pantheon-opencode 1.5.0-beta.2 → 1.5.0-beta.20

package/scripts/package-evidence.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+/** Build and verify the single immutable npm package evidence artifact. */
+
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { validateInventory } from './manifest-inventory.mjs'
+
+const CI_ARGS = ['ci', '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund']
+const REQUIRED_PAYLOAD = [
+  'package/package.json',
+  'package/plugin.json',
+  'package/pyproject.toml',
+  'package/src/plugins/tui/package.json',
+  'package/src/plugins/tui/package-lock.json',
+  'package/src/plugin.ts',
+  'package/src/plugin-v2.ts',
+  'package/src/pantheon/v2-bridge.ts',
+  'package/src/plugins/tui/dist/tui.js',
+  'package/src/plugins/tui/dist/server.js',
+  'package/bin/pantheon-init.mjs',
+  'package/scripts/doctor.mjs',
+  'package/.pantheon/code-mode/compress-inline.py',
+]
+
+function fail(message) {
+  throw new Error(message)
+}
+
+function resolveTargetSha(root, supplied) {
+  const raw =
+    supplied ?? execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' })
+  const sha = String(raw).trim().toLowerCase()
+  if (!/^[0-9a-f]{40}$/.test(sha))
+    fail('target SHA must be a full lowercase 40-character hexadecimal SHA')
+  return sha
+}
+
+function createOutputDirectory(outputDir) {
+  const directory = outputDir ?? mkdtempSync(join(tmpdir(), 'pantheon-package-evidence-'))
+  mkdirSync(directory, { recursive: true })
+  if (readdirSync(directory).length !== 0) fail(`output directory must be empty: ${directory}`)
+  return { directory }
+}
+
+function packOnce(root, outputDir) {
+  const raw = execFileSync(
+    'npm',
+    ['pack', '--ignore-scripts', '--json', '--pack-destination', outputDir],
+    { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 },
+  )
+  let result
+  try {
+    result = JSON.parse(raw)
+  } catch (error) {
+    fail(`npm pack returned malformed JSON: ${error.message}`)
+  }
+  if (!Array.isArray(result) || result.length !== 1 || typeof result[0]?.filename !== 'string') {
+    fail('npm pack must produce exactly one JSON result')
+  }
+  const tgzFiles = readdirSync(outputDir).filter((name) => name.endsWith('.tgz'))
+  if (tgzFiles.length !== 1)
+    fail(`package evidence requires exactly one .tgz, found ${tgzFiles.length}`)
+  if (tgzFiles[0] !== result[0].filename)
+    fail('npm pack result does not identify the sole .tgz artifact')
+  return join(outputDir, tgzFiles[0])
+}
+
+function validateArchiveEntries(tarball) {
+  const listing = execFileSync('tar', ['-tzf', tarball], { encoding: 'utf8' })
+  const entries = listing.split('\n').filter(Boolean)
+  if (entries.length === 0) fail('package tarball is empty')
+  for (const entry of entries) {
+    const normalized = entry.replace(/\/$/, '')
+    const parts = normalized.split('/')
+    if (
+      isAbsolute(normalized) ||
+      normalized.includes('\\') ||
+      parts.includes('..') ||
+      (!normalized.startsWith('package/') && normalized !== 'package')
+    ) {
+      fail(`unsafe package archive entry: ${entry}`)
+    }
+  }
+  const detailed = execFileSync('tar', ['-tvzf', tarball], { encoding: 'utf8' })
+  for (const line of detailed.split('\n').filter(Boolean)) {
+    if (/^[lh]/i.test(line)) fail(`package archive contains a link entry: ${line}`)
+  }
+  return new Set(entries)
+}
+
+function extractSafely(tarball, workDir) {
+  const extractionRoot = join(workDir, 'extract')
+  mkdirSync(extractionRoot)
+  validateArchiveEntries(tarball)
+  execFileSync(
+    'tar',
+    ['-xzf', tarball, '--directory', extractionRoot, '--no-same-owner', '--no-same-permissions'],
+    { encoding: 'utf8' },
+  )
+  const realRoot = realpathSync(extractionRoot)
+  const walk = (current) => {
+    const stat = lstatSync(current)
+    if (stat.isSymbolicLink()) fail(`package archive extraction contains a symlink: ${current}`)
+    const resolved = realpathSync(current)
+    if (resolved !== realRoot && !resolved.startsWith(`${realRoot}/`)) {
+      fail(`package archive extraction escaped its temporary directory: ${current}`)
+    }
+    if (stat.isDirectory()) for (const name of readdirSync(current)) walk(join(current, name))
+  }
+  walk(extractionRoot)
+  return join(extractionRoot, 'package')
+}
+
+function validatePayload(packageRoot, inventory) {
+  for (const relativePath of REQUIRED_PAYLOAD) {
+    const path = join(packageRoot, relativePath.replace(/^package\//, ''))
+    if (!existsSync(path) || !lstatSync(path).isFile())
+      fail(`required package payload is missing: ${relativePath}`)
+  }
+  for (const document of inventory.documents) {
+    const { entry, path: sourcePath } = document
+    const packagedPath = join(packageRoot, entry.file)
+    if (entry.role === 'lock' && entry.file === 'package-lock.json' && !existsSync(packagedPath)) {
+      // npm-packlist excludes the package root lockfile by policy. It remains
+      // validated below as source evidence, but is not fabricated in the tgz.
+      continue
+    }
+    if (!existsSync(packagedPath) || !lstatSync(packagedPath).isFile())
+      fail(`versioned package payload is missing: package/${entry.file}`)
+    if (sha256(sourcePath) !== sha256(packagedPath))
+      fail(`published package payload differs from source: ${entry.file}`)
+  }
+}
+
+function collectLockfileEvidence(inventory, entries, packageRoot) {
+  return inventory.documents
+    .filter(({ entry }) => entry.role === 'lock')
+    .map(({ entry, data, path: sourcePath }) => {
+      const archivePath = `package/${entry.file}`
+      const packagedPath = join(packageRoot, entry.file)
+      const publishedInTarball = entries.has(archivePath)
+      return {
+        file: entry.file,
+        sourceSha256: sha256(sourcePath),
+        publishedSha256: publishedInTarball ? sha256(packagedPath) : null,
+        sourceName: data.name,
+        sourceVersion: data.version,
+        lockfileVersion: data.lockfileVersion,
+        parity: 'validated-against-manifest',
+        publishedInTarball,
+      }
+    })
+}
+
+function installProductionDependencies(root) {
+  // The root package-lock.json is source evidence only: npm-packlist omits it
+  // from the root of an npm package, so root ci must validate the source tree.
+  execFileSync('npm', CI_ARGS, { cwd: root, stdio: 'inherit' })
+  execFileSync('npm', CI_ARGS, {
+    cwd: join(root, 'src', 'plugins', 'tui'),
+    stdio: 'inherit',
+  })
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+export function createPackageEvidence(root, { outputDir, targetSha } = {}) {
+  const inventory = validateInventory(root)
+  const sha = resolveTargetSha(root, targetSha)
+  const output = createOutputDirectory(outputDir)
+  let workDir
+  try {
+    const tarball = packOnce(root, output.directory)
+    workDir = mkdtempSync(join(tmpdir(), 'pantheon-package-evidence-check-'))
+    const entries = validateArchiveEntries(tarball)
+    const packageRoot = extractSafely(tarball, workDir)
+    validatePayload(packageRoot, inventory)
+    installProductionDependencies(root)
+    const digest = sha256(tarball)
+    if (!/^[0-9a-f]{64}$/.test(digest)) fail('tarball SHA-256 is not lowercase 64-hex')
+    const metadata = {
+      version: inventory.sourceVersion,
+      targetSha: sha,
+      tarballSha256: digest,
+      tarball: tarball.split('/').at(-1),
+      lockfilePolicy: {
+        rootPackageLockfile: entries.has('package/package-lock.json')
+          ? 'published-by-npm-pack'
+          : 'omitted-by-npm-pack',
+        note: entries.has('package/package-lock.json')
+          ? 'npm pack published the root package-lock.json; lockfile parity is validated and recorded as source evidence, while tarball validation covers only the payload npm pack publishes.'
+          : 'npm pack omits the package root package-lock.json by policy; lockfile parity is validated and recorded as source evidence, while tarball validation covers only the payload npm pack publishes.',
+      },
+      lockfileEvidence: collectLockfileEvidence(inventory, entries, packageRoot),
+    }
+    writeFileSync(join(output.directory, 'metadata.json'), `${JSON.stringify(metadata, null, 2)}\n`)
+    writeFileSync(join(output.directory, 'version'), `${metadata.version}\n`)
+    writeFileSync(join(output.directory, 'target-sha'), `${metadata.targetSha}\n`)
+    writeFileSync(join(output.directory, 'tarball-sha256'), `${metadata.tarballSha256}\n`)
+    return { ...metadata, outputDir: output.directory, tarball }
+  } catch (error) {
+    rmSync(output.directory, { recursive: true, force: true })
+    throw error
+  } finally {
+    if (workDir) rmSync(workDir, { recursive: true, force: true })
+  }
+}
+
+function parseOptions(args) {
+  const options = {}
+  for (const arg of args) {
+    const match = /^--(output-dir|target-sha)=(.*)$/.exec(arg)
+    if (!match) fail(`unsupported package evidence option: ${arg}`)
+    options[match[1] === 'output-dir' ? 'outputDir' : 'targetSha'] = match[2]
+  }
+  return options
+}
+
+if (process.argv[1]?.endsWith('package-evidence.mjs')) {
+  try {
+    const evidence = createPackageEvidence(process.cwd(), parseOptions(process.argv.slice(2)))
+    console.log(JSON.stringify(evidence))
+  } catch (error) {
+    console.error(`package-evidence: ${error.message}`)
+    process.exit(1)
+  }
+}

package/scripts/probe-pantheon-cost.mjs

@@ -28,6 +28,15 @@ function emit(status, detail, checks = []) {
   if (status === 'FAIL') process.exitCode = 1
 }
 
+function diagnostic(error) {
+  const message = error instanceof Error ? error.message : String(error)
+  const stderr =
+    error && typeof error === 'object' && typeof error.stderr === 'string'
+      ? error.stderr.trim()
+      : ''
+  return stderr === '' ? message : `${message}; stderr: ${stderr}`
+}
+
 function ambiental(detail) {
   emit('AMBIENTAL', detail)
 }
@@ -295,7 +304,7 @@ async function main() {
     checks.push('incompatible schema: PASS')
     emit('PASS', 'offline synthetic DB checks passed; no real DB was read', checks)
   } catch (error) {
-    emit('FAIL', error instanceof Error ? error.message : String(error), checks)
+    emit('FAIL', diagnostic(error), checks)
   } finally {
     rmSync(root, { recursive: true, force: true })
   }

package/scripts/release-beta-version.mjs

@@ -1,80 +1,76 @@
 #!/usr/bin/env node
-/** Compute and optionally apply the beta version for a release PR. */
+/**
+ * release-beta-version.mjs — beta version helpers.
+ *
+ * The beta version is committed in the manifests (package.json) and never
+ * computed at release time. `nextBetaVersion` advances the committed version:
+ *
+ *   X.Y.Z-beta.N  ->  X.Y.Z-beta.(N+1)     (stay on the current beta line)
+ *   X.Y.Z         ->  X.Y.(Z+1)-beta.1     (start a fresh beta line)
+ *
+ * `applyBetaVersion` writes an already-decided beta version into every
+ * manifest and is retained for recovery tooling. The legacy PR+SHA scheme
+ * (`X.Y.Z-beta.<pr>.<sha7>`) is accepted by validation for backward
+ * compatibility only; it is no longer generated.
+ */
 
-import { readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { SEMVER_PATTERN, validateInventory, writeInventoryVersion } from './manifest-inventory.mjs'
 
-export const MANIFESTS = [
-  { file: 'package.json', kind: 'json' },
-  { file: 'pyproject.toml', kind: 'toml' },
-  { file: 'plugin.json', kind: 'json' },
-  { file: 'src/plugins/tui/package.json', kind: 'json' },
-]
-
-const STABLE = /^(\d+)\.(\d+)\.(\d+)$/
+const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
+// Current committed sequential beta line.
+const BETA_LINE = /^(\d+\.\d+\.\d+)-beta\.(\d+)$/
+// Legacy PR+SHA beta scheme, accepted for recovery only.
+const LEGACY_BETA = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-beta\.[1-9]\d*\.[0-9a-f]{7}$/
+const BETA_RELEASE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-beta\.[1-9]\d*$/
 
 export function nextStableVersion(latest, intent = 'patch') {
-  const match = STABLE.exec(String(latest))
-  if (!match) throw new Error(`npm latest is not a stable semver: "${latest}"`)
-  const [major, minor, patch] = match.slice(1).map(Number)
+  const match = STABLE.exec(String(latest).trim())
+  if (!match) throw new Error(`latest is not a stable semver: "${latest}"`)
   if (!['patch', 'minor', 'major'].includes(intent)) {
     throw new Error(`release intent must be patch, minor, or major: "${intent}"`)
   }
+  const [major, minor, patch] = match.slice(1).map(Number)
   if (intent === 'major') return `${major + 1}.0.0`
   if (intent === 'minor') return `${major}.${minor + 1}.0`
   return `${major}.${minor}.${patch + 1}`
 }
 
-export function betaVersion(latest, intent, pr, sha) {
-  if (!/^\d+$/.test(String(pr)) || Number(pr) < 1) throw new Error(`invalid PR number: "${pr}"`)
-  const shortSha = String(sha).slice(0, 7)
-  if (!/^[0-9a-f]{7,}$/i.test(shortSha)) throw new Error(`invalid commit SHA: "${sha}"`)
-  return `${nextStableVersion(latest, intent)}-beta.${pr}.${shortSha}`
-}
+/**
+ * Next beta version derived from the committed manifest version.
+ *
+ * @param {string} current committed version (e.g. "1.5.0-beta.2")
+ * @returns {string} the next sequential beta (e.g. "1.5.0-beta.3")
+ */
+export function nextBetaVersion(current) {
+  const value = String(current).trim()
+  const line = BETA_LINE.exec(value)
+  if (line) return `${line[1]}-beta.${Number(line[2]) + 1}`
 
-function writeVersion(root, { file, kind }, version) {
-  const path = join(root, file)
-  const raw = readFileSync(path, 'utf8')
-  if (kind === 'toml') {
-    const updated = raw.replace(/^(version\s*=\s*")[^"]+("\s*)$/m, `$1${version}$2`)
-    if (updated === raw) throw new Error(`no version field in ${file}`)
-    writeFileSync(path, updated)
-    return
-  }
-  const content = JSON.parse(raw)
-  content.version = version
-  writeFileSync(path, `${JSON.stringify(content, null, 2)}\n`)
-}
+  const stable = STABLE.exec(value)
+  if (stable) return `${nextStableVersion(value, 'patch')}-beta.1`
 
-export function applyBetaVersion(root, version) {
-  for (const manifest of MANIFESTS) writeVersion(root, manifest, version)
-  // Keep npm's lockfile metadata consistent without changing dependency data.
-  const lockPath = join(root, 'package-lock.json')
-  const lock = JSON.parse(readFileSync(lockPath, 'utf8'))
-  lock.version = version
-  if (lock.packages?.['']) lock.packages[''].version = version
-  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`)
+  // Any other prerelease (e.g. 1.5.0-rc.1): beta the next patch of its base.
+  const base = /^(\d+\.\d+\.\d+)-[0-9A-Za-z.-]+$/.exec(value)
+  if (!base) throw new Error(`cannot derive a beta version from: "${current}"`)
+  return `${nextStableVersion(base[1], 'patch')}-beta.1`
 }
 
-const args = new Map(
-  process.argv.slice(2).map((arg) => {
-    const [key, ...value] = arg.split('=')
-    return [key.replace(/^--/, ''), value.join('=')]
-  }),
-)
-
-if (args.has('latest')) {
-  try {
-    const version = betaVersion(
-      args.get('latest'),
-      args.get('intent') || 'patch',
-      args.get('pr'),
-      args.get('sha'),
+function validateReleaseVersion(version) {
+  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {
+    throw new Error(`invalid release semver: "${version}"`)
+  }
+  if (!BETA_RELEASE.test(version) && !LEGACY_BETA.test(version)) {
+    throw new Error(
+      `release version must be <base>-beta.<N> or legacy <base>-beta.<pr>.<7-char-sha>: "${version}"`,
     )
-    if (args.has('apply')) applyBetaVersion(process.cwd(), version)
-    console.log(version)
-  } catch (error) {
-    console.error(`release-beta-version: ${error.message}`)
-    process.exit(1)
   }
 }
+
+/** Preflight all six entries, then update metadata only. */
+export function applyBetaVersion(root, version) {
+  validateReleaseVersion(version)
+  const inventory = validateInventory(root, { allowVersionDivergence: true })
+  writeInventoryVersion(inventory, version)
+  const after = validateInventory(root)
+  if (after.sourceVersion !== version) throw new Error('beta version post-write validation failed')
+}

package/scripts/sync-artifacts.mjs

@@ -0,0 +1,169 @@
+/**
+ * sync-artifacts.mjs — postinstall freshness sync for copy-only artifacts.
+ *
+ * Guarantees that an `npm install -g pantheon-opencode` (or npx cache
+ * refresh) brings an EXISTING installation up to date for everything that is
+ * a pure byte-compare copy: agents + routing.yml, skills, AGENTS.md,
+ * commands, the runtime MCP scripts, the code-mode payload and tiers.json.
+ *
+ * Deliberately NOT done here (they belong to `pantheon-opencode init` /
+ * `update`, which the doctor points at when versions drift):
+ *   - opencode.json merge (config keys, plugin registration, MCP entries)
+ *   - venv/pip setup
+ *   - tui.json registration changes
+ *
+ * The user's opencode.json already references the installed package root for
+ * plugins, so after a package update those references hit the NEW code
+ * automatically; this sync refreshes the COPIES that would otherwise stay
+ * stale until the next manual init.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+import {
+  collectSkillNames,
+  copyFiles,
+  installSkills,
+  ROOT,
+  syncDir,
+  writeIfChanged,
+} from './install/shared.mjs'
+
+/** Canonical MCP script sources — mirrors installOpenCode phase 2.10. */
+const MCP_SCRIPTS = {
+  'mcp_resources_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_resources_server.py'),
+  'code_mode_server.py': () => join(ROOT, 'src', 'mcp', 'code_mode_server.py'),
+  'memory_mcp_server.py': () => join(ROOT, 'src', 'mcp', 'memory_mcp_server.py'),
+  'mcp_persistence_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_persistence_server.py'),
+  '_pantheon_paths.py': () => join(ROOT, 'src', 'mcp', '_pantheon_paths.py'),
+  'mcp_codemap_module.py': () => join(ROOT, 'src', 'mcp', 'mcp_codemap_module.py'),
+  'pantheon_vision_server.py': () => join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
+  'eval_store.py': () => join(ROOT, 'src', 'mcp', 'eval_store.py'),
+  'scrub-secrets.py': () => join(ROOT, 'scripts', 'scrub-secrets.py'),
+}
+
+/**
+ * Sync all copy-only artifacts from the installed package into configDir
+ * (the GLOBAL OpenCode config dir). Byte-compare idempotent; never throws.
+ * @returns {{ created: number, skipped: number, errors: string[] }}
+ */
+export function syncCopyArtifacts(configDir) {
+  const result = { created: 0, skipped: 0, errors: [] }
+  const bump = (r) => {
+    result.created += r.created
+    result.skipped += r.skipped
+  }
+
+  // ── agents + routing.yml ──
+  try {
+    const dstAgents = join(configDir, 'agents')
+    if (existsSync(join(ROOT, 'src', 'agents'))) {
+      mkdirSync(dstAgents, { recursive: true })
+      bump(copyFiles(join(ROOT, 'src', 'agents'), dstAgents, false))
+      const routing = join(ROOT, 'src', 'routing.yml')
+      if (existsSync(routing)) {
+        if (
+          writeIfChanged(join(configDir, 'routing.yml'), readFileSync(routing, 'utf8'), false) ===
+          'created'
+        ) {
+          result.created++
+        } else result.skipped++
+      }
+    }
+  } catch (err) {
+    result.errors.push(`agents: ${err.message}`)
+  }
+
+  // ── skills ──
+  try {
+    const names = collectSkillNames()
+    if (names.length > 0) bump(installSkills(names, configDir, false, ''))
+  } catch (err) {
+    result.errors.push(`skills: ${err.message}`)
+  }
+
+  // ── instructions (AGENTS.md) ──
+  try {
+    const src = join(ROOT, 'AGENTS.md')
+    if (existsSync(src)) {
+      if (
+        writeIfChanged(join(configDir, 'AGENTS.md'), readFileSync(src, 'utf8'), false) === 'created'
+      ) {
+        result.created++
+      } else result.skipped++
+    }
+  } catch (err) {
+    result.errors.push(`instructions: ${err.message}`)
+  }
+
+  // ── commands (*.md) ──
+  try {
+    const srcCmds = join(ROOT, 'commands')
+    if (existsSync(srcCmds)) {
+      bump(syncDir(srcCmds, join(configDir, 'commands'), false, false, (f) => f.endsWith('.md')))
+    }
+  } catch (err) {
+    result.errors.push(`commands: ${err.message}`)
+  }
+
+  // ── runtime payload (MCP scripts, code-mode, tiers) ──
+  try {
+    const dstScripts = join(configDir, 'scripts')
+    mkdirSync(dstScripts, { recursive: true })
+    for (const [name, srcFn] of Object.entries(MCP_SCRIPTS)) {
+      const src = srcFn()
+      if (!existsSync(src)) continue
+      const content = readFileSync(src, 'utf8')
+      const dst = join(dstScripts, name)
+      if (writeIfChanged(dst, content, false) === 'created') {
+        statSync(dst)
+        result.created++
+      } else result.skipped++
+    }
+
+    const req = join(ROOT, 'src', 'mcp', 'requirements-vision.txt')
+    if (existsSync(req)) {
+      if (
+        writeIfChanged(
+          join(configDir, 'requirements-vision.txt'),
+          readFileSync(req, 'utf8'),
+          false,
+        ) === 'created'
+      ) {
+        result.created++
+      } else result.skipped++
+    }
+
+    const srcCodeMode = join(ROOT, '.pantheon', 'code-mode')
+    const dstCodeMode = join(configDir, '.pantheon', 'code-mode')
+    if (existsSync(srcCodeMode)) {
+      bump(syncDir(srcCodeMode, dstCodeMode, false, false))
+    }
+
+    const srcTiers = join(ROOT, '.pantheon', 'tiers.json')
+    const dstTiers = join(configDir, '.pantheon', 'tiers.json')
+    if (existsSync(srcTiers)) {
+      if (writeIfChanged(dstTiers, readFileSync(srcTiers, 'utf8'), false) === 'created')
+        result.created++
+      else result.skipped++
+    }
+  } catch (err) {
+    result.errors.push(`runtime: ${err.message}`)
+  }
+
+  return result
+}
+
+/** Drop stale entries in dst that no longer exist in src (agents/skills dirs). */
+export function pruneMissing(srcDir, dstDir) {
+  if (!existsSync(srcDir) || !existsSync(dstDir)) return 0
+  const src = new Set(readdirSync(srcDir))
+  let removed = 0
+  for (const entry of readdirSync(dstDir)) {
+    if (!src.has(entry)) {
+      rmSync(join(dstDir, entry), { recursive: true, force: true })
+      removed++
+    }
+  }
+  return removed
+}