ompchamber 1.2.0 → 2.0.0

package/src/server/lib/btw/store.server.ts

@@ -18,7 +18,8 @@
  */
 
 import { getDb } from '@/server/db.server';
-import type { BtwModel, BtwTopic, BtwTurn, BtwTurnStatus } from '@/shared/types';
+import { isApprovalMode, type ApprovalMode } from '@/shared/lib/omp/config/access-mode';
+import type { BtwModel, BtwTopic, BtwTurn, BtwTurnStatus, ChatMessageData } from '@/shared/types';
 
 interface TopicRow {
   id: string;
@@ -27,6 +28,8 @@ interface TopicRow {
   provider: string | null;
   model_id: string | null;
   model_name: string | null;
+  thinking_level: string | null;
+  approval_mode: string | null;
   leaf_id: string | null;
   promoted_session_id: string | null;
   created_at: number;
@@ -38,6 +41,7 @@ interface TurnRow {
   turn_index: number;
   question: string;
   answer: string;
+  messages: string;
   status: string;
   created_at: number;
   updated_at: number;
@@ -67,6 +71,8 @@ function rowToTopic(row: TopicRow): BtwTopic {
     createdAt: row.created_at,
     updatedAt: row.updated_at,
     ...(model ? { model } : {}),
+    ...(row.thinking_level ? { thinkingLevel: row.thinking_level } : {}),
+    ...(isApprovalMode(row.approval_mode) ? { approvalMode: row.approval_mode } : {}),
     ...(row.promoted_session_id ? { promotedSessionId: row.promoted_session_id } : {}),
     turns: [],
   };
@@ -77,12 +83,25 @@ function rowToTurn(row: TurnRow): BtwTurn {
     index: row.turn_index,
     question: row.question,
     answer: row.answer,
+    messages: parseMessages(row.messages),
     status: isBtwTurnStatus(row.status) ? row.status : 'interrupted',
     createdAt: row.created_at,
     updatedAt: row.updated_at,
   };
 }
 
+/** A turn's stored conversation. A row written before the column existed (or a
+ *  corrupted one) reads as an empty conversation rather than throwing. */
+function parseMessages(raw: string | null | undefined): ChatMessageData[] {
+  if (!raw) return [];
+  try {
+    const value: unknown = JSON.parse(raw);
+    return Array.isArray(value) ? (value as ChatMessageData[]) : [];
+  } catch {
+    return [];
+  }
+}
+
 /** Every topic of a session, oldest first, each with its turns in order. */
 export async function listBtwTopics(sessionId: string): Promise<BtwTopic[]> {
   const db = await getDb();
@@ -119,6 +138,8 @@ export interface NewBtwTopicInput {
   sessionId: string;
   title: string;
   model?: BtwModel;
+  thinkingLevel?: string;
+  approvalMode?: ApprovalMode;
   /** Parent transcript leaf when the topic was created (promotion guard). */
   leafId?: string | null;
 }
@@ -133,6 +154,8 @@ export async function createBtwTopic(input: NewBtwTopicInput): Promise<BtwTopic>
     provider: input.model?.provider ?? null,
     model_id: input.model?.id ?? null,
     model_name: input.model?.name ?? null,
+    thinking_level: input.thinkingLevel ?? null,
+    approval_mode: input.approvalMode ?? null,
     leaf_id: input.leafId ?? null,
     promoted_session_id: null,
     created_at: now,
@@ -140,9 +163,21 @@ export async function createBtwTopic(input: NewBtwTopicInput): Promise<BtwTopic>
   };
   await db.run(
     `INSERT INTO btw_topics
-       (id, session_id, title, provider, model_id, model_name, leaf_id, promoted_session_id, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)`,
-    [row.id, row.session_id, row.title, row.provider, row.model_id, row.model_name, row.leaf_id, now, now],
+       (id, session_id, title, provider, model_id, model_name, thinking_level, approval_mode, leaf_id, promoted_session_id, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)`,
+    [
+      row.id,
+      row.session_id,
+      row.title,
+      row.provider,
+      row.model_id,
+      row.model_name,
+      row.thinking_level,
+      row.approval_mode,
+      row.leaf_id,
+      now,
+      now,
+    ],
   );
   return rowToTopic(row);
 }
@@ -165,11 +200,11 @@ export async function appendBtwTurn(topicId: string, question: string): Promise<
   return turnIndex;
 }
 
-/** Patch one turn's answer and/or status. */
+/** Patch one turn's answer, conversation and/or status. */
 export async function updateBtwTurn(
   topicId: string,
   turnIndex: number,
-  patch: { answer?: string; status?: BtwTurnStatus },
+  patch: { answer?: string; status?: BtwTurnStatus; messages?: ChatMessageData[] },
 ): Promise<void> {
   const db = await getDb();
   const sets: string[] = ['updated_at = ?'];
@@ -182,6 +217,10 @@ export async function updateBtwTurn(
     sets.push('status = ?');
     values.push(patch.status);
   }
+  if (patch.messages !== undefined) {
+    sets.push('messages = ?');
+    values.push(JSON.stringify(patch.messages));
+  }
   await db.run(`UPDATE btw_turns SET ${sets.join(', ')} WHERE topic_id = ? AND turn_index = ?`, [
     ...values,
     topicId,
@@ -223,6 +262,18 @@ export async function setBtwTopicModel(topicId: string, model: BtwModel): Promis
   ]);
 }
 
+/** Record the thinking level the side child runs at (`null` clears it). */
+export async function setBtwTopicThinkingLevel(topicId: string, level: string | null): Promise<void> {
+  const db = await getDb();
+  await db.run('UPDATE btw_topics SET thinking_level = ?, updated_at = ? WHERE id = ?', [level, Date.now(), topicId]);
+}
+
+/** Record the approval mode the side child was spawned with. */
+export async function setBtwTopicApprovalMode(topicId: string, mode: ApprovalMode): Promise<void> {
+  const db = await getDb();
+  await db.run('UPDATE btw_topics SET approval_mode = ?, updated_at = ? WHERE id = ?', [mode, Date.now(), topicId]);
+}
+
 export async function setBtwTopicPromoted(topicId: string, promotedSessionId: string): Promise<void> {
   const db = await getDb();
   await db.run('UPDATE btw_topics SET promoted_session_id = ?, updated_at = ? WHERE id = ?', [

package/src/server/lib/db/schema.ts

@@ -15,6 +15,7 @@ import type { DbClient } from '@/server/lib/db/client';
 import { migrateQueueTableFk } from '@/server/lib/queue/schema-migration.server';
 import { ensureBtwSchema } from '@/server/lib/btw/schema.server';
 import { migrateWorkspaceFolderColumns } from '@/shared/lib/workspace/schema-migrations';
+import { migrateSessionStreamStateColumns } from '@/shared/lib/omp/session/schema-migrations';
 
 export async function initSchema(db: DbClient): Promise<void> {
   await db.exec(`
@@ -84,6 +85,7 @@ export async function initSchema(db: DbClient): Promise<void> {
     CREATE TABLE IF NOT EXISTS session_stream_state (
       session_id TEXT PRIMARY KEY,
       status TEXT NOT NULL,
+      owner_pid INTEGER,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
   `);
@@ -92,6 +94,8 @@ export async function initSchema(db: DbClient): Promise<void> {
   // Installs older `queued_messages` schemas carry an invalid FK (see the
   // migration module); rebuild once so real-session queue inserts work.
   await migrateQueueTableFk(db);
+  // `owner_pid` arrived after `session_stream_state` shipped; see the migration.
+  await migrateSessionStreamStateColumns(db);
   // Side-question tables live in their own module (see schema.server.ts).
   await ensureBtwSchema(db);
 

package/src/server/lib/db/settings-store.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from 'bun:test';
+
+import type { DbClient } from '@/server/lib/db/client';
+import { isPlainObject, mergeSettingsJson, readSettingsJson } from '@/server/lib/db/settings-store';
+
+/** Minimal in-memory stand-in for the `app_settings` rows the store talks to. */
+function fakeDb(rows: Record<string, string> = {}) {
+  const store = new Map(Object.entries(rows));
+  const db = {
+    async get(_sql: string, params: unknown[] = []) {
+      const value = store.get(String(params[0]));
+      return value === undefined ? undefined : { value };
+    },
+    async run(_sql: string, params: unknown[] = []) {
+      store.set(String(params[0]), String(params[1]));
+      return { changes: 1, lastID: 0 };
+    },
+  };
+  // Only `get`/`run` are reachable from the store; the rest of `DbClient` exists
+  // for callers this test never exercises.
+  return { db: db as unknown as DbClient, read: (key: string) => store.get(key) };
+}
+
+const KEY = 'omp_chamber_settings';
+
+describe('mergeSettingsJson', () => {
+  test('applies the patch and keeps the keys it did not name', async () => {
+    const { db, read } = fakeDb({ [KEY]: JSON.stringify({ theme: 'paper', soundAlerts: true }) });
+    await mergeSettingsJson(db, KEY, { theme: 'nord-dark' });
+    expect(JSON.parse(read(KEY)!)).toEqual({ theme: 'nord-dark', soundAlerts: true });
+  });
+
+  test('creates the row when it is absent or not an object', async () => {
+    const absent = fakeDb();
+    await mergeSettingsJson(absent.db, KEY, { theme: 'nord-dark' });
+    expect(JSON.parse(absent.read(KEY)!)).toEqual({ theme: 'nord-dark' });
+
+    const array = fakeDb({ [KEY]: JSON.stringify(['stale']) });
+    await mergeSettingsJson(array.db, KEY, { theme: 'nord-dark' });
+    expect(JSON.parse(array.read(KEY)!)).toEqual({ theme: 'nord-dark' });
+
+    const malformed = fakeDb({ [KEY]: 'not json' });
+    await mergeSettingsJson(malformed.db, KEY, { theme: 'nord-dark' });
+    expect(JSON.parse(malformed.read(KEY)!)).toEqual({ theme: 'nord-dark' });
+  });
+
+  test('a patch cannot resurrect a value from a stale copy of its siblings', async () => {
+    // Two writers, one blob: only the key each of them edited is stored.
+    const { db, read } = fakeDb({ [KEY]: JSON.stringify({ theme: 'paper' }) });
+    await mergeSettingsJson(db, KEY, { theme: 'nord-dark' });
+    await mergeSettingsJson(db, KEY, { chatCompletionSound: false });
+    expect(JSON.parse(read(KEY)!)).toEqual({ theme: 'nord-dark', chatCompletionSound: false });
+    expect(await readSettingsJson(db, KEY, {})).toEqual({ theme: 'nord-dark', chatCompletionSound: false });
+  });
+});
+
+describe('isPlainObject', () => {
+  test('accepts objects and rejects the shapes that must replace instead of merge', () => {
+    expect(isPlainObject({ a: 1 })).toBe(true);
+    expect(isPlainObject(['a'])).toBe(false);
+    expect(isPlainObject(null)).toBe(false);
+    expect(isPlainObject('a')).toBe(false);
+    expect(isPlainObject(7)).toBe(false);
+  });
+});

package/src/server/lib/db/settings-store.ts

@@ -35,6 +35,31 @@ export async function writeSettingsRaw(db: DbClient, key: string, value: string)
   await db.run(UPSERT_VALUE_SQL, [key, value]);
 }
 
+/** A JSON object that is not an array — the only shape a key-wise merge applies to. */
+export function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Shallow-merge a plain-object patch into the object already stored for `key`.
+ *
+ * A patch is the only thing the settings client can send without republishing
+ * values it merely read: the `omp_chamber_settings` blob is written by two
+ * writers (the settings modal, the theme picker) and read by many, so a writer
+ * that echoed its whole copy would discard whatever another writer stored in
+ * between. Merging is what makes a partial write safe; a stored value that is
+ * absent or not an object is replaced outright, and arrays still replace
+ * because a list has no per-key identity to merge on.
+ */
+export async function mergeSettingsJson(
+  db: DbClient,
+  key: string,
+  patch: Record<string, unknown>,
+): Promise<void> {
+  const stored = await readSettingsJson<unknown>(db, key, null);
+  await writeSettingsJson(db, key, { ...(isPlainObject(stored) ? stored : {}), ...patch });
+}
+
 /** Read every settings row, parsing JSON where possible and keeping raw text otherwise. */
 export async function readAllSettingsJson(db: DbClient): Promise<Record<string, unknown>> {
   const rows = await db.all<{ key: string; value: string }>(SELECT_ALL_SQL);

package/src/server/lib/fs/atomic-write.ts

@@ -8,18 +8,56 @@
  * the target. rename(2) is atomic on POSIX, so a crash mid-write leaves either
  * the old file or the new one — never a truncated file. The temp file is
  * removed (best-effort) when the write or rename fails.
+ *
+ * Two properties the plain rename does NOT give you, and both are required for
+ * omp's config files:
+ *
+ * - **Mode.** `Bun.write` creates the temp file with the process umask
+ *   (0644/0664), so overwriting a `0600` file — omp opens its own config temp
+ *   with `wx, 0o600` — silently loosened the mode of a file holding plaintext
+ *   API keys. The existing target's mode is carried onto the replacement; only
+ *   a brand-new file uses `createMode`.
+ * - **Symlinks.** Renaming onto a symlinked path replaces the symlink with a
+ *   regular file. omp resolves the symlink chain and writes to the real target
+ *   (`Settings.#resolveYamlWritePath`), so a user who links `config.yml` into a
+ *   dotfiles repo keeps the link. The chain is resolved before the temp file is
+ *   placed, so the temp lands beside the real target on the same filesystem.
  */
 
 import fs from 'fs';
 import { dirname } from 'path';
 
+export interface AtomicWriteOptions {
+  /**
+   * Mode for a file that does not exist yet. Existing files always keep their
+   * own mode. Defaults to `0o644`.
+   */
+  createMode?: number;
+}
+
 /** Writes `data` to `targetPath` via a sibling temp file then rename (atomic on POSIX). */
-export async function writeFileAtomic(targetPath: string, data: string): Promise<void> {
-  await fs.promises.mkdir(dirname(targetPath), { recursive: true });
-  const tempPath = `${targetPath}.tmp-${process.pid}-${Date.now()}`;
+export async function writeFileAtomic(
+  targetPath: string,
+  data: string,
+  options: AtomicWriteOptions = {},
+): Promise<void> {
+  // Missing file (first write) or a dangling link throws — the parent is real.
+  let resolved = targetPath;
+  try {
+    resolved = fs.realpathSync.native(targetPath);
+  } catch {}
+  let mode = options.createMode ?? 0o644;
+  try {
+    mode = fs.statSync(resolved).mode & 0o777;
+  } catch {}
+  await fs.promises.mkdir(dirname(resolved), { recursive: true });
+  const tempPath = `${resolved}.tmp-${process.pid}-${crypto.randomUUID()}`;
   try {
     await Bun.write(tempPath, data);
-    await fs.promises.rename(tempPath, targetPath);
+    // Bun.write ignores `mode` when creating, so the mode is applied explicitly
+    // before the rename — a chmod after would leave a window at the default.
+    await fs.promises.chmod(tempPath, mode);
+    await fs.promises.rename(tempPath, resolved);
   } catch (error) {
     await fs.promises.rm(tempPath, { force: true }).catch(() => undefined);
     throw error;

package/src/server/lib/fs/config-lock.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Cross-process lock for read-modify-write cycles on shared config files.
+ *
+ * Two writers (the dev server, the installed app, or two provider mutations
+ * landing together) editing the same file would otherwise silently lose the
+ * earlier mutation when the later rename wins. A lockfile with exclusive
+ * create (`wx`) is atomic on every platform; the holder writes its PID and
+ * deletes the file on completion. Stale locks (writer crashed) are broken
+ * after a grace period.
+ *
+ * This is deliberately NOT omp's own lock: omp takes an OS-level `flock(2)` on
+ * `${path}.lock` (Linux uses abstract Unix sockets, Windows named mutexes), so
+ * the two mechanisms do not interop. The window this leaves — a chamber write
+ * landing between omp's read and its rename — is bounded by keeping every
+ * critical section to a single read-modify-write, and omp re-reads inside its
+ * own lock before applying its pending changes.
+ */
+
+import fs from 'fs';
+import { dirname } from 'path';
+
+const LOCK_TIMEOUT_MS = 3_000;
+const LOCK_STALE_MS = 10_000;
+const LOCK_RETRY_MS = 25;
+
+/** Run `fn` while holding an exclusive `${configPath}.lock` lease. */
+export async function withConfigLock<T>(configPath: string, fn: () => T | Promise<T>): Promise<T> {
+  const lockPath = `${configPath}.lock`;
+  // The config file may not exist yet (first write) — the lockfile needs its
+  // parent dir to exist before exclusive-create can succeed.
+  await fs.promises.mkdir(dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (;;) {
+    let handle: fs.promises.FileHandle | null = null;
+    try {
+      handle = await fs.promises.open(lockPath, 'wx');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      // Held by another process — break it if stale, otherwise wait and retry.
+      try {
+        if (Date.now() - (await fs.promises.stat(lockPath)).mtimeMs > LOCK_STALE_MS) {
+          await fs.promises.unlink(lockPath);
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`Timed out waiting for ${lockPath} (another process holds the config lock)`);
+      }
+      await Bun.sleep(LOCK_RETRY_MS);
+      continue;
+    }
+    try {
+      await handle.writeFile(String(process.pid));
+    } finally {
+      await handle.close();
+    }
+    try {
+      return await fn();
+    } finally {
+      try {
+        await fs.promises.unlink(lockPath);
+      } catch {
+        // Already removed (e.g. by cleanup) — the critical section is done.
+      }
+    }
+  }
+}

package/src/server/lib/fs/git-ignore.ts

@@ -15,10 +15,46 @@
  *
  * Paths must be relative to `dir` and must exist on disk: git resolves
  * directory-only patterns (`build/`) by stat-ing the path.
+ *
+ * Answers are memoized per path: the panel asks again every time a folder is
+ * re-listed or re-expanded, and each question costs a `git` subprocess
+ * (measured 5.6 ms). The TTL is short because a `.gitignore` the user just
+ * edited should take effect without a reload; a path whose answer is still
+ * cached is simply not asked about, so a re-listing of a known folder spawns
+ * nothing at all.
  */
+
+const CACHE_TTL_MS = 5_000;
+/** Bound on remembered paths; the oldest answer is evicted past this. */
+const CACHE_MAX_ENTRIES = 20_000;
+
+interface IgnoreAnswer {
+  ignored: boolean;
+  at: number;
+}
+
+const cache = new Map<string, IgnoreAnswer>();
+
+function cacheKey(dir: string, rel: string): string {
+  return `${dir}\0${rel}`;
+}
+
 export async function collectIgnoredPaths(dir: string, relPaths: string[]): Promise<Set<string>> {
   if (relPaths.length === 0) return new Set();
 
+  const now = Date.now();
+  const ignored = new Set<string>();
+  const unknown: string[] = [];
+  for (const rel of relPaths) {
+    const answer = cache.get(cacheKey(dir, rel));
+    if (answer && now - answer.at < CACHE_TTL_MS) {
+      if (answer.ignored) ignored.add(rel);
+      continue;
+    }
+    unknown.push(rel);
+  }
+  if (unknown.length === 0) return ignored;
+
   try {
     const proc = Bun.spawn({
       cmd: ['git', 'check-ignore', '--stdin', '-z'],
@@ -32,18 +68,32 @@ export async function collectIgnoredPaths(dir: string, relPaths: string[]): Prom
     // Drain stdout while the listing is written: a directory big enough to
     // fill both pipe buffers would otherwise deadlock child against parent.
     const stdout = new Response(proc.stdout).text();
-    proc.stdin.write(relPaths.map(rel => `${rel}\0`).join(''));
+    proc.stdin.write(unknown.map(rel => `${rel}\0`).join(''));
     // FileSink.end() types as `number | Promise<number>` — EPIPE (child gone)
     // must not surface as an unhandled rejection.
     void Promise.resolve(proc.stdin.end()).catch(() => {});
 
     const [text, exitCode] = await Promise.all([stdout, proc.exited]);
     // 0 = at least one path matched, 1 = none, 128 = no repository. Only 0 can
-    // carry a match list.
-    if (exitCode !== 0) return new Set();
+    // carry a match list, but every path still gets a definite answer: an
+    // unlisted one is not ignored.
+    const matched = exitCode === 0 ? new Set(text.split('\0').filter(Boolean)) : new Set<string>();
+
+    // Only 0 and 1 mean git actually read the paths; 128 (no repository) is
+    // not an answer, so nothing is cached from it and the next listing retries.
+    const answered = exitCode === 0 || exitCode === 1;
+    const stamped = Date.now();
+    for (const rel of unknown) {
+      const isIgnored = matched.has(rel);
+      if (isIgnored) ignored.add(rel);
+      if (answered) {
+        if (cache.size >= CACHE_MAX_ENTRIES) cache.clear();
+        cache.set(cacheKey(dir, rel), { ignored: isIgnored, at: stamped });
+      }
+    }
 
-    return new Set(text.split('\0').filter(Boolean));
+    return ignored;
   } catch {
-    return new Set(); // git missing / spawn failed — nothing is dimmed
+    return ignored; // git missing / spawn failed — nothing is dimmed
   }
 }

package/src/server/lib/fs/ripgrep.ts

@@ -0,0 +1,119 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The `rg` behind the Search panel — a native one when the machine has it.
+ *
+ * The `ripgrep` package is a WASI build (732 KiB of wasm) whose guest sees a
+ * single preopened directory. That costs two things. Speed: measured 86–117 ms
+ * against 37 ms for the same query in this repo. And correctness: the guest
+ * cannot reach the user's global gitignore, so a path git refuses to track —
+ * `~/.gitignore` excludes `AGENTS.md` on this machine — was listed as a search
+ * hit while the Files and Git panels both hid it.
+ *
+ * A native `rg` on PATH answers both, but `Bun.which` alone is not enough to
+ * find one: the first `rg` on PATH in this repo is `node_modules/.bin/rg`, the
+ * WASI shim itself (`#!/usr/bin/env node`). Resolving by hand lets a script be
+ * skipped and the next PATH entry considered. When no native binary exists the
+ * WASI build still runs, because the panel has to work on a machine that never
+ * installed ripgrep.
+ */
+
+import { join } from 'path';
+import { ripgrep } from 'ripgrep';
+
+/** Bytes that open a script rather than an executable (`#!`). */
+const SHEBANG_MAGIC = [0x23, 0x21] as const;
+
+export interface RipgrepSink {
+  /** Raw stdout, chunk by chunk, as rg flushes it. */
+  onStdout: (chunk: Uint8Array) => void;
+  /** Raw stderr, chunk by chunk. */
+  onStderr: (chunk: Uint8Array) => void;
+}
+
+let resolvedBinary: string | null | undefined;
+
+/**
+ * Path of a native `rg`, or null when PATH holds only scripts.
+ *
+ * Cached for the process: PATH does not move under a running server, and the
+ * answer costs one 2-byte read per candidate. A binary is recognised by *not*
+ * starting with `#!` — that covers ELF, Mach-O (thin and fat) and PE without
+ * enumerating magics, and a wrong guess only costs a failed spawn, which falls
+ * back to the WASI build.
+ */
+export async function nativeRipgrepPath(): Promise<string | null> {
+  if (resolvedBinary !== undefined) return resolvedBinary;
+  resolvedBinary = null;
+
+  const executable = process.platform === 'win32' ? 'rg.exe' : 'rg';
+  for (const dir of (Bun.env.PATH ?? '').split(process.platform === 'win32' ? ';' : ':')) {
+    if (!dir) continue;
+    const candidate = join(dir, executable);
+    try {
+      const head = await Bun.file(candidate).slice(0, 2).bytes();
+      if (head.length < 2) continue;
+      if (head[0] === SHEBANG_MAGIC[0] && head[1] === SHEBANG_MAGIC[1]) continue;
+      resolvedBinary = candidate;
+      break;
+    } catch {
+      // Not there, or not readable — try the next PATH entry.
+    }
+  }
+  return resolvedBinary;
+}
+
+/**
+ * Run `rg` with `args` in `cwd`, streaming both pipes into `sink`.
+ *
+ * Returns rg's exit code (0 = matches, 1 = none, 2 = error). A native binary
+ * that disappears between resolution and spawn falls back to WASI rather than
+ * failing the search.
+ */
+export async function runRipgrep(args: string[], cwd: string, sink: RipgrepSink): Promise<number> {
+  const binary = await nativeRipgrepPath();
+  if (binary) {
+    try {
+      const proc = Bun.spawn({
+        cmd: [binary, ...args],
+        cwd,
+        stdout: 'pipe',
+        stderr: 'pipe',
+      });
+      // `pipeTo`, not `for await`: the repo's lib set has no
+      // `ReadableStream[Symbol.asyncIterator]`, and this is the same shape
+      // `lib/omp/rpc/lines.ts` uses to drain a Bun child.
+      const pump = (stream: ReadableStream<Uint8Array>, write: (chunk: Uint8Array) => void) =>
+        stream.pipeTo(
+          new WritableStream({
+            write(chunk) {
+              write(chunk);
+            },
+          }),
+        ).then(
+          () => undefined,
+          () => undefined,
+        );
+      // Drained together: rg filling one pipe while the other is unread would
+      // otherwise block it against a full buffer.
+      await Promise.all([pump(proc.stdout, sink.onStdout), pump(proc.stderr, sink.onStderr)]);
+      return await proc.exited;
+    } catch {
+      // Spawn refused (deleted, not executable) — the WASI build still answers.
+    }
+  }
+
+  // WASI preopens map the guest "." onto the real target directory.
+  const preopens = { '.': cwd };
+  const { code } = await ripgrep(args, {
+    preopens,
+    // ripgrep accepts any `{ write(chunk) }` sink — feed it the raw stream so
+    // matches flush incrementally.
+    stdout: { write: (chunk: Uint8Array) => sink.onStdout(chunk) },
+    stderr: { write: (chunk: Uint8Array) => sink.onStderr(chunk) },
+  });
+  return code;
+}