@visual-z/xeno 0.8.3 → 0.9.0

package/src/store/lsp-document.ts

@@ -1,30 +0,0 @@
-import { editablePath } from "./file-checkpoints.ts";
-import { open } from "node:fs/promises";
-import { constants } from "node:fs";
-import { blobAddress } from "./blobs.ts";
-import { pathToFileURL } from "node:url";
-import { resolve } from "node:path";
-
-// Operational memory ceiling: a language server is optional and must not read arbitrarily large files.
-const MAX_LSP_DOCUMENT = 2 * 1024 * 1024;
-export async function readLspDocument(root: string, path: string, signal?: AbortSignal): Promise<{ uri: string; text: string; sha256: string }> {
-  signal?.throwIfAborted();
-  const absolute = await editablePath(root, path);
-  const file = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
-  try {
-    const info = await file.stat();
-    if (!info.isFile() || info.nlink > 1) throw Error("LSP requires an existing ordinary workspace file");
-    if (info.size > MAX_LSP_DOCUMENT) throw Error("LSP document exceeds 2 MiB");
-    const bytes = new Uint8Array(MAX_LSP_DOCUMENT + 1); let length = 0;
-    for (;;) {
-      signal?.throwIfAborted();
-      const result = await file.read(bytes, length, bytes.length - length, null);
-      if (!result.bytesRead) break;
-      length += result.bytesRead;
-      if (length > MAX_LSP_DOCUMENT) throw Error("LSP document exceeds 2 MiB");
-    }
-    signal?.throwIfAborted();
-    const content = bytes.subarray(0, length);
-    return { uri: pathToFileURL(resolve(root, path)).href, text: new TextDecoder("utf8", { fatal: true }).decode(content), sha256: blobAddress(content) };
-  } finally { await file.close(); }
-}

package/src/store/mcp-credentials.ts

@@ -1,85 +0,0 @@
-/** Credential storage is separate from append-only observations: secrets must never become log evidence. */
-import { mkdir, open, rename, rm, lstat } from "node:fs/promises";
-import { join } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
-import { constants } from "node:fs";
-import { isJsonValue, type JsonValue } from "../core/tool-contract.ts";
-
-export interface McpCredentials {
-  version: 1; serverUrl: string; redirectUrl: string;
-  clientIdentity?: string;
-  clients: Record<string, JsonValue>; tokens: Record<string, JsonValue>; expiresAt: Record<string, number>; activeIssuer: string | null;
-}
-export interface McpCredentialsStore {
-  read(serverUrl: string, clientIdentity?: string): Promise<McpCredentials | undefined>;
-  write(credentials: McpCredentials): Promise<void>;
-  remove(serverUrl: string, clientIdentity?: string): Promise<void>;
-}
-// Assumed bound prevents a replaced credential file from becoming an unbounded JSON allocation.
-const MAX_CREDENTIAL_BYTES = 1024 * 1024;
-function filename(dir: string, url: string, clientIdentity = "") { return join(dir, createHash("sha256").update(JSON.stringify([url, clientIdentity])).digest("hex") + ".json"); }
-function record(value: unknown): value is Record<string, JsonValue> {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && isJsonValue(value);
-}
-function validate(value: unknown, serverUrl: string, clientIdentity = ""): McpCredentials {
-  if (!record(value) || value["version"] !== 1 || value["serverUrl"] !== serverUrl || typeof value["redirectUrl"] !== "string"
-    || (value["clientIdentity"] ?? "") !== clientIdentity
-    || !record(value["clients"]) || !record(value["tokens"]) || !record(value["expiresAt"])
-    || Object.values(value["expiresAt"]).some(time => typeof time !== "number" || !Number.isFinite(time))
-    || value["activeIssuer"] !== null && typeof value["activeIssuer"] !== "string") throw Error("MCP credential record is invalid");
-  return { version: 1, serverUrl, redirectUrl: value["redirectUrl"], clients: value["clients"], tokens: value["tokens"],
-    expiresAt: Object.fromEntries(Object.entries(value["expiresAt"]).map(([issuer, time]) => [issuer, Number(time)])), activeIssuer: value["activeIssuer"],
-    ...(typeof value["clientIdentity"] === "string" ? { clientIdentity: value["clientIdentity"] } : {}) };
-}
-/** Explicit restricted-file backend, compatible with Codex's fallback; applications may provide an OS vault adapter. */
-export class FileMcpCredentialsStore implements McpCredentialsStore {
-  private readonly dir: string;
-  private writes = Promise.resolve();
-  constructor(dir: string) { this.dir = dir; }
-  private async directory(): Promise<void> {
-    const stat = await lstat(this.dir);
-    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) throw Error("MCP credential directory permissions are invalid");
-  }
-  async read(serverUrl: string, clientIdentity?: string): Promise<McpCredentials | undefined> {
-    const path = filename(this.dir, serverUrl, clientIdentity);
-    try {
-      await this.directory();
-      const stat = await lstat(path);
-      if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.size > MAX_CREDENTIAL_BYTES) throw Error("MCP credential file permissions or size are invalid");
-      const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-      try {
-        const opened = await file.stat();
-        if (!opened.isFile() || opened.size > MAX_CREDENTIAL_BYTES || (opened.mode & 0o077) !== 0) throw Error("Unsafe credential handle");
-        return validate(JSON.parse(await file.readFile("utf8")), serverUrl, clientIdentity);
-      } finally { await file.close(); }
-    } catch (error) {
-      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return undefined;
-      throw Error("MCP credential store could not be read safely");
-    }
-  }
-  write(credentials: McpCredentials): Promise<void> {
-    const serialized = JSON.stringify(validate(credentials, credentials.serverUrl, credentials.clientIdentity));
-    const target = filename(this.dir, credentials.serverUrl, credentials.clientIdentity);
-    if (Buffer.byteLength(serialized) > MAX_CREDENTIAL_BYTES) return Promise.reject(Error("MCP credential record exceeds size limit"));
-    const operation = this.writes.then(async () => {
-      await mkdir(this.dir, { recursive: true, mode: 0o700 });
-      await this.directory();
-      const temporary = join(this.dir, `.${randomUUID()}.tmp`);
-      try {
-        const file = await open(temporary, "wx", 0o600);
-        try { await file.writeFile(serialized); await file.sync(); } finally { await file.close(); }
-        await rename(temporary, target);
-      } finally { await rm(temporary, { force: true }); }
-    });
-    this.writes = operation.catch(() => {});
-    return operation;
-  }
-  async remove(serverUrl: string, clientIdentity?: string): Promise<void> {
-    await this.writes;
-    try { await this.directory(); await rm(filename(this.dir, serverUrl, clientIdentity), { force: true }); }
-    catch (error) {
-      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return;
-      throw Error("MCP credential store could not be removed safely");
-    }
-  }
-}

package/src/store/models.ts

@@ -1,60 +0,0 @@
-/**
- * The on-disk catalog overlay. `~/.xeno/models.json`, next to auth.json.
- *
- * This layer only reads and writes bytes. It does not know what a ModelSpec
- * is — that lives in runtime — because store may not import runtime. A
- * corrupt file is returned as text plus no error: the parser names the bad
- * entry, and discarding the whole file here would be the thing the card
- * forbids.
- */
-
-import { mkdir, readFile, rename, writeFile, rm } from "node:fs/promises";
-import { randomUUID } from "node:crypto";
-import { join } from "node:path";
-import { configDir } from "./config.ts";
-
-export function modelsPath(): string {
-  return join(configDir(), "models.json");
-}
-export function catalogCachePath(): string { return join(configDir(), "models-cache.json"); }
-
-export async function readModelsText(): Promise<{ text: string | null; error: string | null }> {
-  return readModelFile(modelsPath());
-}
-export async function readCatalogCacheText(): Promise<{ text: string | null; error: string | null }> {
-  return readModelFile(catalogCachePath());
-}
-async function readModelFile(path: string): Promise<{ text: string | null; error: string | null }> {
-  try {
-    const text = await readFile(path, "utf8");
-    return { text, error: null };
-  } catch (err) {
-    const absent = typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-    return { text: null, error: absent ? null : `cannot read ${path}` };
-  }
-}
-export async function readModelSources(): Promise<{ userText: string | null; cacheText: string | null; readWarnings: string[] }> {
-  const [user, cache] = await Promise.all([readModelsText(), readCatalogCacheText()]);
-  return { userText: user.text, cacheText: cache.text, readWarnings: [user.error, cache.error].filter((value): value is string => value !== null) };
-}
-
-/**
- * Replace, don't truncate. writeFile on the live path empties it first, so a
- * crash or a thrown write would leave the user with no catalog. Sidecar then
- * rename is atomic on the same filesystem; a failed refresh must leave the
- * existing bytes untouched (feat-json-mode-and-header).
- */
-export async function writeModelsFile(value: unknown): Promise<void> {
-  return writeModelFile(modelsPath(), value);
-}
-export async function writeCatalogCache(value: unknown): Promise<void> {
-  return writeModelFile(catalogCachePath(), value);
-}
-async function writeModelFile(dest: string, value: unknown): Promise<void> {
-  await mkdir(configDir(), { recursive: true });
-  const tmp = `${dest}.${randomUUID()}.tmp`;
-  try {
-    await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-    await rename(tmp, dest);
-  } finally { await rm(tmp, { force: true }); }
-}

package/src/store/observations.ts

@@ -1,224 +0,0 @@
-/** Store complete observations while keeping only a bounded preview in memory. */
-import { createReadStream } from "node:fs";
-import { open, mkdir, rename, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
-import type { ArtifactRef } from "../core/events.ts";
-import { blobFilePath, verifyBlob } from "./blobs.ts";
-
-/** Byte pages keep very large single-line observations retrievable as well. */
-export async function readObservation(dir: string, sha256: string, offset: number, limit: number): Promise<{
-  sha256: string; bytes: number; offset: number; next: number | null; text: string; base64: string;
-}> {
-  if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(limit) || limit < 1) throw new Error("invalid observation page");
-  if (!await verifyBlob(dir, sha256)) throw new Error(`missing observation ${sha256}`);
-  const file = await open(blobFilePath(dir, sha256), "r");
-  try {
-    const bytes = (await file.stat()).size;
-    const buffer = Buffer.alloc(Math.min(limit, Math.max(0, bytes - offset)));
-    const { bytesRead } = await file.read(buffer, 0, buffer.length, offset);
-    const data = buffer.subarray(0, bytesRead);
-    return { sha256, bytes, offset, next: offset + bytesRead < bytes ? offset + bytesRead : null,
-      text: data.toString("utf8"), base64: data.toString("base64") };
-  } finally { await file.close(); }
-}
-
-/**
- * After the shell exits, how long silence must last before capture stops.
- *
- * A background child (`server &`) inherits the pipes, so waiting for EOF
- * waits for the server -- the call then blocks until the timeout and the
- * timeout kills the server with the group. Operational choice, not measured:
- * long enough for buffered output of the exited shell to arrive, short
- * enough that a background start costs nothing noticeable. pi uses the same
- * idle-grace shape (`utils/child-process.ts`).
- */
-const EXIT_IDLE_MS = 100;
-/** Hard bound after exit for a background child that never goes quiet. */
-const EXIT_DRAIN_MS = 1_000;
-
-/**
- * Both streams into one file in arrival order.
- *
- * A build that prints progress on stdout and the error on stderr only makes
- * sense interleaved; appending all of stderr after all of stdout (the previous
- * shape) separates each error from the step that produced it. Writes are
- * serialized on one handle, so interleaving happens at chunk granularity --
- * the same granularity a terminal shows.
- *
- * Capture ends at EOF on both streams, or once `exited` has resolved and the
- * streams have gone idle. Ending early cancels the readers only; it signals
- * no process, so a detached background child keeps running.
- */
-async function spoolMerged(
-  dir: string, streams: readonly ReadableStream<Uint8Array>[], exited: Promise<number>,
-  onOutput?: (chunk: Uint8Array) => void,
-  separate = false,
-  limitBytes?: number,
-): Promise<{ path: string; channels: string[]; complete: boolean }> {
-  await mkdir(dir, { recursive: true });
-  const path = join(dir, `.${randomUUID()}.stream`);
-  const file = await open(path, "wx", 0o600);
-  const channels: string[] = [];
-  const channelFiles: Awaited<ReturnType<typeof open>>[] = [];
-  try {
-    if (separate) for (let i = 0; i < streams.length; i++) {
-      const channel = `${path}.${i}`;
-      channelFiles.push(await open(channel, "wx", 0o600)); channels.push(channel);
-    }
-  } catch (error) {
-    await Promise.allSettled([file.close(), ...channelFiles.map(item => item.close())]);
-    await Promise.all([path, ...channels].map(item => rm(item, { force: true })));
-    throw error;
-  }
-  const readers = streams.map((stream) => stream.getReader());
-  let queue: Promise<unknown> = Promise.resolve();
-  let exitedAt: number | undefined;
-  let idle: ReturnType<typeof setTimeout> | undefined;
-  let drain: ReturnType<typeof setTimeout> | undefined;
-  let finished = false, complete = true, capturedBytes = 0;
-  const stop = () => { if (finished) return; complete = false; for (const reader of readers) reader.cancel().catch(() => {}); };
-  const armIdle = () => {
-    if (finished || exitedAt === undefined) return;
-    clearTimeout(idle);
-    idle = setTimeout(stop, EXIT_IDLE_MS);
-  };
-  void exited.then(() => { if (finished) return; exitedAt = performance.now(); armIdle(); drain = setTimeout(stop, EXIT_DRAIN_MS); }, () => {});
-  try {
-    const drained = await Promise.allSettled(readers.map(async (reader, index) => {
-      try {
-        for (;;) {
-          const result = await reader.read();
-          if (result.done) return;
-          armIdle();
-          queue = queue.then(async () => {
-            await file.writeFile(result.value);
-            await channelFiles[index]?.writeFile(result.value);
-            onOutput?.(result.value);
-            capturedBytes += result.value.byteLength;
-            // Retain every delivered chunk, then cancel both readers. At most
-            // the in-flight crossing chunks exceed the bound; SIGTERM grace
-            // cannot turn an output limit into unlimited spool growth (R6).
-            if (limitBytes !== undefined && capturedBytes > limitBytes) stop();
-          });
-          await queue;
-        }
-      } catch (error) { stop(); throw error; }
-    }));
-    await queue;
-    for (const result of drained) if (result.status === "rejected") throw result.reason;
-  } catch (error) {
-    await Promise.allSettled([file.close(), ...channelFiles.map(item => item.close())]);
-    await Promise.all([path, ...channels].map(item => rm(item, { force: true })));
-    throw error;
-  }
-  finally {
-    finished = true;
-    clearTimeout(idle); clearTimeout(drain);
-    for (const reader of readers) reader.releaseLock();
-  }
-  await Promise.all([file.close(), ...channelFiles.map(item => item.close())]);
-  return { path, channels, complete };
-}
-
-/** Last `limit` bytes of a stream, in O(limit) memory however long it runs. */
-class TailWindow {
-  private readonly parts: Uint8Array[] = [];
-  private size = 0;
-  private readonly limit: number;
-  constructor(limit: number) { this.limit = limit; }
-  push(chunk: Uint8Array): void {
-    if (this.limit === 0) return;
-    const part = chunk.byteLength > this.limit ? chunk.slice(chunk.byteLength - this.limit) : chunk.slice();
-    this.parts.push(part);
-    this.size += part.byteLength;
-    while (this.size - this.parts[0]!.byteLength >= this.limit) this.size -= this.parts.shift()!.byteLength;
-  }
-  bytes(): Uint8Array {
-    const all = Buffer.concat(this.parts);
-    return all.subarray(Math.max(0, all.byteLength - this.limit));
-  }
-}
-
-export interface ArchivedObservation {
-  ref: ArtifactRef;
-  /** First `previewBytes` bytes, decoded; kept for callers that only page from the start. */
-  preview: string;
-  /** First and last `previewBytes` bytes, for a head-and-tail view. */
-  head: Uint8Array;
-  tail: Uint8Array;
-}
-
-export async function archiveObservation(
-  dir: string, source: AsyncIterable<Uint8Array>, previewBytes: number,
-): Promise<ArchivedObservation> {
-  await mkdir(dir, { recursive: true });
-  const path = join(dir, `.${randomUUID()}.observation`);
-  const file = await open(path, "wx", 0o600);
-  const hash = createHash("sha256");
-  let bytes = 0;
-  let kept = 0;
-  const preview: Uint8Array[] = [];
-  const tail = new TailWindow(previewBytes);
-  try {
-    try {
-      for await (const chunk of source) {
-        hash.update(chunk);
-        bytes += chunk.byteLength;
-        if (kept < previewBytes) {
-          const part = chunk.slice(0, previewBytes - kept);
-          preview.push(part); kept += part.byteLength;
-        }
-        tail.push(chunk);
-        await file.writeFile(chunk);
-      }
-      await file.sync();
-    } finally { await file.close(); }
-    const sha256 = hash.digest("hex");
-    const destination = blobFilePath(dir, sha256);
-    await mkdir(join(dir, sha256.slice(0, 2)), { recursive: true });
-    await rename(path, destination);
-    const shard = await open(join(dir, sha256.slice(0, 2)), "r");
-    try { await shard.sync(); } finally { await shard.close(); }
-    const head = Buffer.concat(preview);
-    return {
-      ref: { sha256, path: destination, bytes },
-      preview: new TextDecoder().decode(head, { stream: kept < bytes }),
-      head, tail: tail.bytes(),
-    };
-  } finally { await rm(path, { force: true }); }
-}
-
-/**
- * The artifact is `exit N\n` followed by the merged output. Nothing that varies
- * run to run (wall time) belongs here: the artifact digest is the D9 novelty
- * key, and a timestamp in it would make every rerun look like new evidence.
- */
-export async function captureCommandObservation(
-  dir: string, stdout: ReadableStream<Uint8Array>, stderr: ReadableStream<Uint8Array>,
-  exited: Promise<number>, previewBytes: number,
-  onOutput?: (chunk: Uint8Array) => void,
-  separate = false,
-  limitBytes?: number,
-): Promise<ArchivedObservation & { exit: number; prefixBytes: number; channels: ArtifactRef[]; capture: "complete" | "partial" }> {
-  const merged = await spoolMerged(dir, [stdout, stderr], exited, onOutput, separate, limitBytes);
-  try {
-    const exit = await exited;
-    const prefix = new TextEncoder().encode(`exit ${exit}\n`);
-    async function* combined(): AsyncGenerator<Uint8Array> {
-      yield prefix;
-      for await (const chunk of createReadStream(merged.path)) yield chunk as Uint8Array;
-    }
-    async function* channel(path: string): AsyncGenerator<Uint8Array> {
-      for await (const chunk of createReadStream(path)) yield chunk as Uint8Array;
-    }
-    // Drain all archive attempts before removing their source files, including failures.
-    const attempts = await Promise.allSettled([archiveObservation(dir, combined(), previewBytes),
-      ...merged.channels.map(path => archiveObservation(dir, channel(path), 0))]);
-    const stored = attempts.map(result => { if (result.status === "rejected") throw result.reason; return result.value; });
-    return { ...stored[0]!, exit, prefixBytes: prefix.byteLength, channels: stored.slice(1).map(item => item.ref),
-      capture: merged.complete ? "complete" : "partial" };
-  } finally {
-    await Promise.all([merged.path, ...merged.channels].map(path => rm(path, { force: true })));
-  }
-}

package/src/store/packages.ts

@@ -1,98 +0,0 @@
-/** Package storage is local metadata; only runtime/package-manager may install sources. */
-import { mkdir, stat } from "node:fs/promises";
-import { join, resolve, relative, isAbsolute, sep } from "node:path";
-import { homedir } from "node:os";
-import { createHash } from "node:crypto";
-import { readJsonFile } from "./config.ts";
-import { atomicWrite } from "./atomic.ts";
-import { serialized } from "./serial.ts";
-import { packageConfig, packageDeclaration, parsePackageSource, type PackageDeclaration, type PackageSource } from "../core/packages.ts";
-import type { ResourceKind } from "../core/resource-selection.ts";
-
-export type PackageScope = "user" | "project" | "cli";
-export interface PackageRecord { source: string; identity: string; path: string; version?: string; revision?: string }
-export interface PackageRoot {
-  source: PackageSource; declaration: Exclude<PackageDeclaration,string>; scope: PackageScope; base: string;
-  root?: string; delta?: Exclude<PackageDeclaration,string>; trusted: boolean;
-}
-export function packageSource(source: string, base: string): PackageSource {
-  return parsePackageSource(source, path => resolve(base, path.startsWith("~/") ? join(homedir(),path.slice(2)) : path === "~" ? homedir() : path));
-}
-export function packageKey(source: PackageSource): string {
-  // Config identity omits versions, but installed references must retain them:
-  // publishing a new pin cannot invalidate the old declaration before its atomic write.
-  const version=source.kind==="npm"?source.version:source.kind==="git"?source.ref:undefined;
-  return createHash("sha256").update(source.id+"\0"+(version??"")).digest("hex");
-}
-export function packageHome(base: string): string { return join(base,"packages"); }
-export function managedPackagePath(base: string, path: string): string {
-  const home = packageHome(base), target = resolve(home,path), rel = relative(home,target);
-  if (!rel || rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel)) throw Error("Package path escapes its managed directory");
-  return target;
-}
-export async function packageRecords(base: string): Promise<Record<string, PackageRecord>> {
-  const read = await readJsonFile<Record<string,PackageRecord>>(join(packageHome(base),"installed.json"));
-  if (read.error) throw Error(read.error);
-  if (read.value && (typeof read.value !== "object" || Array.isArray(read.value))) throw Error("Invalid package installation index");
-  const records=read.value ?? {};
-  for(const record of Object.values(records)) {
-    if (!record || typeof record.source !== "string" || typeof record.identity !== "string" || typeof record.path !== "string") throw Error("Invalid package installation entry");
-    managedPackagePath(base,record.path);
-  }
-  return records;
-}
-export async function savePackageRecord(base: string, source: PackageSource, record: PackageRecord | undefined): Promise<void> {
-  const path=join(packageHome(base),"installed.json");
-  await serialized(path,async()=>{const records=await packageRecords(base); if(record) records[packageKey(source)]=record; else delete records[packageKey(source)]; await mkdir(packageHome(base),{recursive:true}); await atomicWrite(path,JSON.stringify(records,null,2)+"\n");});
-}
-export async function removePackageRecords(base:string,identity:string):Promise<string[]> {
-  const path=join(packageHome(base),"installed.json");
-  return serialized(path,async()=>{const records=await packageRecords(base),keys=Object.keys(records).filter(key=>records[key]!.identity===identity);for(const key of keys)delete records[key];await mkdir(packageHome(base),{recursive:true});await atomicWrite(path,JSON.stringify(records,null,2)+"\n");return keys;});
-}
-export async function installedPackage(source: PackageSource, base: string): Promise<string | undefined> {
-  if(source.kind==="local") return await stat(source.path).then(()=>source.path,()=>undefined);
-  const record=(await packageRecords(base))[packageKey(source)];
-  if (!record || record.identity!==source.id) return undefined;
-  const installed=packageSource(record.source,base);
-  if(source.kind==="npm"&&(installed.kind!=="npm"||installed.version!==source.version)||source.kind==="git"&&(installed.kind!=="git"||installed.ref!==source.ref))return undefined;
-  const path=managedPackagePath(base,record.path); return await stat(path).then(s=>s.isDirectory()?path:undefined,()=>undefined);
-}
-export async function configuredPackages(base: string): Promise<PackageDeclaration[]> {
-  const read=await readJsonFile<Record<string,unknown>>(join(base,"settings.json")); if(read.error)throw Error(read.error);
-  if(read.value!==null&&(typeof read.value!=="object"||Array.isArray(read.value)))throw Error("Settings must be an object");
-  const list=read.value?.["packages"] ?? []; if(!Array.isArray(list)||!list.every(packageDeclaration))throw Error("Invalid packages configuration"); return list;
-}
-export async function savePackageDeclaration(base: string, source: PackageSource, declaration: PackageDeclaration | undefined): Promise<void> {
-  const file=join(base,"settings.json");
-  await serialized(file,async()=>{
-    const read=await readJsonFile<Record<string,unknown>>(file); if(read.error)throw Error(read.error);
-    if(read.value!==null&&(typeof read.value!=="object"||Array.isArray(read.value)))throw Error("Settings must be an object");
-    const previous=read.value?.["packages"]??[]; if(!Array.isArray(previous)||!previous.every(packageDeclaration))throw Error("Invalid packages configuration");
-    const packages=previous.filter(entry=>packageSource(packageConfig(entry).source,base).id!==source.id);
-    if(declaration!==undefined)packages.push(declaration);
-    await mkdir(base,{recursive:true}); await atomicWrite(file,JSON.stringify({...read.value,packages},null,2)+"\n");
-  });
-}
-export async function packageRoots(user: readonly PackageDeclaration[], project: readonly PackageDeclaration[], opts:{userDir:string;projectDir:string;trusted:boolean}, diagnostics:string[]):Promise<PackageRoot[]> {
-  const roots=new Map<string,PackageRoot>();
-  for(const scope of ["user","project"] as const) for(const entry of scope==="user"?user:project) {
-    try {
-      const declaration=packageConfig(entry),base=scope==="user"?opts.userDir:opts.projectDir,source=packageSource(declaration.source,base),existing=roots.get(source.id);
-      if(scope==="project"&&existing&&(!opts.trusted||declaration.autoload===false)) { if(opts.trusted)existing.delta=declaration; continue; }
-      const root=await installedPackage(source,base);
-      if(!root)diagnostics.push(`Package ${source.source} is not installed; run xeno install ${source.source}${scope==="project"?" --local":""}`);
-      roots.set(source.id,{source,declaration,scope,base,...(root?{root}:{}),trusted:scope==="user"||opts.trusted});
-    } catch(error){diagnostics.push(String(error));}
-  }
-  return [...roots.values()];
-}
-export async function packageManifest(root: string): Promise<Partial<Record<ResourceKind, readonly string[]>>> {
-  if(await stat(root).then(s=>s.isFile(),()=>false)) return {extensions:[root],skills:[],prompts:[],themes:[]};
-  const read=await readJsonFile<{xeno?:unknown;pi?:unknown}>(join(root,"package.json"));if(read.error)throw Error(read.error);
-  const value=read.value?.xeno??read.value?.pi;
-  if(value===undefined)return {extensions:["extensions"],skills:["skills"],prompts:["prompts"],themes:["themes"]};
-  if(!value||typeof value!=="object"||Array.isArray(value))throw Error("Invalid package resource manifest");
-  const result:Partial<Record<ResourceKind,readonly string[]>>={};
-  for(const kind of ["extensions","skills","prompts","themes"] as const){const paths=(value as Record<string,unknown>)[kind]??[];if(!Array.isArray(paths)||paths.some(path=>typeof path!=="string"))throw Error("Invalid package manifest " + kind);result[kind]=paths;}
-  return result;
-}

package/src/store/patch.ts

@@ -1,92 +0,0 @@
-/** R4 / P.3: one fully prepared plan shares the existing confined checkpoint CAS. */
-import { relative, resolve } from "node:path";
-import { parsePatch, applyPatchChunks, patchPaths, PatchError, type PatchOperation } from "../core/patch.ts";
-import { sameVersion, changedPaths, type FileChanges } from "../core/checkpoints.ts";
-import { unifiedFileDiff } from "../core/review.ts";
-import { isFileDigest } from "../core/file-precondition.ts";
-import { ToolFault, NOT_STARTED, READ_ATTEMPTED } from "../core/tool-failure.ts";
-import { editablePath, readEditableFile, applyFileChanges } from "./file-checkpoints.ts";
-import { putBlob } from "./blobs.ts";
-
-export interface PreparedPatch {
-  root: string;
-  changes: FileChanges;
-  operations: readonly PatchOperation[];
-  diffs: readonly { path: string; destination?: string; kind: "add" | "update" | "move" | "delete"; diff: string }[];
-}
-export interface PreparePatchOptions {
-  observedFileVersion?: (absolute: string) => Promise<string | undefined>;
-  expectedSha256?: Readonly<Record<string, string>>;
-  signal?: AbortSignal;
-}
-const decode = (bytes: Uint8Array) => {
-  try { return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes); }
-  catch { throw new ToolFault("invalid_input", "patch requires valid UTF-8 files; use a trusted command for binary data", READ_ATTEMPTED); }
-};
-
-/** No workspace write occurs until every source, destination and hunk passes. */
-export async function preparePatch(root: string, blobs: string, text: string, options: PreparePatchOptions = {}): Promise<PreparedPatch> {
-  let operations: PatchOperation[];
-  try { operations = parsePatch(text); }
-  catch (error) { if (error instanceof PatchError) throw new ToolFault(error.code, error.message, NOT_STARTED); throw error; }
-  const names = new Map<string, string>();
-  const targets = new Set<string>();
-  for (const path of patchPaths(operations)) {
-    const absolute = await editablePath(root, path), canonical = relative(resolve(root), absolute);
-    if (targets.has(canonical) || [...targets].some(existing => existing.startsWith(canonical + "/") || canonical.startsWith(existing + "/")))
-      throw new ToolFault("invalid_input", `patch has duplicate or overlapping targets: ${path}`, NOT_STARTED);
-    names.set(path, canonical); targets.add(canonical);
-  }
-  const canonical = (path: string) => names.get(path)!;
-  const observed = new Map<string, Awaited<ReturnType<typeof readEditableFile>>>();
-  for (const path of targets) {
-    if (options.signal?.aborted) throw new ToolFault("cancelled", "patch preparation cancelled", NOT_STARTED);
-    observed.set(path, await readEditableFile(root, path));
-  }
-  const changes: FileChanges = Object.create(null) as FileChanges;
-  const diffs: PreparedPatch["diffs"][number][] = [];
-  for (const operation of operations) {
-    const path = canonical(operation.path), source = observed.get(path)!;
-    if (operation.kind !== "add") {
-      if (source.bytes === null || source.version === null) throw new ToolFault("not_found", `patch source is missing: ${path}`, READ_ATTEMPTED);
-      const explicit = options.expectedSha256?.[operation.path] ?? options.expectedSha256?.[path];
-      const expected = explicit ?? await options.observedFileVersion?.(resolve(root, path));
-      if (!isFileDigest(expected) || expected !== source.version.sha256)
-        throw new ToolFault("version_mismatch", `patch source version was not observed or changed: ${path}; read it before editing`, READ_ATTEMPTED, { recover: { tool: "read", input: { path } } });
-    } else if (source.version !== null) {
-      throw new ToolFault("version_mismatch", `patch add requires an absent destination: ${path}; existing bytes were preserved`, READ_ATTEMPTED);
-    }
-    let destination = path, content: string | null;
-    const before = source.bytes === null ? null : decode(source.bytes);
-    if (operation.kind === "delete") content = null;
-    else if (operation.kind === "add") content = operation.content;
-    else {
-      try { content = applyPatchChunks(before!, operation.chunks); }
-      catch (error) { if (error instanceof PatchError) throw new ToolFault(error.code, `${path}: ${error.message}`, READ_ATTEMPTED); throw error; }
-      if (operation.movePath !== undefined) {
-        destination = canonical(operation.movePath);
-        if (observed.get(destination)!.version !== null) throw new ToolFault("version_mismatch", `patch move requires an absent destination: ${destination}`, READ_ATTEMPTED);
-      }
-    }
-    if (source.bytes !== null) await putBlob(blobs, source.bytes);
-    const after = content === null ? null : { sha256: await putBlob(blobs, content), mode: source.version?.mode ?? (0o666 & ~process.umask()) };
-    if (destination !== path) {
-      changes[path] = { before: source.version, after: null };
-      changes[destination] = { before: null, after };
-    } else changes[path] = { before: source.version, after };
-    diffs.push({ path, ...(destination === path ? {} : { destination }), kind: destination !== path ? "move" : operation.kind,
-      diff: unifiedFileDiff(path, before, content, destination) });
-  }
-  return { root: resolve(root), operations, changes, diffs };
-}
-
-/** The caller persists prepared/applied checkpoint phases around this operation. */
-export async function applyPreparedPatch(root: string, blobs: string, prepared: PreparedPatch, signal?: AbortSignal): Promise<void> {
-  if (resolve(root) !== prepared.root) throw new ToolFault("invalid_input", "prepared patch names another workspace", NOT_STARTED);
-  if (signal?.aborted) throw new ToolFault("cancelled", "patch application cancelled", NOT_STARTED);
-  await applyFileChanges(root, blobs, prepared.changes, signal);
-  for (const path of changedPaths(prepared.changes)) {
-    if (!sameVersion((await readEditableFile(root, path)).version, prepared.changes[path]!.after))
-      throw new Error(`file changed concurrently after patch: ${path}; inspect the prepared checkpoint`);
-  }
-}

package/src/store/permission-paths.ts

@@ -1,34 +0,0 @@
-/** R13 / D13: path policy sees aliases and actual resources; confinement remains separate. */
-import { realpath } from "node:fs/promises";
-import { dirname, basename, resolve, relative, isAbsolute } from "node:path";
-import { permissionRequest, normalizePermissionPath, type PermissionRequest } from "../core/permissions.ts";
-
-async function canonicalPath(path: string): Promise<string> {
-  try { return await realpath(path); }
-  catch (error) {
-    if (!error || typeof error !== "object" || !("code" in error) || !["ENOENT", "ENOTDIR"].includes(String(error.code))) throw error;
-    const parent = dirname(path);
-    if (parent === path) throw error;
-    // New files have no realpath yet; existing ancestors still reveal aliases.
-    return resolve(await canonicalPath(parent), basename(path));
-  }
-}
-function resource(root: string, absolute: string): string {
-  const path = relative(root, absolute);
-  return normalizePermissionPath(path === ".." || path.startsWith("../") || isAbsolute(path) ? absolute : path || ".");
-}
-
-export async function permissionPaths(root: string, paths: readonly string[]): Promise<string[]> {
-  const absoluteRoot = resolve(root), canonicalRoot = await canonicalPath(absoluteRoot), resources: string[] = [];
-  for (const path of paths) {
-    const absolute = resolve(absoluteRoot, path);
-    resources.push(resource(absoluteRoot, absolute), resource(canonicalRoot, await canonicalPath(absolute)));
-  }
-  return [...new Set(resources)];
-}
-
-/** Models never supply the root or canonical target; the current runtime does. */
-export async function canonicalPermissionRequest(root: string, name: string, input: unknown): Promise<PermissionRequest> {
-  const request = permissionRequest(name, input);
-  return request.paths ? { ...request, paths: await permissionPaths(root, request.paths) } : request;
-}