@bendyline/gezel-inference 0.0.0-stage → 1.0.0

package/dist/chat/catalog-model-lookup.js

@@ -0,0 +1,48 @@
+/**
+ * Look up a chat-model manifest's `parameterSize` for the given model
+ * id. Best-effort: returns undefined when the model isn't in the
+ * catalog (third-party/manual installs) or when the lookup throws.
+ *
+ * The result feeds `classifyLocalModelTier`, which prefers an explicit
+ * parameterSize over tag parsing. The lookup matters because several catalog
+ * model tags drop the size suffix — `qwen3.6` is 27B but the tag never says
+ * so, and tag-only parsing would land it in `tiny` rather than `medium`.
+ */
+export async function resolveCatalogParameterSize(catalog, catalogId) {
+    if (!catalogId)
+        return undefined;
+    try {
+        const detail = await catalog.get('chat-model', catalogId);
+        if (!detail)
+            return undefined;
+        if (detail.manifest.kind !== 'chat-model')
+            return undefined;
+        return detail.manifest.parameterSize;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Catalog `contextWindow` lookup, mirroring
+ * {@link resolveCatalogParameterSize}. Drives the auto-activation of
+ * `prompt.minimal-context`: a model whose window can't hold the standing
+ * prompt (e.g. talkie-1930 at 2048) gets the stripped prompt without any
+ * per-manifest opt-in. Returns undefined when the id is unknown or the
+ * manifest omits the field (treated as "not tiny").
+ */
+export async function resolveCatalogContextWindow(catalog, catalogId) {
+    if (!catalogId)
+        return undefined;
+    try {
+        const detail = await catalog.get('chat-model', catalogId);
+        if (!detail)
+            return undefined;
+        if (detail.manifest.kind !== 'chat-model')
+            return undefined;
+        return detail.manifest.contextWindow;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/chat/local-model-tier.d.ts

@@ -0,0 +1 @@
+export * from '@bendyline/gezel/local-loop';

package/dist/chat/local-model-tier.js

@@ -0,0 +1,2 @@
+// Moved to core so the portable runtime resolves profiles the same way; see core/src/model-profile.
+export * from '@bendyline/gezel/local-loop';

package/dist/chat/vision-capability.d.ts

@@ -0,0 +1 @@
+export * from '../providers/vision-capability.js';

package/dist/chat/vision-capability.js

@@ -0,0 +1,3 @@
+// Compatibility entry point for product chat consumers. The capability logic
+// belongs to providers so native inference can use it independently of chat.
+export * from '../providers/vision-capability.js';

package/dist/engine-components.d.ts

@@ -0,0 +1,30 @@
+import type { GezelConfig } from '@bendyline/gezel';
+import type { CatalogService } from '@bendyline/gezel-catalog';
+import { SessionCacheController } from './cache/controller.js';
+import { EngineBinaryRegistry } from './engines/registry.js';
+type FitnessEngine = 'llama-cpp' | 'mlx' | 'ds4';
+import { GpuArbiter } from './providers/gpu-arbiter.js';
+import { LlamaCppModelManager } from './providers/llama-cpp/index.js';
+import { MlxModelManager } from './providers/mlx/index.js';
+import type { MlxRuntimeStatusBus } from './python/mlx-runtime-status-bus.js';
+import { UvRuntime } from './python/uv-runtime.js';
+export declare function createEngineComponents(opts: {
+    home: string;
+    catalog: CatalogService;
+    bootConfig: GezelConfig;
+    mlxRuntimeStatus: MlxRuntimeStatusBus;
+    scheduleInstallProbe: (info: {
+        engine: FitnessEngine;
+        id: string;
+    }) => void;
+}): Promise<{
+    llamaCppModels: LlamaCppModelManager;
+    ds4Models: LlamaCppModelManager;
+    mlxModels: MlxModelManager;
+    uvRuntime: UvRuntime;
+    ensureModel: import("./models/ensure.js").EnsureModelOrchestrator;
+    cacheController: SessionCacheController;
+    gpuArbiter: GpuArbiter;
+    engineBinaries: EngineBinaryRegistry;
+}>;
+export {};

package/dist/engine-components.js

@@ -0,0 +1,144 @@
+import { createLogger } from '@bendyline/gezel';
+import { DeviceHealthGate, createSystemDeviceHealthProbe, resolveDeviceSafetyPolicy, } from '@bendyline/gezel/native';
+import { defaultCacheBudgetMb } from './cache/budget.js';
+import { SessionCacheController } from './cache/controller.js';
+import { EngineBinaryRegistry } from './engines/registry.js';
+import { createEnsureModelOrchestrator } from './models/ensure.js';
+import { GpuArbiter, resolveGpuPolicy } from './providers/gpu-arbiter.js';
+import { LlamaCppModelManager } from './providers/llama-cpp/index.js';
+import { MLX_VENV_NAME, MlxModelManager, mlxVenvPackages } from './providers/mlx/index.js';
+import { UvRuntime } from './python/uv-runtime.js';
+const log = createLogger('engines');
+export async function createEngineComponents(opts) {
+    const { home, catalog, bootConfig, mlxRuntimeStatus, scheduleInstallProbe } = opts;
+    const llamaCppModels = new LlamaCppModelManager({
+        home,
+        catalog,
+        onInstalled: scheduleInstallProbe,
+    });
+    // ds4 (DwarfStar) GGUF storage. Reuses the llama.cpp model
+    // manager (ds4 GGUFs are structurally identical) pointed at `engines/ds4/`
+    // and the catalog `ds4` source block. Cheap to construct on any platform;
+    // the ds4 provider gates on platform/accelerator before ever using it.
+    const ds4Models = new LlamaCppModelManager({
+        home,
+        catalog,
+        engine: 'ds4',
+        onInstalled: scheduleInstallProbe,
+    });
+    // Shared Python-runtime bootstrap. Same pattern — cheap to construct
+    // everywhere; only the MLX provider actually asks it for a venv,
+    // and only on Apple Silicon. It is constructed before the MLX model
+    // manager so every model-install entrypoint can share the warm hook.
+    const uvRuntime = new UvRuntime({ home });
+    const warmMlxRuntime = () => {
+        mlxRuntimeStatus.publish({
+            phase: 'provisioning',
+            message: 'Preparing the MLX Python runtime while the model downloads…',
+        });
+        void uvRuntime
+            .ensureVenv({
+            name: MLX_VENV_NAME,
+            packages: mlxVenvPackages(bootConfig.mlxPackageSpec),
+        })
+            .then((venv) => {
+            mlxRuntimeStatus.publish({
+                phase: 'ready',
+                message: `Python ${venv.pythonVersion ?? '?'} via ${venv.source}`,
+            });
+        })
+            .catch((err) => {
+            const message = err instanceof Error ? err.message : String(err);
+            mlxRuntimeStatus.publish({ phase: 'error', error: message });
+            // Non-fatal: the lazy first-chat `ensureVenv` will retry and
+            // surface the error to the user then.
+            log.warn(`[mlx] install-time venv warm failed (will retry on first chat): ${message}`);
+        });
+    };
+    // Put the warm hook on the model manager itself so every install
+    // entrypoint — including the in-app Settings downloader — overlaps
+    // runtime provisioning with the weights download.
+    const mlxModels = new MlxModelManager({
+        home,
+        catalog,
+        onInstallStart: () => warmMlxRuntime(),
+        onInstalled: scheduleInstallProbe,
+    });
+    // Backs `POST /v1/models/ensure` + `GET /v1/models/ensure/:jobId/events`.
+    // Wraps the local model managers above into a single uniform
+    // "ensure this model is downloaded" primitive so third-party apps
+    // don't need to learn either install API.
+    const ensureModel = await createEnsureModelOrchestrator({
+        llamaCpp: llamaCppModels,
+        ds4: ds4Models,
+        mlx: mlxModels,
+        catalog,
+    });
+    // Engine-agnostic prompt-cache controller. Local providers (mlx,
+    // llama-cpp) register adapters with it as ChatManager constructs
+    // them; cloud providers ignore it. The reconcile timer runs in the
+    // background and is `unref`ed so it doesn't block shutdown.
+    const cacheController = new SessionCacheController({
+        logger: { info: (m) => log.info(m), warn: (m) => log.warn(m) },
+    });
+    // Apply per-engine cache budgets — explicit config overrides win
+    // over the RAM-aware default. Read once at boot; runtime config
+    // changes flow through `PUT /api/config` which calls back into the
+    // controller via `setBudget`. (Wired in the config route as part of
+    // the operator-controls UI work below.)
+    {
+        const { totalmem } = await import('node:os');
+        const ramAware = defaultCacheBudgetMb(totalmem());
+        const mlxBudgetMb = bootConfig.cacheBudgetMb?.mlx ?? ramAware;
+        const llamaCppBudgetMb = bootConfig.cacheBudgetMb?.['llama-cpp'] ?? ramAware;
+        // setBudget is a no-op for providers without registered adapters
+        // (which is correct here — adapters register lazily via
+        // ChatManager.ensureProvider). The controller will apply the
+        // budget on first registration via the entry's default + a
+        // setBudget call we add below.
+        cacheController.setBudget('mlx', mlxBudgetMb * 1024 * 1024);
+        cacheController.setBudget('llama-cpp', llamaCppBudgetMb * 1024 * 1024);
+    }
+    // Cross-engine GPU arbiter. Constructed before ChatManager and
+    // ImageProviderManager so both can register their evictors as soon
+    // as the underlying providers are built (lazy — first chat turn /
+    // first image gen). The shared device ledger admits automatic co-residency;
+    // an explicit swap preference still uses this slot arbiter. The PUT
+    // /api/config handler hot-swaps via `setPolicy`.
+    const deviceSafetyPolicy = resolveDeviceSafetyPolicy(bootConfig.deviceSafety);
+    const deviceHealthGate = new DeviceHealthGate({
+        policy: deviceSafetyPolicy,
+        probe: createSystemDeviceHealthProbe({
+            helperPath: process.env.GEZEL_DEVICE_HEALTH_BIN,
+        }),
+        log: (message) => log.info(message),
+    });
+    const gpuArbiter = new GpuArbiter({
+        policy: resolveGpuPolicy(bootConfig.gpuMemoryPolicy),
+        healthGate: deviceHealthGate,
+    });
+    log.info(`[gpu-arbiter] policy=${gpuArbiter.getPolicy()}`);
+    log.info(`[device-health] mode=${deviceSafetyPolicy.mode} start<=${deviceSafetyPolicy.maxStartTemperatureC}C resume<=${deviceSafetyPolicy.resumeTemperatureC}C margin>=${deviceSafetyPolicy.minThermalMarginC}C telemetryFailure=${deviceSafetyPolicy.onTelemetryFailure}`);
+    // Resolves native engine binaries on demand (lazy on-device chat + the
+    // manual Settings trigger). Verified download → cache → env-stamp; see
+    // engines/resolver.ts. Background-job lifecycle mirrors `imagePulls`.
+    // Constructed before ChatManager so the lazy on-device hook can reach it.
+    // Signature validation fails closed by default on Windows/macOS. The
+    // config remains an explicit operator escape hatch for development.
+    const engineBinaries = new EngineBinaryRegistry({
+        home,
+        ...(bootConfig.engineSignaturePolicy
+            ? { signaturePolicy: bootConfig.engineSignaturePolicy }
+            : {}),
+    });
+    return {
+        llamaCppModels,
+        ds4Models,
+        mlxModels,
+        uvRuntime,
+        ensureModel,
+        cacheController,
+        gpuArbiter,
+        engineBinaries,
+    };
+}

package/dist/engines/electron-native-reuse.d.ts

@@ -0,0 +1,65 @@
+import { verifyCodeSignature } from './signature.js';
+type FileSignatureExpectation = 'bendyline' | 'vendor-hash-only' | 'hash-only';
+interface NativeFilePin {
+    sha256: string;
+    sizeBytes: number;
+    /** How the native release signed this file; enforced there, not re-checked here. */
+    signature: FileSignatureExpectation;
+}
+interface NativePlatformPin {
+    files: Record<string, NativeFilePin>;
+    symlinks: Record<string, string>;
+}
+interface NativeFileManifest {
+    schemaVersion: 2;
+    release: string;
+    platforms: Record<string, NativePlatformPin>;
+}
+export interface ElectronNativeReuseResult {
+    reused: boolean;
+    nativeBinDir?: string;
+    reason: string;
+}
+export interface ElectronNativeReuseOptions {
+    candidates: string[];
+    platform?: NodeJS.Platform;
+    arch?: string;
+    release?: string;
+    manifest?: NativeFileManifest;
+    /** Verifies the enclosing macOS app; test seam. */
+    verifySignature?: typeof verifyCodeSignature;
+    /**
+     * Accept an exactly pinned standalone macOS native release tree without an
+     * enclosing Electron app. Intended for the development checkout populated
+     * by `fetch-native-binaries.mjs`; installed Electron payloads must leave
+     * this false so their parent app is also signature/notarization checked.
+     */
+    allowStandaloneMacPayload?: boolean;
+}
+/**
+ * Adopt Electron's extracted native payload, or an explicitly allowed
+ * standalone development payload, only when every executable and loadable
+ * library matches the CLI's source-bundled per-file pins.
+ *
+ * A manifest found beside the Electron app is never trusted. The expected
+ * file set and hashes come from this package, which pin-native-release.mjs
+ * updates from the separately published native release.
+ *
+ * The pins are the whole per-file check; signatures are not re-verified here.
+ * A native release tag cannot build without signing credentials, and its
+ * build verifies every first-party file's Authenticode or Developer ID
+ * signature as it signs it, so a matching SHA-256 proves the file is those
+ * signed bytes. Re-checking the signature at runtime could only add
+ * certificate revocation, which guards against binaries signed with a stolen
+ * key, and a file that matches a pin is byte for byte one this release
+ * produced. Meanwhile the operating system re-reads each signed file to check
+ * it: about a gigabyte on win32-x64, 3–6 s in front of every daemon start.
+ * Anyone able to change these pins could change this verifier as well.
+ * On macOS the enclosing app's signature and notarization, which vouch for
+ * the pins, are still checked below.
+ */
+/** Pure verification for embedders; never changes process.env. */
+export declare function verifyNativeBinaries(opts: ElectronNativeReuseOptions): Promise<ElectronNativeReuseResult>;
+/** Legacy adoption API. New embedding hosts should use the side-effect-free verifier. */
+export declare function reuseVerifiedElectronNativeBinaries(opts: ElectronNativeReuseOptions): Promise<ElectronNativeReuseResult>;
+export {};

package/dist/engines/electron-native-reuse.js

@@ -0,0 +1,305 @@
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { lstat, readdir, readlink } from 'node:fs/promises';
+import { basename, join, posix, relative, resolve, sep } from 'node:path';
+import { resolvePlatformKey } from '@bendyline/gezel/native';
+import pinnedManifestJson from './native-file-manifest.json' with { type: 'json' };
+import { effectiveEngineRelease } from './native-manifest.js';
+import { BENDYLINE_APPLE_TEAM_ID, BENDYLINE_PUBLISHER, verifyCodeSignature } from './signature.js';
+const pinnedManifest = pinnedManifestJson;
+/**
+ * Adopt Electron's extracted native payload, or an explicitly allowed
+ * standalone development payload, only when every executable and loadable
+ * library matches the CLI's source-bundled per-file pins.
+ *
+ * A manifest found beside the Electron app is never trusted. The expected
+ * file set and hashes come from this package, which pin-native-release.mjs
+ * updates from the separately published native release.
+ *
+ * The pins are the whole per-file check; signatures are not re-verified here.
+ * A native release tag cannot build without signing credentials, and its
+ * build verifies every first-party file's Authenticode or Developer ID
+ * signature as it signs it, so a matching SHA-256 proves the file is those
+ * signed bytes. Re-checking the signature at runtime could only add
+ * certificate revocation, which guards against binaries signed with a stolen
+ * key, and a file that matches a pin is byte for byte one this release
+ * produced. Meanwhile the operating system re-reads each signed file to check
+ * it: about a gigabyte on win32-x64, 3–6 s in front of every daemon start.
+ * Anyone able to change these pins could change this verifier as well.
+ * On macOS the enclosing app's signature and notarization, which vouch for
+ * the pins, are still checked below.
+ */
+/** Pure verification for embedders; never changes process.env. */
+export async function verifyNativeBinaries(opts) {
+    const platform = opts.platform ?? process.platform;
+    const arch = opts.arch ?? process.arch;
+    const release = opts.release ?? effectiveEngineRelease();
+    const manifest = opts.manifest ?? pinnedManifest;
+    if (manifest.schemaVersion !== 2 || manifest.release !== release) {
+        return {
+            reused: false,
+            reason: `no per-file native pins for release ${release}`,
+        };
+    }
+    const baseKey = resolvePlatformKey(platform, arch);
+    if (!baseKey) {
+        return { reused: false, reason: `unsupported platform ${platform}/${arch}` };
+    }
+    const platformEntries = Object.entries(manifest.platforms).filter(([key]) => key === baseKey || key.startsWith(`${baseKey}-`));
+    if (platformEntries.length === 0) {
+        return {
+            reused: false,
+            reason: `release ${release} has no pinned files for ${baseKey}`,
+        };
+    }
+    const failures = [];
+    for (const candidate of opts.candidates) {
+        const startedAt = Date.now();
+        try {
+            await verifyCandidate({
+                root: candidate,
+                platform,
+                entries: platformEntries,
+                verifySignature: opts.verifySignature ?? verifyCodeSignature,
+                allowStandaloneMacPayload: opts.allowStandaloneMacPayload === true,
+            });
+            return {
+                reused: true,
+                nativeBinDir: resolve(candidate),
+                // The elapsed time is load-bearing diagnostics, not decoration: this
+                // is pre-bind boot work whose cost scales with the payload, and on a
+                // CUDA host it is the largest single read the daemon ever does at
+                // startup. Without it in the log there is nothing to attribute a slow
+                // launch to.
+                reason: `verified ${opts.allowStandaloneMacPayload ? 'standalone' : 'Electron'} native release ${release} in ${((Date.now() - startedAt) / 1000).toFixed(1)}s`,
+            };
+        }
+        catch (error) {
+            failures.push(`${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        reused: false,
+        reason: failures.length > 0
+            ? failures.join('; ')
+            : 'no Electron native payload candidate was installed',
+    };
+}
+async function verifyCandidate(opts) {
+    const root = resolve(opts.root);
+    const rootInfo = await lstat(root);
+    if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) {
+        throw new Error('native-bin root is not a real directory');
+    }
+    for (const [platformKey, platformPin] of opts.entries) {
+        const platformDir = join(root, platformKey);
+        const platformInfo = await lstat(platformDir);
+        if (!platformInfo.isDirectory() || platformInfo.isSymbolicLink()) {
+            throw new Error(`native platform root is not a real directory: ${platformKey}`);
+        }
+        if (!isRecord(platformPin.files) || !isRecord(platformPin.symlinks)) {
+            throw new Error(`invalid native manifest entry: ${platformKey}`);
+        }
+        const actual = await listNativeEntries(platformDir, opts.platform);
+        assertSamePaths(`${platformKey} executable/loadable file`, Object.keys(platformPin.files), actual.files);
+        assertSamePaths(`${platformKey} symlink`, Object.keys(platformPin.symlinks), [
+            ...actual.symlinks.keys(),
+        ]);
+        // Hash several files at once. This runs on the boot path of every daemon
+        // — before the HTTP bind — and on a CUDA host the pinned set is dominated
+        // by NVIDIA redistributables: libcublasLt.so alone is 717 MB, libcublas.so
+        // another 111 MB. Serially, that is a gigabyte of streaming SHA-256 in
+        // front of the first request on every single launch. The work is I/O bound
+        // on a handful of very large files, so a small pool collapses most of it
+        // into the time of the largest member; a bigger pool just queues seeks.
+        // Semantics are unchanged: any rejection still fails the candidate, and
+        // the first one to fail wins the message.
+        // The pin is the whole per-file check; see verifyNativeBinaries.
+        await mapWithConcurrency(Object.entries(platformPin.files), 4, async ([relativePath, pin]) => {
+            if (!isSafeRelativePath(relativePath)) {
+                throw new Error(`unsafe pinned native path: ${relativePath}`);
+            }
+            const absolute = join(platformDir, ...relativePath.split('/'));
+            const info = await lstat(absolute);
+            if (!info.isFile() || info.isSymbolicLink()) {
+                throw new Error(`pinned file is missing or not regular: ${platformKey}/${relativePath}`);
+            }
+            // Cheap discriminator first: a size mismatch means the sha cannot match,
+            // so a wrong release is rejected without reading a byte of it.
+            if (info.size !== pin.sizeBytes) {
+                throw new Error(`size mismatch: ${platformKey}/${relativePath}`);
+            }
+            const actualSha = await sha256File(absolute);
+            if (actualSha !== pin.sha256.toLowerCase()) {
+                throw new Error(`sha256 mismatch: ${platformKey}/${relativePath}`);
+            }
+        });
+        for (const [relativePath, target] of Object.entries(platformPin.symlinks)) {
+            if (!isSafeRelativePath(relativePath)) {
+                throw new Error(`unsafe pinned symlink path: ${relativePath}`);
+            }
+            if (!isSafeSymlinkTarget(target)) {
+                throw new Error(`unsafe pinned symlink target: ${platformKey}/${relativePath} -> ${JSON.stringify(target)}`);
+            }
+            const actualTarget = actual.symlinks.get(relativePath);
+            if (actualTarget !== target) {
+                throw new Error(`symlink target mismatch: ${platformKey}/${relativePath} expected ${JSON.stringify(target)}, got ${JSON.stringify(actualTarget)}`);
+            }
+            resolvePinnedSymlink(platformKey, relativePath, platformPin);
+        }
+    }
+    if (opts.platform === 'darwin' && !opts.allowStandaloneMacPayload) {
+        const appBundle = enclosingMacApp(root);
+        if (!appBundle)
+            throw new Error('native payload is not inside a macOS app bundle');
+        const outcome = await opts.verifySignature(appBundle, {
+            platform: 'darwin',
+            policy: 'require',
+            expectedPublisher: BENDYLINE_PUBLISHER,
+            expectedAppleTeamId: BENDYLINE_APPLE_TEAM_ID,
+            requireNotarizedApp: true,
+        });
+        if (!outcome.accepted) {
+            throw new Error(`parent app signature/notarization rejected: ${outcome.result.detail ?? ''}`);
+        }
+    }
+}
+async function listNativeEntries(root, platform) {
+    const files = [];
+    const symlinks = new Map();
+    const visit = async (dir) => {
+        for (const entry of await readdir(dir, { withFileTypes: true })) {
+            const absolute = join(dir, entry.name);
+            const path = relative(root, absolute).split(sep).join('/');
+            if (!isSafeRelativePath(path)) {
+                throw new Error(`unsafe native payload path: ${path}`);
+            }
+            if (entry.isSymbolicLink()) {
+                const target = await readlink(absolute);
+                if (!isSafeSymlinkTarget(target)) {
+                    throw new Error(`unsafe symlink target in native payload: ${path} -> ${JSON.stringify(target)}`);
+                }
+                symlinks.set(path, target);
+            }
+            else if (entry.isDirectory()) {
+                await visit(absolute);
+            }
+            else if (entry.isFile()) {
+                const info = await lstat(absolute);
+                if (isLoadableNativeFile(platform, entry.name, info.mode)) {
+                    files.push(path);
+                }
+            }
+            else {
+                throw new Error(`unsupported native payload entry: ${path}`);
+            }
+        }
+    };
+    await visit(root);
+    return {
+        files: files.sort(),
+        symlinks: new Map([...symlinks].sort(([a], [b]) => a.localeCompare(b))),
+    };
+}
+/**
+ * Run `worker` over `items` with at most `limit` in flight, rejecting with the
+ * first failure. Workers already in flight are allowed to settle; nothing here
+ * mutates state, so an abandoned hash is inert.
+ */
+async function mapWithConcurrency(items, limit, worker) {
+    let next = 0;
+    const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        for (;;) {
+            const index = next++;
+            const item = items[index];
+            if (index >= items.length || item === undefined)
+                return;
+            await worker(item);
+        }
+    });
+    await Promise.all(runners);
+}
+function isLoadableNativeFile(platform, name, mode) {
+    const lower = basename(name).toLowerCase();
+    if (platform === 'win32')
+        return lower.endsWith('.exe') || lower.endsWith('.dll');
+    if (platform === 'darwin')
+        return lower.endsWith('.dylib') || (mode & 0o111) !== 0;
+    return lower.includes('.so') || (mode & 0o111) !== 0;
+}
+function isSafeRelativePath(path) {
+    return (path.length > 0 &&
+        !path.startsWith('/') &&
+        !path.includes('\\') &&
+        !path.includes('\0') &&
+        path
+            .split('/')
+            .every((segment) => segment.length > 0 && segment !== '.' && segment !== '..' && !segment.includes(':')));
+}
+function isSafeSymlinkTarget(target) {
+    return typeof target === 'string' && isSafeRelativePath(target);
+}
+function resolvePinnedSymlink(platformKey, start, platformPin) {
+    const seen = new Set();
+    let current = start;
+    while (Object.hasOwn(platformPin.symlinks, current)) {
+        if (seen.has(current)) {
+            throw new Error(`symlink cycle in ${platformKey}: ${[...seen, current].join(' -> ')}`);
+        }
+        seen.add(current);
+        const target = platformPin.symlinks[current];
+        if (!isSafeSymlinkTarget(target)) {
+            throw new Error(`unsafe pinned symlink target: ${platformKey}/${current} -> ${JSON.stringify(target)}`);
+        }
+        current = posix.normalize(posix.join(posix.dirname(current), target));
+        if (!isSafeRelativePath(current)) {
+            throw new Error(`symlink escapes platform directory: ${platformKey}/${start} -> ${JSON.stringify(target)}`);
+        }
+    }
+    if (!Object.hasOwn(platformPin.files, current)) {
+        throw new Error(`symlink does not terminate at a pinned regular file: ${platformKey}/${start} -> ${current}`);
+    }
+    return current;
+}
+function assertSamePaths(label, expected, actual) {
+    const expectedSorted = [...expected].sort();
+    const actualSorted = [...actual].sort();
+    if (expectedSorted.length !== actualSorted.length ||
+        expectedSorted.some((value, index) => value !== actualSorted[index])) {
+        const missing = expectedSorted.filter((path) => !actualSorted.includes(path));
+        const unexpected = actualSorted.filter((path) => !expectedSorted.includes(path));
+        throw new Error(`${label} set mismatch` +
+            `${missing.length > 0 ? `; missing: ${missing.join(', ')}` : ''}` +
+            `${unexpected.length > 0 ? `; unexpected: ${unexpected.join(', ')}` : ''}`);
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function enclosingMacApp(path) {
+    const normalized = path.split(sep).join('/');
+    const marker = '.app/Contents/';
+    const index = normalized.indexOf(marker);
+    return index < 0 ? null : normalized.slice(0, index + 4);
+}
+// Big read buffer so hashing a native binary doesn't starve inside the busy
+// daemon event loop (a 64 KB stream yields ~100k times and queues behind other
+// work). Engines is a lower layer than models, so this mirrors models'
+// MODEL_HASH_READ_BUFFER_BYTES rather than importing it.
+const HASH_READ_BUFFER_BYTES = 16 * 1024 * 1024;
+function sha256File(path) {
+    return new Promise((resolveHash, reject) => {
+        const hash = createHash('sha256');
+        const stream = createReadStream(path, { highWaterMark: HASH_READ_BUFFER_BYTES });
+        stream.on('data', (chunk) => hash.update(chunk));
+        stream.on('error', reject);
+        stream.on('end', () => resolveHash(hash.digest('hex')));
+    });
+}
+/** Legacy adoption API. New embedding hosts should use the side-effect-free verifier. */
+export async function reuseVerifiedElectronNativeBinaries(opts) {
+    const result = await verifyNativeBinaries(opts);
+    if (result.reused && result.nativeBinDir)
+        process.env.GEZEL_NATIVE_BIN_DIR = result.nativeBinDir;
+    return result;
+}