runId ? `run ${runId}` : null, runId ? null : resolvedRun.blocker));
     if (!runId)
         return finish();
     const watch = opts.run('gh', ['run', 'watch', runId, '--exit-status'], { timeoutMs: opts.watchTimeoutMs ?? 3 * 60 * 60 * 1000 });
@@ -52,11 +66,11 @@ export function stagePublish(opts) {
     if (watch.status !== 0)
         return finish();
     const artifactDir = opts.artifactDir || path.join(opts.root, '.sneakoscope', 'reports', 'release', version, 'stage');
-    const download = downloadArtifacts(opts, runId, commit, artifactDir);
+    const download = downloadArtifacts(opts, runId, commit, dispatchNonce, artifactDir);
     steps.push(download.step);
     if (!download.step.ok)
         return finish();
-    const receipt = readStageReceipt(artifactDir, commit, readJsonFile);
+    const receipt = readStageReceipt(artifactDir, commit, dispatchNonce, physicalEvidenceRunId, runId, readJsonFile);
     stageId = receipt.stageId;
     steps.push(step('stage_receipt', Boolean(stageId), receipt.path, stageId ? null : receipt.blocker));
     if (!stageId || !receipt.path)
@@ -65,7 +79,10 @@ export function stagePublish(opts) {
         handoffDir: receipt.handoffDir,
         stageReceiptPath: receipt.path,
         version,
-        stageId
+        stageId,
+        dispatchNonce,
+        physicalEvidenceRunId,
+        workflowRunId: runId
     });
     steps.push(verify);
     return finish();
@@ -77,6 +94,9 @@ export function stagePublish(opts) {
             ok: blockers.length === 0 && (confirmed ? reachedApproval : true),
             confirmed,
             version,
+            release_tag: `v${version}`,
+            physical_evidence_run_id: /^\d+$/.test(physicalEvidenceRunId) ? physicalEvidenceRunId : null,
+            dispatch_nonce: dispatchNonce,
             commit,
             run_id: runId,
             stage_id: stageId,
@@ -104,11 +124,24 @@ function runPreflight(opts, packageName, version) {
     const steps = [];
     const branch = text(opts.run('git', ['rev-parse', '--abbrev-ref', 'HEAD']));
     steps.push(step('branch', branch === RELEASE_BRANCH, branch, branch === RELEASE_BRANCH ? null : 'stage_requires_main_branch'));
+    const commit = text(opts.run('git', ['rev-parse', 'HEAD'])) || null;
     const status = opts.run('git', ['status', '--porcelain']);
     const clean = status.status === 0 && text(status) === '';
     steps.push(step('clean_tree', clean, clean ? 'clean' : 'dirty', clean ? null : 'stage_requires_clean_tree'));
     const versionOk = /^\d+\.\d+\.\d+$/.test(version);
     steps.push(step('version', versionOk, version || null, versionOk ? null : 'stage_version_invalid'));
+    const releaseTag = versionOk ? `v${version}` : '';
+    const localTag = releaseTag
+        ? text(opts.run('git', ['rev-parse', `refs/tags/${releaseTag}^{commit}`]))
+        : '';
+    const localTagOk = Boolean(commit) && localTag === commit;
+    steps.push(step('local_release_tag', localTagOk, localTag || releaseTag || null, localTagOk ? null : 'stage_local_release_tag_mismatch'));
+    const remoteTagResult = releaseTag
+        ? opts.run('git', ['ls-remote', '--exit-code', 'origin', `refs/tags/${releaseTag}`, `refs/tags/${releaseTag}^{}`])
+        : { status: 1, stdout: '', stderr: '' };
+    const remoteTag = remoteTagResult.status === 0 ? remoteReleaseTagCommit(remoteTagResult.stdout, releaseTag) : '';
+    const remoteTagOk = Boolean(commit) && remoteTag === commit;
+    steps.push(step('remote_release_tag', remoteTagOk, remoteTag || releaseTag || null, remoteTagOk ? null : 'stage_remote_release_tag_mismatch'));
     const packageNameOk = packageName.length > 0;
     steps.push(step('package_name', packageNameOk, packageName || null, packageNameOk ? null : 'stage_package_name_invalid'));
     const origin = releaseOriginIdentity(opts.root);
@@ -122,11 +155,27 @@ function runPreflight(opts, packageName, version) {
     const verifierReady = fs.existsSync(verifier);
     steps.push(step('local_review_verifier', verifierReady, verifierReady ? verifier : null, verifierReady ? null : 'stage_verifier_unavailable_outside_checkout'));
     const physicalVerifier = path.join(opts.root, 'dist', 'scripts', 'release-physical-gates-check.js');
-    const physical = opts.run(process.execPath, [physicalVerifier]);
+    const physicalEvidenceRunId = String(opts.physicalEvidenceRunId || '').trim();
+    const physicalEvidenceRunIdReady = /^\d+$/.test(physicalEvidenceRunId);
+    steps.push(step('physical_evidence_run_id', physicalEvidenceRunIdReady, physicalEvidenceRunId || null, physicalEvidenceRunIdReady ? null : 'stage_physical_evidence_run_id_invalid'));
+    const physicalArgs = [
+        physicalVerifier,
+        ...(opts.physicalEvidenceArchive ? ['--archive', path.resolve(opts.root, opts.physicalEvidenceArchive)] : []),
+        '--evidence-run-id', physicalEvidenceRunId,
+        '--repository', PHYSICAL_RELEASE_EVIDENCE_REPOSITORY
+    ];
+    const physical = physicalEvidenceRunIdReady
+        ? opts.run(process.execPath, physicalArgs)
+        : { status: 1, stdout: '', stderr: 'physical evidence run id missing or invalid' };
     const physicalReport = safeJsonObject(physical.stdout);
-    const physicalReady = physical.status === 0 && physicalReport?.ok === true;
+    const physicalReady = physical.status === 0
+        && physicalReport?.schema === 'sks.release-physical-gates-inspection.v2'
+        && physicalReport?.ok === true
+        && physicalReport?.status === 'passed'
+        && physicalReport?.release_authorizing === true
+        && physicalReport?.inspector_platform === 'darwin';
     steps.push(step('physical_release_gates', physicalReady, physicalReady
-        ? 'all four source-bound physical release receipts verified'
+        ? 'all five source-bound physical release receipts and live Desktop Bridge artifacts verified on macOS'
         : compactPhysicalGateFailure(physical, physicalReport), physicalReady ? null : 'stage_physical_release_gates_invalid'));
     const reviewEnvironmentBlocker = localNpmStageReviewEnvironmentBlocker(opts.env || process.env);
     steps.push(step('local_review_environment', reviewEnvironmentBlocker === null, reviewEnvironmentBlocker === null ? 'maintainer-local' : reviewEnvironmentBlocker, reviewEnvironmentBlocker === null ? null : `stage_${reviewEnvironmentBlocker}`));
@@ -184,30 +233,44 @@ function runPreflight(opts, packageName, version) {
     }
     const gh = opts.run('gh', ['auth', 'status']);
     steps.push(step('gh_auth', gh.status === 0, gh.status === 0 ? 'authenticated' : null, gh.status === 0 ? null : 'stage_gh_not_authenticated'));
-    const commit = text(opts.run('git', ['rev-parse', 'HEAD'])) || null;
     return { ok: steps.every((entry) => entry.ok), commit, steps };
 }
-function resolveRunId(opts, commit, priorRunIds) {
+function remoteReleaseTagCommit(output, tag) {
+    const rows = String(output || '').trim().split(/\r?\n/).filter(Boolean);
+    const peeled = rows.find((row) => row.endsWith(`refs/tags/${tag}^{}`));
+    return text({ status: 0, stdout: peeled || rows[0] || '', stderr: '' }).split(/\s+/, 1)[0] || '';
+}
+export function stageRunDisplayTitle(version, dispatchNonce, physicalEvidenceRunId) {
+    return `${STAGE_RUN_NAME_PREFIX}-${version}-${dispatchNonce}-physical-${physicalEvidenceRunId}`;
+}
+function defaultDispatchNonce() {
+    return crypto.randomBytes(16).toString('hex');
+}
+function resolveRunId(opts, commit, priorRunIds, expectedDisplayTitle) {
     if (!commit)
-        return null;
+        return { runId: null, blocker: 'stage_run_not_found' };
     for (let attempt = 0; attempt < 30; attempt += 1) {
         const listed = listWorkflowRuns(opts);
         if (listed.status === 0) {
             const rows = safeJsonArray(listed.stdout);
-            const match = rows.find((row) => {
+            const matches = rows.filter((row) => {
                 const id = String(row?.databaseId ?? '');
                 const event = String(row?.event || '');
                 return String(row?.headSha || '') === commit
+                    && String(row?.displayTitle || '') === expectedDisplayTitle
                     && id.length > 0
                     && !priorRunIds.has(id)
-                    && (!event || event === 'workflow_dispatch');
+                    && event === 'workflow_dispatch';
             });
-            if (match?.databaseId != null)
-                return String(match.databaseId);
+            if (matches.length > 1)
+                return { runId: null, blocker: 'stage_run_ambiguous' };
+            if (matches[0]?.databaseId != null) {
+                return { runId: String(matches[0].databaseId), blocker: 'stage_run_not_found' };
+            }
         }
         opts.run('sleep', ['2']);
     }
-    return null;
+    return { runId: null, blocker: 'stage_run_not_found' };
 }
 function snapshotWorkflowRunIds(opts, commit) {
     if (!commit)
@@ -226,12 +289,12 @@ function listWorkflowRuns(opts) {
         'run', 'list',
         '--workflow', STAGE_WORKFLOW_FILE,
         '--branch', RELEASE_BRANCH,
-        '--limit', '20',
-        '--json', 'databaseId,headSha,status,event'
+        '--limit', '100',
+        '--json', 'databaseId,headSha,status,event,displayTitle'
     ]);
 }
-function downloadArtifacts(opts, runId, commit, dir) {
-    const names = stageArtifactNames(commit);
+function downloadArtifacts(opts, runId, commit, dispatchNonce, dir) {
+    const names = stageArtifactNames(commit, dispatchNonce);
     if (!names)
         return { step: step('download', false, null, 'stage_commit_unknown') };
     const args = ['run', 'download', runId, '--dir', dir];
@@ -240,16 +303,16 @@ function downloadArtifacts(opts, runId, commit, dir) {
     const result = opts.run('gh', args);
     return { step: step('download', result.status === 0, dir, result.status === 0 ? null : 'stage_artifact_download_failed') };
 }
-function stageArtifactNames(commit) {
-    if (!commit)
+function stageArtifactNames(commit, dispatchNonce) {
+    if (!commit || !STAGE_DISPATCH_NONCE_PATTERN.test(dispatchNonce))
         return null;
     return {
-        handoff: `stage-input-${commit}`,
-        receipt: `npm-stage-receipt-${commit}`
+        handoff: `stage-input-${commit}-${dispatchNonce}`,
+        receipt: `npm-stage-receipt-${commit}-${dispatchNonce}`
     };
 }
-function readStageReceipt(dir, commit, readJsonFile) {
-    const names = stageArtifactNames(commit);
+function readStageReceipt(dir, commit, dispatchNonce, physicalEvidenceRunId, workflowRunId, readJsonFile) {
+    const names = stageArtifactNames(commit, dispatchNonce);
     const layouts = names
         ? [
             {
@@ -266,9 +329,21 @@ function readStageReceipt(dir, commit, readJsonFile) {
             const stageId = String(payload?.stage_id || '').trim();
             if (!stageId)
                 continue;
+            if (payload?.schema !== NPM_STAGE_PUBLISH_RECEIPT_SCHEMA) {
+                return { stageId: null, path: file, handoffDir: layout.handoffDir, blocker: 'stage_receipt_schema_invalid' };
+            }
             if (!STAGE_ID_RE.test(stageId)) {
                 return { stageId: null, path: file, handoffDir: layout.handoffDir, blocker: 'stage_id_uuid_invalid' };
             }
+            if (String(payload?.dispatch_nonce || '') !== dispatchNonce) {
+                return { stageId: null, path: file, handoffDir: layout.handoffDir, blocker: 'stage_receipt_dispatch_nonce_mismatch' };
+            }
+            if (String(payload?.physical_evidence_run_id || '') !== physicalEvidenceRunId) {
+                return { stageId: null, path: file, handoffDir: layout.handoffDir, blocker: 'stage_receipt_physical_evidence_run_id_mismatch' };
+            }
+            if (String(payload?.workflow_run_id || '') !== workflowRunId) {
+                return { stageId: null, path: file, handoffDir: layout.handoffDir, blocker: 'stage_receipt_workflow_run_id_mismatch' };
+            }
             return { stageId, path: file, handoffDir: layout.handoffDir, blocker: null };
         }
     }
@@ -281,6 +356,9 @@ function runLocalVerify(opts, input) {
     const result = opts.run(process.execPath, [
         verifier,
         '--stage-id', input.stageId,
+        '--dispatch-nonce', input.dispatchNonce,
+        '--physical-evidence-run-id', input.physicalEvidenceRunId,
+        '--workflow-run-id', input.workflowRunId,
         '--local-receipt', path.join(input.handoffDir, 'pack-receipt.json'),
         '--local-tarball', path.join(input.handoffDir, `sneakoscope-${input.version}.tgz`),
         '--stage-receipt', input.stageReceiptPath

package/dist/core/retention/temp-lease.js

@@ -0,0 +1,204 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { exists, readJson, rmrf, SKS_TEMP_LEASE_FILE } from '../fsx.js';
+const TEMP_RETENTION_SCAN_MAX_ENTRIES = 100_000;
+const TEMP_RETENTION_SCAN_MAX_DEPTH = 20;
+export async function inspectTempPath(target) {
+    const rootStat = await fs.lstat(target).catch(() => null);
+    if (!rootStat || rootStat.isSymbolicLink()) {
+        return {
+            complete: false,
+            latestMtimeMs: 0,
+            bytes: 0,
+            blockers: [rootStat ? 'temp_path_is_symlink' : 'temp_path_missing_or_unreadable']
+        };
+    }
+    let latestMtimeMs = rootStat.mtimeMs;
+    let bytes = rootStat.isFile() ? rootStat.size : 0;
+    let entryCount = 0;
+    const blockers = [];
+    const stack = rootStat.isDirectory()
+        ? [{ dir: target, depth: 0 }]
+        : [];
+    while (stack.length) {
+        const current = stack.pop();
+        let entries;
+        try {
+            entries = await fs.readdir(current.dir, { withFileTypes: true });
+        }
+        catch {
+            blockers.push('temp_path_readdir_failed');
+            continue;
+        }
+        for (const entry of entries) {
+            entryCount += 1;
+            if (entryCount > TEMP_RETENTION_SCAN_MAX_ENTRIES) {
+                blockers.push(`temp_path_max_entries_exceeded:${TEMP_RETENTION_SCAN_MAX_ENTRIES}`);
+                return { complete: false, latestMtimeMs, bytes, blockers: [...new Set(blockers)] };
+            }
+            const child = path.join(current.dir, entry.name);
+            const stat = await fs.lstat(child).catch(() => null);
+            if (!stat) {
+                blockers.push('temp_path_stat_failed');
+                continue;
+            }
+            latestMtimeMs = Math.max(latestMtimeMs, stat.mtimeMs);
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.isDirectory()) {
+                if (current.depth >= TEMP_RETENTION_SCAN_MAX_DEPTH) {
+                    blockers.push(`temp_path_max_depth_exceeded:${TEMP_RETENTION_SCAN_MAX_DEPTH}`);
+                }
+                else {
+                    stack.push({ dir: child, depth: current.depth + 1 });
+                }
+                continue;
+            }
+            if (stat.isFile())
+                bytes += stat.size;
+        }
+    }
+    return {
+        complete: blockers.length === 0,
+        latestMtimeMs,
+        bytes,
+        blockers: [...new Set(blockers)]
+    };
+}
+export function currentProcessOwns(stat) {
+    if (typeof process.getuid !== 'function')
+        return true;
+    return stat.uid === process.getuid();
+}
+export function sharedTempEntryMatchesProject(entryName, projectHash) {
+    return entryName === `sks-${projectHash}` || entryName.startsWith(`sks-${projectHash}-`);
+}
+export function activeTempEnvironmentKey(target) {
+    const resolvedTarget = path.resolve(target);
+    for (const key of ['SKS_TMP_DIR', 'TMPDIR', 'TMP', 'TEMP']) {
+        const raw = process.env[key];
+        if (!raw)
+            continue;
+        const activePath = path.resolve(raw);
+        if (isWithin(resolvedTarget, activePath))
+            return key;
+    }
+    return null;
+}
+export async function liveTempLease(target) {
+    const leasePath = path.join(target, SKS_TEMP_LEASE_FILE);
+    const stat = await fs.lstat(leasePath).catch(() => null);
+    if (!stat?.isFile() || stat.isSymbolicLink() || !currentProcessOwns(stat))
+        return null;
+    const lease = await readJson(leasePath, null).catch(() => null);
+    const pid = Number(lease?.pid);
+    if (lease?.schema !== 'sks.temp-lease.v1' || !processIdAlive(pid))
+        return null;
+    return {
+        path: leasePath,
+        pid,
+        kind: lease?.kind ? String(lease.kind) : null
+    };
+}
+export async function removeDeadCanonicalTestLease(base, target, targetStat, dryRun, actions) {
+    if (!targetStat.isDirectory() || targetStat.isSymbolicLink() || !currentProcessOwns(targetStat))
+        return false;
+    const [realBase, realTarget] = await Promise.all([
+        fs.realpath(base).catch(() => null),
+        fs.realpath(target).catch(() => null)
+    ]);
+    if (!realBase || !realTarget || path.dirname(realTarget) !== realBase || !isWithin(realBase, realTarget))
+        return false;
+    const leasePath = path.join(target, SKS_TEMP_LEASE_FILE);
+    const leaseLstat = await fs.lstat(leasePath).catch(() => null);
+    if (!leaseLstat?.isFile()
+        || leaseLstat.isSymbolicLink()
+        || !currentProcessOwns(leaseLstat)
+        || leaseLstat.size > 4096)
+        return false;
+    const leaseHandle = await fs.open(leasePath, 'r').catch(() => null);
+    if (!leaseHandle)
+        return false;
+    let lease = null;
+    try {
+        const leaseStat = await leaseHandle.stat();
+        if (!leaseStat.isFile()
+            || !currentProcessOwns(leaseStat)
+            || leaseStat.dev !== leaseLstat.dev
+            || leaseStat.ino !== leaseLstat.ino)
+            return false;
+        lease = JSON.parse(await leaseHandle.readFile({ encoding: 'utf8' }));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await leaseHandle.close().catch(() => undefined);
+    }
+    const leaseKeys = lease && typeof lease === 'object' && !Array.isArray(lease)
+        ? Object.keys(lease).sort()
+        : [];
+    const pid = Number(lease?.pid);
+    if (lease?.schema !== 'sks.temp-lease.v1'
+        || lease?.kind !== 'canonical-test-runner'
+        || !Number.isSafeInteger(pid)
+        || pid <= 0
+        || typeof lease?.created_at !== 'string'
+        || !Number.isFinite(Date.parse(lease.created_at))
+        || leaseKeys.join(',') !== 'created_at,kind,pid,schema'
+        || processIdAlive(pid))
+        return false;
+    const currentTargetStat = await fs.lstat(target).catch(() => null);
+    if (!currentTargetStat?.isDirectory()
+        || currentTargetStat.isSymbolicLink()
+        || !currentProcessOwns(currentTargetStat)
+        || currentTargetStat.dev !== targetStat.dev
+        || currentTargetStat.ino !== targetStat.ino)
+        return false;
+    const action = {
+        action: 'remove_sks_temp',
+        path: target,
+        reason: 'dead_canonical_test_lease',
+        lease_path: leasePath,
+        owner_pid: pid,
+        lease_kind: lease.kind
+    };
+    if (dryRun) {
+        actions.push(action);
+        return true;
+    }
+    const quarantine = path.join(realBase, `.sks-retention-quarantine-${process.pid}-${randomUUID()}`);
+    try {
+        await fs.rename(target, quarantine);
+    }
+    catch {
+        return false;
+    }
+    const quarantinedStat = await fs.lstat(quarantine).catch(() => null);
+    if (!quarantinedStat
+        || quarantinedStat.dev !== targetStat.dev
+        || quarantinedStat.ino !== targetStat.ino) {
+        if (!(await exists(target)))
+            await fs.rename(quarantine, target).catch(() => undefined);
+        return false;
+    }
+    await rmrf(quarantine);
+    actions.push(action);
+    return true;
+}
+function processIdAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error?.code === 'EPERM';
+    }
+}
+function isWithin(parent, candidate) {
+    const rel = path.relative(path.resolve(parent), path.resolve(candidate));
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}