@bragi-gmbh/codebus 1.2.0

package/dist/commands/github-login.js

@@ -0,0 +1,205 @@
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { execFile } from "node:child_process";
+import { createClient } from "@supabase/supabase-js";
+import { saveFileConfig } from "../config.js";
+import { validateConnection } from "./login.js";
+import { CodebusError } from "../errors.js";
+// `codebus login --github` — the CLI mirror of web/app/login/page.tsx:
+// Supabase Auth signInWithOAuth({provider:'github'}) over a localhost PKCE
+// callback → exchangeCodeForSession → the EXISTING github_web_login() RPC →
+// store the returned agent token. NO new backend; github_web_login() unchanged.
+//
+// GitHub OAuth is not configured in local Supabase, so the end-to-end flow
+// CANNOT run in CI. The irreducible external-OAuth I/O is c8-ignored
+// (DEC-CB-009 EX-001, precedent: join.ts); the testable seams below are
+// pure/covered functions exercised by unit tests.
+const DEFAULT_REMOTE = "https://tcapyyzkzecgfeivbymf.supabase.co";
+const CALLBACK_TIMEOUT_MS = 120_000; // 2 min — user has to finish the browser dance
+export function buildOAuthRequest(port, state) {
+    const redirectTo = `http://127.0.0.1:${port}/callback?state=${encodeURIComponent(state)}`;
+    return { provider: "github", options: { redirectTo, skipBrowserRedirect: true } };
+}
+export function parseCallback(reqUrl, expectedState) {
+    // reqUrl is a path+query (e.g. "/callback?code=..&state=.."); host is irrelevant.
+    const u = new URL(reqUrl ?? "/", "http://127.0.0.1");
+    if (u.pathname !== "/callback")
+        return { ok: false, reason: "ignore" };
+    const err = u.searchParams.get("error");
+    if (err) {
+        const desc = u.searchParams.get("error_description");
+        return { ok: false, reason: `GitHub sign-in was denied or failed: ${desc ?? err}` };
+    }
+    const state = u.searchParams.get("state");
+    if (!state || state !== expectedState) {
+        // CSRF guard: a callback whose state doesn't match the one we minted is
+        // rejected outright — never exchange a code we didn't ask for.
+        return { ok: false, reason: "state mismatch — possible CSRF, aborting login" };
+    }
+    const code = u.searchParams.get("code");
+    if (!code)
+        return { ok: false, reason: "no authorization code in callback" };
+    return { ok: true, code };
+}
+export function persistWebLogin(url, anonKey, res) {
+    return saveFileConfig({
+        url, anonKey, workspace: res.workspace,
+        token: res.token, agent: res.agent_slug, person: res.person_slug,
+    });
+}
+// ── Seam 4: github_web_login() error → CLI message ───────────────────────────
+// Mirror web error semantics (web/app/login/page.tsx surfaces the raw RPC
+// message; the CLI is friendlier). The RPC raises:
+//   * 'no CodeBus identity for github user "X" — ask a teammate for an invite'
+//     → tell them the exact admin command.
+//   * 'github session required' → the Auth session didn't carry a github identity.
+// Anything else passes through. `login` is the GitHub username if known.
+export function mapGithubWebLoginError(message, login) {
+    if (/no CodeBus identity for github user/i.test(message)) {
+        const who = login ? ` <${login}>` : " <your-github-login>";
+        return `No CodeBus identity for your GitHub account, and no pending invite for it. `
+            + `Ask an admin to \`codebus invite${who}\`, then run \`codebus login --github\` again.`;
+    }
+    if (/github session required/i.test(message)) {
+        return "GitHub sign-in did not produce a usable session (no GitHub identity on the token). "
+            + "Make sure you completed the GitHub authorization in the browser.";
+    }
+    if (/fetch failed|ENOTFOUND|ECONNREFUSED|network/i.test(message)) {
+        return "Cannot reach the CodeBus server — check your network/VPN.";
+    }
+    return message;
+}
+// ── Orchestrator ─────────────────────────────────────────────────────────────
+// Wires the four covered seams above (buildOAuthRequest, parseCallback,
+// persistWebLogin, mapGithubWebLoginError — each unit-tested) into the live
+// browser-OAuth flow. The flow CANNOT run in CI (GitHub provider not configured
+// in local Supabase) and the orchestration here is irreducible external-OAuth
+// I/O — network anon-key fetch, the localhost callback server, browser open,
+// signInWithOAuth/exchangeCodeForSession — so it carries the DEC-CB-009 EX-001
+// exemption (precedent: join.ts). The seams are NOT ignored; only this glue is.
+/* c8 ignore start -- DEC-CB-009 EX-001: external OAuth (anon-key fetch, browser, localhost server, code exchange) */
+// Fetch the server's public anon key (same well-known endpoint join.ts uses).
+async function resolveAnonKey(url, o) {
+    let anonKey = o.anonKey ?? process.env.SUPABASE_ANON_KEY;
+    if (!anonKey) {
+        const res = await fetch(`${url}/functions/v1/www/config`);
+        if (res.ok)
+            anonKey = (await res.json()).anonKey;
+    }
+    if (!anonKey)
+        throw new CodebusError(`could not fetch server config from ${url} — check your network/VPN, or pass --anon-key`);
+    return anonKey;
+}
+/* c8 ignore stop */
+/* c8 ignore start -- DEC-CB-009 EX-001: external OAuth (browser, localhost server, code exchange) */
+// Best-effort browser open (reuses the platform open command, like other CLIs).
+// Returns false if it can't open, so the caller can print the URL to paste.
+function openBrowser(targetUrl) {
+    const cmd = process.platform === "darwin" ? "open"
+        : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", targetUrl] : [targetUrl];
+    try {
+        execFile(cmd, args, () => { });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Start an ephemeral localhost server and return its bound port immediately,
+// plus a promise that resolves with the captured auth code.
+function startCallbackServer(expectedState) {
+    return new Promise((resolveServer, rejectServer) => {
+        let resolveCode;
+        let rejectCode;
+        const codeP = new Promise((res, rej) => { resolveCode = res; rejectCode = rej; });
+        const server = createServer((req, res) => {
+            const result = parseCallback(req.url, expectedState);
+            if (result.ok === false && result.reason === "ignore") {
+                res.writeHead(404).end();
+                return;
+            }
+            if (result.ok) {
+                res.writeHead(200, { "content-type": "text/html" })
+                    .end("<h2>CodeBus: GitHub sign-in complete.</h2><p>You can close this tab and return to the terminal.</p>");
+                clearTimeout(timer);
+                resolveCode(result.code);
+            }
+            else {
+                res.writeHead(400, { "content-type": "text/html" })
+                    .end(`<h2>CodeBus sign-in failed.</h2><p>${result.reason}</p>`);
+                clearTimeout(timer);
+                rejectCode(new CodebusError(result.reason));
+            }
+        });
+        const timer = setTimeout(() => {
+            rejectCode(new CodebusError("GitHub sign-in timed out after 2 minutes — rerun `codebus login --github`."));
+        }, CALLBACK_TIMEOUT_MS);
+        server.on("error", (e) => { clearTimeout(timer); rejectServer(e); });
+        server.listen(0, "127.0.0.1", () => {
+            const port = server.address().port;
+            resolveServer({ port, code: codeP, close: () => { clearTimeout(timer); server.close(); } });
+        });
+    });
+}
+/* c8 ignore stop */
+// `codebus login --github` entry point. Mirrors web/app/login/page.tsx exactly:
+// signInWithOAuth(github) → exchangeCodeForSession → github_web_login() RPC
+// (UNCHANGED) → persist token → validateConnection.
+/* c8 ignore start -- DEC-CB-009 EX-001: external OAuth orchestration (uncov-able in CI; seams unit-tested separately) */
+export async function githubLoginCmd(o) {
+    const url = o.url ?? process.env.CODEBUS_URL ?? DEFAULT_REMOTE;
+    const anonKey = await resolveAnonKey(url, o);
+    const state = randomBytes(16).toString("hex");
+    // PKCE: supabase-js generates the verifier+challenge and persists the verifier
+    // in its storage; the SAME client instance must do signInWithOAuth and
+    // exchangeCodeForSession so the verifier matches.
+    const sb = createClient(url, anonKey, {
+        auth: { flowType: "pkce", persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
+    });
+    const server = await startCallbackServer(state);
+    const oauthReq = buildOAuthRequest(server.port, state);
+    const { data: oauth, error: oauthErr } = await sb.auth.signInWithOAuth(oauthReq);
+    if (oauthErr) {
+        server.close();
+        throw new CodebusError(/provider is not enabled/i.test(oauthErr.message)
+            ? "GitHub sign-in isn't enabled on this server."
+            : oauthErr.message);
+    }
+    if (openBrowser(oauth.url))
+        console.log("Opening your browser to sign in with GitHub…");
+    else
+        console.log(`Open this URL in your browser to sign in with GitHub:\n  ${oauth.url}`);
+    let code;
+    try {
+        code = await server.code;
+    }
+    finally { /* server closed on resolve below */ }
+    const { error: exErr } = await sb.auth.exchangeCodeForSession(code);
+    if (exErr) {
+        server.close();
+        throw new CodebusError(`could not complete GitHub sign-in: ${exErr.message}`);
+    }
+    // github_web_login() RPC — same call the web page makes, EXCEPT this surface
+    // passes p_surface: "cli" (0080_agent_tokens). Before 0080 both the CLI and
+    // the web app shared ONE token per person-linked agent, so whichever surface
+    // logged in last silently rotated the other's stored token out from under
+    // it (the CLI/web auth ping-pong). p_surface scopes rotation to THIS
+    // surface's own credential only — logging in here never invalidates a live
+    // web session for the same person, and vice versa.
+    const { data, error: rpcErr } = await sb.rpc("github_web_login", { p_surface: "cli" });
+    await sb.auth.signOut(); // proof consumed; the agent token takes over
+    server.close();
+    if (rpcErr)
+        throw new CodebusError(mapGithubWebLoginError(rpcErr.message));
+    const res = data;
+    persistWebLogin(url, anonKey, res);
+    const facts = await validateConnection({ url, anonKey, workspace: res.workspace, token: res.token });
+    if (o.json) {
+        console.log(JSON.stringify({ ...facts, rotated: res.rotated ?? false }, null, 2));
+        return;
+    }
+    console.log(`Logged in as ${facts.agent} (person: ${facts.person ?? res.person_slug}) @ ${facts.workspace} via GitHub.`);
+}
+/* c8 ignore stop */
+//# sourceMappingURL=github-login.js.map

package/dist/commands/github-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-login.js","sourceRoot":"","sources":["../../src/commands/github-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAa,cAAc,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,kDAAkD;AAElD,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,mBAAmB,GAAG,OAAO,CAAC,CAAC,+CAA+C;AAapF,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,UAAU,GAAG,oBAAoB,IAAI,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1F,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,CAAC;AACpF,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,MAA0B,EAAE,aAAqB;IAC7E,kFAAkF;IAClF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEvE,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACtC,wEAAwE;QACxE,+DAA+D;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAE7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAaD,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAmB;IAC/E,OAAO,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;QACtC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW;KACjE,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,mDAAmD;AACnD,+EAA+E;AAC/E,2CAA2C;AAC3C,mFAAmF;AACnF,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAc;IACpE,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC3D,OAAO,6EAA6E;cAChF,mCAAmC,GAAG,gDAAgD,CAAC;IAC7F,CAAC;IACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,qFAAqF;cACxF,kEAAkE,CAAC;IACzE,CAAC;IACD,IAAI,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,2DAA2D,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAEhF,qHAAqH;AACrH,8EAA8E;AAC9E,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,CAAY;IACrD,IAAI,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,0BAA0B,CAAC,CAAC;QAC1D,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAA2B,CAAA,CAAC,OAAO,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,YAAY,CAAC,sCAAsC,GAAG,+CAA+C,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,oBAAoB;AAEpB,qGAAqG;AACrG,gFAAgF;AAChF,4EAA4E;AAC5E,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM;QAChD,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAsD,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD,6EAA6E;AAC7E,4DAA4D;AAC5D,SAAS,mBAAmB,CAAC,aAAqB;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACjD,IAAI,WAAoC,CAAC;QACzC,IAAI,UAA+B,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,WAAW,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1F,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;qBAChD,GAAG,CAAC,qGAAqG,CAAC,CAAC;gBAC9G,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;qBAChD,GAAG,CAAC,sCAAsC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC;gBAClE,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,UAAU,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,UAAU,CAAC,IAAI,YAAY,CAAC,4EAA4E,CAAC,CAAC,CAAC;QAC7G,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YACzD,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AACD,oBAAoB;AAEpB,gFAAgF;AAChF,4EAA4E;AAC5E,oDAAoD;AACpD,yHAAyH;AACzH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAiC;IACpE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,cAAc,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9C,+EAA+E;IAC/E,uEAAuE;IACvE,kDAAkD;IAClD,MAAM,EAAE,GAAmB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE;QACpD,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;KACtG,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtE,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;;QACnF,OAAO,CAAC,GAAG,CAAC,4DAA4D,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAE1F,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;IAAC,CAAC;YACzB,CAAC,CAAC,oCAAoC,CAAC,CAAC;IAEhD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,sCAAsC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAE7G,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,6CAA6C;IACtE,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAG,IAAsB,CAAC;IACnC,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,KAAK,aAAa,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,OAAO,KAAK,CAAC,SAAS,cAAc,CAAC,CAAC;AAC3H,CAAC;AACD,oBAAoB"}

package/dist/commands/graph.js

@@ -0,0 +1,88 @@
+import { CodebusError } from "../errors.js";
+import { loadGraphSnapshot, getGraphBuiltCommit, checkStaleness } from "../graph.js";
+import { fetchRemoteStatus } from "../graph-remote.js";
+/**
+ * CLI command: codebus graph status
+ * Prints local graph metadata + staleness, and (A6) the hub's attachment
+ * state and remote freshness for the connected repo, when reachable.
+ * The local fields are unchanged/additive vs pre-A6 for scripts already
+ * parsing --json output; `attachmentState`/`remote` are new.
+ */
+export async function graphStatusCmd(options) {
+    try {
+        const repoRoot = options.repoRoot || process.cwd();
+        const snapshot = loadGraphSnapshot(repoRoot);
+        // Remote leg degrades to null silently (missing credentials, no git
+        // remote, repo not connected, or any RPC failure) — never fails the
+        // command just because the local leg already has an answer.
+        const remote = await fetchRemoteStatus(repoRoot, options.repo).catch(() => null);
+        if (!snapshot && !remote) {
+            throw new CodebusError("No graphify-out/graph.json found, and no remote-connected repo status reachable. Run graphify first, or pass --repo.", 1);
+        }
+        const status = {};
+        if (snapshot) {
+            const builtCommit = getGraphBuiltCommit(snapshot);
+            const staleness = await checkStaleness(snapshot, repoRoot, "dirty-only");
+            status.builtAtCommit = builtCommit;
+            status.isStale = staleness.isStale;
+            status.isDirty = staleness.isDirty;
+            status.stalenessNote = staleness.note;
+            status.nodeCount = snapshot.nodes?.length || 0;
+            status.edgeCount = snapshot.links?.length || 0;
+        }
+        if (remote) {
+            status.attachmentState = remote.attachmentState;
+            status.remote = {
+                repo: remote.repoSlug,
+                attachmentState: remote.attachmentState,
+                grade: remote.grade,
+                freshness: remote.freshness,
+                stale: remote.stale,
+                noGraph: remote.noGraph,
+                servingSha: remote.servingSha7,
+                headSha: remote.headSha7,
+            };
+        }
+        if (options.json) {
+            console.log(JSON.stringify(status, null, 2));
+        }
+        else {
+            if (snapshot) {
+                // Pre-A6 text-output contract, byte-for-byte (test/integration/ask.test.ts
+                // pins "Built at:"/"Nodes:"/"Edges:"/"Stale:") — the local leg's plain-text
+                // output must stay unchanged/additive, exactly like its JSON fields already
+                // are; the remote leg below is the only new output.
+                console.log(`Built at: ${status.builtAtCommit}`);
+                console.log(`Nodes: ${status.nodeCount}, Edges: ${status.edgeCount}`);
+                console.log(`Stale: ${status.isStale}`);
+                if (status.stalenessNote)
+                    console.log(`Note: ${status.stalenessNote}`);
+            }
+            else {
+                console.log("Local: no graphify-out/graph.json found");
+            }
+            if (remote) {
+                console.log(`Remote (${remote.repoSlug}): attachment=${remote.attachmentState ?? "unknown"} grade=${remote.grade ?? "unknown"}`);
+                console.log(`  Freshness: ${remote.freshness ?? "unknown"} (serving ${remote.servingSha7 ?? "—"}, head ${remote.headSha7 ?? "—"})`);
+            }
+            else {
+                console.log("Remote: not connected / not reachable");
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof CodebusError)
+            throw err;
+        throw new CodebusError(`Failed to get graph status: ${err instanceof Error ? err.message : String(err)}`, 1);
+    }
+}
+/**
+ * Register the graph command.
+ */
+export function registerGraph(program, g) {
+    const graphCmd = program.command("graph");
+    g(graphCmd.command("status"))
+        .option("--repo <slug>", "check a specific connected repo's remote status (auto-detected from git remote if omitted)")
+        .action((opts) => graphStatusCmd(opts));
+}
+//# sourceMappingURL=graph.js.map

package/dist/commands/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/commands/graph.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAQvD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAE7C,oEAAoE;QACpE,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CACpB,sHAAsH,EACtH,CAAC,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACzE,MAAM,CAAC,aAAa,GAAG,WAAW,CAAC;YACnC,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YACnC,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YACnC,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC;YACtC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;YAC/C,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;YAChD,MAAM,CAAC,MAAM,GAAG;gBACd,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,OAAO,EAAE,MAAM,CAAC,QAAQ;aACzB,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,EAAE,CAAC;gBACb,2EAA2E;gBAC3E,4EAA4E;gBAC5E,4EAA4E;gBAC5E,oDAAoD;gBACpD,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,SAAS,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,aAAa;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,QAAQ,iBAAiB,MAAM,CAAC,eAAe,IAAI,SAAS,UAAU,MAAM,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;gBACjI,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,IAAI,SAAS,aAAa,MAAM,CAAC,WAAW,IAAI,GAAG,UAAU,MAAM,CAAC,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC;YACtI,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,IAAI,YAAY,CAAC,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,CAA0B;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;SAC1B,MAAM,CAAC,eAAe,EAAE,4FAA4F,CAAC;SACrH,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/commands/health.js

@@ -0,0 +1,34 @@
+import { resolveConfig } from "../config.js";
+import { makeCtx, workspaceId } from "../client.js";
+import { CodebusError } from "../errors.js";
+// Workspace health: the CEO view, computed from tables that already record
+// everything (questions timestamps, task/PR status, escalations, session_log).
+export async function healthCmd(o) {
+    const ctx = await makeCtx(resolveConfig(o));
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase.rpc("bus_health", { p_workspace: ws });
+    if (error)
+        throw new CodebusError(error.message);
+    if (o.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    const h = data;
+    const fmt = (v, suffix = "") => (v === null || v === undefined ? "—" : `${v}${suffix}`);
+    console.log(`Workspace Health (${ctx.workspaceSlug})`);
+    console.log(`Open Questions:       ${fmt(h.open_questions)}`);
+    console.log(`Questions >24h:       ${fmt(h.questions_over_24h)}`);
+    console.log(`Blocked Tasks:        ${fmt(h.blocked_tasks)}`);
+    console.log(`Review Queue:         ${fmt(h.review_queue)}`);
+    console.log(`Escalations (7d):     ${fmt(h.escalations_7d)} (resolved: ${fmt(h.escalations_resolved_7d)})`);
+    console.log(`Escalation Rate (7d): ${fmt(h.escalation_rate_7d)}`);
+    console.log(`Median Answer Time:   ${fmt(h.median_answer_minutes, "m")} (p95: ${fmt(h.p95_answer_minutes, "m")})`);
+    console.log(`Median Blocker Age:   ${fmt(h.median_blocker_age_hours, "h")}`);
+    console.log(`Tasks Completed (7d): ${fmt(h.tasks_completed_7d)}`);
+    console.log(`Reviews Done (7d):    ${fmt(h.reviews_completed_7d)}`);
+    console.log(`PRs Merged (7d):      ${fmt(h.prs_merged_7d)}`);
+    console.log(`Session Starts (7d):  ${fmt(h.session_starts_7d)} | digests: ${fmt(h.digest_refreshes_7d)} | next: ${fmt(h.next_invocations_7d)}`);
+    console.log(`Most Blocked Repo:    ${fmt(h.most_blocked_repo)}`);
+    console.log(`Most Asked Repo:      ${fmt(h.most_asked_repo)}`);
+}
+//# sourceMappingURL=health.js.map

package/dist/commands/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/commands/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAa,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAiC;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC5G,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,qBAAqB,EAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,kBAAkB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACnH,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAChJ,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/commands/inbox.js

@@ -0,0 +1,83 @@
+import { resolveConfig } from "../config.js";
+import { makeCtx, workspaceId, projectId, identityIsGuessed, guessedIdentityWarning } from "../client.js";
+import { render } from "../output.js";
+import { CodebusError } from "../errors.js";
+import { isActionableMessage } from "../directives.js";
+/**
+ * Shared core: fetch inbox items with optional filters.
+ * Used by both inboxCmd and MCP codebus_inbox tool.
+ *
+ * Ordering is OLDEST-FIRST (delivery gap #2): the old `created_at desc` order
+ * meant a newest-first drain starved old mail — an agent working the top of
+ * its inbox never reached anything below the newest few items, so old
+ * messages sat forever. `watch`'s backlog drain and `codebus inbox` both
+ * read this in arrival order now.
+ *
+ * `--unread` gates on handled_at IS NULL, not read_at (delivery gap #5/#6):
+ * read_at is a pure "opened" marker now — peeking a message must not clear it
+ * from every unread surface forever. handled_at clears on reply or explicit
+ * `codebus ack`.
+ */
+export async function fetchInbox(ctx, opts) {
+    // recipient rows for me, joined to message body (RLS limits to my rows + member workspaces)
+    let q = ctx.supabase.from("message_recipients")
+        .select("read_at, handled_at, archived_at, messages!inner(display_id, type, subject, body, headline, required_action, in_reply_to, from_agent_id, created_at, project_id, workspace_id)")
+        .is("archived_at", null);
+    if (opts.unread)
+        q = q.is("handled_at", null);
+    if (opts.ws)
+        q = q.eq("messages.workspace_id", opts.ws);
+    if (opts.projId)
+        q = q.eq("messages.project_id", opts.projId);
+    const { data, error } = await q.order("created_at", { foreignTable: "messages", ascending: true });
+    if (error)
+        throw new CodebusError(error.message);
+    const rows = (data ?? [])
+        .map((r) => ({
+        ...r.messages,
+        read: r.read_at ? "read" : "unread",
+        handled: r.handled_at ? "handled" : "unhandled",
+    }))
+        .sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime())
+        .filter((m) => !opts.type || m.type === opts.type);
+    return rows;
+}
+export async function inboxCmd(o) {
+    const ctx = await makeCtx(resolveConfig(o));
+    const ws = await workspaceId(ctx);
+    const projId = await projectId(ctx, ws, o.project);
+    const rows = await fetchInbox(ctx, {
+        unread: o.unread,
+        type: o.type,
+        projId,
+        ws,
+    });
+    // A guessed identity showing MAIL is the sharpest version of this risk —
+    // stdout, not stderr, so it survives in a transcript even if stderr scrolls
+    // past unread (field incident: a fresh session almost acted on it).
+    if (!o.json && identityIsGuessed(ctx))
+        process.stdout.write(guessedIdentityWarning(ctx, "messages"));
+    // RC2 field incident: a fresh inbox of 507 inbound/500 unread/504 unhandled
+    // broke down to 501 note (required_action NULL) and only 4 ask — a raw
+    // count told the reader nothing about how much of it actually needed a
+    // reply. Split the count the same way bus_digest's class 7/8 does
+    // (isActionableMessage, kept in lockstep in directives.ts) so that
+    // distinction is visible here too, not just in the ranked digest.
+    if (!o.json && rows.length > 0) {
+        const actionable = rows.filter((m) => isActionableMessage(m)).length;
+        console.log(`inbox: ${rows.length} shown — ${actionable} needs-reply, ${rows.length - actionable} FYI`);
+    }
+    // Delivery gap #9: headline/required_action render FIRST, ahead of the
+    // table, when present — that's the whole point of the structured-handover
+    // fields (dead columns since 0036 until this migration wired them up).
+    if (!o.json) {
+        for (const m of rows) {
+            if (m.headline) {
+                const ra = m.required_action ? ` — REQUIRED ACTION: ${m.required_action}` : "";
+                console.log(`[${m.display_id}] HEADLINE: ${m.headline}${ra}`);
+            }
+        }
+    }
+    console.log(render(rows, { json: !!o.json }));
+}
+//# sourceMappingURL=inbox.js.map

package/dist/commands/inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox.js","sourceRoot":"","sources":["../../src/commands/inbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAa,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAO,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC/G,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAiBvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,IAAoB;IAC7D,4FAA4F;IAC5F,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC;SAC5C,MAAM,CAAC,gLAAgL,CAAC;SACxL,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM;QAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM;QAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,IAAI,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,CAAC,CAAC,QAAQ;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACnC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;KAChD,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;SAC7F,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY;IACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM;QACN,EAAE;KACH,CAAC,CAAC;IACH,yEAAyE;IACzE,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IACrG,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAI,IAAkC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3G,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,YAAY,UAAU,iBAAiB,IAAI,CAAC,MAAM,GAAG,UAAU,MAAM,CAAC,CAAC;IAC1G,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,IAAiC,EAAE,CAAC;YAClD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,eAAe,CAAC,CAAC,QAAQ,GAAG,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC"}