@visual-z/xeno 0.8.4 → 0.9.0

package/src/store/file-checkpoints.ts

@@ -1,108 +0,0 @@
-/** P.3: bounded path operations with durable before-images and conflict checks. */
-import { lstat, readFile, mkdir, open, rename, rm } from "node:fs/promises";
-import { resolve, relative, dirname, join, sep } from "node:path";
-import { randomUUID } from "node:crypto";
-import { blobAddress, putBlob, getBlobBytes, verifyBlob } from "./blobs.ts";
-import { sameVersion, changedPaths, type FileVersion, type FileChanges } from "../core/checkpoints.ts";
-import { ToolFault, NOT_STARTED, READ_ATTEMPTED, STATE_PATH_GUIDANCE, failureFromError } from "../core/tool-failure.ts";
-
-export async function editablePath(root: string, path: string): Promise<string> {
-  const base = resolve(root), absolute = resolve(base, path), rel = relative(base, absolute);
-  if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || resolve(rel) === rel) throw new ToolFault("permission_denied", `unsafe file checkpoint path: ${path}`, NOT_STARTED);
-  // Session logs and blobs are the evidence; an edit there could rewrite it.
-  if (rel.split(sep).some(part => part === ".git" || part === ".xeno")) {
-    throw new ToolFault("permission_denied", `${path} is inside .git or .xeno, which edit tools never change; this is not a permission problem and no approval will allow it`, NOT_STARTED, { next: STATE_PATH_GUIDANCE });
-  }
-  let current = base;
-  for (const part of rel.split(sep)) {
-    current = join(current, part);
-    try {
-      const info = await lstat(current);
-      if (info.isSymbolicLink() || current !== absolute && !info.isDirectory() || current === absolute && (!info.isFile() || info.nlink > 1))
-        throw new ToolFault("permission_denied", `unsupported file checkpoint path: ${path}`, NOT_STARTED);
-    } catch (error) { if ((error as { code?: string }).code !== "ENOENT") throw error; }
-  }
-  return absolute;
-}
-
-export async function readEditableFile(root: string, path: string): Promise<{ bytes: Uint8Array | null; version: FileVersion }> {
-  const absolute = await editablePath(root, path);
-  try {
-    const info = await lstat(absolute);
-    const bytes = await readFile(absolute);
-    return { bytes, version: { sha256: blobAddress(bytes), mode: info.mode & 0o777 } };
-  } catch (error) {
-    if ((error as { code?: string }).code === "ENOENT") return { bytes: null, version: null };
-    const diagnostic = failureFromError(error, READ_ATTEMPTED);
-    throw new ToolFault(diagnostic.code, diagnostic.message, READ_ATTEMPTED);
-  }
-}
-
-/** The prepared record is durable before rename; cancellation and conflicts leave bytes untouched. */
-export async function replaceFile(root: string, path: string, expected: FileVersion, bytes: Uint8Array | null,
-  mode: number, signal?: AbortSignal): Promise<void> {
-  const absolute = await editablePath(root, path);
-  if (signal?.aborted) throw new ToolFault("cancelled", "file operation cancelled", NOT_STARTED);
-  if (!sameVersion((await readEditableFile(root, path)).version, expected)) throw new ToolFault("version_mismatch", `file conflict: ${path}; read it again before editing`, READ_ATTEMPTED, { recover: { tool: "read", input: { path } } });
-  if (bytes === null) {
-    if (expected === null) return;
-    await rm(absolute);
-    const directory = await open(dirname(absolute), "r");
-    try { await directory.sync(); } finally { await directory.close(); }
-    return;
-  }
-  await mkdir(dirname(absolute), { recursive: true });
-  const temporary = join(dirname(absolute), `.xeno-edit-${randomUUID()}`);
-  try {
-    const file = await open(temporary, "wx", mode);
-    try { await file.writeFile(bytes); await file.chmod(mode); await file.sync(); } finally { await file.close(); }
-    await editablePath(root, path);
-    if (signal?.aborted) throw new ToolFault("cancelled", "file operation cancelled", READ_ATTEMPTED);
-    if (!sameVersion((await readEditableFile(root, path)).version, expected)) throw new ToolFault("version_mismatch", `file conflict: ${path}; read it again before editing`, READ_ATTEMPTED, { recover: { tool: "read", input: { path } } });
-    await rename(temporary, absolute);
-    const directory = await open(dirname(absolute), "r");
-    try { await directory.sync(); } finally { await directory.close(); }
-  } finally { await rm(temporary, { force: true }); }
-}
-
-export async function archiveEdit(blobs: string, before: Uint8Array | null, after: Uint8Array): Promise<void> {
-  if (before !== null) await putBlob(blobs, before);
-  await putBlob(blobs, after);
-}
-
-export async function preflightChanges(root: string, blobs: string, changes: FileChanges, signal?: AbortSignal): Promise<void> {
-  for (const path of changedPaths(changes)) {
-    if (signal?.aborted) throw new ToolFault("cancelled", "file operation cancelled", NOT_STARTED);
-    const change = changes[path]!;
-    if (!sameVersion((await readEditableFile(root, path)).version, change.before)) throw new Error(`file conflict: ${path}; external changes were preserved`);
-    if (change.after && !await verifyBlob(blobs, change.after.sha256)) throw new Error(`missing checkpoint object: ${path}`);
-    if (change.before && !await verifyBlob(blobs, change.before.sha256)) throw new Error(`missing recovery object: ${path}`);
-  }
-}
-
-/** Preflight the complete plan, then compensate partial writes if an individual replacement fails. */
-export async function applyFileChanges(root: string, blobs: string, changes: FileChanges, signal?: AbortSignal): Promise<void> {
-  await preflightChanges(root, blobs, changes, signal);
-  const applied: string[] = [];
-  try {
-    for (const path of changedPaths(changes)) {
-      const { before, after } = changes[path]!;
-      const bytes = after === null ? null : await getBlobBytes(blobs, after.sha256);
-      if (after && bytes === null) throw new Error(`missing checkpoint object: ${path}`);
-      await replaceFile(root, path, before, bytes, after?.mode ?? 0o644, signal);
-      applied.push(path);
-    }
-  } catch (error) {
-    const failures: string[] = [];
-    for (const path of applied.reverse()) {
-      const { before, after } = changes[path]!;
-      try {
-        const bytes = before === null ? null : await getBlobBytes(blobs, before.sha256);
-        if (before && bytes === null) throw new Error("missing recovery object");
-        await replaceFile(root, path, after, bytes, before?.mode ?? 0o644);
-      } catch { failures.push(path); }
-    }
-    if (failures.length) throw new Error(`restore interrupted; inspect partially applied paths: ${failures.join(", ")}; ${String(error)}`);
-    throw error;
-  }
-}

package/src/store/file-index.ts

@@ -1,174 +0,0 @@
-/**
- * Candidate paths for @-file expansion and the walk search engine.
- *
- * A glob on every keystroke is a stall in a large repo (the card's rejected
- * alternative). Scan once, cache for the session. The snapshot scanner is a
- * different job -- it hashes contents and refuses to truncate -- so this walk
- * is its own function rather than a mode flag on scanWorkspace.
- *
- * Inside a Git work tree the candidates are Git's own listing: tracked plus
- * untracked files that are not ignored (S.6 item 4). Claude Code's Grep,
- * OpenCode (`rg --files`) and Pi (`fd`) follow .gitignore the same way; a
- * walk that ignores it let an ignored worktree's build output fill the whole
- * budget before the product's directories were reached
- * (research-file-index-truncation).
- */
-
-import { lstat, readdir } from "node:fs/promises";
-import type { Dirent } from "node:fs";
-import { dirname, join, relative, sep } from "node:path";
-import { DEFAULT_IGNORE } from "./workspace.ts";
-import { gitBytes } from "./workspace-observation.ts";
-
-/**
- * Cap on paths from an unfiltered directory walk, outside Git. Assumed, not
- * measured: enough to fuzzy-search a large tree; past this the walk is hiding
- * a missing filter, not serving one. Hitting it truncates and says so -- a
- * silent cut would make @ miss files that exist. A Git listing is already the
- * filtered candidate set and is not capped unless the caller asks.
- */
-export const MAX_INDEX_ENTRIES = 20_000;
-
-export interface FileIndex {
-  readonly paths: readonly string[];
-  readonly truncated: boolean;
-  readonly issues?: readonly { code: string; path?: string }[];
-}
-
-export interface IndexOptions {
-  readonly ignore?: readonly string[];
-  readonly maxEntries?: number;
-  readonly deadline?: number;
-  readonly signal?: AbortSignal;
-}
-
-function isIgnored(rel: string, ignore: readonly string[]): boolean {
-  const parts = rel.split(sep);
-  return ignore.some((i) => parts.includes(i));
-}
-
-/** Git judges its own ignore rules; an error or a path outside any work tree is not ignored. */
-export async function gitIgnored(path: string, signal?: AbortSignal): Promise<boolean> {
-  try {
-    const info = await lstat(path);
-    await gitBytes(info.isDirectory() ? path : dirname(path), ["check-ignore", "-q", "--", path], undefined, signal);
-    return true;
-  } catch { return false; }
-}
-
-/** Git's listing under `dir`, relative to it, or null when `dir` is not a work tree that Git lists. */
-async function gitListing(dir: string, signal?: AbortSignal): Promise<string[] | null> {
-  try {
-    if (new TextDecoder().decode(await gitBytes(dir, ["rev-parse", "--is-inside-work-tree"], undefined, signal)).trim() !== "true") return null;
-    // Naming an ignored directory is an explicit request: walk it instead.
-    if (await gitIgnored(dir, signal)) return null;
-    const listed = new TextDecoder().decode(await gitBytes(dir, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], undefined, signal));
-    // An untracked nested repository is listed once, as "name/".
-    return [...new Set(listed.split("\0").filter(Boolean).map(path => path.replace(/\/$/, "")))].sort();
-  } catch { return null; }
-}
-
-/** Assumed: enough concurrent lstat calls to hide latency without exhausting descriptors. */
-const LSTAT_BATCH = 256;
-
-async function indexGitListing(root: string, listed: readonly string[], opts: IndexOptions): Promise<FileIndex> {
-  const ignore = opts.ignore ?? DEFAULT_IGNORE;
-  const max = opts.maxEntries ?? Infinity;
-  const paths: string[] = [], issues: { code: string; path?: string }[] = [];
-  // The index can name a path under a directory since replaced by a symlink;
-  // following it would read outside the tree, so every ancestor is checked once.
-  const directories = new Map<string, Promise<boolean>>([["", Promise.resolve(true)]]);
-  const plainDirectory = (rel: string): Promise<boolean> => {
-    let known = directories.get(rel);
-    if (known === undefined) {
-      const parent = rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : "";
-      known = plainDirectory(parent).then(async ok => ok && await lstat(join(root, rel)).then(info => info.isDirectory() && !info.isSymbolicLink(), () => false));
-      directories.set(rel, known);
-    }
-    return known;
-  };
-  for (let offset = 0; offset < listed.length; offset += LSTAT_BATCH) {
-    if (opts.signal?.aborted || opts.deadline !== undefined && performance.now() >= opts.deadline) {
-      issues.push({ code: opts.signal?.aborted ? "cancelled" : "timeout" }); return { paths, truncated: true, issues };
-    }
-    const batch = listed.slice(offset, offset + LSTAT_BATCH).filter(rel => !isIgnored(rel.split("/").join(sep), ignore));
-    const kinds = await Promise.all(batch.map(async rel => {
-      const parent = rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : "";
-      if (!await plainDirectory(parent)) return "skip";
-      // A tracked path deleted from the work tree is not a candidate.
-      const info = await lstat(join(root, rel)).catch(() => null);
-      return info === null || info.isSymbolicLink() ? "skip" : info.isDirectory() ? "nested" : info.isFile() ? "file" : "skip";
-    }));
-    for (let i = 0; i < batch.length; i++) {
-      const rel = batch[i]!;
-      if (kinds[i] === "nested") {
-        // A submodule or nested repository: its own listing, or a walk if it has none.
-        const nested = await buildFileIndex(join(root, rel), { ...opts, ...(max === Infinity ? {} : { maxEntries: max - paths.length }) });
-        paths.push(...nested.paths.map(path => `${rel}/${path}`));
-        issues.push(...(nested.issues ?? []).map(issue => issue.path === undefined ? issue : { ...issue, path: `${rel}/${issue.path}` }));
-        if (nested.truncated) return { paths, truncated: true, issues };
-        continue;
-      }
-      if (kinds[i] !== "file") continue;
-      if (paths.length >= max) { issues.push({ code: "file_index_limit" }); return { paths, truncated: true, issues }; }
-      paths.push(rel);
-    }
-  }
-  return { paths, truncated: false, ...(issues.length ? { issues } : {}) };
-}
-
-export async function buildFileIndex(root: string, opts: IndexOptions = {}): Promise<FileIndex> {
-  const listed = await gitListing(root, opts.signal);
-  if (listed !== null) return indexGitListing(root, listed, opts);
-  const ignore = opts.ignore ?? DEFAULT_IGNORE;
-  const max = opts.maxEntries ?? MAX_INDEX_ENTRIES;
-  const paths: string[] = [];
-  let truncated = false;
-  const issues: { code: string; path?: string }[] = [];
-
-  async function walk(dir: string): Promise<void> {
-    if (truncated) return;
-    if (opts.signal?.aborted || opts.deadline !== undefined && performance.now() >= opts.deadline) {
-      truncated = true; issues.push({ code: opts.signal?.aborted ? "cancelled" : "timeout" }); return;
-    }
-    let entries: Dirent[];
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      issues.push({ code: "unreadable_directory", path: relative(root, dir) || "." });
-      return;
-    }
-    for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
-      if (truncated) return;
-      if (opts.signal?.aborted || opts.deadline !== undefined && performance.now() >= opts.deadline) {
-        truncated = true; issues.push({ code: opts.signal?.aborted ? "cancelled" : "timeout" }); return;
-      }
-      // Do not follow symlinks: a link to / walks the disk, and
-      // node_modules/.bin is nothing but links. Same judgment as
-      // feat-workspace-snapshots, which also skips them via isFile().
-      if (entry.isSymbolicLink()) continue;
-      const abs = join(dir, entry.name);
-      const rel = relative(root, abs);
-      if (isIgnored(rel, ignore)) continue;
-      if (entry.isDirectory()) {
-        await walk(abs);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      if (paths.length >= max) {
-        truncated = true;
-        issues.push({ code: "file_index_limit" });
-        return;
-      }
-      paths.push(rel.split(sep).join("/"));
-    }
-  }
-
-  await walk(root);
-  return { paths, truncated, ...(issues.length ? { issues } : {}) };
-}
-
-export function indexTruncationNote(index: FileIndex): string | null {
-  if (!index.truncated) return null;
-  return `file index truncated at ${index.paths.length} entries; later paths are not searchable`;
-}

package/src/store/foundation-config.ts

@@ -1,24 +0,0 @@
-/** Trusted executable configuration follows the same user/project boundary as extensions. */
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-
-export async function readFoundationConfig(configDirectory: string, workspace: string, trusted: boolean): Promise<Record<string, unknown>> {
-  let value: Record<string, unknown> = {};
-  for (const path of [join(configDirectory, "foundation.json"), ...(trusted ? [join(workspace, ".xeno", "foundation.json")] : [])]) {
-    let text: string;
-    try { text = await readFile(path, "utf8"); }
-    catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") continue; throw error; }
-    const parsed: unknown = JSON.parse(text);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw Error(`${path}: expected an object`);
-    const allowed = ["mcp", "webSearch", "formatters", "lsp", "permissions"];
-    if (Object.keys(parsed).some(key => !allowed.includes(key))) throw Error(`${path}: unknown foundation setting`);
-    value = { ...value, ...parsed };
-  }
-  return value;
-}
-
-export async function readOutputSchema(path: string): Promise<unknown> {
-  const text = await readFile(path, "utf8");
-  if (Buffer.byteLength(text) > 1_048_576) throw Error("output schema exceeds 1 MiB");
-  return JSON.parse(text) as unknown;
-}

package/src/store/git-checkpoints.ts

@@ -1,67 +0,0 @@
-/** P.3/OpenCode v2: retained private index, scoped capture, path-only CAS export. */
-import { mkdir, lstat } from "node:fs/promises";
-import { join } from "node:path";
-import { blobAddress, putBlob } from "./blobs.ts";
-import { gitBytes, sourceInventory } from "./workspace-observation.ts";
-import type { FileChanges, FileVersion } from "../core/checkpoints.ts";
-import { atomicWrite } from "./atomic.ts";
-
-const text = (bytes: Uint8Array) => new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-export interface GitCheckpoint { tree: string; modes: ReadonlyMap<string, number>; }
-export class GitCheckpoints {
-  readonly root: string;
-  private readonly ownedPaths: readonly string[];
-  private initialized = false;
-  readonly directory: string;
-  constructor(root: string, storage: string, ownedPaths: readonly string[] = []) {
-    this.root = root; this.directory = join(storage, "git-checkpoints", blobAddress(root)); this.ownedPaths = ownedPaths;
-  }
-  private git(args: readonly string[], input?: Uint8Array, signal?: AbortSignal) {
-    return gitBytes(this.root, ["--literal-pathspecs", "-c", "core.autocrlf=false", "-c", "core.safecrlf=false", "-c", "core.attributesFile=/dev/null", "-c", "core.hooksPath=/dev/null", "-c", "gc.auto=0", ...args], input, signal,
-      { GIT_DIR: this.directory, GIT_WORK_TREE: this.root, GIT_INDEX_FILE: join(this.directory, "index"), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_ATTR_NOSYSTEM: "1" });
-  }
-  async capture(signal?: AbortSignal): Promise<GitCheckpoint> {
-    const inventory = await sourceInventory(this.root, signal, true, this.ownedPaths);
-    if (!this.initialized) {
-      await mkdir(this.directory, { recursive: true });
-      await gitBytes(this.root, ["init", "--bare", "--quiet", this.directory], undefined, signal);
-      // Git's highest-precedence attributes keep checkpoint bytes exact, even if the project uses LFS, encoding or EOL conversion.
-      await atomicWrite(join(this.directory, "info", "attributes"), "* -text -crlf -ident -filter -working-tree-encoding -eol\n");
-      this.initialized = true;
-    }
-    // Git trees retain only the executable bit; recovery needs the observed POSIX permissions as well.
-    const modes = new Map<string, number>();
-    for (const path of inventory.paths) {
-      const info = await lstat(join(this.root, path));
-      if (!info.isFile() || info.nlink > 1) throw new Error(`unsupported Git checkpoint path: ${path}`);
-      modes.set(path, info.mode & 0o777);
-    }
-    const previous = text(await this.git(["ls-files", "-z"], undefined, signal)).split("\0").filter(Boolean);
-    const present = new Set(inventory.paths);
-    const removed = previous.filter(path => !present.has(path));
-    if (removed.length) await this.git(["update-index", "--force-remove", "-z", "--stdin"], Buffer.from(removed.join("\0") + "\0"), signal);
-    // Feeding explicit paths avoids scanning ignored descendants and preserves names with newlines or leading dashes.
-    if (inventory.paths.length) await this.git(["add", "--force", "--pathspec-from-file=-", "--pathspec-file-nul"], Buffer.from(inventory.paths.join("\0") + "\0"), signal);
-    const tree = text(await this.git(["write-tree"], undefined, signal)).trim();
-    // Durable reachability is owned by Xeno, independent of the user's Git GC/index/HEAD.
-    await this.git(["update-ref", `refs/checkpoints/${tree}`, tree], undefined, signal);
-    return { tree, modes };
-  }
-  async changes(before: GitCheckpoint, after: GitCheckpoint, blobs: string, signal?: AbortSignal): Promise<FileChanges> {
-    const paths = new Set(before.tree === after.tree ? [] : text(await this.git(["diff-tree", "--no-renames", "--name-only", "-r", "-z", before.tree, after.tree], undefined, signal)).split("\0").filter(Boolean));
-    for (const [path, mode] of before.modes) if (mode !== after.modes.get(path)) paths.add(path);
-    for (const path of after.modes.keys()) if (!before.modes.has(path)) paths.add(path);
-    const version = async (snapshot: GitCheckpoint, path: string): Promise<FileVersion> => {
-      const entry = text(await this.git(["ls-tree", "-z", snapshot.tree, "--", path], undefined, signal));
-      if (!entry) return null;
-      const match = /^(100644|100755) blob ([a-f0-9]+)\t/.exec(entry);
-      const mode = snapshot.modes.get(path);
-      if (!match || mode === undefined) throw new Error(`unsupported Git checkpoint entry: ${path}`);
-      const bytes = await this.git(["cat-file", "blob", match[2]!], undefined, signal);
-      return { sha256: await putBlob(blobs, bytes), mode };
-    };
-    const changes: FileChanges = Object.create(null) as FileChanges;
-    for (const path of paths) changes[path] = { before: await version(before, path), after: await version(after, path) };
-    return changes;
-  }
-}

package/src/store/git-status.ts

@@ -1,15 +0,0 @@
-/** Local Git reads are asynchronous and bounded; a paint never launches a process. */
-import { execFile } from "node:child_process";
-import { parseGitStatus, type GitStatus } from "../core/git-status.ts";
-/** Assumed cold-disk allowance; Git failure remains unavailable rather than "clean". */
-const GIT_STATUS_TIMEOUT_MS = 1000;
-/** A busy repository cannot flood memory or the status view with paths. */
-const GIT_STATUS_MAX_BYTES = 1024 * 1024;
-
-export function readGitStatus(cwd: string): Promise<GitStatus | null> {
-  return new Promise(resolve => {
-    execFile("git", ["--no-optional-locks", "status", "--porcelain=v2", "--branch", "-z", "--untracked-files=normal"],
-      { cwd, timeout: GIT_STATUS_TIMEOUT_MS, maxBuffer: GIT_STATUS_MAX_BYTES, encoding: "utf8" },
-      (error, output) => resolve(error ? null : parseGitStatus(output)));
-  });
-}

package/src/store/history-search.ts

@@ -1,19 +0,0 @@
-/** Search immutable observation bodies without loading large command output into RAM. */
-import { createReadStream } from "node:fs";
-import { blobFilePath, verifyBlob } from "./blobs.ts";
-
-export async function observationContains(dir: string, sha256: string, terms: readonly string[]): Promise<boolean> {
-  if (!await verifyBlob(dir, sha256)) throw new Error(`missing or corrupt observation ${sha256}`);
-  const remaining = new Set(terms);
-  const overlap = Math.max(0, ...terms.map((term) => term.length - 1));
-  const decoder = new TextDecoder();
-  let tail = "";
-  for await (const chunk of createReadStream(blobFilePath(dir, sha256))) {
-    const text = tail + decoder.decode(chunk as Uint8Array, { stream: true }).toLowerCase();
-    for (const term of remaining) if (text.includes(term)) remaining.delete(term);
-    if (remaining.size === 0) return true;
-    tail = overlap > 0 ? text.slice(-overlap) : "";
-  }
-  const last = tail + decoder.decode().toLowerCase();
-  return [...remaining].every((term) => last.includes(term));
-}