@akon-labs/nexus-cli 0.1.0

package/dist/core/usage-totals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-totals.js","sourceRoot":"","sources":["../../src/core/usage-totals.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,iBAAiB,GAAgB;IAChD,OAAO;QACN,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,CAAC;KACP,CAAC;AAAA,CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,KAAY,EAAQ;IACzE,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IAC5B,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IAC9B,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC;IACpC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;IACtC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;AAAA,CAChC;AAQD,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,OAAuB,EAA6B;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAuB,CAAC;QAC5B,IAAI,KAAwB,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxF,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnG,GAAG,GAAG,iBAAiB,CAAC;YACxB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5F,GAAG,GAAG,iBAAiB,CAAC;YACxB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;YAAE,SAAS;QAE7B,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,GAAG,iBAAiB,EAAE,CAAC;YAC7B,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,GAAG;QACH,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU;KAC3E,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACrD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AAAA,CAClC","sourcesContent":["import type { Usage } from \"@earendil-works/pi-ai/compat\";\nimport type { SessionEntry } from \"./session-manager.ts\";\n\nexport interface UsageTotals {\n\tinput: number;\n\toutput: number;\n\tcacheRead: number;\n\tcacheWrite: number;\n\tcost: number;\n}\n\nexport function createUsageTotals(): UsageTotals {\n\treturn {\n\t\tinput: 0,\n\t\toutput: 0,\n\t\tcacheRead: 0,\n\t\tcacheWrite: 0,\n\t\tcost: 0,\n\t};\n}\n\nexport function addUsageToTotals(totals: UsageTotals, usage: Usage): void {\n\ttotals.input += usage.input;\n\ttotals.output += usage.output;\n\ttotals.cacheRead += usage.cacheRead;\n\ttotals.cacheWrite += usage.cacheWrite;\n\ttotals.cost += usage.cost.total;\n}\n\nexport interface UsageCostBreakdownEntry {\n\tkey: string;\n\tcost: number;\n\ttokens: number;\n}\n\n/** Group attributable assistant usage by model and all other usage into a separate bucket. */\nexport function getUsageCostBreakdown(entries: SessionEntry[]): UsageCostBreakdownEntry[] {\n\tconst totalsByKey = new Map<string, UsageTotals>();\n\n\tfor (const entry of entries) {\n\t\tlet key: string | undefined;\n\t\tlet usage: Usage | undefined;\n\t\tif (entry.type === \"message\" && entry.message.role === \"assistant\") {\n\t\t\tkey = `${entry.message.provider}/${entry.message.responseModel ?? entry.message.model}`;\n\t\t\tusage = entry.message.usage;\n\t\t} else if (entry.type === \"message\" && entry.message.role === \"toolResult\" && entry.message.usage) {\n\t\t\tkey = \"Tools/summaries\";\n\t\t\tusage = entry.message.usage;\n\t\t} else if ((entry.type === \"branch_summary\" || entry.type === \"compaction\") && entry.usage) {\n\t\t\tkey = \"Tools/summaries\";\n\t\t\tusage = entry.usage;\n\t\t}\n\t\tif (!key || !usage) continue;\n\n\t\tlet totals = totalsByKey.get(key);\n\t\tif (!totals) {\n\t\t\ttotals = createUsageTotals();\n\t\t\ttotalsByKey.set(key, totals);\n\t\t}\n\t\taddUsageToTotals(totals, usage);\n\t}\n\n\treturn Array.from(totalsByKey, ([key, totals]) => ({\n\t\tkey,\n\t\tcost: totals.cost,\n\t\ttokens: totals.input + totals.output + totals.cacheRead + totals.cacheWrite,\n\t}))\n\t\t.filter((entry) => entry.cost > 0 || entry.tokens > 0)\n\t\t.sort((a, b) => b.cost - a.cost);\n}\n"]}

package/dist/extensions/gitnexus/augment.d.ts

@@ -0,0 +1,4 @@
+import type { ExtensionAPI } from "../../core/extensions/types.ts";
+import { GitNexusClient } from "./client.ts";
+export declare function registerAugmentedGrep(pi: ExtensionAPI, cwd: string, getClient: () => GitNexusClient | undefined, currentRepo: () => string | undefined): void;
+//# sourceMappingURL=augment.d.ts.map

package/dist/extensions/gitnexus/augment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"augment.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/augment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAe7C,wBAAgB,qBAAqB,CACpC,EAAE,EAAE,YAAY,EAChB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,cAAc,GAAG,SAAS,EAC3C,WAAW,EAAE,MAAM,MAAM,GAAG,SAAS,GACnC,IAAI,CAiDN","sourcesContent":["import type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { createGrepToolDefinition } from \"../../core/tools/index.ts\";\nimport { GitNexusClient } from \"./client.ts\";\n\n/**\n * native_augment: enrich grep results with graph context, mirroring the\n * Claude Code plugin's PreToolUse hook (gitnexus-claude-plugin/hooks) — except\n * the context comes from the hub, not a local .gitnexus DB.\n *\n * Conservative by design: pattern >= 3 chars, one augment per unique pattern\n * per session, ~3s budget, silent on any failure.\n */\n\nconst AUGMENT_TIMEOUT_MS = 3_000;\nconst AUGMENT_MAX_CHARS = 1_500;\nconst MIN_PATTERN_LENGTH = 3;\n\nexport function registerAugmentedGrep(\n\tpi: ExtensionAPI,\n\tcwd: string,\n\tgetClient: () => GitNexusClient | undefined,\n\tcurrentRepo: () => string | undefined,\n): void {\n\tconst seenPatterns = new Set<string>();\n\tconst grep = createGrepToolDefinition(cwd);\n\n\tpi.registerTool({\n\t\t...grep,\n\t\texecute: async (id, params, signal, onUpdate, ctx) => {\n\t\t\tconst result = await grep.execute(id, params, signal, onUpdate, ctx);\n\t\t\ttry {\n\t\t\t\tconst client = getClient();\n\t\t\t\tconst repo = currentRepo();\n\t\t\t\tconst pattern = String((params as { pattern?: unknown })?.pattern ?? \"\").trim();\n\t\t\t\tif (!client || !repo || pattern.length < MIN_PATTERN_LENGTH || seenPatterns.has(pattern)) return result;\n\t\t\t\tseenPatterns.add(pattern);\n\n\t\t\t\tconst abort = new AbortController();\n\t\t\t\tconst timer = setTimeout(() => abort.abort(), AUGMENT_TIMEOUT_MS);\n\t\t\t\tlet graphText: string;\n\t\t\t\ttry {\n\t\t\t\t\tconst hubResult = await client.callTool(\n\t\t\t\t\t\t\"query\",\n\t\t\t\t\t\t{ query: pattern, repo, limit: 2, max_symbols: 5 },\n\t\t\t\t\t\tabort.signal,\n\t\t\t\t\t);\n\t\t\t\t\tgraphText = GitNexusClient.text(hubResult);\n\t\t\t\t} finally {\n\t\t\t\t\tclearTimeout(timer);\n\t\t\t\t}\n\t\t\t\tif (!graphText.trim()) return result;\n\n\t\t\t\tconst trimmed =\n\t\t\t\t\tgraphText.length > AUGMENT_MAX_CHARS\n\t\t\t\t\t\t? `${graphText.slice(0, AUGMENT_MAX_CHARS)}\\n…(truncated)`\n\t\t\t\t\t\t: graphText;\n\t\t\t\treturn {\n\t\t\t\t\t...result,\n\t\t\t\t\tcontent: [\n\t\t\t\t\t\t...result.content,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\ttext: `\\n── GitNexus graph context for \"${pattern}\" (${repo}) ──\\n${trimmed}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t};\n\t\t\t} catch {\n\t\t\t\treturn result; // augmentation must never break grep\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/extensions/gitnexus/augment.js

@@ -0,0 +1,60 @@
+import { createGrepToolDefinition } from "../../core/tools/index.js";
+import { GitNexusClient } from "./client.js";
+/**
+ * native_augment: enrich grep results with graph context, mirroring the
+ * Claude Code plugin's PreToolUse hook (gitnexus-claude-plugin/hooks) — except
+ * the context comes from the hub, not a local .gitnexus DB.
+ *
+ * Conservative by design: pattern >= 3 chars, one augment per unique pattern
+ * per session, ~3s budget, silent on any failure.
+ */
+const AUGMENT_TIMEOUT_MS = 3_000;
+const AUGMENT_MAX_CHARS = 1_500;
+const MIN_PATTERN_LENGTH = 3;
+export function registerAugmentedGrep(pi, cwd, getClient, currentRepo) {
+    const seenPatterns = new Set();
+    const grep = createGrepToolDefinition(cwd);
+    pi.registerTool({
+        ...grep,
+        execute: async (id, params, signal, onUpdate, ctx) => {
+            const result = await grep.execute(id, params, signal, onUpdate, ctx);
+            try {
+                const client = getClient();
+                const repo = currentRepo();
+                const pattern = String(params?.pattern ?? "").trim();
+                if (!client || !repo || pattern.length < MIN_PATTERN_LENGTH || seenPatterns.has(pattern))
+                    return result;
+                seenPatterns.add(pattern);
+                const abort = new AbortController();
+                const timer = setTimeout(() => abort.abort(), AUGMENT_TIMEOUT_MS);
+                let graphText;
+                try {
+                    const hubResult = await client.callTool("query", { query: pattern, repo, limit: 2, max_symbols: 5 }, abort.signal);
+                    graphText = GitNexusClient.text(hubResult);
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+                if (!graphText.trim())
+                    return result;
+                const trimmed = graphText.length > AUGMENT_MAX_CHARS
+                    ? `${graphText.slice(0, AUGMENT_MAX_CHARS)}\n…(truncated)`
+                    : graphText;
+                return {
+                    ...result,
+                    content: [
+                        ...result.content,
+                        {
+                            type: "text",
+                            text: `\n── GitNexus graph context for "${pattern}" (${repo}) ──\n${trimmed}`,
+                        },
+                    ],
+                };
+            }
+            catch {
+                return result; // augmentation must never break grep
+            }
+        },
+    });
+}
+//# sourceMappingURL=augment.js.map

package/dist/extensions/gitnexus/augment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"augment.js","sourceRoot":"","sources":["../../../src/extensions/gitnexus/augment.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;GAOG;AAEH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,UAAU,qBAAqB,CACpC,EAAgB,EAChB,GAAW,EACX,SAA2C,EAC3C,WAAqC,EAC9B;IACP,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAE3C,EAAE,CAAC,YAAY,CAAC;QACf,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAE,MAAgC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,OAAO,MAAM,CAAC;gBACxG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE1B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAClE,IAAI,SAAiB,CAAC;gBACtB,IAAI,CAAC;oBACJ,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CACtC,OAAO,EACP,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAClD,KAAK,CAAC,MAAM,CACZ,CAAC;oBACF,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC5C,CAAC;wBAAS,CAAC;oBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;oBAAE,OAAO,MAAM,CAAC;gBAErC,MAAM,OAAO,GACZ,SAAS,CAAC,MAAM,GAAG,iBAAiB;oBACnC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,kBAAgB;oBAC1D,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO;oBACN,GAAG,MAAM;oBACT,OAAO,EAAE;wBACR,GAAG,MAAM,CAAC,OAAO;wBACjB;4BACC,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,wCAAoC,OAAO,MAAM,IAAI,aAAS,OAAO,EAAE;yBAC7E;qBACD;iBACD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,MAAM,CAAC,CAAC,qCAAqC;YACrD,CAAC;QAAA,CACD;KACD,CAAC,CAAC;AAAA,CACH","sourcesContent":["import type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { createGrepToolDefinition } from \"../../core/tools/index.ts\";\nimport { GitNexusClient } from \"./client.ts\";\n\n/**\n * native_augment: enrich grep results with graph context, mirroring the\n * Claude Code plugin's PreToolUse hook (gitnexus-claude-plugin/hooks) — except\n * the context comes from the hub, not a local .gitnexus DB.\n *\n * Conservative by design: pattern >= 3 chars, one augment per unique pattern\n * per session, ~3s budget, silent on any failure.\n */\n\nconst AUGMENT_TIMEOUT_MS = 3_000;\nconst AUGMENT_MAX_CHARS = 1_500;\nconst MIN_PATTERN_LENGTH = 3;\n\nexport function registerAugmentedGrep(\n\tpi: ExtensionAPI,\n\tcwd: string,\n\tgetClient: () => GitNexusClient | undefined,\n\tcurrentRepo: () => string | undefined,\n): void {\n\tconst seenPatterns = new Set<string>();\n\tconst grep = createGrepToolDefinition(cwd);\n\n\tpi.registerTool({\n\t\t...grep,\n\t\texecute: async (id, params, signal, onUpdate, ctx) => {\n\t\t\tconst result = await grep.execute(id, params, signal, onUpdate, ctx);\n\t\t\ttry {\n\t\t\t\tconst client = getClient();\n\t\t\t\tconst repo = currentRepo();\n\t\t\t\tconst pattern = String((params as { pattern?: unknown })?.pattern ?? \"\").trim();\n\t\t\t\tif (!client || !repo || pattern.length < MIN_PATTERN_LENGTH || seenPatterns.has(pattern)) return result;\n\t\t\t\tseenPatterns.add(pattern);\n\n\t\t\t\tconst abort = new AbortController();\n\t\t\t\tconst timer = setTimeout(() => abort.abort(), AUGMENT_TIMEOUT_MS);\n\t\t\t\tlet graphText: string;\n\t\t\t\ttry {\n\t\t\t\t\tconst hubResult = await client.callTool(\n\t\t\t\t\t\t\"query\",\n\t\t\t\t\t\t{ query: pattern, repo, limit: 2, max_symbols: 5 },\n\t\t\t\t\t\tabort.signal,\n\t\t\t\t\t);\n\t\t\t\t\tgraphText = GitNexusClient.text(hubResult);\n\t\t\t\t} finally {\n\t\t\t\t\tclearTimeout(timer);\n\t\t\t\t}\n\t\t\t\tif (!graphText.trim()) return result;\n\n\t\t\t\tconst trimmed =\n\t\t\t\t\tgraphText.length > AUGMENT_MAX_CHARS\n\t\t\t\t\t\t? `${graphText.slice(0, AUGMENT_MAX_CHARS)}\\n…(truncated)`\n\t\t\t\t\t\t: graphText;\n\t\t\t\treturn {\n\t\t\t\t\t...result,\n\t\t\t\t\tcontent: [\n\t\t\t\t\t\t...result.content,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\ttext: `\\n── GitNexus graph context for \"${pattern}\" (${repo}) ──\\n${trimmed}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t};\n\t\t\t} catch {\n\t\t\t\treturn result; // augmentation must never break grep\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/extensions/gitnexus/changes.d.ts

@@ -0,0 +1,3 @@
+import type { ExtensionAPI } from "../../core/extensions/types.ts";
+export declare function registerChangeTracking(pi: ExtensionAPI, cwd: string): void;
+//# sourceMappingURL=changes.d.ts.map

package/dist/extensions/gitnexus/changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/changes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAoBnE,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAmC1E","sourcesContent":["import type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { graphRailStore } from \"../../core/graph-rail-store.ts\";\nimport { createEditToolDefinition, createWriteToolDefinition } from \"../../core/tools/index.ts\";\n\n/**\n * Wrap the edit/write tools to record per-file diffstats for the side rail.\n * Pure observation — results pass through untouched.\n */\n\nfunction countDiff(diff: string | undefined): { added: number; removed: number } {\n\tif (!diff) return { added: 0, removed: 0 };\n\tlet added = 0;\n\tlet removed = 0;\n\tfor (const line of diff.split(\"\\n\")) {\n\t\tif (line.startsWith(\"+\") && !line.startsWith(\"+++\")) added++;\n\t\telse if (line.startsWith(\"-\") && !line.startsWith(\"---\")) removed++;\n\t}\n\treturn { added, removed };\n}\n\nexport function registerChangeTracking(pi: ExtensionAPI, cwd: string): void {\n\tconst edit = createEditToolDefinition(cwd);\n\tconst write = createWriteToolDefinition(cwd);\n\n\tpi.registerTool({\n\t\t...edit,\n\t\texecute: async (id, params, signal, onUpdate, ctx) => {\n\t\t\tconst result = await edit.execute(id, params, signal, onUpdate, ctx);\n\t\t\ttry {\n\t\t\t\tconst path = String((params as { path?: unknown })?.path ?? \"\");\n\t\t\t\tconst diff = (result.details as { diff?: string } | undefined)?.diff;\n\t\t\t\tconst { added, removed } = countDiff(diff);\n\t\t\t\tif (path && (added > 0 || removed > 0)) graphRailStore.recordChange(path, added, removed);\n\t\t\t} catch {\n\t\t\t\t// observation only\n\t\t\t}\n\t\t\treturn result;\n\t\t},\n\t});\n\n\tpi.registerTool({\n\t\t...write,\n\t\texecute: async (id, params, signal, onUpdate, ctx) => {\n\t\t\tconst result = await write.execute(id, params, signal, onUpdate, ctx);\n\t\t\ttry {\n\t\t\t\tconst p = params as { path?: unknown; content?: unknown };\n\t\t\t\tconst path = String(p?.path ?? \"\");\n\t\t\t\tconst lineCount = String(p?.content ?? \"\").split(\"\\n\").length;\n\t\t\t\tif (path) graphRailStore.recordChange(path, lineCount, 0);\n\t\t\t} catch {\n\t\t\t\t// observation only\n\t\t\t}\n\t\t\treturn result;\n\t\t},\n\t});\n}\n"]}

package/dist/extensions/gitnexus/changes.js

@@ -0,0 +1,58 @@
+import { graphRailStore } from "../../core/graph-rail-store.js";
+import { createEditToolDefinition, createWriteToolDefinition } from "../../core/tools/index.js";
+/**
+ * Wrap the edit/write tools to record per-file diffstats for the side rail.
+ * Pure observation — results pass through untouched.
+ */
+function countDiff(diff) {
+    if (!diff)
+        return { added: 0, removed: 0 };
+    let added = 0;
+    let removed = 0;
+    for (const line of diff.split("\n")) {
+        if (line.startsWith("+") && !line.startsWith("+++"))
+            added++;
+        else if (line.startsWith("-") && !line.startsWith("---"))
+            removed++;
+    }
+    return { added, removed };
+}
+export function registerChangeTracking(pi, cwd) {
+    const edit = createEditToolDefinition(cwd);
+    const write = createWriteToolDefinition(cwd);
+    pi.registerTool({
+        ...edit,
+        execute: async (id, params, signal, onUpdate, ctx) => {
+            const result = await edit.execute(id, params, signal, onUpdate, ctx);
+            try {
+                const path = String(params?.path ?? "");
+                const diff = result.details?.diff;
+                const { added, removed } = countDiff(diff);
+                if (path && (added > 0 || removed > 0))
+                    graphRailStore.recordChange(path, added, removed);
+            }
+            catch {
+                // observation only
+            }
+            return result;
+        },
+    });
+    pi.registerTool({
+        ...write,
+        execute: async (id, params, signal, onUpdate, ctx) => {
+            const result = await write.execute(id, params, signal, onUpdate, ctx);
+            try {
+                const p = params;
+                const path = String(p?.path ?? "");
+                const lineCount = String(p?.content ?? "").split("\n").length;
+                if (path)
+                    graphRailStore.recordChange(path, lineCount, 0);
+            }
+            catch {
+                // observation only
+            }
+            return result;
+        },
+    });
+}
+//# sourceMappingURL=changes.js.map

package/dist/extensions/gitnexus/changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.js","sourceRoot":"","sources":["../../../src/extensions/gitnexus/changes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEhG;;;GAGG;AAEH,SAAS,SAAS,CAAC,IAAwB,EAAsC;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,KAAK,EAAE,CAAC;aACxD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAAA,CAC1B;AAED,MAAM,UAAU,sBAAsB,CAAC,EAAgB,EAAE,GAAW,EAAQ;IAC3E,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAE7C,EAAE,CAAC,YAAY,CAAC;QACf,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,MAAM,CAAE,MAA6B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBAChE,MAAM,IAAI,GAAI,MAAM,CAAC,OAAyC,EAAE,IAAI,CAAC;gBACrE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;oBAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACR,mBAAmB;YACpB,CAAC;YACD,OAAO,MAAM,CAAC;QAAA,CACd;KACD,CAAC,CAAC;IAEH,EAAE,CAAC,YAAY,CAAC;QACf,GAAG,KAAK;QACR,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,CAAC;gBACJ,MAAM,CAAC,GAAG,MAA+C,CAAC;gBAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBAC9D,IAAI,IAAI;oBAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACR,mBAAmB;YACpB,CAAC;YACD,OAAO,MAAM,CAAC;QAAA,CACd;KACD,CAAC,CAAC;AAAA,CACH","sourcesContent":["import type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { graphRailStore } from \"../../core/graph-rail-store.ts\";\nimport { createEditToolDefinition, createWriteToolDefinition } from \"../../core/tools/index.ts\";\n\n/**\n * Wrap the edit/write tools to record per-file diffstats for the side rail.\n * Pure observation — results pass through untouched.\n */\n\nfunction countDiff(diff: string | undefined): { added: number; removed: number } {\n\tif (!diff) return { added: 0, removed: 0 };\n\tlet added = 0;\n\tlet removed = 0;\n\tfor (const line of diff.split(\"\\n\")) {\n\t\tif (line.startsWith(\"+\") && !line.startsWith(\"+++\")) added++;\n\t\telse if (line.startsWith(\"-\") && !line.startsWith(\"---\")) removed++;\n\t}\n\treturn { added, removed };\n}\n\nexport function registerChangeTracking(pi: ExtensionAPI, cwd: string): void {\n\tconst edit = createEditToolDefinition(cwd);\n\tconst write = createWriteToolDefinition(cwd);\n\n\tpi.registerTool({\n\t\t...edit,\n\t\texecute: async (id, params, signal, onUpdate, ctx) => {\n\t\t\tconst result = await edit.execute(id, params, signal, onUpdate, ctx);\n\t\t\ttry {\n\t\t\t\tconst path = String((params as { path?: unknown })?.path ?? \"\");\n\t\t\t\tconst diff = (result.details as { diff?: string } | undefined)?.diff;\n\t\t\t\tconst { added, removed } = countDiff(diff);\n\t\t\t\tif (path && (added > 0 || removed > 0)) graphRailStore.recordChange(path, added, removed);\n\t\t\t} catch {\n\t\t\t\t// observation only\n\t\t\t}\n\t\t\treturn result;\n\t\t},\n\t});\n\n\tpi.registerTool({\n\t\t...write,\n\t\texecute: async (id, params, signal, onUpdate, ctx) => {\n\t\t\tconst result = await write.execute(id, params, signal, onUpdate, ctx);\n\t\t\ttry {\n\t\t\t\tconst p = params as { path?: unknown; content?: unknown };\n\t\t\t\tconst path = String(p?.path ?? \"\");\n\t\t\t\tconst lineCount = String(p?.content ?? \"\").split(\"\\n\").length;\n\t\t\t\tif (path) graphRailStore.recordChange(path, lineCount, 0);\n\t\t\t} catch {\n\t\t\t\t// observation only\n\t\t\t}\n\t\t\treturn result;\n\t\t},\n\t});\n}\n"]}

package/dist/extensions/gitnexus/client.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Minimal Streamable-HTTP MCP client for the GitNexus hub — and only the hub.
+ *
+ * This is intentionally NOT a general MCP client: it implements exactly the
+ * subset nexus-cli needs against a single known server — initialize,
+ * notifications/initialized, tools/call — over the Streamable HTTP transport
+ * (JSON-RPC over POST; responses arrive as application/json or as a
+ * text/event-stream carrying JSON-RPC messages).
+ */
+import type { GitNexusConfig } from "./config.ts";
+export interface McpToolResult {
+    content?: Array<{
+        type: string;
+        text?: string;
+    }>;
+    isError?: boolean;
+    structuredContent?: unknown;
+}
+export declare class GitNexusClientError extends Error {
+    readonly kind: "auth" | "network" | "protocol" | "tool";
+    constructor(message: string, kind: "auth" | "network" | "protocol" | "tool");
+}
+export declare class GitNexusClient {
+    private sessionId;
+    private nextId;
+    private initializing;
+    private readonly config;
+    constructor(config: GitNexusConfig);
+    /** Call a hub tool by name. Initializes the MCP session lazily on first use. */
+    callTool(name: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<McpToolResult>;
+    /** Extract the primary text payload from an MCP tool result. */
+    static text(result: McpToolResult): string;
+    private ensureInitialized;
+    private initialize;
+    private notify;
+    private request;
+    private post;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/extensions/gitnexus/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAmBlD,MAAM,WAAW,aAAa;IAC7B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IAExD,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,EAI1E;CACD;AAKD,qBAAa,cAAc;IAC1B,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IAExC,YAAY,MAAM,EAAE,cAAc,EAEjC;IAED,gFAAgF;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAIxG;IAED,gEAAgE;IAChE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAUzC;IAED,OAAO,CAAC,iBAAiB;YAQX,UAAU;YAaV,MAAM;YAIN,OAAO;YAUP,IAAI;CA8DlB","sourcesContent":["/**\n * Minimal Streamable-HTTP MCP client for the GitNexus hub — and only the hub.\n *\n * This is intentionally NOT a general MCP client: it implements exactly the\n * subset nexus-cli needs against a single known server — initialize,\n * notifications/initialized, tools/call — over the Streamable HTTP transport\n * (JSON-RPC over POST; responses arrive as application/json or as a\n * text/event-stream carrying JSON-RPC messages).\n */\n\nimport { appendFileSync } from \"node:fs\";\nimport type { GitNexusConfig } from \"./config.ts\";\n\n/** File-based trace (NEXUS_TRACE=1): TUI captures stderr, so console won't do. */\nfunction clientTrace(message: string): void {\n\tif (!process.env.NEXUS_TRACE) return;\n\ttry {\n\t\tappendFileSync(\"/tmp/nexus-observatory-trace.log\", `${new Date().toISOString()} [client] ${message}\\n`);\n\t} catch {\n\t\t// best-effort\n\t}\n}\n\ninterface JsonRpcResponse {\n\tjsonrpc: \"2.0\";\n\tid?: number | string | null;\n\tresult?: unknown;\n\terror?: { code: number; message: string; data?: unknown };\n}\n\nexport interface McpToolResult {\n\tcontent?: Array<{ type: string; text?: string }>;\n\tisError?: boolean;\n\tstructuredContent?: unknown;\n}\n\nexport class GitNexusClientError extends Error {\n\treadonly kind: \"auth\" | \"network\" | \"protocol\" | \"tool\";\n\n\tconstructor(message: string, kind: \"auth\" | \"network\" | \"protocol\" | \"tool\") {\n\t\tsuper(message);\n\t\tthis.name = \"GitNexusClientError\";\n\t\tthis.kind = kind;\n\t}\n}\n\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst REQUEST_TIMEOUT_MS = 60_000;\n\nexport class GitNexusClient {\n\tprivate sessionId: string | undefined;\n\tprivate nextId = 1;\n\tprivate initializing: Promise<void> | undefined;\n\tprivate readonly config: GitNexusConfig;\n\n\tconstructor(config: GitNexusConfig) {\n\t\tthis.config = config;\n\t}\n\n\t/** Call a hub tool by name. Initializes the MCP session lazily on first use. */\n\tasync callTool(name: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<McpToolResult> {\n\t\tawait this.ensureInitialized(signal);\n\t\tconst result = await this.request(\"tools/call\", { name, arguments: args }, signal);\n\t\treturn (result ?? {}) as McpToolResult;\n\t}\n\n\t/** Extract the primary text payload from an MCP tool result. */\n\tstatic text(result: McpToolResult): string {\n\t\tconst parts = result.content ?? [];\n\t\tconst text = parts\n\t\t\t.filter((p) => p.type === \"text\" && typeof p.text === \"string\")\n\t\t\t.map((p) => p.text)\n\t\t\t.join(\"\\n\");\n\t\tif (result.isError) {\n\t\t\tthrow new GitNexusClientError(text || \"hub tool returned an error\", \"tool\");\n\t\t}\n\t\treturn text;\n\t}\n\n\tprivate ensureInitialized(signal?: AbortSignal): Promise<void> {\n\t\tthis.initializing ??= this.initialize(signal).catch((error) => {\n\t\t\tthis.initializing = undefined;\n\t\t\tthrow error;\n\t\t});\n\t\treturn this.initializing;\n\t}\n\n\tprivate async initialize(signal?: AbortSignal): Promise<void> {\n\t\tawait this.request(\n\t\t\t\"initialize\",\n\t\t\t{\n\t\t\t\tprotocolVersion: PROTOCOL_VERSION,\n\t\t\t\tcapabilities: {},\n\t\t\t\tclientInfo: { name: \"nexus-cli\", version: \"0.1.0\" },\n\t\t\t},\n\t\t\tsignal,\n\t\t);\n\t\tawait this.notify(\"notifications/initialized\");\n\t}\n\n\tprivate async notify(method: string): Promise<void> {\n\t\tawait this.post({ jsonrpc: \"2.0\", method }, undefined);\n\t}\n\n\tprivate async request(method: string, params: unknown, signal?: AbortSignal): Promise<unknown> {\n\t\tconst id = this.nextId++;\n\t\tconst response = await this.post({ jsonrpc: \"2.0\", id, method, params }, signal);\n\t\tif (!response) throw new GitNexusClientError(`empty response for ${method}`, \"protocol\");\n\t\tif (response.error) {\n\t\t\tthrow new GitNexusClientError(`hub ${method} failed: ${response.error.message}`, \"protocol\");\n\t\t}\n\t\treturn response.result;\n\t}\n\n\tprivate async post(body: unknown, signal?: AbortSignal): Promise<JsonRpcResponse | undefined> {\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\t\tconst onOuterAbort = () => controller.abort();\n\t\tsignal?.addEventListener(\"abort\", onOuterAbort, { once: true });\n\t\ttry {\n\t\t\tconst method = (body as { method?: string }).method ?? \"?\";\n\t\t\tclientTrace(`${method}: fetch dispatch`);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await fetch(this.config.hubUrl, {\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\taccept: \"application/json, text/event-stream\",\n\t\t\t\t\t\tauthorization: `Bearer ${this.config.token}`,\n\t\t\t\t\t\t...(this.config.deviceFingerprint ? { \"x-device-fingerprint\": this.config.deviceFingerprint } : {}),\n\t\t\t\t\t\t...(this.config.deviceName ? { \"x-device-name\": this.config.deviceName } : {}),\n\t\t\t\t\t\t...(this.sessionId ? { \"mcp-session-id\": this.sessionId } : {}),\n\t\t\t\t\t},\n\t\t\t\t\tbody: JSON.stringify(body),\n\t\t\t\t\tsignal: controller.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tconst reason = error instanceof Error ? error.message : String(error);\n\t\t\t\tthrow new GitNexusClientError(`cannot reach GitNexus hub: ${reason}`, \"network\");\n\t\t\t}\n\n\t\t\tclientTrace(`${method}: status ${response.status} content-type ${response.headers.get(\"content-type\")}`);\n\t\t\tconst newSessionId = response.headers.get(\"mcp-session-id\");\n\t\t\tif (newSessionId) this.sessionId = newSessionId;\n\n\t\t\tif (response.status === 401 || response.status === 403) {\n\t\t\t\tawait response.body?.cancel().catch(() => {});\n\t\t\t\tthrow new GitNexusClientError(\"GitNexus hub rejected the token (401/403). Run /login.\", \"auth\");\n\t\t\t}\n\t\t\tif (response.status === 202) {\n\t\t\t\t// Drain the body — an unconsumed response pins its socket, and under a\n\t\t\t\t// connection-capped dispatcher that deadlocks every later hub call.\n\t\t\t\tawait response.body?.cancel().catch(() => {});\n\t\t\t\treturn undefined; // accepted notification\n\t\t\t}\n\t\t\tif (!response.ok) {\n\t\t\t\tawait response.body?.cancel().catch(() => {});\n\t\t\t\tthrow new GitNexusClientError(`GitNexus hub HTTP ${response.status}`, \"protocol\");\n\t\t\t}\n\n\t\t\tconst contentType = response.headers.get(\"content-type\") ?? \"\";\n\t\t\tif (contentType.includes(\"text/event-stream\")) {\n\t\t\t\tconst sse = await response.text();\n\t\t\t\tclientTrace(`${method}: sse body ${sse.length} bytes`);\n\t\t\t\treturn parseSseForResponse(sse);\n\t\t\t}\n\t\t\tconst text = await response.text();\n\t\t\tclientTrace(`${method}: json body ${text.length} bytes`);\n\t\t\tif (!text) return undefined;\n\t\t\treturn JSON.parse(text) as JsonRpcResponse;\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t\tsignal?.removeEventListener(\"abort\", onOuterAbort);\n\t\t}\n\t}\n}\n\n/** Pull the (single) JSON-RPC response message out of an SSE body. */\nfunction parseSseForResponse(sse: string): JsonRpcResponse | undefined {\n\tlet last: JsonRpcResponse | undefined;\n\tfor (const rawEvent of sse.split(\"\\n\\n\")) {\n\t\tconst data = rawEvent\n\t\t\t.split(\"\\n\")\n\t\t\t.filter((line) => line.startsWith(\"data:\"))\n\t\t\t.map((line) => line.slice(5).trim())\n\t\t\t.join(\"\\n\");\n\t\tif (!data) continue;\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(data) as JsonRpcResponse;\n\t\t\t// Responses carry an id; server-initiated notifications do not.\n\t\t\tif (parsed.id !== undefined && parsed.id !== null) last = parsed;\n\t\t} catch {\n\t\t\t// Ignore non-JSON keepalives.\n\t\t}\n\t}\n\treturn last;\n}\n"]}

package/dist/extensions/gitnexus/client.js

@@ -0,0 +1,173 @@
+/**
+ * Minimal Streamable-HTTP MCP client for the GitNexus hub — and only the hub.
+ *
+ * This is intentionally NOT a general MCP client: it implements exactly the
+ * subset nexus-cli needs against a single known server — initialize,
+ * notifications/initialized, tools/call — over the Streamable HTTP transport
+ * (JSON-RPC over POST; responses arrive as application/json or as a
+ * text/event-stream carrying JSON-RPC messages).
+ */
+import { appendFileSync } from "node:fs";
+/** File-based trace (NEXUS_TRACE=1): TUI captures stderr, so console won't do. */
+function clientTrace(message) {
+    if (!process.env.NEXUS_TRACE)
+        return;
+    try {
+        appendFileSync("/tmp/nexus-observatory-trace.log", `${new Date().toISOString()} [client] ${message}\n`);
+    }
+    catch {
+        // best-effort
+    }
+}
+export class GitNexusClientError extends Error {
+    kind;
+    constructor(message, kind) {
+        super(message);
+        this.name = "GitNexusClientError";
+        this.kind = kind;
+    }
+}
+const PROTOCOL_VERSION = "2025-06-18";
+const REQUEST_TIMEOUT_MS = 60_000;
+export class GitNexusClient {
+    sessionId;
+    nextId = 1;
+    initializing;
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /** Call a hub tool by name. Initializes the MCP session lazily on first use. */
+    async callTool(name, args, signal) {
+        await this.ensureInitialized(signal);
+        const result = await this.request("tools/call", { name, arguments: args }, signal);
+        return (result ?? {});
+    }
+    /** Extract the primary text payload from an MCP tool result. */
+    static text(result) {
+        const parts = result.content ?? [];
+        const text = parts
+            .filter((p) => p.type === "text" && typeof p.text === "string")
+            .map((p) => p.text)
+            .join("\n");
+        if (result.isError) {
+            throw new GitNexusClientError(text || "hub tool returned an error", "tool");
+        }
+        return text;
+    }
+    ensureInitialized(signal) {
+        this.initializing ??= this.initialize(signal).catch((error) => {
+            this.initializing = undefined;
+            throw error;
+        });
+        return this.initializing;
+    }
+    async initialize(signal) {
+        await this.request("initialize", {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: "nexus-cli", version: "0.1.0" },
+        }, signal);
+        await this.notify("notifications/initialized");
+    }
+    async notify(method) {
+        await this.post({ jsonrpc: "2.0", method }, undefined);
+    }
+    async request(method, params, signal) {
+        const id = this.nextId++;
+        const response = await this.post({ jsonrpc: "2.0", id, method, params }, signal);
+        if (!response)
+            throw new GitNexusClientError(`empty response for ${method}`, "protocol");
+        if (response.error) {
+            throw new GitNexusClientError(`hub ${method} failed: ${response.error.message}`, "protocol");
+        }
+        return response.result;
+    }
+    async post(body, signal) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+        const onOuterAbort = () => controller.abort();
+        signal?.addEventListener("abort", onOuterAbort, { once: true });
+        try {
+            const method = body.method ?? "?";
+            clientTrace(`${method}: fetch dispatch`);
+            let response;
+            try {
+                response = await fetch(this.config.hubUrl, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        accept: "application/json, text/event-stream",
+                        authorization: `Bearer ${this.config.token}`,
+                        ...(this.config.deviceFingerprint ? { "x-device-fingerprint": this.config.deviceFingerprint } : {}),
+                        ...(this.config.deviceName ? { "x-device-name": this.config.deviceName } : {}),
+                        ...(this.sessionId ? { "mcp-session-id": this.sessionId } : {}),
+                    },
+                    body: JSON.stringify(body),
+                    signal: controller.signal,
+                });
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                throw new GitNexusClientError(`cannot reach GitNexus hub: ${reason}`, "network");
+            }
+            clientTrace(`${method}: status ${response.status} content-type ${response.headers.get("content-type")}`);
+            const newSessionId = response.headers.get("mcp-session-id");
+            if (newSessionId)
+                this.sessionId = newSessionId;
+            if (response.status === 401 || response.status === 403) {
+                await response.body?.cancel().catch(() => { });
+                throw new GitNexusClientError("GitNexus hub rejected the token (401/403). Run /login.", "auth");
+            }
+            if (response.status === 202) {
+                // Drain the body — an unconsumed response pins its socket, and under a
+                // connection-capped dispatcher that deadlocks every later hub call.
+                await response.body?.cancel().catch(() => { });
+                return undefined; // accepted notification
+            }
+            if (!response.ok) {
+                await response.body?.cancel().catch(() => { });
+                throw new GitNexusClientError(`GitNexus hub HTTP ${response.status}`, "protocol");
+            }
+            const contentType = response.headers.get("content-type") ?? "";
+            if (contentType.includes("text/event-stream")) {
+                const sse = await response.text();
+                clientTrace(`${method}: sse body ${sse.length} bytes`);
+                return parseSseForResponse(sse);
+            }
+            const text = await response.text();
+            clientTrace(`${method}: json body ${text.length} bytes`);
+            if (!text)
+                return undefined;
+            return JSON.parse(text);
+        }
+        finally {
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", onOuterAbort);
+        }
+    }
+}
+/** Pull the (single) JSON-RPC response message out of an SSE body. */
+function parseSseForResponse(sse) {
+    let last;
+    for (const rawEvent of sse.split("\n\n")) {
+        const data = rawEvent
+            .split("\n")
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice(5).trim())
+            .join("\n");
+        if (!data)
+            continue;
+        try {
+            const parsed = JSON.parse(data);
+            // Responses carry an id; server-initiated notifications do not.
+            if (parsed.id !== undefined && parsed.id !== null)
+                last = parsed;
+        }
+        catch {
+            // Ignore non-JSON keepalives.
+        }
+    }
+    return last;
+}
+//# sourceMappingURL=client.js.map

package/dist/extensions/gitnexus/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/extensions/gitnexus/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,kFAAkF;AAClF,SAAS,WAAW,CAAC,OAAe,EAAQ;IAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IACrC,IAAI,CAAC;QACJ,cAAc,CAAC,kCAAkC,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,IAAI,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACR,cAAc;IACf,CAAC;AAAA,CACD;AAeD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACpC,IAAI,CAA2C;IAExD,YAAY,OAAe,EAAE,IAA8C,EAAE;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAED,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,OAAO,cAAc;IAClB,SAAS,CAAqB;IAC9B,MAAM,GAAG,CAAC,CAAC;IACX,YAAY,CAA4B;IAC/B,MAAM,CAAiB;IAExC,YAAY,MAAsB,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAAA,CACrB;IAED,gFAAgF;IAChF,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B,EAAE,MAAoB,EAA0B;QACzG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACnF,OAAO,CAAC,MAAM,IAAI,EAAE,CAAkB,CAAC;IAAA,CACvC;IAED,gEAAgE;IAChE,MAAM,CAAC,IAAI,CAAC,MAAqB,EAAU;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;aAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,IAAI,IAAI,4BAA4B,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC;IAAA,CACZ;IAEO,iBAAiB,CAAC,MAAoB,EAAiB;QAC9D,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,MAAM,KAAK,CAAC;QAAA,CACZ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC;IAAA,CACzB;IAEO,KAAK,CAAC,UAAU,CAAC,MAAoB,EAAiB;QAC7D,MAAM,IAAI,CAAC,OAAO,CACjB,YAAY,EACZ;YACC,eAAe,EAAE,gBAAgB;YACjC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE;SACnD,EACD,MAAM,CACN,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAAA,CAC/C;IAEO,KAAK,CAAC,MAAM,CAAC,MAAc,EAAiB;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IAAA,CACvD;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAAe,EAAE,MAAoB,EAAoB;QAC9F,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,OAAO,MAAM,YAAY,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC;IAAA,CACvB;IAEO,KAAK,CAAC,IAAI,CAAC,IAAa,EAAE,MAAoB,EAAwC;QAC7F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC;YACJ,MAAM,MAAM,GAAI,IAA4B,CAAC,MAAM,IAAI,GAAG,CAAC;YAC3D,WAAW,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;YACzC,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;oBAC1C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACR,cAAc,EAAE,kBAAkB;wBAClC,MAAM,EAAE,qCAAqC;wBAC7C,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;wBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/D;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;iBACzB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;YAClF,CAAC;YAED,WAAW,CAAC,GAAG,MAAM,YAAY,QAAQ,CAAC,MAAM,iBAAiB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACzG,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC5D,IAAI,YAAY;gBAAE,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;YAEhD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAAC,wDAAwD,EAAE,MAAM,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,yEAAuE;gBACvE,oEAAoE;gBACpE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;gBAC9C,OAAO,SAAS,CAAC,CAAC,wBAAwB;YAC3C,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClC,WAAW,CAAC,GAAG,MAAM,cAAc,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;gBACvD,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,WAAW,CAAC,GAAG,MAAM,eAAe,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;IAAA,CACD;CACD;AAED,sEAAsE;AACtE,SAAS,mBAAmB,CAAC,GAAW,EAA+B;IACtE,IAAI,IAAiC,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ;aACnB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACnC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;YACnD,gEAAgE;YAChE,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;gBAAE,IAAI,GAAG,MAAM,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACR,8BAA8B;QAC/B,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ","sourcesContent":["/**\n * Minimal Streamable-HTTP MCP client for the GitNexus hub — and only the hub.\n *\n * This is intentionally NOT a general MCP client: it implements exactly the\n * subset nexus-cli needs against a single known server — initialize,\n * notifications/initialized, tools/call — over the Streamable HTTP transport\n * (JSON-RPC over POST; responses arrive as application/json or as a\n * text/event-stream carrying JSON-RPC messages).\n */\n\nimport { appendFileSync } from \"node:fs\";\nimport type { GitNexusConfig } from \"./config.ts\";\n\n/** File-based trace (NEXUS_TRACE=1): TUI captures stderr, so console won't do. */\nfunction clientTrace(message: string): void {\n\tif (!process.env.NEXUS_TRACE) return;\n\ttry {\n\t\tappendFileSync(\"/tmp/nexus-observatory-trace.log\", `${new Date().toISOString()} [client] ${message}\\n`);\n\t} catch {\n\t\t// best-effort\n\t}\n}\n\ninterface JsonRpcResponse {\n\tjsonrpc: \"2.0\";\n\tid?: number | string | null;\n\tresult?: unknown;\n\terror?: { code: number; message: string; data?: unknown };\n}\n\nexport interface McpToolResult {\n\tcontent?: Array<{ type: string; text?: string }>;\n\tisError?: boolean;\n\tstructuredContent?: unknown;\n}\n\nexport class GitNexusClientError extends Error {\n\treadonly kind: \"auth\" | \"network\" | \"protocol\" | \"tool\";\n\n\tconstructor(message: string, kind: \"auth\" | \"network\" | \"protocol\" | \"tool\") {\n\t\tsuper(message);\n\t\tthis.name = \"GitNexusClientError\";\n\t\tthis.kind = kind;\n\t}\n}\n\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst REQUEST_TIMEOUT_MS = 60_000;\n\nexport class GitNexusClient {\n\tprivate sessionId: string | undefined;\n\tprivate nextId = 1;\n\tprivate initializing: Promise<void> | undefined;\n\tprivate readonly config: GitNexusConfig;\n\n\tconstructor(config: GitNexusConfig) {\n\t\tthis.config = config;\n\t}\n\n\t/** Call a hub tool by name. Initializes the MCP session lazily on first use. */\n\tasync callTool(name: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<McpToolResult> {\n\t\tawait this.ensureInitialized(signal);\n\t\tconst result = await this.request(\"tools/call\", { name, arguments: args }, signal);\n\t\treturn (result ?? {}) as McpToolResult;\n\t}\n\n\t/** Extract the primary text payload from an MCP tool result. */\n\tstatic text(result: McpToolResult): string {\n\t\tconst parts = result.content ?? [];\n\t\tconst text = parts\n\t\t\t.filter((p) => p.type === \"text\" && typeof p.text === \"string\")\n\t\t\t.map((p) => p.text)\n\t\t\t.join(\"\\n\");\n\t\tif (result.isError) {\n\t\t\tthrow new GitNexusClientError(text || \"hub tool returned an error\", \"tool\");\n\t\t}\n\t\treturn text;\n\t}\n\n\tprivate ensureInitialized(signal?: AbortSignal): Promise<void> {\n\t\tthis.initializing ??= this.initialize(signal).catch((error) => {\n\t\t\tthis.initializing = undefined;\n\t\t\tthrow error;\n\t\t});\n\t\treturn this.initializing;\n\t}\n\n\tprivate async initialize(signal?: AbortSignal): Promise<void> {\n\t\tawait this.request(\n\t\t\t\"initialize\",\n\t\t\t{\n\t\t\t\tprotocolVersion: PROTOCOL_VERSION,\n\t\t\t\tcapabilities: {},\n\t\t\t\tclientInfo: { name: \"nexus-cli\", version: \"0.1.0\" },\n\t\t\t},\n\t\t\tsignal,\n\t\t);\n\t\tawait this.notify(\"notifications/initialized\");\n\t}\n\n\tprivate async notify(method: string): Promise<void> {\n\t\tawait this.post({ jsonrpc: \"2.0\", method }, undefined);\n\t}\n\n\tprivate async request(method: string, params: unknown, signal?: AbortSignal): Promise<unknown> {\n\t\tconst id = this.nextId++;\n\t\tconst response = await this.post({ jsonrpc: \"2.0\", id, method, params }, signal);\n\t\tif (!response) throw new GitNexusClientError(`empty response for ${method}`, \"protocol\");\n\t\tif (response.error) {\n\t\t\tthrow new GitNexusClientError(`hub ${method} failed: ${response.error.message}`, \"protocol\");\n\t\t}\n\t\treturn response.result;\n\t}\n\n\tprivate async post(body: unknown, signal?: AbortSignal): Promise<JsonRpcResponse | undefined> {\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\t\tconst onOuterAbort = () => controller.abort();\n\t\tsignal?.addEventListener(\"abort\", onOuterAbort, { once: true });\n\t\ttry {\n\t\t\tconst method = (body as { method?: string }).method ?? \"?\";\n\t\t\tclientTrace(`${method}: fetch dispatch`);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await fetch(this.config.hubUrl, {\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\taccept: \"application/json, text/event-stream\",\n\t\t\t\t\t\tauthorization: `Bearer ${this.config.token}`,\n\t\t\t\t\t\t...(this.config.deviceFingerprint ? { \"x-device-fingerprint\": this.config.deviceFingerprint } : {}),\n\t\t\t\t\t\t...(this.config.deviceName ? { \"x-device-name\": this.config.deviceName } : {}),\n\t\t\t\t\t\t...(this.sessionId ? { \"mcp-session-id\": this.sessionId } : {}),\n\t\t\t\t\t},\n\t\t\t\t\tbody: JSON.stringify(body),\n\t\t\t\t\tsignal: controller.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tconst reason = error instanceof Error ? error.message : String(error);\n\t\t\t\tthrow new GitNexusClientError(`cannot reach GitNexus hub: ${reason}`, \"network\");\n\t\t\t}\n\n\t\t\tclientTrace(`${method}: status ${response.status} content-type ${response.headers.get(\"content-type\")}`);\n\t\t\tconst newSessionId = response.headers.get(\"mcp-session-id\");\n\t\t\tif (newSessionId) this.sessionId = newSessionId;\n\n\t\t\tif (response.status === 401 || response.status === 403) {\n\t\t\t\tawait response.body?.cancel().catch(() => {});\n\t\t\t\tthrow new GitNexusClientError(\"GitNexus hub rejected the token (401/403). Run /login.\", \"auth\");\n\t\t\t}\n\t\t\tif (response.status === 202) {\n\t\t\t\t// Drain the body — an unconsumed response pins its socket, and under a\n\t\t\t\t// connection-capped dispatcher that deadlocks every later hub call.\n\t\t\t\tawait response.body?.cancel().catch(() => {});\n\t\t\t\treturn undefined; // accepted notification\n\t\t\t}\n\t\t\tif (!response.ok) {\n\t\t\t\tawait response.body?.cancel().catch(() => {});\n\t\t\t\tthrow new GitNexusClientError(`GitNexus hub HTTP ${response.status}`, \"protocol\");\n\t\t\t}\n\n\t\t\tconst contentType = response.headers.get(\"content-type\") ?? \"\";\n\t\t\tif (contentType.includes(\"text/event-stream\")) {\n\t\t\t\tconst sse = await response.text();\n\t\t\t\tclientTrace(`${method}: sse body ${sse.length} bytes`);\n\t\t\t\treturn parseSseForResponse(sse);\n\t\t\t}\n\t\t\tconst text = await response.text();\n\t\t\tclientTrace(`${method}: json body ${text.length} bytes`);\n\t\t\tif (!text) return undefined;\n\t\t\treturn JSON.parse(text) as JsonRpcResponse;\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t\tsignal?.removeEventListener(\"abort\", onOuterAbort);\n\t\t}\n\t}\n}\n\n/** Pull the (single) JSON-RPC response message out of an SSE body. */\nfunction parseSseForResponse(sse: string): JsonRpcResponse | undefined {\n\tlet last: JsonRpcResponse | undefined;\n\tfor (const rawEvent of sse.split(\"\\n\\n\")) {\n\t\tconst data = rawEvent\n\t\t\t.split(\"\\n\")\n\t\t\t.filter((line) => line.startsWith(\"data:\"))\n\t\t\t.map((line) => line.slice(5).trim())\n\t\t\t.join(\"\\n\");\n\t\tif (!data) continue;\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(data) as JsonRpcResponse;\n\t\t\t// Responses carry an id; server-initiated notifications do not.\n\t\t\tif (parsed.id !== undefined && parsed.id !== null) last = parsed;\n\t\t} catch {\n\t\t\t// Ignore non-JSON keepalives.\n\t\t}\n\t}\n\treturn last;\n}\n"]}

package/dist/extensions/gitnexus/config.d.ts

@@ -0,0 +1,25 @@
+/**
+ * GitNexus hub connection settings.
+ *
+ * Resolution order (first hit wins):
+ *   1. Environment: GITNEXUS_HUB_URL / GITNEXUS_TOKEN
+ *   2. Config file: ~/.config/nexus/auth.json  ({ hubUrl, token })
+ *
+ * The hub endpoint is the Streamable-HTTP MCP endpoint (".../mcp"). Bearer
+ * tokens are hub API tokens; an empty token allowlist on the hub means the
+ * token can see every repo of its user identity.
+ */
+export interface GitNexusConfig {
+    hubUrl: string;
+    token: string;
+    /** Hub tokens can be device-bound; these headers must then match the binding. */
+    deviceFingerprint?: string | undefined;
+    deviceName?: string | undefined;
+}
+export declare const DEFAULT_HUB_URL = "https://gitnexus-enterprise-production.up.railway.app/mcp";
+/** Resolve hub settings. Returns undefined when no token is configured anywhere. */
+export declare function resolveGitNexusConfig(): GitNexusConfig | undefined;
+/** Persist hub settings from `/login`. */
+export declare function saveGitNexusConfig(config: GitNexusConfig): string;
+export declare function gitNexusConfigPath(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/extensions/gitnexus/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,eAAO,MAAM,eAAe,8DAA8D,CAAC;AAoB3F,oFAAoF;AACpF,wBAAgB,qBAAqB,IAAI,cAAc,GAAG,SAAS,CAQlE;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAIjE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/**\n * GitNexus hub connection settings.\n *\n * Resolution order (first hit wins):\n *   1. Environment: GITNEXUS_HUB_URL / GITNEXUS_TOKEN\n *   2. Config file: ~/.config/nexus/auth.json  ({ hubUrl, token })\n *\n * The hub endpoint is the Streamable-HTTP MCP endpoint (\".../mcp\"). Bearer\n * tokens are hub API tokens; an empty token allowlist on the hub means the\n * token can see every repo of its user identity.\n */\n\nexport interface GitNexusConfig {\n\thubUrl: string;\n\ttoken: string;\n\t/** Hub tokens can be device-bound; these headers must then match the binding. */\n\tdeviceFingerprint?: string | undefined;\n\tdeviceName?: string | undefined;\n}\n\nexport const DEFAULT_HUB_URL = \"https://gitnexus-enterprise-production.up.railway.app/mcp\";\n\nfunction configDir(): string {\n\treturn join(homedir(), \".config\", \"nexus\");\n}\n\nfunction configPath(): string {\n\treturn join(configDir(), \"auth.json\");\n}\n\nfunction readConfigFile(): Partial<GitNexusConfig> {\n\ttry {\n\t\tconst raw = readFileSync(configPath(), \"utf8\");\n\t\tconst parsed = JSON.parse(raw) as Partial<GitNexusConfig>;\n\t\treturn typeof parsed === \"object\" && parsed !== null ? parsed : {};\n\t} catch {\n\t\treturn {};\n\t}\n}\n\n/** Resolve hub settings. Returns undefined when no token is configured anywhere. */\nexport function resolveGitNexusConfig(): GitNexusConfig | undefined {\n\tconst file = readConfigFile();\n\tconst token = process.env.GITNEXUS_TOKEN ?? file.token;\n\tif (!token) return undefined;\n\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? file.hubUrl ?? DEFAULT_HUB_URL;\n\tconst deviceFingerprint = process.env.GITNEXUS_DEVICE_FP ?? file.deviceFingerprint;\n\tconst deviceName = process.env.GITNEXUS_DEVICE_NAME ?? file.deviceName;\n\treturn { hubUrl, token, deviceFingerprint, deviceName };\n}\n\n/** Persist hub settings from `/login`. */\nexport function saveGitNexusConfig(config: GitNexusConfig): string {\n\tif (!existsSync(configDir())) mkdirSync(configDir(), { recursive: true, mode: 0o700 });\n\twriteFileSync(configPath(), `${JSON.stringify(config, null, \"\\t\")}\\n`, { mode: 0o600 });\n\treturn configPath();\n}\n\nexport function gitNexusConfigPath(): string {\n\treturn configPath();\n}\n"]}

package/dist/extensions/gitnexus/config.js

@@ -0,0 +1,42 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const DEFAULT_HUB_URL = "https://gitnexus-enterprise-production.up.railway.app/mcp";
+function configDir() {
+    return join(homedir(), ".config", "nexus");
+}
+function configPath() {
+    return join(configDir(), "auth.json");
+}
+function readConfigFile() {
+    try {
+        const raw = readFileSync(configPath(), "utf8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed === "object" && parsed !== null ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Resolve hub settings. Returns undefined when no token is configured anywhere. */
+export function resolveGitNexusConfig() {
+    const file = readConfigFile();
+    const token = process.env.GITNEXUS_TOKEN ?? file.token;
+    if (!token)
+        return undefined;
+    const hubUrl = process.env.GITNEXUS_HUB_URL ?? file.hubUrl ?? DEFAULT_HUB_URL;
+    const deviceFingerprint = process.env.GITNEXUS_DEVICE_FP ?? file.deviceFingerprint;
+    const deviceName = process.env.GITNEXUS_DEVICE_NAME ?? file.deviceName;
+    return { hubUrl, token, deviceFingerprint, deviceName };
+}
+/** Persist hub settings from `/login`. */
+export function saveGitNexusConfig(config) {
+    if (!existsSync(configDir()))
+        mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    writeFileSync(configPath(), `${JSON.stringify(config, null, "\t")}\n`, { mode: 0o600 });
+    return configPath();
+}
+export function gitNexusConfigPath() {
+    return configPath();
+}
+//# sourceMappingURL=config.js.map

package/dist/extensions/gitnexus/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/extensions/gitnexus/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC,MAAM,CAAC,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAE3F,SAAS,SAAS,GAAW;IAC5B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAAA,CAC3C;AAED,SAAS,UAAU,GAAW;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;AAAA,CACtC;AAED,SAAS,cAAc,GAA4B;IAClD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AAAA,CACD;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,GAA+B;IACnE,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAC9E,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,CAAC;IACnF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,UAAU,CAAC;IACvE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;AAAA,CACxD;AAED,0CAA0C;AAC1C,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAU;IAClE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAAE,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,aAAa,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,OAAO,UAAU,EAAE,CAAC;AAAA,CACpB;AAED,MAAM,UAAU,kBAAkB,GAAW;IAC5C,OAAO,UAAU,EAAE,CAAC;AAAA,CACpB","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/**\n * GitNexus hub connection settings.\n *\n * Resolution order (first hit wins):\n *   1. Environment: GITNEXUS_HUB_URL / GITNEXUS_TOKEN\n *   2. Config file: ~/.config/nexus/auth.json  ({ hubUrl, token })\n *\n * The hub endpoint is the Streamable-HTTP MCP endpoint (\".../mcp\"). Bearer\n * tokens are hub API tokens; an empty token allowlist on the hub means the\n * token can see every repo of its user identity.\n */\n\nexport interface GitNexusConfig {\n\thubUrl: string;\n\ttoken: string;\n\t/** Hub tokens can be device-bound; these headers must then match the binding. */\n\tdeviceFingerprint?: string | undefined;\n\tdeviceName?: string | undefined;\n}\n\nexport const DEFAULT_HUB_URL = \"https://gitnexus-enterprise-production.up.railway.app/mcp\";\n\nfunction configDir(): string {\n\treturn join(homedir(), \".config\", \"nexus\");\n}\n\nfunction configPath(): string {\n\treturn join(configDir(), \"auth.json\");\n}\n\nfunction readConfigFile(): Partial<GitNexusConfig> {\n\ttry {\n\t\tconst raw = readFileSync(configPath(), \"utf8\");\n\t\tconst parsed = JSON.parse(raw) as Partial<GitNexusConfig>;\n\t\treturn typeof parsed === \"object\" && parsed !== null ? parsed : {};\n\t} catch {\n\t\treturn {};\n\t}\n}\n\n/** Resolve hub settings. Returns undefined when no token is configured anywhere. */\nexport function resolveGitNexusConfig(): GitNexusConfig | undefined {\n\tconst file = readConfigFile();\n\tconst token = process.env.GITNEXUS_TOKEN ?? file.token;\n\tif (!token) return undefined;\n\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? file.hubUrl ?? DEFAULT_HUB_URL;\n\tconst deviceFingerprint = process.env.GITNEXUS_DEVICE_FP ?? file.deviceFingerprint;\n\tconst deviceName = process.env.GITNEXUS_DEVICE_NAME ?? file.deviceName;\n\treturn { hubUrl, token, deviceFingerprint, deviceName };\n}\n\n/** Persist hub settings from `/login`. */\nexport function saveGitNexusConfig(config: GitNexusConfig): string {\n\tif (!existsSync(configDir())) mkdirSync(configDir(), { recursive: true, mode: 0o700 });\n\twriteFileSync(configPath(), `${JSON.stringify(config, null, \"\\t\")}\\n`, { mode: 0o600 });\n\treturn configPath();\n}\n\nexport function gitNexusConfigPath(): string {\n\treturn configPath();\n}\n"]}

package/dist/extensions/gitnexus/device-auth.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Device authorization client for hub login.
+ *
+ * The CLI cannot receive a browser redirect, so it starts a request, shows the
+ * user a short code, and polls until they approve it in the web app. The hub
+ * mints the token on the first successful poll, so it exists in plaintext only
+ * in that one response and in the local auth file.
+ *
+ * Protocol shape follows RFC 8628, and the hub returns its error codes
+ * verbatim so callers branch on a stable string rather than prose.
+ */
+export interface DeviceAuthStart {
+    deviceCode: string;
+    userCode: string;
+    verificationUrl: string;
+    verificationUrlComplete?: string;
+    /** Seconds until the request expires. */
+    expiresIn: number;
+    /** Seconds the CLI must wait between polls. */
+    interval: number;
+}
+export interface DeviceAuthResult {
+    token: string;
+    hubUrl: string;
+    tokenId?: string;
+}
+export type DeviceAuthFailure = 
+/** The user rejected the code in the browser. */
+"access_denied"
+/** The request expired, was already used, or never existed. */
+ | "expired_token"
+/** The CLI gave up waiting. */
+ | "timeout";
+export declare class DeviceAuthError extends Error {
+    readonly reason: DeviceAuthFailure | "network" | "protocol";
+    constructor(message: string, reason: DeviceAuthError["reason"]);
+}
+/** Base URL of the hub's HTTP API, derived from the configured MCP endpoint. */
+export declare function hubApiBase(hubUrl: string): string;
+/** Human-readable device label, so tokens are identifiable in the hub UI. */
+export declare function defaultDeviceName(): string;
+/** Stable machine identity required by Hub device-token authentication. */
+export declare function deviceFingerprint(): string;
+/** Ask the hub to begin a device login. */
+export declare function startDeviceAuth(hubUrl: string, options?: {
+    deviceName?: string;
+    deviceFingerprint?: string;
+    signal?: AbortSignal;
+}): Promise<DeviceAuthStart>;
+/**
+ * Poll until the user approves, the request dies, or the deadline passes.
+ *
+ * `sleep` is injectable so tests do not wait in real time.
+ */
+export declare function pollDeviceAuth(hubUrl: string, start: DeviceAuthStart, options?: {
+    signal?: AbortSignal;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}): Promise<DeviceAuthResult>;
+//# sourceMappingURL=device-auth.d.ts.map

package/dist/extensions/gitnexus/device-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/device-auth.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,eAAe;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB;AAC5B,iDAAiD;AAC/C,eAAe;AACjB,+DAA+D;GAC7D,eAAe;AACjB,+BAA+B;GAC7B,SAAS,CAAC;AAEb,qBAAa,eAAgB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;IAE5D,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,EAI7D;CACD;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,IAAI,MAAM,CAS1C;AAkCD,2CAA2C;AAC3C,wBAAsB,eAAe,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GACrF,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE;IACR,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACd,GACJ,OAAO,CAAC,gBAAgB,CAAC,CA+C3B","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { arch, hostname, platform, userInfo } from \"node:os\";\nimport { APP_NAME, VERSION } from \"../../config.ts\";\n\n/**\n * Device authorization client for hub login.\n *\n * The CLI cannot receive a browser redirect, so it starts a request, shows the\n * user a short code, and polls until they approve it in the web app. The hub\n * mints the token on the first successful poll, so it exists in plaintext only\n * in that one response and in the local auth file.\n *\n * Protocol shape follows RFC 8628, and the hub returns its error codes\n * verbatim so callers branch on a stable string rather than prose.\n */\n\nexport interface DeviceAuthStart {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUrl: string;\n\tverificationUrlComplete?: string;\n\t/** Seconds until the request expires. */\n\texpiresIn: number;\n\t/** Seconds the CLI must wait between polls. */\n\tinterval: number;\n}\n\nexport interface DeviceAuthResult {\n\ttoken: string;\n\thubUrl: string;\n\ttokenId?: string;\n}\n\nexport type DeviceAuthFailure =\n\t/** The user rejected the code in the browser. */\n\t| \"access_denied\"\n\t/** The request expired, was already used, or never existed. */\n\t| \"expired_token\"\n\t/** The CLI gave up waiting. */\n\t| \"timeout\";\n\nexport class DeviceAuthError extends Error {\n\treadonly reason: DeviceAuthFailure | \"network\" | \"protocol\";\n\n\tconstructor(message: string, reason: DeviceAuthError[\"reason\"]) {\n\t\tsuper(message);\n\t\tthis.name = \"DeviceAuthError\";\n\t\tthis.reason = reason;\n\t}\n}\n\n/** Base URL of the hub's HTTP API, derived from the configured MCP endpoint. */\nexport function hubApiBase(hubUrl: string): string {\n\treturn hubUrl.replace(/\\/mcp\\/?$/, \"\").replace(/\\/+$/, \"\");\n}\n\n/** Human-readable device label, so tokens are identifiable in the hub UI. */\nexport function defaultDeviceName(): string {\n\ttry {\n\t\tconst host = hostname();\n\t\tconst user = userInfo().username;\n\t\treturn user ? `${user}@${host}` : host;\n\t} catch {\n\t\treturn \"unknown-device\";\n\t}\n}\n\n/** Stable machine identity required by Hub device-token authentication. */\nexport function deviceFingerprint(): string {\n\tlet username = \"unknown-user\";\n\ttry {\n\t\tusername = userInfo().username || username;\n\t} catch {\n\t\t// Keep deterministic fallback.\n\t}\n\tconst identity = `${hostname()}:${username}:${platform()}:${arch()}`;\n\treturn createHash(\"sha256\").update(identity).digest(\"hex\").slice(0, 16);\n}\n\nasync function postJson(\n\turl: string,\n\tbody: unknown,\n\tsignal: AbortSignal | undefined,\n): Promise<{ status: number; data: any }> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/json\" },\n\t\t\tbody: JSON.stringify(body),\n\t\t\tsignal,\n\t\t});\n\t} catch (error) {\n\t\tif (signal?.aborted) throw new DeviceAuthError(\"Login cancelled\", \"timeout\");\n\t\tthrow new DeviceAuthError(`Cannot reach the hub at ${url}: ${errorText(error)}`, \"network\");\n\t}\n\n\tconst text = await response.text();\n\tlet data: any;\n\ttry {\n\t\tdata = text ? JSON.parse(text) : {};\n\t} catch {\n\t\tthrow new DeviceAuthError(`Hub returned a non-JSON response (HTTP ${response.status})`, \"protocol\");\n\t}\n\treturn { status: response.status, data };\n}\n\nfunction errorText(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\n/** Ask the hub to begin a device login. */\nexport async function startDeviceAuth(\n\thubUrl: string,\n\toptions: { deviceName?: string; deviceFingerprint?: string; signal?: AbortSignal } = {},\n): Promise<DeviceAuthStart> {\n\tconst { status, data } = await postJson(\n\t\t`${hubApiBase(hubUrl)}/auth/device/start`,\n\t\t{\n\t\t\tagentName: APP_NAME,\n\t\t\tagentVersion: VERSION,\n\t\t\tdeviceName: options.deviceName ?? defaultDeviceName(),\n\t\t\tdeviceFingerprint: options.deviceFingerprint ?? deviceFingerprint(),\n\t\t},\n\t\toptions.signal,\n\t);\n\n\tif (status !== 200 || typeof data?.deviceCode !== \"string\" || typeof data?.userCode !== \"string\") {\n\t\tthrow new DeviceAuthError(\n\t\t\tdata?.error ? String(data.error) : `Hub rejected the login request (HTTP ${status})`,\n\t\t\t\"protocol\",\n\t\t);\n\t}\n\n\treturn {\n\t\tdeviceCode: data.deviceCode,\n\t\tuserCode: data.userCode,\n\t\tverificationUrl: String(data.verificationUrl ?? `${hubApiBase(hubUrl)}/device`),\n\t\tverificationUrlComplete:\n\t\t\ttypeof data.verificationUrlComplete === \"string\" ? data.verificationUrlComplete : undefined,\n\t\texpiresIn: typeof data.expiresIn === \"number\" ? data.expiresIn : 600,\n\t\tinterval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n\t};\n}\n\n/**\n * Poll until the user approves, the request dies, or the deadline passes.\n *\n * `sleep` is injectable so tests do not wait in real time.\n */\nexport async function pollDeviceAuth(\n\thubUrl: string,\n\tstart: DeviceAuthStart,\n\toptions: {\n\t\tsignal?: AbortSignal;\n\t\tsleep?: (ms: number) => Promise<void>;\n\t\tnow?: () => number;\n\t} = {},\n): Promise<DeviceAuthResult> {\n\tconst sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n\tconst now = options.now ?? (() => Date.now());\n\tconst deadline = now() + start.expiresIn * 1000;\n\tlet intervalMs = start.interval * 1000;\n\n\twhile (true) {\n\t\tif (options.signal?.aborted) throw new DeviceAuthError(\"Login cancelled\", \"timeout\");\n\t\tawait sleep(intervalMs);\n\t\t// Re-check after sleeping: a request that expired while we waited should\n\t\t// not cost the hub another round trip.\n\t\tif (now() >= deadline) break;\n\n\t\tconst { status, data } = await postJson(\n\t\t\t`${hubApiBase(hubUrl)}/auth/device/poll`,\n\t\t\t{ deviceCode: start.deviceCode },\n\t\t\toptions.signal,\n\t\t);\n\n\t\tif (status === 200 && typeof data?.token === \"string\") {\n\t\t\treturn {\n\t\t\t\ttoken: data.token,\n\t\t\t\thubUrl: typeof data.hubUrl === \"string\" ? data.hubUrl : hubUrl,\n\t\t\t\ttokenId: typeof data.tokenId === \"string\" ? data.tokenId : undefined,\n\t\t\t};\n\t\t}\n\n\t\tswitch (data?.error) {\n\t\t\tcase \"authorization_pending\":\n\t\t\t\tbreak;\n\t\t\tcase \"slow_down\":\n\t\t\t\t// Back off to whatever the hub now advertises, or a second more.\n\t\t\t\tintervalMs = typeof data.interval === \"number\" ? data.interval * 1000 : intervalMs + 1000;\n\t\t\t\tbreak;\n\t\t\tcase \"access_denied\":\n\t\t\t\tthrow new DeviceAuthError(\"Login was denied in the browser\", \"access_denied\");\n\t\t\tcase \"expired_token\":\n\t\t\t\tthrow new DeviceAuthError(\"The login code expired or was already used\", \"expired_token\");\n\t\t\tdefault:\n\t\t\t\tthrow new DeviceAuthError(\n\t\t\t\t\tdata?.error ? String(data.error) : `Unexpected hub response (HTTP ${status})`,\n\t\t\t\t\t\"protocol\",\n\t\t\t\t);\n\t\t}\n\t}\n\n\tthrow new DeviceAuthError(\"Timed out waiting for approval\", \"timeout\");\n}\n"]}