@visual-z/xeno 0.8.3 → 0.9.0

package/src/store/sessions.ts

@@ -1,525 +0,0 @@
-/**
- * Many sessions under one project.
- *
- * A workspace used to hold a single log at `.xeno/log`. That made `/new`,
- * `/resume`, `/name` and the rest unimplementable: there was nothing to
- * list, name, or pick. Each session is now its own log tree under
- * `.xeno/sessions/<id>/`, and the blob store stays at `.xeno/blobs` --
- * content-addressed bytes are the same bytes no matter which session
- * snapshotted them, and splitting the store would throw the dedup away
- * without buying any isolation.
- *
- * There is no index file. An index is a second source of truth and will
- * disagree with the directories; this project's whole position is that the
- * log is the only truth, and a session list that can lie is the same class
- * of error as a handoff that can lie. Listing is a scan. The cost is one
- * small read per session, capped, which is the point of the cap.
- *
- * Why the id has a random suffix, not just a timestamp: two sessions
- * created in the same millisecond would otherwise share a directory, and
- * the second write would land in the first session's tree. That is the
- * same collision shape that once had two node allocators agree on id 1
- * and silently truncate a log.
- */
-
-import { cp, lstat, mkdir, mkdtemp, open, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import type { Dirent } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import {
-  digestNode,
-  listNodes,
-  nodePath,
-  initNode,
-  readManifest,
-  readCursor,
-  readCursorAt,
-  readNode,
-  forkedAt,
-  writeCursor,
-  setParentSession,
-  type Manifest,
-} from "./log.ts";
-import { readNodeHistory } from "./restore.ts";
-import { replayContext } from "./replay.ts";
-import { recoverCut } from "./recovery.ts";
-import { planSessionEntry, type SessionEntryFlags } from "../core/session-entry.ts";
-import { assertNever } from "../core/exhaustive.ts";
-import type { LogEvent } from "../core/events.ts";
-import { resolveHistoryPosition } from "./session-position.ts";
-import { importSessionArchive } from "./session-archive.ts";
-
-/**
- * A listing that reads every session ever is unbounded. Two hundred is
- * enough to find the one you were in last week; beyond that the scan would
- * be hiding a missing search feature, not serving one. Assumed, not
- * measured: this is a product cap, not a performance number. The rest stay
- * on disk -- the listing says it truncated, so they are not silent.
- */
-export const MAX_SESSION_LIST = 200;
-
-/**
- * Exclusive-create retries when the id is already on disk.
- *
- * The suffix space is 36^4 (about 1.7 million). A collision is a bug in
- * the clock -- same millisecond AND same random -- not a thing we wait
- * out. Four tries then refuse, rather than loop.
- */
-const MAX_ID_ATTEMPTS = 4;
-
-const SUFFIX_SPAN = 36 ** 4;
-
-export interface SessionIdClock {
-  nowMs: () => number;
-  /** In [0, 1), same range as Math.random. */
-  random: () => number;
-}
-
-export type ListedSession =
-  | {
-      ok: true;
-      id: string;
-      name: string | null;
-      model: string | null;
-      node: number | null;
-      events: number;
-      updated_at: string | null;
-      path: string;
-      workspace?: string;
-      parent_session?: string;
-      text?: string;
-      /** Details only: whether any node holds a user event (fix-skip-empty-sessions). */
-      conversation?: boolean;
-      /** Details only, forks only: when the copy was made (fix-fork-start-time). */
-      forked_at?: string;
-    }
-  | {
-      ok: false;
-      id: string;
-      path: string;
-      error: string;
-    };
-
-export interface SessionList {
-  sessions: ListedSession[];
-  /** Session directories not read because the listing cap was hit. */
-  truncated: number;
-}
-
-const systemIdClock: SessionIdClock = {
-  nowMs: () => Date.now(),
-  random: () => Math.random(),
-};
-
-export function sessionsDir(workspace: string, override?: string): string {
-  if (override !== undefined && override.length > 0) {
-    return isAbsolute(override) ? override : join(workspace, override);
-  }
-  return join(workspace, ".xeno", "sessions");
-}
-
-/**
- * `<base36 ms>-<4 digit base36 random>`.
- *
- * Time first so ids sort by creation. The suffix is what makes two calls
- * in the same millisecond distinct; without it the second session is the
- * first session's directory.
- */
-export function formatSessionId(ms: number, random: number): string {
-  const n = Math.min(SUFFIX_SPAN - 1, Math.max(0, Math.floor(random * SUFFIX_SPAN)));
-  return `${ms.toString(36)}-${n.toString(36).padStart(4, "0")}`;
-}
-
-export function truncationNote(truncated: number): string | null {
-  if (truncated <= 0) return null;
-  const noun = truncated === 1 ? "session" : "sessions";
-  return `listing capped at ${MAX_SESSION_LIST}; ${truncated} older ${noun} not shown`;
-}
-
-export async function createSession(
-  workspace: string,
-  clock: SessionIdClock = systemIdClock,
-  sessionDir?: string,
-): Promise<{ id: string; path: string }> {
-  const dir = sessionsDir(workspace, sessionDir);
-  await mkdir(dir, { recursive: true });
-  // The first session makes the state directory exist; keep it out of git from that moment.
-  await ignoreStateDir(dirname(dir));
-  for (let attempt = 0; attempt < MAX_ID_ATTEMPTS; attempt++) {
-    const id = formatSessionId(clock.nowMs(), clock.random());
-    const path = join(dir, id);
-    try {
-      // Exclusive. recursive would succeed on an existing directory and the
-      // second session would write into the first -- the collision this
-      // suffix exists to make unrepresentable.
-      await mkdir(path);
-      return { id, path };
-    } catch (err) {
-      if ((err as { code?: string }).code !== "EEXIST") throw err;
-    }
-  }
-  throw new Error(
-    `could not allocate a unique session id under ${dir} after ${MAX_ID_ATTEMPTS} attempts`,
-  );
-}
-
-export async function listSessions(workspace: string, sessionDir?: string, limit = MAX_SESSION_LIST): Promise<SessionList> {
-  const dir = sessionsDir(workspace, sessionDir);
-  let entries: Dirent[];
-  try {
-    entries = await readdir(dir, { withFileTypes: true });
-  } catch (err) {
-    if ((err as { code?: string }).code === "ENOENT") return { sessions: [], truncated: 0 };
-    throw err;
-  }
-
-  const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith("."));
-  const withMtime = await Promise.all(
-    dirs.map(async (d) => {
-      const path = join(dir, d.name);
-      const st = await stat(path);
-      return { id: d.name, path, mtime: st.mtimeMs };
-    }),
-  );
-  // The cap is "which 200 do we even open", and mtime is the cheap proxy
-  // for "likely recent". After that, the list is ordered by what each
-  // session recorded: a backup restore can make an old session the
-  // newest directory on disk, and that must not hide the one that ran last.
-  withMtime.sort((a, b) => b.mtime - a.mtime);
-  const truncated = Math.max(0, withMtime.length - limit);
-  const chosen = withMtime.slice(0, limit);
-
-  const sessions: ListedSession[] = [];
-  for (const d of chosen) {
-    sessions.push(await readListed(d.id, d.path));
-  }
-  sessions.sort(byRecordedTime);
-  return { sessions, truncated };
-}
-
-export type SessionPrefixMatch =
-  | { ok: true; session: Extract<ListedSession, { ok: true }> }
-  | { ok: false; reason: string; candidates: string[] };
-
-/**
- * Unique prefix or exact path only. Two matches is a list, never catalog
- * order -- the same rule as findModelByPattern. Guessing here would open
- * someone else's session because ids share a timestamp prefix.
- */
-export async function findSessionByPrefix(
-  workspace: string,
-  prefix: string,
-  sessionDir?: string,
-): Promise<SessionPrefixMatch> {
-  const needle = prefix.trim();
-  if (needle.length === 0) {
-    return { ok: false, reason: "empty session id", candidates: [] };
-  }
-
-  const { sessions } = await listSessions(workspace, sessionDir, Infinity);
-  const ok = sessions.filter((s): s is Extract<ListedSession, { ok: true }> => s.ok);
-
-  const exactId = ok.filter((s) => s.id === needle);
-  if (exactId.length === 1) return { ok: true, session: exactId[0]! };
-
-  const exactPath = ok.filter((s) => s.path === needle);
-  if (exactPath.length === 1) return { ok: true, session: exactPath[0]! };
-
-  const existing = await existingDir(workspace, needle);
-  if (existing !== null) {
-    const listed = ok.find((s) => s.path === existing);
-    if (listed !== undefined) return { ok: true, session: listed };
-    const read = await readListed(basename(existing), existing);
-    if (read.ok) return { ok: true, session: read };
-    return {
-      ok: true,
-      session: {
-        ok: true,
-        id: basename(existing),
-        path: existing,
-        name: null,
-        model: null,
-        node: null,
-        events: 0,
-        updated_at: null,
-      },
-    };
-  }
-
-  const hits = ok.filter((s) => s.id.startsWith(needle));
-  if (hits.length === 1) return { ok: true, session: hits[0]! };
-  if (hits.length === 0) {
-    return { ok: false, reason: `unknown session: ${needle}`, candidates: [] };
-  }
-  const ids = hits.map((s) => s.id);
-  return {
-    ok: false,
-    reason:
-      `ambiguous session id prefix ${JSON.stringify(needle)}: matches ${ids.join(", ")}. ` +
-      "Be more specific rather than guessing",
-    candidates: ids,
-  };
-}
-
-/**
- * Copy the log graph and its content-addressed observations, then open a new
- * inherit node at the chosen point. Like copying Git objects and moving a ref,
- * this keeps immutable evidence intact (D3/D8 / M.2). Flattening just the current
- * context loses earlier handoffs; flattening every event loses cut semantics.
- * Publication is atomic into an empty destination, so a partial copy cannot be
- * mistaken for a resumable session. Historical log_ref paths retain provenance;
- * readers resolve node IDs and artifact hashes inside the new session.
- */
-export async function copyAncestryTo(
-  sourceDir: string,
-  destDir: string,
-  createdAt: string,
-  untilEvent?: string,
-  position: "at" | "before" = "at",
-): Promise<void> {
-  const rel = relative(resolve(sourceDir), resolve(destDir));
-  if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel))) {
-    throw new Error("cannot copy a session into itself or its descendants");
-  }
-  await mkdir(destDir, { recursive: true });
-  if ((await readdir(destDir)).length > 0) throw new Error("cannot copy session into a nonempty destination");
-  const stage = await mkdtemp(join(dirname(destDir), ".xeno-copy-"));
-  try {
-    await cp(sourceDir, stage, { recursive: true, force: false, errorOnExist: true });
-    const recorded = await readCursor(stage);
-    const cursor = recorded === null ? null : await recoverCut(stage, recorded);
-    const tip = cursor?.node ?? 0;
-    const history = await readNodeHistory(stage, tip);
-    if (!history.ok) throw new Error(`cannot copy session: ${history.error}`);
-    const nodes = await listNodes(stage);
-    const resolved = untilEvent === undefined ? { basis: "inherit" as const, selection: await readCursorAt(stage, tip),
-      parent: { node: tip, log_ref: nodePath(destDir, tip), sha256: await digestNode(stage, tip) } }
-      : await resolveHistoryPosition(stage, untilEvent, position);
-    const { selection: historical, basis, parent } = resolved;
-    const next = Math.max(cursor?.next_node ?? 1, ...nodes.map((n) => n + 1));
-    await initNode(stage, next, parent, createdAt, basis);
-    const selection = { ...(historical ?? cursor) };
-    delete selection.at_event;
-    await writeCursor(stage, {
-      ...selection, node: next, next_node: next + 1, model: historical?.model ?? cursor?.model ?? "unknown", updated_at: createdAt,
-      ...(historical === null && parent !== null ? { needs_model_checkpoint: true } : {}),
-    });
-    await replayContext(stage, next);
-    await setParentSession(stage, resolve(sourceDir));
-    await syncCopiedTree(stage);
-    await rename(stage, destDir);
-    const directory = await open(dirname(destDir), "r");
-    try { await directory.sync(); } finally { await directory.close(); }
-  } finally { await rm(stage, { recursive: true, force: true }); }
-}
-
-async function syncCopiedTree(dir: string): Promise<void> {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    const path = join(dir, entry.name);
-    if (entry.isDirectory()) await syncCopiedTree(path);
-    else if (entry.isFile()) {
-      const file = await open(path, "r");
-      try { await file.sync(); } finally { await file.close(); }
-    } else throw new Error(`cannot copy unsupported session entry: ${path}`);
-  }
-  const directory = await open(dir, "r");
-  try { await directory.sync(); } finally { await directory.close(); }
-}
-
-export interface ResolveLogOpts extends SessionEntryFlags {
-  sessionDir?: string;
-}
-
-/**
- * Picks the log directory for a process that did not pass a path, or
- * honours one that did.
- *
- * Like Pi, a new invocation starts a new session unless a resume intent
- * was explicit. --fresh remains a non-destructive alias for that default.
- * Legacy .xeno/log stays opt-in; storage layout never implies user intent.
- */
-export async function resolveLogDir(
-  workspace: string,
-  opts: ResolveLogOpts = {},
-): Promise<{ logDir: string; created: boolean }> {
-  const entry = planSessionEntry(opts);
-  switch (entry.kind) {
-    case "named": {
-      const root = sessionsDir(workspace, opts.sessionDir), logDir = join(root, entry.id);
-      await mkdir(root, { recursive: true });
-      await ignoreStateDir(dirname(root));
-      try { await mkdir(logDir); return { logDir, created: true }; }
-      catch (error) {
-        if ((error as { code?: string }).code !== "EEXIST" || !(await lstat(logDir)).isDirectory()) throw error;
-        return { logDir, created: false };
-      }
-    }
-    case "ephemeral": {
-      const logDir = await mkdtemp(join(tmpdir(), "xeno-nosession-"));
-      return { logDir, created: true };
-    }
-    case "open": {
-      if (entry.explicit) return { logDir: entry.target, created: false };
-      const archive = resolve(workspace, entry.target);
-      if (await stat(archive).then(info => info.isFile(), () => false)) {
-        return { logDir: await importSessionArchive(archive, sessionsDir(workspace, opts.sessionDir), workspace), created: true };
-      }
-      const found = await findSessionByPrefix(workspace, entry.target, opts.sessionDir);
-      if (!found.ok) throw new Error(found.reason);
-      return { logDir: found.session.path, created: false };
-    }
-    case "fork": {
-      const found = await findSessionByPrefix(workspace, entry.target, opts.sessionDir);
-      if (!found.ok) throw new Error(found.reason);
-      const created = await createSession(workspace, systemIdClock, opts.sessionDir);
-      await copyAncestryTo(found.session.path, created.path, new Date().toISOString());
-      return { logDir: created.path, created: true };
-    }
-    case "continue": {
-      const newest = await newestConversation(workspace, opts.sessionDir);
-      if (newest !== undefined) return { logDir: newest.path, created: false };
-      break;
-    }
-    case "select":
-      throw new Error("--resume needs an interactive terminal. Pass --session <id> instead");
-    case "new": break;
-    default: return assertNever(entry, "resolveLogDir");
-  }
-  const created = await createSession(workspace, systemIdClock, opts.sessionDir);
-  return { logDir: created.path, created: true };
-}
-
-async function existingDir(workspace: string, prefix: string): Promise<string | null> {
-  if (await isDirectory(prefix)) return prefix;
-  const rel = join(workspace, prefix);
-  if (rel !== prefix && (await isDirectory(rel))) return rel;
-  return null;
-}
-
-export async function readListed(id: string, path: string, details?: { workspace: string; signal?: AbortSignal }): Promise<ListedSession> {
-  let parsed: unknown;
-  try {
-    parsed = await readManifest(path);
-  } catch (err) {
-    if ((err as { code?: string }).code === "ENOENT") {
-      return {
-        ok: true, id, path,
-        name: null, model: null, node: null, events: 0, updated_at: null,
-        ...(details ? { workspace: details.workspace, conversation: await hasConversation(path) } : {}),
-      };
-    }
-    return { ok: false, id, path, error: `${path} could not be read: ${(err as Error).message}` };
-  }
-
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { ok: false, id, path, error: `${path} manifest is not an object` };
-  }
-
-  const manifest = parsed as Manifest;
-  const cursor = manifest.cursor;
-  if (cursor === undefined) {
-    return {
-      ok: true, id, path,
-      name: null, model: null, node: null, events: 0, updated_at: null,
-      ...(details ? { workspace: details.workspace, conversation: await hasConversation(path) } : {}),
-    };
-  }
-
-  // The open node's size, not an ancestry walk. Walking can fail the whole
-  // listing (a cycle, a missing parent), and a list that throws for one
-  // bad tree is the same shape as a list that throws for one bad file.
-  const events = (await readNode(path, cursor.node)).events.length;
-  const text: string[] = [];
-  let conversation = false;
-  if (details) for (const node of await listNodes(path)) {
-    if (details.signal?.aborted) break;
-    const read = await readNode(path, node);
-    if (read.corrupt.length) throw new Error(`${path} has corrupt events`);
-    for (const event of read.events) {
-      if (userActivity(event)) conversation = true;
-      if (event.t === "user") text.push(event.text);
-      else if (event.t === "assistant") for (const block of event.blocks) if (block.type === "text") text.push(block.text);
-    }
-  }
-  const forked = details ? await forkedAt(path) : null;
-  return {
-    ok: true,
-    id,
-    path,
-    name: cursor.name ?? null,
-    model: cursor.model,
-    node: cursor.node,
-    events,
-    updated_at: cursor.updated_at,
-    ...(details ? { workspace: cursor.workspace ?? details.workspace, text: text.join("\n"), conversation,
-      ...(manifest.parent_session ? { parent_session: manifest.parent_session } : {}),
-      ...(forked === null ? {} : { forked_at: forked }) } : {}),
-  };
-}
-
-/**
- * A session the user opened and left without a word still has a header,
- * cursor and manifest: Session.start writes them before the first message.
- * Pi avoids such files by not persisting until a message exists; xeno keeps
- * its write order and filters on read instead, like Codex's resume picker,
- * so -c and the pickers land on a conversation (fix-skip-empty-sessions).
- * A shell command the user ran counts: it is their activity, not setup.
- */
-function userActivity(event: LogEvent): boolean {
-  return event.t === "user" || event.t === "user_bash";
-}
-
-/**
- * Stops at the first node holding user activity, so a real session costs one
- * node read. An unreadable node counts as activity: hiding a session we
- * cannot judge would silently skip it, while opening it reports the error.
- */
-export async function hasConversation(path: string): Promise<boolean> {
-  for (const node of await listNodes(path)) {
-    try { if ((await readNode(path, node)).events.some(userActivity)) return true; }
-    catch { return true; }
-  }
-  return false;
-}
-
-/** What -c continues: the newest readable session the user actually spoke in. */
-export async function newestConversation(workspace: string, sessionDir?: string): Promise<Extract<ListedSession, { ok: true }> | undefined> {
-  const { sessions } = await listSessions(workspace, sessionDir, Infinity);
-  for (const session of sessions) if (session.ok && await hasConversation(session.path)) return session;
-  return undefined;
-}
-
-function byRecordedTime(a: ListedSession, b: ListedSession): number {
-  const ta = a.ok ? a.updated_at : null;
-  const tb = b.ok ? b.updated_at : null;
-  if (ta !== null && tb !== null) return tb < ta ? -1 : tb > ta ? 1 : 0;
-  if (ta !== null) return -1;
-  if (tb !== null) return 1;
-  return 0;
-}
-
-async function isDirectory(path: string): Promise<boolean> {
-  try {
-    return (await stat(path)).isDirectory();
-  } catch (err) {
-    if ((err as { code?: string }).code === "ENOENT") return false;
-    throw err;
-  }
-}
-
-/**
- * Keeps a state directory out of `git status` the way pytest, ruff and mypy
- * keep their caches out: a `.gitignore` holding `*` inside the directory
- * itself. Checks people and models write ("only plan.md changed") read git,
- * and a visible session directory made such a check fail forever
- * (fix-state-dir-self-ignore). The user's own ignore files are never edited,
- * and .git/info/exclude is avoided: worktrees do not read it, and a sandboxed
- * agent could use it to hide files. An existing file is left alone; failure
- * to write one never blocks a session.
- */
-export async function ignoreStateDir(stateRoot: string): Promise<void> {
-  try {
-    await mkdir(stateRoot, { recursive: true });
-    await writeFile(join(stateRoot, ".gitignore"), "# Created by xeno: session state is not project source.\n*\n", { flag: "wx" });
-  } catch { /* present already, or not writable: either way nothing to do */ }
-}

package/src/store/source-cancellation.ts

@@ -1,6 +0,0 @@
-/** D11: cancelled source capture never becomes a partial successful observation. */
-import { ToolFault, READ_ATTEMPTED } from "../core/tool-failure.ts";
-
-export function checkSourceCancellation(signal?: AbortSignal): void {
-  if (signal?.aborted) throw new ToolFault("cancelled", "source capture cancelled", READ_ATTEMPTED);
-}

package/src/store/tool-binaries.ts

@@ -1,90 +0,0 @@
-/**
- * xeno's own copy of ripgrep, for machines that have none.
- *
- * Where it lives: `<configDir>/bin`, next to settings and auth, so one
- * install serves every workspace. Who sees it: the grep tool (after PATH)
- * and shell commands, whose PATH gets the directory appended -- appended so a
- * user who later installs rg keeps theirs (core/command-contract.ts).
- *
- * The network fetch is injected: store owns the filesystem, the caller owns
- * the request (as runtime/update-check.ts does for the registry).
- */
-import { existsSync } from "node:fs";
-import { chmod, lstat, mkdir, mkdtemp, rename, rm, writeFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { join } from "node:path";
-import { ripgrepAsset, type RipgrepAsset } from "../core/ripgrep-release.ts";
-
-export function xenoBinDir(configDir: string): string {
-  return join(configDir, "bin");
-}
-
-function onPath(name: string, pathEnv: string): string | null {
-  for (const dir of pathEnv.split(process.platform === "win32" ? ";" : ":")) {
-    if (dir.length === 0) continue;
-    const candidate = join(dir, name);
-    if (existsSync(candidate)) return candidate;
-  }
-  return null;
-}
-
-/** The user's rg first, then xeno's; null when neither exists. */
-export function findRipgrep(configDir: string, pathEnv = process.env["PATH"] ?? ""): string | null {
-  const own = join(xenoBinDir(configDir), "rg");
-  return onPath("rg", pathEnv) ?? (existsSync(own) ? own : null);
-}
-
-export type ProvisionResult =
-  | { ok: true; path: string; installed: boolean }
-  | { ok: false; error: string };
-
-export interface ProvisionOptions {
-  configDir: string;
-  fetchBytes: (url: string, signal?: AbortSignal) => Promise<Uint8Array>;
-  /** Defaults to the user's PATH; injected so tests are not decided by the machine. */
-  path?: string;
-  /** Defaults to the pinned build for this platform. */
-  asset?: RipgrepAsset | null;
-  signal?: AbortSignal;
-}
-
-/**
- * Installs the pinned ripgrep unless one is already reachable.
- *
- * Nothing becomes visible until it is proven: the archive is hashed before
- * extraction, only the one member is extracted, and the executable reaches
- * `bin/rg` by rename, so a crash or a mismatch never leaves a partial or
- * unverified binary where the shell would find it.
- */
-export async function provisionRipgrep(options: ProvisionOptions): Promise<ProvisionResult> {
-  const existing = findRipgrep(options.configDir, options.path);
-  if (existing !== null) return { ok: true, path: existing, installed: false };
-  const asset = options.asset === undefined ? ripgrepAsset(process.platform, process.arch) : options.asset;
-  if (asset === null) return { ok: false, error: `no pinned ripgrep build for ${process.platform} ${process.arch}` };
-
-  const bin = xenoBinDir(options.configDir);
-  await mkdir(bin, { recursive: true });
-  // Inside bin, so the final rename stays on one filesystem and is atomic.
-  const stage = await mkdtemp(join(bin, ".rg-install-"));
-  try {
-    const bytes = await options.fetchBytes(asset.url, options.signal);
-    const digest = createHash("sha256").update(bytes).digest("hex");
-    if (digest !== asset.sha256) return { ok: false, error: `ripgrep archive sha256 ${digest} does not match pinned ${asset.sha256}` };
-    const archive = join(stage, "rg.tar.gz");
-    await writeFile(archive, bytes);
-    const extracted = Bun.spawnSync(["tar", "-xzf", archive, "-C", stage, asset.member], { stdout: "ignore", stderr: "pipe" });
-    if (extracted.exitCode !== 0) return { ok: false, error: `cannot extract ripgrep: ${extracted.stderr.toString().trim()}` };
-    const executable = join(stage, asset.member);
-    // The digest pins the archive, but chmod and rename follow what tar
-    // wrote; a member that is not a plain file is refused before either.
-    if (!(await lstat(executable)).isFile()) return { ok: false, error: "ripgrep archive member is not a regular file" };
-    await chmod(executable, 0o755);
-    const target = join(bin, "rg");
-    await rename(executable, target);
-    return { ok: true, path: target, installed: true };
-  } catch (error) {
-    return { ok: false, error: `cannot install ripgrep: ${error instanceof Error ? error.message : String(error)}` };
-  } finally {
-    await rm(stage, { recursive: true, force: true });
-  }
-}