@visual-z/xeno 0.8.3 → 0.9.0

package/src/store/process-receipts.ts

@@ -1,34 +0,0 @@
-/** R7/R8: data_ref is the original receipt, not permission to substitute current process/file state. */
-import type { LogEvent } from "../core/events.ts";
-import { isLogEvent } from "../core/event-validation.ts";
-import { readObservation } from "./observations.ts";
-
-// Assumed per-query metadata budget. Exhaustion is explicit unknown, never fallback to older success.
-export const PROCESS_RECEIPT_READ_BYTES = 8 * 1024 * 1024;
-export async function hydrateProcessReceipts(nodes: readonly { node: number; events: readonly LogEvent[] }[], archive: string):
-  Promise<{ node: number; events: LogEvent[] }[]> {
-  const calls = new Map<string, string>();
-  for (const part of nodes) for (const event of part.events) {
-    if (event.t === "tool_invocation") calls.set(event.call_id, event.name);
-    if (event.t === "assistant") for (const block of event.blocks) if (block.type === "tool_use") calls.set(block.call_id, block.name);
-  }
-  let remaining = PROCESS_RECEIPT_READ_BYTES;
-  const result: { node: number; events: LogEvent[] }[] = [];
-  for (const part of nodes) {
-    const events: LogEvent[] = [];
-    for (const event of part.events) {
-      if (event.t !== "tool_result" || !event.data_ref || !["exec_command", "write_stdin", "target"].includes(calls.get(event.call_id) ?? "")) { events.push(event); continue; }
-      const ref = event.data_ref;
-      if (ref.bytes > remaining) throw new Error("process receipt metadata exceeds observation budget; state remains unknown");
-      remaining -= ref.bytes;
-      const page = await readObservation(archive, ref.sha256, 0, Math.max(1, ref.bytes));
-      if (page.bytes !== ref.bytes || page.next !== null) throw new Error("process receipt metadata length mismatch");
-      const { data_ref: _ref, ...original } = event;
-      const restored: unknown = { ...original, data: JSON.parse(page.text) };
-      if (!isLogEvent(restored)) throw new Error("archived process receipt contradicts its original event");
-      events.push(restored);
-    }
-    result.push({ node: part.node, events });
-  }
-  return result;
-}

package/src/store/query-source.ts

@@ -1,49 +0,0 @@
-/** N.3: bind a complete calculation input to confined files and content digests. */
-import { lstat, open } from "node:fs/promises";
-import { constants } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
-import { createHash } from "node:crypto";
-import { ToolFault, NOT_STARTED, READ_ATTEMPTED } from "../core/tool-failure.ts";
-import { checkSourceCancellation } from "./source-cancellation.ts";
-
-// Assumed working-memory safety budget for the synchronous pure query engine.
-// Exceeding it is an explicit refusal, never a truncated calculation.
-export const MAX_QUERY_SOURCE_BYTES = 32 * 1024 * 1024;
-export async function readQuerySources(root: string, paths: unknown, signal?: AbortSignal): Promise<{
-  text: string; sources: { path: string; sha256: string; bytes: number }[];
-}> {
-  if (!Array.isArray(paths) || paths.length === 0 || paths.length > 1024 || paths.some((p) => typeof p !== "string" || !p)) throw new ToolFault("invalid_input", "query paths must contain 1..1024 file paths in concatenation order", NOT_STARTED);
-  const sources: { path: string; sha256: string; bytes: number }[] = [];
-  const chunks: Uint8Array[] = [];
-  let bytes = 0;
-  for (const path of paths as string[]) {
-    checkSourceCancellation(signal);
-    const absolute = resolve(root, path), rel = relative(root, absolute);
-    if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) throw new ToolFault("permission_denied", "query path escapes workspace", READ_ATTEMPTED);
-    let current = resolve(root);
-    for (const part of rel.split(sep)) {
-      current = resolve(current, part);
-      if ((await lstat(current)).isSymbolicLink()) throw new ToolFault("permission_denied", "query does not follow symbolic links", READ_ATTEMPTED);
-    }
-    const file = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    try {
-      const info = await file.stat();
-      if (!info.isFile()) throw new ToolFault("invalid_input", "query source must be a regular file", READ_ATTEMPTED);
-      if (bytes + info.size > MAX_QUERY_SOURCE_BYTES) throw new ToolFault("invalid_input", "query source exceeds 32 MiB resource budget; use a smaller input", READ_ATTEMPTED);
-      const hash = createHash("sha256");
-      let sourceBytes = 0;
-      for (;;) {
-        checkSourceCancellation(signal);
-        const buffer = Buffer.alloc(Math.min(65536, MAX_QUERY_SOURCE_BYTES - bytes + 1));
-        const result = await file.read(buffer, 0, buffer.length, null);
-        checkSourceCancellation(signal);
-        if (result.bytesRead === 0) break;
-        bytes += result.bytesRead; sourceBytes += result.bytesRead;
-        if (bytes > MAX_QUERY_SOURCE_BYTES) throw new ToolFault("invalid_input", "query source grew past resource budget", READ_ATTEMPTED);
-        const data = buffer.subarray(0, result.bytesRead); hash.update(data); chunks.push(data);
-      }
-      sources.push({ path: rel.split(sep).join("/"), sha256: hash.digest("hex"), bytes: sourceBytes });
-    } finally { await file.close(); }
-  }
-  return { text: new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)), sources };
-}

package/src/store/recovery.ts

@@ -1,44 +0,0 @@
-/** Complete an explicitly logged cut; never infer a user's chosen branch. */
-import type { Cursor } from "./log.ts";
-import { closeNode, digestNode, initNode, listNodes, nodePath, readNode, readManifest, writeCursor } from "./log.ts";
-import { replayContext, carriedHandoff } from "./replay.ts";
-import { deriveHandoff } from "../core/derive.ts";
-
-export async function recoverCut(dir: string, cursor: Cursor): Promise<Cursor> {
-  const source = await readNode(dir, cursor.node);
-  const cut = source.events.at(-1);
-  if (cut?.t !== "cut" || cut.next_node === undefined) return cursor;
-  const rebuilt = await replayContext(dir, cursor.node);
-  const manifest = await readManifest(dir);
-  if (!manifest.nodes.some((n) => n.node === cursor.node)) {
-    const handoff = deriveHandoff({
-      prev: rebuilt.fullHandoff, depth: rebuilt.depth, events: rebuilt.events,
-      config: { maxUserTurns: Infinity, maxUserTurnBytes: Infinity },
-      self: { node: cursor.node, log_ref: nodePath(dir, cursor.node), sha256: await digestNode(dir, cursor.node) },
-    });
-    await closeNode(dir, cursor.node,
-      await carriedHandoff(dir, cursor.node, handoff, cut, manifest), source.events.length, cut.at);
-  }
-  const successor = await readNode(dir, cut.next_node);
-  if (successor.header === null) {
-    await initNode(dir, cut.next_node, {
-      node: cursor.node, log_ref: nodePath(dir, cursor.node), sha256: await digestNode(dir, cursor.node),
-    }, cut.at, "handoff");
-  } else if (successor.header.parent?.node !== cursor.node || successor.header.basis !== "handoff") {
-    throw new Error(`INTEGRITY: cut successor ${cut.next_node} belongs to another transition`);
-  }
-  const nodes = await listNodes(dir);
-  const next: Cursor = {
-    ...cursor, node: cut.next_node,
-    next_node: Math.max(cursor.next_node, cut.next_node + 1, ...nodes.map((n) => n + 1)),
-    model: cut.next_model ?? cursor.model, updated_at: cut.at,
-  };
-  // Cuts of this session format always record the successor's provider (S.3).
-  if (cut.next_provider !== undefined) next.provider = cut.next_provider;
-  if (cut.next_thinking !== undefined) next.thinking = cut.next_thinking;
-  if (cut.next_context_ref !== undefined) next.context_ref = cut.next_context_ref;
-  delete next.at_event;
-  delete next.needs_model_checkpoint;
-  await writeCursor(dir, next);
-  return next;
-}

package/src/store/replay.ts

@@ -1,76 +0,0 @@
-/**
- * Rebuild the effective context, including every preceding handoff boundary.
- *
- * D3/G.5: physical node files are storage units, not context units. Resume,
- * rewind and cut must agree on inherited events and accumulated state.
- */
-import { deriveHandoff } from "../core/derive.ts";
-import type { Handoff } from "../core/handoff.ts";
-import type { CutEvent, LogEvent } from "../core/events.ts";
-import { boundHandoff, boundRecoveryHandoff, boundRecoveryHandoffV3 } from "../core/history.ts";
-import { retainedContext } from "../core/context-window.ts";
-import { digestNode, nodePath, readAncestry, readManifest, type Manifest } from "./log.ts";
-import { readNodeHistory } from "./restore.ts";
-
-export interface ReplayedContext {
-  /** Events not already included in fullHandoff; use these for derivation. */
-  events: LogEvent[];
-  /** Model view also includes explicitly retained original exchanges. */
-  contextEvents: LogEvent[];
-  handoff: Handoff | null;
-  /** Full derivation state; only the bounded handoff is sent to the model. */
-  fullHandoff: Handoff | null;
-  depth: number;
-}
-
-/** A live cut, cold replay and interrupted-cut repair must select the same version. */
-export async function carriedHandoff(dir: string, node: number, full: Handoff,
-  policy: Pick<CutEvent, "handoff_tokens" | "working_set_version" | "guidance_tools">, manifest?: Manifest): Promise<Handoff> {
-  if (policy.handoff_tokens === undefined) return full;
-  // The recorded version selects the algorithm; a new default never reinterprets an old cut.
-  if (policy.working_set_version === 2 || policy.working_set_version === 3) {
-    const history = await readNodeHistory(dir, node, manifest, "context");
-    if (!history.ok) throw new Error(history.error);
-    return (policy.working_set_version === 3 ? boundRecoveryHandoffV3 : boundRecoveryHandoff)(full, history.nodes, policy.handoff_tokens, policy.guidance_tools);
-  }
-  return boundHandoff(full, policy.handoff_tokens);
-}
-
-export async function replayContext(
-  dir: string, node: number, manifest?: Manifest,
-): Promise<ReplayedContext> {
-  const index = manifest ?? await readManifest(dir);
-  const seen = new Set<number>();
-  // Iterative even across handoff boundaries: a valid long session must not
-  // consume the JS call stack just because it has many compacted segments.
-  const parts: { node: number; events: LogEvent[]; depth: number }[] = [];
-  let current: number | null = node;
-  while (current !== null) {
-    if (seen.has(current)) throw new Error(`CYCLE: handoff ancestry revisits node ${current}`);
-    seen.add(current);
-    const walk = await readAncestry(dir, current, index);
-    if (!walk.ok) throw new Error(`${walk.error.code}: ${walk.error.detail}`);
-    parts.push({ node: current, events: walk.events, depth: walk.visited.length });
-    current = walk.basis?.node ?? null;
-  }
-  let handoff: Handoff | null = null;
-  let depth = 0;
-  let carried: Handoff | null = null;
-  let retained: LogEvent[] = [];
-  for (let i = parts.length - 1; i >= 0; i--) {
-    const part = parts[i]!;
-    depth += part.depth;
-    const contextEvents = [...retained, ...part.events];
-    if (i === 0) return { handoff: carried, fullHandoff: handoff, depth, events: part.events, contextEvents };
-    handoff = deriveHandoff({
-      prev: handoff, depth, events: part.events,
-      config: { maxUserTurns: Infinity, maxUserTurnBytes: Infinity },
-      self: { node: part.node, log_ref: nodePath(dir, part.node), sha256: await digestNode(dir, part.node) },
-    });
-    const tail = part.events.at(-1);
-    carried = tail?.t === "cut" ? await carriedHandoff(dir, part.node, handoff, tail, index) : handoff;
-    retained = tail?.t === "cut" && tail.retained_from !== undefined
-      ? retainedContext(contextEvents, tail.retained_from) : [];
-  }
-  throw new Error(`MISSING_HEADER: no context for node ${node}`);
-}

package/src/store/resource-index.ts

@@ -1,170 +0,0 @@
-/** One resource inventory for loading and configuration; paths carry their declaring scope. */
-import { readdir, realpath, stat, mkdir } from "node:fs/promises";
-import { homedir } from "node:os";
-import { basename, dirname, join, resolve, sep } from "node:path";
-import { configDir, readJsonFile } from "./config.ts";
-import { atomicWrite } from "./atomic.ts";
-import { serialized } from "./serial.ts";
-import { parseSettings, type Settings } from "../core/settings.ts";
-import { parseResourcePattern, resourceOverride, updateResourcePatterns, type ResourceEntry, type ResourceKind, type ResourceOverride } from "../core/resource-selection.ts";
-import { packageResourceEnabled, packageConfig } from "../core/packages.ts";
-import { packageRoots, packageManifest, packageSource, configuredPackages, savePackageDeclaration, type PackageRoot } from "./packages.ts";
-
-export interface ResourceOptions {
-  workspace: string; trusted: boolean; configDir?: string;
-  noSkills?: boolean; noPromptTemplates?: boolean;
-  noThemes?: boolean; themePaths?: readonly string[];
-  skillPaths?: readonly string[]; promptTemplatePaths?: readonly string[];
-  noExtensions?: boolean; extensionPaths?: readonly string[];
-  packagePaths?: readonly { source: string; path: string }[];
-  local?: boolean;
-}
-export interface ResourceIndex {
-  entries: ResourceEntry[]; diagnostics: string[]; user: Settings; project: Settings;
-  userDir: string; projectDir: string; trusted: boolean;
-}
-export function resourcePath(path: string, base: string): string {
-  const expanded = path === "~" ? homedir() : path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
-  return resolve(base, expanded);
-}
-function matches(path: string, pattern: string, base: string): boolean {
-  const absolute = resourcePath(pattern, base);
-  return path === absolute || path.startsWith(absolute + sep) || new Bun.Glob(absolute.replace(/\\/g, "/")).match(path.replace(/\\/g, "/"));
-}
-export async function discoverResources(opts: ResourceOptions): Promise<ResourceIndex> {
-  const userDir = opts.configDir ?? configDir(), projectDir = join(opts.workspace, ".xeno");
-  const index: ResourceIndex = { entries: [], diagnostics: [], user: {}, project: {}, userDir, projectDir, trusted: opts.trusted };
-  for (const scope of ["user", "project"] as const) {
-    const file = join(scope === "user" ? userDir : projectDir, "settings.json");
-    const read = await readJsonFile<unknown>(file);
-    if (read.error) index.diagnostics.push(read.error);
-    const parsed = parseSettings(read.value);
-    index.diagnostics.push(...parsed.diagnostics.map(message => `${file}: ${message}`));
-    // Global-only policy cannot be granted by the project it would trust.
-    const { defaultProjectTrust: _ignored, ...project } = parsed.settings;
-    index[scope] = scope === "project" ? project : parsed.settings;
-  }
-  const found = new Map<string, ResourceEntry>();
-  const packages=await packageRoots(index.user.packages??[],index.project.packages??[],index,index.diagnostics);
-  const explicitPackageRoots=new Set<string>();
-  for(const source of opts.extensionPaths??[]) {
-    const path=resourcePath(source,opts.workspace);
-    const manifest=await readJsonFile<{pi?:unknown;xeno?:unknown}>(join(path,"package.json"));
-    const conventional=(await Promise.all(["extensions","skills","prompts","themes"].map(kind=>stat(join(path,kind)).then(s=>s.isDirectory(),()=>false)))).some(Boolean);
-    if(manifest.value?.pi||manifest.value?.xeno||conventional) {
-      explicitPackageRoots.add(path); packages.push({source:packageSource(source,opts.workspace),declaration:{source},scope:"cli",base:opts.workspace,root:path,trusted:true});
-    }
-  }
-  for(const entry of opts.packagePaths??[])packages.push({source:packageSource(entry.source,opts.workspace),declaration:{source:entry.source},scope:"cli",base:opts.workspace,root:entry.path,trusted:true});
-  for (const kind of ["skills", "prompts", "themes", "extensions"] as const) {
-    const disabled = kind === "skills" ? opts.noSkills : kind === "prompts" ? opts.noPromptTemplates : kind === "extensions" ? opts.noExtensions : opts.noThemes;
-    for (const scope of ["user", "project"] as const) {
-      const base = scope === "user" ? userDir : projectDir;
-      const sources = [join(base, kind), ...(index[scope][kind] ?? []).map(parseResourcePattern).filter(p => p.enabled).map(p => resourcePath(p.pattern, base))];
-      for (const source of [...new Set(sources)]) for (const path of await resourceFiles(source, kind, index.diagnostics, source !== join(base, kind))) {
-        // A project override of an inherited path does not transfer resource ownership.
-        if (found.has(kind + ":" + path)) continue;
-        const global = resourceOverride(index.user[kind] ?? [], pattern => matches(path, pattern, userDir));
-        const local = resourceOverride(index.project[kind] ?? [], pattern => matches(path, pattern, projectDir));
-        const inherited = !disabled && global !== "skip";
-        const trusted = scope === "user" || opts.trusted;
-        const enabled = trusted && !disabled && (opts.trusted && local !== "inherit" ? local === "load" : inherited);
-        found.set(kind + ":" + path, { kind, path, name: kind === "skills" ? basename(dirname(path)) : basename(path).replace(/\.[^.]+$/, ""),
-          scope, source, enabled, inherited, override: local, trusted });
-      }
-    }
-    const cli = kind === "skills" ? opts.skillPaths : kind === "prompts" ? opts.promptTemplatePaths : kind === "extensions" ? opts.extensionPaths : opts.themePaths;
-    for (const source of cli ?? []) for (const path of explicitPackageRoots.has(resourcePath(source,opts.workspace)) ? [] : await resourceFiles(resourcePath(source, opts.workspace), kind, index.diagnostics, true)) {
-      found.set(kind + ":" + path, { kind, path, name: kind === "skills" ? basename(dirname(path)) : basename(path).replace(/\.[^.]+$/, ""),
-        scope: "cli", source, enabled: true, inherited: true, override: "inherit", trusted: true });
-    }
-    for(const pkg of packages) await addPackageResources(found,index,pkg,kind,!!disabled);
-  }
-  index.entries = [...found.values()];
-  return index;
-}
-
-async function addPackageResources(found:Map<string,ResourceEntry>,index:ResourceIndex,pkg:PackageRoot,kind:ResourceKind,disabled:boolean):Promise<void> {
-  if(!pkg.root)return;
-  try {
-    const manifest=await packageManifest(pkg.root),patterns=manifest[kind]??[],candidates=new Set<string>();
-    for(const pattern of patterns.map(parseResourcePattern).filter(p=>p.enabled)) {
-      for(const path of await resourceFiles(resourcePath(pattern.pattern,pkg.root),kind,index.diagnostics))candidates.add(path);
-    }
-    for(const path of candidates) {
-      const match=(pattern:string,exact=false)=>exact?path===resourcePath(pattern,pkg.root!):matches(path,pattern,pkg.root!);
-      // The package manifest is the outer boundary; settings cannot expose undeclared files.
-      if(!packageResourceEnabled(patterns,match))continue;
-      const inherited=packageResourceEnabled(pkg.declaration[kind],match)&&pkg.declaration.autoload!==false;
-      const delta=packageResourceEnabled(pkg.delta?.[kind],match,inherited);
-      const global=resourceOverride(index.user[kind]??[],pattern=>matches(path,pattern,index.userDir));
-      const flat=resourceOverride(index.project[kind]??[],pattern=>matches(path,pattern,index.projectDir));
-      const local=flat!=="inherit"?flat:resourceOverride(pkg.delta?.[kind]??[],match);
-      const base=inherited&&global!=="skip",enabled=pkg.scope==="cli"||pkg.trusted&&!disabled&&(index.trusted&&local!=="inherit"?local==="load":delta&&global!=="skip");
-      if(found.get(kind+":"+path)?.scope==="cli")continue;
-      found.set(kind+":"+path,{kind,path,name:kind==="skills"?basename(dirname(path)):basename(path).replace(/\.[^.]+$/,""),scope:pkg.scope,source:pkg.source.source,
-        enabled,inherited:base,override:local,trusted:pkg.trusted,package:{source:pkg.source.source,identity:pkg.source.id,root:pkg.root}});
-    }
-  }catch(error){index.diagnostics.push(`${pkg.source.source}: ${String(error)}`);}
-}
-
-/** Iterative realpath tracking allows linked resource folders without following cycles. */
-async function resourceFiles(source: string, kind: ResourceKind, diagnostics: string[], required = false): Promise<string[]> {
-  const files: string[] = [], seen = new Set<string>(), stack = [source];
-  if (/[*?{[]/.test(source)) {
-    try { return [...new Bun.Glob(source).scanSync({ absolute: true, onlyFiles: true })].sort(); }
-    catch (error) { diagnostics.push(`${source}: ${String(error)}`); return []; }
-  }
-  while (stack.length) {
-    const path = stack.pop()!;
-    try {
-      const canonical = await realpath(path); if (seen.has(canonical)) continue; seen.add(canonical);
-      const info = await stat(path);
-      if (info.isDirectory()) {
-        if (kind === "extensions" && path !== source) {
-          const manifest = await readJsonFile<{ xeno?: { extensions?: string[] }; pi?: { extensions?: string[] } }>(join(path, "package.json"));
-          const declared = manifest.value?.xeno?.extensions ?? manifest.value?.pi?.extensions;
-          if (declared) { for (const entry of declared) stack.push(resolve(path, entry)); continue; }
-          for (const ext of ["ts", "js", "mts", "mjs"]) {
-            const entry = join(path, `index.${ext}`);
-            if (await stat(entry).then(s => s.isFile(), () => false)) { stack.push(entry); break; }
-          }
-          continue;
-        }
-        const entries = (await readdir(path, { withFileTypes: true })).sort((a, b) => b.name.localeCompare(a.name));
-        for (const entry of entries) if (!entry.name.startsWith(".") && entry.name !== "node_modules" && (kind === "skills" || kind === "extensions" || !entry.isDirectory())) stack.push(join(path, entry.name));
-      } else if (info.isFile() && (kind === "skills" ? basename(path) === "SKILL.md" || path === source : kind === "extensions" ? /\.[cm]?[jt]s$/.test(path) : path.endsWith(kind === "themes" ? ".json" : ".md"))) files.push(resolve(path));
-    } catch (error) { if ((error as { code?: string }).code !== "ENOENT" || required && path === source) diagnostics.push(`${path}: ${String(error)}`); }
-  }
-  return files;
-}
-export async function setResourceOverride(index: ResourceIndex, entry: ResourceEntry, scope: "user" | "project", state: ResourceOverride): Promise<void> {
-  if (entry.scope === "cli") throw new Error("Explicit command-line resources are controlled by their flags");
-  if (scope === "user" && entry.scope !== "user") throw new Error("Project resources are configured in project scope");
-  const base = scope === "user" ? index.userDir : index.projectDir;
-  if(entry.package) {
-    const metadata=entry.package,previous=(await configuredPackages(base)).find(value=>packageSource(packageConfig(value).source,base).id===metadata.identity);
-    const source=metadata.identity.startsWith("local:")?metadata.root:metadata.source;
-    const config=previous?{...packageConfig(previous)}:{source,...(scope==="project"&&entry.scope==="user"?{autoload:false}:{})};
-    const old=config[entry.kind],patterns=old?.length===0&&state!=="inherit"?["!**/*",...(old??[])]:old??[];
-    const selected=updateResourcePatterns(patterns,entry.path,state,pattern=>resourcePath(pattern,metadata.root)===entry.path);
-    if(selected.length)config[entry.kind]=selected;else delete config[entry.kind];
-    await savePackageDeclaration(base,packageSource(source,base),config);return;
-  }
-  const file = join(base, "settings.json");
-  await serialized(file, async () => {
-    const { value, error } = await readJsonFile<Record<string, unknown>>(file);
-    if (error) throw new Error(error);
-    if (value !== null && (typeof value !== "object" || Array.isArray(value))) throw new Error("Settings must be an object");
-    const previous = value?.[entry.kind];
-    if (previous !== undefined && (!Array.isArray(previous) || previous.some(p => typeof p !== "string"))) throw new Error("Resource paths must be strings");
-    const patterns = updateResourcePatterns((previous ?? []) as string[], entry.path, state, pattern => resourcePath(pattern, base) === entry.path);
-    await mkdir(base, { recursive: true });
-    await atomicWrite(file, JSON.stringify({ ...value, [entry.kind]: patterns }, null, 2) + "\n");
-  });
-}
-
-export function themeResourcePath(index: ResourceIndex, name: string): string | undefined {
-  const candidates = index.entries.filter(entry => entry.kind === "themes" && (entry.name === name || entry.path === name));
-  return candidates.findLast(entry => entry.enabled)?.path ?? (candidates.length ? "dark" : undefined);
-}

package/src/store/resources.ts

@@ -1,285 +0,0 @@
-/**
- * Discover and read UI resources: settings, theme, keybindings, skills,
- * prompt templates.
- *
- * I/O lives here; validation is core. Reads diagnose corrupt files and fall
- * back so startup survives a missing comma. Writes preserve them and report failure.
- *
- * Project-level files follow the same trust rule as `.xeno/settings.json`.
- * Theme and keymap are UI state and are not logged.
- */
-
-import { readdir, readFile } from "node:fs/promises";
-import { watch } from "node:fs";
-import { basename, dirname, join } from "node:path";
-import { configDir, readJsonFile } from "./config.ts";
-import { editUserSettings } from "./user-settings.ts";
-import { mergePreferenceJson } from "../core/model-preferences.ts";
-import { discoverResources, themeResourcePath, type ResourceIndex } from "./resource-index.ts";
-import { parseSkill, type Skill } from "../core/skills.ts";
-import { parsePromptTemplate, type PromptTemplate } from "../core/prompts.ts";
-import {
-  builtinTheme,
-  parseTheme,
-  type Theme,
-} from "../core/theme.ts";
-import {
-  defaultKeymap,
-  parseKeymap,
-  type Keymap,
-} from "../core/keymap.ts";
-import {
-  defaultSettings,
-  mergeSettings,
-  type Settings,
-} from "../core/settings.ts";
-
-export interface LoadUiOptions {
-  readonly workspace: string;
-  readonly trusted: boolean;
-  /** `--theme <name|path>`, wins over settings. */
-  readonly theme?: string;
-  readonly noThemes?: boolean;
-  readonly themePaths?: readonly string[];
-  readonly tuiMode?: "regular" | "fullscreen";
-}
-
-export interface UiResources {
-  readonly settings: Settings;
-  readonly theme: Theme;
-  readonly keymap: Keymap;
-  readonly diagnostics: readonly string[];
-  readonly userOverrides: Partial<Settings>;
-}
-
-export function keybindingsPath(): string {
-  return join(configDir(), "keybindings.json");
-}
-
-export function projectKeybindingsPath(workspace: string): string {
-  return join(workspace, ".xeno", "keybindings.json");
-}
-
-export function userThemePath(name: string): string {
-  return join(configDir(), "themes", `${name}.json`);
-}
-
-export async function loadUiResources(opts: LoadUiOptions, resources?: ResourceIndex): Promise<UiResources> {
-  const index = resources ?? await discoverResources(opts);
-  const diagnostics = [...index.diagnostics];
-  const userOverrides = index.user;
-
-  const cli: Settings = { ...(opts.theme ? { theme: opts.theme } : {}), ...(opts.tuiMode ? { tuiMode: opts.tuiMode } : {}) };
-  const settings = mergeSettings({
-    builtin: defaultSettings(),
-    user: index.user,
-    project: opts.trusted ? index.project : {},
-    cli,
-  });
-
-  const theme = await resolveTheme(selectedThemePath(index, settings.theme ?? "dark", opts.noThemes), diagnostics);
-  const keymap = await resolveKeymap(opts.workspace, opts.trusted, diagnostics);
-
-  return { settings, theme, keymap, diagnostics, userOverrides };
-}
-
-/** Loading and watching share enablement; a disabled resource must not reactivate on file changes. */
-export function selectedThemePath(index: ResourceIndex, name: string, noThemes = false): string {
-  const source = themeResourcePath(index, name);
-  const disabled = !source && (noThemes || index.entries.some(entry => entry.kind === "themes" && (entry.name === name || entry.path === name) && !entry.enabled));
-  return disabled && !["dark", "light", "system", "auto"].includes(name) ? "dark" : source ?? name;
-}
-
-export async function writeUserSettings(overrides: Partial<Settings>): Promise<void> {
-  const patch = structuredClone(overrides);
-  await editUserSettings(previous => mergePreferenceJson(previous, patch));
-}
-
-/** Remove only the user's override; project defaults and unrelated keys retain their ownership. */
-export async function removeModelThinkingOverride(identity: string): Promise<void> {
-  await editUserSettings(previous => {
-    const levels = previous["modelThinkingLevels"];
-    if (!levels || typeof levels !== "object" || Array.isArray(levels)) return null;
-    const next = Object.fromEntries(Object.entries(levels).filter(([key]) => key !== identity));
-    return { ...previous, modelThinkingLevels: next };
-  });
-}
-
-export async function resolveTheme(spec: string, diagnostics: string[]): Promise<Theme> {
-  if (spec === "dark" || spec === "light") return builtinTheme(spec);
-  if (spec === "system" || spec === "auto") return { ...builtinTheme("dark"), name: spec };
-
-  const path = looksLikePath(spec) ? spec : userThemePath(spec);
-  const { value, error } = await readJsonFile<unknown>(path);
-  if (error) {
-    diagnostics.push(error);
-    return builtinTheme("dark");
-  }
-  if (value === null) {
-    diagnostics.push(`theme "${spec}" not found at ${path}; using dark`);
-    return builtinTheme("dark");
-  }
-  const parsed = parseTheme(value);
-  diagnostics.push(...parsed.diagnostics);
-  return parsed.theme;
-}
-
-/** Directory watching survives atomic editor saves; malformed edits keep the last valid palette. */
-export function watchTheme(spec: string, apply: (theme: Theme) => void, report: (message: string) => void): () => void {
-  if (["dark", "light", "system", "auto"].includes(spec)) return () => {};
-  const file = looksLikePath(spec) ? spec : userThemePath(spec);
-  let timer: ReturnType<typeof setTimeout> | undefined, closed = false;
-  const changed = () => {
-    if (timer) clearTimeout(timer);
-    timer = setTimeout(() => { void (async () => {
-      const diagnostics: string[] = [];
-      const theme = await resolveTheme(spec, diagnostics);
-      if (closed) return;
-      if (diagnostics.length) report(diagnostics.join("\n")); else apply(theme);
-    })(); }, 80);
-  };
-  try {
-    const watcher = watch(dirname(file), { persistent: false }, (_event, name) => { if (!name || String(name) === basename(file)) changed(); });
-    watcher.on("error", error => { if (!closed) report(String(error)); });
-    return () => { closed = true; if (timer) clearTimeout(timer); watcher.close(); };
-  } catch (error) { report(String(error)); return () => { closed = true; }; }
-}
-
-export async function discoverThemes(index?: ResourceIndex): Promise<string[]> {
-  if (index) return [...new Set(["dark", "light", "system", "auto", ...index.entries.filter(entry => entry.kind === "themes" && entry.enabled).map(entry => entry.name)])];
-  let names: string[] = [];
-  try { names = (await readdir(join(configDir(), "themes"))).filter(name => name.endsWith(".json")).map(name => name.slice(0, -5)).sort(); }
-  catch (error) { if (!isNotFound(error)) throw error; }
-  return [...new Set(["dark", "light", "system", "auto", ...names])];
-}
-
-async function resolveKeymap(workspace: string, trusted: boolean, diagnostics: string[]): Promise<Keymap> {
-  let map = defaultKeymap(process.platform === "win32" ? "win32" : process.env["WSL_DISTRO_NAME"] || process.env["WSL_INTEROP"] ? "wsl" : "posix");
-
-  const userRead = await readJsonFile<unknown>(keybindingsPath());
-  if (userRead.error) diagnostics.push(userRead.error);
-  if (userRead.value !== null) {
-    map = parseKeymap(userRead.value, map);
-  }
-
-  if (trusted) {
-    const projectRead = await readJsonFile<unknown>(projectKeybindingsPath(workspace));
-    if (projectRead.error) diagnostics.push(projectRead.error);
-    if (projectRead.value !== null) {
-      map = parseKeymap(projectRead.value, map);
-    }
-  }
-
-  diagnostics.push(...map.diagnostics);
-  return map;
-}
-
-function looksLikePath(spec: string): boolean {
-  return spec.includes("/") || spec.includes("\\") || spec.endsWith(".json");
-}
-
-export interface LoadTextOptions {
-  readonly workspace: string;
-  readonly configDir: string;
-  readonly trusted: boolean;
-  readonly noSkills?: boolean;
-  readonly noPromptTemplates?: boolean;
-  /** `--skill <path>`, loaded even when `noSkills` is set. */
-  readonly skillPaths?: readonly string[];
-  /** `--prompt-template <path>`, loaded even when discovery is off. */
-  readonly promptTemplatePaths?: readonly string[];
-}
-
-export interface LoadedTextResources {
-  readonly skills: readonly Skill[];
-  readonly prompts: readonly PromptTemplate[];
-  readonly diagnostics: readonly string[];
-}
-
-/**
- * Discover skills and prompt templates. Project directories load only when
- * trusted, matching `.xeno/settings.json`. A bad file is named and skipped.
- */
-export async function loadTextResources(opts: LoadTextOptions, resources?: ResourceIndex): Promise<LoadedTextResources> {
-  const diagnostics: string[] = [];
-  const skills = new Map<string, Skill>();
-  const prompts = new Map<string, PromptTemplate>();
-
-  const addSkill = (skill: Skill): void => {
-    const prev = skills.get(skill.name);
-    if (prev !== undefined) {
-      diagnostics.push(
-        `skill "${skill.name}" from ${skill.filePath} replaces ${prev.filePath}`,
-      );
-    }
-    skills.set(skill.name, skill);
-  };
-  const addPrompt = (prompt: PromptTemplate): void => {
-    const prev = prompts.get(prompt.name);
-    if (prev !== undefined) {
-      diagnostics.push(
-        `prompt template "${prompt.name}" from ${prompt.filePath} replaces ${prev.filePath}`,
-      );
-    }
-    prompts.set(prompt.name, prompt);
-  };
-
-  const index = resources ?? await discoverResources(opts);
-  diagnostics.push(...index.diagnostics);
-  for (const entry of index.entries) if (entry.enabled) {
-    if (entry.kind === "skills") await absorbSkill(entry.path, addSkill, diagnostics);
-    if (entry.kind === "prompts") await absorbPrompt(entry.path, addPrompt, diagnostics);
-  }
-
-  return {
-    skills: [...skills.values()],
-    prompts: [...prompts.values()],
-    diagnostics,
-  };
-}
-
-async function absorbSkill(
-  filePath: string,
-  add: (skill: Skill) => void,
-  diagnostics: string[],
-): Promise<void> {
-  const text = await readUtf8(filePath);
-  if (text === null) {
-    diagnostics.push(`${filePath}: could not read`);
-    return;
-  }
-  const parsed = parseSkill({
-    filePath,
-    parentDirName: basename(dirname(filePath)),
-    text,
-  });
-  diagnostics.push(...parsed.diagnostics);
-  if (parsed.skill) add(parsed.skill);
-}
-
-async function absorbPrompt(
-  filePath: string,
-  add: (prompt: PromptTemplate) => void,
-  diagnostics: string[],
-): Promise<void> {
-  const text = await readUtf8(filePath);
-  if (text === null) {
-    diagnostics.push(`${filePath}: could not read`);
-    return;
-  }
-  const parsed = parsePromptTemplate({ filePath, text });
-  diagnostics.push(...parsed.diagnostics);
-  if (parsed.template) add(parsed.template);
-}
-
-async function readUtf8(path: string): Promise<string | null> {
-  try {
-    return await readFile(path, "utf8");
-  } catch {
-    return null;
-  }
-}
-
-function isNotFound(err: unknown): boolean {
-  return (err as { code?: string }).code === "ENOENT";
-}