Deduplicates concurrent download requests so that multiple callers for the same URL share a single HTTP operation. Thread-safe with cancellation support that does not cancel the shared operation unless all callers cancel. Extracts to a new project with zero dependencies on internal modules.

Implements a snapshot-based policy currency guard for execution approvals. Detects if the allowlist policy was tightened between the time an approval evaluation started and when it resolved, forcing re-evaluation. Uses triple-key fingerprinting (path, command, args) with early-exit optimization. Pure logic module with no framework coupling.

Provides exclusive file-based lease coordination between the AI-driven setup engine and the native UI dashboard. Uses a lock file with FileShare.None, atomic temp-file writes with SHA256 handle hashing, and time-based expiration (5 minutes). The Lease class encapsulates exclusive access with Consume, RetainForExplicitRetry, and IDisposable cleanup. Solves a common inter-process handoff pattern cleanly.

Collection of extension methods for reading values from System.Text.Json JsonElement with total non-throwing behavior. Provides GetString(), GetInt(), GetLong(), GetBool() etc. that return null/default on missing key, wrong type, or parse failure instead of throwing. Reduces exception overhead in high-throughput deserialization paths. Self-contained utility.

Implements SSRF (Server-Side Request Forgery) protection for the Canvas WebView navigation. Normalizes all IPv4/IPv6 encodings (decimal, hex, octal, mixed) and detects private/loopback addresses including CGNAT and Tailscale ranges. Pure static analysis of URI strings with no I/O or networking dependencies.