@tuned-tensor/cli 0.26.2 → 0.28.0

package/dist/{chunk-VQWJ2XKR.js → chunk-7CO5DBCY.js}

@@ -63,7 +63,7 @@ import {
   writeFileAtomic,
   writeJson,
   writeJsonAtomic
-} from "./chunk-2AIP63QO.js";
+} from "./chunk-FSVTMX4L.js";
 
 // src/local-runtime/dataset.ts
 import { readFile } from "fs/promises";
@@ -868,16 +868,259 @@ function assertFoundationSettingsMatch(hp, plan2) {
 import { createHash as createHash3, randomUUID as randomUUID4 } from "crypto";
 import { constants as constants4 } from "fs";
 import { lstat as lstat3, mkdir as mkdir3, open as open4, rename as rename2, rm, rmdir, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, isAbsolute as isAbsolute4, join as join4, relative as relative4, resolve as resolve2, sep as sep4 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join5, relative as relative4, resolve as resolve2, sep as sep4 } from "path";
 import { z } from "zod";
 
 // src/local-spec-workspace.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { constants } from "fs";
 import { lstat, open, realpath, writeFile as writeFile2 } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
+
+// src/windows-workspace.ts
+import { spawn } from "child_process";
+import { createInterface } from "readline";
+import { join } from "path";
+var HELPER = String.raw`
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+[Console]::InputEncoding = New-Object Text.UTF8Encoding($false)
+[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+public static class TTWorkspace {
+  [StructLayout(LayoutKind.Sequential)] struct Info {
+    public uint Attributes, CreationLow, CreationHigh, AccessLow, AccessHigh,
+      WriteLow, WriteHigh, Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+  }
+  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  static extern SafeFileHandle CreateFileW(string path, uint access, uint share,
+    IntPtr security, uint disposition, uint flags, IntPtr template);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern bool GetFileInformationByHandle(SafeFileHandle handle, out Info info);
+  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  static extern bool MoveFileExW(string source, string target, uint flags);
+  static string NativePath(string path) {
+    path = Path.GetFullPath(path);
+    return path.StartsWith(@"\\") ? @"\\?\UNC\" + path.Substring(2) : @"\\?\" + path;
+  }
+  static SafeFileHandle Open(string path, bool directory) {
+    // No FILE_SHARE_DELETE: the directory cannot be renamed or replaced.
+    var handle = CreateFileW(NativePath(path), 0x80000000u,
+      directory ? 3u : 1u, IntPtr.Zero, 3, 0x02200000, IntPtr.Zero);
+    if (handle.IsInvalid) { int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error); }
+    Info info;
+    if (!GetFileInformationByHandle(handle, out info)) {
+      int error = Marshal.GetLastWin32Error(); handle.Dispose(); throw new Win32Exception(error);
+    }
+    if ((info.Attributes & 0x400) != 0 || (((info.Attributes & 0x10) != 0) != directory)) {
+      handle.Dispose(); throw new IOException("Workspace entries must be real directories or regular files, not symlinks/reparse points.");
+    }
+    return handle;
+  }
+  public static SafeFileHandle DirectoryHandle(string path) { return Open(path, true); }
+  public static string Child(string directory, string name) {
+    if (String.IsNullOrEmpty(name) || name == "." || name == ".." || name.IndexOfAny(Path.GetInvalidFileNameChars()) >= 0)
+      throw new IOException("Invalid workspace entry name.");
+    return Path.Combine(directory, name);
+  }
+  public static string Read(string path, int limit) {
+    using (var handle = Open(path, false))
+    using (var stream = new FileStream(handle, FileAccess.Read)) {
+      if (stream.Length > limit) throw new IOException("Spec/revision exceeds the byte limit.");
+      using (var bytes = new MemoryStream()) {
+        var buffer = new byte[16384]; int count;
+        while ((count = stream.Read(buffer, 0, buffer.Length)) > 0) {
+          if (bytes.Length + count > limit) throw new IOException("Spec/revision exceeds the byte limit.");
+          bytes.Write(buffer, 0, count);
+        }
+        return new UTF8Encoding(false, true).GetString(bytes.ToArray());
+      }
+    }
+  }
+  public static void WriteNew(string path, string source) {
+    byte[] bytes = new UTF8Encoding(false).GetBytes(source);
+    var security = new FileSecurity();
+    security.SetAccessRuleProtection(true, false);
+    security.AddAccessRule(new FileSystemAccessRule(WindowsIdentity.GetCurrent().User, FileSystemRights.FullControl, AccessControlType.Allow));
+    using (var stream = new FileStream(NativePath(path), FileMode.CreateNew, FileSystemRights.Write, FileShare.Read, 4096, FileOptions.None, security)) {
+      stream.Write(bytes, 0, bytes.Length); stream.Flush(true);
+    }
+  }
+  public static FileStream LockFile(string path) {
+    return new FileStream(NativePath(path), FileMode.CreateNew, FileAccess.ReadWrite,
+      FileShare.None, 1, FileOptions.DeleteOnClose);
+  }
+  public static void Atomic(string directory, string name, string source) {
+    string temporary = Child(directory, ".tt-" + Guid.NewGuid().ToString() + ".tmp");
+    try {
+      WriteNew(temporary, source);
+      if (!MoveFileExW(NativePath(temporary), NativePath(Child(directory, name)), 9))
+        throw new Win32Exception(Marshal.GetLastWin32Error());
+    } finally { File.Delete(NativePath(temporary)); }
+  }
+}
+'@
+$handles = New-Object 'Collections.Generic.List[System.IDisposable]'
+$directories = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
+function Lock-Directory([string]$path) {
+  $path = [IO.Path]::GetFullPath($path)
+  $current = [IO.Path]::GetPathRoot($path)
+  $parts = @('') + @($path.Substring($current.Length).Split('\') | Where-Object { $_ })
+  foreach ($part in $parts) {
+    if ($part) { $current = [IO.Path]::Combine($current, $part) }
+    if (-not $directories.Contains($current)) {
+      $handle = [TTWorkspace]::DirectoryHandle($current)
+      $handles.Add($handle)
+      [void]$directories.Add($current)
+    }
+  }
+}
+try {
+  while ($null -ne ($line = [Console]::ReadLine())) {
+    try {
+      $request = $line | ConvertFrom-Json
+      if ($request.op -eq 'directory') {
+        Lock-Directory $request.directory
+        $result = $null
+      } else {
+        if (-not $directories.Contains([IO.Path]::GetFullPath($request.directory))) { throw 'Directory is not pinned.' }
+        $path = [TTWorkspace]::Child($request.directory, $request.name)
+        switch ($request.op) {
+          'read' { $result = [TTWorkspace]::Read($path, $request.limit) }
+          'create' { [TTWorkspace]::WriteNew($path, $request.source); $result = $null }
+          'atomic' { [TTWorkspace]::Atomic($request.directory, $request.name, $request.source); $result = $null }
+          'lock' { $handles.Add([TTWorkspace]::LockFile($path)); $result = $null }
+          'child' {
+            [void][IO.Directory]::CreateDirectory($path)
+            Lock-Directory $path
+            $result = $path
+          }
+          default { throw 'Unknown workspace operation.' }
+        }
+      }
+      [Console]::WriteLine((@{ ok = $true; result = $result } | ConvertTo-Json -Compress -Depth 3))
+    } catch {
+      $native = $_.Exception.GetBaseException()
+      $number = if ($native -is [ComponentModel.Win32Exception]) { $native.NativeErrorCode } else { $native.HResult -band 65535 }
+      $code = switch ($number) { 2 { 'ENOENT' } 3 { 'ENOENT' } 80 { 'EEXIST' } 183 { 'EEXIST' } default { 'EIO' } }
+      [Console]::WriteLine((@{ ok = $false; error = $native.Message; code = $code } | ConvertTo-Json -Compress))
+    }
+  }
+} finally {
+  for ($i = $handles.Count - 1; $i -ge 0; $i--) { $handles[$i].Dispose() }
+}
+`;
+var WindowsWorkspace = class _WindowsWorkspace {
+  child;
+  exited;
+  pending;
+  failure;
+  stderr = "";
+  constructor() {
+    const executable = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    this.child = spawn(executable, [
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-OutputFormat",
+      "Text",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+      Buffer.from(HELPER, "utf16le").toString("base64")
+    ], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const fail = (error) => {
+      this.failure = error;
+      this.pending?.reject(error);
+      this.pending = void 0;
+    };
+    this.child.on("error", fail);
+    this.child.stdin.on("error", fail);
+    this.child.stderr.on("data", (data) => {
+      this.stderr = (this.stderr + String(data)).slice(-4e3);
+    });
+    createInterface({ input: this.child.stdout }).on("line", (line) => {
+      const pending = this.pending;
+      if (!pending) return;
+      this.pending = void 0;
+      try {
+        const response = JSON.parse(line);
+        if (response.ok) pending.resolve(response.result);
+        else pending.reject(Object.assign(new Error(response.error ?? "Windows workspace operation failed."), { code: response.code }));
+      } catch {
+        pending.reject(new Error("Invalid Windows workspace helper response."));
+      }
+    });
+    this.exited = new Promise((resolve12) => this.child.once("close", () => {
+      fail(new Error(`Windows workspace helper stopped. ${this.stderr}`));
+      resolve12();
+    }));
+  }
+  static async open(directory) {
+    const workspace = new _WindowsWorkspace();
+    try {
+      await workspace.request({ op: "directory", directory });
+      return workspace;
+    } catch (error) {
+      await workspace.close();
+      throw error;
+    }
+  }
+  async request(command) {
+    if (this.failure) throw this.failure;
+    if (this.pending) throw new Error("Concurrent operations on one Windows workspace transaction are not supported.");
+    return await new Promise((resolve12, reject) => {
+      const timer = setTimeout(() => {
+        this.child.kill();
+        reject(new Error("Windows workspace operation timed out."));
+      }, 3e4);
+      this.pending = { resolve: (value) => {
+        clearTimeout(timer);
+        resolve12(value);
+      }, reject: (error) => {
+        clearTimeout(timer);
+        reject(error);
+      } };
+      this.child.stdin.write(JSON.stringify(command) + "\n");
+    });
+  }
+  async read(directory, name, limit) {
+    return await this.request({ op: "read", directory, name, limit });
+  }
+  async create(directory, name, source) {
+    await this.request({ op: "create", directory, name, source });
+  }
+  async atomic(directory, name, source) {
+    await this.request({ op: "atomic", directory, name, source });
+  }
+  async childDirectory(directory, name) {
+    return await this.request({ op: "child", directory, name });
+  }
+  async lock(directory, name) {
+    await this.request({ op: "lock", directory, name });
+  }
+  async close() {
+    this.child.stdin.end();
+    const timer = setTimeout(() => this.child.kill(), 3e3);
+    try {
+      await this.exited;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/local-spec-workspace.ts
 var LocalBaseModel = Type.String({
   minLength: 3,
   maxLength: 193,
@@ -952,7 +1195,7 @@ async function prepareLocalSpecProject(workspaceRoot, spec, expectedWorkspaceFin
   }
   validateInputs(spec);
   try {
-    await lstat(join(canonicalRoot, SPEC_FILE));
+    await lstat(join2(canonicalRoot, SPEC_FILE));
   } catch (error) {
     if (errorCode(error) === "ENOENT") {
       return { specPath: SPEC_DISPLAY_PATH, workspaceFingerprint };
@@ -973,19 +1216,22 @@ async function createLocalSpecProject(workspaceRoot, spec, expectedWorkspaceFing
     const detail = error instanceof Error ? error.message : String(error);
     throw new LocalSpecMutationError(detail, "not_applied", error);
   }
-  if (process.platform !== "linux") {
+  if (process.platform !== "linux" && process.platform !== "win32") {
     throw new LocalSpecMutationError(
       "Secure local spec creation currently requires Linux filesystem handle support.",
       "not_applied"
     );
   }
   let workspaceHandle;
+  let windows;
   try {
-    workspaceHandle = await open(
+    if (process.platform === "win32") {
+      windows = await WindowsWorkspace.open(canonicalRoot);
+    } else workspaceHandle = await open(
       canonicalRoot,
       constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW
     );
-    if (fingerprintWorkspaceInfo(await workspaceHandle.stat()) !== expectedWorkspaceFingerprint) {
+    if ((windows ? await fingerprintWorkspace(canonicalRoot) : fingerprintWorkspaceInfo(await workspaceHandle.stat())) !== expectedWorkspaceFingerprint) {
       throw new LocalSpecMutationError(
         "The local workspace changed after this action was prepared; return to the original workspace and prepare it again.",
         "not_applied"
@@ -998,15 +1244,18 @@ async function createLocalSpecProject(workspaceRoot, spec, expectedWorkspaceFing
       } catch {
       }
     }
+    await windows?.close();
     if (error instanceof LocalSpecMutationError) throw error;
     const detail = error instanceof Error ? error.message : String(error);
     throw new LocalSpecMutationError(detail, "not_applied", error);
   }
   const operations = { ...NODE_FILE_OPERATIONS, ...operationOverrides };
-  const stableSpecPath = join(`/proc/self/fd/${workspaceHandle.fd}`, SPEC_FILE);
+  const stableSpecPath = windows ? join2(canonicalRoot, SPEC_FILE) : join2(`/proc/self/fd/${workspaceHandle.fd}`, SPEC_FILE);
   try {
-    await operations.writeFile(stableSpecPath, `${JSON.stringify({ id: randomUUID2(), ...spec }, null, 2)}
-`, {
+    const source = `${JSON.stringify({ id: randomUUID2(), ...spec }, null, 2)}
+`;
+    if (windows && !operationOverrides.writeFile) await windows.create(canonicalRoot, SPEC_FILE, source);
+    else await operations.writeFile(stableSpecPath, source, {
       encoding: "utf8",
       flag: "wx",
       mode: 384
@@ -1017,9 +1266,10 @@ async function createLocalSpecProject(workspaceRoot, spec, expectedWorkspaceFing
     }
   } catch (error) {
     try {
-      await workspaceHandle.close();
+      await workspaceHandle?.close();
     } catch {
     }
+    await windows?.close();
     const detail = error instanceof Error ? error.message : String(error);
     if (errorCode(error) === "EEXIST") {
       throw new LocalSpecMutationError(`Refusing to overwrite existing ${SPEC_DISPLAY_PATH}.`, "not_applied", error);
@@ -1031,9 +1281,10 @@ async function createLocalSpecProject(workspaceRoot, spec, expectedWorkspaceFing
     );
   }
   try {
-    await workspaceHandle.close();
+    await workspaceHandle?.close();
   } catch {
   }
+  await windows?.close();
   return { created: true, path: prepared.specPath };
 }
 
@@ -1041,7 +1292,7 @@ async function createLocalSpecProject(workspaceRoot, spec, expectedWorkspaceFing
 import { randomUUID as randomUUID3 } from "crypto";
 import { constants as constants2 } from "fs";
 import { lstat as lstat2, mkdir as mkdir2, open as open2, readdir, rename, unlink } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join2, relative as relative2, sep as sep2 } from "path";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative as relative2, sep as sep2 } from "path";
 var MAX_BYTES = 2e5;
 var EDIT_KEYS = /* @__PURE__ */ new Set([
   "name",
@@ -1074,6 +1325,14 @@ function validateDocument(document, path) {
   }
 }
 async function readBounded(path, limit = MAX_BYTES) {
+  if (process.platform === "win32") {
+    const windows = await WindowsWorkspace.open(dirname2(path));
+    try {
+      return await windows.read(dirname2(path), basename(path), limit);
+    } finally {
+      await windows.close();
+    }
+  }
   const handle = await open2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
   try {
     const info = await handle.stat();
@@ -1093,19 +1352,19 @@ async function readBounded(path, limit = MAX_BYTES) {
 }
 async function specLocation(workspaceRoot, specPath) {
   const root = await canonicalWorkspace(workspaceRoot);
-  const parts = specPath.replace(/^\.\//, "").split(/[\\/]/);
+  const parts = specPath.replace(/^\.[\\/]/, "").split(/[\\/]/);
   if (isAbsolute2(specPath) || parts.some((part) => !part || part === "." || part === "..") || parts.at(-1) !== "tunedtensor.json") {
     throw new Error("spec_path must name tunedtensor.json inside the current workspace (no traversal or symlinks).");
   }
   let parent = root;
   for (const part of parts.slice(0, -1)) {
-    parent = join2(parent, part);
+    parent = join3(parent, part);
     const info = await lstat2(parent);
     if (info.isSymbolicLink() || !info.isDirectory()) throw new Error("Spec directories must be real directories, not symlinks.");
   }
   return {
     root,
-    path: join2(parent, "tunedtensor.json"),
+    path: join3(parent, "tunedtensor.json"),
     parent,
     displayPath: `./${parts.join("/")}`,
     workspaceFingerprint: await fingerprintWorkspace(root),
@@ -1119,6 +1378,15 @@ async function assertCurrentLocation(location2) {
   }
 }
 async function readSpecSource(location2) {
+  if (process.platform === "win32") {
+    const windows = await WindowsWorkspace.open(location2.parent);
+    try {
+      await assertCurrentLocation(location2);
+      return await windows.read(location2.parent, "tunedtensor.json", MAX_BYTES);
+    } finally {
+      await windows.close();
+    }
+  }
   if (process.platform !== "linux") return await readBounded(location2.path);
   const handles = [];
   try {
@@ -1269,7 +1537,7 @@ async function privateChild(parent, name) {
 }
 async function atomicText(parent, name, source) {
   const base = `/proc/self/fd/${parent.fd}`;
-  const temporary = join2(base, `.tt-${randomUUID3()}.tmp`);
+  const temporary = join3(base, `.tt-${randomUUID3()}.tmp`);
   try {
     const file = await open2(temporary, "wx", 384);
     try {
@@ -1278,7 +1546,7 @@ async function atomicText(parent, name, source) {
     } finally {
       await file.close();
     }
-    await rename(temporary, join2(base, name));
+    await rename(temporary, join3(base, name));
     await parent.sync();
   } finally {
     await unlink(temporary).catch(() => {
@@ -1286,6 +1554,7 @@ async function atomicText(parent, name, source) {
   }
 }
 async function applySpecUpdate(workspaceRoot, update) {
+  if (process.platform === "win32") return await applyWindowsSpecUpdate(workspaceRoot, update);
   let committing = false;
   let lock;
   const handles = [];
@@ -1338,11 +1607,48 @@ async function applySpecUpdate(workspaceRoot, update) {
     for (const handle of handles.reverse()) await handle.close();
   }
 }
+async function applyWindowsSpecUpdate(workspaceRoot, update) {
+  let windows;
+  let committing = false;
+  try {
+    const prepared = await validateSpecUpdate(workspaceRoot, update);
+    windows = await WindowsWorkspace.open(prepared.current.parent);
+    await assertCurrentLocation(prepared.current);
+    const parent = prepared.current.parent;
+    await windows.lock(parent, ".tunedtensor-spec.lock");
+    const before = await windows.read(parent, "tunedtensor.json", MAX_BYTES);
+    if (specHash(before) !== update.expected_sha256) throw new Error("The behavior spec changed; inspect it and prepare the edit again.");
+    const state = await windows.childDirectory(parent, ".tuned-tensor");
+    const history = await windows.childDirectory(state, "spec-history");
+    const id = `${Date.now()}-${randomUUID3()}`;
+    const revision = {
+      id,
+      status: "prepared",
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      before_sha256: update.expected_sha256,
+      after_sha256: update.after_sha256,
+      before: prepared.current.document,
+      after: prepared.next
+    };
+    await windows.atomic(history, `${id}.json`, JSON.stringify(revision));
+    if (specHash(await windows.read(parent, "tunedtensor.json", MAX_BYTES)) !== update.expected_sha256) {
+      throw new Error("The behavior spec changed before commit; prepare the edit again.");
+    }
+    committing = true;
+    await windows.atomic(parent, "tunedtensor.json", prepared.source);
+    await windows.atomic(history, `${id}.json`, JSON.stringify({ ...revision, status: "applied" }));
+    return { updated: true, path: update.spec_path, revision: id, sha256: revision.after_sha256, diff: prepared.diff };
+  } catch (error) {
+    throw new LocalSpecMutationError(error.message, committing ? "unknown" : "not_applied", error);
+  } finally {
+    await windows?.close();
+  }
+}
 async function readSpecHistory(workspaceRoot, specPath = "tunedtensor.json") {
   const location2 = await specLocation(workspaceRoot, specPath);
   let path = location2.parent;
   for (const part of [".tuned-tensor", "spec-history"]) {
-    path = join2(path, part);
+    path = join3(path, part);
     try {
       const info = await lstat2(path);
       if (!info.isDirectory() || info.isSymbolicLink()) {
@@ -1354,13 +1660,13 @@ async function readSpecHistory(workspaceRoot, specPath = "tunedtensor.json") {
     }
   }
   const names = (await readdir(path)).filter((name) => /^\d+-[a-f0-9-]+\.json$/.test(name)).sort().reverse().slice(0, 50);
-  return await Promise.all(names.map(async (name) => JSON.parse(await readBounded(join2(path, name), MAX_BYTES * 3))));
+  return await Promise.all(names.map(async (name) => JSON.parse(await readBounded(join3(path, name), MAX_BYTES * 3))));
 }
 
 // src/agent-local-datasets.ts
 import { constants as constants3 } from "fs";
 import { open as open3, realpath as realpath2, stat as stat2 } from "fs/promises";
-import { basename, dirname as dirname2, isAbsolute as isAbsolute3, join as join3, relative as relative3, sep as sep3 } from "path";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute3, join as join4, relative as relative3, sep as sep3 } from "path";
 import { parquetMetadataAsync, parquetReadObjects, parquetSchema } from "hyparquet";
 import { compressors } from "hyparquet-compressors";
 var MAX_READ_BYTES = 16 * 1024 * 1024;
@@ -1374,12 +1680,12 @@ async function cachedPath(asset, file) {
     throw new Error("Choose an exact recorded file from list_local_datasets; arbitrary paths are not supported.");
   }
   const snapshot = asset.snapshot_path;
-  const repoRoot = dirname2(dirname2(snapshot));
-  if (!/^[a-f0-9]{40}$/.test(asset.revision) || basename(snapshot) !== asset.revision || basename(dirname2(snapshot)) !== "snapshots" || basename(repoRoot) !== `datasets--${asset.repo.replaceAll("/", "--")}`) {
+  const repoRoot = dirname3(dirname3(snapshot));
+  if (!/^[a-f0-9]{40}$/.test(asset.revision) || basename2(snapshot) !== asset.revision || basename2(dirname3(snapshot)) !== "snapshots" || basename2(repoRoot) !== `datasets--${asset.repo.replaceAll("/", "--")}`) {
     throw new Error("The dataset manifest has an invalid cache location.");
   }
   const root = await realpath2(repoRoot);
-  const target = await realpath2(join3(snapshot, file));
+  const target = await realpath2(join4(snapshot, file));
   const child = relative3(root, target);
   if (isAbsolute3(child) || child.startsWith(`..${sep3}`) || child === ".." || !child) {
     throw new Error("The recorded dataset file points outside its cache directory.");
@@ -1533,7 +1839,7 @@ async function location(workspaceRoot, name, missingLeaf = false) {
   let current = root;
   const parts = child.split(sep4);
   for (const [i, part] of parts.entries()) {
-    current = join4(current, part);
+    current = join5(current, part);
     let info;
     try {
       info = await lstat3(current);
@@ -1704,7 +2010,7 @@ async function plan(workspaceRoot, input, signal) {
     counts,
     trainingOnlyRows,
     workspace_fingerprint: await fingerprintWorkspace(source.root),
-    parent_fingerprint: await fingerprintWorkspace(dirname3(target.path))
+    parent_fingerprint: await fingerprintWorkspace(dirname4(target.path))
   };
 }
 async function prepareDatasetSplit(workspaceRoot, input, signal) {
@@ -1737,14 +2043,14 @@ async function validateDatasetSplit(workspaceRoot, input, signal) {
 }
 async function executeDatasetSplit(workspaceRoot, input, signal) {
   const p = await validateDatasetSplit(workspaceRoot, input, signal);
-  const stage = join4(dirname3(p.target.path), `.tt-split-${randomUUID4()}`);
+  const stage = join5(dirname4(p.target.path), `.tt-split-${randomUUID4()}`);
   await mkdir3(stage, { mode: 448 });
   const files = {};
   const handles = /* @__PURE__ */ new Map();
   let reserved = false;
   try {
     for (const split of SPLITS) if (p.counts[split]) {
-      handles.set(split, await open4(join4(stage, `${split}.jsonl`), "wx", 384));
+      handles.set(split, await open4(join5(stage, `${split}.jsonl`), "wx", 384));
       files[split] = `${p.options.output}/${split}.jsonl`;
     }
     const written = { training: 0, validation: 0, test: 0 };
@@ -1771,13 +2077,15 @@ async function executeDatasetSplit(workspaceRoot, input, signal) {
       dataset_prebuilt: { ...files, format: "chat_jsonl" },
       note: "Source and spec unchanged. Groups containing repeated prompts were kept in training. Inspect this result, then update dataset_prebuilt in your spec separately. Original source split labels were not enforced."
     };
-    await writeFile3(join4(stage, "split-manifest.json"), `${JSON.stringify(report, null, 2)}
+    await writeFile3(join5(stage, "split-manifest.json"), `${JSON.stringify(report, null, 2)}
 `, { flag: "wx" });
     signal?.throwIfAborted();
     await location(workspaceRoot, p.options.output, true);
-    if (await fingerprintWorkspace(dirname3(p.target.path)) !== p.parent_fingerprint) throw new Error("Output parent changed during splitting.");
-    await mkdir3(p.target.path, { mode: 448 });
-    reserved = true;
+    if (await fingerprintWorkspace(dirname4(p.target.path)) !== p.parent_fingerprint) throw new Error("Output parent changed during splitting.");
+    if (process.platform !== "win32") {
+      await mkdir3(p.target.path, { mode: 448 });
+      reserved = true;
+    }
     await rename2(stage, p.target.path);
     reserved = false;
     return report;
@@ -1794,7 +2102,7 @@ import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
 import { createReadStream } from "fs";
 import { mkdir as mkdir4, open as open5, readFile as readFile3, rename as rename3, rm as rm2, stat as stat3, writeFile as writeFile4 } from "fs/promises";
 import { hostname } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function canonicalJson3(value) {
   const normalized = JSON.parse(JSON.stringify(value ?? null));
   const encode = (entry) => {
@@ -1869,7 +2177,7 @@ function processAlive(pid) {
 }
 async function readLockOwner(lockPath) {
   try {
-    return JSON.parse(await readFile3(join5(lockPath, "owner.json"), "utf8"));
+    return JSON.parse(await readFile3(join6(lockPath, "owner.json"), "utf8"));
   } catch {
     return null;
   }
@@ -1905,7 +2213,7 @@ async function withAppendLock(lockPath, action, options = {}) {
   for (; ; ) {
     try {
       await mkdir4(lockPath, { mode: 448 });
-      await writeFile4(join5(lockPath, "owner.json"), JSON.stringify({ token, pid: process.pid, host: hostname() }), { mode: 384 });
+      await writeFile4(join6(lockPath, "owner.json"), JSON.stringify({ token, pid: process.pid, host: hostname() }), { mode: 384 });
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
@@ -2020,7 +2328,7 @@ async function auditRun(store, runId) {
     const sha256 = await sha256File(path);
     return { path, sha256, matches_recorded: recorded ? sha256 === recorded : null };
   }));
-  const manifestPath = state.artifact_dir ? join5(state.artifact_dir, "artifact-manifest.json") : null;
+  const manifestPath = state.artifact_dir ? join6(state.artifact_dir, "artifact-manifest.json") : null;
   const manifestFile = manifestPath && (await stat3(manifestPath).catch(() => null))?.isFile() ? await sha256File(manifestPath).then((sha256) => ({
     path: manifestPath,
     sha256,
@@ -2081,9 +2389,25 @@ async function auditRun(store, runId) {
 }
 
 // src/local-runtime/store.ts
-import { appendFile, chmod, copyFile, lstat as lstat4, mkdir as mkdir5, readdir as readdir2, readFile as readFile4, rename as rename4, rm as rm3, stat as stat4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4, join as join6, resolve as resolve3, sep as sep5 } from "path";
+import { appendFile, chmod, copyFile, lstat as lstat4, mkdir as mkdir5, readdir as readdir2, readFile as readFile4, rm as rm3, stat as stat4, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname5, join as join7, resolve as resolve3, sep as sep5 } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
+
+// src/local-runtime/atomic-rename.ts
+import { rename as rename4 } from "fs/promises";
+async function renameAtomicFile(source, destination) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await rename4(source, destination);
+      return;
+    } catch (error) {
+      if (process.platform !== "win32" || attempt >= 10 || !["EPERM", "EACCES", "EBUSY"].includes(error.code ?? "")) throw error;
+      await new Promise((resolve12) => setTimeout(resolve12, 10 * (attempt + 1)));
+    }
+  }
+}
+
+// src/local-runtime/store.ts
 function isTerminalRunState(state) {
   return state.status === "stage_completed" || state.status === "completed" || state.status === "failed" || state.status === "cancelled" && state.current_stage === "cancelled" && Boolean(state.completed_at);
 }
@@ -2093,10 +2417,10 @@ function defaultLocalHome() {
 function localStorePaths(root) {
   return {
     root,
-    specsDir: join6(root, "specs"),
-    runsDir: join6(root, "runs"),
-    modelsDir: join6(root, "models"),
-    datasetsDir: join6(root, "datasets")
+    specsDir: join7(root, "specs"),
+    runsDir: join7(root, "runs"),
+    modelsDir: join7(root, "models"),
+    datasetsDir: join7(root, "datasets")
   };
 }
 async function exists2(path) {
@@ -2127,7 +2451,7 @@ async function hardenPrivateTree(path) {
     await chmod(path, 448);
     for (const entry of await readdir2(path)) {
       try {
-        await hardenPrivateTree(join6(path, entry));
+        await hardenPrivateTree(join7(path, entry));
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
       }
@@ -2159,21 +2483,21 @@ async function hardenExistingLocalStore(root) {
   return true;
 }
 async function writePrivateJsonAtomic(path, value) {
-  await ensurePrivateDirectory(dirname4(path));
+  await ensurePrivateDirectory(dirname5(path));
   const tmp = `${path}.${process.pid}.${Date.now()}.${randomUUID6()}.tmp`;
   await writeFile5(tmp, `${JSON.stringify(value, null, 2)}
 `, {
     encoding: "utf8",
     mode: 384
   });
-  await rename4(tmp, path);
-  await chmod(path, 384);
+  await chmod(tmp, 384);
+  await renameAtomicFile(tmp, path);
 }
 async function readJson2(path) {
   return JSON.parse(await readFile4(path, "utf8"));
 }
 async function appendJsonl(path, value) {
-  await ensurePrivateDirectory(dirname4(path));
+  await ensurePrivateDirectory(dirname5(path));
   await appendFile(path, `${JSON.stringify(value)}
 `, {
     encoding: "utf8",
@@ -2182,13 +2506,13 @@ async function appendJsonl(path, value) {
   await chmod(path, 384);
 }
 async function writePrivateText(path, value) {
-  await ensurePrivateDirectory(dirname4(path));
+  await ensurePrivateDirectory(dirname5(path));
   await writeFile5(path, value, { encoding: "utf8", mode: 384 });
   await chmod(path, 384);
 }
 async function copyIfExists(from, to) {
   if (!await exists2(from)) return;
-  await ensurePrivateDirectory(dirname4(to));
+  await ensurePrivateDirectory(dirname5(to));
   await copyFile(from, to);
   await chmod(to, 384);
 }
@@ -2224,15 +2548,15 @@ function isPathInside(root, candidate) {
 function createLocalStore(root = defaultLocalHome()) {
   const resolvedRoot = resolve3(root);
   const paths = localStorePaths(resolvedRoot);
-  const runDir = (id) => join6(paths.runsDir, id);
-  const runStatePath = (id) => join6(runDir(id), "state.json");
-  const runEventsPath = (id) => join6(runDir(id), "progress.jsonl");
-  const runRequestPath = (id) => join6(runDir(id), "request.json");
-  const runReportPath = (id) => join6(runDir(id), "run-report.json");
-  const cancellationPath = (id) => join6(runDir(id), "cancel.requested");
-  const specDir = (id) => join6(paths.specsDir, id);
-  const specPath = (id) => join6(specDir(id), "spec.json");
-  const modelPath = (id) => join6(paths.modelsDir, id, "model.json");
+  const runDir = (id) => join7(paths.runsDir, id);
+  const runStatePath = (id) => join7(runDir(id), "state.json");
+  const runEventsPath = (id) => join7(runDir(id), "progress.jsonl");
+  const runRequestPath = (id) => join7(runDir(id), "request.json");
+  const runReportPath = (id) => join7(runDir(id), "run-report.json");
+  const cancellationPath = (id) => join7(runDir(id), "cancel.requested");
+  const specDir = (id) => join7(paths.specsDir, id);
+  const specPath = (id) => join7(specDir(id), "spec.json");
+  const modelPath = (id) => join7(paths.modelsDir, id, "model.json");
   let ensurePromise;
   async function ensureOnce() {
     await ensurePrivateDirectory(paths.root);
@@ -2317,7 +2641,7 @@ function createLocalStore(root = defaultLocalHome()) {
   }
   async function appendRunEvent(state, event) {
     const path = runEventsPath(state.id);
-    await ensurePrivateDirectory(dirname4(path));
+    await ensurePrivateDirectory(dirname5(path));
     const row = await withAppendLock(`${path}.lock`, async () => {
       const { partial } = await readJsonlTail(path);
       const { last: previous } = await readJsonlTail(path, (row2) => typeof row2.hash === "string");
@@ -2331,7 +2655,7 @@ function createLocalStore(root = defaultLocalHome()) {
       await appendJsonl(path, chained);
       return chained;
     });
-    await appendJsonl(join6(state.artifact_dir, "progress.jsonl"), {
+    await appendJsonl(join7(state.artifact_dir, "progress.jsonl"), {
       at: row.occurred_at,
       stage: row.stage,
       status: row.status,
@@ -2362,7 +2686,7 @@ function createLocalStore(root = defaultLocalHome()) {
     const previous = await getRun(runId);
     if (isTerminalRunState(previous)) return previous;
     await Promise.all([
-      rm3(join6(paths.modelsDir, `local-${previous.id}`), { recursive: true, force: true }),
+      rm3(join7(paths.modelsDir, `local-${previous.id}`), { recursive: true, force: true }),
       rm3(runReportPath(previous.id), { force: true })
     ]);
     if (previous.status === "cancelled" && previous.current_stage === "cancel_requested") return previous;
@@ -2529,7 +2853,7 @@ function createLocalStore(root = defaultLocalHome()) {
         createdAt: completedAt
       });
       if (!model) {
-        await rm3(join6(paths.modelsDir, `local-${report.run_id}`), { recursive: true, force: true });
+        await rm3(join7(paths.modelsDir, `local-${report.run_id}`), { recursive: true, force: true });
       }
       const previous = await getRun(report.run_id);
       const state = {
@@ -2550,7 +2874,7 @@ function createLocalStore(root = defaultLocalHome()) {
       if (await exists2(cancellationPath(report.run_id))) {
         return preserveCancellationRequestState(report.run_id);
       }
-      const manifestPath = join6(artifactDir, "artifact-manifest.json");
+      const manifestPath = join7(artifactDir, "artifact-manifest.json");
       await appendRunEvent(state, {
         stage: "completed",
         status: "completed",
@@ -2570,7 +2894,7 @@ function createLocalStore(root = defaultLocalHome()) {
       const previous = await getRun(runId);
       if (options.report) await rm3(runReportPath(previous.id), { force: true });
       if (options.model) {
-        await rm3(join6(paths.modelsDir, `local-${previous.id}`), { recursive: true, force: true });
+        await rm3(join7(paths.modelsDir, `local-${previous.id}`), { recursive: true, force: true });
       }
       const state = {
         ...previous,
@@ -2690,8 +3014,8 @@ function createLocalStore(root = defaultLocalHome()) {
 import { createHash as createHash5 } from "crypto";
 import { createReadStream as createReadStream2 } from "fs";
 import { mkdir as mkdir6, readFile as readFile5, realpath as realpath3, stat as stat5 } from "fs/promises";
-import { createInterface } from "readline";
-import { basename as basename2, isAbsolute as isAbsolute5, join as join7, relative as relative5, resolve as resolve4, sep as sep6 } from "path";
+import { createInterface as createInterface2 } from "readline";
+import { basename as basename3, isAbsolute as isAbsolute5, join as join8, relative as relative5, resolve as resolve4, sep as sep6 } from "path";
 import { asyncBufferFromFile, parquetMetadataAsync as parquetMetadataAsync2, parquetReadObjects as parquetReadObjects2, parquetSchema as parquetSchema2 } from "hyparquet";
 import { compressors as compressors2 } from "hyparquet-compressors";
 var SPLITS2 = ["training", "validation", "test"];
@@ -2714,7 +3038,7 @@ function huggingFaceHubCache(modelCache) {
   return withHuggingFaceCacheEnvironment(process.env, modelCache).HF_HUB_CACHE;
 }
 function repositoryDirectory(hubCache, repo) {
-  return join7(hubCache, `datasets--${repo.replaceAll("/", "--")}`);
+  return join8(hubCache, `datasets--${repo.replaceAll("/", "--")}`);
 }
 function isStrictDescendant(parent, child) {
   const path = relative5(parent, child);
@@ -2739,7 +3063,7 @@ async function resolveCachedHuggingFaceDataset(args) {
   const prefetchHint = "Run `tt datasets prefetch` with this spec (for example `tt datasets prefetch tunedtensor.json`) to download it.";
   let revision = source.revision;
   if (!revision) {
-    const ref = await readFile5(join7(repository, "refs", "main"), "utf8").catch(() => null);
+    const ref = await readFile5(join8(repository, "refs", "main"), "utf8").catch(() => null);
     const parsed = baseModelRevisionSchema.safeParse(ref?.trim());
     if (!parsed.success) {
       throw new DatasetNotDownloadedError(
@@ -2748,13 +3072,13 @@ async function resolveCachedHuggingFaceDataset(args) {
     }
     revision = parsed.data;
   }
-  const snapshot = join7(repository, "snapshots", revision);
+  const snapshot = join8(repository, "snapshots", revision);
   const physicalRepository = await realpath3(repository).catch(() => null);
-  const blobs = physicalRepository ? join7(physicalRepository, "blobs") : null;
+  const blobs = physicalRepository ? join8(physicalRepository, "blobs") : null;
   const files = {};
   const localPaths = {};
   for (const [split, path] of Object.entries(datasetFiles(args.dataset))) {
-    const local = join7(snapshot, ...path.split(/[/\\]/));
+    const local = join8(snapshot, ...path.split(/[/\\]/));
     const metadata = await stat5(local).catch(() => null);
     if (!metadata || !physicalRepository || !blobs) {
       throw new DatasetNotDownloadedError(
@@ -2767,7 +3091,7 @@ async function resolveCachedHuggingFaceDataset(args) {
     }
     if (metadata.size === 0) throw new Error(`Cached dataset file ${path} (${split}) is empty: ${local}`);
     const digests = await digestFile(target, metadata.size);
-    const blobName = isStrictDescendant(blobs, target) ? basename2(target).toLowerCase() : "";
+    const blobName = isStrictDescendant(blobs, target) ? basename3(target).toLowerCase() : "";
     const expected = /^[0-9a-f]{64}$/.test(blobName) ? digests.sha256 : /^[0-9a-f]{40}$/.test(blobName) ? digests.gitSha1 : null;
     if (expected !== null && expected !== blobName) {
       throw new Error(
@@ -2812,7 +3136,7 @@ function columnNames(columns) {
   return "messages" in columns ? [columns.messages] : [columns.input, columns.output];
 }
 async function* jsonlRecords(path, split) {
-  const lines = createInterface({ input: createReadStream2(path, { encoding: "utf8" }), crlfDelay: Infinity });
+  const lines = createInterface2({ input: createReadStream2(path, { encoding: "utf8" }), crlfDelay: Infinity });
   let index = -1;
   for await (const line of lines) {
     index += 1;
@@ -2925,7 +3249,7 @@ async function convertMappedDataset(args) {
     if (examples.length === 0) {
       throw new Error(`No usable ${split} records remain after applying dataset_prebuilt.huggingface.columns.`);
     }
-    const output = join7(args.outputRoot, `${split}-${key}.jsonl`);
+    const output = join8(args.outputRoot, `${split}-${key}.jsonl`);
     const content = `${examples.map((example) => JSON.stringify(exampleToChatRow(args.spec, example))).join("\n")}
 `;
     if (await readFile5(output, "utf8").catch(() => null) !== content) {
@@ -2987,9 +3311,9 @@ async function prefetchHuggingFaceDataset(args) {
     `${safeName(dataset.huggingface.repo)}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
   );
   await mkdir6(artifactDir, { recursive: true });
-  const inputPath = join7(artifactDir, "prefetch-input.json");
-  const outputPath = join7(artifactDir, "prefetch-output.json");
-  const logPath = join7(artifactDir, "prefetch.log");
+  const inputPath = join8(artifactDir, "prefetch-input.json");
+  const outputPath = join8(artifactDir, "prefetch-output.json");
+  const logPath = join8(artifactDir, "prefetch.log");
   await writeJson(inputPath, {
     repo: dataset.huggingface.repo,
     ...dataset.huggingface.revision ? { revision: dataset.huggingface.revision } : {},
@@ -3096,13 +3420,13 @@ import { createReadStream as createReadStream3 } from "fs";
 import { createHash as createHash8, randomUUID as randomUUID8 } from "crypto";
 import { performance } from "perf_hooks";
 import { homedir as homedir2 } from "os";
-import { basename as basename5, dirname as dirname7, join as join11, relative as relative6, resolve as resolve8 } from "path";
+import { basename as basename6, dirname as dirname8, join as join12, relative as relative6, resolve as resolve8 } from "path";
 
 // src/local-runtime/gpu-executor.ts
 import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
 import { mkdtemp, mkdir as mkdir7, realpath as realpath4, rm as rm4, stat as stat6, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
-import { basename as basename3, dirname as dirname5, join as join8, resolve as resolve5 } from "path";
+import { basename as basename4, dirname as dirname6, join as join9, resolve as resolve5 } from "path";
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -3172,14 +3496,14 @@ function gpuBaseModelPath(config, model, revision) {
     throw new Error("AWS GPU execution needs an immutable base-model revision. Run tt models prefetch first or configure paths.baseModel.");
   }
   const env = withHuggingFaceCacheEnvironment(process.env, config.paths.modelCache);
-  return join8(env.HF_HUB_CACHE, `models--${model.replaceAll("/", "--")}`, "snapshots", revision);
+  return join9(env.HF_HUB_CACHE, `models--${model.replaceAll("/", "--")}`, "snapshots", revision);
 }
 async function physicalTransferPath(path) {
   try {
     return await realpath4(path);
   } catch (error) {
-    if (error.code !== "ENOENT" || dirname5(path) === path) throw error;
-    return join8(await physicalTransferPath(dirname5(path)), basename3(path));
+    if (error.code !== "ENOENT" || dirname6(path) === path) throw error;
+    return join9(await physicalTransferPath(dirname6(path)), basename4(path));
   }
 }
 async function assertSeparateTransferPaths(files) {
@@ -3202,9 +3526,9 @@ async function runGpuProcess(args) {
   const options = sshOptions(args.gpu);
   const identity = args.logPath ? createHash6("sha256").update(resolve5(args.logPath)).digest("hex").slice(0, 32) : randomUUID7();
   const root = `/tmp/tt-gpu-${identity}`;
-  const scratch = await mkdtemp(join8(tmpdir(), "tt-gpu-"));
-  const runtime = join8(localRuntimePackageRoot(import.meta.url), "training", args.runtime);
-  const mappings = args.files.map((file, index) => ({ ...file, path: resolve5(file.path), remote: `${root}/files/${index}/${basename3(file.path)}` }));
+  const scratch = await mkdtemp(join9(tmpdir(), "tt-gpu-"));
+  const runtime = join9(localRuntimePackageRoot(import.meta.url), "training", args.runtime);
+  const mappings = args.files.map((file, index) => ({ ...file, path: resolve5(file.path), remote: `${root}/files/${index}/${basename4(file.path)}` }));
   const mapPath = (path) => {
     const absolute = resolve5(path);
     const match = [...mappings].sort((a, b) => b.path.length - a.path.length).find((file) => absolute === file.path || file.directory && absolute.startsWith(`${file.path}/`));
@@ -3255,10 +3579,10 @@ async function runGpuProcess(args) {
       throw new Error(`Cannot reserve GPU staging directory ${host}:${root}. Another process or unrecovered artifacts may be present. ${error instanceof Error ? error.message : error}`);
     });
     for (const name of ["pyproject.toml", "uv.lock", "src"]) {
-      await sync(join8(runtime, name), `${root}/runtime/`, true);
+      await sync(join9(runtime, name), `${root}/runtime/`, true);
     }
     for (const file of mappings) {
-      await ssh(`mkdir -p ${shellQuote(file.directory ? file.remote : dirname5(file.remote))}`);
+      await ssh(`mkdir -p ${shellQuote(file.directory ? file.remote : dirname6(file.remote))}`);
       if (file.direction !== "output") {
         const exists3 = await stat6(file.path).catch((error) => {
           if (error.code === "ENOENT" && file.direction === "both") return void 0;
@@ -3270,7 +3594,7 @@ async function runGpuProcess(args) {
     if (args.document) {
       const value = { ...args.document.value };
       for (const key of args.document.pathKeys) if (typeof value[key] === "string") value[key] = mapPath(value[key]);
-      const path = join8(scratch, "document.json");
+      const path = join9(scratch, "document.json");
       await writeFile6(path, JSON.stringify(value), { mode: 384 });
       await sync(path, mapPath(args.document.path), true);
     }
@@ -3303,7 +3627,7 @@ async function runGpuProcess(args) {
       if (started) {
         await ssh(`bash -c ${shellQuote(`if test -f ${root}/pid; then pid=$(cat ${root}/pid); ${stop}; fi`)}`, false);
         for (const file of mappings.filter((file2) => file2.direction !== "input")) {
-          await mkdir7(file.directory ? file.path : dirname5(file.path), { recursive: true });
+          await mkdir7(file.directory ? file.path : dirname6(file.path), { recursive: true });
           if (!completed && !file.directory) {
             const exists3 = await runLoggedProcess({ command: "ssh", commandArgs: [...options, host, `test -e ${shellQuote(file.remote)}`], stage: args.stage, timeoutMs: 3e4 });
             if (exists3.exitCode === 1) continue;
@@ -3324,7 +3648,7 @@ async function runGpuProcess(args) {
 // src/local-runtime/evaluation.ts
 import { createHash as createHash7 } from "crypto";
 import { mkdir as mkdir8, readFile as readFile6, rm as rm5, stat as stat7, writeFile as writeFile7 } from "fs/promises";
-import { basename as basename4, dirname as dirname6, join as join9, resolve as resolve6 } from "path";
+import { basename as basename5, dirname as dirname7, join as join10, resolve as resolve6 } from "path";
 function normalize(value) {
   return value.trim().replace(/\s+/g, " ").toLowerCase();
 }
@@ -3491,7 +3815,7 @@ function aggregateJsonFieldMetrics(scores, total) {
 }
 function fileUriToPath(value) {
   if (!value) return void 0;
-  return value.startsWith("file://") ? value.slice("file://".length) : value;
+  return value.startsWith("file://") ? localModelArtifactPath(value) : value;
 }
 var INFERENCE_PROTOCOL_VERSION = 2;
 function parseInferenceProgress(line, total) {
@@ -3555,8 +3879,8 @@ async function runTransformersInference(args) {
   const inputPath = `${args.outputPath}.inference-input.json`;
   const outputPath = `${args.outputPath}.inference-output.json`;
   const logPath = `${args.outputPath}.inference.log`;
-  const checkpointPath = args.checkpointPath ?? join9(dirname6(args.outputPath), "inference-checkpoints", basename4(args.outputPath));
-  await mkdir8(dirname6(inputPath), { recursive: true });
+  const checkpointPath = args.checkpointPath ?? join10(dirname7(args.outputPath), "inference-checkpoints", basename5(args.outputPath));
+  await mkdir8(dirname7(inputPath), { recursive: true });
   const payload = {
     protocol_version: INFERENCE_PROTOCOL_VERSION,
     kind: args.kind,
@@ -3755,7 +4079,7 @@ function baselineStoreRoot(config) {
   return config.storeRoot ? resolve6(config.storeRoot) : defaultLocalHome();
 }
 function baselineCachePath(config, key) {
-  return join9(baselineStoreRoot(config), "cache", "baseline-evals", `${key}.json`);
+  return join10(baselineStoreRoot(config), "cache", "baseline-evals", `${key}.json`);
 }
 async function readBaselineCache(config, path) {
   await hardenExistingLocalStore(baselineStoreRoot(config));
@@ -3882,7 +4206,7 @@ async function evaluateExamples(args) {
   }
   if (cacheKey) {
     await createLocalStore(baselineStoreRoot(args.config)).ensure();
-    await mkdir8(dirname6(baselineCachePath(args.config, cacheKey)), { recursive: true, mode: 448 });
+    await mkdir8(dirname7(baselineCachePath(args.config, cacheKey)), { recursive: true, mode: 448 });
     await hardenExistingLocalStore(baselineStoreRoot(args.config));
   }
   const inference = args.config.dryRun ? null : await runTransformersInference({
@@ -3962,7 +4286,7 @@ function compareEvalReports(baseline, candidate) {
 
 // src/local-runtime/process-training.ts
 import { access, mkdir as mkdir9, readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
-import { join as join10, resolve as resolve7 } from "path";
+import { join as join11, resolve as resolve7 } from "path";
 function buildTrainingHyperparameters(request, options = {}) {
   const model = resolveTrainingModel(request.spec_snapshot.base_model);
   const hyper = request.hyperparameters;
@@ -4058,7 +4382,7 @@ async function launchProcessTraining(args) {
   const hyperparameters = buildTrainingHyperparameters(request, {
     baseModelRevision: args.baseModelRevision
   });
-  await writeJson(join10(artifacts.trainingConfigDir, "hyperparameters.json"), hyperparameters);
+  await writeJson(join11(artifacts.trainingConfigDir, "hyperparameters.json"), hyperparameters);
   const entrypoint = buildBundledPythonCommand("train.py");
   if (config.dryRun) {
     await writeFile8(
@@ -4137,12 +4461,12 @@ async function launchProcessTraining(args) {
     onLine: (line) => forwardTrainingProgress(line),
     shouldCancel: args.shouldCancel
   });
-  const metricsPath = join10(artifacts.trainingModelDir, "training-metrics.json");
+  const metricsPath = join11(artifacts.trainingModelDir, "training-metrics.json");
   const metrics = await pathExists(metricsPath) ? JSON.parse(await readFile7(metricsPath, "utf8")) : null;
   if (exitCode !== 0) {
     throw new Error(`Training process exited with code ${exitCode}. See ${artifacts.trainingLog}.`);
   }
-  const modelTarPath = join10(artifacts.trainingOutputDir, "model.tar.gz");
+  const modelTarPath = join11(artifacts.trainingOutputDir, "model.tar.gz");
   const modelUri = await pathExists(modelTarPath) ? fileUri(modelTarPath) : fileUri(artifacts.trainingModelDir);
   await args.reporter?.onEvent?.({
     stage: "training",
@@ -4246,7 +4570,7 @@ function parseLocalRunnerConfig(document, path) {
   const config = localRunnerConfigSchema.parse(document);
   if (!path) return config;
   const configPath = resolve8(path);
-  const base = dirname7(configPath);
+  const base = dirname8(configPath);
   const configPathValue = (value) => {
     if (!value) return void 0;
     if (value === "~") return homedir2();
@@ -4284,7 +4608,7 @@ function elapsed(started) {
   return { ms, seconds: Math.round(ms / 1e3 * 1e3) / 1e3 };
 }
 function stripFileUri(path) {
-  return path.replace(/^file:\/\//, "");
+  return path.startsWith("file://") ? localModelArtifactPath(path) : path;
 }
 async function pathExists2(path) {
   try {
@@ -4582,8 +4906,8 @@ async function readStageMetadata(path) {
   }
 }
 async function removePrefixedArtifacts(path) {
-  const directory = dirname7(path);
-  const prefix = `${basename5(path)}.`;
+  const directory = dirname8(path);
+  const prefix = `${basename6(path)}.`;
   const names = await readdir3(directory).catch(() => []);
   await Promise.all([
     rm6(path, { force: true }),
@@ -4654,7 +4978,7 @@ async function throwIfCancelled(store, request) {
   }
 }
 async function acquireWorkflowLock(lockPath, description) {
-  await mkdir10(dirname7(lockPath), { recursive: true });
+  await mkdir10(dirname8(lockPath), { recursive: true });
   const token = randomUUID8();
   for (let attempt = 0; attempt < 3; attempt += 1) {
     try {
@@ -4713,7 +5037,7 @@ async function acquireRunLock(store, runId) {
 }
 async function acquireArtifactLock(artifacts) {
   return acquireWorkflowLock(
-    join11(artifacts.runDir, ARTIFACT_WORKFLOW_LOCK_FILE),
+    join12(artifacts.runDir, ARTIFACT_WORKFLOW_LOCK_FILE),
     `Artifact directory ${artifacts.runDir}`
   );
 }
@@ -5573,7 +5897,7 @@ async function runLocalPipeline(input) {
         store,
         reporter: input.reporter
       });
-      await writeJsonAtomic(join11(artifacts.runDir, "resolved-workflow.json"), {
+      await writeJsonAtomic(join12(artifacts.runDir, "resolved-workflow.json"), {
         spec: input.projectSpec ?? {
           ...input.request.spec_snapshot,
           hyperparameters: input.request.hyperparameters,
@@ -5595,7 +5919,7 @@ async function runLocalPipeline(input) {
         if (step.uses === "evaluate") {
           const isBase = step.with.model === "base";
           const report = isBase ? await runBaselineStage({ prepared, config: input.config, store, reporter: input.reporter, runReporter }) : await runCandidateStage({ prepared, config: input.config, store, reporter: input.reporter, runReporter });
-          const reportPath = join11(artifacts.runDir, "evaluations", `${step.id}.json`);
+          const reportPath = join12(artifacts.runDir, "evaluations", `${step.id}.json`);
           await writeJsonAtomic(reportPath, { ...report, artifact_uri: fileUri(reportPath) });
           outputs[step.id] = { report: { ...report, artifact_uri: fileUri(reportPath) }, reportPath };
           await refreshArtifactManifest(prepared);
@@ -5674,7 +5998,7 @@ async function runLocalFineTune(input) {
 // src/local-runtime/project-workflow.ts
 import { existsSync } from "fs";
 import { readFile as readFile9 } from "fs/promises";
-import { basename as basename6, dirname as dirname8, join as join12, resolve as resolve9 } from "path";
+import { basename as basename7, dirname as dirname9, join as join13, resolve as resolve9 } from "path";
 function configForSpec(spec, specPath) {
   return parseLocalRunnerConfig({
     storeRoot: process.env.TT_LOCAL_HOME?.trim() ? expandUserPath(process.env.TT_LOCAL_HOME.trim()) : DEFAULT_PROJECT_STORE_ROOT,
@@ -5695,10 +6019,10 @@ async function resolveDownloadConfig(specPath, configPath, warn) {
 async function resolveProjectConfig(specPath, configPath, warn, loaded) {
   const input = loaded ?? (existsSync(specPath) ? await loadLocalRunInput(specPath) : void 0);
   const spec = input && input.kind !== "request" ? input.spec : void 0;
-  if (!configPath && spec?.runtime && /^\..+\.tt-agent-[0-9a-f-]+\.json$/.test(basename6(specPath))) {
+  if (!configPath && spec?.runtime && /^\..+\.tt-agent-[0-9a-f-]+\.json$/.test(basename7(specPath))) {
     return { config: configForSpec(spec, specPath) };
   }
-  const candidate = configPath ? resolve9(configPath) : join12(dirname8(resolve9(specPath)), "local-runner.json");
+  const candidate = configPath ? resolve9(configPath) : join13(dirname9(resolve9(specPath)), "local-runner.json");
   if (configPath || existsSync(candidate)) {
     const legacy = parseLocalRunnerConfig(JSON.parse(await readFile9(candidate, "utf8")), candidate);
     if (spec?.runtime || spec?.evaluation) {
@@ -5714,15 +6038,15 @@ async function resolveProjectConfig(specPath, configPath, warn, loaded) {
 import { constants as constants5 } from "fs";
 import { access as access2, statfs as statfs2 } from "fs/promises";
 import { cpus as cpus2, homedir as homedir4, type } from "os";
-import { dirname as dirname10, join as join14, resolve as resolve11 } from "path";
-import { spawn } from "child_process";
+import { dirname as dirname11, join as join15, resolve as resolve11 } from "path";
+import { spawn as spawn2 } from "child_process";
 
 // src/local-runtime/live-usage.ts
 import { execFile } from "child_process";
 import { readFileSync } from "fs";
 import { statfs } from "fs/promises";
 import { cpus, freemem, homedir as homedir3, loadavg, totalmem } from "os";
-import { dirname as dirname9, join as join13, resolve as resolve10 } from "path";
+import { dirname as dirname10, join as join14, resolve as resolve10 } from "path";
 function parseMacMemory(stdout, total) {
   const pageSize = Number(/page size of (\d+) bytes/.exec(stdout)?.[1]);
   const pages = (label) => {
@@ -5861,7 +6185,7 @@ function cpuModel(reported, platform, arch) {
   }
 }
 async function modelCacheDisk(env) {
-  const path = resolve10(env.HF_HOME?.trim() || join13(homedir3(), ".cache", "huggingface"));
+  const path = resolve10(env.HF_HOME?.trim() || join14(homedir3(), ".cache", "huggingface"));
   for (let probe = path, depth = 0; depth < 8; depth += 1) {
     try {
       const fs = await statfs(probe);
@@ -5871,7 +6195,7 @@ async function modelCacheDisk(env) {
         total_bytes: Number(fs.blocks) * Number(fs.bsize)
       };
     } catch {
-      const parent = dirname9(probe);
+      const parent = dirname10(probe);
       if (parent === probe) break;
       probe = parent;
     }
@@ -5932,7 +6256,7 @@ async function runCommand(command, args, options = {}) {
     let stderr = "";
     let stopError;
     let forceKillTimer = null;
-    const child = spawn(command, args, {
+    const child = spawn2(command, args, {
       cwd: options.cwd,
       env: options.env ?? process.env,
       stdio: ["ignore", "pipe", "pipe"],
@@ -6093,7 +6417,7 @@ async function diskCheck(name, path) {
   } catch (error) {
     let probe = resolvedPath;
     for (let i = 0; i < 6; i += 1) {
-      const parent = dirname10(probe);
+      const parent = dirname11(probe);
       if (parent === probe) break;
       probe = parent;
       try {
@@ -6182,10 +6506,10 @@ async function collectHostInventory(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const nodeVersion = process.versions.node;
   const nodeMajor = Number(nodeVersion.split(".")[0]);
-  const artifactRoot = resolve11(cwd, config?.artifactRoot ?? join14(cwd, DEFAULT_ARTIFACT_ROOT));
+  const artifactRoot = resolve11(cwd, config?.artifactRoot ?? join15(cwd, DEFAULT_ARTIFACT_ROOT));
   const storeRoot = resolve11(config?.storeRoot ?? defaultStoreRoot(env));
   const modelCache = resolve11(
-    config?.paths.modelCache ?? env.HF_HOME ?? join14(homedir4(), ".cache", "huggingface")
+    config?.paths.modelCache ?? env.HF_HOME ?? join15(homedir4(), ".cache", "huggingface")
   );
   const [artifactDisk, storeDisk, cacheDisk, uvVersion, nvidiaQueried, memory] = await Promise.all([
     diskCheck("artifact-root", artifactRoot),
@@ -6673,11 +6997,11 @@ function warningsFromSnapshot(report, target) {
 
 // src/local-runtime/hardware-snapshot.ts
 import { chmod as chmod2, mkdir as mkdir11, readFile as readFile10, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname11, join as join15 } from "path";
+import { dirname as dirname12, join as join16 } from "path";
 var HARDWARE_SNAPSHOT_VERSION = 1;
 var HARDWARE_SNAPSHOT_TTL_MS = 24 * 60 * 60 * 1e3;
 function hardwareSnapshotPath(env = process.env) {
-  return join15(getTunedTensorHome(env), "hardware.json");
+  return join16(getTunedTensorHome(env), "hardware.json");
 }
 async function readHardwareSnapshot(env = process.env) {
   const path = hardwareSnapshotPath(env);
@@ -6703,7 +7027,7 @@ async function readHardwareSnapshot(env = process.env) {
 }
 async function writeHardwareSnapshot(snapshot, env = process.env) {
   const path = hardwareSnapshotPath(env);
-  await mkdir11(dirname11(path), { recursive: true, mode: 448 });
+  await mkdir11(dirname12(path), { recursive: true, mode: 448 });
   const gpu = snapshot.capabilities.gpu;
   const record = {
     version: HARDWARE_SNAPSHOT_VERSION,
@@ -6882,6 +7206,7 @@ export {
   executeDatasetSplit,
   checkAwsGpu,
   runGpuProcess,
+  renameAtomicFile,
   chainEvent,
   verifyEventChain,
   withAppendLock,
@@ -6926,4 +7251,4 @@ export {
   assessHardware,
   createRunConsoleReporter
 };
-//# sourceMappingURL=chunk-VQWJ2XKR.js.map
+//# sourceMappingURL=chunk-7CO5DBCY.js.map