@bevel-software/platform-core-backend 0.22.0 → 0.24.0

package/dist/modules/database/migrate.js

@@ -1,8 +1,10 @@
 import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import { sql } from 'drizzle-orm';
 import { logger } from '../../shared/logging.js';
 const log = logger('database');
-import { DEFAULT_DB_SCHEMA, dbSchemaOf } from './connection.js';
+import { DEFAULT_DB_SCHEMA, dbSchemaOf, piiKeysOf } from './connection.js';
 import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
+import { PII_SEALED_SHAPE_SQL_REGEX, isEncryptedBlob } from '../../shared/column-crypto.js';
 /*
  * ── Per-tier migration folders ──────────────────────────────────────────────
  *
@@ -62,6 +64,9 @@ export async function runCoreMigrations(db, folder) {
         log.info('Running core database migrations...');
         await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core', migrationsSchema });
         log.info('Core migrations complete.');
+        // Under the same lock, before anything reads or writes a PII column:
+        // the data half of migration 0016, which SQL cannot do (see below).
+        await runPiiEncryptionBackfill(db);
     }, { tenantKey });
 }
 /**
@@ -81,4 +86,269 @@ export async function runEnterpriseMigrations(db, folder) {
         log.info('Enterprise migrations complete.');
     }, { tenantKey });
 }
+const PII_BACKFILL_TABLES = [
+    { table: 'users', key: ['id'], encrypted: ['email', 'name', 'avatar_url'], bidx: { source: 'email', column: 'email_bidx' } },
+    { table: 'pr_file_approvals', key: ['id'], encrypted: ['approver_email', 'approver_name'], bidx: { source: 'approver_email', column: 'approver_email_bidx' } },
+    { table: 'pr_merge_log', key: ['id'], encrypted: ['triggered_by_email', 'triggered_by_name', 'error'], bidx: { source: 'triggered_by_email', column: 'triggered_by_email_bidx' } },
+    { table: 'pr_comments', key: ['id'], encrypted: ['author_email', 'author_name', 'body'], bidx: { source: 'author_email', column: 'author_email_bidx' } },
+    { table: 'change_requests', key: ['id'], encrypted: ['author_email', 'author_name', 'title', 'body', 'apply_failure_reason', 'apply_failed_by_name'], bidx: { source: 'author_email', column: 'author_email_bidx' } },
+    { table: 'pending_commits', key: ['id'], encrypted: ['author_email', 'author_name', 'last_error'], bidx: { source: 'author_email', column: 'author_email_bidx' } },
+    { table: 'file_locks', key: ['workspace_id', 'branch', 'path'], encrypted: ['holder_name'] },
+    { table: 'plugin_join_requests', key: ['id'], encrypted: ['requester_email', 'requester_name', 'failure_reason'], bidx: { source: 'requester_email', column: 'requester_email_bidx' } },
+];
+const ident = (name) => sql.raw(`"${name}"`);
+/** A text column as it is stored: bytes, so the handle's connection does not open it. */
+const asStored = (col) => sql `convert_to(${ident(col)}, 'UTF8') AS ${ident(col)}`;
+/** What {@link asStored} selected, back as text; anything else as it came. */
+const storedText = (value) => (Buffer.isBuffer(value) ? value.toString('utf8') : value);
+/**
+ * A column "needs sealing" when it holds non-empty text that isn't a blob.
+ * The shape regex is deliberately used as a NEGATIVE filter: anything failing
+ * it — including plaintext that merely BEGINS with the prefix — is selected
+ * and sealed, and `isEncryptedBlob` is the same pattern, so the two can never
+ * disagree about a value. Sealed rows all match, keeping the steady-state scan
+ * an empty-result query.
+ *
+ * `trustShape` is false on the FIRST backfill of a database (see
+ * {@link isFirstBackfill}): nothing has been sealed yet, so a value in this
+ * shape is plaintext somebody typed, and every non-empty value is selected.
+ */
+function needsSealing(col, trustShape) {
+    if (!trustShape)
+        return sql `(${ident(col)} IS NOT NULL AND ${ident(col)} <> '')`;
+    return sql `(${ident(col)} IS NOT NULL AND ${ident(col)} <> '' AND ${ident(col)} !~ ${PII_SEALED_SHAPE_SQL_REGEX})`;
+}
+/**
+ * Whether this database has never been through the backfill: the blind-index
+ * column of `users` is still nullable. The backfill, the duplicate collapse
+ * and the constraints run in ONE transaction, so a nullable column means no
+ * backfill has ever committed here — and therefore that nothing in it is
+ * sealed, whatever it looks like.
+ *
+ * That is what lets a first backfill trust no shape at all. A blob is
+ * recognised by its shape, and a title or a display name is text a person
+ * chose: one typed in that shape before the upgrade would be read as sealed,
+ * skipped, and left in clear for good — and, sampled by
+ * {@link assertKeyOpensSealedRows}, would refuse the start for a key that is
+ * perfectly right. Once the first backfill has committed, every write goes
+ * through a handle that seals it, so no such value can arrive again.
+ */
+async function isFirstBackfill(tx) {
+    const result = await tx.execute(sql `
+    SELECT is_nullable FROM information_schema.columns
+    WHERE table_schema = current_schema() AND table_name = 'users' AND column_name = 'email_bidx'
+  `);
+    return result.rows[0]?.is_nullable === 'YES';
+}
+/** How many rows one backfill query reads: a table is walked in batches, never loaded whole. */
+const BACKFILL_BATCH_ROWS = 500;
+/**
+ * The configured key must open what earlier starts sealed. A rotated or
+ * mistyped `SECRETS_ENC_KEY` would otherwise go unnoticed here — sealed rows
+ * are exactly the ones the scan skips — and surface only as every login
+ * failing and every lookup by email missing, because the blind indexes would
+ * be computed under the new key. One sealed value per table is enough: all
+ * rows of a deployment are sealed under one key. Refusing the start is the
+ * loud failure; re-keying a database is a deliberate operation, not a boot.
+ */
+async function assertKeyOpensSealedRows(tx, keys) {
+    for (const t of PII_BACKFILL_TABLES) {
+        const col = t.bidx?.source ?? t.encrypted[0];
+        const sample = await tx.execute(sql `SELECT ${asStored(col)} FROM ${ident(t.table)} WHERE ${ident(col)} ~ ${PII_SEALED_SHAPE_SQL_REGEX} LIMIT 1`);
+        const value = storedText(sample.rows[0]?.[col]);
+        if (typeof value === 'string' && !keys.open(value).ok) {
+            throw new Error(`PII encryption: ${t.table}.${col} is sealed with a key the configured SECRETS_ENC_KEY ` +
+                '(for a tenant: the one derived from TENANT_MASTER_KEY) does not open — refusing to start. ' +
+                'Restore the key that sealed it; changing the key is a re-keying of the database, not a configuration change.');
+        }
+    }
+}
+async function backfillTable(tx, keys, t, trustShape) {
+    // The key columns are read as text beside themselves, so the next batch can
+    // be asked for by value whatever their type is (a uuid, a serial, a path).
+    const keyText = (k) => `${k}__key`;
+    const cols = [
+        ...t.key.map(ident),
+        ...t.key.map((k) => sql `${ident(k)}::text AS ${ident(keyText(k))}`),
+        ...t.encrypted.map(asStored),
+        ...(t.bidx ? [ident(t.bidx.column)] : []),
+    ];
+    // Only rows with work left: the ciphertext prefix makes "unsealed" a plain
+    // SQL predicate, so a fully-sealed table costs one empty-result query.
+    const pending = [
+        ...t.encrypted.map((col) => needsSealing(col, trustShape)),
+        ...(t.bidx ? [sql `${ident(t.bidx.column)} IS NULL`] : []),
+    ];
+    const keyTuple = sql `(${sql.join(t.key.map((k) => sql `${ident(k)}::text`), sql `, `)})`;
+    // A blob, as far as this pass may believe one. On a first backfill nothing
+    // is sealed yet, so nothing is believed (see `isFirstBackfill`).
+    const sealedAlready = (value) => trustShape && isEncryptedBlob(value);
+    let rewritten = 0;
+    /** The key of the last row read, as text: the next batch starts after it. */
+    let after = null;
+    // IN BATCHES, in key order. A table is never loaded whole: a deployment with
+    // years of change requests holds every title and body it ever had, and
+    // reading them into one result held the first start after the upgrade — and
+    // the memory of the process making it — for as long as that took. Walking by
+    // key rather than re-asking for "what is left" also ends: a row this pass
+    // leaves as it found it (a write overtook it) is passed, not met again.
+    for (;;) {
+        const past = after ? sql ` AND ${keyTuple} > (${sql.join(after.map((v) => sql `${v}`), sql `, `)})` : sql ``;
+        const result = await tx.execute(sql `SELECT ${sql.join(cols, sql `, `)} FROM ${ident(t.table)} WHERE (${sql.join(pending, sql ` OR `)})${past} ORDER BY ${keyTuple} LIMIT ${BACKFILL_BATCH_ROWS}`);
+        const batch = result.rows;
+        for (const read of batch) {
+            const row = Object.fromEntries(Object.entries(read).map(([col, value]) => [col, storedText(value)]));
+            const sets = [];
+            // Compare-and-swap: pin every value this row was read with, so a write
+            // that lands between scan and update makes this UPDATE match zero rows
+            // instead of clobbering the newer value.
+            const where = t.key.map((k) => sql `${ident(k)} = ${row[k]}`);
+            for (const col of t.encrypted) {
+                const value = row[col];
+                if (typeof value === 'string' && value !== '' && !sealedAlready(value)) {
+                    sets.push(sql `${ident(col)} = ${keys.seal(value)}`);
+                    where.push(sql `${ident(col)} = ${value}`);
+                }
+            }
+            if (t.bidx) {
+                // The blind index is derived from its source, so it is (re)computed
+                // whenever the source is being sealed in this pass — a legacy writer
+                // that put a NEW plaintext email on an already-indexed row left a stale
+                // index behind, and sealing the email alone would freeze that mismatch
+                // — and whenever it was never filled. The source may already be
+                // ciphertext (an index that was never filled beside a sealed address);
+                // the index is always computed over the plaintext, never over a blob
+                // the key cannot open.
+                const source = row[t.bidx.source];
+                const stored = row[t.bidx.column];
+                const text = typeof source === 'string' ? source : '';
+                const sealingSource = text !== '' && !sealedAlready(text);
+                if (sealingSource || stored == null) {
+                    const opened = sealedAlready(text) ? keys.open(text) : { ok: true, plain: text };
+                    if (!opened.ok) {
+                        throw new Error(`PII encryption backfill: ${t.table}.${t.bidx.source} cannot be decrypted with the ` +
+                            'configured SECRETS_ENC_KEY — refusing to derive a blind index from ciphertext. ' +
+                            'Restore the key that sealed it, then restart.');
+                    }
+                    sets.push(sql `${ident(t.bidx.column)} = ${keys.index(opened.plain)}`);
+                    // Pin the index AND its source: if a concurrent writer replaces the
+                    // email between scan and write, the CAS must not attach the OLD
+                    // email's blind index to the NEW value.
+                    where.push(sql `${ident(t.bidx.column)} IS NOT DISTINCT FROM ${stored ?? null}`);
+                    where.push(sql `${ident(t.bidx.source)} IS NOT DISTINCT FROM ${source ?? null}`);
+                }
+            }
+            if (sets.length === 0)
+                continue;
+            const updated = await tx.execute(sql `UPDATE ${ident(t.table)} SET ${sql.join(sets, sql `, `)} WHERE ${sql.join(where, sql ` AND `)}`);
+            rewritten += updated.rowCount ?? 0;
+        }
+        if (batch.length < BACKFILL_BATCH_ROWS)
+            return rewritten;
+        const last = batch[batch.length - 1];
+        after = t.key.map((k) => String(last[keyText(k)]));
+    }
+}
+/**
+ * The name on a refused apply that was recorded BEFORE this release: the
+ * address of whoever it names was never kept, so no blind index stands beside
+ * it and an account erasure has nothing to find it by.
+ *
+ * Matching it by display name instead got both mistakes at once: a person
+ * who had since changed their name kept the old one on the request for good,
+ * and somebody else of the same name had theirs taken away. So the name goes,
+ * once, here. The refusal itself stays, with its reason and its time; it
+ * reads "could not apply" without saying who. A refusal recorded from this
+ * release on carries its index and is never touched by this.
+ */
+async function clearUnindexedRefusalNames(tx) {
+    const cleared = await tx.execute(sql.raw(`
+    UPDATE "change_requests" SET "apply_failed_by_name" = NULL
+    WHERE "apply_failed_by_name" IS NOT NULL AND "apply_failed_by_email_bidx" IS NULL
+  `));
+    return cleared.rowCount ?? 0;
+}
+/**
+ * Legacy uniqueness was on the RAW email, so rows differing only by case or
+ * whitespace could coexist; under the normalized blind index they collide and
+ * the unique-index creation below would abort the start. Approval rows and
+ * join-request rows are the same logical row — collapse them, keeping the
+ * earliest. Colliding USER rows are distinct accounts; refuse loudly with the
+ * ids so an operator resolves the conflict deliberately instead of the
+ * upgrade guessing.
+ */
+async function resolveBidxCollisions(tx) {
+    await tx.execute(sql.raw(`
+    DELETE FROM "pr_file_approvals" a USING "pr_file_approvals" b
+    WHERE a."pr_number" = b."pr_number" AND a."path" = b."path"
+      AND a."approver_email_bidx" = b."approver_email_bidx" AND a."head_sha" = b."head_sha"
+      AND (a."approved_at" > b."approved_at" OR (a."approved_at" = b."approved_at" AND a."id" > b."id"))
+  `));
+    await tx.execute(sql.raw(`
+    DELETE FROM "plugin_join_requests" a USING "plugin_join_requests" b
+    WHERE a."plugin_key" = b."plugin_key" AND a."requester_email_bidx" = b."requester_email_bidx"
+      AND (a."created_at" > b."created_at" OR (a."created_at" = b."created_at" AND a."id" > b."id"))
+  `));
+    const dupes = await tx.execute(sql.raw(`
+    SELECT array_agg("id") AS ids FROM "users" GROUP BY "email_bidx" HAVING count(*) > 1
+  `));
+    if (dupes.rows.length > 0) {
+        const groups = dupes.rows.map((r) => r.ids.join(', '));
+        throw new Error('PII encryption backfill: multiple user rows share the same email after normalization ' +
+            '(case/whitespace variants of one address). Merge or delete the duplicates, then restart. ' +
+            `Conflicting user ids: [${groups.join('], [')}]`);
+    }
+}
+const PII_FINALIZE_STATEMENTS = [
+    'ALTER TABLE "users" ALTER COLUMN "email_bidx" SET NOT NULL',
+    'CREATE UNIQUE INDEX IF NOT EXISTS "users_email_bidx_unq" ON "users" ("email_bidx")',
+    'ALTER TABLE "users" DROP CONSTRAINT IF EXISTS "users_email_unique"',
+    'ALTER TABLE "pr_file_approvals" ALTER COLUMN "approver_email_bidx" SET NOT NULL',
+    'CREATE UNIQUE INDEX IF NOT EXISTS "pr_file_approvals_bidx_unq" ON "pr_file_approvals" ("pr_number","path","approver_email_bidx","head_sha")',
+    'DROP INDEX IF EXISTS "pr_file_approvals_unq"',
+    'ALTER TABLE "pr_merge_log" ALTER COLUMN "triggered_by_email_bidx" SET NOT NULL',
+    'ALTER TABLE "pr_comments" ALTER COLUMN "author_email_bidx" SET NOT NULL',
+    'ALTER TABLE "change_requests" ALTER COLUMN "author_email_bidx" SET NOT NULL',
+    'ALTER TABLE "pending_commits" ALTER COLUMN "author_email_bidx" SET NOT NULL',
+    'ALTER TABLE "plugin_join_requests" ALTER COLUMN "requester_email_bidx" SET NOT NULL',
+    'CREATE UNIQUE INDEX IF NOT EXISTS "plugin_join_requests_requester_bidx_plugin_unq" ON "plugin_join_requests" ("requester_email_bidx","plugin_key")',
+    'DROP INDEX IF EXISTS "plugin_join_requests_requester_plugin_unq"',
+];
+/**
+ * Encrypt pre-existing plaintext PII rows, fill the blind-index columns, and
+ * apply the constraints migration 0016 deferred. Idempotent; `runCoreMigrations`
+ * runs it under the migrations lock right after the history. The handle must
+ * hold the knowledge base's key (`createDb(url, { piiKey })`; the composition
+ * root's does): one that holds none is refused before anything is read.
+ */
+export async function runPiiEncryptionBackfill(db) {
+    const keys = piiKeysOf(db);
+    await db.transaction(async (tx) => {
+        const first = await isFirstBackfill(tx);
+        // Nothing is sealed before the first backfill, so there is no sealed row
+        // for the key to be checked against — and a value that only LOOKS sealed
+        // must not be taken for one (see `isFirstBackfill`).
+        if (!first)
+            await assertKeyOpensSealedRows(tx, keys);
+        let rewritten = 0;
+        for (const t of PII_BACKFILL_TABLES) {
+            rewritten += await backfillTable(tx, keys, t, !first);
+        }
+        if (rewritten > 0)
+            log.info(`PII encryption backfill: rewrote ${rewritten} row(s).`);
+        const cleared = await clearUnindexedRefusalNames(tx);
+        if (cleared > 0) {
+            log.info(`PII encryption backfill: took the name off ${cleared} refused apply(ies) recorded before this release.`);
+        }
+        // Only where the unique indexes are not up yet. Once they are, they are
+        // what keeps two rows from sharing an index, so there is nothing to
+        // collapse — and the collapse is two self-joins and an aggregate over
+        // whole tables, which every later start paid for nothing.
+        if (first)
+            await resolveBidxCollisions(tx);
+        for (const statement of PII_FINALIZE_STATEMENTS) {
+            await tx.execute(sql.raw(statement));
+        }
+    });
+}
 //# sourceMappingURL=migrate.js.map

package/dist/modules/database/migrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAiB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,KAAK,iBAAiB;QACjC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACnB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,MAAc;IAClE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,gBAAgB,CACpB,EAAE,EACF,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChH,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACxE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,gBAAgB,CACpB,EAAE,EACF,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,EAAE,EAAE;YAChB,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,iCAAiC;YAClD,gBAAgB;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAiB,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAgB,MAAM,+BAA+B,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,KAAK,iBAAiB;QACjC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACnB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,MAAc;IAClE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,gBAAgB,CACpB,EAAE,EACF,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChH,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACtC,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACxE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,gBAAgB,CACpB,EAAE,EACF,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,EAAE,EAAE;YAChB,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,iCAAiC;YAClD,gBAAgB;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;AACJ,CAAC;AAyDD,MAAM,mBAAmB,GAAuB;IAC9C,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC5H,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE;IAC9J,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE;IAClL,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE;IACxJ,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE;IACrN,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE;IAClK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;IAC5F,EAAE,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE;CACxL,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AAKrD,yFAAyF;AACzF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAA,cAAc,KAAK,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1F,8EAA8E;AAC9E,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAE1G;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,UAAmB;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAA,IAAI,KAAK,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;IACjF,OAAO,GAAG,CAAA,IAAI,KAAK,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC,OAAO,0BAA0B,GAAG,CAAC;AACrH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,eAAe,CAAC,EAAY;IACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;GAGlC,CAAC,CAAC;IACH,OAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,CAA0C,EAAE,WAAW,KAAK,KAAK,CAAC;AACzF,CAAC;AAED,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CAAC,EAAY,EAAE,IAAa;IACjE,KAAK,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,GAAG,CAAA,UAAU,QAAQ,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,MAAM,0BAA0B,UAAU,CAChH,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAyC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,mBAAmB,CAAC,CAAC,KAAK,IAAI,GAAG,uDAAuD;gBACtF,4FAA4F;gBAC5F,8GAA8G,CACjH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAY,EACZ,IAAa,EACb,CAAmB,EACnB,UAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC;IACvF,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,UAAU,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,6EAA6E;IAC7E,IAAI,KAAK,GAAoB,IAAI,CAAC;IAClC,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAA,QAAQ,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,GAAG,CAAA,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAA,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAA,MAAM,CAAC,IAAI,IAAI,aAAa,QAAQ,UAAU,mBAAmB,EAAE,CAC/J,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAsC,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACrG,MAAM,IAAI,GAAG,EAAE,CAAC;YAChB,uEAAuE;YACvE,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7D,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACX,oEAAoE;gBACpE,qEAAqE;gBACrE,wEAAwE;gBACxE,uEAAuE;gBACvE,gEAAgE;gBAChE,uEAAuE;gBACvE,qEAAqE;gBACrE,uBAAuB;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAG,IAAI,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,aAAa,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAY,CAAC;oBAC5F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;wBACf,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,gCAAgC;4BAClF,iFAAiF;4BACjF,+CAA+C,CAClD,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACtE,oEAAoE;oBACpE,gEAAgE;oBAChE,wCAAwC;oBACxC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;oBAChF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAC9B,GAAG,CAAA,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAA,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAA,OAAO,CAAC,EAAE,CAClG,CAAC;YACF,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QACtC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,0BAA0B,CAAC,EAAY;IACpD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;;;GAGxC,CAAC,CAAC,CAAC;IACJ,OAAO,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,qBAAqB,CAAC,EAAY;IAC/C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;;;;;GAKxB,CAAC,CAAC,CAAC;IACJ,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;;;;GAIxB,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;;GAEtC,CAAC,CAAC,CAAC;IACJ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAI,KAAK,CAAC,IAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,uFAAuF;YACrF,2FAA2F;YAC3F,0BAA0B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,4DAA4D;IAC5D,oFAAoF;IACpF,oEAAoE;IACpE,iFAAiF;IACjF,6IAA6I;IAC7I,8CAA8C;IAC9C,gFAAgF;IAChF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,qFAAqF;IACrF,oJAAoJ;IACpJ,kEAAkE;CACnE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAY;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;QACxC,yEAAyE;QACzE,yEAAyE;QACzE,qDAAqD;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,wBAAwB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;YACpC,SAAS,IAAI,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,SAAS,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,oCAAoC,SAAS,UAAU,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,8CAA8C,OAAO,mDAAmD,CAAC,CAAC;QACrH,CAAC;QACD,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,KAAK;YAAE,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;YAChD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/modules/kb-fs/branch-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-name.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/branch-name.ts"],"names":[],"mappings":"AASA,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAIzC,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAwBxD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAyBlE"}
+{"version":3,"file":"branch-name.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/branch-name.ts"],"names":[],"mappings":"AASA,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAIzC,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAwBxD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAsClE"}

package/dist/modules/kb-fs/branch-name.js

@@ -49,8 +49,18 @@ export function assertValidRelativePath(relativePath) {
         throw new WorkflowValidationError('path is required');
     if (relativePath.length > 1024)
         throw new WorkflowValidationError('path too long');
-    if (relativePath.includes('\0'))
-        throw new WorkflowValidationError('path contains NUL');
+    // NUL, every other C0 control and DEL. A NUL is named on its own because it
+    // terminates a C string and git's `-z` output; the rest are refused with it
+    // because a LINE BREAK in a path is a separator in git's line-oriented stdin
+    // protocols — `cat-file --batch` reads one `<ref>:<path>` per line, so
+    // `Docs/secret.md\nzzz` is two object names while every gate upstream was
+    // asked about one string. See `CONTROL_CHARACTERS` in `repo-path.ts`, which
+    // refuses the same range at the normaliser; this is the same rule at the
+    // check every path handed to git as a pathspec passes through.
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1F\x7F]/.test(relativePath)) {
+        throw new WorkflowValidationError(relativePath.includes('\0') ? 'path contains NUL' : 'path contains a control character');
+    }
     if (relativePath.includes('\\')) {
         throw new WorkflowValidationError('path must use forward slashes only');
     }

package/dist/modules/kb-fs/branch-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/branch-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAEzF,qFAAqF;AACrF,8EAA8E;AAC9E,+EAA+E;AAC/E,4FAA4F;AAC5F,mEAAmE;AACnE,wEAAwE;AACxE,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IACxF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;AAC3E,CAAC"}
+{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/branch-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAEzF,qFAAqF;AACrF,8EAA8E;AAC9E,+EAA+E;AAC/E,4FAA4F;AAC5F,mEAAmE;AACnE,wEAAwE;AACxE,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACnF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,+DAA+D;IAC/D,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;AAC3E,CAAC"}

package/dist/modules/kb-fs/repo-path.d.ts

@@ -1,21 +1,16 @@
 /**
- * Workspace-relative paths and the repository folder.
- *
- * A workspace directory holds the git clone as `<kbDirName>/` (plus transient
- * scratch such as `tmp/`). The agent filesystem, the lock keys and the human
- * editor all speak WORKSPACE-relative paths, so a path reaches git only when
- * it starts with that folder — and `KnowledgeBase/Foo.md` on its own names a
- * location BESIDE the clone, that nothing commits and nothing pushes.
- *
- * Which is why nothing on this platform resolves a workspace path for itself.
- * Every accepted path goes through {@link normalizeWorkspacePath} first, which
- * places it inside the clone; {@link assertInsideRepo} is then the check that
- * what came out really is in there. A route or a tool that resolved a path of
- * its own would be the drift this file exists to prevent — a `KnowledgeBase/`
- * folder, a `Plugins/` folder and eight uploaded documents sitting beside a
- * staging checkout is what it looked like the last time two spellings of this
- * rule were allowed to exist.
+ * Whether `value` carries one of them — THE predicate, so the places that
+ * accept a NAME enforce the same rule as the normaliser that joins it into a
+ * path. The checkout folder name is the one that matters: it is not a caller's
+ * path, it is deployment configuration (`KB_DIR_NAME`, and the `kbDirName`
+ * setting), and it is PREFIXED onto every workspace-relative path. A name with
+ * a line break in it would therefore make the normaliser emit exactly the path
+ * this rule exists to exclude, from inputs that were each clean. Refused where
+ * the name is set — at boot in `core-config` and in the settings validator —
+ * so the deployment fails loudly instead of serving a path nothing downstream
+ * can safely read.
  */
+export declare function hasControlCharacter(value: string): boolean;
 /**
  * True when `wsPath` is the repository folder or lies under it.
  *

package/dist/modules/kb-fs/repo-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-path.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/repo-path.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAexE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAwChF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAY9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,IAAI,CAaN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9F,IAAI,CAiBN;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB"}
+{"version":3,"file":"repo-path.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/repo-path.ts"],"names":[],"mappings":"AAoDA;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CA+BxE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA2DhF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAY9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,IAAI,CAaN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9F,IAAI,CAiBN;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB"}

package/dist/modules/kb-fs/repo-path.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { WorkflowValidationError } from '../../shared/domain-errors.js';
+import { sanitizedPath } from '../../shared/printable.js';
 /**
  * Workspace-relative paths and the repository folder.
  *
@@ -18,6 +19,49 @@ import { WorkflowValidationError } from '../../shared/domain-errors.js';
  * staging checkout is what it looked like the last time two spellings of this
  * rule were allowed to exist.
  */
+/**
+ * NUL, the C0 controls (a line break among them) and DEL — refused in a
+ * workspace path wherever one enters.
+ *
+ * Not merely hygiene about names nobody can type. A `\n` is a SEPARATOR in
+ * git's own line-oriented stdin protocols: `cat-file --batch` reads one
+ * `<ref>:<path>` object name per LINE, so `Docs/secret.md\nzzz` is TWO specs.
+ * Everything upstream — the read gate, the download gate, the not-a-directory
+ * check — is then asked about the whole string, which names nothing, while git
+ * answers about `Docs/secret.md` and hands over its bytes. A file denied by
+ * its own frontmatter inside a folder its reader may list would be readable
+ * that way, and in a batch of several specs the extra answer shifts every
+ * result after it, so the access resolver reads one directory's `access.md` as
+ * another's.
+ *
+ * Refused HERE, at the normaliser every accepted path goes through, rather
+ * than at each route: the fence has to be at the mechanism, because the next
+ * caller to assemble a git spec from a path will not remember this. The
+ * shared `validateFilename` has always refused the same range per segment, so
+ * no name any surface can create is lost — this closes the gap between it and
+ * the paths that reach git. U+2028/U+2029 are NOT in it: they are nothing to
+ * git's protocols (which read bytes, and a line break there is 0x0A), a name
+ * carrying one is creatable today, and refusing it here would make an existing
+ * file unreadable. They are escaped for display instead, which is what
+ * `sanitizedPath` is for.
+ */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTERS = /[\x00-\x1F\x7F]/;
+/**
+ * Whether `value` carries one of them — THE predicate, so the places that
+ * accept a NAME enforce the same rule as the normaliser that joins it into a
+ * path. The checkout folder name is the one that matters: it is not a caller's
+ * path, it is deployment configuration (`KB_DIR_NAME`, and the `kbDirName`
+ * setting), and it is PREFIXED onto every workspace-relative path. A name with
+ * a line break in it would therefore make the normaliser emit exactly the path
+ * this rule exists to exclude, from inputs that were each clean. Refused where
+ * the name is set — at boot in `core-config` and in the settings validator —
+ * so the deployment fails loudly instead of serving a path nothing downstream
+ * can safely read.
+ */
+export function hasControlCharacter(value) {
+    return CONTROL_CHARACTERS.test(value);
+}
 /**
  * True when `wsPath` is the repository folder or lies under it.
  *
@@ -32,6 +76,11 @@ import { WorkflowValidationError } from '../../shared/domain-errors.js';
 export function isInsideRepo(wsPath, kbDirName) {
     if (typeof wsPath !== 'string' || wsPath.includes('\\'))
         return false;
+    // A control character is not a spelling of any path under the repository —
+    // see {@link CONTROL_CHARACTERS}. Refused here too, so the check AFTER the
+    // normaliser cannot pass one that somehow skipped it.
+    if (CONTROL_CHARACTERS.test(wsPath))
+        return false;
     const segments = wsPath.replace(/\/$/, '').split('/');
     if (segments[0] !== kbDirName)
         return false;
@@ -52,6 +101,19 @@ export function isInsideRepo(wsPath, kbDirName) {
 export function assertInsideRepo(wsPath, kbDirName) {
     if (isInsideRepo(wsPath, kbDirName))
         return;
+    // Said as what it is, before the suggestion below: a control character is
+    // not a path that landed in the wrong place, and a "use this instead"
+    // carrying an invisible character back to the caller would be nonsense.
+    if (typeof wsPath === 'string' && CONTROL_CHARACTERS.test(wsPath)) {
+        // Through `sanitizedPath`, like every other refusal that names a path: the
+        // character that makes this path invalid is also the character that would
+        // forge a second line of the answer, in the message and in the `path` a
+        // JSON consumer reads.
+        const shown = sanitizedPath(wsPath);
+        throw new WorkflowValidationError(`"${shown}" contains a control character: a line break, a NUL or another invisible byte is not part of any ` +
+            'file name, and git reads a line break in a path as the end of one object name and the start of another. ' +
+            'Remove it and send the name as it is written.', { kind: 'path-control-character', path: shown, kbDirName });
+    }
     // The suggestion collapses what made the path wrong: backslashes, leading
     // `./` or `/`, and any `..` climbing back out (a bare `..` included, so the
     // suggestion is never itself a climb). The agent gets a path it can use.
@@ -101,6 +163,23 @@ export function normalizeWorkspacePath(wsPath, kbDirName) {
     // read. Refused before anything is collapsed, never rewritten to `/`.
     if (wsPath.includes('\\'))
         refuse();
+    // A line break (or any other control character) is a SEPARATOR to git, not
+    // part of a name — see {@link CONTROL_CHARACTERS}. Refused before the path
+    // is normalised, so no gate downstream is ever asked about a string that
+    // means one thing to it and two things to git.
+    if (CONTROL_CHARACTERS.test(wsPath))
+        refuse();
+    // …and the FOLDER NAME, which is prefixed onto the result rather than read
+    // from it: a clean path joined to `kb\nname` comes out carrying the line
+    // break, so the normaliser would itself emit what the check above refuses.
+    // Said as the configuration error it is — the caller's path is fine, and an
+    // operator reading a refusal about their own path would have nothing to fix.
+    // `core-config` and the `kbDirName` setting validator both refuse this at
+    // the point it is SET, so reaching here means the two drifted.
+    if (CONTROL_CHARACTERS.test(kbDirName)) {
+        throw new WorkflowValidationError(`the configured checkout folder name (kbDirName / KB_DIR_NAME) contains a control character: "${sanitizedPath(kbDirName)}". ` +
+            'Every workspace path is prefixed with it, so no path can be resolved until the setting is corrected.', { kind: 'kb-dir-name-control-character', kbDirName: sanitizedPath(kbDirName) });
+    }
     // The root-anchored form, and ONLY for the repository folder: `/<kbDirName>/…`
     // is what the app's Copy path gives (it is the form a Markdown link resolves
     // from) and names the same workspace path. `/tmp/x` and `//x` are not that

package/dist/modules/kb-fs/repo-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-path.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/repo-path.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,IAAI,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO;IAC5C,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK;SAC1B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;SACxE,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClG,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,8FAA8F,SAAS,8DAA8D;QAC7K,QAAQ,SAAS,mHAAmH,EACtI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IACtE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,GAAU,EAAE;QACzB,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,iEAAiE;QACjE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,4CAA4C,CAAC,CAAC;IACvF,CAAC,CAAC;IACF,6EAA6E;IAC7E,iDAAiD;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,EAAE,CAAC;IACpC,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,aAAa;IACb,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,SAAS,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/F,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,CAAC;IAClE,0EAA0E;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC5F,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,MAAM,EAAE,CAAC;IACvG,yEAAyE;IACzE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO;IACjF,MAAM,IAAI,uBAAuB,CAC/B,IAAI,QAAQ,CAAC,CAAC,CAAC,gGAAgG;QAC7G,gEAAgE,SAAS,iFAAiF;QAC1J,oEAAoE;QACpE,6CAA6C;QAC7C,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kHAAkH,SAAS,iCAAiC,CAAC,EACjM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA6B,EAC7B,SAAiB,EACjB,IAAuB;IAEvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvF,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,sBAAsB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,MAA+F;IAE/F,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GACb;QACE,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC7C,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;KAEpC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,IAAI,KAAK,CACb,0DAA0D,SAAS,oCAAoC;QACrG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,mFAAmF;QACpH,4BAA4B,SAAS,CAAC,CAAC,CAAC,sEAAsE;QAC9G,yCAAyC,CAC5C,CAAC;AACJ,CAAC;AAED,mDAAmD;AACnD,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAU,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA6B,EAC7B,SAAiB,EACjB,IAAiC;IAEjC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAW,EAAE,CACtC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC;QAC9D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CACvC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC;YACvC,CAAC,CAAC,EAAE,GAAI,CAA6B,EAAE,IAAI,EAAE,GAAG,CAAE,CAA6B,CAAC,IAAI,CAAC,EAAE;YACvF,CAAC,CAAC,CAAC,CACN,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"repo-path.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/repo-path.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,IAAI,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO;IAC5C,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,uBAAuB;QACvB,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,uBAAuB,CAC/B,IAAI,KAAK,mGAAmG;YAC1G,0GAA0G;YAC1G,+CAA+C,EACjD,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAC3D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK;SAC1B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;SACxE,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClG,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,8FAA8F,SAAS,8DAA8D;QAC7K,QAAQ,SAAS,mHAAmH,EACtI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IACtE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,GAAU,EAAE;QACzB,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,iEAAiE;QACjE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,4CAA4C,CAAC,CAAC;IACvF,CAAC,CAAC;IACF,6EAA6E;IAC7E,iDAAiD;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,EAAE,CAAC;IACpC,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,CAAC;IAC9C,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAuB,CAC/B,gGAAgG,aAAa,CAAC,SAAS,CAAC,KAAK;YAC3H,sGAAsG,EACxG,EAAE,IAAI,EAAE,+BAA+B,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,aAAa;IACb,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,SAAS,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/F,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,CAAC;IAClE,0EAA0E;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC5F,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,MAAM,EAAE,CAAC;IACvG,yEAAyE;IACzE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO;IACjF,MAAM,IAAI,uBAAuB,CAC/B,IAAI,QAAQ,CAAC,CAAC,CAAC,gGAAgG;QAC7G,gEAAgE,SAAS,iFAAiF;QAC1J,oEAAoE;QACpE,6CAA6C;QAC7C,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kHAAkH,SAAS,iCAAiC,CAAC,EACjM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA6B,EAC7B,SAAiB,EACjB,IAAuB;IAEvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvF,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,sBAAsB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,MAA+F;IAE/F,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GACb;QACE,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC7C,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;KAEpC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,IAAI,KAAK,CACb,0DAA0D,SAAS,oCAAoC;QACrG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,mFAAmF;QACpH,4BAA4B,SAAS,CAAC,CAAC,CAAC,sEAAsE;QAC9G,yCAAyC,CAC5C,CAAC;AACJ,CAAC;AAED,mDAAmD;AACnD,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAU,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA6B,EAC7B,SAAiB,EACjB,IAAiC;IAEjC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAW,EAAE,CACtC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC;QAC9D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CACvC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC;YACvC,CAAC,CAAC,EAAE,GAAI,CAA6B,EAAE,IAAI,EAAE,GAAG,CAAE,CAA6B,CAAC,IAAI,CAAC,EAAE;YACvF,CAAC,CAAC,CAAC,CACN,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/modules/kb-sync/kb-sync.routes.d.ts

@@ -39,10 +39,10 @@ export interface KbSyncRouteDeps {
     /** The configured secret, read per request so a setup-screen save applies at once. */
     syncSecret: () => string;
     authService: {
-        verifyToken(token: string): {
+        resolveSession(token: string): Promise<{
             userId: string;
             email: string;
-        };
+        }>;
     };
     adminAccess: IAdminAccessService;
 }

package/dist/modules/kb-sync/kb-sync.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kb-sync.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-sync/kb-sync.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB,sFAAsF;IACtF,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,EAAE;QAAE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/E,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAKD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AACnD,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAIjE;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAsGxE"}
+{"version":3,"file":"kb-sync.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-sync/kb-sync.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB,sFAAsF;IACtF,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,EAAE;QAAE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC3F,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAKD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AACnD,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAIjE;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CA+GxE"}

package/dist/modules/kb-sync/kb-sync.routes.js

@@ -4,6 +4,7 @@ const log = logger('sync');
 import { assertValidBranchName } from '../kb-fs/branch-name.js';
 import { parseSyncPayload } from './sync-payload.js';
 import { verifySyncCredential } from './sync-auth.js';
+import { AuthBackendError } from '../auth/account-admission.js';
 /** Cap on a webhook body. ADO's PR payloads run to a few hundred KB. */
 const BODY_LIMIT = '2mb';
 /**
@@ -52,6 +53,7 @@ export function createKbSyncRoutes(deps) {
     async function handle(req, res, select) {
         res.setHeader(SYNC_RESPONSE_HEADER, SYNC_RESPONSE_MARKER);
         const raw = Buffer.isBuffer(req.body) ? req.body : undefined;
+        let lookupFailed = null;
         const auth = await verifySyncCredential({
             secret: deps.syncSecret(),
             authorization: header(req, 'authorization'),
@@ -59,17 +61,26 @@ export function createKbSyncRoutes(deps) {
             hubSignature: header(req, 'x-hub-signature-256'),
             rawBody: raw,
         }, {
-            verifyJwt: (token) => {
+            verifyJwt: async (token) => {
                 try {
-                    return { email: deps.authService.verifyToken(token).email };
+                    return { email: (await deps.authService.resolveSession(token)).email };
                 }
-                catch {
+                catch (err) {
+                    if (err instanceof AuthBackendError)
+                        lookupFailed = err;
                     return null;
                 }
             },
             isAdmin: (email) => deps.adminAccess.isAdmin(email),
         });
         if (!auth.ok) {
+            // The session's account could not be looked up: an outage, not a wrong
+            // credential, and saying 401 would send an admin to sign in again.
+            if (lookupFailed) {
+                log.error('session account lookup failed:', { err: lookupFailed.cause });
+                res.status(500).json({ error: 'Authentication backend unavailable' });
+                return;
+            }
             if (auth.status === 401)
                 res.setHeader('WWW-Authenticate', 'Bearer realm="hexis-sync"');
             res.status(auth.status).json({ error: auth.message });