@oooooooooo/ch0de 0.0.0-stage → 1.9.56

package/debtaur-orchestration.js

@@ -0,0 +1,456 @@
+"use strict";
+// Host-owned evidence, not model-authored propositions. See DEBTAUR-INTEGRATION.md.
+const fs = require("fs"),
+  path = require("path"),
+  crypto = require("crypto"),
+  engine = require("./debtaur-engine");
+const hash = engine.hash;
+const RULES = Object.freeze({
+  dispatch: {
+    rules: [
+      "if the scope is valid and the owner is current then the worker may start",
+    ],
+    goal: "the worker may start",
+    facts: ["the scope is valid", "the owner is current"],
+  },
+  handoff: {
+    rules: [
+      "if the owner is current and the artifact is current then the handoff is checked",
+      "if the handoff is checked and the check is passed then the handoff is ready",
+    ],
+    goal: "the handoff is ready",
+    facts: [
+      "the owner is current",
+      "the artifact is current",
+      "the check is passed",
+    ],
+  },
+  verify: {
+    rules: [
+      "if the artifact is current and the check is passed then the evidence is checked",
+      "if the evidence is checked and the workers are settled then the evidence is usable",
+    ],
+    goal: "the evidence is usable",
+    facts: [
+      "the artifact is current",
+      "the check is passed",
+      "the workers are settled",
+    ],
+  },
+});
+function create(root, options = {}) {
+  root = fs.realpathSync(root);
+  const client = options.client || engine.create(options),
+    run = crypto.randomUUID(),
+    taskHash = hash(
+      JSON.stringify([
+        options.goal || "",
+        options.session || "default",
+        options.acceptanceDigest || "",
+      ]),
+    );
+  const owners = new Map(),
+    leases = new Map(),
+    events = [];
+  let sequence = 0,
+    decisionCount = 0,
+    head = "0".repeat(64),
+    lastProof = null,
+    lastDecision = null,
+    storageWarning = null;
+  const relative = path.join(".chode", "orchestration", run + ".json");
+  function fileName(file) {
+    if (typeof file !== "string" || !file || /[\x00-\x1f]/.test(file))
+      throw Error("Invalid artifact path");
+    const full = path.resolve(root, file),
+      rel = path.relative(root, full);
+    if (
+      !rel ||
+      rel === ".." ||
+      rel.startsWith(".." + path.sep) ||
+      path.isAbsolute(rel) ||
+      /(^|[/\\])(?:\.chode|\.git|node_modules|\.env(?:\.[^/\\]*)?|credentials?)(?:[/\\]|$)/i.test(
+        rel,
+      ) ||
+      (options.allowed && !options.allowed(full))
+    )
+      throw Error("Artifact is outside the permitted source scope");
+    let at = root;
+    for (const segment of rel.split(path.sep)) {
+      at = path.join(at, segment);
+      try {
+        if (fs.lstatSync(at).isSymbolicLink())
+          throw Error("Linked artifact path");
+      } catch (error) {
+        if (error.code === "ENOENT") break;
+        throw error;
+      }
+    }
+    return {
+      full,
+      rel: rel.split(path.sep).join("/"),
+      key: process.platform === "win32" ? full.toLowerCase() : full,
+    };
+  }
+  function snapshot(files, allowMissing = false) {
+    const rows = [];
+    let total = 0;
+    try {
+      if (!Array.isArray(files) || files.length > 256)
+        throw Error("Artifact set exceeds256 files");
+      const names = [...new Set(files)]
+        .map(fileName)
+        .sort((a, b) => a.rel.localeCompare(b.rel, "en"));
+      for (const item of names) {
+        let fd;
+        try {
+          fd = fs.openSync(
+            item.full,
+            fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0),
+          );
+          const st = fs.fstatSync(fd);
+          if (
+            !st.isFile() ||
+            st.nlink > 1 ||
+            st.size > 16 * 1024 * 1024 ||
+            (total += st.size) > 64 * 1024 * 1024
+          )
+            throw Error("Artifact cannot be bounded safely");
+          // Read at most the observed size plus one byte. A concurrently
+          // growing artifact must not turn a bounded hash into an unbounded read.
+          const buffer = Buffer.alloc(st.size + 1);
+          let length = 0;
+          while (length < buffer.length) {
+            const read = fs.readSync(
+              fd,
+              buffer,
+              length,
+              buffer.length - length,
+              length,
+            );
+            if (!read) break;
+            length += read;
+          }
+          const bytes = buffer.subarray(0, length);
+          const after = fs.fstatSync(fd);
+          if (
+            bytes.length !== st.size ||
+            after.mtimeMs !== st.mtimeMs ||
+            after.size !== st.size
+          )
+            throw Error("Artifact changed while hashing");
+          rows.push({ file: item.rel, hash: hash(bytes) });
+        } catch (error) {
+          if (error.code === "ENOENT" && allowMissing)
+            rows.push({ file: item.rel, hash: null });
+          else throw error;
+        } finally {
+          if (fd !== undefined) fs.closeSync(fd);
+        }
+      }
+      return { ok: true, files: rows, hash: hash(JSON.stringify(rows)) };
+    } catch (error) {
+      return { ok: false, reason: error.message, files: [] };
+    }
+  }
+  function persist() {
+    if (options.noMemory) return;
+    try {
+      let at = root;
+      for (const part of [".chode", "orchestration"]) {
+        at = path.join(at, part);
+        try {
+          const st = fs.lstatSync(at);
+          if (st.isSymbolicLink() || !st.isDirectory())
+            throw Error("Unsafe orchestration storage");
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          fs.mkdirSync(at, { mode: 0o700 });
+        }
+      }
+      const file = path.join(root, relative);
+      try {
+        const st = fs.lstatSync(file);
+        if (st.isSymbolicLink() || st.nlink > 1 || !st.isFile())
+          throw Error("Unsafe orchestration report");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      const temp = file + "." + crypto.randomBytes(6).toString("hex") + ".tmp";
+      try {
+        fs.writeFileSync(
+          temp,
+          JSON.stringify(
+            {
+              schema: 1,
+              policy: "chode-evidence-v1",
+              run,
+              taskHash,
+              head,
+              sequence,
+              events,
+            },
+            null,
+            2,
+          ) + "\n",
+          { flag: "wx", mode: 0o600 },
+        );
+        fs.renameSync(temp, file);
+      } finally {
+        try {
+          fs.unlinkSync(temp);
+        } catch {}
+      }
+    } catch (error) {
+      storageWarning = String(error.message).slice(0, 160);
+    }
+  }
+  function record(kind, data) {
+    const event = { sequence: ++sequence, kind, ...data, previous: head };
+    head = hash(JSON.stringify(event));
+    events.push({ ...event, hash: head });
+    if (events.length > 128) events.shift();
+    persist();
+  }
+  async function decide(stage, flags, detail = {}) {
+    const policy = RULES[stage],
+      local = flags.every(Boolean) && !options.signal?.aborted;
+    const operations = [
+      ...policy.rules.map((clause) => ({ op: "stated", clause })),
+      ...policy.facts
+        .filter((_, i) => flags[i])
+        .map((clause) => ({ op: "stated", clause })),
+      { op: "!", clause: policy.goal },
+    ];
+    let judged;
+    try {
+      judged = await client.run(operations, options.signal);
+    } catch (error) {
+      judged = { status: "unavailable", reason: error.message };
+    }
+    const gate = judged.status === "judged" ? judged.rows.at(-1) : null;
+    const result = {
+      allowed: local && (!gate || gate.allow === true),
+      status: gate ? (gate.allow && local ? "allow" : "deny") : "unavailable",
+      stage,
+      localAllowed: local,
+      missing: policy.facts.filter((_, i) => !flags[i]),
+      backend: gate ? "debtaur-wasm" : "unavailable",
+      runtimeHash: judged.runtimeHash,
+      inputHash: judged.inputHash,
+      outputHash: judged.outputHash,
+      reason: gate?.why || judged.reason || "Judge unavailable",
+      ...detail,
+    };
+    decisionCount++;
+    lastDecision = result;
+    record("decision", {
+      ...result,
+      proof: gate
+        ? {
+            verdict: gate.verdict,
+            provenance: gate.provenance,
+            evidence: gate.evidence,
+          }
+        : null,
+    });
+    return result;
+  }
+  function invalidate(decision, reason) {
+    decision.allowed = false;
+    decision.status = "deny";
+    decision.localAllowed = false;
+    decision.reason = reason;
+    decision.missing = [
+      ...new Set([...(decision.missing || []), "the artifact is current"]),
+    ];
+    record("invalidation", {
+      stage: decision.stage,
+      inputHash: decision.inputHash,
+      reason,
+    });
+    return decision;
+  }
+  async function dispatch(unit) {
+    const files = Array.isArray(unit?.files) ? unit.files : [],
+      before = snapshot(files, true);
+    let scope = before.ok && files.length > 0,
+      available = true,
+      keys = [];
+    if (scope) {
+      keys = files.map(fileName).map((x) => x.key);
+      available = keys.every((key) => !owners.has(key));
+    }
+    const lease = {
+      id: crypto.randomUUID(),
+      unit: String(unit?.id || "worker").slice(0, 80),
+      files: [...files],
+      active: scope && available,
+      before,
+    };
+    // Reserve before awaiting: concurrent dispatches cannot claim the same file.
+    if (lease.active) {
+      leases.set(lease.id, lease);
+      keys.forEach((key) => owners.set(key, lease.id));
+    }
+    const verdict = await decide("dispatch", [scope, available], {
+      unit: lease.unit,
+      lease: lease.id,
+    });
+    if (!verdict.allowed) {
+      release(lease, "dispatch-denied");
+      return { ok: false, decision: verdict };
+    }
+    return { ok: true, lease, decision: verdict };
+  }
+  function release(lease, reason) {
+    if (!lease || leases.get(lease.id) !== lease) return;
+    lease.active = false;
+    for (const [key, id] of owners) if (id === lease.id) owners.delete(key);
+    leases.delete(lease.id);
+    record("worker-release", { unit: lease.unit, lease: lease.id, reason });
+  }
+  async function handoff(lease, beforeChecks, verdict) {
+    const owns = !!lease && leases.get(lease.id) === lease && lease.active,
+      after = lease ? snapshot(lease.files) : { ok: false };
+    const stable =
+      !!beforeChecks?.ok && after.ok && beforeChecks.hash === after.hash;
+    const decision = await decide(
+      "handoff",
+      [owns, stable, verdict?.ok === true],
+      {
+        unit: lease?.unit || "unknown",
+        lease: lease?.id,
+        snapshotHash: after.hash,
+        artifacts: after.files,
+      },
+    );
+    if (decision.allowed) {
+      const final = snapshot(lease.files);
+      if (!final.ok || final.hash !== after.hash)
+        invalidate(
+          decision,
+          "Artifact changed while the handoff verdict was computed",
+        );
+    }
+    release(lease, decision.allowed ? "handoff" : "handoff-rejected");
+    return decision;
+  }
+  async function verify(check, files) {
+    const before = snapshot(files);
+    lastProof = null;
+    const result = await check(),
+      after = snapshot(files);
+    const observable = before.ok && after.ok,
+      stable = observable && before.hash === after.hash;
+    // Unsupported/oversized sets do not invent a native approval; baseline checks
+    // remain useful. Actual observed mutations always invalidate the check.
+    if (!observable) {
+      lastDecision = {
+        stage: "verify",
+        status: "unavailable",
+        backend: "unavailable",
+        reason: before.reason || after.reason,
+        allowed: result.pass === true,
+        localAllowed: result.pass === true,
+      };
+      record("unobservable-check", lastDecision);
+      return result;
+    }
+    const decision = await decide(
+      "verify",
+      [
+        stable,
+        result.pass === true,
+        leases.size === 0 &&
+          (!options.workersSettled || options.workersSettled()),
+      ],
+      {
+        snapshotHash: after.hash,
+        artifacts: after.files,
+        checkHash: hash(JSON.stringify(result.checks || [])),
+      },
+    );
+    if (decision.allowed) {
+      const final = snapshot(files);
+      if (!final.ok || final.hash !== after.hash)
+        invalidate(
+          decision,
+          "Artifact changed while the check verdict was computed",
+        );
+    }
+    result.debtaur = decision;
+    if (result.pass && !decision.allowed) {
+      const failed = {
+        check: "current orchestration evidence",
+        ok: false,
+        detail: decision.missing.join("; ") || decision.reason,
+      };
+      result.checks.push(failed);
+      result.failed.push(failed);
+      result.pass = false;
+    }
+    if (result.pass)
+      lastProof = {
+        ...after,
+        checkHash: hash(JSON.stringify(result.checks || [])),
+      };
+    return result;
+  }
+  async function confirm() {
+    if (!lastProof)
+      return {
+        allowed: !options.signal?.aborted,
+        status: "unavailable",
+        reason: "No bounded artifact snapshot was certified",
+      };
+    const now = snapshot(lastProof.files.map((x) => x.file));
+    const decision = await decide(
+      "verify",
+      [
+        now.ok && now.hash === lastProof.hash,
+        true,
+        leases.size === 0 &&
+          (!options.workersSettled || options.workersSettled()),
+      ],
+      { snapshotHash: now.hash, checkHash: lastProof.checkHash },
+    );
+    if (decision.allowed) {
+      const final = snapshot(lastProof.files.map((x) => x.file));
+      if (!final.ok || final.hash !== lastProof.hash)
+        invalidate(
+          decision,
+          "Artifact changed while final evidence was confirmed",
+        );
+    }
+    return decision;
+  }
+  function summary() {
+    return {
+      policy: "chode-evidence-v1",
+      status: lastDecision?.status || "not-used",
+      backend: lastDecision?.backend || "unavailable",
+      runtimeHash: lastDecision?.runtimeHash,
+      stage: lastDecision?.stage,
+      reason: lastDecision?.reason,
+      decisions: decisionCount,
+      report: options.noMemory ? null : relative.split(path.sep).join("/"),
+      storageWarning,
+    };
+  }
+  function close() {
+    client.close();
+  }
+  return {
+    dispatch,
+    handoff,
+    release,
+    snapshot,
+    verify,
+    confirm,
+    summary,
+    close,
+    events: () => JSON.parse(JSON.stringify(events)),
+  };
+}
+module.exports = { create, RULES };

package/debtaur-worker.cjs

@@ -0,0 +1,76 @@
+"use strict";
+const fs = require("fs"),
+  path = require("path"),
+  crypto = require("crypto"),
+  { parentPort, workerData } = require("worker_threads");
+let modulePromise;
+async function load() {
+  const bytes = {};
+  for (const [name, expected] of Object.entries(workerData.pinned)) {
+    const file = path.join(workerData.directory, name),
+      st = fs.lstatSync(file);
+    if (
+      !st.isFile() ||
+      st.isSymbolicLink() ||
+      st.nlink > 1 ||
+      st.size > 1024 * 1024
+    )
+      throw Error("Unsafe Debtaur runtime");
+    bytes[name] = fs.readFileSync(file);
+    if (
+      crypto.createHash("sha256").update(bytes[name]).digest("hex") !== expected
+    )
+      throw Error("Debtaur runtime changed before loading");
+  }
+  const { default: create } = await import(
+    "data:text/javascript;base64," + bytes["judge_wasm.js"].toString("base64")
+  );
+  const wasm = new WebAssembly.Module(bytes["judge_wasm.wasm"]);
+  return create({
+    print() {},
+    printErr() {},
+    instantiateWasm(imports, callback) {
+      const instance = new WebAssembly.Instance(wasm, imports);
+      callback(instance);
+      return instance.exports;
+    },
+  });
+}
+// Serialize calls: the module-persistent native engine resets its high-water
+// state per batch. Concurrent calls into one instance must never interleave.
+let tail = Promise.resolve();
+parentPort.on("message", (message) => {
+  tail = tail
+    .then(async () => {
+      try {
+        const mod = await (modulePromise || (modulePromise = load())),
+          bytes = new TextEncoder().encode(message.wire),
+          cap = 524288;
+        let input = 0,
+          output = 0;
+        try {
+          input = mod._malloc(bytes.length + 1);
+          output = mod._malloc(cap);
+          if (!input || !output) throw Error("Debtaur allocation failed");
+          mod.HEAPU8.set(bytes, input);
+          mod.HEAPU8[input + bytes.length] = 0;
+          const n = mod._judge_run(input, output, cap);
+          if (n <= 0 || n >= cap - 1)
+            throw Error("Debtaur output limit reached");
+          const raw = new TextDecoder("utf-8", { fatal: true }).decode(
+            mod.HEAPU8.subarray(output, output + n),
+          );
+          parentPort.postMessage({ id: message.id, raw });
+        } finally {
+          if (input) mod._free(input);
+          if (output) mod._free(output);
+        }
+      } catch (error) {
+        parentPort.postMessage({
+          id: message.id,
+          error: String(error.message).slice(0, 160),
+        });
+      }
+    })
+    .catch(() => {});
+});

package/doctor.js

@@ -0,0 +1,24 @@
+'use strict';
+const fs=require('fs');const path=require('path');
+function inspect(root=process.cwd(),runtime=__dirname,options={}){
+ const checks=[];const push=(name,ok,detail)=>checks.push({name,ok,detail});
+ push('Node.js version',Number(process.versions.node.split('.')[0])>=18,process.version+' (18+ required)');
+ for(const file of ['chode.js','terminal-ui.js','workspace-tui.js','workspace-view.js','workspace-store.js','workspace-commands.js','automatic-re.js','agent-budget.js','acceptance-check.js','recovery-context.js','rea-environment.js','request-deadline.js','elapsed.js','tui-worker.js','web-context.js','toolbox.js','evidence-ledger.js','json-output.js'])push('Runtime '+file,fs.existsSync(path.join(runtime,file)),file);
+ for(const file of ['config.json','pending-tasks.json']){const p=path.join(root,'.chode',file);if(!fs.existsSync(p))continue;try{const value=JSON.parse(fs.readFileSync(p,'utf8'));if(file==='pending-tasks.json'&&(!Array.isArray(value)||value.some(t=>!t||typeof t.id!=='string'||typeof t.prompt!=='string')))throw Error('Invalid queue');if(file==='config.json'&&(!value||typeof value!=='object'||Array.isArray(value)))throw Error('Invalid config');push('State '+file,true,'valid JSON and expected shape');}catch(_){push('State '+file,false,'Invalid JSON. Back up and repair '+p);}}
+ const npmrc=path.join(root,'.npmrc');if(fs.existsSync(npmrc)){const fd=fs.openSync(npmrc,'r');const header=Buffer.alloc(2);try{fs.readSync(fd,header,0,2,0);}finally{fs.closeSync(fd);}if(header.equals(Buffer.from([255,254]))||header.equals(Buffer.from([254,255])))push('npm configuration encoding',false,'.npmrc is UTF-16; npm expects UTF-8. Convert its encoding without changing credentials.');}
+ if(options.rea){const nativeEnv=require('./rea-environment').resolve();for(const name of ['GHIDRA_INSTALL_DIR','JAVA_HOME']){const value=nativeEnv[name];push(name,!!value&&fs.existsSync(value),value&&fs.existsSync(value)?'Configured path exists.':'Not available in this process. If already configured in Windows user settings, restart the terminal; otherwise configure the installed Ghidra/JDK path.');}push('Local REA analysis',true,'Run chode tool rea doctor to check the analyzer. Automatic RE only inspects an explicitly named existing local binary and does not run it.');}
+ return {ok:checks.every(x=>x.ok),checks};
+}
+function repair(root=process.cwd()){
+ const p=path.join(root,'.npmrc');if(!fs.existsSync(p))return [];
+ const bytes=fs.readFileSync(p);let body;
+ if(bytes[0]===255&&bytes[1]===254)body=bytes.subarray(2);
+ else if(bytes[0]===254&&bytes[1]===255)body=Buffer.from(bytes.subarray(2)).swap16();
+ else return [];
+ const backup=p+'.encoding-backup';if(fs.existsSync(backup))throw new Error('Encoding backup already exists; review it before another repair.');
+ fs.writeFileSync(backup,bytes,{flag:'wx',mode:0o600});
+ fs.writeFileSync(p,body.toString('utf16le'),{encoding:'utf8',mode:0o600});
+ return ['Converted .npmrc from UTF-16 to UTF-8; original preserved in .npmrc.encoding-backup.'];
+}
+function run(argv=[]){let repairs=[],failure=null;try{if(argv.includes('--fix'))repairs=repair();}catch(error){failure={name:'Configuration repair',ok:false,detail:error.message};}let r;try{r={...inspect(process.cwd(),__dirname,{rea:argv.includes('--rea')}),repairs};}catch(error){r={ok:false,checks:[{name:'Local filesystem',ok:false,detail:error.message}],repairs};}if(failure){r.checks.push(failure);r.ok=false;}if(argv.includes('--json'))console.log(JSON.stringify(r));else console.log(repairs.concat(r.checks.map(c=>(c.ok?'✓ ':'! ')+c.name+' — '+c.detail)).join('\n'));if(!r.ok)process.exitCode=1;return r;}
+module.exports={inspect,repair,run};

package/edit-transactions.js

@@ -0,0 +1,79 @@
+'use strict';
+const fs=require('fs'),path=require('path'),crypto=require('crypto');
+const MAX_FILE=200*1024,MAX_TOTAL=1024*1024,KEEP=50;
+function unified(file,before,after){
+ if(before===after)return '';
+ if(before===null&&after==='')return 'diff --git '+JSON.stringify('a/'+file)+' '+JSON.stringify('b/'+file)+'\nnew file mode 100600\n';
+ const lines=s=>s==null||s===''?[]:s.split('\n').slice(0,s.endsWith('\n')?-1:undefined);
+ const a=lines(before),b=lines(after);let pre=0,tail=0;
+ while(pre<a.length&&pre<b.length&&a[pre]===b[pre])pre++;
+ if(pre===a.length&&pre===b.length&&pre)pre--;
+ const newlineChanged=!!before?.endsWith('\n')!==!!after?.endsWith('\n');
+ while(!newlineChanged&&tail<a.length-pre&&tail<b.length-pre&&a[a.length-1-tail]===b[b.length-1-tail])tail++;
+ const start=Math.max(0,pre-3),aEnd=Math.min(a.length,a.length-tail+3),bEnd=Math.min(b.length,b.length-tail+3),out=[];
+ const label=(prefix,exists)=>exists?JSON.stringify(prefix+'/'+file):'/dev/null';
+ out.push('--- '+label('a',before!==null),'+++ '+label('b',after!==null),'@@ -'+(aEnd-start?start+1:start)+','+(aEnd-start)+' +'+(bEnd-start?start+1:start)+','+(bEnd-start)+' @@');
+ const emit=(prefix,line,index,arr,raw)=>{out.push(prefix+line);if(index===arr.length-1&&raw&&!raw.endsWith('\n'))out.push('\');};
+ for(let i=start;i<pre;i++)emit(' ',a[i],i,a,before);
+ for(let i=pre;i<a.length-tail;i++)emit('-',a[i],i,a,before);
+ for(let i=pre;i<b.length-tail;i++)emit('+',b[i],i,b,after);
+ for(let i=0;i<Math.min(3,tail);i++)emit(' ',a[a.length-tail+i],a.length-tail+i,a,before);
+ return out.join('\n')+'\n';
+}
+function create(root,options={}){
+ const io=options.fs||fs,base=io.realpathSync(root),directory=path.join(base,'.chode','changes');
+ function target(file,state=false){
+  if(typeof file!=='string'||!file||/[\x00-\x1f]/.test(file)||path.isAbsolute(file))throw Error('Expected a relative workspace file');
+  const full=path.resolve(base,file),rel=path.relative(base,full),parts=rel.split(path.sep);
+  if(rel==='..'||rel.startsWith('..'+path.sep)||path.isAbsolute(rel)||!rel||parts.some(p=>p.toLowerCase()==='.git'||(!state&&p.toLowerCase()==='.chode')))throw Error('Denied workspace or harness-state path');
+  let at=base;for(const part of parts){at=path.join(at,part);try{if(io.lstatSync(at).isSymbolicLink())throw Error('Symbolic links are not editable');}catch(error){if(error.code!=='ENOENT')throw error;}}
+  if(!state&&options.allow&&options.allow(rel)===false)throw Error('Denied protected file');
+  return {full,file:rel.replace(/\\/g,'/')};
+ }
+ function read(file){const t=target(file);try{const stat=io.statSync(t.full);if(!stat.isFile()||stat.size>MAX_FILE||stat.nlink>1)throw Error('Expected an unlinked text file <=200KB');const data=io.readFileSync(t.full);if(data.includes(0))throw Error('Binary files are not editable');const content=data.toString('utf8');if(!Buffer.from(content).equals(data))throw Error('Invalid UTF-8 file');return {file:t.file,before:content,mode:stat.mode&0o777};}catch(error){if(error.code==='ENOENT')return {file:t.file,before:null,mode:0o600};throw error;}}
+ function atomic(full,content,mode=0o600){
+  io.mkdirSync(path.dirname(full),{recursive:true});const temp=full+'.chode-'+crypto.randomBytes(8).toString('hex')+'.tmp';let fd;
+  try{fd=io.openSync(temp,'wx',mode);io.fchmodSync(fd,mode);io.writeFileSync(fd,content);io.fsyncSync(fd);io.closeSync(fd);fd=null;io.renameSync(temp,full);}finally{if(fd!=null)io.closeSync(fd);try{io.unlinkSync(temp);}catch{}}
+ }
+ function save(record){target('.chode/changes',true);atomic(path.join(directory,record.id+'.json'),JSON.stringify(record));}
+ function records(){target('.chode/changes',true);let names;try{names=io.readdirSync(directory);}catch(e){if(e.code==='ENOENT')return [];throw e;}return names.filter(n=>/^change_[a-f0-9]{32}\.json$/.test(n)).map(n=>{
+  const full=path.join(directory,n);if(io.lstatSync(full).isSymbolicLink()||io.statSync(full).size>5*MAX_TOTAL)throw Error('Invalid edit journal');const r=JSON.parse(io.readFileSync(full,'utf8'));
+  if(r.id+'.json'!==n||!Number.isSafeInteger(r.seq)||!Array.isArray(r.changes)||r.changes.length>20)throw Error('Invalid edit journal');
+  for(const c of r.changes){target(c.file);if(![c.before,c.after].every(x=>x===null||typeof x==='string'&&Buffer.byteLength(x)<=MAX_FILE))throw Error('Invalid journal content');}
+  return r;
+ }).sort((a,b)=>b.seq-a.seq);}
+ function current(change){return read(change.file).before;}
+ function write(change,value){const t=target(change.file);if(value===null){try{io.unlinkSync(t.full);}catch(e){if(e.code!=='ENOENT')throw e;}}else atomic(t.full,value,change.mode);}
+ function restore(record){for(const c of record.changes){const now=current(c);if(now!==c.before&&now!==c.after)throw Error('Recovery conflict: '+c.file);}for(const c of record.changes)if(current(c)!==c.before)write(c,c.before);}
+ function locked(fn){
+  target('.chode/changes',true);io.mkdirSync(directory,{recursive:true});const lock=path.join(directory,'lock');let fd;
+  try{fd=io.openSync(lock,'wx',0o600);}catch(error){if(error.code!=='EEXIST')throw error;let owner;try{owner=JSON.parse(io.readFileSync(lock,'utf8'));process.kill(owner.pid,0);}catch(e){if(e.code==='ESRCH'){io.unlinkSync(lock);return locked(fn);}throw Error('Edit history is locked; inspect .chode/changes/lock before recovery');}throw Error('Another edit transaction is active');}
+  try{io.writeFileSync(fd,JSON.stringify({pid:process.pid}));io.closeSync(fd);fd=null;
+   for(const record of records())if(['applying','undoing'].includes(record.status)){restore(record);record.status=record.status==='undoing'?'undone':'rolled-back';save(record);}
+   return fn();
+  }finally{if(fd!=null)io.closeSync(fd);io.unlinkSync(lock);}
+ }
+ function prepare(edits,compile){
+  if(!Array.isArray(edits)||!edits.length||edits.length>20)throw Error('Supply 1–20 edits');const staged=new Map();
+  for(const edit of edits){if(!edit||typeof edit!=='object')throw Error('Invalid edit');const t=target(edit.file),key=process.platform==='win32'?t.full.toLowerCase():t.full;let c=staged.get(key);if(!c){c={...read(t.file)};c.after=c.before;staged.set(key,c);}
+   const result=compile(edit,c.after);if(!result||!result.ok){const error=Error(result?.error||'Edit could not be prepared');if(result?.recovery){error.recovery=result.recovery;error.file=t.file;}throw error;}if(typeof result.after!=='string'||Buffer.byteLength(result.after)>MAX_FILE||result.after.includes('\0'))throw Error('Expected UTF-8 text <=200KB');c.after=result.after;
+  }
+  const changes=[...staged.values()].filter(c=>c.before!==c.after);if(changes.reduce((n,c)=>n+Buffer.byteLength(c.before||'')+Buffer.byteLength(c.after||''),0)>MAX_TOTAL)throw Error('Batch exceeds 1MB journal limit');return changes;
+ }
+ function preview(changes){const diff=changes.map(c=>unified(c.file,c.before,c.after)).join('');return {ok:true,files:changes.map(c=>c.file),diff,truncated:false};}
+ function apply(changes,label='edit'){
+  return locked(()=>{
+   if(!changes.length)return {ok:true,files:[],unchanged:true,diff:''};
+   for(const c of changes)if(current(c)!==c.before)throw Error('File changed since preview: '+c.file);
+   if(typeof options.validate==='function')for(const c of changes)options.validate(c.file,c.before,c.after);
+   const all=records(),record={id:'change_'+crypto.randomBytes(16).toString('hex'),seq:(all[0]?.seq||0)+1,at:new Date().toISOString(),label:String(label).slice(0,120),status:'applying',changes};save(record);
+   try{for(const c of changes){if(current(c)!==c.before)throw Error('Concurrent file change: '+c.file);write(c,c.after);}record.status='applied';save(record);}
+   catch(error){try{restore(record);record.status='rolled-back';save(record);}catch(recovery){throw Error(error.message+'; '+recovery.message+'; recovery required for '+record.id);}throw error;}
+   for(const old of records().slice(KEEP))try{io.unlinkSync(path.join(directory,old.id+'.json'));}catch{}
+   return {...preview(changes),id:record.id};
+  });
+ }
+ function undo(id){return locked(()=>{const record=records().find(r=>r.status==='applied');if(!record)throw Error('Nothing to undo');if(id&&id!==record.id)throw Error('Undo the latest applied change first');for(const c of record.changes)if(current(c)!==c.after)throw Error('Undo conflict: file changed after edit: '+c.file);record.status='undoing';save(record);restore(record);record.status='undone';save(record);return {ok:true,id:record.id,files:record.changes.map(c=>c.file),diff:record.changes.map(c=>unified(c.file,c.after,c.before)).join('')};});}
+ return {prepare,preview,apply,undo,history:()=>records().map(({id,seq,at,label,status,changes})=>({id,seq,at,label,status,files:changes.map(c=>c.file)})),read};
+}
+module.exports={create,unified};

package/elapsed.js

@@ -0,0 +1,28 @@
+function formatElapsed(milliseconds) {
+  if (typeof milliseconds !== 'number' || !isFinite(milliseconds) || milliseconds < 0) {
+    return '0s';
+  }
+
+  const totalSeconds = Math.floor(milliseconds / 1000);
+
+  if (totalSeconds === 0) {
+    return '0s';
+  }
+
+  const hours = Math.floor(totalSeconds / 3600);
+  const remainderAfterHours = totalSeconds % 3600;
+  const minutes = Math.floor(remainderAfterHours / 60);
+  const secondsPart = remainderAfterHours % 60;
+
+  if (hours > 0) {
+    return hours + 'h ' + minutes + 'm ' + secondsPart + 's';
+  }
+
+  if (minutes > 0) {
+    return minutes + 'm ' + secondsPart + 's';
+  }
+
+  return secondsPart + 's';
+}
+
+module.exports = { formatElapsed };