@code-partner/codepipe-hub 0.14.1-dev.422.gf90f06c4 → 0.14.1-dev.424.ge3c8cc77

package/hub/dist/embedded.js

@@ -457,7 +457,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.422.gf90f06c4";
+    PLATFORM_VERSION = "0.14.1-dev.424.ge3c8cc77";
   }
 });
 
@@ -467,7 +467,7 @@ var init_version = __esm({
   "../packages/shared/dist/version.js"() {
     "use strict";
     init_version_generated();
-    PROTOCOL_VERSION = 4;
+    PROTOCOL_VERSION = 5;
   }
 });
 
@@ -4983,6 +4983,8 @@ function createCommandOperations(deps) {
         throw errors.unprocessable({ details: { reason: outcome.reason } });
       case "not_found":
         throw errors.notFound();
+      case "rate_limited":
+        throw errors.rateLimited();
     }
   }
   function accountActorOf(actor) {
@@ -5572,6 +5574,14 @@ function createCommandOperations(deps) {
         return { value: run.result, replayed: run.replayed };
       });
     },
+    async issueWorkerRegistrationToken(actor) {
+      const subjectId = actor.principal.subjectId;
+      return await audited(actor, { operationId: "worker.issueRegistrationToken", aggregateType: "account", aggregateId: subjectId, projectId: null }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const issued = unwrap(await write2.issueWorkerRegistrationToken({ owner: accountActorOf(actor) }));
+        return { value: { secret: issued.secret, expiresAt: toTimestamp(issued.expiresAt) }, replayed: false };
+      });
+    },
     async reportInitStatus(actor, command) {
       const { projectId, phase } = command;
       return await audited(actor, { operationId: "project.reportInitStatus", aggregateType: "project", aggregateId: projectId, projectId, data: { phase, failed: command.error !== void 0 } }, async (policy) => {
@@ -10972,7 +10982,20 @@ var init_auth = __esm({
 });
 
 // src/sandbox-reg-tokens.ts
+import { createHash as createHash2 } from "node:crypto";
 import { nanoid as nanoid7 } from "nanoid";
+function hashSandboxRegToken(secret) {
+  return createHash2("sha256").update(secret, "utf8").digest("hex");
+}
+async function issueEphemeralSandboxRegToken(db, email, ttlMs = EPHEMERAL_REG_TOKEN_TTL_MS) {
+  const normalized = email.trim().toLowerCase();
+  const secret = `sbxreg_${nanoid7(48)}`;
+  const now = Date.now();
+  const expiresAt = now + ttlMs;
+  await db.run(`INSERT INTO sandbox_reg_tokens (token_hash, email, user_id, created_at, expires_at)
+     VALUES (?, ?, (SELECT id FROM users WHERE email = ?), ?, ?)`, hashSandboxRegToken(secret), normalized, normalized, now, expiresAt);
+  return { secret, expiresAt };
+}
 var EPHEMERAL_REG_TOKEN_TTL_MS;
 var init_sandbox_reg_tokens = __esm({
   "src/sandbox-reg-tokens.ts"() {
@@ -11268,6 +11291,25 @@ var init_state_machine2 = __esm({
 });
 
 // src/abuse-throttle.ts
+function createAbuseThrottle(opts) {
+  const hits = /* @__PURE__ */ new Map();
+  return {
+    take(key) {
+      const now = Date.now();
+      const entry = hits.get(key);
+      if (!entry || entry.resetAt <= now) {
+        hits.set(key, { count: 1, resetAt: now + opts.windowMs });
+        return true;
+      }
+      if (entry.count >= opts.max) return false;
+      entry.count += 1;
+      return true;
+    },
+    reset() {
+      hits.clear();
+    }
+  };
+}
 var init_abuse_throttle = __esm({
   "src/abuse-throttle.ts"() {
     "use strict";
@@ -11298,11 +11340,11 @@ var init_sandbox2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_auth();
-    init_cli_auth();
     init_sandbox_reg_tokens();
     init_users();
     init_agent_auth_probe();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -11357,6 +11399,7 @@ var init_farm2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -11389,6 +11432,7 @@ var init_runner2 = __esm({
     init_users();
     init_runner_reg_tokens();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -12367,10 +12411,10 @@ __export(regimen_config_exports, {
   loadWorkflowSettings: () => loadWorkflowSettings,
   loadYouTrackWrites: () => loadYouTrackWrites
 });
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { parse as parseYaml2 } from "yaml";
 function contentSha2(content) {
-  return createHash2("sha1").update(content, "utf-8").digest("hex");
+  return createHash3("sha1").update(content, "utf-8").digest("hex");
 }
 async function applyRegimenContent(db, projectId, content, log, preParsed) {
   const previous = cache3.get(projectId) ?? null;
@@ -19186,9 +19230,9 @@ var init_cluster_order = __esm({
 });
 
 // src/prompts/prompt-cache.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function contentSha3(content) {
-  return createHash3("sha1").update(content, "utf-8").digest("hex");
+  return createHash4("sha1").update(content, "utf-8").digest("hex");
 }
 function getProjectPromptTemplate(projectId, role) {
   return cache4.get(projectId)?.get(role)?.content ?? null;
@@ -22786,7 +22830,7 @@ __export(lifecycle_exports, {
   taskRunsDirectImplement: () => taskRunsDirectImplement,
   triggerRework: () => triggerRework
 });
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 async function reconcileStuckTasks(db, log) {
   let recovered = 0;
   for (const task of await listTasks(db)) {
@@ -23381,7 +23425,7 @@ async function maybeAwaitingAnswer(db, task, log, blockingQuestions = []) {
   if (blocking.length === 0) return false;
   const now = Date.now();
   for (let i = 0; i < blocking.length; i++) {
-    const digest2 = createHash4("sha256").update(blocking[i]).digest("hex").slice(0, 12);
+    const digest2 = createHash5("sha256").update(blocking[i]).digest("hex").slice(0, 12);
     await ingestComment(db, {
       taskId: task.id,
       trackerCommentId: `agent:${task.phase.toLowerCase()}:${i}:${digest2}`,
@@ -28487,6 +28531,8 @@ function requestGhRunnersDelete(runnerId, projectId, sealedBundle, timeoutMs) {
 init_farm2();
 init_runner2();
 init_init_status();
+init_sandbox_reg_tokens();
+init_abuse_throttle();
 
 // src/projects/forget.ts
 init_legacy_cred_bundles();
@@ -28675,6 +28721,7 @@ function nodeUnavailable(capability, err) {
 function taskState(row) {
   return { ...row, revision: String(row.updatedAt) };
 }
+var WORKER_REG_TOKEN_MINTS = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
 function createWriteModel(db, log, hooks = {}) {
   async function readTaskRow(projectId, key) {
     const row = await db.get(
@@ -29357,6 +29404,16 @@ function createWriteModel(db, log, hooks = {}) {
       log.info({ projectId, jobId, kind }, kind === "backfill" ? "backfill job enqueued" : "index job enqueued");
       return ok({ jobId });
     },
+    async issueWorkerRegistrationToken({ owner }) {
+      if (owner.email === null) return { ok: false, refusal: "unprocessable", reason: "account_has_no_email" };
+      if (!WORKER_REG_TOKEN_MINTS.take(`email:${owner.email}`)) {
+        log.warn({ email: owner.email }, "ephemeral sandbox reg token mint throttled");
+        return { ok: false, refusal: "rate_limited" };
+      }
+      const issued = await issueEphemeralSandboxRegToken(db, owner.email);
+      log.info({ email: owner.email }, "ephemeral sandbox reg token issued for a client");
+      return ok(issued);
+    },
     async reportInitStatus({ projectId, phase, error }) {
       const recorded = await advanceInitPhase(db, projectId, phase);
       if (error !== null) {