@cursor/bdk 0.2.2 → 0.2.4

package/src/internal/update-check.ts

@@ -1,517 +0,0 @@
-/**
- * Outdated-version warning + `agent-sdk update`.
- *
- * Every CLI run of a published install compares its own version against the
- * npm registry's `latest` dist-tag and warns on stderr when behind. The
- * registry lookup is cached under the config dir
- * (`~/.config/agent-serve/update-check.json`) so most runs never touch the
- * network; a stale cache refreshes inline under a short timeout, and any
- * network failure is silent (the warning is best-effort, never a blocker).
- *
- * `agent-sdk update` re-runs the lookup fresh, figures out how this copy was
- * installed (global npm/pnpm/yarn/bun, or a project dependency), and runs the
- * matching install command.
- */
-
-import { spawn } from "node:child_process";
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import { dirname, join, sep } from "node:path";
-import { z } from "zod";
-import { configDirPath } from "./cursor/credentials.js";
-import { describeError } from "./describe-error.js";
-import {
-  CLI_COMMAND_NAME,
-  isCompiledDistribution,
-  PACKAGE_NAME,
-  packageRootDir,
-  packageVersion,
-} from "./distribution.js";
-import { stderrPalette } from "./terminal-style.js";
-
-const NPM_REGISTRY_URL = "https://registry.npmjs.org";
-
-/** Refresh the registry lookup at most this often. */
-const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
-
-/** Inline refresh budget; a slow registry must not stall the command. */
-const WARN_FETCH_TIMEOUT_MS = 1500;
-
-/** `agent-sdk update` runs interactively, so it can afford a real timeout. */
-const UPDATE_FETCH_TIMEOUT_MS = 10_000;
-
-// ============================================================================
-// Version comparison (plain semver triples + prerelease, no ranges)
-// ============================================================================
-
-interface ParsedVersion {
-  release: [number, number, number];
-  prerelease: string[];
-}
-
-function parseVersion(version: string): ParsedVersion | undefined {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+.*)?$/.exec(version.trim());
-  if (match === null) {
-    return undefined;
-  }
-  return {
-    release: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4] === undefined ? [] : match[4].split("."),
-  };
-}
-
-/**
- * Semver-style ordering: negative when `a < b`, 0 when equal, positive when
- * `a > b`. Unparseable versions compare equal (never warn on garbage).
- */
-export function compareVersions(a: string, b: string): number {
-  const pa = parseVersion(a);
-  const pb = parseVersion(b);
-  if (pa === undefined || pb === undefined) {
-    return 0;
-  }
-  for (let i = 0; i < 3; i++) {
-    const diff = pa.release[i]! - pb.release[i]!;
-    if (diff !== 0) {
-      return diff;
-    }
-  }
-  // A release outranks any prerelease of the same triple.
-  if (pa.prerelease.length === 0 || pb.prerelease.length === 0) {
-    return pb.prerelease.length - pa.prerelease.length;
-  }
-  const len = Math.max(pa.prerelease.length, pb.prerelease.length);
-  for (let i = 0; i < len; i++) {
-    const ia = pa.prerelease[i];
-    const ib = pb.prerelease[i];
-    // A longer prerelease list outranks its prefix (1.0.0-a.1 > 1.0.0-a).
-    if (ia === undefined) {
-      return -1;
-    }
-    if (ib === undefined) {
-      return 1;
-    }
-    const na = /^\d+$/.test(ia) ? Number(ia) : undefined;
-    const nb = /^\d+$/.test(ib) ? Number(ib) : undefined;
-    if (na !== undefined && nb !== undefined) {
-      if (na !== nb) {
-        return na - nb;
-      }
-    } else if (na !== undefined) {
-      return -1; // numeric identifiers sort before alphanumeric ones
-    } else if (nb !== undefined) {
-      return 1;
-    } else if (ia !== ib) {
-      return ia < ib ? -1 : 1;
-    }
-  }
-  return 0;
-}
-
-// ============================================================================
-// Registry lookup
-// ============================================================================
-
-const distTagResponseSchema = z.object({ version: z.string() });
-
-/**
- * Latest published version of the package, from the registry's `latest`
- * dist-tag. Returns undefined on any failure (offline, 404 pre-publish, …).
- */
-export async function fetchLatestPublishedVersion(options?: {
-  fetchImpl?: typeof fetch;
-  timeoutMs?: number;
-  packageName?: string;
-}): Promise<string | undefined> {
-  const fetchImpl = options?.fetchImpl ?? fetch;
-  const packageName = options?.packageName ?? PACKAGE_NAME;
-  // Scoped names keep the `@` but encode the `/` for the registry path.
-  const url = `${NPM_REGISTRY_URL}/${packageName.replace("/", "%2F")}/latest`;
-  try {
-    const response = await fetchImpl(url, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(options?.timeoutMs ?? WARN_FETCH_TIMEOUT_MS),
-    });
-    if (!response.ok) {
-      return undefined;
-    }
-    const body = distTagResponseSchema.safeParse(await response.json());
-    if (!body.success || parseVersion(body.data.version) === undefined) {
-      return undefined;
-    }
-    return body.data.version;
-  } catch {
-    return undefined;
-  }
-}
-
-// ============================================================================
-// Cache (one JSON file next to credentials.json)
-// ============================================================================
-
-const cacheSchema: z.ZodObject<
-  { checkedAt: z.ZodNumber; latestVersion: z.ZodOptional<z.ZodString> },
-  "strip"
-> = z.object({
-  /** Epoch ms of the last registry lookup attempt (success or not). */
-  checkedAt: z.number(),
-  /** Last version the registry reported; absent when lookups keep failing. */
-  latestVersion: z.string().optional(),
-});
-
-export type UpdateCheckCache = z.infer<typeof cacheSchema>;
-
-export function updateCheckCachePath(configDir?: string): string {
-  return join(configDir ?? configDirPath(), "update-check.json");
-}
-
-export async function readUpdateCheckCache(
-  configDir?: string,
-): Promise<UpdateCheckCache | undefined> {
-  let raw: string;
-  try {
-    raw = await readFile(updateCheckCachePath(configDir), "utf8");
-  } catch {
-    return undefined;
-  }
-  try {
-    const parsed = cacheSchema.safeParse(JSON.parse(raw));
-    return parsed.success ? parsed.data : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-export async function writeUpdateCheckCache(
-  cache: UpdateCheckCache,
-  configDir?: string,
-): Promise<void> {
-  const path = updateCheckCachePath(configDir);
-  try {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, `${JSON.stringify(cache, null, 2)}\n`);
-  } catch {
-    // Best-effort; a read-only config dir just means re-checking next run.
-  }
-}
-
-// ============================================================================
-// The per-run warning
-// ============================================================================
-
-export interface WarnIfOutdatedOptions {
-  /** Defaults to the running package's own version. */
-  currentVersion?: string;
-  /** Test seam; defaults to the shared config dir. */
-  configDir?: string;
-  fetchImpl?: typeof fetch;
-  /** Test seam; defaults to Date.now(). */
-  now?: number;
-  env?: NodeJS.ProcessEnv;
-  /** Defaults to process.stderr.write. */
-  err?: (text: string) => void;
-  /** Skip the source-checkout guard (tests exercise the full path). */
-  force?: boolean;
-}
-
-/**
- * Print an outdated-version warning to stderr when a newer release exists.
- *
- * Never throws and never blocks longer than {@link WARN_FETCH_TIMEOUT_MS}.
- * Suppressed on source-checkout runs (there is no installed copy to update),
- * in CI, and via NO_UPDATE_NOTIFIER / AGENT_SERVE_NO_UPDATE_CHECK.
- */
-export async function warnIfOutdated(options?: WarnIfOutdatedOptions): Promise<void> {
-  const env = options?.env ?? process.env;
-  if (
-    isTruthyEnv(env.AGENT_SERVE_NO_UPDATE_CHECK) ||
-    isTruthyEnv(env.NO_UPDATE_NOTIFIER) ||
-    isTruthyEnv(env.CI)
-  ) {
-    return;
-  }
-  if (options?.force !== true && !isCompiledDistribution()) {
-    return;
-  }
-  const now = options?.now ?? Date.now();
-  const currentVersion = options?.currentVersion ?? packageVersion();
-
-  const cached = await readUpdateCheckCache(options?.configDir);
-  let latestVersion = cached?.latestVersion;
-  const fresh = cached !== undefined && now - cached.checkedAt < CHECK_INTERVAL_MS;
-  if (!fresh) {
-    const fetched = await fetchLatestPublishedVersion({
-      fetchImpl: options?.fetchImpl,
-      timeoutMs: WARN_FETCH_TIMEOUT_MS,
-    });
-    latestVersion = fetched ?? latestVersion;
-    // checkedAt always advances so a flaky registry backs off to one
-    // attempt per interval instead of one per command.
-    await writeUpdateCheckCache({ checkedAt: now, latestVersion }, options?.configDir);
-  }
-
-  if (latestVersion === undefined || compareVersions(currentVersion, latestVersion) >= 0) {
-    return;
-  }
-  const c = stderrPalette();
-  const err = options?.err ?? ((text: string) => void process.stderr.write(text));
-  err(
-    `${c.yellow("warning:")} ${CLI_COMMAND_NAME} ${currentVersion} is outdated (latest is ${latestVersion}). Run \`${CLI_COMMAND_NAME} update\` to upgrade.\n`,
-  );
-}
-
-function isTruthyEnv(value: string | undefined): boolean {
-  return value !== undefined && value !== "" && value !== "0";
-}
-
-// ============================================================================
-// `agent-sdk update`
-// ============================================================================
-
-export interface UpdateCommand {
-  cmd: string;
-  args: string[];
-  /** Working directory for local project installs. */
-  cwd?: string;
-  /** One-line human description of what will run and why. */
-  reason: string;
-}
-
-/**
- * Figure out how the running copy was installed and which command upgrades
- * it. Detection is path-shape based (global stores have recognizable
- * layouts), then falls back to walking up to the project that declares the
- * dependency. Returns undefined for layouts we cannot safely upgrade
- * (npx cache, unrecognized stores).
- */
-export async function detectUpdateCommand(args: {
-  packageRoot: string;
-  packageName?: string;
-}): Promise<UpdateCommand | undefined> {
-  const packageName = args.packageName ?? PACKAGE_NAME;
-  const spec = `${packageName}@latest`;
-  const posixRoot = args.packageRoot.split(sep).join("/");
-
-  // npx / pnpm dlx caches are ephemeral; a fresh `npx agent-sdk` already
-  // resolves latest, and upgrading the cache entry in place helps nobody.
-  if (posixRoot.includes("/_npx/") || posixRoot.includes("/.pnpm-store/")) {
-    return undefined;
-  }
-  if (posixRoot.includes("/pnpm/global/")) {
-    return {
-      cmd: "pnpm",
-      args: ["add", "-g", spec],
-      reason: "installed with pnpm --global",
-    };
-  }
-  if (posixRoot.includes("/.bun/install/global/")) {
-    return {
-      cmd: "bun",
-      args: ["add", "-g", spec],
-      reason: "installed with bun --global",
-    };
-  }
-  if (posixRoot.includes("/yarn/global/") || posixRoot.includes("/.config/yarn/global/")) {
-    return {
-      cmd: "yarn",
-      args: ["global", "add", spec],
-      reason: "installed with yarn global",
-    };
-  }
-
-  // A project that depends on the package: upgrade the dependency there,
-  // with whichever package manager the lockfile says the project uses.
-  const projectDir = await findDependingProjectDir(args.packageRoot, packageName);
-  if (projectDir !== undefined) {
-    const pm = await detectProjectPackageManager(projectDir);
-    const command =
-      pm === "pnpm"
-        ? { cmd: "pnpm", args: ["add", spec] }
-        : pm === "yarn"
-          ? { cmd: "yarn", args: ["add", spec] }
-          : pm === "bun"
-            ? { cmd: "bun", args: ["add", spec] }
-            : { cmd: "npm", args: ["install", spec] };
-    return {
-      ...command,
-      cwd: projectDir,
-      reason: `project dependency in ${projectDir}`,
-    };
-  }
-
-  // Global npm layout: <prefix>/lib/node_modules/<name> (or <prefix>\
-  // node_modules\<name> on Windows), with no depending project above it.
-  if (posixRoot.includes("/node_modules/")) {
-    return {
-      cmd: "npm",
-      args: ["install", "-g", spec],
-      reason: "installed with npm --global",
-    };
-  }
-  return undefined;
-}
-
-/**
- * Nearest ancestor with a package.json that declares `packageName` as a
- * dependency. Skips directories inside node_modules (pnpm's virtual store
- * nests package.json files that are not the user's project).
- */
-async function findDependingProjectDir(
-  packageRoot: string,
-  packageName: string,
-): Promise<string | undefined> {
-  let dir = dirname(packageRoot);
-  for (let depth = 0; depth < 30; depth++) {
-    const parent = dirname(dir);
-    if (parent === dir) {
-      return undefined;
-    }
-    const inNodeModules = dir.split(sep).some(part => part === "node_modules" || part === ".pnpm");
-    if (!inNodeModules && (await declaresDependency(dir, packageName))) {
-      return dir;
-    }
-    dir = parent;
-  }
-  return undefined;
-}
-
-async function declaresDependency(dir: string, packageName: string): Promise<boolean> {
-  let raw: string;
-  try {
-    raw = await readFile(join(dir, "package.json"), "utf8");
-  } catch {
-    return false;
-  }
-  const manifestSchema = z.object({
-    dependencies: z.record(z.string()).optional(),
-    devDependencies: z.record(z.string()).optional(),
-  });
-  try {
-    const parsed = manifestSchema.safeParse(JSON.parse(raw));
-    if (!parsed.success) {
-      return false;
-    }
-    return (
-      parsed.data.dependencies?.[packageName] !== undefined ||
-      parsed.data.devDependencies?.[packageName] !== undefined
-    );
-  } catch {
-    return false;
-  }
-}
-
-async function detectProjectPackageManager(
-  projectDir: string,
-): Promise<"pnpm" | "yarn" | "bun" | "npm"> {
-  const exists = async (file: string): Promise<boolean> => {
-    try {
-      await stat(join(projectDir, file));
-      return true;
-    } catch {
-      return false;
-    }
-  };
-  if (await exists("pnpm-lock.yaml")) {
-    return "pnpm";
-  }
-  if (await exists("yarn.lock")) {
-    return "yarn";
-  }
-  if ((await exists("bun.lock")) || (await exists("bun.lockb"))) {
-    return "bun";
-  }
-  return "npm";
-}
-
-export interface UpdateCliOptions {
-  /** Test seams. */
-  fetchImpl?: typeof fetch;
-  currentVersion?: string;
-  packageRoot?: string;
-  configDir?: string;
-  runCommand?: (command: UpdateCommand) => Promise<number>;
-  compiled?: boolean;
-  out?: (text: string) => void;
-  err?: (text: string) => void;
-}
-
-/** `agent-sdk update` — upgrade this install to the latest published version. */
-export async function cmdUpdate(options?: UpdateCliOptions): Promise<number> {
-  const c = stderrPalette();
-  const out = options?.out ?? ((text: string) => void process.stdout.write(text));
-  const err = options?.err ?? ((text: string) => void process.stderr.write(text));
-  const compiled = options?.compiled ?? isCompiledDistribution();
-  if (!compiled) {
-    err(
-      `${CLI_COMMAND_NAME} is running from a source checkout, not an installed package; update it with git instead.\n`,
-    );
-    return 1;
-  }
-
-  const currentVersion = options?.currentVersion ?? packageVersion();
-  const latestVersion = await fetchLatestPublishedVersion({
-    fetchImpl: options?.fetchImpl,
-    timeoutMs: UPDATE_FETCH_TIMEOUT_MS,
-  });
-  if (latestVersion === undefined) {
-    err(
-      `Could not reach the npm registry to look up the latest ${PACKAGE_NAME} version. Check your network and retry.\n`,
-    );
-    return 1;
-  }
-  if (compareVersions(currentVersion, latestVersion) >= 0) {
-    out(`${CLI_COMMAND_NAME} ${currentVersion} is already the latest version.\n`);
-    await writeUpdateCheckCache({ checkedAt: Date.now(), latestVersion }, options?.configDir);
-    return 0;
-  }
-
-  const command = await detectUpdateCommand({
-    packageRoot: options?.packageRoot ?? packageRootDir(),
-  });
-  if (command === undefined) {
-    err(
-      `${CLI_COMMAND_NAME} ${currentVersion} is outdated (latest is ${latestVersion}), but this install's layout was not recognized.\nUpgrade it yourself, e.g. \`npm install -g ${PACKAGE_NAME}@latest\` for a global install, or bump the ${PACKAGE_NAME} dependency in your project.\n`,
-    );
-    return 1;
-  }
-
-  const rendered = [command.cmd, ...command.args].join(" ");
-  err(
-    c.dim(
-      `Updating ${CLI_COMMAND_NAME} ${currentVersion} → ${latestVersion} (${command.reason}):\n  ${rendered}\n`,
-    ),
-  );
-  const run = options?.runCommand ?? runUpdateCommand;
-  let code: number;
-  try {
-    code = await run(command);
-  } catch (error) {
-    err(`\`${rendered}\` failed: ${describeError(error)}\n`);
-    return 1;
-  }
-  if (code !== 0) {
-    err(`\`${rendered}\` exited with code ${code}.\n`);
-    return code;
-  }
-  await writeUpdateCheckCache({ checkedAt: Date.now(), latestVersion }, options?.configDir);
-  out(`Updated ${CLI_COMMAND_NAME} to ${latestVersion}. New commands run the new version.\n`);
-  return 0;
-}
-
-function runUpdateCommand(command: UpdateCommand): Promise<number> {
-  return new Promise((resolve, reject) => {
-    // Windows-only shell: npm/pnpm/yarn/bun are .cmd shims there, and Node
-    // refuses to spawn .cmd files without a shell (EINVAL, CVE-2024-27980
-    // hardening). Injection-safe: cmd and args are module-level constants
-    // from detectUpdateCommand (never user or registry input).
-    // nosemgrep: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
-    const child = spawn(command.cmd, command.args, {
-      stdio: "inherit",
-      cwd: command.cwd,
-      shell: process.platform === "win32",
-    });
-    child.on("error", reject);
-    child.on("close", code => {
-      resolve(code ?? 1);
-    });
-  });
-}

package/src/internal/v2-hosting.ts

@@ -1,52 +0,0 @@
-import type { AgentArchitecture } from "../types.js";
-import {
-  type CursorManagedV2StoreIds,
-  requireCursorManagedV2StoreIdsSync,
-} from "./cursor/hosted-store-secrets.js";
-import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
-
-/**
- * Exported (as `1`) by the control plane's start script for a version
- * container of a persistent deployment. Its presence, not the agent's
- * `persistent` flag, is what tells the runtime it owns a durable state
- * directory.
- */
-export const AGENT_SERVE_PERSISTENT_ENV_VAR = "AGENT_SERVE_PERSISTENT";
-
-export type AgentV2Hosting =
-  | { kind: "not-v2" }
-  | { kind: "self-hosted" }
-  | {
-      kind: "cursor-managed";
-      resolveStoreIds: () => CursorManagedV2StoreIds;
-    }
-  | {
-      kind: "cursor-managed-persistent";
-    };
-
-/**
- * Close the architecture/hosting inputs into a compiler-owned union.
- *
- * Managed freeze processes exist before task bind, so store resolution stays
- * lazy. Consumers can branch once on `kind`; managed storage operations then
- * receive a resolver whose successful result always contains both ids.
- */
-export function resolveAgentV2Hosting(input: {
-  architecture: AgentArchitecture | undefined;
-  env?: NodeJS.ProcessEnv;
-}): AgentV2Hosting {
-  if (input.architecture !== "v2") {
-    return { kind: "not-v2" };
-  }
-  const env = input.env ?? process.env;
-  if (env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined) {
-    return { kind: "self-hosted" };
-  }
-  if (env[AGENT_SERVE_PERSISTENT_ENV_VAR] === "1") {
-    return { kind: "cursor-managed-persistent" };
-  }
-  return {
-    kind: "cursor-managed",
-    resolveStoreIds: () => requireCursorManagedV2StoreIdsSync(env),
-  };
-}

package/src/internal/workspace-sync.ts

@@ -1,114 +0,0 @@
-/**
- * Sync workspace trees onto an Agent Store so cloud-runtime turns read
- * them from the store mount. Authored `agent/sandbox/workspace/**` seeds
- * land at store-root `workspace/<path>` (see `buildCloudWorkspaceSection`).
- * Per-turn `workspaceFiles` land at `sessions/<sessionId>/workspace/<path>`
- * (see `buildCloudSessionWorkspaceSection`). Personal-key local+cloud
- * nests both under `agent-serve/<agent>/`.
- */
-
-import { readFile } from "node:fs/promises";
-import { agentStoreKeys, type FileSink } from "../files.js";
-import { MEMORY_DIR_NAME } from "../memory.js";
-import type { SeedFile } from "../types.js";
-import { mirrorToStore, storeRelPath } from "./store-mirror.js";
-
-export type WorkspaceFileBody = string | { encoding: "base64"; data: string; mimeType?: string };
-
-/** Path or encoding that can never land. Distinct from a store outage. */
-export class WorkspaceFileRefusal extends Error {
-  override readonly name = "WorkspaceFileRefusal";
-}
-
-/**
- * Mirror the seed tree onto the store at its authored relative paths and
- * delete keys no seed claims so redeploys drop removed files. Every seed
- * loads and validates before the store is touched.
- */
-export async function syncWorkspaceToStore(args: {
-  sink: FileSink;
-  seedFiles: readonly SeedFile[];
-  /** Store-root directory that holds the seed tree. Defaults to `workspace/`. */
-  workspacePrefix?: string;
-}): Promise<void> {
-  const workspacePrefix = args.workspacePrefix ?? agentStoreKeys.workspacePrefix();
-  const desired = new Map<string, Uint8Array>();
-  for (const seed of args.seedFiles) {
-    desired.set(
-      agentStoreKeys.workspaceFile(workspaceRelPath(seed.relativePath), workspacePrefix),
-      await readFile(seed.sourcePath),
-    );
-  }
-  await mirrorToStore({ sink: args.sink, prefix: workspacePrefix, desired });
-}
-
-/**
- * Replace the session workspace prefix with this turn's `workspaceFiles`.
- * Keys the map does not claim are deleted so a later send cannot leave a
- * stale `pr.json`. Every path validates before the store is touched.
- * Returns the relative paths that landed, in send order.
- */
-export async function syncSessionWorkspaceFiles(args: {
-  sink: FileSink;
-  files: Record<string, WorkspaceFileBody>;
-  workspacePrefix: string;
-}): Promise<string[]> {
-  const desired = new Map<string, Uint8Array>();
-  const relPaths: string[] = [];
-  for (const [relativePath, contents] of Object.entries(args.files)) {
-    const rel = workspaceRelPath(relativePath);
-    desired.set(
-      agentStoreKeys.workspaceFile(rel, args.workspacePrefix),
-      workspaceFileBytes(relativePath, contents),
-    );
-    relPaths.push(rel);
-  }
-  await mirrorToStore({
-    sink: args.sink,
-    prefix: args.workspacePrefix,
-    desired,
-  });
-  return relPaths;
-}
-
-/** Delete every key under the session workspace prefix. */
-export async function wipeSessionWorkspace(args: {
-  sink: FileSink;
-  workspacePrefix: string;
-}): Promise<void> {
-  await mirrorToStore({
-    sink: args.sink,
-    prefix: args.workspacePrefix,
-    desired: new Map(),
-  });
-}
-
-/**
- * Same reservation as local materialization's `resolveWorkspaceWritePath`:
- * `memory/` is the shared cross-session journal, so a seed or send under it
- * fails the sync exactly as it fails a local first turn.
- */
-function workspaceRelPath(relPath: string): string {
-  let rel: string;
-  try {
-    rel = storeRelPath(relPath, "workspace file");
-  } catch (error) {
-    throw new WorkspaceFileRefusal(error instanceof Error ? error.message : String(error));
-  }
-  if (rel.split("/", 1)[0] === MEMORY_DIR_NAME) {
-    throw new WorkspaceFileRefusal(
-      `"${MEMORY_DIR_NAME}" is reserved for shared session memory; refusing to sync ${relPath}`,
-    );
-  }
-  return rel;
-}
-
-function workspaceFileBytes(relativePath: string, contents: WorkspaceFileBody): Uint8Array {
-  if (typeof contents === "string") {
-    return new TextEncoder().encode(contents);
-  }
-  if (contents.encoding === "base64") {
-    return new Uint8Array(Buffer.from(contents.data, "base64"));
-  }
-  throw new WorkspaceFileRefusal(`Unsupported workspace file encoding for ${relativePath}`);
-}