mindspace: close authority boundaries

scripts/build-mindspace-service-runtime.mjs

@@ -33,8 +33,50 @@ async function exists(targetPath) {
   }
 }
 
+async function waitForFile(targetPath, { timeoutMs = 5000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let lastError = null;
+  while (Date.now() <= deadline) {
+    try {
+      const stat = await fs.stat(targetPath);
+      if (stat.isFile()) return;
+    } catch (error) {
+      lastError = error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  throw new Error(
+    `runtime file was not copied in time: ${targetPath}${
+      lastError?.message ? ` (${lastError.message})` : ''
+    }`,
+  );
+}
+
 async function remove(targetPath) {
-  await fs.rm(targetPath, { recursive: true, force: true });
+  try {
+    await fs.rm(targetPath, {
+      recursive: true,
+      force: true,
+      maxRetries: 5,
+      retryDelay: 100,
+    });
+    return;
+  } catch (error) {
+    if (!['ENOTEMPTY', 'EBUSY', 'EPERM'].includes(error?.code)) throw error;
+    const tombstone = `${targetPath}.delete-${process.pid}-${Date.now()}`;
+    try {
+      await fs.rename(targetPath, tombstone);
+    } catch (renameError) {
+      if (renameError?.code === 'ENOENT') return;
+      throw error;
+    }
+    await fs.rm(tombstone, {
+      recursive: true,
+      force: true,
+      maxRetries: 10,
+      retryDelay: 200,
+    });
+  }
 }
 
 async function copyDir(source, target) {
@@ -48,6 +90,7 @@ function shouldCopyMemindSource(source) {
   const parts = relative.split(path.sep);
   const top = parts[0];
   const last = parts[parts.length - 1];
+  if (parts.includes('node_modules')) return false;
   if (excludeTopLevel.has(top)) return false;
   if (last.endsWith('.pid')) return false;
   if (last === '.DS_Store' || last === '.env' || last === '.env.local') return false;
@@ -95,6 +138,7 @@ async function copyServiceSource() {
 async function copyMemindSourceSnapshot() {
   console.log('==> 拷贝 Memind 受控源码快照');
   const targetRoot = path.join(runtimeRoot, 'memind-source');
+  await remove(targetRoot);
   await fs.mkdir(targetRoot, { recursive: true });
   const entries = await fs.readdir(root);
   for (const entry of entries) {
@@ -165,7 +209,9 @@ async function main() {
   await copyMemindSourceSnapshot();
   await copyNodeModules();
   await writeMetadata();
-  await fs.chmod(path.join(runtimeRoot, 'scripts', 'run-mindspace-prod.sh'), 0o755);
+  const runnerPath = path.join(runtimeRoot, 'scripts', 'run-mindspace-prod.sh');
+  await waitForFile(runnerPath);
+  await fs.chmod(runnerPath, 0o755);
   console.log('');
   console.log(`MindSpace service runtime 已生成: ${runtimeRoot}`);
 }