@agenthippo-ai/agenthippo 0.1.0

package/out/analytics/sessionEvents.js

@@ -0,0 +1,231 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObservableStreamEmitter = exports.SessionEventWriter = void 0;
+exports.wrapEmitterWithObservability = wrapEmitterWithObservability;
+/**
+ * Session Event Writer & Observable Stream Emitter
+ *
+ * Layer 2 of the analytics design (see PLAN/analytics-design.md):
+ * Captures agent-level events (tool calls, file edits, turn boundaries)
+ * that happen between LLM calls and are invisible to LiteLLM OTEL.
+ *
+ * Events are written to ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+ * and queryable by DuckDB alongside OTEL traces.
+ */
+const path = __importStar(require("path"));
+const fs_1 = require("fs");
+const branding_1 = require("../branding");
+const os = __importStar(require("os"));
+// -----------------------------------------------------------------------------
+// Session Event Writer
+// -----------------------------------------------------------------------------
+/**
+ * Append-only JSONL writer for session events.
+ * One file per session: ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+ *
+ * Design: write-through (no buffering). Each event appends immediately.
+ * JSONL is safe for concurrent writes and crash-safe.
+ */
+class SessionEventWriter {
+    baseDir;
+    ensuredDirs = new Set();
+    sanitizeSessionId(sessionId) {
+        const trimmed = sessionId.trim();
+        if (!trimmed) {
+            return `session-${Date.now()}`;
+        }
+        // Prevent path traversal or separator injection in filenames.
+        return trimmed.replace(/[\\/]/g, '_').replace(/\.\./g, '_');
+    }
+    constructor(baseDir) {
+        this.baseDir = baseDir ?? path.join(os.homedir(), branding_1.AGENTIDE_DIR_NAME, 'analytics', 'sessions');
+    }
+    /**
+     * Append a session event to the session's JSONL file.
+     */
+    async append(sessionId, requestId, eventType, payload) {
+        try {
+            const safeSessionId = this.sanitizeSessionId(sessionId);
+            // Ensure directory exists (cached per session to avoid repeated stat)
+            if (!this.ensuredDirs.has(safeSessionId)) {
+                await fs_1.promises.mkdir(this.baseDir, { recursive: true });
+                this.ensuredDirs.add(safeSessionId);
+            }
+            const event = {
+                session_id: sessionId,
+                request_id: requestId,
+                timestamp: Date.now(),
+                event_type: eventType,
+                payload,
+            };
+            const filePath = path.join(this.baseDir, `${safeSessionId}.jsonl`);
+            const line = JSON.stringify(event) + '\n';
+            await fs_1.promises.appendFile(filePath, line);
+        }
+        catch {
+            // Best-effort: don't crash the agent if event writing fails
+        }
+    }
+    /**
+     * Get the sessions directory path (for DuckDB queries).
+     */
+    getSessionsDir() {
+        return this.baseDir;
+    }
+}
+exports.SessionEventWriter = SessionEventWriter;
+// -----------------------------------------------------------------------------
+// Observable Stream Emitter (Decorator)
+// -----------------------------------------------------------------------------
+/**
+ * Wraps an existing StreamEmitter to capture tool events as session events.
+ * This is the bridge between engine-level streaming (what the UI sees) and
+ * analytics-level event logging (what DuckDB queries).
+ *
+ * The decorator pattern means zero changes to engine code - just wrap the
+ * emitter before passing it to engine.stream().
+ */
+class ObservableStreamEmitter {
+    inner;
+    writer;
+    sessionId;
+    requestId;
+    missingCallIdCounter = 0;
+    pendingSyntheticCallIds = new Map();
+    constructor(inner, writer, sessionId, requestId) {
+        this.inner = inner;
+        this.writer = writer;
+        this.sessionId = sessionId;
+        this.requestId = requestId;
+    }
+    makeCallIdKey(toolName) {
+        return `${this.sessionId}:${this.requestId}:${toolName}`;
+    }
+    enqueueSyntheticCallId(toolName) {
+        const key = this.makeCallIdKey(toolName);
+        const id = `synthetic-${toolName}-${++this.missingCallIdCounter}`;
+        const queue = this.pendingSyntheticCallIds.get(key) ?? [];
+        queue.push(id);
+        this.pendingSyntheticCallIds.set(key, queue);
+        return id;
+    }
+    dequeueSyntheticCallId(toolName) {
+        const key = this.makeCallIdKey(toolName);
+        const queue = this.pendingSyntheticCallIds.get(key);
+        if (!queue || queue.length === 0) {
+            return undefined;
+        }
+        const id = queue.shift();
+        if (queue.length === 0) {
+            this.pendingSyntheticCallIds.delete(key);
+        }
+        else {
+            this.pendingSyntheticCallIds.set(key, queue);
+        }
+        return id;
+    }
+    async thinking(delta) {
+        return this.inner.thinking(delta);
+    }
+    async text(delta) {
+        return this.inner.text(delta);
+    }
+    async toolStart(toolName, input, toolCallId, metadata) {
+        const loggedCallId = toolCallId?.trim()
+            ? toolCallId
+            : this.enqueueSyntheticCallId(toolName);
+        await this.writer.append(this.sessionId, this.requestId, 'tool_start', {
+            toolName,
+            callId: loggedCallId,
+            // Truncate input to avoid huge JSONL files
+            inputPreview: input?.slice(0, 500),
+        });
+        return this.inner.toolStart(toolName, input, toolCallId, metadata);
+    }
+    async toolEnd(toolName, toolCallId, result, isError, metadata) {
+        const loggedCallId = toolCallId?.trim()
+            ? toolCallId
+            : this.dequeueSyntheticCallId(toolName) ?? '';
+        await this.writer.append(this.sessionId, this.requestId, 'tool_end', {
+            toolName,
+            callId: loggedCallId,
+            isError: isError ?? false,
+            // Truncate result to avoid huge JSONL files
+            resultPreview: result?.slice(0, 500),
+        });
+        return this.inner.toolEnd(toolName, toolCallId, result, isError, metadata);
+    }
+    async progress(message) {
+        return this.inner.progress(message);
+    }
+    async question(payload) {
+        return this.inner.question(payload);
+    }
+    async error(message) {
+        await this.writer.append(this.sessionId, this.requestId, 'error', {
+            message,
+        });
+        return this.inner.error(message);
+    }
+    async done() {
+        return this.inner.done();
+    }
+    /**
+     * Emit a turn_start event. Call at the beginning of stream().
+     */
+    async emitTurnStart() {
+        await this.writer.append(this.sessionId, this.requestId, 'turn_start', {});
+    }
+    /**
+     * Emit a turn_end event. Call at the end of stream().
+     */
+    async emitTurnEnd(success) {
+        await this.writer.append(this.sessionId, this.requestId, 'turn_end', {
+            success,
+        });
+    }
+}
+exports.ObservableStreamEmitter = ObservableStreamEmitter;
+/**
+ * Create an ObservableStreamEmitter that wraps the given emitter.
+ * Returns both the wrapped emitter and emit helpers for turn boundaries.
+ */
+function wrapEmitterWithObservability(inner, writer, sessionId, requestId) {
+    return new ObservableStreamEmitter(inner, writer, sessionId, requestId);
+}

package/out/auth/bootstrapApply.js

@@ -0,0 +1,72 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEAM_BOOTSTRAP_CACHE_KEY = exports.TEAM_LAST_BOOTSTRAP_KEY = exports.TEAM_ID_KEY = exports.TEAM_MANAGED_ROUTING_KEY = exports.TEAM_MANAGED_STORE_KEY = void 0;
+exports.applyIdeBootstrap = applyIdeBootstrap;
+exports.revertTeamManagedBootstrap = revertTeamManagedBootstrap;
+exports.TEAM_MANAGED_STORE_KEY = 'agentide.teamManaged.store';
+exports.TEAM_MANAGED_ROUTING_KEY = 'agentide.teamManaged.routing';
+exports.TEAM_ID_KEY = 'agentide.team.id';
+exports.TEAM_LAST_BOOTSTRAP_KEY = 'agentide.team.lastBootstrapAt';
+exports.TEAM_BOOTSTRAP_CACHE_KEY = 'agentide.team.bootstrapCache';
+function shouldApplySetting(managedFlag, teamManagedList, key) {
+    return !managedFlag || teamManagedList.includes(key);
+}
+async function applyIdeBootstrap(bootstrap, target) {
+    const applied = [];
+    const skipped = [];
+    const teamManaged = bootstrap.policy.teamManagedSettings ?? [];
+    const storeConfig = target.getConfiguration('agentide');
+    const litellmConfig = target.getConfiguration('agentide.providers.litellm');
+    if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_STORE_KEY), teamManaged, 'store')) {
+        await storeConfig.update('storeRepo', bootstrap.store.repo, target.ConfigurationTarget.Global);
+        await storeConfig.update('store.indexUrl', bootstrap.store.indexUrl, target.ConfigurationTarget.Global);
+        await target.globalStateUpdate(exports.TEAM_MANAGED_STORE_KEY, teamManaged.includes('store'));
+        applied.push('store');
+    }
+    else {
+        skipped.push('store');
+    }
+    if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY), teamManaged, 'routing')) {
+        await litellmConfig.update('baseUrl', bootstrap.routing.litellmBaseUrl, target.ConfigurationTarget.Global);
+        if (target.setParticipantApiKey) {
+            await target.setParticipantApiKey({
+                provider: 'litellm',
+                apiKey: bootstrap.routing.litellmApiKey,
+                baseUrl: bootstrap.routing.litellmBaseUrl,
+            });
+        }
+        await target.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY, teamManaged.includes('routing'));
+        applied.push('routing');
+    }
+    else {
+        skipped.push('routing');
+    }
+    await target.globalStateUpdate(exports.TEAM_ID_KEY, bootstrap.team.id);
+    await target.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY, new Date().toISOString());
+    await target.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY, bootstrap);
+    return { applied, skipped };
+}
+async function revertTeamManagedBootstrap(target) {
+    const storeManaged = target.globalStateGet(exports.TEAM_MANAGED_STORE_KEY);
+    const routingManaged = target.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY);
+    const storeConfig = target.getConfiguration('agentide');
+    const litellmConfig = target.getConfiguration('agentide.providers.litellm');
+    if (storeManaged) {
+        await storeConfig.update('storeRepo', 'agenthippoai/agenthippo-store', target.ConfigurationTarget.Global);
+        await storeConfig.update('store.indexUrl', 'https://agenthippoai.github.io/agenthippo-store', target.ConfigurationTarget.Global);
+    }
+    if (routingManaged) {
+        await litellmConfig.update('baseUrl', '', target.ConfigurationTarget.Global);
+        if (target.setParticipantApiKey) {
+            await target.setParticipantApiKey({ provider: 'litellm', apiKey: '', baseUrl: '' });
+        }
+    }
+    await target.globalStateUpdate(exports.TEAM_MANAGED_STORE_KEY, false);
+    await target.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY, false);
+    await target.globalStateUpdate(exports.TEAM_ID_KEY, undefined);
+    await target.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY, undefined);
+    await target.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY, undefined);
+}

package/out/auth/brokerClient.js

@@ -0,0 +1,126 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuthBrokerBaseUrl = getAuthBrokerBaseUrl;
+exports.devLoginForTests = devLoginForTests;
+exports.exchangeAuthorizationCode = exchangeAuthorizationCode;
+exports.refreshAccessToken = refreshAccessToken;
+exports.fetchBootstrapRefresh = fetchBootstrapRefresh;
+exports.fetchBootstrap = fetchBootstrap;
+exports.fetchMe = fetchMe;
+exports.buildAuthorizeUrl = buildAuthorizeUrl;
+exports.completeDevPkceLogin = completeDevPkceLogin;
+const types_js_1 = require("./types.js");
+const pkce_js_1 = require("./pkce.js");
+function getAuthBrokerBaseUrl(configured) {
+    const fromEnv = process.env.AGENTHIPPO_AUTH_BASE_URL?.trim();
+    const value = configured?.trim() || fromEnv || 'https://auth.agenthippo.ai';
+    return value.replace(/\/+$/, '');
+}
+async function devLoginForTests(baseUrl, email, redirectUri, codeChallenge) {
+    const res = await fetch(`${baseUrl}/oauth/dev/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            email,
+            client_id: types_js_1.AUTH_CLIENT_ID,
+            redirect_uri: redirectUri,
+            code_challenge: codeChallenge,
+        }),
+    });
+    if (!res.ok) {
+        throw new Error(`dev login failed: ${res.status}`);
+    }
+    const json = await res.json();
+    return json.code;
+}
+async function exchangeAuthorizationCode(baseUrl, code, redirectUri, codeVerifier) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: types_js_1.AUTH_CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier,
+    });
+    const res = await fetch(`${baseUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`token exchange failed: ${res.status} ${text}`);
+    }
+    return res.json();
+}
+async function refreshAccessToken(baseUrl, refreshToken) {
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: types_js_1.AUTH_CLIENT_ID,
+        refresh_token: refreshToken,
+        scope: types_js_1.AUTH_SCOPES.join(' '),
+    });
+    const res = await fetch(`${baseUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`refresh failed: ${res.status} ${text}`.trim());
+    }
+    return res.json();
+}
+async function fetchBootstrapRefresh(baseUrl, accessToken) {
+    const res = await fetch(`${baseUrl}/api/ide/bootstrap/refresh`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`bootstrap refresh failed: ${res.status} ${text}`.trim());
+    }
+    return res.json();
+}
+async function fetchBootstrap(baseUrl, accessToken) {
+    const res = await fetch(`${baseUrl}/api/ide/bootstrap`, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`bootstrap failed: ${res.status} ${text}`.trim());
+    }
+    return res.json();
+}
+async function fetchMe(baseUrl, accessToken) {
+    const res = await fetch(`${baseUrl}/api/ide/me`, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`me failed: ${res.status} ${text}`.trim());
+    }
+    return res.json();
+}
+function buildAuthorizeUrl(baseUrl, redirectUri, codeChallenge, state, loginHint) {
+    const url = new URL(`${baseUrl}/oauth/authorize`);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', types_js_1.AUTH_CLIENT_ID);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('scope', types_js_1.AUTH_SCOPES.join(' '));
+    url.searchParams.set('state', state);
+    if (loginHint) {
+        url.searchParams.set('login_hint', loginHint);
+    }
+    return url.toString();
+}
+async function completeDevPkceLogin(baseUrl, email, redirectUri = 'agenthippo://auth/callback') {
+    const verifier = (0, pkce_js_1.generateCodeVerifier)();
+    const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
+    const code = await devLoginForTests(baseUrl, email, redirectUri, challenge);
+    return exchangeAuthorizationCode(baseUrl, code, redirectUri, verifier);
+}

package/out/auth/callbackUri.js

@@ -0,0 +1,59 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAuthCallbackUri = buildAuthCallbackUri;
+exports.resolveAuthRedirectUri = resolveAuthRedirectUri;
+exports.isAuthCallbackUri = isAuthCallbackUri;
+const vscode = __importStar(require("vscode"));
+const types_js_1 = require("./types.js");
+const callbackUriParse_js_1 = require("./callbackUriParse.js");
+/** VS Code / Cursor URI handler requires authority === extension id (e.g. agenthippo.agenthippo). */
+function buildAuthCallbackUri() {
+    return vscode.Uri.from({
+        scheme: vscode.env.uriScheme,
+        authority: types_js_1.AUTH_EXTENSION_AUTHORITY,
+        path: types_js_1.AUTH_CALLBACK_PATH,
+    });
+}
+async function resolveAuthRedirectUri() {
+    const external = await vscode.env.asExternalUri(buildAuthCallbackUri());
+    return external.toString(true);
+}
+function isAuthCallbackUri(uri) {
+    return (0, callbackUriParse_js_1.isAuthCallbackParts)(uri.authority, uri.path);
+}

package/out/auth/callbackUriParse.js

@@ -0,0 +1,59 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAuthCallback = parseAuthCallback;
+exports.parseAuthCallbackFromText = parseAuthCallbackFromText;
+exports.isAuthCallbackParts = isAuthCallbackParts;
+exports.parseAuthCallbackFromLoopbackUrl = parseAuthCallbackFromLoopbackUrl;
+const types_js_1 = require("./types.js");
+function parseAuthCallback(uri, expectedState) {
+    if (uri.authority !== types_js_1.AUTH_EXTENSION_AUTHORITY || uri.path !== types_js_1.AUTH_CALLBACK_PATH) {
+        return undefined;
+    }
+    const params = new URLSearchParams(uri.query);
+    const code = params.get('code');
+    const state = params.get('state');
+    if (!code || state !== expectedState) {
+        return undefined;
+    }
+    return code;
+}
+/** Accept pasted redirect URL when the OS does not hand off to the IDE automatically. */
+function parseAuthCallbackFromText(text, expectedState) {
+    const trimmed = text.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    try {
+        const url = new URL(trimmed);
+        return parseAuthCallback({ authority: url.host, path: url.pathname, query: url.search.replace(/^\?/, '') }, expectedState);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isAuthCallbackParts(authority, path) {
+    return authority === types_js_1.AUTH_EXTENSION_AUTHORITY && path === types_js_1.AUTH_CALLBACK_PATH;
+}
+function parseAuthCallbackFromLoopbackUrl(text, expectedState) {
+    try {
+        const url = new URL(text.trim());
+        if (url.hostname !== '127.0.0.1' && url.hostname !== 'localhost') {
+            return undefined;
+        }
+        if (url.pathname !== '/callback') {
+            return undefined;
+        }
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
+        if (!code || state !== expectedState) {
+            return undefined;
+        }
+        return code;
+    }
+    catch {
+        return undefined;
+    }
+}

package/out/auth/githubStoreGate.js

@@ -0,0 +1,70 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedBootstrap = getCachedBootstrap;
+exports.ensureGitHubStoreAccess = ensureGitHubStoreAccess;
+const vscode = __importStar(require("vscode"));
+const bootstrapApply_js_1 = require("./bootstrapApply.js");
+const github_js_1 = require("../agentpack/github.js");
+function getCachedBootstrap(globalState) {
+    return globalState.get(bootstrapApply_js_1.TEAM_BOOTSTRAP_CACHE_KEY);
+}
+/**
+ * When team bootstrap sets store.githubOrg, require a GitHub session before store mutations.
+ */
+async function ensureGitHubStoreAccess(context) {
+    const bootstrap = getCachedBootstrap(context.globalState);
+    const githubOrg = bootstrap?.store.githubOrg?.trim();
+    if (!githubOrg) {
+        return;
+    }
+    if (await (0, github_js_1.isGitHubAuthenticated)()) {
+        try {
+            await (0, github_js_1.getGitHubToken)(false, ['read:user', 'repo']);
+            return;
+        }
+        catch {
+            // fall through to prompt
+        }
+    }
+    const action = await vscode.window.showWarningMessage(`Team store is tied to GitHub org "${githubOrg}". Connect GitHub to install or publish.`, 'Connect GitHub', 'Cancel');
+    if (action !== 'Connect GitHub') {
+        throw new Error('GitHub connection required for team store access.');
+    }
+    await (0, github_js_1.getGitHubToken)(true, ['read:user', 'repo']);
+}