talos-code 0.0.1 → 0.2.0

package/dist/tui/vim-mode.js

@@ -0,0 +1,99 @@
+import { deleteForward, moveCursor, moveVertical, nextGraphemeBoundary, previousGraphemeBoundary, redoEditor, undoEditor } from "./editor.js";
+export function createVimState() { return { enabled: false, mode: 'insert' }; }
+export function toggleVim(state) { return state.enabled ? { enabled: false, mode: 'insert' } : { enabled: true, mode: 'insert' }; }
+export function vimModeHint(state) {
+    if (!state.enabled)
+        return '';
+    return state.mode === 'insert'
+        ? 'VIM INSERT · Esc normal · Alt+V off'
+        : 'VIM NORMAL · h/j/k/l · b/w · 0/$ · x · u/Ctrl+R · i/a/I/A · Alt+V off';
+}
+function setCursor(state, cursor) {
+    const { selectionAnchor: _, preferredColumn: __, ...rest } = state;
+    return { ...rest, cursor: Math.max(0, Math.min(state.text.length, cursor)) };
+}
+function isWordAt(state, cursor) {
+    if (cursor < 0 || cursor >= state.text.length)
+        return false;
+    const end = nextGraphemeBoundary(state.text, cursor);
+    return /[\p{L}\p{N}_]/u.test(state.text.slice(cursor, end));
+}
+function vimWordForward(state) {
+    let cursor = state.cursor;
+    if (cursor >= state.text.length)
+        return setCursor(state, cursor);
+    if (isWordAt(state, cursor))
+        while (cursor < state.text.length && isWordAt(state, cursor))
+            cursor = nextGraphemeBoundary(state.text, cursor);
+    while (cursor < state.text.length && !isWordAt(state, cursor))
+        cursor = nextGraphemeBoundary(state.text, cursor);
+    return setCursor(state, cursor);
+}
+function vimWordBackward(state) {
+    let cursor = state.cursor;
+    if (cursor <= 0)
+        return setCursor(state, 0);
+    cursor = previousGraphemeBoundary(state.text, cursor);
+    while (cursor > 0 && !isWordAt(state, cursor))
+        cursor = previousGraphemeBoundary(state.text, cursor);
+    while (cursor > 0) {
+        const previous = previousGraphemeBoundary(state.text, cursor);
+        if (!isWordAt(state, previous))
+            break;
+        cursor = previous;
+    }
+    return setCursor(state, cursor);
+}
+function result(state, editor, handled) { return { handled, state: { enabled: state.enabled, mode: state.mode }, editor }; }
+function insertMode(state) { return { enabled: state.enabled, mode: 'insert' }; }
+export function handleVimInput(input) {
+    const { state, editor, ch, key } = input;
+    if (!state.enabled)
+        return result(state, editor, false);
+    if (state.mode === 'insert') {
+        if (key.escape)
+            return { handled: true, state: { enabled: true, mode: 'normal' }, editor };
+        return result(state, editor, false);
+    }
+    if (key.escape)
+        return result(state, editor, false);
+    if (key.ctrl && ch.toLowerCase() === 'c')
+        return result(state, editor, false);
+    if (key.ctrl && ch.toLowerCase() === 'r')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: redoEditor(editor) };
+    if (key.ctrl || key.meta)
+        return result(state, editor, false);
+    if ((ch === '?' || ch === '/') && editor.text.trim().length === 0)
+        return result(state, editor, false);
+    if (ch === 'i')
+        return { handled: true, state: insertMode(state), editor };
+    if (ch === 'a')
+        return { handled: true, state: insertMode(state), editor: moveCursor(editor, 'right') };
+    if (ch === 'I')
+        return { handled: true, state: insertMode(state), editor: moveCursor(editor, 'home') };
+    if (ch === 'A')
+        return { handled: true, state: insertMode(state), editor: moveCursor(editor, 'end') };
+    if (ch === 'h')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: moveCursor(editor, 'left') };
+    if (ch === 'l')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: moveCursor(editor, 'right') };
+    if (ch === 'j')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: moveVertical(editor, 1) };
+    if (ch === 'k')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: moveVertical(editor, -1) };
+    if (ch === 'w')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: vimWordForward(editor) };
+    if (ch === 'b')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: vimWordBackward(editor) };
+    if (ch === '0')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: moveCursor(editor, 'home') };
+    if (ch === '$')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: moveCursor(editor, 'end') };
+    if (ch === 'x')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: deleteForward(editor) };
+    if (ch === 'u')
+        return { handled: true, state: { enabled: true, mode: 'normal' }, editor: undoEditor(editor) };
+    if (ch)
+        return result(state, editor, true);
+    return result(state, editor, false);
+}

package/dist/update/check.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+const V = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/u;
+function cmp(a, b) { const x = V.exec(a), y = V.exec(b); if (!x || !y)
+    throw new Error('UPDATE_VERSION_INVALID'); for (let i = 1; i <= 3; i++) {
+    const d = Number(x[i]) - Number(y[i]);
+    if (d)
+        return Math.sign(d);
+} return (x[4] ? 0 : 1) - (y[4] ? 0 : 1); }
+/** The release order the installer check uses, shared with the npm check (update/npm.ts). */
+export function compareReleaseVersions(a, b) { return cmp(a, b); }
+export async function checkRelease({ currentVersion, channel, platform, fetchManifest }) { const m = await fetchManifest(); if (m.schema !== 'talos.cli.release.v1' || m.channel !== channel || !V.test(m.version))
+    throw new Error('UPDATE_MANIFEST_INVALID'); const asset = m.assets.find(a => a.platform === platform); return { available: cmp(m.version, currentVersion) > 0, version: m.version, asset: asset ?? null, manifest: m }; }
+export async function verifyDownloadedAsset(bytes, asset) { if (bytes.byteLength !== asset.size)
+    throw new Error('UPDATE_SIZE_MISMATCH'); const h = createHash('sha256').update(bytes).digest('hex'); if (h.toLowerCase() !== asset.sha256.toLowerCase())
+    throw new Error('UPDATE_CHECKSUM_MISMATCH'); return h; }

package/dist/update/npm.js

@@ -0,0 +1,51 @@
+import { basename, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { compareReleaseVersions } from "./check.js";
+/*
+ * R7 (owner, 2026-09-25): an install made with `npm i -g talos-code` updates with npm. `talos update` asks the npm registry
+ * which version is current and says the command to run; it downloads nothing and changes nothing. The Windows installer
+ * keeps its own path (GitHub release manifest, verified download).
+ *
+ * How an npm install is recognised: npm puts the package at `<prefix>/node_modules/talos-code` (global) or
+ * `<project>/node_modules/talos-code`, so the folder above the package is `node_modules`. The Windows installer puts it in
+ * its own `app` folder, and a checkout runs from `cli/`.
+ */
+export const NPM_PACKAGE = 'talos-code';
+export const NPM_DIST_TAGS_URL = `https://registry.npmjs.org/-/package/${NPM_PACKAGE}/dist-tags`;
+const TAG = { stable: 'latest', preview: 'next' };
+/** The package folder of this build: `dist/update/npm.js` or `src/update/npm.ts`, two levels down. */
+export function packageRootOf(moduleUrl = import.meta.url) { return fileURLToPath(new URL('../../', moduleUrl)); }
+export function installedWithNpm(packageRoot = packageRootOf()) {
+    const root = packageRoot.replace(/[\\/]+$/u, '');
+    return basename(dirname(root)).toLowerCase() === 'node_modules' && basename(root) === NPM_PACKAGE;
+}
+export function npmUpdateCommand(channel) { return `npm i -g ${NPM_PACKAGE}@${TAG[channel]}`; }
+export async function checkNpmRegistry({ currentVersion, channel, fetchFn = fetch, url = NPM_DIST_TAGS_URL, timeoutMs = 15_000 }) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+        response = await fetchFn(url, { headers: { Accept: 'application/json' }, signal: controller.signal });
+    }
+    catch (error) {
+        if (controller.signal.aborted)
+            throw Object.assign(new Error('UPDATE_TIMEOUT'), { code: 'UPDATE_TIMEOUT' });
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok)
+        throw Object.assign(new Error(`UPDATE_HTTP_${response.status}`), { code: 'UPDATE_HTTP_ERROR', status: response.status });
+    let tags;
+    try {
+        tags = await response.json();
+    }
+    catch {
+        throw Object.assign(new Error('UPDATE_RELEASE_METADATA_INVALID'), { code: 'UPDATE_RELEASE_METADATA_INVALID' });
+    }
+    const version = tags && typeof tags === 'object' ? tags[TAG[channel]] : undefined;
+    if (typeof version !== 'string')
+        throw Object.assign(new Error('UPDATE_RELEASE_NOT_FOUND'), { code: 'UPDATE_RELEASE_NOT_FOUND' });
+    return { source: 'npm', available: compareReleaseVersions(version, currentVersion) > 0, version, currentVersion, channel, command: npmUpdateCommand(channel) };
+}

package/dist/update/run.js

@@ -0,0 +1,129 @@
+import { mkdir, rename, writeFile } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+import { checkRelease, verifyDownloadedAsset } from "./check.js";
+const DEFAULT_TIMEOUT_MS = 15_000;
+const DEFAULT_ATTEMPTS = 2;
+const DEFAULT_RETRY_DELAY_MS = 250;
+function httpError(status) {
+    return Object.assign(new Error(`UPDATE_HTTP_${status}`), { code: 'UPDATE_HTTP_ERROR', status });
+}
+function timeoutError() {
+    return Object.assign(new Error('UPDATE_TIMEOUT'), { code: 'UPDATE_TIMEOUT' });
+}
+function sleep(ms) { return ms > 0 ? new Promise(resolve => setTimeout(resolve, ms)) : Promise.resolve(); }
+function transient(error) {
+    if (error?.code === 'UPDATE_TIMEOUT')
+        return true;
+    if (error?.code === 'UPDATE_HTTP_ERROR')
+        return Number(error.status) >= 500;
+    return error instanceof TypeError || (typeof error?.code === 'string' && /^(?:EAI_AGAIN|ECONNRESET|ECONNREFUSED|ENETUNREACH|ETIMEDOUT)$/u.test(error.code));
+}
+async function fetchOnce(fetchFn, url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(timeoutError()), timeoutMs);
+    try {
+        let response;
+        try {
+            response = await fetchFn(url, { headers: { Accept: 'application/json, application/octet-stream' }, signal: controller.signal });
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                throw timeoutError();
+            throw error;
+        }
+        if (!response.ok)
+            throw httpError(response.status);
+        return response;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function checkedResponse(fetchFn, url, { timeoutMs = DEFAULT_TIMEOUT_MS, attempts = DEFAULT_ATTEMPTS, retryDelayMs = DEFAULT_RETRY_DELAY_MS } = {}) {
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0)
+        throw new Error('UPDATE_TIMEOUT_INVALID');
+    if (!Number.isInteger(attempts) || attempts <= 0 || attempts > 2)
+        throw new Error('UPDATE_ATTEMPTS_INVALID');
+    if (!Number.isInteger(retryDelayMs) || retryDelayMs < 0)
+        throw new Error('UPDATE_RETRY_DELAY_INVALID');
+    let last;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        try {
+            return await fetchOnce(fetchFn, url, timeoutMs);
+        }
+        catch (error) {
+            last = error;
+            if (attempt >= attempts || !transient(error))
+                throw error;
+            await sleep(retryDelayMs);
+        }
+    }
+    throw last;
+}
+export async function discoverGitHubReleaseManifest({ channel, fetchFn = fetch, releasesUrl = 'https://api.github.com/repos/Ninozzz95/talos/releases?per_page=30', timeoutMs, retryDelayMs }) {
+    const policy = {};
+    if (timeoutMs !== undefined)
+        policy.timeoutMs = timeoutMs;
+    if (retryDelayMs !== undefined)
+        policy.retryDelayMs = retryDelayMs;
+    const response = await checkedResponse(fetchFn, releasesUrl, policy);
+    let releases;
+    try {
+        releases = await response.json();
+    }
+    catch {
+        throw new Error('UPDATE_RELEASE_METADATA_INVALID');
+    }
+    if (!Array.isArray(releases))
+        throw new Error('UPDATE_RELEASE_METADATA_INVALID');
+    const release = releases.find(r => r && r.draft !== true && typeof r.tag_name === 'string' && r.tag_name.startsWith('talos-cli-v') && (channel === 'preview' ? r.prerelease === true : r.prerelease !== true));
+    if (!release)
+        throw Object.assign(new Error('UPDATE_RELEASE_NOT_FOUND'), { code: 'UPDATE_RELEASE_NOT_FOUND' });
+    const asset = release.assets?.find(a => a?.name === 'talos-cli-release.json' && typeof a.browser_download_url === 'string');
+    if (!asset?.browser_download_url)
+        throw Object.assign(new Error('UPDATE_MANIFEST_ASSET_NOT_FOUND'), { code: 'UPDATE_MANIFEST_ASSET_NOT_FOUND' });
+    let url;
+    try {
+        url = new URL(asset.browser_download_url);
+    }
+    catch {
+        throw new Error('UPDATE_RELEASE_METADATA_INVALID');
+    }
+    if (url.protocol !== 'https:')
+        throw new Error('UPDATE_RELEASE_METADATA_INVALID');
+    return url.toString();
+}
+export async function performUpdateCheck({ currentVersion, channel, platform, manifestUrl, fetchFn = fetch, timeoutMs, retryDelayMs }) {
+    const policy = {};
+    if (timeoutMs !== undefined)
+        policy.timeoutMs = timeoutMs;
+    if (retryDelayMs !== undefined)
+        policy.retryDelayMs = retryDelayMs;
+    const response = await checkedResponse(fetchFn, manifestUrl, policy);
+    let manifest;
+    try {
+        manifest = await response.json();
+    }
+    catch {
+        throw new Error('UPDATE_MANIFEST_INVALID');
+    }
+    return checkRelease({ currentVersion, channel, platform, fetchManifest: async () => manifest });
+}
+export async function downloadVerifiedUpdate({ asset, cacheDir, fetchFn = fetch, timeoutMs, retryDelayMs }) {
+    await mkdir(cacheDir, { recursive: true, mode: 0o700 });
+    const policy = {};
+    if (timeoutMs !== undefined)
+        policy.timeoutMs = timeoutMs;
+    if (retryDelayMs !== undefined)
+        policy.retryDelayMs = retryDelayMs;
+    const response = await checkedResponse(fetchFn, asset.url, policy);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    await verifyDownloadedAsset(bytes, asset);
+    const raw = basename(new URL(asset.url).pathname) || 'talos-update.bin';
+    const name = raw.replace(/[^A-Za-z0-9._-]/gu, '_');
+    const target = join(cacheDir, name);
+    const tmp = `${target}.tmp-${process.pid}`;
+    await writeFile(tmp, bytes, { mode: 0o600 });
+    await rename(tmp, target);
+    return target;
+}

package/dist/version.js

@@ -0,0 +1,2 @@
+export const CLI_VERSION = '0.2.0';
+export const TALOS_BASE_COMMIT = '0c432153a288f64237e98403869d02d20d8fabc7';

package/dist/workspace/checkpoint-store.js

@@ -0,0 +1,210 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, open, readdir, readFile, realpath, rename, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { resolveWorkspaceIdentity } from "../security/workspace-identity.js";
+import { CHECKPOINT_LIMITS, captureWorkspaceSnapshot, extractWorkspaceWriteEvidence, sameGitSnapshot, sameSnapshotEntry } from "./checkpoint.js";
+function coded(code, message = code) { return Object.assign(new Error(message === code ? code : `${code}: ${message}`), { code }); }
+function validId(id) { if (!/^[0-9]+-[0-9a-f-]{36}$/iu.test(id))
+    throw coded('CHECKPOINT_ID_INVALID'); return id; }
+async function durableDir(dirname) { try {
+    const h = await open(dirname, 'r');
+    try {
+        await h.sync();
+    }
+    finally {
+        await h.close();
+    }
+}
+catch (error) {
+    if (process.platform !== 'win32')
+        throw error;
+} }
+async function ensurePrivateDir(dirname) { await mkdir(dirname, { recursive: true, mode: 0o700 }); try {
+    await chmod(dirname, 0o700);
+}
+catch (error) {
+    if (process.platform !== 'win32')
+        throw error;
+} }
+async function atomicWrite(pathname, text) {
+    const dirname = path.dirname(pathname);
+    await ensurePrivateDir(dirname);
+    const temp = path.join(dirname, `.${path.basename(pathname)}.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        const handle = await open(temp, 'wx', 0o600);
+        try {
+            await handle.writeFile(text, 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temp, pathname);
+        try {
+            await chmod(pathname, 0o600);
+        }
+        catch (error) {
+            if (process.platform !== 'win32')
+                throw error;
+        }
+        await durableDir(dirname);
+    }
+    catch (error) {
+        await rm(temp, { force: true }).catch(() => { });
+        throw error;
+    }
+}
+function parseRecord(text, expectedRoot) {
+    const value = JSON.parse(text);
+    if (value?.schema !== 'talos.cli.checkpoint.v1' || typeof value.id !== 'string' || value.canonicalRoot !== expectedRoot || !['open', 'complete', 'undone'].includes(value.state) || !value.pre)
+        throw coded('CHECKPOINT_STORE_INVALID');
+    return value;
+}
+function dedupeEvidence(rows) { const byKey = new Map(); for (const row of rows)
+    byKey.set(`${row.path}\0${row.beforeHash ?? ''}\0${row.afterHash ?? ''}`, row); return [...byKey.values()]; }
+export function createCheckpointStore({ rootDir, projectRoot, limits = CHECKPOINT_LIMITS }) {
+    const absoluteProject = path.resolve(projectRoot);
+    const absoluteRoot = path.resolve(rootDir);
+    const blobRoot = path.join(absoluteRoot, 'blobs');
+    let initialized = null;
+    async function init() {
+        if (!initialized)
+            initialized = (async () => { const workspace = await resolveWorkspaceIdentity({ projectRoot: absoluteProject }); const relation = path.relative(workspace.canonicalRoot, absoluteRoot); if (relation === '' || (!relation.startsWith(`..${path.sep}`) && relation !== '..' && !path.isAbsolute(relation)))
+                throw coded('CHECKPOINT_STORE_INSIDE_WORKSPACE'); await ensurePrivateDir(absoluteRoot); const canonicalState = await realpath(absoluteRoot); const stateRelation = path.relative(workspace.canonicalRoot, canonicalState); if (stateRelation === '' || (!stateRelation.startsWith(`..${path.sep}`) && stateRelation !== '..' && !path.isAbsolute(stateRelation)))
+                throw coded('CHECKPOINT_STORE_INSIDE_WORKSPACE'); const workspaceDir = path.join(canonicalState, 'workspaces', workspace.identityHash), recordsDir = path.join(workspaceDir, 'records'); await Promise.all([ensurePrivateDir(blobRoot), ensurePrivateDir(workspaceDir), ensurePrivateDir(recordsDir)]); return { workspaceDir, recordsDir, canonicalRoot: workspace.canonicalRoot }; })();
+        return initialized;
+    }
+    async function recordPath(id) { const x = await init(); return path.join(x.recordsDir, `${validId(id)}.json`); }
+    async function read(id) { const x = await init(); try {
+        return parseRecord(await readFile(await recordPath(id), 'utf8'), x.canonicalRoot);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            throw coded('CHECKPOINT_NOT_FOUND');
+        throw error;
+    } }
+    async function replace(record) { const x = await init(); if (record.canonicalRoot !== x.canonicalRoot)
+        throw coded('CHECKPOINT_WORKSPACE_MISMATCH'); await atomicWrite(await recordPath(record.id), `${JSON.stringify(record)}\n`); }
+    async function capture() { const x = await init(); return captureWorkspaceSnapshot({ projectRoot: x.canonicalRoot, blobRoot, limits }); }
+    async function list() { const x = await init(); let names = []; try {
+        names = await readdir(x.recordsDir);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return [];
+        throw error;
+    } const rows = []; for (const name of names.filter(name => name.endsWith('.json')).sort()) {
+        try {
+            rows.push(parseRecord(await readFile(path.join(x.recordsDir, name), 'utf8'), x.canonicalRoot));
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+    } return rows.sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.id.localeCompare(a.id)); }
+    async function begin(input) {
+        const pre = await capture();
+        const now = new Date().toISOString();
+        const record = { schema: 'talos.cli.checkpoint.v1', id: `${Date.now()}-${randomUUID()}`, operation: input.operation, sessionId: input.sessionId ?? null, commandId: null, state: 'open', createdAt: now, finalizedAt: null, workspaceIdentityHash: pre.workspace.identityHash, canonicalRoot: pre.workspace.canonicalRoot, pre, post: null, writeEvidence: [], reversible: true, nonReversibleReason: null, finalizationError: null, transitions: [{ kind: 'created', at: now }] };
+        await replace(record);
+        let finalized = null;
+        return { id: record.id, bindSession(sessionId) { record.sessionId = sessionId; }, bindCommand(commandId) { record.commandId = commandId; }, observe(raw) { record.writeEvidence.push(...extractWorkspaceWriteEvidence(raw)); }, finalize() {
+                if (finalized)
+                    return finalized;
+                finalized = (async () => { try {
+                    const post = await capture();
+                    const at = new Date().toISOString();
+                    record.post = post;
+                    record.state = 'complete';
+                    record.finalizedAt = at;
+                    record.writeEvidence = dedupeEvidence(record.writeEvidence);
+                    record.transitions.push({ kind: 'finalized', at });
+                    if (!sameGitSnapshot(record.pre.git, post.git)) {
+                        record.reversible = false;
+                        record.nonReversibleReason = 'CHECKPOINT_GIT_METADATA_CHANGED';
+                    }
+                    await replace(record);
+                    return record;
+                }
+                catch (error) {
+                    record.finalizationError = error instanceof Error ? error.message : String(error);
+                    await replace(record).catch(() => { });
+                    throw error;
+                } })();
+                return finalized;
+            } };
+    }
+    async function latest(state) { return (await list()).find(row => row.state === state) ?? null; }
+    async function withRestoreLock(fn) {
+        const x = await init();
+        const lockPath = path.join(x.workspaceDir, 'restore.lock');
+        let handle;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                handle = await open(lockPath, 'wx', 0o600);
+                break;
+            }
+            catch (error) {
+                if (error?.code !== 'EEXIST')
+                    throw error;
+                let stale = false;
+                try {
+                    const owner = Number((await readFile(lockPath, 'utf8')).trim());
+                    if (Number.isInteger(owner) && owner > 0 && owner !== process.pid) {
+                        try {
+                            process.kill(owner, 0);
+                        }
+                        catch (probe) {
+                            if (probe?.code === 'ESRCH')
+                                stale = true;
+                        }
+                    }
+                }
+                catch { }
+                if (stale) {
+                    await rm(lockPath, { force: true });
+                    continue;
+                }
+                throw coded('CHECKPOINT_RESTORE_BUSY');
+            }
+        }
+        if (!handle)
+            throw coded('CHECKPOINT_RESTORE_BUSY');
+        try {
+            await handle.writeFile(`${process.pid}\n`);
+            await handle.sync();
+            return await fn();
+        }
+        finally {
+            await handle.close().catch(() => { });
+            await rm(lockPath, { force: true }).catch(() => { });
+        }
+    }
+    async function transactionPath() { const x = await init(); return path.join(x.workspaceDir, 'restore-transaction.json'); }
+    async function readRestoreTransaction() { try {
+        const value = JSON.parse(await readFile(await transactionPath(), 'utf8'));
+        if (value?.schema !== 'talos.cli.checkpoint-restore.v1')
+            throw coded('CHECKPOINT_STORE_INVALID');
+        return value;
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return null;
+        throw error;
+    } }
+    async function writeRestoreTransaction(tx) { await atomicWrite(await transactionPath(), `${JSON.stringify(tx)}\n`); }
+    async function clearRestoreTransaction() { await rm(await transactionPath(), { force: true }); }
+    return { projectRoot: absoluteProject, rootDir: absoluteRoot, blobRoot, limits, begin, list, show: read, latest, capture, replace, withRestoreLock, readRestoreTransaction, writeRestoreTransaction, clearRestoreTransaction };
+}
+export function checkpointChanges(record) {
+    if (!record.post)
+        return [];
+    const pre = record.pre.entries, post = record.post.entries;
+    return [...new Set([...Object.keys(pre), ...Object.keys(post)])].sort()
+        .filter(relative => !sameSnapshotEntry(pre[relative], post[relative]))
+        .map(relative => ({ path: relative, change: !pre[relative] ? 'added' : !post[relative] ? 'deleted' : 'modified' }));
+}
+export async function sessionCheckpoints(store, sessionId) {
+    return (await store.list()).filter(row => row.sessionId === sessionId);
+}