stim 1.20.2 → 1.21.0

package/dist/offload-worker.mjs

@@ -1,26 +1,32 @@
-import { O as writeConfigSetting } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { t as git } from "./git-DDfFzkMm.mjs";
-import { d as androidLayoutSetting, y as iosProjectDirSetting } from "./settings-B717odTD.mjs";
-import { D as fingerprintProject, M as refingerprintAfterMutation } from "./device-lease-BX1sJQ2E.mjs";
-import { w as workspaceLogsDir, x as workspaceDir } from "./workspace-state-DJt_MMvf.mjs";
+import { t as getExecutor } from "./exec-_UbtCQcG.mjs";
+import { d as workspaceDir, m as workspaceLogsDir$1 } from "./paths-DQtTgsBf.mjs";
+import { k as writeConfigSetting } from "./config-CYcBF478.mjs";
 import { n as stripAnsi } from "./process-output-Fpl8PYi8.mjs";
-import { d as projectRegistry, h as selectNativeXcodeProject } from "./project-_phNIJfs.mjs";
-import { o as parseNdjsonText } from "./ndjson-GOnbyvso.mjs";
-import { n as CCACHE_UNAVAILABLE, o as resolveCcache } from "./ccache-zdKiYQ3E.mjs";
-import { i as assembleTaskFor } from "./gradle-DSrXb6lG.mjs";
-import { f as podsAreStale, g as runPodInstall, p as readPodState, u as workerToolchain } from "./toolchain-DxSsNssu.mjs";
-import { a as validateGradleManifest, d as verifyNativeTransfer, m as manifestDigest, n as gradleStateDirectories, o as verifyGradleTransfer, r as nativeGradleOutputs, t as gradleOffloadInputs } from "./native-gradle-inputs-BsLRrl7u.mjs";
-import { n as buildAndroid, o as gradlewPath, r as buildIos } from "./react-native-build-CtCccJtb.mjs";
-import { n as buildAndroidOperation, t as buildIosOperation } from "./build-DYDbfkk5.mjs";
-import { n as recordPrebuild, r as runPrebuild, t as planPrebuild } from "./prebuild-DYbucPXy.mjs";
-import { f as podAction } from "./support-CwjbFs9H.mjs";
-import { r as stageBundle, t as resolveBundleExtras } from "./stage-KNTQopqv.mjs";
-import { t as logLines } from "./run-BtPgpKks.mjs";
-import { r as nativeXcodeMetadataDirectories } from "./native-xcode-inputs-CykopJdM.mjs";
-import { chmodSync, constants, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { d as androidLayoutSetting, y as iosProjectDirSetting } from "./settings-CsJDEXgK.mjs";
+import { t as git } from "./git-C3iTsJaZ.mjs";
+import { f as projectRegistry, g as selectNativeXcodeProject } from "./project-BZNjmW_8.mjs";
+import { o as parseNdjsonText } from "./ndjson-CgE_o3Dl.mjs";
+import { Fn as processContext } from "./budget-Bs6SxxzO.mjs";
+import { l as fingerprintProject, m as refingerprintAfterMutation } from "./build-cache-DmyR9Zzc.mjs";
+import { n as CCACHE_UNAVAILABLE, o as resolveCcache } from "./ccache-BJRZ9pG3.mjs";
+import { m as clearCorruptCompilationCache, p as COMPILATION_CACHE_CORRUPT } from "./client-UXD70ZbM.mjs";
+import { _ as runPodInstall, d as workerToolchain, m as readPodState, p as podsAreStale } from "./toolchain-Hp9sCpK4.mjs";
+import { r as manifestDigest } from "./native-inputs-TRTTTRxt.mjs";
+import { f as verifyNativeTransfer, i as nativeGradleOutputs, n as gradleStateDirectories, o as validateGradleManifest, s as verifyGradleTransfer, t as gradleOffloadInputs } from "./native-gradle-inputs-Bep9JcSF.mjs";
+import { n as buildAndroid, o as gradlewPath, r as buildIos, u as assembleTaskFor } from "./react-native-build-rhk4smwQ.mjs";
+import { f as podAction } from "./support-Dlu37g6H.mjs";
+import { n as recordPrebuild, r as runPrebuild, t as planPrebuild } from "./prebuild-uD_ipCxF.mjs";
+import { n as buildAndroidOperation, t as buildIosOperation } from "./build-CoPzQRNw.mjs";
+import { r as stageBundle, t as resolveBundleExtras } from "./stage-BIS0ydsV.mjs";
+import { t as logLines } from "./run-D23HmJMs.mjs";
+import { r as nativeXcodeMetadataDirectories } from "./native-xcode-inputs-CB2iQeWq.mjs";
 import { createHash } from "node:crypto";
+import { chmodSync, constants, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, sep } from "node:path";
+import { withAmbientContext } from "@stim-cli/core";
+import { isJsonObject, windowsShortDir, windowsShortDirKey } from "@stim-cli/core/state";
+import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
 //#region src/offload/worker.ts
 function emit(value) {
 	process.stdout.write(`${JSON.stringify(value)}\n`);
@@ -90,13 +96,85 @@ function ensureParents(root, path) {
 		mkdirSync(current);
 	}
 }
-function materialize(job, src) {
+const PRIVATE_DIRS = [
+	"$ErrorActionPreference = 'Stop'",
+	"$me = [Security.Principal.WindowsIdentity]::GetCurrent().User",
+	"$acl = New-Object Security.AccessControl.DirectorySecurity",
+	"$acl.SetAccessRuleProtection($true, $false)",
+	"foreach ($sid in @($me, (New-Object Security.Principal.SecurityIdentifier 'S-1-5-18'))) {",
+	"  $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')))",
+	"}",
+	"foreach ($line in [Console]::In.ReadToEnd().Split([char]10) | ForEach-Object { $_.Trim() } | Where-Object { $_ }) {",
+	"  $dir, $key = $line.Split([char]9)",
+	"  [void][IO.Directory]::CreateDirectory($dir, $acl)",
+	"  $current = Get-Acl -LiteralPath $dir",
+	"  $owner = $current.GetOwner([Security.Principal.SecurityIdentifier]).Value",
+	"  if ($owner -notin @($me.Value, 'S-1-5-32-544', 'S-1-5-18')) { [Console]::Error.WriteLine(\"$dir is owned by $owner\"); exit 3 }",
+	"  $foreign = $current.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) | Where-Object { $_.IdentityReference.Value -notin @($me.Value, 'S-1-5-18') }",
+	"  if (-not $current.AreAccessRulesProtected -or $foreign) { Set-Acl -LiteralPath $dir -AclObject $acl }",
+	"  if ($key) {",
+	"    $marker = \"$dir.owner\"",
+	"    if (-not (Test-Path -LiteralPath $marker)) { Set-Content -NoNewline -LiteralPath $marker -Value $key }",
+	"    elseif ((Get-Content -Raw -LiteralPath $marker) -ne $key) { [Console]::Error.WriteLine(\"$dir belongs to another build area\"); exit 4 }",
+	"  }",
+	"}"
+].join("\n");
+/**
+* Creates each directory, in order, with access for this user and SYSTEM only, and gives an existing one that ACL.
+* A directory at the drive root inherits the root's ACL, which lets every authenticated user modify it, so another
+* account could plant code in a build; one that another account owns could hold such code, so it is refused. A
+* directory with a key records it in `<dir>.owner` and is refused when another key is recorded there, since the
+* short names of different areas can collide.
+*/
+function makePrivateWindowsDirs(dirs) {
+	try {
+		getExecutor().runFile("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			PRIVATE_DIRS
+		], {
+			input: dirs.map((entry) => entry.join("	")).join("\n"),
+			timeoutMs: 6e4
+		});
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).trim().split("\n").at(-1);
+		throw new Error(`Could not prepare the private Windows build directories: ${reason}`, { cause: error });
+	}
+}
+/**
+* Creates the checkout directory `src` of `area`. On Windows it is a junction to a private `windowsShortDir`, and the
+* client's Gradle home is made private too; an area whose `src` is a directory keeps it.
+*/
+function ensureCheckout(area, src) {
+	const stat = lstatSync(src, { throwIfNoEntry: false });
+	if (process.platform === "win32") {
+		const linked = !stat || stat.isSymbolicLink();
+		const realArea = realpathSync(area);
+		const target = windowsShortDir(realArea);
+		const gradleHome = process.env.GRADLE_USER_HOME;
+		const dirs = [[dirname(target)]];
+		if (linked) dirs.push([target, windowsShortDirKey("checkout", realArea)]);
+		if (gradleHome) dirs.push([gradleHome, windowsShortDirKey("gradle", dirname(dirname(area)))]);
+		makePrivateWindowsDirs(dirs);
+		if (!linked) return;
+		let current = null;
+		try {
+			current = realpathSync(src);
+		} catch {}
+		if (current?.toLowerCase() === target.toLowerCase()) return;
+		if (stat) rmSync(src, { force: true });
+		symlinkSync(target, src, "junction");
+		return;
+	}
+	mkdirSync(src, { recursive: true });
+}
+async function materialize(job, src) {
 	const recordFile = join(job.area, "mirror.json");
 	let previous = {};
 	try {
 		previous = JSON.parse(readFileSync(recordFile, "utf8"));
 	} catch {}
-	mkdirSync(src, { recursive: true });
 	if (!existsSync(join(src, ".git"))) {
 		git(src, ["init", "--quiet"], {
 			write: true,
@@ -126,7 +204,7 @@ function materialize(job, src) {
 			} catch {}
 			const allowed = [...declaration.outputs, ...gradleStateDirectories(job.project)];
 			if (receipt.project === job.project && Array.isArray(receipt.directories)) retained = allowed.filter((path) => receipt.directories.includes(path));
-			retained = nativeGradleOutputs(src, {
+			retained = await nativeGradleOutputs(src, {
 				complete: true,
 				ignored: [],
 				outputs: retained
@@ -318,6 +396,49 @@ function destination(runtime) {
 		return null;
 	}
 }
+/**
+* Writes `name` under `dir` to `archive` as a gzip tarball at compression level 1. Node does the gzip because tar's
+* compression-level flags differ between bsdtar (macOS, Windows) and GNU tar (Linux).
+*/
+async function packArchive(archive, dir, name) {
+	const child = getExecutor().spawn("tar", [
+		"-cf",
+		"-",
+		"-C",
+		dir,
+		name
+	], { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	const tarball = child.stdout;
+	if (!tarball) throw new Error("tar opened no output stream.");
+	const stderr = [];
+	child.stderr?.on("data", (chunk) => stderr.push(String(chunk)));
+	let spawnError = null;
+	const exited = new Promise((resolve) => {
+		child.once("error", (error) => {
+			spawnError = error;
+			resolve(null);
+		});
+		child.once("close", resolve);
+	});
+	const timeout = new AbortController();
+	const timer = setTimeout(() => timeout.abort(), 6e5);
+	try {
+		await pipeline(tarball, createGzip({ level: 1 }), createWriteStream(archive), { signal: timeout.signal });
+	} catch (error) {
+		child.kill("SIGKILL");
+		await exited;
+		throw timeout.signal.aborted ? /* @__PURE__ */ new Error("Packing the artifact did not finish within 10 minutes.") : error;
+	} finally {
+		clearTimeout(timer);
+	}
+	const code = await exited;
+	if (spawnError) throw spawnError;
+	if (code !== 0) throw new Error(`tar exited with ${code}: ${stderr.join("").trim().slice(-500)}`);
+}
 async function sha256Of(path) {
 	const hash = createHash("sha256");
 	for await (const chunk of createReadStream(path)) hash.update(chunk);
@@ -347,13 +468,14 @@ async function build(job) {
 		message,
 		timings
 	});
-	const src = join(job.area, "src");
+	ensureCheckout(job.area, join(job.area, "src"));
+	const src = realpathSync(join(job.area, "src"));
 	const root = join(src, job.project);
 	const log = relayWriter(join(job.area, "build.ndjson"));
 	const mirrored = await time("syncMs", () => materialize(job, src));
 	const realSrc = realpathSync(src);
 	const realRoot = realpathSync(root);
-	if (realRoot !== realSrc && !realRoot.startsWith(`${realSrc}/`)) return failed("bad-project", `${job.project} leaves the checkout.`);
+	if (realRoot !== realSrc && !realRoot.startsWith(`${realSrc}${sep}`)) return failed("bad-project", `${job.project} leaves the checkout.`);
 	note("sync", `${job.manifest.length} files, ${mirrored.written} written, ${mirrored.removed} removed`);
 	let fingerprint;
 	let compiled;
@@ -361,13 +483,13 @@ async function build(job) {
 		if (job.platform !== "android" || job.expectedFingerprint !== null) return failed("unsupported-provider", "Native Gradle needs an Android request with no reusable artifact identity.");
 		const selected = projectRegistry.selectAndroid(root);
 		if ("problem" in selected || selected.id !== "native-android") return failed("provider-mismatch", "The transferred project did not select the native Android integration.");
-		if (!verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
+		if (!await verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
 		compiled = await compileNativeAndroid(job, root, log, time);
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 		try {
 			const model = JSON.parse(readFileSync(join(workspaceDir(root), "gradle-build", `native-apk-${encodeURIComponent(job.android?.variant ?? "debug")}.json`), "utf8"));
-			const outputs = nativeGradleOutputs(src, job.native.inputs, model.buildDirectories);
-			if (!verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) throw new Error("The native source changed while the worker compiled it.");
+			const outputs = await nativeGradleOutputs(src, job.native.inputs, model.buildDirectories);
+			if (!await verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) throw new Error("The native source changed while the worker compiled it.");
 			const directories = [...outputs, ...gradleStateDirectories(job.project).filter((path) => lstatSync(join(src, path), { throwIfNoEntry: false })?.isDirectory())];
 			const receipt = join(job.area, "gradle-outputs.json");
 			const tmp = `${receipt}.${process.pid}.tmp`;
@@ -391,7 +513,7 @@ async function build(job) {
 		let metadataDirectories;
 		try {
 			metadataDirectories = nativeXcodeMetadataDirectories(selectNativeXcodeProject(root, job.scheme ?? void 0, job.configuration ?? void 0));
-			if (!verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
+			if (!await verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
 		} catch (error) {
 			return failed("source-mismatch", error.message);
 		}
@@ -401,7 +523,7 @@ async function build(job) {
 		compiled = await compileNativeIos(job, root, log, time);
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 		try {
-			if (!verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) throw new Error("The native source changed while the worker compiled it.");
+			if (!await verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) throw new Error("The native source changed while the worker compiled it.");
 		} catch (error) {
 			if (compiled.temporary) rmSync(compiled.temporary, {
 				recursive: true,
@@ -413,7 +535,7 @@ async function build(job) {
 	} else if (job.platform === "macos") {
 		fingerprint = await time("fingerprintMs", () => manifestDigest(job.manifest));
 		if (fingerprint !== job.expectedFingerprint) return failed("fingerprint-mismatch", `the manifest there fingerprints ${fingerprint.slice(0, 12)}, here ${job.expectedFingerprint?.slice(0, 12)}`);
-		compiled = await compileMacos(job, root, log, time);
+		compiled = await workerOperation(root, (context) => compileMacos(context, job, root, log, time));
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 	} else {
 		try {
@@ -424,7 +546,7 @@ async function build(job) {
 		const platform = job.platform;
 		let iosProject;
 		try {
-			iosProject = iosProjectDirSetting({ ios: { projectPath: job.iosProjectPath ?? void 0 } }, root);
+			iosProject = iosProjectDirSetting({ ios: { projectPath: job.iosProjectPath ?? void 0 } }, realRoot);
 		} catch (error) {
 			return failed("bad-request", error.message);
 		}
@@ -433,17 +555,17 @@ async function build(job) {
 			androidLayout = androidLayoutSetting({ android: {
 				gradleRoot: job.android?.gradleRoot ?? void 0,
 				module: job.android?.module ?? void 0
-			} }, root, realSrc);
+			} }, realRoot, realSrc);
 		} catch (error) {
 			return failed("bad-request", error.message);
 		}
-		const initial = await time("fingerprintMs", () => fingerprintProject(root, {
+		const initial = await time("fingerprintMs", () => fingerprintProject(realRoot, {
 			platform,
 			iosProjectPath: iosProject.relative,
 			androidLayout
 		}));
-		if (!initial) return failed("no-fingerprint", "The remote Mac could not fingerprint the project.");
-		const plan = planPrebuild(root, platform, {
+		if (!initial) return failed("no-fingerprint", "The remote machine could not fingerprint the project.");
+		const plan = planPrebuild(realRoot, platform, {
 			isExpo: job.isExpo,
 			fingerprint: initial.hash,
 			sources: initial.sources
@@ -452,17 +574,17 @@ async function build(job) {
 		const mutations = [];
 		if (plan === "generate" || plan === "regenerate") {
 			note("prebuild", plan === "generate" ? `generating ${platform}/` : `regenerating ${platform}/ with --clean`);
-			recordPrebuild(root, platform, null);
-			const result = await time("prebuildMs", () => runPrebuild(root, platform, log, { clean: plan === "regenerate" }));
+			recordPrebuild(realRoot, platform, null);
+			const result = await time("prebuildMs", () => runPrebuild(realRoot, platform, log, { clean: plan === "regenerate" }));
 			if (result?.failed) return failed("prebuild-failed", result.reason ?? "expo prebuild failed.");
 			mutations.push("prebuild");
 		}
 		if (platform === "ios") {
-			const podState = readPodState(root, iosProject.dir);
+			const podState = readPodState(realRoot, iosProject.dir);
 			const pods = podAction(podState, podsAreStale(podState.lockText, podState.manifestText, podState.dir));
 			if (pods.install) {
 				note("pods", `${pods.reason ?? "Pods are stale"} -> pod install`);
-				const result = await time("podsMs", () => runPodInstall(root, log, {
+				const result = await time("podsMs", () => runPodInstall(realRoot, log, {
 					directory: iosProject.dir,
 					onHeartbeat: (line) => note("pods", line)
 				}));
@@ -473,7 +595,7 @@ async function build(job) {
 		fingerprint = initial.hash;
 		if (mutations.length) {
 			const after = await time("fingerprintMs", () => refingerprintAfterMutation({
-				projectRoot: root,
+				projectRoot: realRoot,
 				platform,
 				previousHash: initial.hash,
 				iosProjectPath: iosProject.relative,
@@ -481,14 +603,14 @@ async function build(job) {
 			}));
 			if (!after) return failed("no-fingerprint", `No fingerprint after ${mutations.join(", ")}.`);
 			fingerprint = after.hash;
-			if (mutations.includes("prebuild")) recordPrebuild(root, platform, after.hash);
+			if (mutations.includes("prebuild")) recordPrebuild(realRoot, platform, after.hash);
 		}
 		if (fingerprint !== job.expectedFingerprint) return failed("fingerprint-mismatch", `the checkout there fingerprints ${fingerprint.slice(0, 12)}, here ${job.expectedFingerprint?.slice(0, 12)}`);
-		compiled = platform === "android" ? await compileAndroid(job, root, log, time, androidLayout) : await compileIos(job, root, log, time);
+		compiled = platform === "android" ? await compileAndroid(job, realRoot, log, time, androidLayout) : await compileIos(job, realRoot, log, time);
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 		const builtFingerprint = fingerprint;
 		const settled = await time("fingerprintMs", () => refingerprintAfterMutation({
-			projectRoot: root,
+			projectRoot: realRoot,
 			platform,
 			previousHash: builtFingerprint,
 			iosProjectPath: iosProject.relative,
@@ -510,15 +632,7 @@ async function build(job) {
 			verbatimSymlinks: true,
 			mode: constants.COPYFILE_FICLONE
 		});
-		await time("packageMs", () => getExecutor().runFileAsync("tar", [
-			"-czf",
-			archive,
-			"--options",
-			"gzip:compression-level=1",
-			"-C",
-			dirname(compiled.path),
-			name
-		], { timeoutMs: 6e5 }));
+		await time("packageMs", () => packArchive(archive, dirname(compiled.path), name));
 		const sha256 = await time("packageMs", () => sha256Of(archive));
 		return {
 			ok: true,
@@ -541,12 +655,9 @@ async function build(job) {
 		});
 	}
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function differingParameters(here, there, path) {
 	if (JSON.stringify(here) === JSON.stringify(there)) return [];
-	if (!isRecord(here) || !isRecord(there)) return [path];
+	if (!isJsonObject(here) || !isJsonObject(there)) return [path];
 	return [.../* @__PURE__ */ new Set([...Object.keys(here), ...Object.keys(there)])].toSorted().flatMap((key) => differingParameters(here[key], there[key], `${path}.${key}`));
 }
 function unused() {
@@ -593,6 +704,10 @@ async function nativeIdentityRefusal(job, native, root, load) {
 		return `This Mac cannot key the native build: ${error.message}`;
 	}
 }
+function workerOperation(root, fn) {
+	const context = processContext(root, new AbortController().signal);
+	return withAmbientContext(context, () => fn(context));
+}
 async function compileNativeIos(job, root, log, time) {
 	if (job.native?.provider !== "xcode" || !job.optimizations) return {
 		ok: false,
@@ -612,15 +727,15 @@ async function compileNativeIos(job, root, log, time) {
 		}, `optimizations.ios.${key}`, value ?? void 0);
 	}
 	note("build", `native Xcode ${job.configuration ?? "Debug"}`);
-	const logFile = join(workspaceLogsDir(root), "build-ios.ndjson");
+	const logFile = join(workspaceLogsDir$1(root), "build-ios.ndjson");
 	try {
 		rmSync(logFile, { force: true });
-		const built = await time("buildMs", () => buildIosOperation(root, {
+		const built = await time("buildMs", () => workerOperation(root, (context) => buildIosOperation(context, root, {
 			scheme: job.scheme ?? void 0,
 			configuration: job.configuration ?? void 0,
 			arch: native.arch ?? "all",
 			remoteBuild: "local"
-		}));
+		})));
 		if (built.cacheKey !== native.cacheKey || built.cacheSkipped) {
 			rmSync(dirname(built.appPath), {
 				recursive: true,
@@ -639,6 +754,14 @@ async function compileNativeIos(job, root, log, time) {
 			temporary: dirname(built.appPath)
 		};
 	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "STIM_COMPILATION_CACHE_CORRUPT") {
+			const remedy = "remedy" in error && typeof error.remedy === "string" ? ` ${error.remedy}` : "";
+			return {
+				ok: false,
+				code: COMPILATION_CACHE_CORRUPT,
+				message: `${error.message}${remedy}`
+			};
+		}
 		return {
 			ok: false,
 			code: "native-build-failed",
@@ -671,15 +794,15 @@ async function compileNativeAndroid(job, root, log, time) {
 		process.exit(143);
 	};
 	process.once("SIGTERM", stop);
-	const logFile = join(workspaceLogsDir(root), "build-android.ndjson");
+	const logFile = join(workspaceLogsDir$1(root), "build-android.ndjson");
 	note("build", `native Gradle ${options.variant ?? "debug"}`);
 	try {
 		rmSync(logFile, { force: true });
-		const built = await time("buildMs", () => buildAndroidOperation(root, {
+		const built = await time("buildMs", () => workerOperation(root, (context) => buildAndroidOperation(context, root, {
 			variant: options.variant ?? void 0,
 			abi: options.abi ?? "all",
 			remoteBuild: "local"
-		}));
+		}, { cacheArtifacts: false })));
 		if (built.cacheKey !== null || !built.cacheSkipped || !built.androidPackage) {
 			rmSync(dirname(built.apkPath), {
 				recursive: true,
@@ -710,7 +833,7 @@ async function compileNativeAndroid(job, root, log, time) {
 		if (existsSync(logFile)) for (const record of parseNdjsonText(readFileSync(logFile, "utf8"))) log.write(record);
 	}
 }
-async function compileMacos(job, root, log, time) {
+async function compileMacos(context, job, root, log, time) {
 	const options = job.macos;
 	if (!options) return {
 		ok: false,
@@ -780,7 +903,7 @@ async function compileMacos(job, root, log, time) {
 				"--show-bin-path"
 			], true);
 			const bundle = join(job.area, "out", job.job, `${options.product}.app`);
-			stageBundle(root, options.product, options.infoPlist, bin, bundle, options.bundleId, extras);
+			await stageBundle(context, root, options.product, options.infoPlist, bin, bundle, options.bundleId, extras);
 			return {
 				ok: true,
 				path: bundle,
@@ -816,6 +939,14 @@ async function compileIos(job, root, log, time) {
 		onNote: (line) => note("build", line)
 	}));
 	if (!built.ok) {
+		if (built.compilationCacheCorruption) {
+			const report = clearCorruptCompilationCache(built.compilationCacheCorruption, root);
+			return {
+				ok: false,
+				code: report.code,
+				message: `${report.message} ${report.remedy}`
+			};
+		}
 		const first = built.diagnostics[0]?.message;
 		return {
 			ok: false,

package/dist/{ownership-DCtw_2IA.mjs → ownership-DEmM5vhh.mjs}

@@ -1,6 +1,6 @@
-import { k as process_identity_exports } from "./config-BYDxlMY3.mjs";
-import { c as writeWorkspaceState, o as withWorkspaceStateLock, r as readWorkspaceState } from "./workspace-state-DJt_MMvf.mjs";
-import { s as pidExists } from "./metro-DnCEjCxs.mjs";
+import { p as process_identity_exports } from "./exec-_UbtCQcG.mjs";
+import { c as withWorkspaceStateLock, d as writeWorkspaceState, r as readWorkspaceState } from "./workspace-state-Cjuigeeu.mjs";
+import { l as pidExists } from "./metro-DEXpIhHC.mjs";
 import { realpathSync } from "node:fs";
 //#region src/collector/state.ts
 function collectorRoot(root) {

package/dist/{page-DRHy329N.mjs → page-CPaHeYqj.mjs}

@@ -1,5 +1,6 @@
-import { k as process_identity_exports } from "./config-BYDxlMY3.mjs";
-import { t as connectOwnedBrowser } from "./cdp-Dq_ypAlJ.mjs";
+import { p as process_identity_exports } from "./exec-_UbtCQcG.mjs";
+import { en as throwIfCancelled } from "./settings-CsJDEXgK.mjs";
+import { t as connectOwnedBrowser } from "./cdp-CWmIUMbw.mjs";
 //#region src/web/page.ts
 /** The record of a verified live browser: its supervisor and Chrome are the processes the record names. */
 function liveWebRecord(record) {
@@ -12,14 +13,16 @@ const NAVIGATE_ACK_MS = 1e3;
 * Sends one page-level DevTools command to the owned page, through a connection verified to reach its Chrome.
 * Resolves to the URL the page was on when the command was sent.
 */
-async function sendToOwnedPage(record, method, params = {}) {
-	const cdp = await connectOwnedBrowser(record.cdpPort, record.chromeProcess.pid);
+async function sendToOwnedPage(record, method, params = {}, signal) {
+	const cdp = await connectOwnedBrowser(record.cdpPort, record.chromeProcess.pid, signal);
 	try {
 		const { targetInfo } = await cdp.send("Target.getTargetInfo", { targetId: record.targetId });
+		throwIfCancelled(signal, "browser operation");
 		const { sessionId } = await cdp.send("Target.attachToTarget", {
 			targetId: record.targetId,
 			flatten: true
 		});
+		throwIfCancelled(signal, "browser operation");
 		const reply = cdp.send(method, params, sessionId);
 		if (method === "Page.navigate") {
 			reply.catch(() => {});

package/dist/paths-BsJMoPP2.mjs

@@ -0,0 +1,12 @@
+import { resolve } from "path";
+import { realpathSync } from "fs";
+//#region src/commands/gc/paths.ts
+function canonicalPath(p) {
+	try {
+		return realpathSync(p);
+	} catch {
+		return resolve(p);
+	}
+}
+//#endregion
+export { canonicalPath as t };

package/dist/paths-DQtTgsBf.mjs

@@ -0,0 +1,42 @@
+import { existsSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { buildCacheRoot as sharedBuildCache, ensurePrivateDir, withDirLock as withDirLock$1, withDirLockAsync as withDirLockAsync$1, workspaceId as workspaceId$1, workspaceName as workspaceName$1, workspaceStateDir as workspaceDir } from "@stim-cli/core";
+import { emulatorLogFile, readJsonObject, sharedCcache as sharedCcache$1, sharedCompilationCache as sharedCompilationCache$1, supervisorLogFile, supervisorPidFile, workspaceAgentDeviceDir, workspaceDerivedData, workspaceLogErrorIndex, workspaceLogsDir as workspaceLogsDir$1, workspaceMetadataFile, workspaceStateFile as workspaceStateFile$1, workspaceStateLock } from "@stim-cli/core/state";
+import { join, resolve } from "path";
+//#region src/workspace/paths.ts
+function ensureWorkspaceStorage(projectRoot) {
+	const canonicalRoot = resolve(projectRoot);
+	const dir = workspaceDir(canonicalRoot);
+	const file = workspaceMetadataFile(canonicalRoot);
+	ensurePrivateDir(dir);
+	return withDirLock$1(join(dir, "metadata.lock"), () => {
+		if (!existsSync(file)) {
+			const metadata = {
+				projectRoot: canonicalRoot,
+				workspace: workspaceName$1(canonicalRoot),
+				version: 1
+			};
+			const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+			writeFileSync(tmp, `${JSON.stringify(metadata, null, 2)}\n`);
+			try {
+				renameSync(tmp, file);
+			} catch (error) {
+				rmSync(tmp, { force: true });
+				throw error;
+			}
+			return dir;
+		}
+		if (readJsonObject(file)?.projectRoot === canonicalRoot) return dir;
+		const error = /* @__PURE__ */ new Error(`Stim workspace collision at ${dir}: its workspace.json does not belong to ${canonicalRoot}.`);
+		error.code = "STIM_WORKSPACE_COLLISION";
+		throw error;
+	});
+}
+/** Initializes or validates workspace storage after asynchronously acquiring its metadata lock. */
+function ensureWorkspaceStorageAsync(projectRoot, signal) {
+	signal?.throwIfAborted();
+	const dir = workspaceDir(resolve(projectRoot));
+	ensurePrivateDir(dir);
+	return withDirLockAsync$1(join(dir, "metadata.lock"), () => ensureWorkspaceStorage(projectRoot), { signal });
+}
+//#endregion
+export { workspaceStateLock as _, sharedCcache$1 as a, supervisorPidFile as c, workspaceDir as d, workspaceId$1 as f, workspaceStateFile$1 as g, workspaceName$1 as h, sharedBuildCache as i, workspaceAgentDeviceDir as l, workspaceLogsDir$1 as m, ensureWorkspaceStorage as n, sharedCompilationCache$1 as o, workspaceLogErrorIndex as p, ensureWorkspaceStorageAsync as r, supervisorLogFile as s, emulatorLogFile as t, workspaceDerivedData as u, withDirLock$1 as v, withDirLockAsync$1 as y };

package/dist/{placement-log-MOfPVgaM.mjs → placement-log-BqGbTa61.mjs}

@@ -1,6 +1,6 @@
-import { m as buildPlacementSettings } from "./client-qQAaXSUs.mjs";
+import { n as buildPlacementSettings } from "./selection-CSl9i5qU.mjs";
 //#region src/placement-log.ts
-/** `machine` is `local` when the run stays on this Mac. */
+/** `machine` is `local` when the run stays on this machine. */
 function placementRecord(input) {
 	const { choice, fallback } = input;
 	const event = input.event ?? (input.kind === "build" ? "build_placement" : "device_placement");
@@ -42,8 +42,8 @@ function devicePlacementRecord({ platform, fromFlag, easFallback = false, placed
 	});
 }
 /**
-* The record for where a build runs. `stays` is the reason this Mac builds it, `chose` the remote Mac that takes it,
-* and `fallback` why a remote Mac that was meant to build it did not.
+* The record for where a build runs. `stays` is the reason this machine builds it, `chose` the remote machine that takes it,
+* and `fallback` why a remote machine that was meant to build it did not.
 */
 function buildPlacementRecord({ platform, buildMachine, candidates = [], ...outcome }) {
 	const base = {
@@ -75,7 +75,7 @@ function buildPlacementRecord({ platform, buildMachine, candidates = [], ...outc
 		choice: {
 			machine: "local",
 			code,
-			msg: "building on this Mac"
+			msg: "building on this machine"
 		},
 		fallback: {
 			code,

package/dist/{plan-placement-V0TdzYXp.mjs → plan-placement-Bwj-IjY1.mjs}

@@ -1,12 +1,12 @@
-import { S as hostingMachines } from "./client-qQAaXSUs.mjs";
-import { r as readHostedNative } from "./ios-state-CBLe1xYw.mjs";
-import { l as probeHost, s as automaticDevicePlacement } from "./build-plan-B7SZsc2N.mjs";
+import { d as hostingMachines } from "./selection-CSl9i5qU.mjs";
+import { r as readHostedNative } from "./ios-state-DvFX-K_l.mjs";
+import { i as probeHost, n as automaticDevicePlacement } from "./eas-fallback-DJwZpy0c.mjs";
 import { automaticMachineEnabled } from "@stim-cli/core/state";
 //#region src/device-host/plan-placement.ts
 /**
 * Where `--plan` assumes the next run puts its simulator or emulator, with no session, reservation or state write.
 * A named Mac, or the Mac a recorded session already holds, answers with the device its `device-host.offer` would
-* give; `auto` repeats the placement decision a run makes now and, when that stays on this Mac, notes any Mac
+* give; `auto` repeats the placement decision a run makes now and, when that stays on this machine, notes any Mac
 * whose device would key differently. The result predicts the cache key only; a run reads its own device.
 */
 async function planHostedDevice({ root, slot, platform, machine, selectors, sameKey, eas, deps = {} }) {
@@ -56,11 +56,11 @@ async function planHostedDevice({ root, slot, platform, machine, selectors, same
 		const differs = (await Promise.all(names.map((name) => probe(name, platform, selectors)))).flatMap(({ probe: each }) => "offer" in each && each.offer.choice && sameKey(each.offer.choice) === false ? [each.machine] : []);
 		if (differs.length) return {
 			kind: "local",
-			placement: `this Mac; auto may use ${differs.join(", ")}, which builds for another architecture, so its key differs`
+			placement: `this machine; auto may use ${differs.join(", ")}, which builds for another architecture, so its key differs`
 		};
 		return {
 			kind: "local",
-			placement: names.length ? `this Mac; auto may use ${names.join(", ")}` : "this Mac"
+			placement: names.length ? `this machine; auto may use ${names.join(", ")}` : "this machine"
 		};
 	} catch (error) {
 		return {

package/dist/{ports-DdSUicVo.mjs → ports-D-MmCTdv.mjs}

@@ -1,6 +1,6 @@
-import { p as getProject } from "./config-BYDxlMY3.mjs";
-import { n as findCommandWorkspace } from "./project-_phNIJfs.mjs";
-import { n as getNamedPort, t as clearNamedPorts } from "./named-ports-4WopRPg-.mjs";
+import { p as getProject } from "./config-CYcBF478.mjs";
+import { n as findCommandWorkspace } from "./project-BZNjmW_8.mjs";
+import { n as getNamedPort, t as clearNamedPorts } from "./named-ports-BWTzt6mu.mjs";
 //#region src/commands/ports.ts
 async function inProject(action) {
 	try {