refactor: group host storage and worker infrastructure (#37606)

config/build-plugins/plain-node-entry-guard.ts

@@ -18,7 +18,7 @@ export const CLI_MAIN_ENTRY_NAMES = [
   'orca-profiles/profile-index-store',
   'claude-accounts/keychain',
   'skills/bundled-skill-install/cli-entry',
-  'macos-tree-clone',
+  'filesystem/macos-tree-clone',
   'orcad/orcad-stale-lock-reclaim',
   'plugins/plugin-authoring-checks',
   ...[

config/electron-builder.config.cjs

@@ -330,8 +330,8 @@ module.exports = {
     'out/main/gitlab/project-ref-parser.js',
     'out/main/grok/**',
     'out/main/hermes/**',
-    'out/main/asar-transparent-fs.js',
-    'out/main/macos-tree-clone.js',
+    'out/main/filesystem/asar-transparent-fs.js',
+    'out/main/filesystem/macos-tree-clone.js',
     'out/main/orca-profiles/profile-index-store.js',
     'out/main/persistence/profile-state/**',
     'out/main/plugins/plugin-authoring-checks.js',

config/scripts/ci-shard-timings.json

@@ -2478,14 +2478,14 @@
       "src/main/daemon/terminal-view-attribute-responder.test.ts": 54,
       "src/main/daemon/windows-conpty-warmup.test.ts": 51,
       "src/main/daemon/wsl-cold-restore-cwd.test.ts": 50,
-      "src/main/destination-serialized-local-rename.test.ts": 1392,
+      "src/main/filesystem/destination-serialized-local-rename.test.ts": 1392,
       "src/main/devin/hook-config-json.test.ts": 78,
       "src/main/devin/hook-service.test.ts": 159,
       "src/main/diagnostics/event-loop-delay-probe.test.ts": 84,
       "src/main/dsh/dsh-home-patch.test.ts": 57,
       "src/main/dsh/hook-service.test.ts": 124,
-      "src/main/durable-file-write-syscall-proof.test.ts": 73,
-      "src/main/durable-file-write.test.ts": 176,
+      "src/main/filesystem/durable-file-write-syscall-proof.test.ts": 73,
+      "src/main/filesystem/durable-file-write.test.ts": 176,
       "src/main/electron-updater-mac-staging-contract.test.ts": 125,
       "src/main/emulator/android/adb-devices.test.ts": 46,
       "src/main/emulator/android/android-avd-boot-identity.test.ts": 88,
@@ -2524,7 +2524,7 @@
       "src/main/ephemeral-vm/recipe-runner.test.ts": 460,
       "src/main/ephemeral-vm/runtime-service.test.ts": 870,
       "src/main/ephemeral-vm/runtime-ssh-cleanup.test.ts": 188,
-      "src/main/event-listener-fanout.test.ts": 52,
+      "src/main/runtime/events/event-listener-fanout.test.ts": 52,
       "src/main/execution-host-workspace-trust.test.ts": 232,
       "src/main/external-conversations/external-conversation-cancel-liveness.test.ts": 1752,
       "src/main/external-conversations/external-conversation-cancel-settlement.test.ts": 1601,
@@ -2536,7 +2536,7 @@
       "src/main/external-conversations/external-conversations-install.test.ts": 1687,
       "src/main/external-editors/external-editor-launch-process-host.test.ts": 215,
       "src/main/external-editors/external-editor-launch.test.ts": 151,
-      "src/main/file-transaction-lock.test.ts": 1047,
+      "src/main/filesystem/file-transaction-lock.test.ts": 1047,
       "src/main/fish-history-session.test.ts": 82,
       "src/main/fish-xdg-data-dirs-handoff.test.ts": 76,
       "src/main/folder-upgrade-worktree-path.test.ts": 251,
@@ -2923,8 +2923,8 @@
       "src/main/hooks-runner.test.ts": 314,
       "src/main/hooks-setup-runner-script.test.ts": 336,
       "src/main/hooks.test.ts": 474,
-      "src/main/host-checkout-removal.test.ts": 52,
-      "src/main/host-tree-removal-asar.electron.test.ts": 308,
+      "src/main/filesystem/host-checkout-removal.test.ts": 52,
+      "src/main/filesystem/host-tree-removal-asar.electron.test.ts": 308,
       "src/main/host/deferred-secret-protection-report.test.ts": 81,
       "src/main/host/electron-http-client.test.ts": 496,
       "src/main/host/electron-manual-redirect-fetch.test.ts": 52,
@@ -2936,8 +2936,8 @@
       "src/main/i18n/main-i18n-pre-init.test.ts": 50,
       "src/main/i18n/system-language.test.ts": 358,
       "src/main/media/image-file-signature.test.ts": 47,
-      "src/main/integration-state-file-cache.test.ts": 47,
-      "src/main/integration-token-file-cache.test.ts": 152,
+      "src/main/credentials/integration-state-file-cache.test.ts": 47,
+      "src/main/credentials/integration-token-file-cache.test.ts": 152,
       "src/main/ipc/account-sign-in-link-opener.test.ts": 128,
       "src/main/ipc/agent-hooks.test.ts": 736,
       "src/main/ipc/agent-pane-authority-ownership.test.ts": 47,
@@ -3584,7 +3584,7 @@
       "src/main/macos-permissions/macos-tcc-log-stream-orphans.test.ts": 110,
       "src/main/macos-permissions/macos-tcc-prompt-notice.test.ts": 82,
       "src/main/macos-permissions/macos-tcc-prompt-watch.test.ts": 77,
-      "src/main/macos-tree-clone.test.ts": 84,
+      "src/main/filesystem/macos-tree-clone.test.ts": 84,
       "src/main/macos-update-running-instances.integration.test.ts": 59,
       "src/main/managed-data-accounts/original-environment.test.ts": 209,
       "src/main/managed-data-accounts/profile-removal-recovery.test.ts": 479,
@@ -4860,8 +4860,8 @@
       "src/main/project-runtime-git-router-store.test.ts": 1818,
       "src/main/project-runtime-git-router.test.ts": 192,
       "src/main/project-runtime-read-git-options-opt-in.test.ts": 137,
-      "src/main/protected-secret-persistence-concurrency.test.ts": 68,
-      "src/main/protected-secret-persistence.test.ts": 53,
+      "src/main/credentials/protected-secret-persistence-concurrency.test.ts": 68,
+      "src/main/credentials/protected-secret-persistence.test.ts": 53,
       "src/main/provider-process/managed-provider-process-fallback-tree.test.ts": 150,
       "src/main/provider-process/managed-provider-process-root-only.test.ts": 164,
       "src/main/provider-process/managed-provider-process.test.ts": 185,
@@ -6479,7 +6479,7 @@
       "src/main/shell-startup-identity-scanner.test.ts": 39,
       "src/main/shell-startup-output-scanner.test.ts": 58,
       "src/main/shell-wrapper-content-address.test.ts": 49,
-      "src/main/sidecar-snapshot-file.test.ts": 65,
+      "src/main/filesystem/sidecar-snapshot-file.test.ts": 65,
       "src/main/skills/agent-skill-selection.test.ts": 103,
       "src/main/skills/antigravity-skill-discovery.test.ts": 128,
       "src/main/skills/bundled-skill-install/auto-update-eligibility.test.ts": 400,
@@ -7081,7 +7081,7 @@
       "src/main/windows/windows-pty-job.win32.test.ts": 84,
       "src/main/worker-thread-child-process/worker-thread-child-output-flow.test.ts": 158,
       "src/main/worker-thread-child-process/worker-thread-child-process.test.ts": 602,
-      "src/main/worker-thread-request-queue.test.ts": 83,
+      "src/main/worker-threads/worker-thread-request-queue.test.ts": 83,
       "src/main/workspaces/cleanup/workspace-cleanup-removal-snapshot-prune.test.ts": 60,
       "src/main/workspaces/cleanup/workspace-cleanup-scan-snapshot.test.ts": 160,
       "src/main/workspace-create-event-fields.test.ts": 265,
@@ -7231,7 +7231,7 @@
       "src/main/zcode/zcode-plan-api-key-store.test.ts": 89,
       "src/main/zcode/zcode-v2-personal-overlay-raw-json.test.ts": 259,
       "src/main/zcode/zcode-v2-plan-credentials.test.ts": 934,
-      "src/main/zod-schema-compilation.test.ts": 87,
+      "src/main/schema-validation/zod-schema-compilation.test.ts": 87,
       "src/packages/process-host/src/bounded-output-sink.test.ts": 75,
       "src/packages/process-host/src/close-process-registry.test.ts": 39,
       "src/packages/process-host/src/growing-byte-buffer.test.ts": 102,

config/scripts/orcad-terminal-smoke-change-scope.test.mjs

@@ -48,7 +48,7 @@ describe('the actual terminal smoke dependency graph', () => {
     ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
     'src/main/runtime/orca-runtime.ts',
     'src/main/windows/windows-process-table.ts',
-    'src/main/worker-thread-entry-path.ts',
+    'src/main/worker-threads/worker-thread-entry-path.ts',
     'src/cli/index.ts',
     'config/scripts/runtime-serve-terminal-smoke.mjs',
     'config/scripts/build-orcad-node.mjs',

config/tsconfig.tc.web.json

@@ -85,7 +85,7 @@
     "../src/main/persistence/applying-settings/ui-state-update.ts",
     "../src/main/persistence/applying-settings/ui-selection-normalization.ts",
     "../src/main/persistence/applying-settings/ui-interaction-merge.ts",
-    "../src/main/protected-secret-persistence.ts",
+    "../src/main/credentials/protected-secret-persistence.ts",
     "../src/main/startup/serve-desktop-activation.ts",
     "../src/main/startup/serve-mode-argv.ts",
     "../src/main/startup/single-instance-lock.ts",

src/cli/handlers/profile-state-recovery-admission.test.ts

@@ -10,7 +10,7 @@ import {
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import * as durableFileWrite from '../../main/durable-file-write'
+import * as durableFileWrite from '../../main/filesystem/durable-file-write'
 import {
   acquireProfileStateMaintenance,
   acquireProfileStateRuntimeAdmission

src/cli/handlers/profile-state.test.ts

@@ -3,7 +3,7 @@ import { tmpdir } from 'node:os'
 import { basename, join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as ProcessHostModule from '@orca/process-host'
-import * as durableFileWrite from '../../main/durable-file-write'
+import * as durableFileWrite from '../../main/filesystem/durable-file-write'
 import * as http1Marker from '../../main/startup/http1-compatibility-marker'
 import { readPersistedHttp1CompatibilityMode } from '../../main/startup/http1-compatibility-profile-state'
 import {

src/cli/runtime/serve-supervisor-relocation.ts

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto'
 import { constants, readFileSync, rmSync, statSync } from 'node:fs'
 import { cp, mkdir, readdir, rename, rm, stat, writeFile } from 'node:fs/promises'
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path'
-import { cloneMacTree } from '../../main/macos-tree-clone'
+import { cloneMacTree } from '../../main/filesystem/macos-tree-clone'
 import { isProcessAlive } from '../../shared/serve-bundle-coordination'
 
 /** Relocated supervisors can no longer derive the app root from __dirname. */

src/main/acp/acp-session-events.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { getCompiledSchema } from '../zod-schema-compilation'
+import { getCompiledSchema } from '../schema-validation/zod-schema-compilation'
 import {
   SessionNotificationSchema,
   type SessionNotification

src/main/agent-hooks/installer-utils.ts

@@ -14,7 +14,7 @@ import { randomUUID } from 'node:crypto'
 import type { AgentHookSource } from '../../shared/agent-hook-relay'
 import { grantDirAcl, isPermissionError } from '../win32-utils'
 import { resolveHooksJsonWritePath } from './hook-config-write-path'
-import { writeRollingFileBackup } from '../rolling-file-backup'
+import { writeRollingFileBackup } from '../filesystem/rolling-file-backup'
 import { renameOverLockedTarget } from './locked-executable-rename'
 import {
   getWindowsNativeHookAgent,

src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events'
 import { spawnProcess } from '@orca/process-host'
 import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
-import type { WorkerRequestTransport } from '../lazy-worker-thread-host'
+import type { WorkerRequestTransport } from '../worker-threads/worker-thread-transport'
 import { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
 import {
   createOpenCodeSqliteLineDecoder,

src/main/ai-vault/session-scanner-opencode-sqlite-scan-scope.ts

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
-import type { WorkerThreadRequestOwner } from '../worker-thread-request-queue'
+import type { WorkerThreadRequestOwner } from '../worker-threads/worker-thread-request-queue'
 
 export const OPENCODE_SQLITE_SCAN_BUDGET_MS = 45_000
 

src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts

@@ -1,6 +1,6 @@
-import type { WorkerThreadFactory } from '../lazy-worker-thread-host'
+import type { WorkerThreadFactory } from '../worker-threads/worker-thread-transport'
 import { aiVaultScanIssueText } from '../../shared/ai-vault-scan-issue-copy'
-import { WorkerThreadRequestQueue } from '../worker-thread-request-queue'
+import { WorkerThreadRequestQueue } from '../worker-threads/worker-thread-request-queue'
 import type { AiVaultScanIssue, AiVaultSession } from '../../shared/ai-vault-types'
 import type {
   OpenCodeNativeChatReadRequest,

src/main/ai-vault/session-scanner-service-entry-path.ts

@@ -3,7 +3,7 @@ import {
   getForkedChildEntryPath,
   resolveForkedChildEntryPath,
   resolveForkedChildEntryPathWithoutApp
-} from '../forked-child-entry-path'
+} from '../worker-threads/forked-child-entry-path'
 
 // orcad resolves this literal beside orcad.js; build-orcad.mjs emits it from ORCAD_CHILD_ENTRY_POINTS.
 export const AI_VAULT_SERVICE_ENTRY_FILENAME = 'session-scanner-service-entry.js'

src/main/antigravity/native-account-store.ts

@@ -1,7 +1,7 @@
 import { existsSync, lstatSync, mkdirSync, readFileSync, statSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { getSecretStore } from '../../shared/secret-store'
-import { writeCredentialFileAtomic } from '../integration-credential-file'
+import { writeCredentialFileAtomic } from '../credentials/integration-credential-file'
 import type { AntigravityAccountSummary } from '../../shared/antigravity-account-types'
 import { parseAntigravityNativeCredential } from './native-credential-codec'
 import { readPrivateWindowsFile } from '../../shared/secure-path-windows-acl'

src/main/antigravity/native-file-credentials.ts

@@ -1,6 +1,6 @@
 import { existsSync, lstatSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname } from 'node:path'
-import { writeCredentialFileAtomic } from '../integration-credential-file'
+import { writeCredentialFileAtomic } from '../credentials/integration-credential-file'
 import { readPrivateWindowsFile } from '../../shared/secure-path-windows-acl'
 import { parseAntigravityNativeCredential } from './native-credential-codec'
 import type { AntigravityCredentialBackend } from './native-account-service'

src/main/bitbucket/credential-store.ts

@@ -7,9 +7,9 @@ import {
   readStoredCredentialToken,
   writeCredentialFileAtomic,
   writeEncryptedCredential
-} from '../integration-credential-file'
+} from '../credentials/integration-credential-file'
 import type { BitbucketAuthMode } from '../../shared/bitbucket-credentials'
-import { readCredentialFileProtection } from '../credential-file-protection'
+import { readCredentialFileProtection } from '../credentials/credential-file-protection'
 import type { SecretAtRestProtection } from '../../shared/secret-at-rest-protection'
 
 // Plaintext display metadata lets status reads avoid keychain prompts.

src/main/browser/__mocks__/browser-session-registry-persistence-fixture.ts

@@ -164,21 +164,26 @@ export function installModuleMocks(
     isScopedStagedCookieImport: vi.fn(() => false),
     removeCookieImportScopeMarker: vi.fn()
   }))
+  const renameFileWithWindowsRetryMock = vi.fn((source: string, target: string) => {
+    const sourceKey = fsKey(source)
+    const targetKey = fsKey(target)
+    if (!fsState.present.has(sourceKey)) {
+      throw new Error('ENOENT')
+    }
+    const value = fsState.files.get(sourceKey)
+    fsState.present.delete(sourceKey)
+    fsState.files.delete(sourceKey)
+    fsState.present.add(targetKey)
+    if (value !== undefined) {
+      fsState.files.set(targetKey, value)
+    }
+  })
+  vi.doMock('../../../shared/windows-retry-file-operations', async (importOriginal) => ({
+    ...(await importOriginal<Record<string, unknown>>()),
+    renameFileWithWindowsRetry: renameFileWithWindowsRetryMock
+  }))
   vi.doMock('../../codex-accounts/fs-utils', () => ({
-    renameFileWithWindowsRetry: vi.fn((source: string, target: string) => {
-      const sourceKey = fsKey(source)
-      const targetKey = fsKey(target)
-      if (!fsState.present.has(sourceKey)) {
-        throw new Error('ENOENT')
-      }
-      const value = fsState.files.get(sourceKey)
-      fsState.present.delete(sourceKey)
-      fsState.files.delete(sourceKey)
-      fsState.present.add(targetKey)
-      if (value !== undefined) {
-        fsState.files.set(targetKey, value)
-      }
-    }),
+    renameFileWithWindowsRetry: renameFileWithWindowsRetryMock,
     writeFileAtomically: vi.fn((pathValue: string, data: string) => {
       const key = fsKey(pathValue)
       fsState.files.set(key, data)

src/main/browser/browser-host-client-identity.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, readFileSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { dirname, join } from 'node:path'
-import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../filesystem/durable-file-write'
 
 export const BROWSER_HOST_CLIENT_IDENTITY_FILE_NAME = 'browser-host-client-identity.json'
 

src/main/browser/browser-identity-mode-store.test.ts

@@ -2,11 +2,11 @@ import { mkdtempSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as DurableFileWrite from '../durable-file-write'
+import type * as DurableFileWrite from '../filesystem/durable-file-write'
 
 const mocks = vi.hoisted(() => ({ failWrite: false }))
 
-vi.mock('../durable-file-write', async (importOriginal) => {
+vi.mock('../filesystem/durable-file-write', async (importOriginal) => {
   const actual = await importOriginal<typeof DurableFileWrite>()
   return {
     ...actual,

src/main/browser/browser-identity-mode-store.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
-import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../filesystem/durable-file-write'
 import type {
   BrowserIdentityModeSetResult,
   BrowserIdentityModeSnapshot,

src/main/browser/browser-profile-site-store.ts

@@ -1,7 +1,7 @@
 import { app } from 'electron'
 import { mkdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
-import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../filesystem/durable-file-write'
 
 export type BrowserProfileSiteStore<Entry> = {
   configure: (profileDirectory: string) => void

src/main/browser/browser-route-partition-binding-store.ts

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, statSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { grantDirAcl, isPermissionError } from '../win32-utils'
-import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../filesystem/durable-file-write'
 import {
   assertBinding,
   assertStorageScope,

src/main/browser/extensions/browser-extension-native-host-process.test.ts

@@ -12,7 +12,7 @@ import {
   type NativeHostConnection
 } from './browser-extension-native-host-process'
 
-vi.mock('../../forked-child-entry-path', () => ({
+vi.mock('../../worker-threads/forked-child-entry-path', () => ({
   getForkedChildEntryPath: (fileName: string) => join(root, fileName)
 }))
 

src/main/browser/extensions/browser-extension-native-host-process.ts

@@ -6,7 +6,7 @@ import {
   forceTerminateProcessTree,
   signalProcessTree
 } from '@orca/process-host/process-tree-termination'
-import { getForkedChildEntryPath } from '../../forked-child-entry-path'
+import { getForkedChildEntryPath } from '../../worker-threads/forked-child-entry-path'
 import { NATIVE_HOST_ERRORS } from './browser-extension-native-host-errors'
 import {
   createNativeHostMessageReader,

src/main/browser/extensions/browser-extension-retired-profile-storage.ts

@@ -1,7 +1,7 @@
 import { session } from 'electron'
 import { mkdirSync, readFileSync, rmSync } from 'node:fs'
 import { dirname, join } from 'node:path'
-import { durableWriteTempPath, writeFileDurableSync } from '../../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../../filesystem/durable-file-write'
 import { getBrowserExtensionInstallStore } from './browser-extension-install-store'
 import { clearBrowserExtensionProfileSessionData } from './browser-extension-data-removal'
 

src/main/browser/extensions/browser-extension-sync-storage-store.ts

@@ -2,7 +2,7 @@ import { app } from 'electron'
 import { mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { isChromeExtensionId } from '../../../shared/browser-extension-url'
-import { durableWriteTempPath, writeFileDurableSync } from '../../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../../filesystem/durable-file-write'
 import { getBrowserExtensionProfileDataDirectory } from './browser-extension-profile-data-directory'
 
 const SYNC_STORAGE_DIRECTORY = 'sync-storage'

src/main/claude-accounts/claude-profile-setup-worker.ts

@@ -1,7 +1,10 @@
 import { existsSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { Worker } from 'node:worker_threads'
-import { currentWorkerEntryLayout, resolveWorkerThreadEntryPath } from '../worker-thread-entry-path'
+import {
+  currentWorkerEntryLayout,
+  resolveWorkerThreadEntryPath
+} from '../worker-threads/worker-thread-entry-path'
 import type { ClaudeProfileDescriptor } from './claude-profile-paths'
 import type { ClaudeProfileSetupReport } from './claude-profile-setup'
 

src/main/claude/claude-rewind-transcript.ts

@@ -3,7 +3,11 @@ import { createReadStream } from 'node:fs'
 import { rm } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import type { AgentSessionRewindFork } from '../../shared/agent-session/lifecycle/agent-session-rewind'
-import { durableWriteTempPath, renameDurable, writeTempFileDurable } from '../durable-file-write'
+import {
+  durableWriteTempPath,
+  renameDurable,
+  writeTempFileDurable
+} from '../filesystem/durable-file-write'
 import { splitTranscriptStreamLines } from '../native-chat/transcript-stream-lines'
 import { loadClaudeAgentSdk } from './claude-stream-json-connection'
 

src/main/codex-accounts/async-file-rename.test.ts

@@ -3,7 +3,7 @@ import type * as NodeFsPromises from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
-import { writeFileDurable, writeFileDurableIfCurrent } from '../durable-file-write'
+import { writeFileDurable, writeFileDurableIfCurrent } from '../filesystem/durable-file-write'
 
 const rename = vi.hoisted(() => vi.fn())
 vi.mock('node:fs/promises', async (importOriginal) => {

src/main/codex/codex-hook-hash-lookup.ts

@@ -1,5 +1,5 @@
 import { withTimeout } from '../../shared/promise-timeout-fallback'
-import { dedupeInFlightRun } from '../in-flight-run-dedupe'
+import { dedupeInFlightRun } from '../runtime/concurrency/in-flight-run-dedupe'
 import { resolveCodexCommand, resolveCodexCommandForSpawn } from '../codex-cli/command'
 import { getManagedCommand, getManagedScriptPath } from './codex-hook-definition'
 import {

src/main/codex/codex-hook-service-implementation.ts

@@ -2,7 +2,7 @@ import { win32 as pathWin32 } from 'node:path'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import { normalizeRuntimePathForComparison } from '../../shared/cross-platform-path'
-import { dedupeInFlightRun } from '../in-flight-run-dedupe'
+import { dedupeInFlightRun } from '../runtime/concurrency/in-flight-run-dedupe'
 import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import { writeManagedScript } from '../agent-hooks/installer-utils'
 import { getOrcaManagedCodexHomePath } from './codex-home-paths'

src/main/codex/config-toml-atomic-write.ts

@@ -10,7 +10,7 @@ import {
 } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { renameFileWithWindowsRetry } from '../codex-accounts/fs-utils'
-import { writeRollingFileBackup } from '../rolling-file-backup'
+import { writeRollingFileBackup } from '../filesystem/rolling-file-backup'
 
 export function writeTomlConfigAtomically(configPath: string, contents: string): void {
   const writePath = resolveTomlWritePath(configPath)

src/main/computer/sidecar-client.ts

@@ -14,7 +14,7 @@ import {
 import { isComputerSidecarDiagnostic, logComputerDiagnostic } from './computer-sidecar-diagnostics'
 import { validateComputerSidecarPasteText } from './computer-sidecar-paste-validation'
 import { RuntimeClientError } from './runtime-client-error'
-import { getForkedChildEntryPath } from '../forked-child-entry-path'
+import { getForkedChildEntryPath } from '../worker-threads/forked-child-entry-path'
 
 // Bundled beside orcad.js on servers and under out/main on desktop.
 export const COMPUTER_SIDECAR_ENTRY_FILENAME = 'computer-sidecar.js'

src/main/credentials/credential-file-protection.ts

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import {
   classifyUnenvelopedCredential,
   type SecretAtRestProtection
-} from '../shared/secret-at-rest-protection'
+} from '../../shared/secret-at-rest-protection'
 
 /** Classify unenveloped token/ciphertext bytes without decrypting or prompting for the keychain. */
 export function readCredentialFileProtection(path: string): SecretAtRestProtection | null {

src/main/credentials/integration-credential-file.ts

@@ -9,13 +9,13 @@ import {
   unlinkSync,
   writeSync
 } from 'node:fs'
-import { getSecretStore } from '../shared/secret-store'
-import { fsyncFileSync } from '../shared/secure-file'
-import { writeRestrictedWindowsFile } from '../shared/secure-path-windows-acl'
+import { getSecretStore } from '../../shared/secret-store'
+import { fsyncFileSync } from '../../shared/secure-file'
+import { writeRestrictedWindowsFile } from '../../shared/secure-path-windows-acl'
 import {
   credentialDecryptionMessage,
   type IntegrationCredentialService
-} from '../shared/integration-credential-errors'
+} from '../../shared/integration-credential-errors'
 
 // Empty files mean no saved credential; keep status consistent with token reads.
 export function credentialFileHasContent(path: string): boolean {

src/main/credentials/integration-state-file-cache.ts

@@ -1,5 +1,5 @@
 import { statSync } from 'node:fs'
-import { fileStatSignature } from './file-stat-signature'
+import { fileStatSignature } from '../filesystem/file-stat-signature'
 
 export type IntegrationStateFileCache<T> = {
   get(): T

src/main/credentials/integration-token-file-cache.test.ts

@@ -2,7 +2,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { setSecretStore } from '../shared/secret-store'
+import { setSecretStore } from '../../shared/secret-store'
 import { createIntegrationTokenFileCache } from './integration-token-file-cache'
 
 let directory = ''

src/main/credentials/integration-token-file-cache.ts

@@ -1,5 +1,5 @@
 import { readFileSync } from 'node:fs'
-import type { IntegrationCredentialService } from '../shared/integration-credential-errors'
+import type { IntegrationCredentialService } from '../../shared/integration-credential-errors'
 import {
   CredentialDecryptionError,
   credentialFileHasContent,

src/main/credentials/protected-secret-persistence-concurrency.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { setSecretStore } from '../shared/secret-store'
+import { setSecretStore } from '../../shared/secret-store'
 import {
   ProtectedSecretPersistence,
   type ProtectedSecretRetentionUpdate

src/main/credentials/protected-secret-persistence.test.ts

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it } from 'vitest'
-import { setSecretStore } from '../shared/secret-store'
+import { setSecretStore } from '../../shared/secret-store'
 
 const cipherState = { available: true }
 

src/main/credentials/protected-secret-persistence.ts

@@ -1,4 +1,4 @@
-import { getSecretStore } from '../shared/secret-store'
+import { getSecretStore } from '../../shared/secret-store'
 
 export const PROTECTED_SECRET_SLOT = {
   opencodeSessionCookie: 'settings.opencodeSessionCookie',

src/main/daemon/automatic-work-run-marker-store.ts

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs'
 import { uptime } from 'node:os'
-import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../filesystem/durable-file-write'
 import type { AutomaticWorkMode } from '../../shared/host-spawn-admission'
 import {
   decideStartupAutomaticWorkMode,

src/main/daemon/daemon-host-file-hash-cache.ts

@@ -1,8 +1,8 @@
 import { createHash } from 'node:crypto'
 import { readFileSync, statSync } from 'node:fs'
-import { fileStatSignature } from '../file-stat-signature'
+import { fileStatSignature } from '../filesystem/file-stat-signature'
 
-export { fileStatSignature as daemonHostFileStatSignature } from '../file-stat-signature'
+export { fileStatSignature as daemonHostFileStatSignature } from '../filesystem/file-stat-signature'
 
 // Metadata validation avoids rereading unchanged daemon code on the main thread.
 const cachedHashes = new Map<string, { signature: string; sha256: string }>()

src/main/daemon/history-manager.test.ts

@@ -12,7 +12,7 @@ import {
   writeFileSync
 } from 'node:fs'
 import { HistoryManager } from './history-manager'
-import * as hostTreeRemoval from '../host-tree-removal'
+import * as hostTreeRemoval from '../filesystem/host-tree-removal'
 import { flushPendingSessionTreeRemovals } from './terminal-history-session-tombstone'
 import type { TerminalSnapshot, TerminalModes } from './types'
 import { getHistorySessionDirName } from './history-paths'

src/main/daemon/legacy-restore-records.ts

@@ -1,5 +1,5 @@
 import { readFileSync } from 'node:fs'
-import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { durableWriteTempPath, writeFileDurableSync } from '../filesystem/durable-file-write'
 import type { LegacyRestoreRecord } from '../../shared/host-spawn-admission'
 import { DEFAULT_MAX_HOST_TERMINALS } from './host-terminal-ledger'
 

src/main/daemon/macos-daemon-bundle-retirement.ts

@@ -1,7 +1,7 @@
 import { readdir } from 'node:fs/promises'
 import { join } from 'node:path'
 import { runProcess } from '@orca/process-host'
-import { rm } from '../asar-transparent-fs'
+import { rm } from '../filesystem/asar-transparent-fs'
 import { macDaemonCopyBundlePath } from './macos-daemon-bundle'
 
 const LSREGISTER =

src/main/daemon/macos-daemon-bundle.ts

@@ -2,8 +2,8 @@ import { existsSync } from 'node:fs'
 import { mkdir, mkdtemp, realpath, rename } from 'node:fs/promises'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { runProcess } from '@orca/process-host'
-import { cloneMacTree } from '../macos-tree-clone'
-import { rm } from '../asar-transparent-fs'
+import { cloneMacTree } from '../filesystem/macos-tree-clone'
+import { rm } from '../filesystem/asar-transparent-fs'
 import { ensurePrivateDir } from './daemon-private-file-modes'
 import { inspectMacProcessCodeIdentity } from './daemon-mac-code-identity'
 

src/main/daemon/macos-daemon-launchd.ts

@@ -5,7 +5,7 @@ import { getAppEnvironment } from '../../shared/app-environment'
 import { LOCAL_BUILD_COMPATIBILITY_CONTRACT } from '../../shared/local-build-compatibility-contract'
 import { NODE_RUNTIME_DARWIN_MINIMUM_OS } from '../../shared/node-runtime-pin'
 import { runProcess } from '@orca/process-host'
-import { rm } from '../asar-transparent-fs'
+import { rm } from '../filesystem/asar-transparent-fs'
 import { compareDottedVersions } from '../orcad/native-host-abi'
 import { DaemonClient } from './client'
 import { DaemonEndpointOwnershipError, holdDaemonAdoptionLease } from './daemon-endpoint-adoption'

src/main/daemon/terminal-history-session-tombstone-retry.test.ts

@@ -7,7 +7,7 @@ const { removeHostTreeMock } = vi.hoisted(() => ({
   removeHostTreeMock: vi.fn<(dir: string) => Promise<void>>()
 }))
 
-vi.mock('../host-tree-removal', () => ({
+vi.mock('../filesystem/host-tree-removal', () => ({
   removeHostTree: removeHostTreeMock
 }))
 

src/main/daemon/terminal-history-session-tombstone.ts

@@ -3,7 +3,7 @@
 import { randomUUID } from 'node:crypto'
 import { existsSync, readdirSync, renameSync } from 'node:fs'
 import { join } from 'node:path'
-import { removeHostTree } from '../host-tree-removal'
+import { removeHostTree } from '../filesystem/host-tree-removal'
 import { ensurePrivateDir } from './daemon-private-file-modes'
 import { getHistorySessionDirName } from './history-paths'
 import { getTerminalHistoryQuarantineOwnerDir } from './terminal-history-recovery-quarantine'

src/main/filesystem/destination-serialized-local-rename.test.ts

@@ -28,8 +28,8 @@ vi.mock('fs/promises', async () => {
 })
 
 import { renameLocalPathSerializedByDestination } from './destination-serialized-local-rename'
-import { registerFilesystemMutationHandlers } from './ipc/filesystem/filesystem-mutations'
-import { RuntimeFileCommands } from './runtime/orca-runtime-files'
+import { registerFilesystemMutationHandlers } from '../ipc/filesystem/filesystem-mutations'
+import { RuntimeFileCommands } from '../runtime/orca-runtime-files'
 
 const REPO_PATH = path.resolve('/workspace/repo')
 const store = {

src/main/filesystem/destination-serialized-local-rename.ts

@@ -1,7 +1,7 @@
 import { realpath, rename } from 'node:fs/promises'
 import { dirname, normalize } from 'node:path'
-import { assertNoClobberRenameDestinationAvailable } from '../shared/filesystem-rename-collision'
-import { windowsFsPath } from './wsl/wsl-unc-drive-fs-path'
+import { assertNoClobberRenameDestinationAvailable } from '../../shared/filesystem-rename-collision'
+import { windowsFsPath } from '../wsl/wsl-unc-drive-fs-path'
 
 // Parent-scoped serialization covers Unicode aliases without guessing filesystem collation.
 const pendingRenamesByParent = new Map<string, Promise<void>>()

src/main/filesystem/durable-file-write.ts

@@ -3,11 +3,11 @@
 import { closeSync, fsyncSync, openSync, rmSync, writeFileSync } from 'node:fs'
 import { open, readdir, rm, stat } from 'node:fs/promises'
 import { basename, dirname, join } from 'node:path'
+import { publishFileWithoutOverwrite } from '../codex-accounts/fs-utils'
 import {
-  publishFileWithoutOverwrite,
   renameFileWithWindowsRetry,
   renameFileWithWindowsRetryAsync
-} from './codex-accounts/fs-utils'
+} from '../../shared/windows-retry-file-operations'
 
 /** Persist directory changes where supported; Windows and some filesystems reject directory fsync. */
 async function syncDirectory(directory: string): Promise<void> {

src/main/filesystem/host-tree-removal-asar.electron.test.ts

@@ -11,7 +11,7 @@ import { createRequire, isBuiltin } from 'node:module'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { afterAll, describe, expect, it } from 'vitest'
-import { removeTreeSync } from '../shared/windows-transient-lock-removal'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 
 /** Electron’s asar fs shim makes recursive removal fail; plain Node cannot reproduce it. */
 const requireFromTest = createRequire(import.meta.url)
@@ -67,7 +67,7 @@ async function bundleHostTreeRemoval(outFile: string): Promise<void> {
       minify: false,
       ssr: true,
       rollupOptions: {
-        input: 'src/main/host-tree-removal.ts',
+        input: 'src/main/filesystem/host-tree-removal.ts',
         // Match production externals: externalizing original-fs here could hide a bundling regression.
         output: { format: 'cjs' },
         external: (id: string) => isBuiltin(id) || id === 'electron' || id.startsWith('electron/')

src/main/filesystem/host-tree-removal.ts

@@ -1,13 +1,13 @@
 // Host deletion needs bounded Windows lock retries and unpatched fs for Electron’s .asar handling.
 
-import { getErrorCode } from './git/worktree-operation-options'
-import { unregisteredFolderRefusal } from '../shared/worktree/removal'
+import { getErrorCode } from '../git/worktree-operation-options'
+import { unregisteredFolderRefusal } from '../../shared/worktree/removal'
 import { join, win32 } from 'node:path'
 import { lstat, readdir, rm, rmdir, unlink } from './asar-transparent-fs'
-import { isWindowsAbsolutePathLike } from '../shared/cross-platform-path'
-import { isWslUncPath } from '../shared/wsl-paths'
-import { stripWin32LongPathPrefix } from '../shared/windows-path-access'
-import { removeTree } from '../shared/windows-transient-lock-removal'
+import { isWindowsAbsolutePathLike } from '../../shared/cross-platform-path'
+import { isWslUncPath } from '../../shared/wsl-paths'
+import { stripWin32LongPathPrefix } from '../../shared/windows-path-access'
+import { removeTree } from '../../shared/windows-transient-lock-removal'
 
 /** Convert a native host filesystem path to the Win32 long-path namespace. */
 export function toHostFilesystemPath(targetPath: string): string {

src/main/filesystem/rolling-file-backup.ts

@@ -1,6 +1,9 @@
 import { randomUUID } from 'node:crypto'
 import { lstatSync, rmSync } from 'node:fs'
-import { copyFileWithWindowsRetry, renameFileWithWindowsRetry } from './codex-accounts/fs-utils'
+import {
+  copyFileWithWindowsRetry,
+  renameFileWithWindowsRetry
+} from '../../shared/windows-retry-file-operations'
 
 export function writeRollingFileBackup(sourcePath: string, backupPath: string): void {
   try {

src/main/foreign-sqlite-readers/foreign-sqlite-reader-client-worker-lifecycle.test.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events'
 import { Worker } from 'node:worker_threads'
 import { afterEach, describe, expect, it } from 'vitest'
-import type { WorkerRequestTransport } from '../lazy-worker-thread-host'
+import type { WorkerRequestTransport } from '../worker-threads/worker-thread-transport'
 import { ForeignSqliteReaderClient } from './foreign-sqlite-reader-client'
 
 const FAILURE = { status: 'error', error: 'Unable to read the Cursor desktop login' }

src/main/foreign-sqlite-readers/foreign-sqlite-reader-client.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
-import type { WorkerRequestTransport } from '../lazy-worker-thread-host'
+import type { WorkerRequestTransport } from '../worker-threads/worker-thread-transport'
 import { ForeignSqliteReaderClient, ForeignSqliteReaderLane } from './foreign-sqlite-reader-client'
 import type { ForeignSqliteReaderRequest } from './foreign-sqlite-reader-protocol'
 

src/main/foreign-sqlite-readers/foreign-sqlite-reader-client.ts

@@ -1,5 +1,5 @@
-import type { WorkerThreadFactory } from '../lazy-worker-thread-host'
-import { WorkerThreadRequestQueue } from '../worker-thread-request-queue'
+import type { WorkerThreadFactory } from '../worker-threads/worker-thread-transport'
+import { WorkerThreadRequestQueue } from '../worker-threads/worker-thread-request-queue'
 import {
   cursorProfileReadFailure,
   parseCursorProfileReadResult,

src/main/foreign-sqlite-readers/foreign-sqlite-reader-entry-path.ts

@@ -1,6 +1,9 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { resolveWorkerThreadEntryPath, type WorkerEntryLayout } from '../worker-thread-entry-path'
+import {
+  resolveWorkerThreadEntryPath,
+  type WorkerEntryLayout
+} from '../worker-threads/worker-thread-entry-path'
 
 // Electron-free: the OpenCode scanner reaches this from plain-Node processes too.
 

src/main/foreign-sqlite-readers/foreign-sqlite-reader-spawn.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { stat } from 'node:fs/promises'
 import { Worker } from 'node:worker_threads'
-import { currentWorkerEntryLayout } from '../worker-thread-entry-path'
+import { currentWorkerEntryLayout } from '../worker-threads/worker-thread-entry-path'
 import type { CursorDesktopProfileReadResult } from './cursor-profile-result'
 import { ForeignSqliteReaderClient } from './foreign-sqlite-reader-client'
 import { resolveForeignSqliteReaderEntryPath } from './foreign-sqlite-reader-entry-path'

src/main/git/windows-worktree-removal.ts

@@ -1,7 +1,7 @@
 import { join, resolve } from 'node:path'
 import { readFile } from 'node:fs/promises'
-import { lstat, readdir } from '../asar-transparent-fs'
-import { removeHostCheckout } from '../host-tree-removal'
+import { lstat, readdir } from '../filesystem/asar-transparent-fs'
+import { removeHostCheckout } from '../filesystem/host-tree-removal'
 import { parseWslPath } from '../wsl'
 import { CLIENT_REMOVAL_HOME } from '../worktree-removal-home-guard'
 import {

src/main/git/worktree-preparation-add.ts

@@ -2,7 +2,7 @@ import { lstat } from 'node:fs/promises'
 import { isUnsupportedWorktreeAddLockReasonError } from '../../shared/git-worktree-command-capabilities'
 import { resolveWorktreeHostPath } from '../../shared/git-metadata-path'
 import { windowsLongPathGitArgs } from '../../shared/windows-long-path-git-args'
-import { toHostFilesystemPath } from '../host-tree-removal'
+import { toHostFilesystemPath } from '../filesystem/host-tree-removal'
 import { withLocalGitCapabilityCacheForExecution } from './git-capability-state'
 import { gitExecFileAsync } from './runner'
 import {

src/main/git/worktree-preparation-discard.ts

@@ -4,7 +4,7 @@ import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
 import { resolveWorktreeHostPath } from '../../shared/git-metadata-path'
 import { findLinkedWorktreeGitDirectory } from '../../shared/git-worktree-admin'
 import { windowsLongPathGitArgs } from '../../shared/windows-long-path-git-args'
-import { toHostFilesystemPath } from '../host-tree-removal'
+import { toHostFilesystemPath } from '../filesystem/host-tree-removal'
 import { gitExecFileAsync } from './runner'
 import {
   getErrorCode,

src/main/git/worktree-preparation-lock.test.ts

@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { toHostFilesystemPath } from '../host-tree-removal'
+import { toHostFilesystemPath } from '../filesystem/host-tree-removal'
 import type * as FilePromises from 'node:fs/promises'
 
 const mocks = vi.hoisted(() => ({

src/main/git/worktree-preparation-lock.ts

@@ -2,7 +2,7 @@ import { readFile, unlink, writeFile } from 'node:fs/promises'
 import { posix, win32 } from 'node:path'
 import { isWindowsAbsolutePathLike } from '../../shared/cross-platform-path'
 import { resolveGitMetadataPath, type GitMetadataPathOptions } from '../../shared/git-metadata-path'
-import { toHostFilesystemPath } from '../host-tree-removal'
+import { toHostFilesystemPath } from '../filesystem/host-tree-removal'
 import { gitExecFileAsync } from './runner'
 import {
   getErrorCode,

src/main/git/worktree-removal-real-git.test.ts

@@ -7,7 +7,7 @@ import { join } from 'node:path'
 import { performance } from 'node:perf_hooks'
 import { promisify } from 'node:util'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import * as nativeFs from '../asar-transparent-fs'
+import * as nativeFs from '../filesystem/asar-transparent-fs'
 import * as diskFs from 'node:fs/promises'
 import * as runner from './runner'
 import {

src/main/git/worktree-removal.ts

@@ -3,7 +3,7 @@ import { pruneGitWorktrees } from './worktree-prune-guard'
 import type { RemoveWorktreeResult } from '../../shared/worktree/create-types'
 import { assertWorktreeUnlockedForRemoval } from '../../shared/worktree/removal'
 import { windowsLongPathGitArgs } from '../../shared/windows-long-path-git-args'
-import { removeHostTree } from '../host-tree-removal'
+import { removeHostTree } from '../filesystem/host-tree-removal'
 import { withSpan } from '../observability/tracer'
 import { parseWslPath } from '../wsl'
 import { gitExecFileAsync } from './runner'

src/main/github/conflict-summary-cache.ts

@@ -1,5 +1,5 @@
 import type { PRConflictSummary } from '../../shared/github/pull-request-types'
-import { dedupeInFlightRun } from '../in-flight-run-dedupe'
+import { dedupeInFlightRun } from '../runtime/concurrency/in-flight-run-dedupe'
 
 // Throttle even manual refreshes to one base fetch per minute; GitHub recomputes mergeability asynchronously.
 export const CONFLICT_SUMMARY_BASE_FETCH_WINDOW_MS = 60_000

src/main/ipc/command-path-directory-worker-client.ts

@@ -1,7 +1,11 @@
 import { existsSync } from 'node:fs'
 import { Worker } from 'node:worker_threads'
-import { LazyWorkerThreadHost, type WorkerThreadFactory } from '../lazy-worker-thread-host'
-import { currentWorkerEntryLayout, resolveWorkerThreadEntryPath } from '../worker-thread-entry-path'
+import { LazyWorkerThreadHost } from '../worker-threads/lazy-worker-thread-host'
+import type { WorkerThreadFactory } from '../worker-threads/worker-thread-transport'
+import {
+  currentWorkerEntryLayout,
+  resolveWorkerThreadEntryPath
+} from '../worker-threads/worker-thread-entry-path'
 import type {
   DetectionDirectoryRequest,
   DetectionDirectoryResponse

src/main/ipc/filesystem/filesystem-download-handlers.ts

@@ -2,7 +2,7 @@ import { BrowserWindow, dialog, ipcMain } from 'electron'
 import { randomUUID } from 'node:crypto'
 import { open, writeFile } from 'node:fs/promises'
 import { SshHostNotServedError } from '../../providers/ssh-host-not-served-error'
-import { sanitizeLocalDownloadFilename } from '../../local-download-filename'
+import { sanitizeLocalDownloadFilename } from './local-download-filename'
 import { abortWhenRendererGone } from '../renderer-lifetime-abort'
 import type { FilesystemHandlerContext } from './filesystem-handler-context'
 import {

src/main/ipc/filesystem/filesystem-mutations.ts

@@ -13,7 +13,7 @@ import { SshHostNotServedError } from '../../providers/ssh-host-not-served-error
 import { resolveLocalDroppedPathsForAgent } from '../dropped-path-resolution'
 import type { SshMutationExpectation } from '../../../shared/ssh-types'
 import { assertSshMutationExpectation } from '../../ssh/connection/ssh-connection-generation'
-import { renameLocalPathSerializedByDestination } from '../../destination-serialized-local-rename'
+import { renameLocalPathSerializedByDestination } from '../../filesystem/destination-serialized-local-rename'
 import { assertNotExists, rethrowWithUserMessage } from './filesystem-create-path-guards'
 import type {
   ImportItemResult,

src/main/ipc/filesystem/local-disk-write-precondition.ts

@@ -17,7 +17,7 @@ import {
 import { readlink, realpath, stat, writeFile } from 'node:fs/promises'
 import { basename, dirname, join, normalize, resolve } from 'node:path'
 import { runKeyedSerializedOperation } from '../../cli/keyed-promise-queue'
-import { serializedParentDirectoryKey } from '../../destination-serialized-local-rename'
+import { serializedParentDirectoryKey } from '../../filesystem/destination-serialized-local-rename'
 import { windowsFsPath } from '../../wsl/wsl-unc-drive-fs-path'
 import {
   assertLocalWriteTargetIsRegularFile,

src/main/ipc/filesystem/watcher-process/parcel-watcher-entry-path.ts

@@ -3,7 +3,7 @@ import {
   getForkedChildEntryPath,
   resolveForkedChildEntryPath,
   resolveForkedChildEntryPathWithoutApp
-} from '../../../forked-child-entry-path'
+} from '../../../worker-threads/forked-child-entry-path'
 
 const WATCHER_ENTRY_FILENAME = 'parcel-watcher-process-entry.js'
 

src/main/ipc/jira/issue-summary-generation.ts

@@ -9,7 +9,7 @@ import {
   cancelJiraIssueSummaryRequest,
   generateJiraIssueSummaryRequest
 } from '../../text-generation/jira-issue-summary-requests'
-import { addFanoutListener } from '../../event-listener-fanout'
+import { addFanoutListener } from '../../runtime/events/event-listener-fanout'
 
 export function registerJiraIssueSummaryGenerationHandlers(
   store: Pick<Store, 'getSettings'>,

src/main/ipc/renderer-lifetime-abort.ts

@@ -1,4 +1,4 @@
-import { addFanoutListeners, type FanoutEventSource } from '../event-listener-fanout'
+import { addFanoutListeners, type FanoutEventSource } from '../runtime/events/event-listener-fanout'
 
 export type RendererLifetimeSender = FanoutEventSource
 

src/main/ipc/runtime-ssh-access-handlers.ts

@@ -4,7 +4,7 @@ import {
   RuntimeSshAccessUnlinkRequestSchema
 } from '../../shared/runtime-ssh-access'
 import { linkRuntimeSshAccess, unlinkRuntimeSshAccess } from '../ssh/runtime-ssh-access'
-import { addFanoutListener } from '../event-listener-fanout'
+import { addFanoutListener } from '../runtime/events/event-listener-fanout'
 
 export function registerRuntimeSshAccessHandlers(options: {
   getUserDataPath: () => string

src/main/ipc/worktrees-removal-recovery.test.ts

@@ -6,7 +6,7 @@ import * as gitRunner from '../git/runner'
 import { removeWorktree } from '../git/worktree'
 import { removeWorktree as removeNativeWorktree } from '../git/worktree-removal'
 import { readTranslatedWorktreeGraph } from '../git/worktree-list-reader'
-import { toHostFilesystemPath } from '../host-tree-removal'
+import { toHostFilesystemPath } from '../filesystem/host-tree-removal'
 import { removeTree } from '../../shared/windows-transient-lock-removal'
 import * as scopedRootsInvalidation from './registered-worktree-roots-scoped-invalidation'
 import * as authorizedRootsCache from './registered-worktree-roots-cache'

src/main/jira/client.ts

@@ -1,5 +1,5 @@
 import { taskProviderFailure } from '../../shared/task-provider-failure'
-import { CredentialDecryptionError } from '../integration-credential-file'
+import { CredentialDecryptionError } from '../credentials/integration-credential-file'
 import type {
   JiraAuthType,
   JiraConnectArgs,

src/main/jira/site-credential-store.ts

@@ -1,13 +1,13 @@
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import { writeEncryptedCredential } from '../integration-credential-file'
-import { readCredentialFileProtection } from '../credential-file-protection'
+import { writeEncryptedCredential } from '../credentials/integration-credential-file'
+import { readCredentialFileProtection } from '../credentials/credential-file-protection'
 import type { SecretAtRestProtection } from '../../shared/secret-at-rest-protection'
 import type { JiraSite, JiraSiteSelection } from '../../shared/jira/jira-types'
-import { createIntegrationStateFileCache } from '../integration-state-file-cache'
+import { createIntegrationStateFileCache } from '../credentials/integration-state-file-cache'
 import { isJiraGatewayBaseUrl } from './gateway-base-url'
-import { createIntegrationTokenFileCache } from '../integration-token-file-cache'
+import { createIntegrationTokenFileCache } from '../credentials/integration-token-file-cache'
 
 export type JiraSiteFile = {
   version: 1

src/main/linear/client.ts

@@ -25,7 +25,7 @@ import {
   saveWorkspaceToken,
   getWorkspaceTokenProtection
 } from './linear-token-store'
-import { CredentialDecryptionError } from '../integration-credential-file'
+import { CredentialDecryptionError } from '../credentials/integration-credential-file'
 import type {
   LinearConnectionStatus,
   LinearViewer,

src/main/linear/linear-token-store.ts

@@ -1,5 +1,5 @@
 import { unlinkSync } from 'node:fs'
-import { writeEncryptedCredential } from '../integration-credential-file'
+import { writeEncryptedCredential } from '../credentials/integration-credential-file'
 import {
   LEGACY_WORKSPACE_ID,
   ensureOrcaDir,
@@ -23,7 +23,7 @@ import {
   workspaceTokenFileCache
 } from './linear-workspace-registry'
 import type { LinearWorkspace } from '../../shared/linear/workspace-types'
-import { readCredentialFileProtection } from '../credential-file-protection'
+import { readCredentialFileProtection } from '../credentials/credential-file-protection'
 import type { SecretAtRestProtection } from '../../shared/secret-at-rest-protection'
 
 export function saveWorkspaceToken(workspaceId: string, apiKey: string): void {

src/main/linear/linear-workspace-registry.ts

@@ -13,8 +13,8 @@ import {
   type LinearWorkspaceFile
 } from './linear-workspace-record'
 import type { LinearWorkspace } from '../../shared/linear/workspace-types'
-import { createIntegrationStateFileCache } from '../integration-state-file-cache'
-import { createIntegrationTokenFileCache } from '../integration-token-file-cache'
+import { createIntegrationStateFileCache } from '../credentials/integration-state-file-cache'
+import { createIntegrationTokenFileCache } from '../credentials/integration-token-file-cache'
 
 export const workspaceTokenFileCache = createIntegrationTokenFileCache({
   service: 'Linear',