@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/shared/pending-proposals.js

@@ -0,0 +1,98 @@
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
+import { workspaceIdForBranch } from './workspace-id.js';
+import { canonicalEmail, hashEmail } from './email-identity.js';
+import { printable } from './printable.js';
+import { logger } from './logging.js';
+const log = logger('pending-proposals');
+/**
+ * Every file matching `matches` that an OPEN change request proposes and this
+ * caller is entitled to see, with its branch content in hand.
+ *
+ * Never throws: these surfaces hang off the library's list load, and a review
+ * shelf that cannot answer must not take the shelf down with it. Everything
+ * degrades to "nothing pending".
+ *
+ * `matches` is where a surface states what it is looking for — and, because it
+ * runs BEFORE the access batch, also where it drops what it already serves from
+ * the default branch, so the batch stays as small as the answer.
+ *
+ * Order follows the change requests as the workflow service listed them; a
+ * caller that wants a stable reading order sorts the result itself.
+ */
+export async function visibleProposedFiles(sources, userEmail, matches) {
+    const email = canonicalEmail(userEmail);
+    if (!email)
+        return [];
+    let crs;
+    try {
+        // Open, and aimed at the DEFAULT BRANCH. Everything downstream is written
+        // in terms of that branch — the released set that decides "added", and the
+        // access tree that decides who may review — so a request targeting some
+        // other branch is not a proposal these surfaces can speak about: merging it
+        // puts nothing in the catalog, and the card would never resolve.
+        crs = (await sources.workflow.listChangeRequests()).filter((c) => c.state === 'open' && c.base === DEFAULT_BRANCH);
+    }
+    catch {
+        return [];
+    }
+    if (crs.length === 0)
+        return [];
+    const candidates = crs.flatMap((cr) => cr.touchedNodePaths.filter(matches).map((path) => ({ cr, path })));
+    if (candidates.length === 0)
+        return [];
+    const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+    const authorHash = hashEmail(email);
+    // One access load for every candidate, resolved on the DEFAULT branch — see
+    // the note on {@link ProposalSources}.
+    const writable = await sources.accessControl
+        .canWriteBatch(wsId, email, candidates.map((c) => c.path))
+        .catch(() => new Map());
+    // The branch copies are read through the default branch's clone at
+    // `origin/<branch>`, so a proposal never needs a clone of its own. Refresh
+    // first, best-effort: a request pushed seconds ago is worth one fetch, and a
+    // failed fetch should degrade to "read what we have".
+    await sources.workspaceService.ensureRemotesFetched(wsId).catch(() => undefined);
+    const out = [];
+    for (const { cr, path } of candidates) {
+        const isAuthor = !!cr.authorId && cr.authorId === authorHash;
+        // Fail closed, matching the catalog: only an explicit `true` admits a
+        // reviewer. A missing entry (the batch skipped the path, the tree could not
+        // be read) means denied, never shown.
+        if (!isAuthor && writable.get(path) !== true)
+            continue;
+        const content = await readAt(sources.workspaceService, wsId, cr.branch, path);
+        // Nothing to describe: the request touched the path but the file is gone at
+        // its head (proposed then withdrawn within the branch), or unreadable.
+        if (content === null)
+            continue;
+        out.push({ cr, path, content, isAuthor });
+    }
+    return out;
+}
+/**
+ * The file at a branch, or null when it is not there.
+ *
+ * `readFileAtRef` ALREADY answers `null` for genuine absence (a `git show` that
+ * finds no such blob), so everything reaching the catch below is an infra
+ * failure instead — an unresolvable workspace, a rejected ref, a git call that
+ * timed out. The contract of this module is "never throws", so those still
+ * become `null` and the card still drops; what they must not do is drop
+ * SILENTLY, which is how a fetch problem reads as "the proposer withdrew it".
+ * The warning is the difference between a shelf that degraded and a shelf that
+ * lied.
+ */
+export async function readAt(workspaceService, wsId, branch, repoRelPath) {
+    try {
+        return await workspaceService.readFileAtRef(wsId, `origin/${branch}`, repoRelPath);
+    }
+    catch (err) {
+        // Every interpolated value is attacker-shaped: the path and the branch come
+        // off a change request somebody else opened, and the reason comes off git.
+        // A raw newline or an escape sequence in any of them forges a log line or
+        // steers the operator's terminal, so all three go through `printable`.
+        log.warn(`could not read ${printable(repoRelPath)} at origin/${printable(branch)} in ${printable(wsId)}; ` +
+            `dropping it from the review shelf: ${printable(err instanceof Error ? err.message : String(err))}`);
+        return null;
+    }
+}
+//# sourceMappingURL=pending-proposals.js.map

package/dist/shared/pending-proposals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-proposals.js","sourceRoot":"","sources":["../../src/shared/pending-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA6C,MAAM,iCAAiC,CAAC;AAE5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AA0CxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAwB,EACxB,SAAiB,EACjB,OAAyC;IAEzC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CACvD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpC,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa;SACzC,aAAa,CACZ,IAAI,EACJ,KAAK,EACL,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC9B;SACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAmB,CAAC,CAAC;IAE3C,mEAAmE;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,OAAO,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEjF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,UAAU,CAAC;QAC7D,sEAAsE;QACtE,4EAA4E;QAC5E,sCAAsC;QACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9E,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,gBAAyD,EACzD,IAAY,EACZ,MAAc,EACd,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,GAAG,CAAC,IAAI,CACN,kBAAkB,SAAS,CAAC,WAAW,CAAC,cAAc,SAAS,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI;YAC/F,sCAAsC,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CACtG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/shared/printable.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Re-export, so this backend's ~20 call sites keep their short import while
+ * the function itself lives where BOTH MCP surfaces can reach it.
+ *
+ * The local server (`@bevel-software/hexis-mcp`) is published standalone and
+ * cannot import this package, but it logs the same kind of text — a reason
+ * string that came off the network — to the same kind of operator log. Two
+ * copies of an escaper is two escapers that drift, so it moved to the one
+ * package both already depend on. See `printable` there for what it escapes
+ * and why.
+ */
+export { printable } from '@bevel-software/platform-mcp-core';
+export declare function sanitizedPath(text: string): string;
+/**
+ * JSON text as a terminal can show it: `JSON.stringify` escapes the C0
+ * controls inside strings and leaves the C1 range and the line separators
+ * raw, so those are escaped here — still the same JSON to any reader of it,
+ * since they can only occur inside a string. For a document, not a path:
+ * the JSON's own line breaks (pretty-printing) are left alone.
+ */
+export declare function terminalSafeJson(json: string): string;
+//# sourceMappingURL=printable.d.ts.map

package/dist/shared/printable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"printable.d.ts","sourceRoot":"","sources":["../../src/shared/printable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AA2C9D,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD"}

package/dist/shared/printable.js

@@ -0,0 +1,65 @@
+/**
+ * Re-export, so this backend's ~20 call sites keep their short import while
+ * the function itself lives where BOTH MCP surfaces can reach it.
+ *
+ * The local server (`@bevel-software/hexis-mcp`) is published standalone and
+ * cannot import this package, but it logs the same kind of text — a reason
+ * string that came off the network — to the same kind of operator log. Two
+ * copies of an escaper is two escapers that drift, so it moved to the one
+ * package both already depend on. See `printable` there for what it escapes
+ * and why.
+ */
+export { printable } from '@bevel-software/platform-mcp-core';
+/**
+ * A path (or any short text) as it may be interpolated into a ONE-LINE
+ * message: every character a caller can put in a filename that RENDERS as a
+ * line break is escaped, so a refusal naming the path stays one line and
+ * cannot forge a second.
+ *
+ * That is every C0 and C1 control character — CR and LF, the other mandatory
+ * breaks (vertical tab, form feed, NEL), and the one-byte escapes a terminal
+ * obeys (U+009B starts an ANSI sequence on its own) — and the Unicode line
+ * separators U+2028/U+2029 with them: `JSON.stringify` leaves the C1 range
+ * and the separators raw, so a path that carries one survives being carried
+ * — in the `path` field of a not-found body, in a log line — and breaks or
+ * steers the line wherever it is finally rendered. {@link printable} escapes
+ * the same set for exactly that reason; the spelling is the same too (`\n`,
+ * `\t`, else `\uXXXX`), so a path reads alike in a refusal and in a log.
+ *
+ * Unquoted, unlike {@link printable}: this text is read by a person or an
+ * agent inside a sentence that already quotes it, not by an operator scanning
+ * a log. THE spelling for that job — `displayPath` in the file readers is this
+ * function, and the missing-path refusals use it too, so a path reads the same
+ * however it is refused.
+ */
+// The names JSON gives its escapes — and so what `printable`, which is
+// `JSON.stringify` underneath, writes for the same characters; every other
+// control is `\uXXXX` in both, so a path reads the same in a refusal and
+// in a log. (JSON has no name for vertical tab, so neither does this.)
+const NAMED_ESCAPES = new Map([
+    ['\b', '\\b'],
+    ['\t', '\\t'],
+    ['\n', '\\n'],
+    ['\f', '\\f'],
+    ['\r', '\\r'],
+]);
+// Built rather than written: the lint rule against control characters in a
+// regex literal guards against accidental ones, and these are the point.
+const CONTROL_OR_SEPARATOR = new RegExp(`[\\x00-\\x1F\\x7F-\\x9F${String.fromCharCode(0x2028, 0x2029)}]`, 'g');
+/** The characters `JSON.stringify` leaves raw: the C1 range and the two line separators. */
+const RAW_AFTER_JSON = new RegExp(`[\\x7F-\\x9F${String.fromCharCode(0x2028, 0x2029)}]`, 'g');
+const uEscape = (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
+export function sanitizedPath(text) {
+    return text.replace(CONTROL_OR_SEPARATOR, (c) => NAMED_ESCAPES.get(c) ?? uEscape(c));
+}
+/**
+ * JSON text as a terminal can show it: `JSON.stringify` escapes the C0
+ * controls inside strings and leaves the C1 range and the line separators
+ * raw, so those are escaped here — still the same JSON to any reader of it,
+ * since they can only occur inside a string. For a document, not a path:
+ * the JSON's own line breaks (pretty-printing) are left alone.
+ */
+export function terminalSafeJson(json) {
+    return json.replace(RAW_AFTER_JSON, uEscape);
+}
+//# sourceMappingURL=printable.js.map

package/dist/shared/printable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"printable.js","sourceRoot":"","sources":["../../src/shared/printable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,KAAK,CAAC;IACb,CAAC,IAAI,EAAE,KAAK,CAAC;IACb,CAAC,IAAI,EAAE,KAAK,CAAC;IACb,CAAC,IAAI,EAAE,KAAK,CAAC;IACb,CAAC,IAAI,EAAE,KAAK,CAAC;CACd,CAAC,CAAC;AACH,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,0BAA0B,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/G,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,eAAe,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAE9F,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAE7F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/shared/redact-secret.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Scrub credentials from anything that reaches a log or an error message:
+ * the token in effect wherever it appears, URL userinfo — a remote spelled
+ * `https://user:pass@host` would otherwise leak `pass` verbatim through every
+ * git failure that quotes the URL back — and URL query strings, where a
+ * presigned remote keeps its credential.
+ *
+ * "The token in effect" is every place one can come from: each environment
+ * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
+ * boot, but a later write to one of them is not normalised), plus whatever the
+ * caller knows about — the settings-stored token, a token a request brought
+ * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
+ * so a secret that contains another is not half-scrubbed.
+ *
+ * Shared, not a module's own: the KB startup phase and the setup routes both
+ * log git's words, and one scrub is the only way they cannot disagree about
+ * what a secret is.
+ */
+export declare function redactSecret(text: string, secrets?: readonly (string | null | undefined)[]): string;
+/**
+ * A remote's query, named as literal secrets for {@link redactSecret}: the
+ * query as written and each value in it, raw and percent-decoded.
+ *
+ * `redactSecret` drops a query that FOLLOWS a URL. Naming the values as well
+ * scrubs them wherever else they turn up — decoded, or on their own — where no
+ * URL pattern can see them. Values too short to be a credential are left alone,
+ * so a `3600` in the query does not garble every number in the log.
+ */
+export declare function urlQuerySecrets(url: string | null | undefined): string[];
+//# sourceMappingURL=redact-secret.d.ts.map

package/dist/shared/redact-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-secret.d.ts","sourceRoot":"","sources":["../../src/shared/redact-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAO,GAAG,MAAM,CAsDvG;AAYD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAgBxE"}

package/dist/shared/redact-secret.js

@@ -0,0 +1,114 @@
+/**
+ * Scrub credentials from anything that reaches a log or an error message:
+ * the token in effect wherever it appears, URL userinfo — a remote spelled
+ * `https://user:pass@host` would otherwise leak `pass` verbatim through every
+ * git failure that quotes the URL back — and URL query strings, where a
+ * presigned remote keeps its credential.
+ *
+ * "The token in effect" is every place one can come from: each environment
+ * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
+ * boot, but a later write to one of them is not normalised), plus whatever the
+ * caller knows about — the settings-stored token, a token a request brought
+ * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
+ * so a secret that contains another is not half-scrubbed.
+ *
+ * Shared, not a module's own: the KB startup phase and the setup routes both
+ * log git's words, and one scrub is the only way they cannot disagree about
+ * what a secret is.
+ */
+export function redactSecret(text, secrets = []) {
+    const tokens = [
+        process.env.GITHUB_TOKEN,
+        process.env.GIT_TOKEN,
+        process.env.GH_TOKEN,
+        ...secrets,
+    ]
+        .map((t) => t?.trim())
+        .filter((t) => !!t);
+    let scrubbed = text;
+    const ordered = [...new Set(tokens)].sort((a, b) => b.length - a.length);
+    // Every whole value first, then every echoed PREFIX. Git and the providers
+    // elide the middle of a token they quote back (`ghp_abcdef…`), and an exact
+    // match would leave that head on screen — enough of a secret to be one.
+    // Both can be in one text (the value in a URL, the elided form in the
+    // host's reply), so the prefix pass runs whether or not the whole was
+    // found — but only once every whole value is gone, or the head two tokens
+    // share (`ghp_from…`) would garble the second before its own turn came.
+    // Down to a floor, so a short common head (`ghp_`) does not garble every
+    // other token in the log.
+    for (const token of ordered)
+        scrubbed = scrubbed.replaceAll(token, '***');
+    // Every echoed prefix of every token, LONGEST FIRST ACROSS TOKENS — not
+    // token by token: two tokens can share a head longer than the floor
+    // (`ghp_abcdefgh…`), and one token's shorter prefix, taken first, would
+    // scrub that head out of the other's echo and leave the rest of it on
+    // screen (`***Y123…`). Longest first, the longer echo goes whole.
+    const prefixes = ordered.flatMap((token) => Array.from({ length: Math.max(0, token.length - MIN_ECHOED_PREFIX_LENGTH) }, (_, i) => token.slice(0, token.length - 1 - i)));
+    for (const prefix of [...new Set(prefixes)].sort((a, b) => b.length - a.length)) {
+        if (scrubbed.includes(prefix))
+            scrubbed = scrubbed.replaceAll(prefix, '***');
+    }
+    return (scrubbed
+        // Through the LAST `@` before the path: a password can carry an
+        // unencoded `@` of its own (`https://user:p@ss@host`), and stopping at
+        // the first would leave the rest of it in the log.
+        .replace(/:\/\/[^/\s]*@/g, '://***@')
+        // A presigned remote carries its credential in the query instead
+        // (`?X-Amz-Signature=…`, `?access_token=…`). A git remote has no query
+        // worth keeping in a log, so the whole of it goes — up to whitespace or
+        // a fragment, not to the first quote: a credential can carry a quote
+        // of its own, and stopping there would leave the rest of it in the log.
+        // When git quoted the URL, the LAST quote of that kind before the next
+        // space is the one closing it, and what follows it (`': 403`) is kept.
+        .replace(/(\bhttps?:\/\/[^\s?#'"]+)\?([^\s#]*)/gi, (_m, url, query, offset, whole) => {
+        const opener = whole[offset - 1];
+        const closing = opener === "'" || opener === '"' ? query.lastIndexOf(opener) : -1;
+        return `${url}?***${closing === -1 ? '' : query.slice(closing)}`;
+    }));
+}
+/** Shorter than this, a query value is not a credential (`X-Amz-Expires=3600`). */
+const MIN_SECRET_LENGTH = 8;
+/**
+ * The shortest head of a token that is still scrubbed when only a prefix of
+ * it was echoed — the same floor the connection probe's redactor uses. Below
+ * it a head is a vendor's common prefix, not a secret.
+ */
+const MIN_ECHOED_PREFIX_LENGTH = 8;
+/**
+ * A remote's query, named as literal secrets for {@link redactSecret}: the
+ * query as written and each value in it, raw and percent-decoded.
+ *
+ * `redactSecret` drops a query that FOLLOWS a URL. Naming the values as well
+ * scrubs them wherever else they turn up — decoded, or on their own — where no
+ * URL pattern can see them. Values too short to be a credential are left alone,
+ * so a `3600` in the query does not garble every number in the log.
+ */
+export function urlQuerySecrets(url) {
+    let query;
+    try {
+        query = url ? new URL(url.trim()).search.slice(1) : '';
+    }
+    catch {
+        return [];
+    }
+    const secrets = new Set();
+    if (query.length >= MIN_SECRET_LENGTH)
+        secrets.add(query);
+    for (const part of query.split('&')) {
+        const raw = part.slice(part.indexOf('=') + 1);
+        for (const value of [raw, decoded(raw)]) {
+            if (value.length >= MIN_SECRET_LENGTH)
+                secrets.add(value);
+        }
+    }
+    return [...secrets];
+}
+function decoded(value) {
+    try {
+        return decodeURIComponent(value.replace(/\+/g, ' '));
+    }
+    catch {
+        return value;
+    }
+}
+//# sourceMappingURL=redact-secret.js.map

package/dist/shared/redact-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-secret.js","sourceRoot":"","sources":["../../src/shared/redact-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,UAAkD,EAAE;IAC7F,MAAM,MAAM,GAAG;QACb,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,OAAO,CAAC,GAAG,CAAC,SAAS;QACrB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,OAAO;KACX;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,0BAA0B;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7H,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CACL,QAAQ;QACN,gEAAgE;QAChE,uEAAuE;QACvE,mDAAmD;SAClD,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC;QACrC,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;SACtE,OAAO,CACN,wCAAwC,EACxC,CAAC,EAAE,EAAE,GAAW,EAAE,KAAa,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,GAAG,GAAG,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC,CACF,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAA8B;IAC5D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/shared/rename-no-replace.d.ts

@@ -0,0 +1,119 @@
+import type { Stats } from 'node:fs';
+import { type ExistingEntryKind } from '@bevel-software/platform-shared';
+/**
+ * A move or copy refused because its destination is taken. Carries the kind
+ * so the caller can raise it as whatever its surface answers with — the
+ * workspace service's `EntryExistsError` (409 to the sidebar), a `ToolError`
+ * (409 to the agent) — without re-deriving the sentence.
+ */
+export declare class DestinationTakenError extends Error {
+    readonly entryKind: ExistingEntryKind;
+    readonly destination: string;
+    readonly status = 409;
+    constructor(entryKind: ExistingEntryKind, destination: string);
+}
+/** What is at the destination, as far as a move from `oldPath` is concerned. */
+export type DestinationVerdict = 
+/** Nothing is there; the move may land. */
+{
+    state: 'free';
+}
+/**
+ * The entry there IS the source: a case-insensitive filesystem opening
+ * `Notes.md` and `notes.md` as one file. That is the rename that was asked
+ * for, not a clash.
+ */
+ | {
+    state: 'self';
+}
+/** Something else has the name. */
+ | {
+    state: 'taken';
+    kind: ExistingEntryKind;
+};
+/** The entry at `absolutePath` without following a link, or null when nothing is there. */
+export declare function lstatOrNull(absolutePath: string): Promise<Stats | null>;
+/** What the reading needs of an entry: which one it is, and whether it is a folder. */
+export interface EntryIdentity {
+    dev: number;
+    ino: number;
+    isDirectory(): boolean;
+}
+/**
+ * The two filesystem facts a destination reading is made of: what is at a
+ * path, and what a folder lists.
+ *
+ * It is a seam for ONE reason, stated plainly because it is the only thing
+ * that justifies it: the reading's whole case-folding half — every answer of
+ * `self`, which is what "a case-only rename is not a clash" means — can be
+ * produced only by a case-insensitive volume, and there is none on the Linux
+ * that CI and the container run. No `mount` and no `mkfs.vfat` in the
+ * container either, so one cannot be made. Gated behind a `foldsCase()` probe,
+ * those branches were executed by nothing on any machine that runs the suite,
+ * while four review rounds reshaped them. A probe standing in for a folding
+ * volume runs them everywhere.
+ *
+ * Deliberately narrow: the facts the reading consults, and nothing else. The
+ * MOVE itself — `link`, `mkdir`, `rename`, `unlink` — has no seam and takes no
+ * probe. Those calls are the guarantee, and a guarantee that can be faked in a
+ * test is not one.
+ */
+export interface DestinationProbe {
+    /** What is at `absolutePath` itself, a link as a link; null when nothing is there. */
+    lstat(absolutePath: string): Promise<EntryIdentity | null>;
+    /** The names `folder` lists; rejects when it cannot be read. */
+    readdir(folder: string): Promise<string[]>;
+}
+/** The real disk — what every caller uses. */
+export declare const diskProbe: DestinationProbe;
+/**
+ * The one reading of "is this destination the source under another name?".
+ *
+ * `lstat`, never `stat`: a link at the destination is an entry in its own
+ * right.
+ */
+export declare function inspectDestination(oldAbsolute: string, newAbsolute: string, probe?: DestinationProbe): Promise<DestinationVerdict>;
+/**
+ * Move `oldAbsolute` to `newAbsolute`, refusing rather than replacing whatever
+ * is already at the new name. `destinationLabel` is the path the refusal names
+ * — workspace-relative, so the user reads the name they typed and the folder
+ * they aimed at, not a path on our disk.
+ *
+ * The caller is expected to have made the destination's parent already; this
+ * only performs the move itself, so a refusal cannot leave folders behind.
+ */
+export declare function renameNoReplace(oldAbsolute: string, newAbsolute: string, destinationLabel: string): Promise<void>;
+/**
+ * The no-clobber move for a file on a filesystem with no hard links: `wx`
+ * claims the name — `open` with `O_EXCL`, which every filesystem Node runs on
+ * implements atomically and which fails with `EEXIST` if anything is there —
+ * and the rename then replaces the empty file we own rather than someone
+ * else's. A rename that fails anyway gives the claim back.
+ *
+ * The cost against `link` + `unlink` is that the destination is briefly an
+ * empty file, which is why this is the fallback and not the first choice.
+ *
+ * Exported for the same reason as {@link landFolder}: the path only runs on
+ * filesystems without hard links, so a test has to call it directly to cover
+ * it at all.
+ */
+export declare function claimThenRename(oldAbsolute: string, newAbsolute: string, destinationLabel: string): Promise<void>;
+/**
+ * `mkdir` claims the name — atomically, failing with `EEXIST` if anything at
+ * all is there — and the rename then replaces the empty folder we own. Should
+ * the rename fail anyway (someone wrote INTO our empty folder in between, and
+ * `rename` answers `ENOTEMPTY`), the claim is given back so a failed move
+ * leaves no folder behind.
+ *
+ * Windows cannot rename onto an existing directory even when it is empty, so
+ * the claim would make every folder move fail. It does not need one: its
+ * `rename` refuses a taken destination for directories by itself.
+ *
+ * Exported without the look `renameNoReplace` does first, so the claim and its
+ * rollback — the half that only runs when a name is taken in the moment
+ * between the two — can be driven directly by a test instead of by a race.
+ */
+export declare function landFolder(oldAbsolute: string, newAbsolute: string, destinationLabel: string): Promise<void>;
+/** The refusal, with the kind read off whatever is actually in the way. */
+export declare function takenError(newAbsolute: string, destinationLabel: string): Promise<Error>;
+//# sourceMappingURL=rename-no-replace.d.ts.map

package/dist/shared/rename-no-replace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename-no-replace.d.ts","sourceRoot":"","sources":["../../src/shared/rename-no-replace.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAElC,QAAQ,CAAC,SAAS,EAAE,iBAAiB;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IAD/E,QAAQ,CAAC,MAAM,OAAO;gBACD,SAAS,EAAE,iBAAiB,EAAW,WAAW,EAAE,MAAM;CAIhF;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB;AAC5B,2CAA2C;AACzC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE;AACnB;;;;GAIG;GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE;AACnB,mCAAmC;GACjC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhD,2FAA2F;AAC3F,wBAAsB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAO7E;AAED,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,IAAI,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC3D,gEAAgE;IAChE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5C;AAED,8CAA8C;AAC9C,eAAO,MAAM,SAAS,EAAE,gBAGvB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,gBAA4B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAS7B;AAqFD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAgBf;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAuBD,2EAA2E;AAC3E,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAG9F"}