@rigour-labs/core 6.2.3 → 6.2.5

package/dist/inference/llama-process.js

@@ -0,0 +1,126 @@
+/**
+ * Process runner and argument builder for llama-cli (llama.cpp b5604).
+ *
+ * Flags verified against b5604:
+ * - `-st` applies the model's chat template for one turn, then exits. Without
+ *   it an instruct model starts an interactive chat and waits on stdin;
+ *   `-no-cnv` avoids that but treats the prompt as raw text to continue.
+ * - `--json-schema-file` constrains output to the findings schema. There is
+ *   no `--json` flag; b5604 rejects it.
+ * - `--log-disable` is NOT used: in b5604 it also suppresses the generated
+ *   text, so stdout comes back empty.
+ * - `--seed` is fixed: llama.cpp otherwise draws a random seed per run, so
+ *   the same file could pass one CI run and fail the next.
+ */
+import { spawn } from 'child_process';
+const MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
+const MIN_CONTEXT = 4096;
+const MAX_CONTEXT = 32768;
+/** Conservative characters-per-token for code and JSON-ish prompts. */
+const CHARS_PER_TOKEN = 3;
+const FIXED_SEED = 42;
+export class ProcessTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`timed out after ${timeoutMs / 1000}s`);
+        this.name = 'ProcessTimeoutError';
+    }
+}
+/**
+ * Run a binary with stdin closed, collecting stdout/stderr. Rejects on spawn
+ * errors and timeouts; a non-zero exit resolves with its code.
+ */
+export function runProcess(command, args, options) {
+    const isWindowsScript = process.platform === 'win32' && /\.(cmd|bat)$/i.test(command);
+    const [bin, argv] = isWindowsScript
+        ? ['cmd.exe', ['/d', '/s', '/c', [command, ...args].map(quoteCmdArg).join(' ')]]
+        : [command, args];
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin, argv, { stdio: ['ignore', 'pipe', 'pipe'], env: options.env, windowsHide: true });
+        const stdout = new BoundedBuffer();
+        const stderr = new BoundedBuffer();
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new ProcessTimeoutError(options.timeoutMs));
+        }, options.timeoutMs);
+        child.stdout.on('data', (chunk) => stdout.push(chunk));
+        child.stderr.on('data', (chunk) => stderr.push(chunk));
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            resolve({ code, stdout: stdout.toString(), stderr: stderr.toString() });
+        });
+    });
+}
+class BoundedBuffer {
+    chunks = [];
+    size = 0;
+    push(chunk) {
+        if (this.size >= MAX_OUTPUT_BYTES)
+            return;
+        this.chunks.push(chunk);
+        this.size += chunk.length;
+    }
+    toString() {
+        return Buffer.concat(this.chunks).toString('utf8');
+    }
+}
+function quoteCmdArg(value) {
+    return `"${value.replace(/"/g, '\\"')}"`;
+}
+export function buildLlamaArgs(input) {
+    const args = [
+        '--model', input.modelPath,
+        '--prompt', input.prompt,
+        '--n-predict', String(input.maxTokens),
+        '--threads', String(input.threads),
+        '--temp', String(input.temperature),
+        '--seed', String(FIXED_SEED),
+        '--ctx-size', String(contextSizeFor(input.prompt, input.maxTokens)),
+        '--no-display-prompt',
+        '-st',
+        '--simple-io',
+    ];
+    if (input.schemaPath)
+        args.push('--json-schema-file', input.schemaPath);
+    return args;
+}
+/**
+ * Context window large enough for prompt + output, rounded up to 1024 and
+ * clamped to what Qwen2.5-Coder was trained on. The b5604 default is 4096,
+ * which silently truncates code-bearing prompts.
+ */
+export function contextSizeFor(prompt, maxTokens) {
+    const needed = Math.ceil(prompt.length / CHARS_PER_TOKEN) + maxTokens + 256;
+    const rounded = Math.ceil(needed / 1024) * 1024;
+    return Math.min(MAX_CONTEXT, Math.max(MIN_CONTEXT, rounded));
+}
+/** Remove llama-cli's end-of-generation marker from stdout. */
+export function cleanLlamaOutput(stdout) {
+    return stdout.replace(/\s*\[end of text\]\s*$/, '').trim();
+}
+/** JSON schema matching DeepFinding, used to constrain local generation. */
+export const FINDINGS_JSON_SCHEMA = {
+    type: 'object',
+    properties: {
+        findings: {
+            type: 'array',
+            items: {
+                type: 'object',
+                properties: {
+                    category: { type: 'string' },
+                    severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'] },
+                    file: { type: 'string' },
+                    line: { type: ['integer', 'null'] },
+                    description: { type: 'string' },
+                    suggestion: { type: 'string' },
+                    confidence: { type: 'number' },
+                },
+                required: ['category', 'severity', 'file', 'description', 'suggestion', 'confidence'],
+            },
+        },
+    },
+    required: ['findings'],
+};

package/dist/inference/llama-process.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/llama-process.test.js

@@ -0,0 +1,61 @@
+import { describe, expect, it } from 'vitest';
+import { buildLlamaArgs, cleanLlamaOutput, contextSizeFor, runProcess } from './llama-process.js';
+const base = { modelPath: '/m.gguf', prompt: 'hello', maxTokens: 1024, threads: 4, temperature: 0.1 };
+describe('buildLlamaArgs', () => {
+    it('uses flags llama.cpp b5604 accepts and that keep generated text on stdout', () => {
+        const args = buildLlamaArgs(base);
+        expect(args).toContain('-st');
+        expect(args).toContain('--simple-io');
+        expect(args).toContain('--no-display-prompt');
+        expect(args).not.toContain('--json');
+        expect(args).not.toContain('--log-disable');
+    });
+    it('fixes the seed so a run is reproducible', () => {
+        const args = buildLlamaArgs(base);
+        expect(args[args.indexOf('--seed') + 1]).toBe('42');
+    });
+    it('constrains output with the findings schema file when given', () => {
+        const args = buildLlamaArgs({ ...base, schemaPath: '/schema.json' });
+        expect(args.slice(-2)).toEqual(['--json-schema-file', '/schema.json']);
+        expect(buildLlamaArgs(base)).not.toContain('--json-schema-file');
+    });
+    it('passes a context size that fits the prompt', () => {
+        const args = buildLlamaArgs({ ...base, prompt: 'x'.repeat(30_000) });
+        expect(Number(args[args.indexOf('--ctx-size') + 1])).toBe(contextSizeFor('x'.repeat(30_000), 1024));
+    });
+});
+describe('contextSizeFor', () => {
+    it('never goes below the 4096 default', () => {
+        expect(contextSizeFor('short', 512)).toBe(4096);
+    });
+    it('grows with the prompt, rounded up to 1024', () => {
+        const size = contextSizeFor('x'.repeat(30_000), 1024);
+        expect(size).toBeGreaterThanOrEqual(10_000 + 1024);
+        expect(size % 1024).toBe(0);
+    });
+    it('is capped at the model training context', () => {
+        expect(contextSizeFor('x'.repeat(1_000_000), 1024)).toBe(32768);
+    });
+});
+describe('cleanLlamaOutput', () => {
+    it('strips the end-of-generation marker', () => {
+        expect(cleanLlamaOutput('{"findings": []} [end of text]\n\n')).toBe('{"findings": []}');
+    });
+});
+describe('runProcess', () => {
+    it('collects stdout and stderr and returns the exit code', async () => {
+        const result = await runProcess(process.execPath, ['-e', 'process.stdout.write("out");process.stderr.write("err");process.exit(3)'], { timeoutMs: 10_000 });
+        expect(result).toEqual({ code: 3, stdout: 'out', stderr: 'err' });
+    });
+    it('runs with stdin closed so an interactive binary cannot wait on it', async () => {
+        const result = await runProcess(process.execPath, ['-e', 'process.stdin.on("end",()=>process.stdout.write("eof")).resume()'], { timeoutMs: 10_000 });
+        expect(result.stdout).toBe('eof');
+    });
+    it('kills and rejects on timeout', async () => {
+        await expect(runProcess(process.execPath, ['-e', 'setTimeout(()=>{}, 10_000)'], { timeoutMs: 100 }))
+            .rejects.toThrow('timed out');
+    });
+    it('rejects when the binary cannot be spawned', async () => {
+        await expect(runProcess('/nonexistent/llama-cli', [], { timeoutMs: 1_000 })).rejects.toThrow();
+    });
+});

package/dist/inference/model-download.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/model-download.test.js

@@ -0,0 +1,73 @@
+import fs from 'fs-extra';
+import path from 'path';
+import { createHash } from 'crypto';
+import { Readable } from 'stream';
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest';
+const home = vi.hoisted(() => {
+    const p = require('path');
+    const o = require('os');
+    return p.join(o.tmpdir(), `rigour-models-${process.pid}-${Date.now()}`);
+});
+vi.mock('../storage/db.js', () => ({ RIGOUR_DIR: home }));
+const { downloadModel, getCachedModel } = await import('./model-manager.js');
+const { FALLBACK_MODELS, MODELS } = await import('./types.js');
+const modelsDir = path.join(home, 'models');
+const PAYLOAD = Buffer.from('gguf-model-bytes');
+const PAYLOAD_SHA = createHash('sha256').update(PAYLOAD).digest('hex');
+function ok(body, sha) {
+    return Promise.resolve({ statusCode: 200, headers: { 'x-linked-etag': `"${sha}"` }, body: Readable.from([body]) });
+}
+const unauthorized = Promise.resolve({ statusCode: 401, headers: {}, body: Readable.from([]) });
+describe('downloadModel', () => {
+    beforeEach(async () => {
+        await fs.remove(home);
+        // A fresh version check: no network call to Hugging Face.
+        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { version: '2.0.0', checkedAt: new Date().toISOString() });
+    });
+    afterAll(async () => { await fs.remove(home); });
+    it('falls back to the stock model when the fine-tuned model is unavailable, and says so', async () => {
+        const requested = [];
+        const get = (url) => {
+            requested.push(url);
+            return url.includes('rigour-labs/') ? unauthorized : ok(PAYLOAD, PAYLOAD_SHA);
+        };
+        const messages = [];
+        const modelPath = await downloadModel('lite', m => messages.push(m), get);
+        expect(requested).toEqual([MODELS.lite.url, FALLBACK_MODELS.lite.url]);
+        expect(path.basename(modelPath)).toBe(FALLBACK_MODELS.lite.filename);
+        expect(messages.some(m => m.includes('Fine-tuned model unavailable (HTTP 401'))).toBe(true);
+        const meta = await fs.readJson(`${modelPath}.meta.json`);
+        expect(meta).toMatchObject({ sha256: PAYLOAD_SHA, sizeBytes: PAYLOAD.length, sourceUrl: FALLBACK_MODELS.lite.url });
+    });
+    it('rejects a checksum mismatch and deletes the partial download', async () => {
+        const get = () => ok(PAYLOAD, 'f'.repeat(64));
+        await expect(downloadModel('lite', undefined, get)).rejects.toThrow('Checksum mismatch');
+        expect(await fs.pathExists(path.join(modelsDir, `${FALLBACK_MODELS.lite.filename}.download`))).toBe(false);
+        expect(await fs.pathExists(path.join(modelsDir, FALLBACK_MODELS.lite.filename))).toBe(false);
+    });
+});
+describe('getCachedModel', () => {
+    beforeEach(async () => { await fs.remove(home); });
+    async function cacheFile(filename, sizeBytes) {
+        const file = path.join(modelsDir, filename);
+        await fs.ensureDir(modelsDir);
+        await fs.writeFile(file, '');
+        await fs.truncate(file, sizeBytes); // sparse: no real disk use
+        await fs.writeJson(`${file}.meta.json`, {
+            sha256: 'a'.repeat(64), sizeBytes, verifiedAt: new Date(Date.now() + 1000).toISOString(), sourceUrl: 'https://x',
+        });
+    }
+    it('returns null when nothing is cached', async () => {
+        expect(await getCachedModel('deep')).toBeNull();
+    });
+    it('reports the stock fallback when only it is cached', async () => {
+        await cacheFile(FALLBACK_MODELS.deep.filename, FALLBACK_MODELS.deep.sizeBytes);
+        const cached = await getCachedModel('deep');
+        expect(cached).toMatchObject({ fallback: true, info: { filename: FALLBACK_MODELS.deep.filename } });
+    });
+    it('ignores a file without verified metadata', async () => {
+        await fs.ensureDir(modelsDir);
+        await fs.writeFile(path.join(modelsDir, FALLBACK_MODELS.deep.filename), 'partial');
+        expect(await getCachedModel('deep')).toBeNull();
+    });
+});

package/dist/inference/model-manager.d.ts

@@ -1,3 +1,4 @@
+import { type HttpGet } from './http-download.js';
 import { type ModelTier, type ModelInfo } from './types.js';
 export declare function extractSha256FromEtag(etag: string | null): string | null;
 export declare function hashFileSha256(filePath: string): Promise<string>;
@@ -5,8 +6,20 @@ export declare function hashFileSha256(filePath: string): Promise<string>;
  * Check if any model for this tier is cached (fine-tuned or fallback).
  */
 export declare function isModelCached(tier: ModelTier): Promise<boolean>;
+export interface CachedModel {
+    path: string;
+    info: ModelInfo;
+    /** True when the stock fallback is in use because the fine-tuned model is not cached. */
+    fallback: boolean;
+}
+/**
+ * The verified model file for a tier, preferring the fine-tuned model over
+ * the stock fallback. Null when neither is cached and verified.
+ */
+export declare function getCachedModel(tier: ModelTier): Promise<CachedModel | null>;
 /**
  * Get the path to a cached model (prefers fine-tuned over fallback).
+ * Existence only; use getCachedModel() for a verified file.
  */
 export declare function getModelPath(tier: ModelTier): string;
 /**
@@ -25,7 +38,7 @@ export declare function checkForUpdates(onProgress?: (message: string, percent?:
  * Download a model from HuggingFace CDN.
  * Checks for updates first, then tries fine-tuned model, falls back to stock Qwen.
  */
-export declare function downloadModel(tier: ModelTier, onProgress?: (message: string, percent?: number) => void): Promise<string>;
+export declare function downloadModel(tier: ModelTier, onProgress?: (message: string, percent?: number) => void, get?: HttpGet): Promise<string>;
 /**
  * Ensure a model is available, downloading if needed.
  */

package/dist/inference/model-manager.js

@@ -6,6 +6,7 @@ import path from 'path';
 import fs from 'fs-extra';
 import { createHash } from 'crypto';
 import { RIGOUR_DIR } from '../storage/db.js';
+import { downloadToFile } from './http-download.js';
 import { MODELS, FALLBACK_MODELS, VERSION_CHECK_URL, BUNDLED_MODEL_VERSION, updateModelVersion } from './types.js';
 const MODELS_DIR = path.join(RIGOUR_DIR, 'models');
 const VERSION_CACHE_PATH = path.join(MODELS_DIR, '.latest_version.json');
@@ -76,13 +77,26 @@ async function isFileCached(model) {
  * Check if any model for this tier is cached (fine-tuned or fallback).
  */
 export async function isModelCached(tier) {
-    if (await isFileCached(MODELS[tier]))
-        return true;
-    const fb = FALLBACK_MODELS[tier];
-    return fb.url !== MODELS[tier].url && await isFileCached(fb);
+    return (await getCachedModel(tier)) !== null;
+}
+/**
+ * The verified model file for a tier, preferring the fine-tuned model over
+ * the stock fallback. Null when neither is cached and verified.
+ */
+export async function getCachedModel(tier) {
+    const primary = MODELS[tier];
+    if (await isFileCached(primary)) {
+        return { path: path.join(MODELS_DIR, primary.filename), info: primary, fallback: false };
+    }
+    const fallback = FALLBACK_MODELS[tier];
+    if (fallback.url !== primary.url && await isFileCached(fallback)) {
+        return { path: path.join(MODELS_DIR, fallback.filename), info: fallback, fallback: true };
+    }
+    return null;
 }
 /**
  * Get the path to a cached model (prefers fine-tuned over fallback).
+ * Existence only; use getCachedModel() for a verified file.
  */
 export function getModelPath(tier) {
     const primary = path.join(MODELS_DIR, MODELS[tier].filename);
@@ -97,84 +111,55 @@ export function getModelInfo(tier) {
     return MODELS[tier];
 }
 /**
- * Stream a response body to disk with progress + SHA256.
- * Returns { sha256, downloaded } on success.
- */
-async function streamToDisk(response, tempPath, model, onProgress) {
-    const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
-    const reader = response.body?.getReader();
-    if (!reader)
-        throw new Error('No response body');
-    const writeStream = fs.createWriteStream(tempPath);
-    const hash = createHash('sha256');
-    let downloaded = 0;
-    let lastPct = 0;
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        const chunk = Buffer.from(value);
-        writeStream.write(chunk);
-        hash.update(chunk);
-        downloaded += value.length;
-        if (contentLength > 0) {
-            const pct = Math.round((downloaded / contentLength) * 100);
-            if (pct >= lastPct + 5) {
-                lastPct = pct;
-                onProgress?.(`Downloading ${model.name}: ${pct}%`, pct);
-            }
-        }
-    }
-    writeStream.end();
-    await new Promise((resolve, reject) => {
-        writeStream.on('finish', resolve);
-        writeStream.on('error', reject);
-    });
-    return { sha256: hash.digest('hex'), downloaded };
-}
-/**
- * Verify SHA256 against ETag, allowing LFS OID mismatches
- * if the download size is reasonable.
+ * Reject a download whose SHA-256 differs from the one the server published.
+ * Hugging Face publishes the LFS object's SHA-256, which is the content hash,
+ * so any mismatch means a corrupt or tampered file.
  */
-function verifySha256(expectedSha256, actualSha256, downloaded, model) {
+function verifySha256(expectedSha256, actualSha256, model) {
     if (!expectedSha256 || actualSha256 === expectedSha256)
         return;
-    const tolerance = model.sizeBytes * 0.1;
-    if (downloaded < model.sizeBytes - tolerance) {
-        throw new Error(`Checksum mismatch for ${model.name}: ` +
-            `expected ${expectedSha256}, got ${actualSha256} ` +
-            `(undersized: ${downloaded} bytes)`);
-    }
-    // Size OK — ETag likely a Git LFS OID, not content SHA256
+    throw new Error(`Checksum mismatch for ${model.name}: expected ${expectedSha256}, got ${actualSha256}`);
+}
+function progressReporter(model, onProgress) {
+    let lastPct = -5;
+    return (downloaded, total) => {
+        const size = total ?? model.sizeBytes;
+        const pct = Math.min(99, Math.round((downloaded / size) * 100));
+        if (pct >= lastPct + 5) {
+            lastPct = pct;
+            onProgress?.(`Downloading ${model.name}: ${pct}%`, pct);
+        }
+    };
 }
 /**
- * Download a specific model from its URL, write to disk, save metadata.
+ * Download a model to `<file>.download`, verify it, then move it into place
+ * with its metadata. A partial file survives network errors so the next run
+ * resumes it; a checksum mismatch deletes it.
  */
-async function downloadFromUrl(tier, model, onProgress) {
+async function downloadFromUrl(model, onProgress, get) {
     const destPath = path.join(MODELS_DIR, model.filename);
     const tempPath = destPath + '.download';
+    const { sha256, bytes, etag } = await downloadToFile(model.url, tempPath, {
+        onProgress: progressReporter(model, onProgress),
+        get,
+    });
     try {
-        const response = await fetch(model.url);
-        if (!response.ok) {
-            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-        }
-        const expectedSha = extractSha256FromEtag(response.headers.get('etag'));
-        const { sha256, downloaded } = await streamToDisk(response, tempPath, model, onProgress);
-        verifySha256(expectedSha, sha256, downloaded, model);
-        fs.renameSync(tempPath, destPath);
-        await writeModelMeta(model.filename, {
-            sha256, sizeBytes: downloaded,
-            verifiedAt: new Date().toISOString(),
-            sourceUrl: model.url,
-            sourceEtag: response.headers.get('etag') || undefined,
-        });
-        onProgress?.(`Model ${model.name} ready`, 100);
-        return destPath;
+        verifySha256(extractSha256FromEtag(etag), sha256, model);
     }
     catch (error) {
-        fs.removeSync(tempPath);
+        await fs.remove(tempPath);
         throw error;
     }
+    await fs.move(tempPath, destPath, { overwrite: true });
+    await writeModelMeta(model.filename, {
+        sha256,
+        sizeBytes: bytes,
+        verifiedAt: new Date().toISOString(),
+        sourceUrl: model.url,
+        sourceEtag: etag || undefined,
+    });
+    onProgress?.(`Model ${model.name} ready`, 100);
+    return destPath;
 }
 /**
  * Check HuggingFace for a newer model version (like antivirus signature updates).
@@ -236,25 +221,25 @@ export async function checkForUpdates(onProgress) {
  * Download a model from HuggingFace CDN.
  * Checks for updates first, then tries fine-tuned model, falls back to stock Qwen.
  */
-export async function downloadModel(tier, onProgress) {
+export async function downloadModel(tier, onProgress, get) {
     fs.ensureDirSync(MODELS_DIR);
     // Check for newer model version (non-blocking, cached 24h)
     await checkForUpdates(onProgress);
-    if (await isModelCached(tier)) {
-        onProgress?.(`Model ${MODELS[tier].name} already cached`, 100);
-        return getModelPath(tier);
+    const cached = await getCachedModel(tier);
+    if (cached) {
+        onProgress?.(`Model ${cached.info.name} already cached`, 100);
+        return cached.path;
     }
     const model = MODELS[tier];
     onProgress?.(`Downloading ${model.name} (${model.sizeHuman})...`, 0);
     try {
-        return await downloadFromUrl(tier, model, onProgress);
+        return await downloadFromUrl(model, onProgress, get);
     }
     catch (error) {
-        // Fine-tuned model not available — try stock fallback
         const fallback = FALLBACK_MODELS[tier];
         if (fallback && fallback.url !== model.url) {
-            onProgress?.(`Fine-tuned model unavailable, using ${fallback.name}`, 0);
-            return downloadFromUrl(tier, fallback, onProgress);
+            onProgress?.(`Fine-tuned model unavailable (${error?.message ?? 'unknown error'}); using stock ${fallback.name}`, 0);
+            return downloadFromUrl(fallback, onProgress, get);
         }
         throw error;
     }
@@ -263,9 +248,9 @@ export async function downloadModel(tier, onProgress) {
  * Ensure a model is available, downloading if needed.
  */
 export async function ensureModel(tier, onProgress) {
-    if (await isModelCached(tier)) {
-        return getModelPath(tier);
-    }
+    const cached = await getCachedModel(tier);
+    if (cached)
+        return cached.path;
     return downloadModel(tier, onProgress);
 }
 /**

package/dist/inference/sidecar-provider.d.ts

@@ -1,23 +1,32 @@
 import type { InferenceProvider, InferenceOptions, ModelTier } from './types.js';
+export interface ActiveModel {
+    name: string;
+    filename: string;
+    fallback: boolean;
+}
 export declare class SidecarProvider implements InferenceProvider {
     readonly name = "sidecar";
     private binaryPath;
-    private modelPath;
+    private model;
+    private schemaPath;
     private tier;
     private threads;
     constructor(tier?: ModelTier, threads?: number);
+    /** True when a llama-cli that actually runs is installed. */
     isAvailable(): Promise<boolean>;
+    /** The llama-cli this provider would use and its version, or null if none runs. */
+    findEngine(): Promise<{
+        path: string;
+        version?: string;
+    } | null>;
+    /** Install the engine and model for this tier without running inference. */
+    prepare(onProgress?: (message: string) => void): Promise<void>;
     setup(onProgress?: (message: string) => void): Promise<void>;
+    /** The model file setup() loaded, or null before setup. */
+    getActiveModel(): ActiveModel | null;
     analyze(prompt: string, options?: InferenceOptions): Promise<string>;
     dispose(): void;
-    private getPlatformKey;
-    private getPlatformPackageName;
+    /** First candidate binary that exists, is executable and passes the probe. */
     private resolveBinaryPath;
-    /**
-     * Download llama-cli directly from llama.cpp GitHub releases.
-     * Extracts the binary to ~/.rigour/bin/llama-cli
-     */
-    private downloadLlamaCli;
-    /** Legacy: install via npm brain package */
-    private installSidecarBinary;
+    private candidateBinaries;
 }