synabun 2.0.5 → 2.0.9

package/neural-interface/lib/git-bash/manager.js

@@ -0,0 +1,268 @@
+// ═══════════════════════════════════════════
+// SynaBun — Git Bash: the copy in use, and its download
+// ═══════════════════════════════════════════
+//
+// On Windows a Claude Code without Git Bash has no Bash tool and runs every
+// hook in PowerShell. The manager keeps the answer to "which Git Bash does a
+// Claude Code started by SynaBun get" (resolver.js) and, on a PC that has
+// none, puts SynaBun's own copy of Git for Windows in place:
+//
+//   bundled      inside an installed app: <resources>\git (the Windows x64
+//                installer carries it; packaging/lib/git-bash.mjs)
+//   downloaded   on an npm install: DATA_HOME/runtime/git/<version>/, fetched
+//                once from the pinned release (pins.js), checked and unpacked
+//                by install.js, outside data/ so no backup holds it
+//
+// It downloads only on Windows, only for a processor a release is pinned for,
+// and only when neither the PC nor the app has a Git Bash: at the server's
+// start (ensure) or at the first Claude Code start that finds none (childEnv),
+// once per process. A failed download is not tried again by itself: Settings
+// shows why and has the button that tries again. SYNABUN_GIT_BASH=off turns all
+// of it off: no download, nothing added to any environment.
+//
+//   resolution()   the Git Bash in use (refreshed when older than half a minute)
+//   childEnv(env)  the environment of a Claude Code process SynaBun starts
+//   gitExecutable() git.exe of SynaBun's copy when it is the one in use (SynaBun's own git features)
+//   ensure()       download when there is no Git Bash at all; never rejects
+//   status()       what Settings shows: missing / downloading / ready / failed, and the rest
+//   onChange(fn)   told when the Git Bash in use changes (the settings of the user's own `claude` follow it)
+//   housekeep()    what an earlier run left in the data home: a stopped attempt's work folder, a version the
+//                  pins no longer name (the server runs it once, in the background)
+
+import { mkdirSync, readdirSync, statSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { getDataHome } from '../../../lib/paths.js';
+import { packagedRuntime } from '../../../lib/packaged-runtime.js';
+import { pathEnvValue } from '../augmented-path.js';
+import { sweepStaleWork } from '../cloudflared/install.js';
+import { checkInstalled, GitBashError, installGitBash } from './install.js';
+import { BUNDLED_FOLDER, gitBashPinFor, inTree, MARKER, readGitBashPins } from './pins.js';
+import { gitBashChildEnv, resolveGitBash } from './resolver.js';
+
+const VERSION_FOLDER = /^\d+\.\d+\.\d+\.\d+$/;
+
+/** `DATA_HOME/runtime/git`: where a downloaded Git for Windows lives. */
+export function gitRoot(dataHome = getDataHome()) {
+  return join(dataHome, 'runtime', 'git');
+}
+
+const describe = (error) => ({
+  code: error instanceof GitBashError ? error.code : 'disk',
+  message: String(error?.message || error),
+});
+
+const same = (a, b) => !!a && !!b && a.path === b.path && a.source === b.source && a.passToClaude === b.passToClaude && a.cmdDir === b.cmdDir;
+
+/**
+ * @param {object} [o]
+ * @param {string} [o.dataHome]
+ * @param {{ resources: string } | null} [o.packaged]  lib/packaged-runtime.js packagedRuntime()
+ * @param {object} [o.pins]               pins.js readGitBashPins() (read here when left out; unreadable pins never throw)
+ * @param {() => string} [o.pathValue]    the PATH a git of the PC is looked for on
+ * @param {() => (string|null)} [o.settingsValue]  CLAUDE_CODE_GIT_BASH_PATH of the user's ~/.claude/settings.json
+ * @param {typeof fetch} [o.fetchImpl]
+ * @param {boolean} [o.worker]            unpack in a worker thread (the server); tests unpack inline
+ * @param {(line: string) => void} [o.log]
+ */
+export function createGitBashManager({
+  dataHome = getDataHome(),
+  packaged = packagedRuntime(),
+  pins,
+  platform = process.platform,
+  arch = process.arch,
+  env = process.env,
+  pathValue = () => pathEnvValue(env),
+  settingsValue = () => null,
+  fetchImpl,
+  stallMs,
+  worker = true,
+  maxAgeMs = 30_000,
+  isFile,
+  install = installGitBash,
+  check = checkInstalled,
+  log = () => {},
+  now = () => Date.now(),
+} = {}) {
+  if (!pins) {
+    try {
+      pins = readGitBashPins();
+    } catch (error) {
+      pins = Object.freeze({ version: null, platforms: Object.freeze({}) });
+      if (platform === 'win32') log(`[git-bash] ${error?.message || error} SynaBun downloads no Git for Windows until this is repaired.`);
+    }
+  }
+  const off = String(env.SYNABUN_GIT_BASH || '').trim().toLowerCase() === 'off';
+  const pin = gitBashPinFor(pins, platform, arch);
+  // `platform` decides which rules apply (Windows'); paths on this disk are in the separators of the system that
+  // runs this (the same thing on a Windows PC; tests ask the Windows rules from any system).
+  const host = process.platform;
+  const root = gitRoot(dataHome);
+  const bundledRoot = platform === 'win32' && packaged?.resources ? join(packaged.resources, BUNDLED_FOLDER) : null;
+  const downloadedRoot = pin ? join(root, pin.version) : null;
+  const ownRoots = [bundledRoot, root].filter(Boolean);
+
+  const verified = new Map();   // copy root → { sig, result }: a copy is hashed again only when its marker changes
+  const listeners = new Set();
+  let current = null;
+  let refreshedAt = 0;
+  let download = null;          // { promise, stop, step, progress } while one runs
+  let lastError = null;
+  let attempted = false;        // a download was started in this process (the first-need trigger fires once)
+  let settings = null;          // what the last sync of the user's settings did (noteSettings)
+
+  /** SynaBun's own copies, checked: the app's, then the data home's. */
+  function copies() {
+    if (!pin) return [];
+    const out = [];
+    for (const [source, copyRoot] of [['bundled', bundledRoot], ['downloaded', downloadedRoot]]) {
+      if (!copyRoot) continue;
+      let sig = null;
+      try { const info = statSync(join(copyRoot, MARKER)); sig = `${info.size}:${info.mtimeMs}:${info.ino}`; } catch { sig = null; }
+      let result;
+      if (sig === null) result = { ok: false, reason: 'missing' };
+      else {
+        const known = verified.get(copyRoot);
+        const fresh = !(known && known.sig === sig);
+        result = fresh ? check(copyRoot, pin, { platform: host }) : known.result;
+        // A copy that could not be read just now is asked again next time; a verdict is remembered with its marker.
+        verified.set(copyRoot, { sig, result });
+        // The tree's empty folders, which an installer of files does not carry (the Windows installer makes them;
+        // this puts back one that is gone). Asked once per verdict.
+        if (fresh && result.ok) for (const rel of pin.folders || []) { try { mkdirSync(inTree(copyRoot, rel, host), { recursive: true }); } catch { /* a folder SynaBun cannot write: bash runs without it */ } }
+      }
+      out.push({ source, root: copyRoot, ok: result.ok, reason: result.reason, bash: inTree(copyRoot, pin.bash, host), git: inTree(copyRoot, pin.git, host) });
+    }
+    return out;
+  }
+
+  function refresh() {
+    let next;
+    // macOS, Linux, the kill switch: nothing to look at (no settings read, no PATH walked).
+    if (off || platform !== 'win32') next = resolveGitBash({ platform: off ? 'off' : platform });
+    else {
+      let settingsBash = null;
+      try { settingsBash = settingsValue(); } catch { settingsBash = null; }
+      let searchPath = '';
+      try { searchPath = pathValue(); } catch { searchPath = pathEnvValue(env); }
+      next = resolveGitBash({ platform, env, settingsValue: settingsBash, pathValue: searchPath, copies: copies(), ownRoots, ...(isFile ? { isFile } : {}) });
+    }
+    const changed = !same(current, next);
+    current = next;
+    refreshedAt = now();
+    if (changed) for (const listener of [...listeners]) { try { listener(next); } catch { /* the listener's */ } }
+    return current;
+  }
+
+  function resolution({ maxAge = maxAgeMs } = {}) {
+    if (!current || now() - refreshedAt > maxAge) refresh();
+    return current;
+  }
+
+  /** Versions the pins no longer name, removed without holding the event loop (some ten thousand files each). */
+  async function pruneOtherVersions() {
+    let names = [];
+    try { names = readdirSync(root); } catch { return []; }
+    const removed = [];
+    for (const name of names) {
+      if (!VERSION_FOLDER.test(name) || name === pin?.version) continue;
+      // A copy still in use (a Claude Code started before the update) cannot be removed on Windows: the next start tries again.
+      try { await rm(join(root, name), { recursive: true, force: true, maxRetries: 2 }); removed.push(name); log(`[git-bash] Removed Git for Windows ${name}, which the pins no longer name.`); } catch { /* in use */ }
+    }
+    return removed;
+  }
+
+  /** Windows: a work folder a stopped attempt left (when no attempt runs now), and versions the pins no longer name. */
+  async function housekeep() {
+    if (platform !== 'win32' || off || !pin) return { swept: [], removed: [] };
+    const swept = download ? [] : sweepStaleWork(root);
+    return { swept, removed: await pruneOtherVersions() };
+  }
+
+  /** Download SynaBun's copy when there is no Git Bash at all. Resolves the status; never rejects. */
+  function ensure({ reason = 'start' } = {}) {
+    if (platform !== 'win32' || !pin || off) return Promise.resolve(status());
+    if (download) return download.promise.then(() => status());
+    if (refresh().source) return Promise.resolve(status());
+    attempted = true;
+    lastError = null;
+    const stop = new AbortController();
+    const job = { stop, step: 'download', progress: { phase: 'download', received: 0, total: pin.size } };
+    log(`[git-bash] No Git Bash on this PC (${reason}): downloading Git for Windows ${pin.version} (${(pin.size / 1024 / 1024).toFixed(1)} MB) from ${pin.url}`);
+    job.promise = install({
+      pins, pin, root, fetchImpl, stallMs, worker, platform: host, signal: stop.signal,
+      onStep: (step) => { job.step = step; },
+      onProgress: (progress) => { job.progress = progress; },
+    }).then(async (placed) => {
+      log(`[git-bash] Git for Windows ${pin.version} is in place, release file and tree checked: ${placed.path}`);
+      verified.delete(downloadedRoot);
+      await pruneOtherVersions();
+    }, (error) => {
+      lastError = describe(error);
+      log(`[git-bash] Git for Windows ${pin.version} could not be put in place (${lastError.code}): ${lastError.message}`);
+    }).finally(() => {
+      if (download === job) download = null;
+      // The listeners hear the change (SynaBun's copy now in use); Settings asks for the status itself.
+      refresh();
+    });
+    download = job;
+    return job.promise.then(() => status());
+  }
+
+  function childEnv(base = env) {
+    const r = resolution();
+    // The first Claude Code start that finds no Git Bash at all fetches one (once per process; Settings retries).
+    if (platform === 'win32' && pin && !off && !r.source && !download && !attempted) ensure({ reason: 'first-need' });
+    return gitBashChildEnv(base, r, { platform });
+  }
+
+  function gitExecutable() {
+    const r = resolution();
+    return r.passToClaude && r.git ? r.git : null;
+  }
+
+  function status() {
+    const r = current || resolution();
+    const base = {
+      supported: platform === 'win32',
+      pinned: pin ? { version: pin.version, tag: pin.tag, file: pin.file, size: pin.size, url: pin.url } : null,
+      source: r.source,
+      path: r.path,
+      passToClaude: r.passToClaude,
+      step: null,
+      progress: null,
+      error: null,
+      settings,
+      checkedAt: new Date(refreshedAt || now()).toISOString(),
+    };
+    if (platform !== 'win32') return { ...base, state: 'unsupported' };
+    if (off) return { ...base, state: 'off' };
+    if (download) {
+      const { phase, received = 0, consumed = 0, total = 0 } = download.progress || {};
+      const done = phase === 'extract' ? consumed : received;
+      return { ...base, state: 'downloading', step: download.step, progress: { phase, done, total, percent: total ? Math.min(100, Math.floor((done / total) * 100)) : 0 } };
+    }
+    if (r.source === 'bundled' || r.source === 'downloaded') return { ...base, state: 'ready' };
+    if (r.source) return { ...base, state: 'system' };
+    // Windows on a processor no release is pinned for (arm64): nothing to download, nothing to retry.
+    if (!pin) return { ...base, state: 'unsupported' };
+    if (lastError) return { ...base, state: 'failed', error: lastError };
+    return { ...base, state: 'missing' };
+  }
+
+  return {
+    pin,
+    root,
+    ownRoots,
+    resolution,
+    refresh,
+    childEnv,
+    gitExecutable,
+    ensure,
+    status,
+    housekeep,
+    cancel: () => { if (!download) return false; download.stop.abort(); return true; },
+    noteSettings: (result) => { settings = result || null; },
+    onChange: (listener) => { listeners.add(listener); return () => listeners.delete(listener); },
+  };
+}

package/neural-interface/lib/git-bash/pins.js

@@ -0,0 +1,206 @@
+// ═══════════════════════════════════════════
+// SynaBun — Git for Windows: which one
+// ═══════════════════════════════════════════
+//
+// Claude Code on Windows runs its Bash tool and every hook through Git Bash;
+// without one it falls back to PowerShell, where commands written for bash
+// fail (SynaBun's hooks of an installed app among them). SynaBun brings a
+// private copy of Git for Windows for a PC that has none (resolver.js decides
+// when it is the one in use). pins.json beside this file is the one place that
+// knows which: the release, its file for Windows x64, the SHA-256 and size
+// GitHub publishes for it, and what the archive holds once it is unpacked (the
+// tree's digest, and the files SynaBun starts). The running application reads
+// it here (manager.js downloads the file on a Windows npm install), and so does
+// an application build (packaging/lib/git-bash.mjs imports this module from the
+// application it stages): an installer never carries a Git the application
+// would not have fetched itself.
+//
+// To move to another release: change `version`, `tag`, `baseUrl`, `release`
+// and `source`, download the asset from the git-for-windows/git release, put
+// GitHub's digest and size in `sha256` / `size` (check them against the
+// release notes' table), unpack it with this application's own reader and
+// record `tree` and `key` from what install.js treeDigest() reports. Fetch
+// COPYING and LGPL-2.1 of that tag into licenses/. tests/git-bash-pins.test.mjs
+// checks the shape; only a download checks the values.
+//
+// Only node:fs, node:path and node:url here: a build imports this on the Node
+// of the build machine, before the application has a dependency installed.
+
+import { readFileSync } from 'node:fs';
+import { join, posix, win32 } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const PINS_PATH = fileURLToPath(new URL('./pins.json', import.meta.url));
+/** Git's own license texts of the pinned tag (COPYING, LGPL-2.1): what LICENSE.txt in the copy is made of. */
+export const LICENSES_DIR = fileURLToPath(new URL('./licenses/', import.meta.url));
+
+/** Where every pinned file is: Git for Windows' releases on GitHub, over HTTPS, and nowhere else. */
+export const RELEASE_BASE = 'https://github.com/git-for-windows/git/releases/download/';
+const RELEASE_PAGE = 'https://github.com/git-for-windows/git/releases/tag/';
+const SOURCE_TREE = 'https://github.com/git-for-windows/git/tree/';
+
+/** The folder of a packaged application that holds its Git for Windows, beside `runtime/` and `app/`. */
+export const BUNDLED_FOLDER = 'git';
+
+/** What SynaBun puts at the top of its copy, beside what the release file holds (never part of the tree's digest). */
+export const MARKER = 'synabun-git.json';
+export const ADDED_FILES = Object.freeze(['LICENSE.txt', 'SOURCE.txt', MARKER]);
+
+const SHA256 = /^[0-9a-f]{64}$/;
+const VERSION = /^\d+\.\d+\.\d+\.\d+$/;
+const TAG = /^v(\d+\.\d+\.\d+)\.windows\.(\d+)$/;
+const KEY = /^win32-(x64|arm64)$/;
+const FILE_ARCH = Object.freeze({ x64: '64-bit', arm64: 'arm64' });
+const isCount = (value) => Number.isInteger(value) && value > 0 && value < 2 ** 40;
+
+/** A path inside the tree as the archive spells it: relative, forward slashes, no `.` or `..`, nothing Windows reads otherwise. */
+export function isTreePath(value) {
+  if (typeof value !== 'string' || !value || value.length > 400) return false;
+  if (value.startsWith('/') || value.endsWith('/') || /[\\:*?"<>|\0-\x1f]/.test(value)) return false;
+  return value.split('/').every((part) => part && part !== '.' && part !== '..' && !/[ .]$/.test(part));
+}
+
+/** `rel` (a tree path) inside `root`, in the separators of `platform`. */
+export function inTree(root, rel, platform = process.platform) {
+  return (platform === 'win32' ? win32 : posix).join(root, ...rel.split('/'));
+}
+
+/**
+ * The pins as an object every reader can rely on, or an Error that lists what is wrong with them. A pin is
+ * `{ key, platform, arch, version, tag, file, url, sha256, size, archive, skip, folders, tree, bash, git, cmd, keyFiles }`:
+ * `folders` are the tree's empty folders (a digest of files does not see them; an installer of files carries none).
+ * @param {object} raw pins.json, parsed
+ */
+export function validateGitBashPins(raw) {
+  const problems = [];
+  const version = String(raw?.version || '');
+  const tag = String(raw?.tag || '');
+  if (!VERSION.test(version)) problems.push(`version "${version}" is not a Git for Windows file version (2.56.0.2)`);
+  const tagged = TAG.exec(tag);
+  if (!tagged) problems.push(`tag "${tag}" is not a Git for Windows release tag (v2.56.0.windows.2)`);
+  else if (`${tagged[1]}.${tagged[2]}` !== version) problems.push(`tag ${tag} is not the release of version ${version}`);
+  const baseUrl = String(raw?.baseUrl || '');
+  if (baseUrl !== `${RELEASE_BASE}${tag}/`) problems.push(`baseUrl must be ${RELEASE_BASE}${tag}/`);
+  if (raw?.release !== `${RELEASE_PAGE}${tag}`) problems.push(`release must be ${RELEASE_PAGE}${tag}`);
+  if (raw?.source !== `${SOURCE_TREE}${tag}`) problems.push(`source must be ${SOURCE_TREE}${tag}`);
+  if (typeof raw?.origin !== 'string' || !raw.origin.trim()) problems.push('origin (where the checksums come from) is missing');
+  if (typeof raw?.license !== 'string' || !raw.license.trim()) problems.push('license is missing');
+  const platforms = {};
+  for (const [key, entry] of Object.entries(raw?.platforms || {})) {
+    const at = KEY.exec(key);
+    if (!at) { problems.push(`"${key}" is not a platform Git for Windows is pinned for (win32-x64, win32-arm64)`); continue; }
+    const arch = at[1];
+    const wrong = [];
+    const file = String(entry?.file || '');
+    if (file !== `Git-${version}-${FILE_ARCH[arch]}.tar.bz2`) wrong.push(`file must be Git-${version}-${FILE_ARCH[arch]}.tar.bz2`);
+    if (!SHA256.test(String(entry?.sha256 || ''))) wrong.push('sha256 is not 64 hex digits');
+    if (!isCount(entry?.size)) wrong.push('size is not a number of bytes');
+    if (entry?.archive !== 'tar.bz2') wrong.push(`archive "${entry?.archive}" is not a kind this reads (tar.bz2)`);
+    const skip = Array.isArray(entry?.skip) ? entry.skip : null;
+    if (!skip || !skip.every(isTreePath)) wrong.push('skip must be a list of paths inside the tree');
+    const folders = Array.isArray(entry?.folders) ? entry.folders : null;
+    if (!folders || !folders.every(isTreePath)) wrong.push('folders must be a list of paths inside the tree');
+    const tree = entry?.tree || {};
+    if (!isCount(tree.files) || !isCount(tree.bytes) || !SHA256.test(String(tree.sha256 || ''))) wrong.push('tree must give files, bytes and sha256');
+    const keyFiles = entry?.key && typeof entry.key === 'object' ? entry.key : {};
+    for (const [path, info] of Object.entries(keyFiles)) {
+      if (!isTreePath(path) || !isCount(info?.size) || !SHA256.test(String(info?.sha256 || ''))) wrong.push(`key ${path}: a path inside the tree with its size and sha256`);
+      if (ADDED_FILES.includes(path)) wrong.push(`key ${path}: a name SynaBun adds itself`);
+    }
+    for (const role of ['bash', 'git']) {
+      if (!isTreePath(entry?.[role]) || !keyFiles[entry[role]]) wrong.push(`${role} must name one of the key files`);
+    }
+    if (wrong.length) { problems.push(...wrong.map((each) => `${key}: ${each}`)); continue; }
+    platforms[key] = Object.freeze({
+      key, platform: 'win32', arch, version, tag, file,
+      url: `${baseUrl}${file}`,
+      sha256: entry.sha256,
+      size: entry.size,
+      archive: entry.archive,
+      skip: Object.freeze([...skip]),
+      folders: Object.freeze([...folders]),
+      tree: Object.freeze({ files: tree.files, bytes: tree.bytes, sha256: tree.sha256 }),
+      bash: entry.bash,
+      git: entry.git,
+      cmd: posix.dirname(entry.git),
+      keyFiles: Object.freeze(Object.fromEntries(Object.entries(keyFiles).map(([path, info]) => [path, Object.freeze({ size: info.size, sha256: info.sha256 })]))),
+    });
+  }
+  if (!Object.keys(platforms).length && !problems.length) problems.push('no platform is pinned');
+  if (problems.length) throw new Error(`The Git for Windows pins are not usable: ${problems.join('; ')}`);
+  return Object.freeze({
+    name: String(raw.name || 'Git for Windows'),
+    version, tag, baseUrl,
+    release: raw.release,
+    source: raw.source,
+    license: raw.license,
+    origin: raw.origin,
+    platforms: Object.freeze(platforms),
+  });
+}
+
+/** pins.json, read and checked. Throws when the file is missing or wrong: nothing is downloaded by guesswork. */
+export function readGitBashPins(path = PINS_PATH) {
+  return validateGitBashPins(JSON.parse(readFileSync(path, 'utf8')));
+}
+
+/** The pin of a platform, or null: Git for Windows exists for Windows only (and is pinned here for x64). */
+export function gitBashPinFor(pins, platform = process.platform, arch = process.arch) {
+  if (platform !== 'win32') return null;
+  return pins?.platforms?.[`win32-${arch}`] || null;
+}
+
+/** The Git for Windows of a packaged application: `<resources>/git`. */
+export function bundledGitRoot(resources, platform = process.platform) {
+  return (platform === 'win32' ? win32 : posix).join(resources, BUNDLED_FOLDER);
+}
+
+/** LICENSE.txt of SynaBun's copy: Git's own license texts of the pinned tag, after a line that says what they cover. */
+export function licenseText(dir = LICENSES_DIR) {
+  const copying = readFileSync(join(dir, 'COPYING'), 'utf8');
+  const lgpl = readFileSync(join(dir, 'LGPL-2.1'), 'utf8');
+  return [
+    'Git for Windows is free software. Git itself is distributed under the GNU General Public License,',
+    'version 2 (below, as COPYING of the Git source), some of its parts under the GNU Lesser General',
+    'Public License, version 2.1 (after it, as LGPL-2.1 of the Git source). The other programs and',
+    'libraries of this folder carry their own licenses: usr/share/licenses, ucrt64/share/licenses',
+    'and ucrt64/doc. SOURCE.txt says where the source of all of it is.',
+    '',
+    '='.repeat(78),
+    'COPYING',
+    '='.repeat(78),
+    '',
+    copying.replace(/\s+$/, ''),
+    '',
+    '',
+    '='.repeat(78),
+    'LGPL-2.1',
+    '='.repeat(78),
+    '',
+    lgpl.replace(/\s+$/, ''),
+    '',
+  ].join('\n');
+}
+
+/** SOURCE.txt of SynaBun's copy: what it is, where it came from, where its source is. */
+export function sourceText(pins, pin) {
+  return [
+    `${pins.name} ${pins.version} (${pins.tag}), for Windows ${pin.arch}, as SynaBun ships it.`,
+    '',
+    'The files of this folder are those of the release file below, unchanged, except:',
+    `  - left out: ${pin.skip.join(', ')}`,
+    '    (links into /proc that Windows cannot create without administrator rights)',
+    `  - added by SynaBun: ${ADDED_FILES.join(', ')}`,
+    '',
+    `Release file:  ${pin.url}`,
+    `SHA-256:       ${pin.sha256}`,
+    `Release:       ${pins.release}`,
+    `Source of Git: ${pins.source}`,
+    '               (and the "Source code" archives of the release above)',
+    'Source of the other programs: the Git for Windows project, https://github.com/git-for-windows',
+    '               (the MSYS2 and MINGW package definitions it builds them from)',
+    `License:       ${pins.license} for Git (LICENSE.txt); each other program's in usr/share/licenses,`,
+    '               ucrt64/share/licenses and ucrt64/doc.',
+    '',
+  ].join('\n');
+}

package/neural-interface/lib/git-bash/pins.json

@@ -0,0 +1,34 @@
+{
+  "name": "Git for Windows",
+  "version": "2.56.0.2",
+  "tag": "v2.56.0.windows.2",
+  "baseUrl": "https://github.com/git-for-windows/git/releases/download/v2.56.0.windows.2/",
+  "release": "https://github.com/git-for-windows/git/releases/tag/v2.56.0.windows.2",
+  "source": "https://github.com/git-for-windows/git/tree/v2.56.0.windows.2",
+  "license": "GPL-2.0-only",
+  "origin": "Git for Windows' own release file of its stable release v2.56.0.windows.2 (published 2026-10-05). `sha256` and `size` are what GitHub publishes for the asset (`gh release view v2.56.0.windows.2 --repo git-for-windows/git --json assets`: digest sha256:16ca394b…), and the same SHA-256 is in the release notes' own table. The file was downloaded on 2026-10-18 with `gh release download` and both were computed from it and found equal. `tree` and `key` were computed from that download, read by lib/git-bash/bzip2.js and unpacked with `skip` left out: `tree` is every file there, its count, its bytes, and the SHA-256 over one line `path NUL size NUL sha256 LF` per file in path order (install.js treeDigest); `key` is each file SynaBun starts, with its size and SHA-256; `folders` are the tree's empty folders (an installer of files carries none, so the Windows installer makes them).",
+  "platforms": {
+    "win32-x64": {
+      "file": "Git-2.56.0.2-64-bit.tar.bz2",
+      "sha256": "16ca394bdb94b372267d79e1e10b68763674f73e03e0648202a7971a8a730a84",
+      "size": 118485193,
+      "archive": "tar.bz2",
+      "skip": ["dev/fd", "dev/stdin", "dev/stdout", "dev/stderr", "etc/mtab"],
+      "folders": ["dev/mqueue", "dev/shm", "tmp"],
+      "tree": {
+        "files": 9617,
+        "bytes": 423079170,
+        "sha256": "11842baaa80a7e6145959291c338179003bc3b7d4963b891c432c14ee74637a0"
+      },
+      "bash": "bin/bash.exe",
+      "git": "cmd/git.exe",
+      "key": {
+        "bin/bash.exe": { "size": 45416, "sha256": "6cc575e9112efe6253b6a6999c12aa0240cb3f511aeda3480ae026edc0dc5280" },
+        "usr/bin/bash.exe": { "size": 2449886, "sha256": "5490d0da5e7cf9d92068cc48fcc590f2bcf8564add8ff91c3b5fe541eb2d72e3" },
+        "cmd/git.exe": { "size": 45400, "sha256": "54bda91c773c6bba2b970424423cfcb80552d92dc6967d766f98931fe1251a54" },
+        "ucrt64/bin/git.exe": { "size": 4413272, "sha256": "b824434dfe3b5f9cf648af6c9cc8cb1f6a982cc6e13b6c6ebbe6533c7e51cc2e" },
+        "usr/bin/msys-2.0.dll": { "size": 3373151, "sha256": "2a89b7c31b323c42e2fb37900af087aeb27417694e630a210bc75b0369410bc7" }
+      }
+    }
+  }
+}