@brainervirus/workit-pi 2.3.0 → 2.5.0

package/dist/workit.js

@@ -12056,6 +12056,15 @@ var validateBranchNameFor = (workspaceRoot, name) => {
   }
 };
 var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
+var policy = (root) => resolveBranchPolicyFor(root);
+var isProtected = (root, name) => policy(root).protected.has(name.toLowerCase());
+var isProtectedTarget = (root, name) => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
 var verifyPushIdentity = (root, provider, account) => {
   if (!account || typeof account !== "string")
     return { ok: false, error: "push identity requires a configured area account" };
@@ -17322,39 +17331,7 @@ import fs9 from "node:fs";
 import path15 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { pathToFileURL } from "node:url";
-var remoteRepoPath = (remote) => {
-  const raw = remote.trim();
-  if (!raw)
-    return null;
-  if (!raw.includes("://")) {
-    const scp = /^(?:[^@\s]+@)?([^:]+):(.+)$/u.exec(raw);
-    if (scp)
-      return {
-        host: scp[1].toLowerCase(),
-        path: scp[2].replace(/^\//u, "").replace(/\.git$/u, ""),
-        protocol: "ssh:"
-      };
-  }
-  try {
-    const url = new URL(raw);
-    return {
-      host: url.hostname.toLowerCase(),
-      path: url.pathname.replace(/^\//u, "").replace(/\.git$/u, "").replace(/\/$/u, ""),
-      protocol: url.protocol
-    };
-  } catch {
-    return null;
-  }
-};
-var cliRepository = (remote, provider, cfg) => {
-  const parsed = remoteRepoPath(remote);
-  if (!parsed?.path)
-    return null;
-  const host = String(provider === "github" ? cfg.github?.host ?? "github.com" : cfg.gitlab?.host ?? "gitlab.com").toLowerCase();
-  if (provider === "github")
-    return `${host}/${parsed.path}`;
-  return host === "gitlab.com" ? parsed.path : `https://${host}/${parsed.path}`;
-};
+// packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
   return m ? m[1] : String(value).trim().replace(/^#/, "");
@@ -17405,6 +17382,41 @@ function buildBody(body, branch, linkIssues, baseUrl, ytIssue, ghLinkOnPr, ghIss
 
 ${line}` : line;
 }
+
+// packages/workit-core/src/core/pr-create.ts
+var remoteRepoPath = (remote) => {
+  const raw = remote.trim();
+  if (!raw)
+    return null;
+  if (!raw.includes("://")) {
+    const scp = /^(?:[^@\s]+@)?([^:]+):(.+)$/u.exec(raw);
+    if (scp)
+      return {
+        host: scp[1].toLowerCase(),
+        path: scp[2].replace(/^\//u, "").replace(/\.git$/u, ""),
+        protocol: "ssh:"
+      };
+  }
+  try {
+    const url = new URL(raw);
+    return {
+      host: url.hostname.toLowerCase(),
+      path: url.pathname.replace(/^\//u, "").replace(/\.git$/u, "").replace(/\/$/u, ""),
+      protocol: url.protocol
+    };
+  } catch {
+    return null;
+  }
+};
+var cliRepository = (remote, provider, cfg) => {
+  const parsed = remoteRepoPath(remote);
+  if (!parsed?.path)
+    return null;
+  const host = String(provider === "github" ? cfg.github?.host ?? "github.com" : cfg.gitlab?.host ?? "gitlab.com").toLowerCase();
+  if (provider === "github")
+    return `${host}/${parsed.path}`;
+  return host === "gitlab.com" ? parsed.path : `https://${host}/${parsed.path}`;
+};
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
   for (const dir of (process.env.PATH ?? "").split(path15.delimiter)) {
@@ -19048,7 +19060,7 @@ async function logTimeUpdate(input, operation = defaultOperations) {
 // packages/workit-core/src/core/external-action-effects.ts
 import fs12 from "node:fs";
 import path19 from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 
 // packages/workit-core/src/core/changelog.ts
 import fs11 from "node:fs";
@@ -19379,6 +19391,212 @@ function changelogApply({
   }
 }
 
+// packages/workit-core/src/forge/redact.ts
+var R = "[REDACTED]";
+var TOKEN_PATTERNS = [
+  /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
+  /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+  /\bnpm_[A-Za-z0-9]{30,}/gu,
+  /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,
+  /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}/gu,
+  /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/gu,
+  /\bAIza[0-9A-Za-z_-]{35}/gu,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/gu
+];
+var WEBHOOK = /\b(https?:\/\/(?:hooks\.slack\.com\/(?:services|workflows|triggers)|discord(?:app)?\.com\/api\/webhooks))\/[^\s"'<>]+/giu;
+var URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/giu;
+var CURL_USER = /(\s(?:-u|--user)(?:\s+|=))(["']?)[^\s"':]+:[^\s"']+\2/gu;
+var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
+var ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
+var BEARER = /\b(bearer\s+)[A-Za-z0-9._~+/-]{12,}=*/giu;
+var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
+var NETRC = /\b((?:machine|login)\s+\S+\s+(?:login\s+\S+\s+)?password\s+)\S+/giu;
+var FLAG_SECRETS = [
+  /\b(sshpass\s+-p\s*)\S+/gu,
+  /\b(mysql(?:dump|admin|import|show)?\b[^\n]*?\s-p)(?!\s|$)\S+/gu
+];
+var QUERY_SECRET = /([?&;](?:sig|signature|token|access_token|api_key|apikey|key|password|secret|client_secret|X-Amz-Signature|X-Goog-Signature)=)[^&\s#"']+/giu;
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|$)/gu;
+var BASE64 = /[A-Za-z0-9+/]{32,}={0,2}/gu;
+var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
+var stripAnsi = (value) => value.replace(ANSI, "");
+var decodesToSecret = (blob) => {
+  if (/^[0-9a-f]+$/iu.test(blob))
+    return false;
+  let decoded;
+  try {
+    decoded = Buffer.from(blob, "base64").toString("utf8");
+  } catch {
+    return false;
+  }
+  if (!/^[\x20-\x7e\s]+$/u.test(decoded))
+    return false;
+  return TOKEN_PATTERNS.some((pattern) => new RegExp(pattern.source, "u").test(decoded)) || /^[^\s:]{1,64}:[^\s]{6,}$/u.test(decoded.trim());
+};
+function redactText(value) {
+  let out = stripAnsi(value).replace(PRIVATE_KEY, "[REDACTED PRIVATE KEY]");
+  out = out.replace(WEBHOOK, `$1/${R}`);
+  out = out.replace(URL_USERINFO, `$1${R}@`);
+  for (const pattern of TOKEN_PATTERNS)
+    out = out.replace(pattern, R);
+  out = out.replace(CURL_USER, `$1$2${R}$2`);
+  out = out.replace(BEARER, `$1${R}`);
+  out = out.replace(QUOTED_ASSIGNMENT, (match, lead, quote, secret) => secret.startsWith(R) ? match : `${lead}${quote}${R}${quote}`);
+  out = out.replace(NETRC, `$1${R}`);
+  for (const pattern of FLAG_SECRETS)
+    out = out.replace(pattern, `$1${R}`);
+  out = out.replace(QUERY_SECRET, `$1${R}`);
+  out = out.replace(ASSIGNMENT, (match, lead, scheme, secret) => secret.startsWith(R) ? match : `${lead}${scheme ?? ""}${R}`);
+  return out.split(`
+`).map((line) => line.replace(BASE64, (blob) => /\bbase64\b/iu.test(line) || decodesToSecret(blob) ? R : blob)).join(`
+`);
+}
+
+// packages/workit-core/src/git/rev.ts
+import { spawnSync as spawnSync8 } from "node:child_process";
+var MAX_BUFFER = 256 * 1024 * 1024;
+var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
+var git = (cwd, args, options = {}) => {
+  const result = spawnSync8("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: options.env ?? process.env,
+    input: options.input,
+    maxBuffer: MAX_BUFFER,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: error?.code === "ETIMEDOUT"
+  };
+};
+var line = (run) => {
+  if (!run.ok)
+    return null;
+  const value = run.stdout.trim();
+  return value ? value : null;
+};
+function networkGitInvocation(cwd, args, timeoutMs) {
+  const seconds = Math.max(1, Math.ceil(timeoutMs / 1000));
+  const env = {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    SSH_ASKPASS: "",
+    SSH_ASKPASS_REQUIRE: "never",
+    GCM_INTERACTIVE: "never"
+  };
+  const base = process.env.GIT_SSH_COMMAND || line(git(cwd, ["config", "--get", "core.sshCommand"])) || (process.env.GIT_SSH ? null : "ssh");
+  if (base)
+    env.GIT_SSH_COMMAND = `${base} -o BatchMode=yes -o ConnectTimeout=${Math.min(10, seconds)}`;
+  return {
+    args: ["-c", "http.lowSpeedLimit=1", "-c", `http.lowSpeedTime=${seconds}`, ...args],
+    env
+  };
+}
+var WATCHDOG = `
+const cp = require("node:child_process");
+const { ms, args } = JSON.parse(process.env.WORKIT_GIT_WATCHDOG);
+delete process.env.WORKIT_GIT_WATCHDOG;
+const win = process.platform === "win32";
+const child = cp.spawn("git", args, { stdio: "inherit", detached: !win, windowsHide: true });
+const killTree = () => {
+  if (!child.pid) return;
+  if (win) cp.spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  else try { process.kill(-child.pid, "SIGKILL"); } catch {}
+};
+let timedOut = false;
+const timer = setTimeout(() => { timedOut = true; killTree(); }, ms);
+child.on("error", () => { clearTimeout(timer); process.exit(127); });
+child.on("exit", (code) => {
+  clearTimeout(timer);
+  if (!win) killTree();
+  process.exit(timedOut ? 124 : code ?? 1);
+});
+`;
+var WATCHDOG_TIMEOUT_EXIT = 124;
+var gitNetwork = (cwd, args, timeoutMs) => {
+  const invocation = networkGitInvocation(cwd, args, timeoutMs);
+  const result = spawnSync8(process.execPath, ["-e", WATCHDOG], {
+    cwd,
+    encoding: "utf8",
+    env: {
+      ...invocation.env,
+      WORKIT_GIT_WATCHDOG: JSON.stringify({ ms: timeoutMs, args: invocation.args })
+    },
+    maxBuffer: MAX_BUFFER,
+    timeout: timeoutMs + 1e4,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: result.status === WATCHDOG_TIMEOUT_EXIT || error?.code === "ETIMEDOUT"
+  };
+};
+var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
+
+// packages/workit-core/src/ledger.ts
+var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
+var FAILING = new Set(["failed", "blocked"]);
+var PR_ROW_TYPES = new Set(["pr.created", "pr.status", "pr.merged"]);
+var NETWORK_FS_TYPES = new Set([
+  26985,
+  20859,
+  4266872130,
+  4283649346,
+  1702057286,
+  1397113167,
+  12805120,
+  16914839,
+  1196443219,
+  198183888
+]);
+var OBSERVED_ONLY = new Set(["check", ...PR_ROW_TYPES]);
+
+// packages/workit-core/src/git/ops.ts
+var COMMIT_TIMEOUT_MS = 10 * 60000;
+var PUSH_TIMEOUT_MS = 120000;
+var gitError = (run, max = 3) => {
+  const lines = redactText(`${run.stderr}
+${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trim()).filter((value) => value && !value.startsWith("hint:"));
+  return lines.slice(-max).join(" / ").slice(0, 400) || "git failed";
+};
+var SHA = /^[0-9a-f]{40,64}$/u;
+function deleteRemoteBranch(cwd, target, branch, expectedTip, options = {}) {
+  if (target.startsWith("-") || branch.startsWith("-") || !SHA.test(expectedTip))
+    return { ok: false, lease: false, error: "invalid branch deletion target" };
+  if (isProtectedTarget(cwd, branch))
+    return {
+      ok: false,
+      lease: false,
+      error: `${branch} is a protected branch; it is never deleted`
+    };
+  const run = gitNetwork(cwd, [
+    "push",
+    "--no-follow-tags",
+    "--recurse-submodules=no",
+    `--force-with-lease=refs/heads/${branch}:${expectedTip}`,
+    "--delete",
+    target,
+    branch
+  ], options.timeoutMs ?? PUSH_TIMEOUT_MS);
+  if (run.ok)
+    return { ok: true };
+  const text = `${run.stderr}
+${run.stdout}`;
+  return /stale info|cannot lock ref|fetch first|non-fast-forward/iu.test(text) ? { ok: false, lease: true, error: "the remote branch tip changed before deletion" } : { ok: false, lease: false, error: gitError(run) };
+}
+
 // packages/workit-core/src/core/external-action-effects.ts
 var run3 = (root, args) => {
   return run2(root, "git", args);
@@ -19784,7 +20002,7 @@ var hostingProvider = (root, remote) => {
 };
 var remoteBranchTip = (root, provider, host, repo, branch) => {
   const endpoint = provider === "github" ? `repos/${repo}/git/ref/heads/${branch.split("/").map(encodeURIComponent).join("/")}` : `projects/${encodeURIComponent(repo)}/repository/branches/${encodeURIComponent(branch)}`;
-  const response = spawnSync8(provider === "github" ? "gh" : "glab", ["api", endpoint], {
+  const response = spawnSync9(provider === "github" ? "gh" : "glab", ["api", endpoint], {
     cwd: root,
     encoding: "utf8",
     env: hostingCliEnv(provider, host)
@@ -19792,7 +20010,7 @@ var remoteBranchTip = (root, provider, host, repo, branch) => {
   if (response.status !== 0) {
     if (/\b404\b/.test(response.stderr ?? "")) {
       const project = provider === "github" ? `repos/${repo}` : `projects/${encodeURIComponent(repo)}`;
-      const visible = spawnSync8(provider === "github" ? "gh" : "glab", ["api", project], {
+      const visible = spawnSync9(provider === "github" ? "gh" : "glab", ["api", project], {
         cwd: root,
         encoding: "utf8",
         env: hostingCliEnv(provider, host)
@@ -19848,7 +20066,7 @@ var mergedBranch = (root, branch) => {
       outcome: "not_started"
     });
   const endpoint = provider === "github" ? `repos/${repo}/pulls?state=closed&head=${encodeURIComponent(`${repo.split("/")[0]}:${branch}`)}&per_page=100` : `projects/${encodeURIComponent(repo)}/merge_requests?state=merged&source_branch=${encodeURIComponent(branch)}&per_page=100`;
-  const response = spawnSync8(provider === "github" ? "gh" : "glab", ["api", endpoint], {
+  const response = spawnSync9(provider === "github" ? "gh" : "glab", ["api", endpoint], {
     cwd: root,
     encoding: "utf8",
     env: hostingCliEnv(provider, auth.host)
@@ -19910,7 +20128,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       return unknownHostingEvidence(operation);
     const endpoint = cfg.provider === "github" ? `repos/${repo}/pulls?state=all&head=${encodeURIComponent(`${repo.split("/")[0]}:${branch}`)}&base=${encodeURIComponent(target)}&per_page=100&page=1` : `projects/${encodeURIComponent(repo)}/merge_requests?state=all&source_branch=${encodeURIComponent(branch)}&target_branch=${encodeURIComponent(target)}&per_page=100&page=1`;
     const cli = cfg.provider === "github" ? "gh" : "glab";
-    const response = spawnSync8(cli, ["api", endpoint], {
+    const response = spawnSync9(cli, ["api", endpoint], {
       cwd: root,
       encoding: "utf8",
       env: hostingCliEnv(cfg.provider, auth.host)
@@ -20806,16 +21024,10 @@ var executeConcreteExternalAction = async (request, root, marker, dateMs, step,
           outcome: "not_started"
         });
       const branch = request.payload.branch;
-      const result = run3(root, [
-        "push",
-        `--force-with-lease=refs/heads/${branch}:${approvedTip}`,
-        "--delete",
-        target,
-        branch
-      ]);
-      if (result.exitCode === 0)
+      const result = deleteRemoteBranch(root, target, branch, approvedTip);
+      if (result.ok)
         return success(null, null, { branch, deletedTip: approvedTip });
-      return /stale info|cannot lock ref|fetch first|non-fast-forward/i.test(result.stderr) ? failure2("capability_unavailable", "remote branch tip changed before deletion", {
+      return result.lease ? failure2("capability_unavailable", "remote branch tip changed before deletion", {
         outcome: "not_started"
       }) : unknown2(request.operation);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-pi",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "description": "Workit native extension for Pi — tools, method skills, and session continuity",
   "keywords": [
     "agentic-coding",