@ashlr/hub 2.2.0

package/dist/core/inbox/apply.js

@@ -0,0 +1,407 @@
+/**
+ * core/inbox/apply.ts — The ONLY outward mutation path in v2 (M23).
+ *
+ * applyProposal is the single funnel for every outward action. It is called
+ * ONLY from `cli/inbox.ts` after the user explicitly runs `inbox approve <id>`
+ * (with confirm or --yes). It is NEVER called automatically, never on create,
+ * never on list/show, never by the daemon.
+ *
+ * GUARDRAILS:
+ *  - REFUSE unless proposal exists AND status==='approved' AND confirmed===true.
+ *  - assertMayMutate(repo) before any mutation (enrollment + kill switch).
+ *  - 'patch': apply diff on a NEW branch (ashlr/proposal/<id>) off HEAD.
+ *    NEVER touch the user's current branch/index/working tree.
+ *    NEVER force. NEVER push. Local only.
+ *  - 'pr': branch + commit, then the gated M18 createPr.
+ *  - 'deploy': gated ship path.
+ *  - 'note': no-op record.
+ *  - Every attempt is audited. Status set to 'applied'/'failed' + result.
+ *  - Never throws out — all failures returned as ApplyResult.
+ *  - No secrets in proposals/audit.
+ *  - No new runtime deps; node builtins only.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { loadProposal, setStatus } from './store.js';
+import { assertMayMutate } from '../sandbox/policy.js';
+import { audit } from '../sandbox/audit.js';
+import { isRepo } from '../git.js';
+import { createPr } from '../integrations/github.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Branch prefix for all inbox-applied branches — NEVER delete user branches. */
+const PROPOSAL_BRANCH_PREFIX = 'ashlr/proposal/';
+/** Timeout for git operations (ms). */
+const GIT_TIMEOUT = 30_000;
+// ---------------------------------------------------------------------------
+// git helper — arg arrays, no shell
+// ---------------------------------------------------------------------------
+/** Run a git command in `cwd`. Throws on failure. */
+function gitRun(cwd, args) {
+    return execFileSync('git', args, {
+        cwd,
+        timeout: GIT_TIMEOUT,
+        stdio: 'pipe',
+        encoding: 'utf8',
+    }).trim();
+}
+/** Run a git command, returning null on any error (never throws). */
+function gitTry(cwd, args) {
+    try {
+        return gitRun(cwd, args);
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Temp file helper for diff application
+// ---------------------------------------------------------------------------
+/**
+ * Write `content` to a temp file under ~/.ashlr/tmp and return its path.
+ * Caller is responsible for cleanup.
+ */
+function writeTmpFile(content) {
+    const dir = join(homedir(), '.ashlr', 'tmp');
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const name = `patch-${randomBytes(6).toString('hex')}.diff`;
+    const p = join(dir, name);
+    writeFileSync(p, content, 'utf8');
+    return p;
+}
+// ---------------------------------------------------------------------------
+// Kind handlers
+// ---------------------------------------------------------------------------
+/**
+ * Apply a unified diff to a NEW branch off current HEAD in `repo`.
+ * NEVER touches the user's current branch, index, or working tree.
+ * NEVER force. NEVER push. Local only.
+ */
+async function applyPatch(repo, proposalId, diff) {
+    if (!isRepo(repo)) {
+        return { ok: false, detail: `not a git repository: ${repo}` };
+    }
+    if (!diff.trim()) {
+        return { ok: false, detail: 'proposal diff is empty — nothing to apply' };
+    }
+    // Derive a safe, namespaced branch name. The proposal id is already a
+    // filename-safe lowercase slug (prop-<ts>-<hex>) and is valid as a git ref,
+    // so we use it whole — keeping the full id in the branch lets callers match
+    // the branch back to its proposal (branch.includes(proposalId)).
+    const branch = `${PROPOSAL_BRANCH_PREFIX}${proposalId}`;
+    // Read current HEAD without touching working tree.
+    const head = gitTry(repo, ['rev-parse', 'HEAD']);
+    if (!head) {
+        return { ok: false, detail: 'could not resolve HEAD in repo' };
+    }
+    // Create the new branch off HEAD using --no-checkout so we stay on the
+    // user's current branch. We then apply the diff directly to the new branch
+    // via a worktree, which fully isolates the patch from the user's working tree.
+    // Strategy: use `git worktree add -b <branch> <tmpPath> HEAD` to create an
+    // isolated checkout, apply the patch there, commit, then remove the worktree.
+    // This is the safest approach — it NEVER modifies the user's working tree,
+    // index, or HEAD.
+    const tmpWorktreeDir = join(homedir(), '.ashlr', 'tmp', `wt-${randomBytes(6).toString('hex')}`);
+    // Create the isolated worktree on the new branch.
+    try {
+        gitRun(repo, [
+            'worktree',
+            'add',
+            '-b',
+            branch,
+            tmpWorktreeDir,
+            head,
+        ]);
+    }
+    catch (err) {
+        // Clean up any partial worktree registration.
+        gitTry(repo, ['worktree', 'prune']);
+        return {
+            ok: false,
+            detail: `git worktree add failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // Write diff to a temp file so we can pass it as a path argument (no shell).
+    let patchFile = null;
+    let applyErr = null;
+    let commitSha = null;
+    try {
+        patchFile = writeTmpFile(diff);
+        // Apply the diff inside the isolated worktree.
+        try {
+            gitRun(tmpWorktreeDir, ['apply', '--index', patchFile]);
+        }
+        catch (err) {
+            applyErr = `git apply failed: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        if (!applyErr) {
+            // Commit the applied changes on the new branch.
+            try {
+                gitRun(tmpWorktreeDir, [
+                    'commit',
+                    '--no-verify',
+                    '-m',
+                    `ashlr: apply proposal ${proposalId}`,
+                ]);
+                commitSha = gitTry(tmpWorktreeDir, ['rev-parse', 'HEAD']);
+            }
+            catch (err) {
+                applyErr = `git commit failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        }
+    }
+    finally {
+        // Always remove the temp patch file.
+        if (patchFile) {
+            try {
+                unlinkSync(patchFile);
+            }
+            catch {
+                // ignore cleanup errors
+            }
+        }
+        // Always remove the worktree (removes the tmpWorktreeDir checkout).
+        // The branch itself remains in the repo — that's the desired output.
+        gitTry(repo, ['worktree', 'remove', '--force', tmpWorktreeDir]);
+        gitTry(repo, ['worktree', 'prune']);
+        // If apply/commit failed, also delete the scratch branch to leave no
+        // dangling refs. The branch is in our namespace so this is safe.
+        if (applyErr && branch.startsWith(PROPOSAL_BRANCH_PREFIX)) {
+            gitTry(repo, ['branch', '-D', branch]);
+        }
+    }
+    if (applyErr) {
+        return { ok: false, detail: applyErr };
+    }
+    const sha = commitSha ? ` @ ${commitSha.slice(0, 8)}` : '';
+    return {
+        ok: true,
+        detail: `patch applied on branch ${branch}${sha} (local only, not pushed)`,
+    };
+}
+/**
+ * Create a branch + commit from the diff, then open a PR via the gated M18
+ * createPr path. EXPLICIT + GATED — never auto-triggered.
+ */
+async function applyPr(repo, proposalId, title, summary, diff) {
+    if (!isRepo(repo)) {
+        return { ok: false, detail: `not a git repository: ${repo}` };
+    }
+    // First apply the patch to a new branch (same isolation as 'patch' kind).
+    if (diff && diff.trim()) {
+        const patchResult = await applyPatch(repo, proposalId, diff);
+        if (!patchResult.ok) {
+            return { ok: false, detail: `patch step failed: ${patchResult.detail}` };
+        }
+    }
+    // The branch was created by applyPatch above (same full-id naming).
+    const branch = `${PROPOSAL_BRANCH_PREFIX}${proposalId}`;
+    // Call the gated M18 createPr — EXPLICIT path, never auto.
+    const prResult = await createPr(repo, {
+        title,
+        body: summary,
+        head: branch,
+    });
+    if (!prResult.ok) {
+        return { ok: false, detail: `gh pr create failed: ${prResult.detail}` };
+    }
+    return {
+        ok: true,
+        detail: prResult.detail,
+    };
+}
+// ---------------------------------------------------------------------------
+// applyProposal — the ONLY outward path
+// ---------------------------------------------------------------------------
+/**
+ * Apply an approved proposal. This is the ONLY outward mutation path in v2.
+ *
+ * REFUSES (ok:false, mutates nothing) unless ALL hold:
+ *   1. Proposal exists (loadProposal !== null)
+ *   2. proposal.status === 'approved'
+ *   3. opts.confirmed === true
+ *
+ * Never throws — all failures returned as ApplyResult with status 'failed'.
+ */
+export async function applyProposal(id, opts) {
+    // ── Gate 1: proposal must exist ──────────────────────────────────────────
+    const proposal = loadProposal(id);
+    if (!proposal) {
+        audit({
+            action: 'inbox:apply',
+            repo: null,
+            sandboxId: id,
+            summary: `refused: proposal ${id} not found`,
+            result: 'refused',
+        });
+        return {
+            ok: false,
+            status: 'failed',
+            detail: `proposal not found: ${id}`,
+        };
+    }
+    // ── Gate 2: must be approved ─────────────────────────────────────────────
+    if (proposal.status !== 'approved') {
+        audit({
+            action: 'inbox:apply',
+            repo: proposal.repo,
+            sandboxId: id,
+            summary: `refused: proposal ${id} status is '${proposal.status}', must be 'approved'`,
+            result: 'refused',
+        });
+        return {
+            ok: false,
+            status: proposal.status,
+            detail: `proposal status is '${proposal.status}'; must be 'approved' before applying`,
+        };
+    }
+    // ── Gate 3: must be explicitly confirmed ─────────────────────────────────
+    if (!opts.confirmed) {
+        audit({
+            action: 'inbox:apply',
+            repo: proposal.repo,
+            sandboxId: id,
+            summary: `refused: proposal ${id} apply not confirmed`,
+            result: 'refused',
+        });
+        return {
+            ok: false,
+            status: 'approved',
+            detail: 'apply not confirmed; pass confirmed:true (via --yes or interactive prompt)',
+        };
+    }
+    // ── Gate 4: 'note' kind — no-op, record and return ───────────────────────
+    if (proposal.kind === 'note') {
+        setStatus(id, 'applied', 'note recorded (no-op)');
+        audit({
+            action: 'inbox:apply',
+            repo: proposal.repo,
+            sandboxId: id,
+            summary: `note proposal ${id} applied (no-op)`,
+            result: 'ok',
+        });
+        return { ok: true, status: 'applied', detail: 'note recorded (no-op)' };
+    }
+    // ── Gate 5: enrollment + kill switch ─────────────────────────────────────
+    // 'note' is exempt (never mutates). All other kinds require enrollment.
+    const repo = proposal.repo;
+    if (!repo) {
+        const detail = 'proposal has no repo; cannot apply a mutating kind without a target repo';
+        setStatus(id, 'failed', detail);
+        audit({
+            action: 'inbox:apply',
+            repo: null,
+            sandboxId: id,
+            summary: `failed: ${detail}`,
+            result: 'error',
+        });
+        return { ok: false, status: 'failed', detail };
+    }
+    try {
+        assertMayMutate(repo);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        // REFUSAL — not a failure. Nothing was mutated and the proposal remains
+        // 'approved' so it can be retried after enrolling / clearing the kill switch.
+        // Advancing to 'failed' here would wrongly burn an approved proposal.
+        audit({
+            action: 'inbox:apply',
+            repo,
+            sandboxId: id,
+            summary: `refused by policy gate: ${detail}`,
+            result: 'refused',
+        });
+        return { ok: false, status: 'approved', detail };
+    }
+    // ── Dispatch by kind ─────────────────────────────────────────────────────
+    let result;
+    try {
+        switch (proposal.kind) {
+            case 'patch': {
+                if (!proposal.diff) {
+                    result = { ok: false, detail: 'proposal has no diff to apply' };
+                }
+                else {
+                    result = await applyPatch(repo, id, proposal.diff);
+                }
+                break;
+            }
+            case 'pr': {
+                result = await applyPr(repo, id, proposal.title, proposal.summary, proposal.diff);
+                break;
+            }
+            case 'deploy': {
+                // The gated ship/deploy path. Attempt to load the ship module dynamically
+                // so this module stays importable even before the ship module exists.
+                // The deploy gate requires its own --confirm per the contract.
+                try {
+                    // Dynamic import via indirection so TypeScript's static module resolver
+                    // does not error on the not-yet-implemented ship.ts. At runtime this
+                    // resolves correctly when ship.ts is present, and falls back to null.
+                    const shipPath = new URL('../ship.js', import.meta.url).href;
+                    const shipMod = await new Function('p', 'return import(p)')(shipPath).catch(() => null);
+                    const shipObj = (shipMod !== null && typeof shipMod === 'object')
+                        ? shipMod
+                        : null;
+                    if (!shipObj || typeof shipObj['ship'] !== 'function') {
+                        result = {
+                            ok: false,
+                            detail: 'deploy kind requires the ship module (core/ship.ts) — not yet available in this build',
+                        };
+                    }
+                    else {
+                        // The ship function is itself gated; pass confirmed:true since we
+                        // already confirmed at the inbox layer.
+                        const shipFn = shipObj['ship'];
+                        const shipResult = await shipFn(repo, { confirmed: true });
+                        result = shipResult;
+                    }
+                }
+                catch (err) {
+                    result = {
+                        ok: false,
+                        detail: `deploy failed: ${err instanceof Error ? err.message : String(err)}`,
+                    };
+                }
+                break;
+            }
+            default: {
+                // Exhaustiveness guard — should never reach here given the type.
+                result = {
+                    ok: false,
+                    detail: `unknown proposal kind: ${String(proposal.kind)}`,
+                };
+            }
+        }
+    }
+    catch (err) {
+        // Belt-and-suspenders: the dispatch must never throw out.
+        result = {
+            ok: false,
+            detail: `unexpected error: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // ── Persist outcome + audit ───────────────────────────────────────────────
+    const finalStatus = result.ok ? 'applied' : 'failed';
+    setStatus(id, finalStatus, result.detail);
+    audit({
+        action: 'inbox:apply',
+        repo,
+        sandboxId: id,
+        summary: `proposal ${id} (${proposal.kind}) ${finalStatus}: ${result.detail}`,
+        result: result.ok ? 'ok' : 'error',
+    });
+    return {
+        ok: result.ok,
+        status: finalStatus,
+        detail: result.detail,
+    };
+}
+//# sourceMappingURL=apply.js.map

package/dist/core/inbox/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/core/inbox/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,uCAAuC;AACvC,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,qDAAqD;AACrD,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc;IACzC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG;QACH,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,qEAAqE;AACrE,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,UAAkB,EAClB,IAAY;IAEZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,MAAM,GAAG,GAAG,sBAAsB,GAAG,UAAU,EAAE,CAAC;IAExD,mDAAmD;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,kBAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,CACzB,OAAO,EAAE,EACT,QAAQ,EACR,KAAK,EACL,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CACvC,CAAC;IAEF,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE;YACX,UAAU;YACV,KAAK;YACL,IAAI;YACJ,MAAM;YACN,cAAc;YACd,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8CAA8C;QAC9C,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAE/B,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,GAAG,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,gDAAgD;YAChD,IAAI,CAAC;gBACH,MAAM,CAAC,cAAc,EAAE;oBACrB,QAAQ;oBACR,aAAa;oBACb,IAAI;oBACJ,yBAAyB,UAAU,EAAE;iBACtC,CAAC,CAAC;gBACH,SAAS,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,GAAG,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,UAAU,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpC,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,2BAA2B,MAAM,GAAG,GAAG,2BAA2B;KAC3E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,UAAkB,EAClB,KAAa,EACb,OAAe,EACf,IAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,0EAA0E;IAC1E,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,GAAG,sBAAsB,GAAG,UAAU,EAAE,CAAC;IAExD,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE;QACpC,KAAK;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,IAA4B;IAE5B,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,qBAAqB,EAAE,YAAY;YAC5C,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,uBAAuB,EAAE,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,KAAK,CAAC;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,qBAAqB,EAAE,eAAe,QAAQ,CAAC,MAAM,uBAAuB;YACrF,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,uBAAuB,QAAQ,CAAC,MAAM,uCAAuC;SACtF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,qBAAqB,EAAE,sBAAsB;YACtD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAClD,KAAK,CAAC;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,iBAAiB,EAAE,kBAAkB;YAC9C,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,0EAA0E,CAAC;QAC1F,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChC,KAAK,CAAC;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,WAAW,MAAM,EAAE;YAC5B,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,wEAAwE;QACxE,8EAA8E;QAC9E,sEAAsE;QACtE,KAAK,CAAC;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI;YACJ,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,2BAA2B,MAAM,EAAE;YAC5C,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;IAED,4EAA4E;IAC5E,IAAI,MAAuC,CAAC;IAE5C,IAAI,CAAC;QACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnB,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;gBAClE,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,MAAM,GAAG,MAAM,OAAO,CACpB,IAAI,EACJ,EAAE,EACF,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,IAAI,CACd,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,0EAA0E;gBAC1E,sEAAsE;gBACtE,+DAA+D;gBAC/D,IAAI,CAAC;oBACH,wEAAwE;oBACxE,qEAAqE;oBACrE,sEAAsE;oBACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC7D,MAAM,OAAO,GAAG,MAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC9G,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC;wBAC/D,CAAC,CAAE,OAAmC;wBACtC,CAAC,CAAC,IAAI,CAAC;oBACT,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;wBACtD,MAAM,GAAG;4BACP,EAAE,EAAE,KAAK;4BACT,MAAM,EACJ,uFAAuF;yBAC1F,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,kEAAkE;wBAClE,wCAAwC;wBACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAGgB,CAAC;wBAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC3D,MAAM,GAAG,UAAU,CAAC;oBACtB,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG;wBACP,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;qBAC7E,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,iEAAiE;gBACjE,MAAM,GAAG;oBACP,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,0BAA0B,MAAM,CAAE,QAA6B,CAAC,IAAI,CAAC,EAAE;iBAChF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,MAAM,GAAG;YACP,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE1C,KAAK,CAAC;QACJ,MAAM,EAAE,aAAa;QACrB,IAAI;QACJ,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,YAAY,EAAE,KAAK,QAAQ,CAAC,IAAI,KAAK,WAAW,KAAK,MAAM,CAAC,MAAM,EAAE;QAC7E,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;KACnC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC"}

package/dist/core/inbox/notify-proposal.d.ts

@@ -0,0 +1,13 @@
+/**
+ * M32: new-proposal notification fan-out — desktop (macOS, opt-in) + the
+ * existing webhook notify() (opt-in), fired when an UNATTENDED path (daemon
+ * tick, background swarm) creates a PENDING proposal.
+ *
+ * Deliberately OUTSIDE inbox/store.ts (whose contract is pure persistence).
+ * METADATA ONLY: title/kind/id — never the diff, never repo contents.
+ * Best-effort and never throws; failures are silent (notification is a
+ * convenience, not a control path).
+ */
+import type { AshlrConfig, Proposal } from '../types.js';
+/** Fire desktop + webhook notifications for a newly created proposal. */
+export declare function notifyNewProposal(proposal: Proposal, cfg: AshlrConfig): Promise<void>;

package/dist/core/inbox/notify-proposal.js

@@ -0,0 +1,21 @@
+/**
+ * M32: new-proposal notification fan-out — desktop (macOS, opt-in) + the
+ * existing webhook notify() (opt-in), fired when an UNATTENDED path (daemon
+ * tick, background swarm) creates a PENDING proposal.
+ *
+ * Deliberately OUTSIDE inbox/store.ts (whose contract is pure persistence).
+ * METADATA ONLY: title/kind/id — never the diff, never repo contents.
+ * Best-effort and never throws; failures are silent (notification is a
+ * convenience, not a control path).
+ */
+import { desktopNotify } from '../integrations/desktop-notify.js';
+import { notify } from '../integrations/notify.js';
+/** Fire desktop + webhook notifications for a newly created proposal. */
+export async function notifyNewProposal(proposal, cfg) {
+    const line = `[${proposal.kind}] ${proposal.title} — review: ashlr inbox show ${proposal.id}`;
+    await Promise.all([
+        desktopNotify('ashlr: new proposal', line, cfg).catch(() => false),
+        notify(`ashlr: new pending proposal ${line}`, cfg).catch(() => false),
+    ]);
+}
+//# sourceMappingURL=notify-proposal.js.map

package/dist/core/inbox/notify-proposal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-proposal.js","sourceRoot":"","sources":["../../../src/core/inbox/notify-proposal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEnD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,GAAgB;IAC1E,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,+BAA+B,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC9F,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,aAAa,CAAC,qBAAqB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QAClE,MAAM,CAAC,+BAA+B,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;KACtE,CAAC,CAAC;AACL,CAAC"}

package/dist/core/inbox/store.d.ts

@@ -0,0 +1,67 @@
+/**
+ * store.ts — Proposal persistence for the M23 approval inbox.
+ *
+ * Persists one proposal per file at ~/.ashlr/inbox/<id>.json.
+ *
+ * GUARDRAILS:
+ *  - PURE PERSISTENCE: never applies anything, never mutates a repo, never
+ *    auto-advances status. Status changes happen ONLY through setStatus().
+ *  - Never throws: all exported functions swallow errors and return safe
+ *    defaults (null / [] / 0) so callers remain unblocked.
+ *  - Atomic write: write to <id>.json.tmp then rename, matching the pattern
+ *    in core/portfolio/backlog.ts.
+ *  - No secrets stored: diffs contain user-owned code (fine); tokens/keys are
+ *    not proposal fields. audit() strips secrets defensively on its side.
+ */
+import type { Proposal, ProposalStatus } from '../types.js';
+/**
+ * Absolute path to the inbox directory: ~/.ashlr/inbox.
+ * Created lazily by createProposal / setStatus — this function does NOT
+ * create it.
+ */
+export declare function inboxDir(): string;
+/**
+ * Create a new proposal, persist it, audit the creation, and return it.
+ *
+ * Assigns:
+ *  - `id`        — fresh unique slug (stable, filename-safe)
+ *  - `status`    — 'pending'
+ *  - `createdAt` — current ISO timestamp
+ *
+ * NEVER applies or mutates any repo.
+ * Never throws — on persistence failure the in-memory proposal is still
+ * returned (best-effort).
+ */
+export declare function createProposal(p: Omit<Proposal, 'id' | 'status' | 'createdAt'>): Proposal;
+/**
+ * List all persisted proposals, most-recent first by `createdAt`.
+ * Optionally filter by status.
+ *
+ * Read-only. Unreadable / corrupt files are silently skipped.
+ * Never throws.
+ */
+export declare function listProposals(filter?: {
+    status?: ProposalStatus;
+}): Proposal[];
+/**
+ * Load a single proposal by id.
+ * Returns null if absent, unreadable, or malformed.
+ * Never throws.
+ */
+export declare function loadProposal(id: string): Proposal | null;
+/**
+ * Persist a new status (and optional result detail) for an existing proposal.
+ *
+ * - Sets `decidedAt` to now when moving to 'approved' or 'rejected'.
+ * - No-op if the proposal does not exist or cannot be read.
+ * - NEVER applies anything — pure persistence change only.
+ * - Audits the decision.
+ * - Never throws.
+ */
+export declare function setStatus(id: string, status: ProposalStatus, result?: string): void;
+/**
+ * Count proposals with status === 'pending'.
+ * Read-only. Returns 0 on any error.
+ * Never throws.
+ */
+export declare function pendingCount(): number;