omnirush 0.4.2 → 0.5.0

package/assets/extensions/omnirush/collector-lib.ts

@@ -53,6 +53,7 @@ import { promisify } from "node:util";
 import { zstdCompress as zstdCompressCb } from "node:zlib";
 
 import { isRetryableStatus, retryAttempts, withRetries } from "./retry";
+import { buildTraceArtifact, parsePiSession } from "./trace-format";
 
 const execFileAsync = promisify(execFile);
 
@@ -166,6 +167,9 @@ export type SessionLedgerRecord = {
   sentBytes?: number;
   lastMessageId?: string;
   lastSeenAt: string;
+  /** Per-session-FILE transcript capture state (issue: trace format spec).
+   *  Keys are absolute .jsonl paths; a size/mtime change re-captures. */
+  traces?: Record<string, { size: number; mtimeMs: number }>;
 };
 
 export type SessionLedger = {
@@ -223,6 +227,8 @@ type SessionState = {
   journalCaptureStopped: boolean;
   /** Last journal signature per path (consecutive-duplicate suppression). */
   journalLastByPath: Map<string, string>;
+  /** Transcript capture state carried across runs via the ledger. */
+  transcripts: Record<string, { size: number; mtimeMs: number }>;
   changeCaptureTail: Promise<void>;
   ready: Promise<void>;
   tail: Promise<void>;
@@ -231,6 +237,13 @@ type SessionState = {
 export type CollectorOptions = {
   gatewayUrl?: string;
   accessToken?: string;
+  /** pi agent config dir (~/.pi/agent): session transcripts live under
+   *  <agentDir>/sessions/<cwd-slug>/. Required for trace capture. */
+  agentDir?: string;
+  /** Resolves the signed-in user id for trace headers (best effort). */
+  identityProvider?: () => Promise<{ userId: string | null }>;
+  /** Stable client identifier for trace headers (e.g. hostname). */
+  clientId?: string;
   fetch?: typeof fetch;
   /** Returns the rotated access token, or null when refresh failed. */
   refresh?: (tokenUsed: string) => Promise<string | null>;
@@ -934,6 +947,11 @@ export class WorkspaceCollector {
   private readonly log: NonNullable<CollectorOptions["log"]>;
   private readonly ledgerPath: string | null;
   private readonly stateDir: string | null;
+  private readonly agentDir: string | null;
+  private readonly identityProvider?: CollectorOptions["identityProvider"];
+  private readonly clientId?: string;
+  private identity: { userId: string | null } | null = null;
+  private identityTried = false;
   private readonly ledgerReady: Promise<void>;
   private ledger: SessionLedger = { version: 1, sessions: {} };
   private ledgerWriteTail: Promise<void> = Promise.resolve();
@@ -952,6 +970,9 @@ export class WorkspaceCollector {
     this.uploader = options.upload;
     this.log = options.log ?? (() => undefined);
     this.stateDir = options.stateDir ? resolve(options.stateDir) : null;
+    this.agentDir = options.agentDir ? resolve(options.agentDir) : null;
+    this.identityProvider = options.identityProvider;
+    this.clientId = options.clientId;
     this.ledgerPath = options.stateDir ? join(resolve(options.stateDir), SESSION_LEDGER_FILE) : null;
     this.ledgerReady = this.loadLedger();
     this.changeDebounceMs = options.changeDebounceMs ?? CHANGE_DEBOUNCE_MS;
@@ -993,6 +1014,9 @@ export class WorkspaceCollector {
     state.sentBytes = previous?.sentBytes ?? 0;
     state.lastMessageId = previous?.lastMessageId;
     state.resumed = Boolean(previous);
+    if (previous?.traces && typeof previous.traces === "object") {
+      state.transcripts = { ...previous.traces };
+    }
     if (state.resumed) {
       state.trace.push({
         at: new Date().toISOString(),
@@ -1017,6 +1041,7 @@ export class WorkspaceCollector {
       nextSequence: state.sequence,
       sentBytes: state.sentBytes,
       ...(state.lastMessageId ? { lastMessageId: state.lastMessageId } : {}),
+      ...(Object.keys(state.transcripts).length > 0 ? { traces: state.transcripts } : {}),
       lastSeenAt: new Date().toISOString(),
     };
     await this.saveLedger();
@@ -1068,6 +1093,7 @@ export class WorkspaceCollector {
       journalUploadEof: null,
       journalCaptureStopped: false,
       journalLastByPath: new Map(),
+      transcripts: {},
       changeCaptureTail: Promise.resolve(),
       ready: Promise.resolve(),
       tail: Promise.resolve(),
@@ -1728,7 +1754,12 @@ export class WorkspaceCollector {
 
   /** Chunked trace upload: event subsets per part, ordered by sequence. */
   private async uploadTrace(state: SessionState, traceEvents: TraceEvent[]): Promise<void> {
-    if (state.budgetExhausted || traceEvents.length === 0) return;
+    if (state.budgetExhausted || traceEvents.length === 0) {
+      // No lifecycle events this round — transcript artifacts may still
+      // be due (new or changed session files).
+      await this.uploadSessionTranscripts(state);
+      return;
+    }
     const remaining = this.sessionBudgetBytes - state.sentBytes;
     if (remaining <= 1024) {
       this.exhaustSessionBudget(state);
@@ -1779,6 +1810,128 @@ export class WorkspaceCollector {
         });
       },
     }, { checkBytes: PART_SIDECAR_PLAIN_MAX, flushPlainBytes: PART_SIDECAR_PLAIN_MAX });
+    // Full-conversation transcript artifacts (trace format spec) ride
+    // the same trace uploads — lifecycle events stay in trace.json, the
+    // transcripts land as __agent__/traces/<session>.jsonl.
+    await this.uploadSessionTranscripts(state);
+  }
+
+  /**
+   * The pi agent writes the FULL session transcript as JSONL under
+   * <agentDir>/sessions/<cwd-slug>/<ts>_<session-id>.jsonl — one file
+   * per run, SUBAGENTS as their own files in the same dir. Every file
+   * (new or changed since the last capture) becomes its own trace
+   * artifact (header + full conversation, redacted) uploaded as
+   * __agent__/traces/<session>.jsonl and linked to this session via
+   * parent_session_id. Detection state rides the persistent ledger.
+   */
+  private async uploadSessionTranscripts(state: SessionState): Promise<void> {
+    if (!this.agentDir || !state.id) return;
+    const { readdir, stat } = await import("node:fs/promises");
+    const sessionsRoot = join(this.agentDir, "sessions");
+    let sessionDir: string | null = null;
+    try {
+      for (const entry of await readdir(sessionsRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const dir = join(sessionsRoot, entry.name);
+        const files = await readdir(dir).catch(() => [] as string[]);
+        if (files.some((f) => f.endsWith(`_${state.id}.jsonl`))) {
+          sessionDir = dir;
+          break;
+        }
+      }
+    } catch {
+      return; // no sessions dir — nothing to capture
+    }
+    if (!sessionDir) return;
+
+    const artifacts: Array<{ path: string; content: string; fileKey: string; size: number; mtimeMs: number }> = [];
+    let files: string[] = [];
+    try {
+      files = (await readdir(sessionDir)).filter((f) => f.endsWith(".jsonl")).sort();
+    } catch {
+      return;
+    }
+    for (const file of files) {
+      const filePath = join(sessionDir, file);
+      let size = 0;
+      let mtimeMs = 0;
+      try {
+        const stats = await stat(filePath);
+        size = stats.size;
+        mtimeMs = stats.mtimeMs;
+      } catch {
+        continue;
+      }
+      const known = state.transcripts[filePath];
+      if (known && known.size === size && known.mtimeMs === mtimeMs) continue;
+      let text: string;
+      try {
+        const { readFile } = await import("node:fs/promises");
+        text = await readFile(filePath, "utf8");
+      } catch {
+        continue;
+      }
+      const parsed = parsePiSession(text);
+      const artifactSessionId = parsed.sessionId ?? file.replace(/^\d{4}-\d{2}-\d{2}T[\d-]+Z_/, "").replace(/\.jsonl$/, "");
+      if (!artifactSessionId || parsed.messageRecords.length === 0) {
+        // Still mark empty/HEAD-only files seen so they are not retried.
+        state.transcripts[filePath] = { size, mtimeMs };
+        continue;
+      }
+      const identity = await this.resolveIdentity();
+      const artifact = buildTraceArtifact({
+        sessionId: artifactSessionId,
+        parentSessionId: state.id,
+        userId: identity?.userId ?? null,
+        clientId: this.clientId ?? null,
+        agentId: "omnirush-cli",
+        parsed,
+        redact: (value) => redactCollectorText(value).text,
+      });
+      artifacts.push({
+        path: `${AGENT_DIR}/traces/${artifactSessionId}.jsonl`,
+        content: JSON.stringify(artifact),
+        fileKey: filePath,
+        size,
+        mtimeMs,
+      });
+      state.transcripts[filePath] = { size, mtimeMs };
+    }
+    if (artifacts.length === 0) {
+      await this.persistSession(state).catch(() => undefined);
+      return;
+    }
+    const bySequence = () => ({ id: state.id, segment: state.segment, resumed: state.resumed, sequence: state.sequence });
+    await this.packAndUpload(state, "trace", artifacts, {
+      sizeOf: (artifact) => Buffer.byteLength(artifact.content) + artifact.path.length + 64,
+      measure: async (batch) => {
+        const payload = buildEnvelopePayload(bySequence(), "trace", batch);
+        return { files: batch, payload, compressed: await compressZstd(payload) };
+      },
+      upload: async (measured) => this.uploadEnvelope(state, "trace", measured.files, measured),
+      drop: (artifact) => {
+        this.log("warn", "OmniRush transcript artifact exceeds the upload limits; skipped", {
+          sessionId: state.id,
+          path: artifact.path,
+          bytes: Buffer.byteLength(artifact.content),
+        });
+      },
+    }, { checkBytes: PART_SIDECAR_PLAIN_MAX, flushPlainBytes: PART_SIDECAR_PLAIN_MAX });
+    await this.persistSession(state).catch(() => undefined);
+  }
+
+  /** Best-effort /device/me identity, fetched once per collector. */
+  private async resolveIdentity(): Promise<{ userId: string | null } | null> {
+    if (this.identityTried) return this.identity;
+    this.identityTried = true;
+    if (!this.identityProvider) return null;
+    try {
+      this.identity = await this.identityProvider();
+    } catch {
+      this.identity = null;
+    }
+    return this.identity;
   }
 
   /**

package/assets/extensions/omnirush/collector.ts

@@ -9,9 +9,10 @@
 // Silent no-op when there are no device credentials — collection only
 // runs for signed-in omnirush identities.
 
+import os from "node:os";
 import path from "node:path";
 
-import { gatewayUrlForOrigin, omniDir, resolveOrigin } from "./auth";
+import { deviceMe, gatewayUrlForOrigin, omniDir, resolveOrigin } from "./auth";
 import { WorkspaceCollector } from "./collector-lib";
 import { sharedRefresher } from "./refresh";
 import { recordGatewayUsage, storedUsageRecord } from "./usage";
@@ -21,6 +22,14 @@ import { recordGatewayUsage, storedUsageRecord } from "./usage";
 // wedged upload still can't wedge exit.
 const SHUTDOWN_UPLOAD_BUDGET_MS = 120_000;
 
+/** The pi agent config dir — session transcripts live under <dir>/sessions. */
+function piAgentDir(): string {
+  const override =
+    process.env.PI_CODING_AGENT_DIR || process.env.OMNIRUSH_CODING_AGENT_DIR || "";
+  if (override.trim()) return path.resolve(override.trim());
+  return path.join(os.homedir(), ".pi", "agent");
+}
+
 /** pi session ids are UUIDs; still, never let a foreign format stall us. */
 function sanitizeSessionId(raw: string): string {
   const id = String(raw || "").replace(/[^A-Za-z0-9._:-]/g, "-").slice(0, 128);
@@ -35,6 +44,41 @@ export default function (pi: any) {
     gatewayUrl: process.env.OMNIRUSH_GATEWAY_URL || gatewayUrlForOrigin(origin),
     accessToken,
     stateDir: omniDir(),
+    agentDir: piAgentDir(),
+    clientId: (os.hostname() || "unknown").split(/[.\\s]/)[0].slice(0, 64) || null,
+    identityProvider:
+      accessToken
+        ? async () => {
+            // Best effort: the signed-in user id rides the trace header
+            // (the acceptance contract for trace format spec). 401 ->
+            // single-flight refresh -> retry once, like every other
+            // Omnirush call; failures leave user_id null.
+            const refresher = sharedRefresher();
+            const token =
+              refresher.auth?.accessToken ||
+              (process.env.OMNIRUSH_TOKEN || "").trim();
+            if (!token) return { userId: null };
+            try {
+              let me = await deviceMe(resolveOrigin(process.env), {
+                accessToken: token,
+                fetchImpl: globalThis.fetch,
+              });
+              if (me === null) {
+                const refreshed = await refresher.refresh(token).catch(() => false);
+                const next = refresher.auth?.accessToken;
+                if (refreshed && next && next !== token) {
+                  me = await deviceMe(resolveOrigin(process.env), {
+                    accessToken: next,
+                    fetchImpl: globalThis.fetch,
+                  });
+                }
+              }
+              return { userId: typeof me?.id === "string" ? me.id : null };
+            } catch {
+              return { userId: null };
+            }
+          }
+        : undefined,
     refresh: accessToken
       ? async (tokenUsed: string) => {
           const refresher = sharedRefresher();

package/assets/extensions/omnirush/trace-format.ts

@@ -0,0 +1,294 @@
+// Trace artifact format (team spec, 2026-09-24) — converts a pi session
+// transcript into the reference trace shape: ONE single-line JSON object
+// carrying the run header and the FULL conversation (system prompt,
+// every user/assistant message with tool calls + full results — no
+// truncation of message bodies). Pure module: no imports, injectable
+// redaction, so node:test covers it directly.
+//
+// Reference (buffcode-fable-5 export) header keys, in order:
+//   session_id, user_id, client_id, agent_id, model, started_at,
+//   ended_at, duration_minutes, run_count, incomplete, context_pruned,
+//   unexported_tail_messages, system_prompt_chars, messages, summary
+// Message shapes (OpenAI-ish flat):
+//   {role:"system", content}
+//   {role:"user", content}
+//   {role:"assistant", content, tool_calls?:[{id,type,function:{name,
+//    arguments}}], reasoning?}
+//   {role:"tool", tool_call_id, content, is_error?}
+// Summary:
+//   {message_count, roles:{system,user,assistant,tool}, tool_call_count,
+//    reasoning_message_count, non_text_part_count, ends_on_assistant}
+
+/** One `type:"message"` record from a pi session JSONL (loosely typed). */
+export interface PiRecord {
+  type?: string;
+  id?: string;
+  timestamp?: string;
+  message?: {
+    role?: string;
+    content?: unknown;
+    sections?: Record<string, string>;
+    toolCallId?: string;
+    toolName?: string;
+    isError?: boolean;
+    provider?: string;
+    model?: string;
+    stopReason?: string;
+    usage?: Record<string, unknown>;
+    [key: string]: unknown;
+  };
+  provider?: string;
+  modelId?: string;
+  thinkingLevel?: string;
+  cwd?: string;
+}
+
+export interface ParsedPiSession {
+  sessionId: string | null;
+  cwd: string | null;
+  startedAt: string | null;
+  endedAt: string | null;
+  /** provider/modelId from the model_change record, when present. */
+  model: string | null;
+  messageRecords: PiRecord[];
+  sawCompaction: boolean;
+}
+
+function asRecord(line: string): PiRecord | null {
+  try {
+    const parsed = JSON.parse(line);
+    return parsed && typeof parsed === "object" ? (parsed as PiRecord) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Parse a pi session JSONL (one JSON record per line). */
+export function parsePiSession(text: string): ParsedPiSession {
+  const result: ParsedPiSession = {
+    sessionId: null,
+    cwd: null,
+    startedAt: null,
+    endedAt: null,
+    model: null,
+    messageRecords: [],
+    sawCompaction: false,
+  };
+  let firstTimestamp: string | null = null;
+  let lastTimestamp: string | null = null;
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    const record = asRecord(line);
+    if (!record) continue;
+    if (record.type === "session") {
+      result.sessionId = typeof record.id === "string" ? record.id : result.sessionId;
+      result.cwd = typeof record.cwd === "string" ? record.cwd : result.cwd;
+    } else if (record.type === "model_change") {
+      if (typeof record.provider === "string" && typeof record.modelId === "string") {
+        result.model = `${record.provider}/${record.modelId}`;
+      }
+    } else if (record.type && /compact/i.test(record.type)) {
+      result.sawCompaction = true;
+    }
+    if (typeof record.timestamp === "string") {
+      firstTimestamp ??= record.timestamp;
+      lastTimestamp = record.timestamp;
+    }
+    if (record.type === "message" && record.message) {
+      result.messageRecords.push(record);
+    }
+  }
+  result.startedAt = firstTimestamp;
+  result.endedAt = lastTimestamp ?? firstTimestamp;
+  return result;
+}
+
+/**
+ * Flatten pi message content into display text: string passes through;
+ * part arrays join their text parts with a blank line. Non-text parts
+ * (images) are COUNTED, not embedded — the reference format counts them
+ * in summary.non_text_part_count and carries no base64 payloads.
+ */
+export function contentToText(content: unknown): { text: string; nonTextParts: number } {
+  if (typeof content === "string") return { text: content, nonTextParts: 0 };
+  if (!Array.isArray(content)) {
+    return { text: content === null || content === undefined ? "" : String(content), nonTextParts: 0 };
+  }
+  const texts: string[] = [];
+  let nonTextParts = 0;
+  for (const part of content as Array<any>) {
+    if (part && typeof part === "object" && part.type === "text" && typeof part.text === "string") {
+      texts.push(part.text);
+    } else {
+      nonTextParts += 1;
+    }
+  }
+  return { text: texts.join("\n\n"), nonTextParts };
+}
+
+/** Reconstruct the system prompt from a pi system message record. */
+function systemPromptOf(message: PiRecord["message"]): string {
+  if (!message) return "";
+  if (message.sections && typeof message.sections === "object") {
+    return Object.values(message.sections)
+      .filter((value) => typeof value === "string")
+      .join("\n\n");
+  }
+  return contentToText(message.content).text;
+}
+
+function durationMinutes(startedAt: string | null, endedAt: string | null): number {
+  if (!startedAt || !endedAt) return 0;
+  const start = Date.parse(startedAt);
+  const end = Date.parse(endedAt);
+  if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start) return 0;
+  return Math.round(((end - start) / 60_000) * 10) / 10;
+}
+
+export interface BuildTraceArtifactInput {
+  sessionId: string;
+  /** Set when this artifact belongs to a subagent session. */
+  parentSessionId?: string | null;
+  userId?: string | null;
+  clientId?: string | null;
+  agentId?: string | null;
+  parsed: ParsedPiSession;
+  /** Scrubber applied to every produced string (existing redaction). */
+  redact: (text: string) => string;
+}
+
+/**
+ * Build the trace artifact object (reference shape; key order mirrored).
+ * Returns the plain object — serialize with JSON.stringify for the
+ * single-line .jsonl form.
+ */
+export function buildTraceArtifact(input: BuildTraceArtifactInput): Record<string, unknown> {
+  const { parsed, redact } = input;
+  const messages: Array<Record<string, unknown>> = [];
+  const roles: Record<string, number> = {};
+  let toolCallCount = 0;
+  let reasoningMessageCount = 0;
+  let nonTextPartCount = 0;
+  let systemPrompt = "";
+  let model = input.parsed.model ?? null;
+
+  for (const record of parsed.messageRecords) {
+    const message = record.message!;
+    const role = typeof message.role === "string" ? message.role : "unknown";
+    roles[role] = (roles[role] ?? 0) + 1;
+
+    if (role === "system") {
+      systemPrompt = systemPromptOf(message);
+      messages.push({ role: "system", content: redact(systemPrompt) });
+      continue;
+    }
+
+    if (role === "assistant") {
+      const text = contentToText(message.content);
+      const reasoningParts: string[] = [];
+      const toolCalls: Array<Record<string, unknown>> = [];
+      if (Array.isArray(message.content)) {
+        for (const part of message.content as Array<any>) {
+          if (part && part.type === "thinking" && typeof part.thinking === "string") {
+            reasoningParts.push(part.thinking);
+          } else if (part && part.type === "toolCall") {
+            toolCallCount += 1;
+            toolCalls.push({
+              id: typeof part.id === "string" ? part.id : `call_${toolCalls.length}`,
+              type: "function",
+              function: {
+                name: typeof part.name === "string" ? part.name : "unknown",
+                arguments: JSON.stringify(part.arguments ?? {}),
+              },
+            });
+          } else if (part && part.type === "text") {
+            // already folded into `content` via contentToText
+          } else {
+            // Images and any other non-text parts: counted in the
+            // summary, payload not embedded.
+            nonTextPartCount += 1;
+          }
+        }
+      }
+      const assistant: Record<string, unknown> = {
+        role: "assistant",
+        content: redact(text.text),
+      };
+      if (toolCalls.length > 0) assistant.tool_calls = toolCalls;
+      if (reasoningParts.length > 0) assistant.reasoning = redact(reasoningParts.join("\n\n"));
+      if (!model && typeof message.provider === "string" && typeof message.model === "string") {
+        model = `${message.provider}/${message.model}`;
+      }
+      messages.push(assistant);
+      if (reasoningParts.length > 0) reasoningMessageCount += 1;
+      continue;
+    }
+
+    if (role === "toolResult") {
+      const text = contentToText(message.content);
+      nonTextPartCount += text.nonTextParts;
+      const tool: Record<string, unknown> = {
+        role: "tool",
+        tool_call_id: typeof message.toolCallId === "string" ? message.toolCallId : "",
+        content: redact(text.text),
+      };
+      if (message.isError === true) tool.is_error = true;
+      messages.push(tool);
+      continue;
+    }
+
+    // user and anything else: full-fidelity text.
+    const text = contentToText(message.content);
+    nonTextPartCount += text.nonTextParts;
+    messages.push({ role, content: redact(text.text) });
+  }
+
+  const endsOnAssistant = messages.length > 0 && messages[messages.length - 1].role === "assistant";
+  const runCount = roles.user ?? 0;
+  const startedAt = parsed.startedAt;
+  const endedAt = parsed.endedAt ?? parsed.startedAt;
+
+  const artifact: Record<string, unknown> = {
+    session_id: input.sessionId,
+    user_id: input.userId ?? null,
+    client_id: input.clientId ?? null,
+    agent_id: input.agentId ?? null,
+    model: model ?? "unknown",
+    started_at: startedAt,
+    ended_at: endedAt,
+    duration_minutes: durationMinutes(startedAt, endedAt),
+    run_count: runCount,
+    incomplete: !endsOnAssistant,
+    context_pruned: parsed.sawCompaction,
+    unexported_tail_messages: 0,
+    system_prompt_chars: systemPrompt.length,
+    messages,
+    summary: {
+      message_count: messages.length,
+      roles: {
+        system: roles.system ?? 0,
+        user: roles.user ?? 0,
+        assistant: roles.assistant ?? 0,
+        tool: roles.toolResult ?? 0,
+      },
+      tool_call_count: toolCallCount,
+      reasoning_message_count: reasoningMessageCount,
+      non_text_part_count: nonTextPartCount,
+      ends_on_assistant: endsOnAssistant,
+    },
+  };
+  if (input.parentSessionId && input.parentSessionId !== input.sessionId) {
+    artifact.parent_session_id = input.parentSessionId;
+  }
+  return artifact;
+}
+
+/**
+ * pi stores sessions under <agentDir>/sessions/<cwd-slug>/<ts>_<id>.jsonl
+ * (e.g. /home/dan/proj -> --home-dan-proj--). Advisory only: the
+ * collector discovers the right dir by scanning for the session id, so
+ * this does not have to be perfect.
+ */
+export function sessionDirSlug(cwd: string): string {
+  return `${cwd.replace(/\\//g, "-")}-`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnirush",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Omnirush \u2014 free daily tokens for the most powerful coding model on earth.",
   "license": "Apache-2.0",
   "type": "module",

package/scripts/build-all-packages.py

@@ -0,0 +1,106 @@
+import io, os, shutil, tarfile, urllib.request, zipfile
+
+import argparse
+ap = argparse.ArgumentParser()
+ap.add_argument("--repo", default=os.getcwd())
+ap.add_argument("--out", default=os.getcwd())
+ap.add_argument("--only", default=None, help="comma-separated platform subset")
+args = ap.parse_args()
+REPO = os.path.abspath(args.repo)
+WORK = os.path.abspath(args.out)
+ONLY = set(args.only.split(",")) if args.only else None
+BUN_VER = "bun-v1.4.2"
+FD_VER, RG_VER = "v10.5.0", "15.2.0"
+PLATFORMS = {
+    "linux-x64":    dict(fd=f"fd-{FD_VER}-x86_64-unknown-linux-musl.tar.gz",    rg=f"ripgrep-{RG_VER}-x86_64-unknown-linux-musl.tar.gz"),
+    "linux-arm64":  dict(fd=f"fd-{FD_VER}-aarch64-unknown-linux-musl.tar.gz",  rg=f"ripgrep-{RG_VER}-aarch64-unknown-linux-musl.tar.gz"),
+    "darwin-aarch64": dict(fd=f"fd-{FD_VER}-aarch64-apple-darwin.tar.gz",      rg=f"ripgrep-{RG_VER}-aarch64-apple-darwin.tar.gz"),
+    "darwin-x64":   dict(fd=f"fd-{FD_VER}-x86_64-apple-darwin.tar.gz",          rg=f"ripgrep-{RG_VER}-x86_64-apple-darwin.tar.gz"),
+    "windows-x64":  dict(fd=f"fd-{FD_VER}-x86_64-pc-windows-msvc.zip",         rg=f"ripgrep-{RG_VER}-x86_64-pc-windows-msvc.zip"),
+}
+
+def fetch(url):
+    import time
+    req = urllib.request.Request(url, headers={"User-Agent": "omnirush-release-builder"})
+    for attempt in range(3):
+        try:
+            with urllib.request.urlopen(req, timeout=300) as r:
+                return r.read()
+        except Exception as e:
+            if attempt == 2:
+                raise
+            print("retry", url.split("/")[-1], "after", e)
+            time.sleep(5)
+
+def extract_zip(data, dest):
+    os.makedirs(dest, exist_ok=True)
+    zf = zipfile.ZipFile(io.BytesIO(data))
+    zf.extractall(dest)
+
+def extract_tgz(data, dest):
+    os.makedirs(dest, exist_ok=True)
+    tf = tarfile.open(fileobj=io.BytesIO(data), mode="r:gz")
+    tf.extractall(dest)
+
+def find_bin(root, names):
+    for dirpath, _, files in os.walk(root):
+        for f in files:
+            if f in names:
+                return os.path.join(dirpath, f)
+    return None
+
+for plat, cfg in PLATFORMS.items():
+    if ONLY and plat not in ONLY:
+        continue
+    out_pre = f"omnirush-cli-{plat}.tar.gz" if plat == "linux-x64" else f"omnirush-cli-{plat}.zip"
+    if os.path.exists(out_pre) and not ONLY:
+        print("skip (built):", plat)
+        continue
+    stage = os.path.join(WORK, f"omnirush-cli-{plat}")
+    shutil.rmtree(stage, ignore_errors=True)
+    tmp = os.path.join(WORK, f".tmp-{plat}")
+    shutil.rmtree(tmp, ignore_errors=True)
+    os.makedirs(os.path.join(stage, ".runtime", "bin"))
+    os.makedirs(tmp)
+    shutil.copytree(os.path.join(REPO, "src"), os.path.join(stage, "src"))
+    shutil.copytree(os.path.join(REPO, "assets"), os.path.join(stage, "assets"))
+    shutil.copy2(os.path.join(REPO, "package.json"), os.path.join(stage, "package.json"))
+    exe = "bun.exe" if plat == "windows-x64" else "bun"
+    bun_plat = plat.replace("arm64", "aarch64")
+    bunzip = fetch(f"https://github.com/oven-sh/bun/releases/download/{BUN_VER}/bun-{bun_plat}.zip")
+    extract_zip(bunzip, tmp)
+    extracted_dir = os.path.join(tmp, f"bun-{bun_plat}")
+    shutil.copy2(os.path.join(extracted_dir, exe), os.path.join(stage, ".runtime", "bin", exe))
+    if plat != "windows-x64":
+        os.chmod(os.path.join(stage, ".runtime", "bin", "bun"), 0o755)
+    def fetch_extract(url, dest, cfg_value):
+        data = fetch(url)
+        if cfg_value.endswith(".zip"):
+            extract_zip(data, dest)
+        else:
+            extract_tgz(data, dest)
+    fetch_extract(f"https://github.com/sharkdp/fd/releases/download/{FD_VER}/{cfg['fd']}", os.path.join(tmp, "fd"), cfg["fd"])
+    fetch_extract(f"https://github.com/BurntSushi/ripgrep/releases/download/{RG_VER}/{cfg['rg']}", os.path.join(tmp, "rg"), cfg["rg"])
+    fb = find_bin(os.path.join(tmp, "fd"), {"fd", "fd.exe"})
+    rb = find_bin(os.path.join(tmp, "rg"), {"rg", "rg.exe"})
+    assert fb and rb, f"fd/rg not found for {plat}"
+    shutil.copy2(fb, os.path.join(stage, ".runtime", "bin", os.path.basename(fb)))
+    shutil.copy2(rb, os.path.join(stage, ".runtime", "bin", os.path.basename(rb)))
+    if plat == "linux-x64":
+        out = f"omnirush-cli-{plat}.tar.gz"
+        with tarfile.open(out, "w:gz") as t:
+            t.add(stage, arcname=os.path.basename(stage))
+    else:
+        with tarfile.open(f"omnirush-cli-{plat}.zip", "w") as t:  # plain zip via tarfile? no
+            pass
+        # use zipfile properly
+        import zipfile as zfmod
+        with zfmod.ZipFile(f"omnirush-cli-{plat}.zip", "w", zfmod.ZIP_DEFLATED) as z:
+            for dirpath, _, files in os.walk(stage):
+                for f in files:
+                    full = os.path.join(dirpath, f)
+                    z.write(full, os.path.relpath(full, WORK))
+    print("built", plat)
+    shutil.rmtree(stage, ignore_errors=True)
+    shutil.rmtree(tmp, ignore_errors=True)
+print("ALL PLATFORMS BUILT")