@pmelab/gtd 63.0.0 → 64.0.0

package/src/platform/PinFile.ts

@@ -1,9 +1,3 @@
-import { execFileSync } from "node:child_process"
-import { existsSync, readFileSync } from "node:fs"
-import { registerHooks } from "node:module"
-import { join } from "node:path"
-import { pathToFileURL } from "node:url"
-
 /** A process's pin as the launcher found it: the file's bytes and where its engine runs from. */
 export interface FoundPin {
   readonly path: string
@@ -15,47 +9,3 @@ export interface FoundPin {
  * the landing after an unpin beat deleted the file still runs on the pin.
  */
 export type PinFile = () => FoundPin | undefined
-
-// `cwd`, as the engine's own root is: gtd runs only at the worktree root, and
-// a relocated `$GIT_DIR` leaves no `.git` to walk up to. A file that cannot be
-// read counts as no pin, so the launcher refuses it rather than crashing.
-export const livePinFile =
-  (cwd: string, path: string): PinFile =>
-  () => {
-    const file = join(cwd, path)
-    if (existsSync(file)) {
-      try {
-        return { path: file, bytes: readFileSync(file) }
-      } catch {
-        return { path: file, bytes: new Uint8Array() }
-      }
-    }
-    try {
-      const bytes = execFileSync("git", ["show", `HEAD:${path}`], {
-        cwd,
-        stdio: ["ignore", "pipe", "ignore"],
-      })
-      return { path: file, bytes }
-    } catch {
-      return undefined
-    }
-  }
-
-/**
- * Runs a pin's module as this process's main program. Node refuses an unknown
- * extension, so a load hook serves the unpacked source under the pin's own
- * URL — `import.meta.url` stays a file in the repository.
- */
-export const runPinModule = async (path: string, source: string): Promise<void> => {
-  const url = pathToFileURL(path).href
-  // A pin read from HEAD has no file behind its URL, which Node's own resolve refuses.
-  registerHooks({
-    resolve: (specifier, context, nextResolve) =>
-      specifier === url ? { url, shortCircuit: true } : nextResolve(specifier, context),
-    load: (requested, context, nextLoad) =>
-      requested === url
-        ? { format: "module", source, shortCircuit: true }
-        : nextLoad(requested, context),
-  })
-  await import(url)
-}

package/src/platform/Sha.ts

@@ -0,0 +1,121 @@
+import type { HashAlgorithm } from "./SyncIo.js"
+
+// The digest for a runtime without Node's crypto, which the in-memory tier runs on.
+
+const K256 = Uint32Array.from([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+])
+
+const rotl = (x: number, n: number): number => (x << n) | (x >>> (32 - n))
+const rotr = (x: number, n: number): number => (x >>> n) | (x << (32 - n))
+
+/** `data` padded to whole 64-byte blocks, its bit length big-endian at the end. */
+const padded = (data: Uint8Array): DataView => {
+  const length = Math.ceil((data.length + 9) / 64) * 64
+  const bytes = new Uint8Array(length)
+  bytes.set(data)
+  bytes[data.length] = 0x80
+  const view = new DataView(bytes.buffer)
+  view.setUint32(length - 8, Math.floor(data.length / 0x20000000))
+  view.setUint32(length - 4, (data.length * 8) >>> 0)
+  return view
+}
+
+/** Round `i`'s boolean function of `b`, `c`, `d`, plus its constant. */
+const sha1Mix = (i: number, b: number, c: number, d: number): number =>
+  i < 20
+    ? ((b & c) | (~b & d)) + 0x5a827999
+    : i < 40
+      ? (b ^ c ^ d) + 0x6ed9eba1
+      : i < 60
+        ? ((b & c) | (b & d) | (c & d)) + 0x8f1bbcdc
+        : (b ^ c ^ d) + 0xca62c1d6
+
+const sha1 = (view: DataView): Uint32Array => {
+  const h = Uint32Array.from([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0])
+  const w = new Uint32Array(80)
+  for (let block = 0; block < view.byteLength; block += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(block + i * 4)
+    for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3]! ^ w[i - 8]! ^ w[i - 14]! ^ w[i - 16]!, 1)
+    let [a, b, c, d, e] = [h[0]!, h[1]!, h[2]!, h[3]!, h[4]!]
+    for (let i = 0; i < 80; i++) {
+      const t = (rotl(a, 5) + sha1Mix(i, b, c, d) + e + w[i]!) | 0
+      e = d
+      d = c
+      c = rotl(b, 30)
+      b = a
+      a = t
+    }
+    h[0]! += a
+    h[1]! += b
+    h[2]! += c
+    h[3]! += d
+    h[4]! += e
+  }
+  return h
+}
+
+const sha256 = (view: DataView): Uint32Array => {
+  const h = Uint32Array.from([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+  ])
+  const w = new Uint32Array(64)
+  for (let block = 0; block < view.byteLength; block += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(block + i * 4)
+    for (let i = 16; i < 64; i++) {
+      const x = w[i - 15]!
+      const y = w[i - 2]!
+      const s0 = rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3)
+      const s1 = rotr(y, 17) ^ rotr(y, 19) ^ (y >>> 10)
+      w[i] = w[i - 16]! + s0 + w[i - 7]! + s1
+    }
+    let [a, b, c, d, e, f, g, hh] = [h[0]!, h[1]!, h[2]!, h[3]!, h[4]!, h[5]!, h[6]!, h[7]!]
+    for (let i = 0; i < 64; i++) {
+      const t1 =
+        (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K256[i]! + w[i]!) |
+        0
+      const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) | 0
+      hh = g
+      g = f
+      f = e
+      e = (d + t1) | 0
+      d = c
+      c = b
+      b = a
+      a = (t1 + t2) | 0
+    }
+    h[0]! += a
+    h[1]! += b
+    h[2]! += c
+    h[3]! += d
+    h[4]! += e
+    h[5]! += f
+    h[6]! += g
+    h[7]! += hh
+  }
+  return h
+}
+
+const encoder = new TextEncoder()
+
+export const pureHash = (
+  algorithm: HashAlgorithm,
+  ...parts: readonly (string | Uint8Array)[]
+): string => {
+  const chunks = parts.map((part) => (typeof part === "string" ? encoder.encode(part) : part))
+  const data = new Uint8Array(chunks.reduce((n, chunk) => n + chunk.length, 0))
+  let at = 0
+  for (const chunk of chunks) {
+    data.set(chunk, at)
+    at += chunk.length
+  }
+  const words = (algorithm === "sha1" ? sha1 : sha256)(padded(data))
+  return [...words].map((word) => word.toString(16).padStart(8, "0")).join("")
+}

package/src/platform/SyncIo.ts

@@ -0,0 +1,35 @@
+export type HashAlgorithm = "sha1" | "sha256"
+
+export interface FileInfo {
+  readonly type: "file" | "directory" | "symlink" | "other"
+  /** `undefined` where the platform has no POSIX user ids. */
+  readonly uid: number | undefined
+}
+
+/**
+ * The machine reads that must stay synchronous: workflows read the tree
+ * between two awaits during replay, so neither the reads nor the hashing
+ * behind them can wait on IO. Absence is a value (`undefined`); any other
+ * fault throws.
+ */
+export interface SyncIo {
+  readonly readFile: (path: string) => Uint8Array | undefined
+  readonly readText: (path: string) => string | undefined
+  readonly writeText: (path: string, content: string) => void
+  /** Creates every missing parent too. */
+  readonly makeDirectory: (path: string) => void
+  readonly rename: (from: string, to: string) => void
+  /** Follows a symlink. */
+  readonly stat: (path: string) => FileInfo | undefined
+  /** Reports a symlink as one. */
+  readonly lstat: (path: string) => FileInfo | undefined
+  readonly readLink: (path: string) => string
+  /** Throws when `path` does not exist. */
+  readonly realPath: (path: string) => string
+  /** git's stdout; throws on a non-zero exit, with git's stderr passed through. */
+  readonly git: (cwd: string, args: readonly string[]) => string
+  /** `git`'s raw stdout, with its stderr discarded. */
+  readonly gitBytes: (cwd: string, args: readonly string[]) => Uint8Array
+  /** Lowercase hex digest of the parts, concatenated; a string part is UTF-8. */
+  readonly hash: (algorithm: HashAlgorithm, ...parts: readonly (string | Uint8Array)[]) => string
+}

package/src/platform/Workspace.test.ts

@@ -54,7 +54,9 @@ const makeLiveTier = (): WorkspaceTier => {
 
   const hostLayer = Host.layer({ root, home: root, env: {} })
   const gitLayer = GitService.Live.pipe(Layer.provide(Layer.merge(hostLayer, NodeServices.layer)))
-  const workspaceLayer = Workspace.Live.pipe(Layer.provide(Layer.merge(hostLayer, gitLayer)))
+  const workspaceLayer = Workspace.Live.pipe(
+    Layer.provide(Layer.mergeAll(hostLayer, gitLayer, NodeServices.layer)),
+  )
 
   return {
     root,
@@ -270,8 +272,9 @@ describe("Workspace [Live] worktreeSync", () => {
         Effect.provide(
           Workspace.Live.pipe(
             Layer.provide(
-              Layer.merge(
+              Layer.mergeAll(
                 Host.layer({ root, home: root, env: {} }),
+                NodeServices.layer,
                 GitService.Live.pipe(
                   Layer.provide(
                     Layer.merge(Host.layer({ root, home: root, env: {} }), NodeServices.layer),
@@ -361,7 +364,9 @@ const makeLiveEpisodeTier = () => {
 
   const hostLayer = Host.layer({ root, home: root, env: {} })
   const gitLayer = GitService.Live.pipe(Layer.provide(Layer.merge(hostLayer, NodeServices.layer)))
-  const workspaceLayer = Workspace.Live.pipe(Layer.provide(Layer.merge(hostLayer, gitLayer)))
+  const workspaceLayer = Workspace.Live.pipe(
+    Layer.provide(Layer.mergeAll(hostLayer, gitLayer, NodeServices.layer)),
+  )
   const ops = (): Promise<WorkspaceOps> =>
     Effect.runPromise(
       Effect.gen(function* () {

package/src/platform/Workspace.ts

@@ -1,38 +1,22 @@
-import { execFileSync } from "node:child_process"
-import { createHash } from "node:crypto"
-import {
-  lstatSync,
-  mkdirSync,
-  readFileSync,
-  readlinkSync,
-  renameSync,
-  writeFileSync,
-} from "node:fs"
-import { dirname, isAbsolute, join } from "node:path"
-import { Context, Effect, Layer } from "effect"
+import { Context, Effect, Layer, Path } from "effect"
 import { GitService, type GitOperations } from "./Git.js"
-import { Host } from "./Host.js"
+import { Host, type HostOps } from "./Host.js"
+import { nodeSyncIo } from "./NodeSync.js"
+import type { SyncIo } from "./SyncIo.js"
 
 const toError = (e: unknown): Error => (e instanceof Error ? e : new Error(String(e)))
 
-// A tree listing, or one committed file, can overflow execFileSync's 1 MB default.
-const MAX_BUFFER = 256 * 1024 * 1024
 const HASH_CHUNK = 500
+const encoder = new TextEncoder()
 
 /** A full sha1 or sha256 object id — the only refs an immutable, disk-cached read is safe to key on. */
 const isObjectHash = (ref: string): boolean => /^[0-9a-f]{40}$|^[0-9a-f]{64}$/.test(ref)
 
 const GTD_CACHE_SUBDIR = "gtd-cache"
 
-const treeCachePath = (commonDir: string, hash: string): string =>
-  join(commonDir, GTD_CACHE_SUBDIR, "trees", hash)
-
-const blobCachePath = (commonDir: string, id: string): string =>
-  join(commonDir, GTD_CACHE_SUBDIR, "blobs", id)
-
-const readTextCache = (path: string): string | undefined => {
+const readTextCache = (io: SyncIo, path: string): string | undefined => {
   try {
-    return readFileSync(path, "utf8")
+    return io.readText(path)
   } catch {
     return undefined
   }
@@ -46,20 +30,26 @@ const readTextCache = (path: string): string | undefined => {
  * cache is a best-effort speedup, never a correctness dependency, and the
  * alternative — failing a gtd command over a cache write — is worse.
  */
-const writeTextCacheAtomic = (path: string, content: string): void => {
+const writeTextCacheAtomic = (
+  io: SyncIo,
+  paths: Path.Path,
+  pid: number,
+  path: string,
+  content: string,
+): void => {
   try {
-    mkdirSync(dirname(path), { recursive: true })
-    const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
-    writeFileSync(tmp, content, "utf8")
-    renameSync(tmp, path)
+    io.makeDirectory(paths.dirname(path))
+    const tmp = `${path}.tmp-${pid}-${Math.random().toString(36).slice(2)}`
+    io.writeText(tmp, content)
+    io.rename(tmp, path)
   } catch {
     // A full disk or read-only git dir silently disables the cache.
   }
 }
 
 /** A commit's `path → blob id` map, serialized as JSON. `undefined` on ANY read failure — missing, truncated, unparseable — so the caller falls back to asking git. */
-const readTreeCache = (commonDir: string, hash: string): Map<string, string> | undefined => {
-  const raw = readTextCache(treeCachePath(commonDir, hash))
+const readTreeCache = (io: SyncIo, file: string): Map<string, string> | undefined => {
+  const raw = readTextCache(io, file)
   if (raw === undefined) return undefined
   try {
     const parsed: unknown = JSON.parse(raw)
@@ -75,8 +65,13 @@ const readTreeCache = (commonDir: string, hash: string): Map<string, string> | u
   }
 }
 
-const writeTreeCache = (commonDir: string, hash: string, tree: ReadonlyMap<string, string>): void =>
-  writeTextCacheAtomic(treeCachePath(commonDir, hash), JSON.stringify(Object.fromEntries(tree)))
+const writeTreeCache = (
+  io: SyncIo,
+  paths: Path.Path,
+  pid: number,
+  file: string,
+  tree: ReadonlyMap<string, string>,
+): void => writeTextCacheAtomic(io, paths, pid, file, JSON.stringify(Object.fromEntries(tree)))
 
 /**
  * One raw `git log --raw` diff entry, already resolved to what it does to a
@@ -177,19 +172,14 @@ const parseLsTree = (out: string): Map<string, string> => {
  * check `ok` before doing so.
  */
 const fetchTree = (
+  io: SyncIo,
   root: string,
   ref: string,
 ): { readonly ok: boolean; readonly entries: Map<string, string> } => {
   try {
     return {
       ok: true,
-      entries: parseLsTree(
-        execFileSync("git", ["ls-tree", "-r", "-z", "--full-tree", ref], {
-          cwd: root,
-          encoding: "utf8",
-          maxBuffer: MAX_BUFFER,
-        }),
-      ),
+      entries: parseLsTree(io.git(root, ["ls-tree", "-r", "-z", "--full-tree", ref])),
     }
   } catch {
     return { ok: false, entries: new Map() }
@@ -263,8 +253,8 @@ export interface WorkspaceOps {
   readonly writeAtPath: (path: string, content: string) => Effect.Effect<void, Error>
 }
 
-const assertRepoRelative = (path: string): string => {
-  if (isAbsolute(path)) {
+const assertRepoRelative = (paths: Path.Path, path: string): string => {
+  if (paths.isAbsolute(path)) {
     throw new Error(
       `Workspace: "${path}" is an absolute path — this member takes repo-relative paths only (use "atPath"/"writeAtPath" to read/write outside the repo)`,
     )
@@ -272,24 +262,6 @@ const assertRepoRelative = (path: string): string => {
   return path
 }
 
-const readFileOrAbsent = (path: string): string | undefined => {
-  try {
-    return readFileSync(path, "utf8")
-  } catch (e) {
-    if ((e as NodeJS.ErrnoException).code === "ENOENT") return undefined
-    throw e
-  }
-}
-
-const lstatOrAbsent = (path: string): ReturnType<typeof lstatSync> | undefined => {
-  try {
-    return lstatSync(path)
-  } catch (e) {
-    if ((e as NodeJS.ErrnoException).code === "ENOENT") return undefined
-    throw e
-  }
-}
-
 /** One replayed commit: its hash and the (already-`\n`-stripped) `--raw -z` body `parseRawDiff` consumes. */
 interface RawLogEntry {
   readonly hash: string
@@ -304,27 +276,24 @@ interface RawLogEntry {
  * bounds no longer match git's own history.
  */
 const runRawLogReplay = (
+  io: SyncIo,
   root: string,
   base: string | undefined,
   head: string,
   commits: readonly string[],
 ): readonly RawLogEntry[] => {
   const range = base !== undefined ? `${base}..${head}` : head
-  const out = execFileSync(
-    "git",
-    [
-      "log",
-      "--first-parent",
-      "--reverse",
-      "-z",
-      "--raw",
-      "-r",
-      "--no-abbrev",
-      "--format=%x01%H",
-      range,
-    ],
-    { cwd: root, encoding: "utf8", maxBuffer: MAX_BUFFER },
-  )
+  const out = io.git(root, [
+    "log",
+    "--first-parent",
+    "--reverse",
+    "-z",
+    "--raw",
+    "-r",
+    "--no-abbrev",
+    "--format=%x01%H",
+    range,
+  ])
   const chunks = out.split("\x01").filter((c) => c.length > 0)
   if (chunks.length !== commits.length) {
     throw new Error(
@@ -363,11 +332,19 @@ const foldRawDiffs = (
 }
 
 const makeWorkspaceOps = (
-  root: string,
+  { root, pid }: HostOps,
   git: GitOperations,
   commonDir: string | undefined,
+  paths: Path.Path,
+  io: SyncIo,
 ): WorkspaceOps => {
-  const resolveAny = (path: string): string => (isAbsolute(path) ? path : join(root, path))
+  const resolveAny = (path: string): string =>
+    paths.isAbsolute(path) ? path : paths.join(root, path)
+  const repoPath = (path: string): string => paths.join(root, assertRepoRelative(paths, path))
+  const treeCachePath = (dir: string, hash: string): string =>
+    paths.join(dir, GTD_CACHE_SUBDIR, "trees", hash)
+  const blobCachePath = (dir: string, id: string): string =>
+    paths.join(dir, GTD_CACHE_SUBDIR, "blobs", id)
 
   // Per-PROCESS memo, on the workspace instance rather than any one replay's
   // `TreeView` — an immutable key (a commit hash, a blob id) can never serve
@@ -381,18 +358,18 @@ const makeWorkspaceOps = (
     const memoHit = treeMemo.get(hash)
     if (memoHit !== undefined) return memoHit
     if (commonDir === undefined) return undefined
-    const cached = readTreeCache(commonDir, hash)
+    const cached = readTreeCache(io, treeCachePath(commonDir, hash))
     if (cached !== undefined) treeMemo.set(hash, cached)
     return cached
   }
 
   const rememberTree = (hash: string, tree: ReadonlyMap<string, string>): void => {
     treeMemo.set(hash, tree)
-    if (commonDir !== undefined) writeTreeCache(commonDir, hash, tree)
+    if (commonDir !== undefined)
+      writeTreeCache(io, paths, pid, treeCachePath(commonDir, hash), tree)
   }
 
-  const readSync = (path: string): string | undefined =>
-    readFileOrAbsent(join(root, assertRepoRelative(path)))
+  const readSync = (path: string): string | undefined => io.readText(repoPath(path))
 
   /**
    * A blob's content, keyed on its OWN id rather than a (path, ref) pair —
@@ -405,7 +382,7 @@ const makeWorkspaceOps = (
     const memoHit = blobMemo.get(id)
     if (memoHit !== undefined) return memoHit
     if (commonDir !== undefined) {
-      const cached = readTextCache(blobCachePath(commonDir, id))
+      const cached = readTextCache(io, blobCachePath(commonDir, id))
       if (cached !== undefined) {
         blobMemo.set(id, cached)
         return cached
@@ -413,23 +390,20 @@ const makeWorkspaceOps = (
     }
     let content: string
     try {
-      content = execFileSync("git", ["cat-file", "-p", id], {
-        cwd: root,
-        encoding: "utf8",
-        maxBuffer: MAX_BUFFER,
-      })
+      content = io.git(root, ["cat-file", "-p", id])
     } catch {
       return undefined
     }
     blobMemo.set(id, content)
-    if (commonDir !== undefined) writeTextCacheAtomic(blobCachePath(commonDir, id), content)
+    if (commonDir !== undefined)
+      writeTextCacheAtomic(io, paths, pid, blobCachePath(commonDir, id), content)
     return content
   }
 
   // A raw, synchronous `git show <ref>:<path>` — the sync counterpart to
   // `committed`, for replay, which can't `yield*` mid-flow. Bypasses the Effect-based `GitOperations`
   // entirely, the same escape `readSync` already takes around the Effect
-  // `FileSystem` — both are raw Node calls, not a second git abstraction.
+  // `FileSystem` — both go through the sync port, not a second git abstraction.
   // ANY failure (missing ref, missing path at that ref, git not on PATH)
   // folds to `undefined`, matching `committed`'s own catch-all-as-absence.
   //
@@ -439,17 +413,13 @@ const makeWorkspaceOps = (
   // is never cached here, since it can move mid-process (a landing commit),
   // and goes straight to `git show` as before.
   const readCommittedSync = (path: string, ref = "HEAD"): string | undefined => {
-    const relPath = assertRepoRelative(path)
+    const relPath = assertRepoRelative(paths, path)
     if (isObjectHash(ref)) {
       const id = treeSync(ref).get(relPath)
       return id === undefined ? undefined : readBlobSync(id)
     }
     try {
-      return execFileSync("git", ["show", `${ref}:${relPath}`], {
-        cwd: root,
-        encoding: "utf8",
-        maxBuffer: MAX_BUFFER,
-      })
+      return io.git(root, ["show", `${ref}:${relPath}`])
     } catch {
       return undefined
     }
@@ -464,7 +434,7 @@ const makeWorkspaceOps = (
       const cached = peekTree(ref)
       if (cached !== undefined) return cached
     }
-    const { ok, entries } = fetchTree(root, ref)
+    const { ok, entries } = fetchTree(io, root, ref)
     if (!ok) {
       if (onFailure === "throw") {
         throw new Error(`gtd: failed to read the tree at "${ref}" — git ls-tree did not succeed`)
@@ -510,7 +480,7 @@ const makeWorkspaceOps = (
         }
 
         const head = commits[commits.length - 1]!
-        const replay = runRawLogReplay(root, base, head, commits)
+        const replay = runRawLogReplay(io, root, base, head, commits)
         for (const [hash, tree] of foldRawDiffs(baseTree, replay, rememberTree))
           result.set(hash, tree)
         return result
@@ -518,13 +488,7 @@ const makeWorkspaceOps = (
       catch: toError,
     })
 
-  const gitSync = (args: readonly string[], input?: string): string =>
-    execFileSync("git", args, {
-      cwd: root,
-      encoding: "utf8",
-      maxBuffer: MAX_BUFFER,
-      ...(input !== undefined ? { input } : {}),
-    })
+  const gitSync = (args: readonly string[]): string => io.git(root, args)
 
   // A path git status reports is re-hashed the way `git add` would store it;
   // every other path keeps HEAD's blob id, so an untouched file is never
@@ -544,13 +508,13 @@ const makeWorkspaceOps = (
     for (const record of status.split("\0")) {
       if (record.length < 4) continue
       const path = record.slice(3).replace(/\/$/, "")
-      const stat = lstatOrAbsent(join(root, path))
+      const stat = io.lstat(paths.join(root, path))
       if (stat === undefined) entries.delete(path)
-      else if (stat.isSymbolicLink()) {
-        entries.set(path, blobId(readlinkSync(join(root, path), "utf8")))
-      } else if (stat.isDirectory()) {
+      else if (stat.type === "symlink") {
+        entries.set(path, blobId(io.readLink(paths.join(root, path))))
+      } else if (stat.type === "directory") {
         // Only a directory holding its own repository is committed, as a gitlink.
-        if (lstatOrAbsent(join(root, path, ".git")) === undefined) entries.delete(path)
+        if (io.lstat(paths.join(root, path, ".git")) === undefined) entries.delete(path)
         else entries.set(path, gitlinkOf(path))
       } else files.push(path)
     }
@@ -567,10 +531,7 @@ const makeWorkspaceOps = (
   /** A submodule's (or embedded repository's) checked-out commit — what `git add` records for it. */
   const gitlinkOf = (path: string): string | undefined => {
     try {
-      return execFileSync("git", ["rev-parse", "HEAD"], {
-        cwd: join(root, path),
-        encoding: "utf8",
-      }).trim()
+      return io.git(paths.join(root, path), ["rev-parse", "HEAD"]).trim()
     } catch {
       return undefined
     }
@@ -579,11 +540,8 @@ const makeWorkspaceOps = (
   let objectFormat: string | undefined
   const blobId = (content: string): string => {
     objectFormat ??= gitSync(["rev-parse", "--show-object-format"]).trim()
-    const bytes = Buffer.from(content, "utf8")
-    return createHash(objectFormat === "sha256" ? "sha256" : "sha1")
-      .update(`blob ${bytes.length}\0`)
-      .update(bytes)
-      .digest("hex")
+    const bytes = encoder.encode(content)
+    return io.hash(objectFormat === "sha256" ? "sha256" : "sha1", `blob ${bytes.length}\0`, bytes)
   }
 
   return {
@@ -594,19 +552,19 @@ const makeWorkspaceOps = (
     read: (path) => Effect.try({ try: () => readSync(path), catch: toError }),
     write: (path, content) =>
       Effect.try({
-        try: () => writeFileSync(join(root, assertRepoRelative(path)), content, "utf8"),
+        try: () => io.writeText(repoPath(path), content),
         catch: toError,
       }),
     committed: (path, ref = "HEAD") =>
-      Effect.try({ try: () => assertRepoRelative(path), catch: toError }).pipe(
+      Effect.try({ try: () => assertRepoRelative(paths, path), catch: toError }).pipe(
         Effect.flatMap((relPath) =>
           git.readFileAtRef(ref, relPath).pipe(Effect.catch(() => Effect.succeed(undefined))),
         ),
       ),
     readCommittedSync,
-    atPath: (path) => readFileOrAbsent(resolveAny(path)),
+    atPath: (path) => io.readText(resolveAny(path)),
     writeAtPath: (path, content) =>
-      Effect.try({ try: () => writeFileSync(resolveAny(path), content, "utf8"), catch: toError }),
+      Effect.try({ try: () => io.writeText(resolveAny(path), content), catch: toError }),
   }
 }
 
@@ -614,8 +572,9 @@ export class Workspace extends Context.Service<Workspace, WorkspaceOps>()("Works
   static Live = Layer.effect(
     Workspace,
     Effect.gen(function* () {
-      const { root } = yield* Host
+      const host = yield* Host
       const git = yield* GitService
+      const paths = yield* Path.Path
       // Resolved once per process, not lazily inside a sync method: the
       // common dir is git's own concern to answer, and every cache read/
       // write below is synchronous. A repo whose common dir can't be
@@ -625,7 +584,7 @@ export class Workspace extends Context.Service<Workspace, WorkspaceOps>()("Works
       const commonDir = yield* git
         .gitCommonDir()
         .pipe(Effect.catch(() => Effect.succeed(undefined)))
-      return makeWorkspaceOps(root, git, commonDir)
+      return makeWorkspaceOps(host, git, commonDir, paths, nodeSyncIo)
     }),
   )
 }