@cyanautomation/kaseki-agent 1.25.1 → 1.25.3

package/README.md

@@ -4,7 +4,7 @@ Kaseki is a proof-of-concept ephemeral coding-agent runner. Each run is a number
 
 ## Quick Start
 
-### **Installation (Recommended)**
+### Installation (Recommended)
 
 ```bash
 # Global install (recommended)
@@ -21,7 +21,7 @@ kaseki-agent list
 kaseki-agent report kaseki-1
 ```
 
-### **Without Global Install**
+### Without Global Install
 
 ```bash
 npm install @cyanautomation/kaseki-agent
@@ -29,7 +29,7 @@ npx kaseki-agent setup
 npx kaseki-agent run https://github.com/CyanAutomation/crudmapper main
 ```
 
-### **Using Docker** ⭐ (Alternative)
+### Using Docker ⭐ (Alternative)
 
 If you prefer to avoid installing Node.js globally:
 
@@ -62,23 +62,23 @@ Each produces a numbered instance (kaseki-1, kaseki-2, …) with isolated worksp
 
 ## Getting Started
 
-### **1. Installation & Setup**
+### Installation & Setup
 
-**Option A: Global NPM**
+#### Option A: Global NPM
 
 ```bash
 npm install -g @cyanautomation/kaseki-agent
 kaseki-agent setup
 ```
 
-**Option B: Local NPM**
+#### Option B: Local NPM
 
 ```bash
 npm install @cyanautomation/kaseki-agent
 npx kaseki-agent setup
 ```
 
-**Option C: Docker**
+#### Option C: Docker
 
 ```bash
 docker run -it \
@@ -87,13 +87,13 @@ docker run -it \
   setup
 ```
 
-### **2. Verify Installation**
+### Verify Installation
 
 ```bash
 kaseki-agent doctor
 ```
 
-### **2.5. Configure Authentication**
+### Configure Authentication
 
 Kaseki needs three sets of credentials. Choose your preferred setup method:
 
@@ -134,7 +134,7 @@ See [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) for setting up the kaseki-api servi
 
 **👉 Full guide:** [docs/AUTH_SETUP.md](docs/AUTH_SETUP.md)
 
-### **3. Run Your First Task**
+### Run Your First Task
 
 ```bash
 # Simple example
@@ -145,7 +145,7 @@ kaseki-agent run https://github.com/CyanAutomation/crudmapper main \
   "Fix the TypeScript errors in src/"
 ```
 
-### **4. View Results**
+### View Results
 
 ```bash
 # List all instances
@@ -159,7 +159,7 @@ kaseki-agent report kaseki-1
 
 ## CLI Commands
 
-### `setup` — Interactive Configuration Wizard
+#### `setup` — Interactive Configuration Wizard
 
 First-time setup to validate environment and store API credentials securely.
 
@@ -176,7 +176,7 @@ kaseki-agent setup
 - Saves configuration (project-local or user-global)
 - Runs doctor checks to verify everything works
 
-### `run` — Execute Agent on Repository
+#### `run` — Execute Agent on Repository
 
 ```bash
 kaseki-agent run <REPO_URL> [GIT_REF] [TASK_PROMPT]
@@ -205,7 +205,7 @@ kaseki-agent run https://github.com/CyanAutomation/crudmapper main \
 5. Stream agent output in real-time
 6. Collect results and generate report
 
-### `doctor` — Health Check & Validation
+#### `doctor` — Health Check & Validation
 
 ```bash
 kaseki-agent doctor [--json] [--fix]
@@ -226,7 +226,7 @@ kaseki-agent doctor [--json] [--fix]
 - `--json` — JSON output (useful for scripts)
 - `--fix` — Attempt auto-remediation (pull image, show install hints)
 
-### `list` — Show All Instances
+#### `list` — Show All Instances
 
 ```bash
 kaseki-agent list [--status STATE]
@@ -247,7 +247,7 @@ kaseki-agent list --status running
 - Creation date
 - Execution duration
 
-### `report` — View Instance Results
+#### `report` — View Instance Results
 
 ```bash
 kaseki-agent report <INSTANCE_ID>
@@ -260,7 +260,7 @@ kaseki-agent report <INSTANCE_ID>
 - Final status and exit code
 - Detailed summary (if available)
 
-### `config` — Manage Configuration
+#### `config` — Manage Configuration
 
 ```bash
 kaseki-agent config <SUBCOMMAND> [OPTIONS]
@@ -285,7 +285,7 @@ kaseki-agent config show
 kaseki-agent config locations
 ```
 
-### `secrets` — Manage Credentials
+#### `secrets` — Manage Credentials
 
 ```bash
 kaseki-agent secrets <SUBCOMMAND>
@@ -318,7 +318,7 @@ kaseki-agent secrets list
 - Linux: Uses `pass` (password-store) keyring
 - Headless: Falls back to `~/.kaseki/secrets/` (0600 permissions)
 
-### `serve` — Start REST API Service
+#### `serve` — Start REST API Service
 
 ```bash
 kaseki-agent serve [--port PORT]
@@ -373,6 +373,8 @@ Configuration is loaded from (in order of precedence):
 4. **Environment variables** (`KASEKI_*`, `OPENROUTER_*`, `GITHUB_*`)
 5. **Built-in defaults**
 
+### Example Configuration
+
 **Example `kaseki-agent.json`:**
 
 ```json
@@ -391,7 +393,7 @@ Configuration is loaded from (in order of precedence):
 }
 ```
 
-**Common Environment Variables:**
+### Common Environment Variables
 
 ```bash
 # Required
@@ -401,7 +403,10 @@ OPENROUTER_API_KEY_FILE=~/.kaseki/secrets/openrouter_api_key
 KASEKI_ROOT=/agents                    # Base directory
 KASEKI_MODEL=openrouter/free           # AI model
 KASEKI_AGENT_TIMEOUT_SECONDS=1200      # Timeout
-KASEKI_VALIDATION_COMMANDS="npm run check;npm run test;npm run build"
+KASEKI_PRE_AGENT_VALIDATION=1          # Validate baseline before Pi
+KASEKI_PRE_AGENT_VALIDATION_COMMANDS="npm run check;npm run test;npm run build"
+KASEKI_VALIDATION_COMMANDS="npm run check;npm run test;npm run build" # Validate final diff after Pi
+KASEKI_STARTUP_CHECK_MODE=boot          # boot or baseline-validation for dry-run startup checks
 ```
 
 ---
@@ -410,7 +415,7 @@ KASEKI_VALIDATION_COMMANDS="npm run check;npm run test;npm run build"
 
 ### Deployment Patterns
 
-**1. CLI (Direct Execution)**
+#### CLI (Direct Execution)
 
 ```bash
 kaseki-agent run <repo> <ref>
@@ -420,7 +425,7 @@ kaseki-agent run <repo> <ref>
 - Immediate results
 - Best for: CI/CD, direct usage
 
-**2. REST API (Distributed)**
+#### REST API (Distributed)
 
 ```bash
 kaseki-agent serve --port 8080
@@ -431,7 +436,7 @@ kaseki-agent serve --port 8080
 - Async execution
 - Best for: Controllers, distributed systems
 
-**3. Docker (Self-Contained)**
+#### Docker (Self-Contained)
 
 ```bash
 docker run docker.io/cyanautomation/kaseki-agent:latest run <repo> <ref>
@@ -441,6 +446,8 @@ docker run docker.io/cyanautomation/kaseki-agent:latest run <repo> <ref>
 - Full isolation
 - Best for: Clean environments, CI/CD containers
 
+### Host and Container Layers
+
 **Host layer** — Management and orchestration:
 
 - `run-kaseki.sh` — Direct runner (creates workspace, launches container, cleans up)
@@ -449,13 +456,21 @@ docker run docker.io/cyanautomation/kaseki-agent:latest run <repo> <ref>
 
 **Container layer** — Agent execution:
 
-- `kaseki-agent.sh` — Inside the container (clones repo, installs deps, invokes Pi, validates, stores results)
+- `kaseki-agent.sh` — Inside the container (clones repo, installs deps, runs pre-agent validation, invokes Pi, runs post-agent validation, stores results)
 - `entrypoint.sh` — Container startup orchestrator
 
+### Validation Lifecycle
+
+1. Clone the target repo/ref and install dependencies.
+2. Run **pre-agent validation** when `KASEKI_PRE_AGENT_VALIDATION=1` (default). These commands default to `KASEKI_VALIDATION_COMMANDS` through `KASEKI_PRE_AGENT_VALIDATION_COMMANDS` and execute before Pi so Kaseki can detect an already-failing baseline. Inspect `/agents/kaseki-results/kaseki-N/pre-validation.log`, `/agents/kaseki-results/kaseki-N/pre-validation-raw.log`, `/agents/kaseki-results/kaseki-N/pre-validation-env.log`, and `/agents/kaseki-results/kaseki-N/pre-validation-timings.tsv`.
+3. Invoke Pi only if the baseline validation succeeds (or pre-agent validation is disabled).
+4. Restore disallowed changes, run quality gates, then run **post-agent validation** with `KASEKI_VALIDATION_COMMANDS` against the final diff. Inspect `/agents/kaseki-results/kaseki-N/validation.log`, `/agents/kaseki-results/kaseki-N/validation-raw.log`, `/agents/kaseki-results/kaseki-N/validation-env.log`, and `/agents/kaseki-results/kaseki-N/validation-timings.tsv`.
+5. Record phase exit codes and failure reasons in `/agents/kaseki-results/kaseki-N/metadata.json`; `stage-timings.tsv` shows whether the failing phase was `pre-agent validation` or `validation`.
+
 > **Important:** `kaseki-agent.sh` runs from the Docker image (`/usr/local/bin/kaseki-agent`) and is **not** host-mounted during runs.
 > For Direct CLI mode, the host needs `run-kaseki.sh` (plus `scripts/kaseki-preflight.sh`) and Docker access; the agent script itself stays inside the image.
 
-**Supporting utilities (Node.js):**
+### Supporting Utilities (Node.js)
 
 - `pi-event-filter.js` — Filters raw Pi JSONL, strips thinking blocks, emits `pi-events.jsonl` + `pi-summary.json`
 - `kaseki-report.js` — Reads a results directory and prints diagnostic report
@@ -463,7 +478,7 @@ docker run docker.io/cyanautomation/kaseki-agent:latest run <repo> <ref>
 - `kaseki-api-service.js` — REST API service for remote runs
 - `kaseki-api-client.ts` — TypeScript client for integration
 
-**Directory layout at runtime:**
+### Directory Layout at Runtime
 
 ```
 /agents/kaseki-template/          # Dockerfile, scripts (this repo)
@@ -478,7 +493,7 @@ docker run docker.io/cyanautomation/kaseki-agent:latest run <repo> <ref>
 
 ## Deployment Modes
 
-### 1. Direct CLI (run-kaseki.sh)
+### Direct CLI (run-kaseki.sh)
 
 Simplest single-run invocation on a host:
 
@@ -498,7 +513,7 @@ OPENROUTER_API_KEY_FILE=~/secrets/openrouter_api_key \
 
 ---
 
-### 2. Remote Activation (kaseki-activate.sh)
+### Remote Activation (kaseki-activate.sh)
 
 For SSH/controller-driven setup and execution. Used by OpenClaw and similar orchestrators.
 
@@ -564,7 +579,7 @@ Returns newline-delimited JSON for each major step.
 
 ---
 
-### 3. REST API Service (kaseki-api)
+### REST API Service (kaseki-api)
 
 Long-running async orchestration service. Ideal for:
 
@@ -1174,6 +1189,28 @@ container environment.
 
 3. Install the app on the target repository
 
+### Single-line/text PEM private keys
+
+The preferred approach is to paste the GitHub App private key text into a
+secret file, then reference that file with `GITHUB_APP_PRIVATE_KEY_FILE`. For
+example, store the value at `/agents/secrets/github_app_private_key` for
+container or service deployments, or at `~/secrets/github_app_private_key` for
+local CLI runs.
+
+Kaseki normalizes the private key after reading it, so the file may contain the
+original multi-line PEM, a PEM where newlines are escaped as `\n`, a base64-
+encoded PEM, or a single-line PEM where spaces are used in place of PEM
+newlines.
+
+`GITHUB_APP_PRIVATE_KEY` is only for local `run-kaseki.sh` experiments. Config
+and API service flows may reject inline private keys because they enforce
+file-based secrets; use `GITHUB_APP_PRIVATE_KEY_FILE` for those flows.
+
+> **Security warning:** Never paste real private keys into tickets, prompts,
+> logs, `.env` files, or source control. If a GitHub App private key is exposed,
+> regenerate the private key in the GitHub App settings and replace the secret
+> file everywhere it is used.
+
 ### Setup
 
 ```bash
@@ -1208,10 +1245,12 @@ volumes:
   - /agents:/agents:rw
 ```
 
-`GITHUB_APP_PRIVATE_KEY` is still accepted as a fallback for local experiments,
-including escaped `\n` or single-line PEM values, but avoid it for shared hosts:
-environment variables are easier to leak through process inspection, logs, and
-orchestration UIs.
+`GITHUB_APP_PRIVATE_KEY` is still accepted as a fallback for local
+`run-kaseki.sh` experiments, including escaped `\n`, base64 PEM, or
+single-line PEM values after normalization. Avoid inline private keys for shared
+hosts: environment variables are easier to leak through process inspection,
+logs, and orchestration UIs, and config/API service flows may reject inline
+secrets in favor of file-based secret paths.
 
 ### Behavior
 
@@ -1220,15 +1259,20 @@ When credentials are configured and publishing is enabled:
 1. After validation passes and diff is non-empty, Kaseki generates a GitHub App installation token
 2. Creates a feature branch `kaseki/<instance-name>`
 3. Commits and pushes changes to remote
-4. Creates a draft PR against the target branch when `KASEKI_PUBLISH_MODE=draft_pr` or API `publishMode` is `draft_pr`, with:
+4. Creates a draft PR against the target branch when `KASEKI_PUBLISH_MODE=draft_pr` or API `publishMode` is `draft_pr`; `auto` can also create a draft PR when worker credentials are available, with:
    - Title: `Kaseki: <instance-name>`
    - Body: Model, duration, validation result, quality checks
    - Draft: `true` for safety; review before merging
 
-Publishing modes are `none`, `branch`, and `draft_pr`. Controller requests that
-ask for `branch` or `draft_pr` fail before queueing unless GitHub App credentials
-are readable, so orchestrators can surface a clear setup error instead of waiting
-for a run that cannot publish.
+Publishing modes are `auto`, `none`, `branch`, and `draft_pr`. Controller
+requests default omitted `publishMode` to `draft_pr`, so the normal controller
+path pushes a branch and opens a draft pull request after validation. Explicit
+API `publishMode: "auto"` is accepted for graceful worker auto publishing: the
+worker publishes when credentials are available and skips GitHub operations when
+they are not. Requests that resolve to `branch` or `draft_pr` fail before
+queueing unless GitHub App credentials are readable, so orchestrators can surface
+a clear setup error instead of waiting for a run that cannot publish. Set
+`publishMode` to `none` to opt out of GitHub publishing for a specific API run.
 
 ### Result Artifacts
 
@@ -1259,13 +1303,18 @@ for a run that cannot publish.
 | `KASEKI_AGENT_TIMEOUT_SECONDS` | 1200 | Agent timeout (20 min) |
 | `TASK_PROMPT` | *(code fix task)* | Agent instructions |
 | `KASEKI_TASK_MODE` | patch | `patch` (require diff) or `inspect` (no diff) |
-| `KASEKI_PUBLISH_MODE` | auto | `none`, `branch`, or `draft_pr`; API requests use `publishMode` |
+| `KASEKI_PUBLISH_MODE` | auto | `auto`, `none`, `branch`, or `draft_pr`; controller API requests default omitted `publishMode` to `draft_pr`, while explicit API `publishMode: "auto"` passes graceful auto publishing to workers |
+| `KASEKI_STARTUP_CHECK_MODE` | boot | Dry-run startup check depth: `boot` or `baseline-validation` |
 
 ### Validation and Quality Gates
 
 | Variable | Default | Notes |
 |---|---|---|
-| `KASEKI_VALIDATION_COMMANDS` | `npm run check;npm run test;npm run build` | Semicolon-separated; set to `none` to skip. Missing npm scripts are skipped with a warning (non-fatal). |
+| `KASEKI_PRE_AGENT_VALIDATION` | `1` | Run validation before Pi to detect a failing baseline repo/ref. Set to `0` only when you intentionally want to skip baseline validation. |
+| `KASEKI_PRE_AGENT_VALIDATION_COMMANDS` | same as `KASEKI_VALIDATION_COMMANDS` | Semicolon-separated pre-agent validation commands. Logs: `pre-validation.log`, `pre-validation-raw.log`, `pre-validation-env.log`, `pre-validation-timings.tsv`. |
+| `KASEKI_VALIDATION_COMMANDS` | `npm run check;npm run test;npm run build` | Semicolon-separated post-agent validation commands for the final diff; set to `none` or empty to skip post-agent validation. Missing npm scripts are skipped with a warning (non-fatal). Logs: `validation.log`, `validation-raw.log`, `validation-env.log`, `validation-timings.tsv`. |
+| `KASEKI_STARTUP_CHECK_MODE` | `boot` | For `KASEKI_DRY_RUN=1`, `boot` performs a container smoke test through `/bin/bash`; `baseline-validation` runs `/usr/local/bin/kaseki-agent` to clone, install dependencies, run pre-agent validation, and skip Pi. |
+| `KASEKI_BASELINE_VALIDATION_DRY_RUN` | `0` | Internal/API switch set with `baseline-validation` so pre-agent validation runs even though Pi remains disabled. |
 | `KASEKI_CHANGED_FILES_ALLOWLIST` | `src/lib/parser.ts tests/parser.validation.ts` | Space-separated patterns |
 | `KASEKI_MAX_DIFF_BYTES` | 200000 | Max diff size (200 KB) |
 | `KASEKI_ALLOW_EMPTY_DIFF` | 0 | Set to `1` to allow empty diff with `KASEKI_TASK_MODE=patch` |
@@ -1277,6 +1326,8 @@ for a run that cannot publish.
 
 API controllers may send either the direct fields (`changedFilesAllowlist`, `validationCommands`) or the structured aliases (`allowlist.include`, `validation.commands`). The scheduler normalizes both forms before launching the worker.
 
+Startup checks have two depths. Boot-only startup checks (`startupCheck: true`, `startupCheckMode: "boot"`, or `KASEKI_DRY_RUN=1 KASEKI_STARTUP_CHECK_MODE=boot`) use the minimal container boot path to verify runtime tools, mounts, and secrets without cloning the repository. Baseline validation startup checks (`startupCheckMode: "baseline-validation"`, or a startup check with validation commands) keep dry-run/Pi-skipping behavior but invoke `/usr/local/bin/kaseki-agent` far enough to clone the repository, prepare dependencies, and execute the pre-agent validation commands. A failure in this mode means the requested baseline already failed before any Pi-authored changes existed; inspect `pre-validation.log` and `pre-validation-timings.tsv`.
+
 ### Paths and Caching
 
 | Variable | Default | Notes |

package/dist/config/ConfigManager.d.ts

@@ -132,10 +132,10 @@ export declare const ConfigSchema: z.ZodObject<{
         publish_mode: z.ZodOptional<z.ZodOptional<z.ZodEnum<["auto", "on", "off"]>>>;
     }, "strip", z.ZodTypeAny, {
         app_enabled?: boolean | undefined;
-        publish_mode?: "off" | "auto" | "on" | undefined;
+        publish_mode?: "auto" | "off" | "on" | undefined;
     }, {
         app_enabled?: boolean | undefined;
-        publish_mode?: "off" | "auto" | "on" | undefined;
+        publish_mode?: "auto" | "off" | "on" | undefined;
     }>>;
     docker: z.ZodOptional<z.ZodObject<{
         image: z.ZodOptional<z.ZodOptional<z.ZodString>>;
@@ -254,7 +254,7 @@ export declare const ConfigSchema: z.ZodObject<{
     } | undefined;
     github?: {
         app_enabled?: boolean | undefined;
-        publish_mode?: "off" | "auto" | "on" | undefined;
+        publish_mode?: "auto" | "off" | "on" | undefined;
     } | undefined;
     docker?: {
         image?: string | undefined;
@@ -325,7 +325,7 @@ export declare const ConfigSchema: z.ZodObject<{
     } | undefined;
     github?: {
         app_enabled?: boolean | undefined;
-        publish_mode?: "off" | "auto" | "on" | undefined;
+        publish_mode?: "auto" | "off" | "on" | undefined;
     } | undefined;
     docker?: {
         image?: string | undefined;

package/dist/github-app-private-key.d.ts

@@ -0,0 +1,9 @@
+export interface GitHubAppPrivateKeyValidationResult {
+    ok: boolean;
+    normalized?: string;
+    error?: string;
+    remediation?: string;
+}
+export declare function normalizeGitHubAppPrivateKey(value: string): string;
+export declare function validateGitHubAppPrivateKey(value: string): GitHubAppPrivateKeyValidationResult;
+//# sourceMappingURL=github-app-private-key.d.ts.map

package/dist/github-app-private-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app-private-key.d.ts","sourceRoot":"","sources":["../src/github-app-private-key.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mCAAmC;IAClD,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA0DD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBlE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,mCAAmC,CAiD9F"}

package/dist/github-app-private-key.js

@@ -0,0 +1,98 @@
+import crypto from 'crypto';
+const PRIVATE_KEY_HEADER_PATTERN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+const ANY_PEM_HEADER_PATTERN = /-----BEGIN [^-]+-----/;
+const MAX_CRYPTO_ERROR_LENGTH = 240;
+function hasPrivateKeyPemHeader(value) {
+    return PRIVATE_KEY_HEADER_PATTERN.test(value);
+}
+function looksLikeBase64(value) {
+    const compact = value.replace(/\s+/g, '');
+    return (compact.length > 0 &&
+        compact.length % 4 === 0 &&
+        /^[A-Za-z0-9+/]+={0,2}$/.test(compact));
+}
+function removeMatchingOuterQuotes(value) {
+    if (value.length >= 2) {
+        const first = value[0];
+        const last = value[value.length - 1];
+        if ((first === '"' || first === "'") && first === last) {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
+function normalizePrivateKeyText(value) {
+    return removeMatchingOuterQuotes(value.replace(/^\uFEFF/, '').trim().replace(/\\n/g, '\n'));
+}
+function rewrapPrivateKeyPem(value) {
+    return value.replace(/-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----([\s\S]*?)-----END \1-----/g, (_match, type, body) => {
+        const compactBody = body.replace(/\s+/g, '');
+        const bodyLines = compactBody.match(/.{1,64}/g) || [];
+        return `-----BEGIN ${type}-----\n${bodyLines.join('\n')}\n-----END ${type}-----\n`;
+    });
+}
+function sanitizeCryptoError(error) {
+    const rawMessage = error instanceof Error ? error.message : String(error);
+    const normalizedMessage = rawMessage.replace(/\s+/g, ' ').trim();
+    if (normalizedMessage.length <= MAX_CRYPTO_ERROR_LENGTH) {
+        return normalizedMessage;
+    }
+    return `${normalizedMessage.slice(0, MAX_CRYPTO_ERROR_LENGTH)}...`;
+}
+export function normalizeGitHubAppPrivateKey(value) {
+    let normalizedPem = rewrapPrivateKeyPem(normalizePrivateKeyText(value));
+    if (!hasPrivateKeyPemHeader(normalizedPem) && looksLikeBase64(normalizedPem)) {
+        const decodedPem = Buffer.from(normalizedPem.replace(/\s+/g, ''), 'base64').toString('utf8');
+        if (hasPrivateKeyPemHeader(decodedPem) ||
+            ANY_PEM_HEADER_PATTERN.test(decodedPem)) {
+            normalizedPem = rewrapPrivateKeyPem(normalizePrivateKeyText(decodedPem));
+        }
+    }
+    return normalizedPem;
+}
+export function validateGitHubAppPrivateKey(value) {
+    const normalized = normalizeGitHubAppPrivateKey(value);
+    if (normalized.includes('-----BEGIN OPENSSH PRIVATE KEY-----')) {
+        return {
+            ok: false,
+            error: 'GitHub App private key uses OpenSSH format. GitHub App keys must be the PEM downloaded from GitHub App settings.',
+            remediation: 'Download a new private key from the GitHub App settings page and store that PEM content in the github_app_private_key secret file.',
+        };
+    }
+    if (normalized.includes('-----BEGIN ENCRYPTED PRIVATE KEY-----')) {
+        return {
+            ok: false,
+            error: 'GitHub App private key is encrypted. Encrypted keys are not supported unless passphrase support is added.',
+            remediation: 'Store an unencrypted GitHub App private key PEM in the github_app_private_key secret file.',
+        };
+    }
+    if (/-----BEGIN [^-]*(PUBLIC KEY|CERTIFICATE)-----/.test(normalized)) {
+        return {
+            ok: false,
+            error: 'GitHub App private key file contains a public key or certificate; this is not the GitHub App private key.',
+            remediation: 'Replace github_app_private_key with the private-key PEM downloaded from GitHub App settings, not a public key or certificate.',
+        };
+    }
+    if (!hasPrivateKeyPemHeader(normalized)) {
+        return {
+            ok: false,
+            error: 'GitHub App private key file does not contain a private-key PEM header after normalization/base64 decode. Expected -----BEGIN ... PRIVATE KEY-----.',
+            remediation: 'The github_app_private_key secret file must contain the complete PEM private key downloaded from GitHub App settings, including BEGIN and END lines.',
+        };
+    }
+    try {
+        crypto.createPrivateKey(normalized);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `GitHub App private key is not a valid PEM private key: ${sanitizeCryptoError(error)}`,
+            remediation: 'Regenerate the GitHub App private key in GitHub App settings and replace the github_app_private_key secret file with the complete downloaded PEM.',
+        };
+    }
+    return {
+        ok: true,
+        normalized,
+    };
+}
+//# sourceMappingURL=github-app-private-key.js.map

package/dist/github-app-private-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app-private-key.js","sourceRoot":"","sources":["../src/github-app-private-key.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAS5B,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAC3E,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AACvD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,CACL,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QACxB,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,yBAAyB,CAC9B,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAClB,oEAAoE,EACpE,CAAC,MAAM,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,cAAc,IAAI,UAAU,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IACrF,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,UAAU,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,iBAAiB,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACxD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,IAAI,aAAa,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAExE,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EACjC,QAAQ,CACT,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnB,IACE,sBAAsB,CAAC,UAAU,CAAC;YAClC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EACvC,CAAC;YACD,aAAa,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAEvD,IAAI,UAAU,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kHAAkH;YACzH,WAAW,EAAE,oIAAoI;SAClJ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2GAA2G;YAClH,WAAW,EAAE,4FAA4F;SAC1G,CAAC;IACJ,CAAC;IAED,IAAI,+CAA+C,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2GAA2G;YAClH,WAAW,EAAE,+HAA+H;SAC7I,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oJAAoJ;YAC3J,WAAW,EAAE,sJAAsJ;SACpK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0DAA0D,mBAAmB,CAAC,KAAK,CAAC,EAAE;YAC7F,WAAW,EAAE,mJAAmJ;SACjK,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/github-app-token.js

@@ -15,10 +15,21 @@
 import fs from 'fs';
 import crypto from 'crypto';
 import https from 'https';
+import { validateGitHubAppPrivateKey } from './github-app-private-key.js';
 const APP_ID = process.argv[2];
 const PRIVATE_KEY_FILE = process.argv[3];
 const OWNER = process.argv[4];
 const REPO = process.argv[5];
+function loadAndValidatePrivateKey(privateKeyFile) {
+    const validation = validateGitHubAppPrivateKey(fs.readFileSync(privateKeyFile, 'utf8'));
+    if (!validation.ok || !validation.normalized) {
+        const message = validation.remediation
+            ? `${validation.error} ${validation.remediation}`
+            : validation.error;
+        throw new Error(message || 'GitHub App private key is not valid.');
+    }
+    return crypto.createPrivateKey(validation.normalized);
+}
 async function generateJWT(appId, privateKey) {
     const now = Math.floor(Date.now() / 1000);
     const iat = now - 60; // account for clock skew
@@ -124,8 +135,8 @@ async function main() {
         process.exit(1);
     }
     try {
-        // Read private key
-        const privateKey = fs.readFileSync(PRIVATE_KEY_FILE, 'utf8');
+        // Read and validate private key
+        const privateKey = loadAndValidatePrivateKey(PRIVATE_KEY_FILE);
         // Generate JWT
         const jwt = await generateJWT(APP_ID, privateKey);
         // Get installation ID

package/dist/github-app-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-app-token.js","sourceRoot":"","sources":["../src/github-app-token.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAC;AA8B1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/B,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7B,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,UAAkB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,yBAAyB;IAC/C,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa;IAExC,MAAM,MAAM,GAAc;QACxB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,KAAK;QACV,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,GAAG,YAAY,IAAI,aAAa,EAAE,CAAC;IAEnD,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,EAAE,CAAC;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa,EAAE,IAAY;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,gBAAgB;YAC1B,IAAI,EAAE,UAAU,KAAK,IAAI,IAAI,eAAe;YAC5C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,GAAG,EAAE;gBAChC,QAAQ,EAAE,iDAAiD;gBAC3D,YAAY,EAAE,cAAc;aAC7B;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CACJ,IAAI,KAAK,CACP,kCAAkC,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAC3D,CACF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,MAAM,IAAI,GAA2B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACtD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,KAAK,CACP,0CACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,cAAsB;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,gBAAgB;YAC1B,IAAI,EAAE,sBAAsB,cAAc,gBAAgB;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,GAAG,EAAE;gBAChC,QAAQ,EAAE,iDAAiD;gBAC3D,YAAY,EAAE,cAAc;gBAC5B,gBAAgB,EAAE,GAAG;aACtB;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CACJ,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CACnE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,MAAM,IAAI,GAAwB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACnD,OAAO,CAAC;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,UAAU,EAAE,IAAI,CAAC,UAAU;yBAC5B,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,KAAK,CACP,mCACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,mBAAmB;QACnB,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAE7D,eAAe;QACf,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAElD,sBAAsB;QACtB,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEjE,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE5D,wBAAwB;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAuB;QACvB,MAAM,MAAM,GAAgB;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"github-app-token.js","sourceRoot":"","sources":["../src/github-app-token.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AA8BvE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/B,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7B,SAAS,yBAAyB,CAAC,cAAsB;IACvD,MAAM,UAAU,GAAG,2BAA2B,CAC5C,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CACxC,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW;YACpC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,WAAW,EAAE;YACjD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,sCAAsC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,UAA4B;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,yBAAyB;IAC/C,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa;IAExC,MAAM,MAAM,GAAc;QACxB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,KAAK;QACV,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,GAAG,YAAY,IAAI,aAAa,EAAE,CAAC;IAEnD,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,EAAE,CAAC;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa,EAAE,IAAY;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,gBAAgB;YAC1B,IAAI,EAAE,UAAU,KAAK,IAAI,IAAI,eAAe;YAC5C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,GAAG,EAAE;gBAChC,QAAQ,EAAE,iDAAiD;gBAC3D,YAAY,EAAE,cAAc;aAC7B;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CACJ,IAAI,KAAK,CACP,kCAAkC,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAC3D,CACF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,MAAM,IAAI,GAA2B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACtD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,KAAK,CACP,0CACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,cAAsB;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,gBAAgB;YAC1B,IAAI,EAAE,sBAAsB,cAAc,gBAAgB;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,GAAG,EAAE;gBAChC,QAAQ,EAAE,iDAAiD;gBAC3D,YAAY,EAAE,cAAc;gBAC5B,gBAAgB,EAAE,GAAG;aACtB;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CACJ,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CACnE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,MAAM,IAAI,GAAwB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACnD,OAAO,CAAC;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,UAAU,EAAE,IAAI,CAAC,UAAU;yBAC5B,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,KAAK,CACP,mCACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,UAAU,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAE/D,eAAe;QACf,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAElD,sBAAsB;QACtB,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEjE,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE5D,wBAAwB;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAuB;QACvB,MAAM,MAAM,GAAgB;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/job-scheduler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-scheduler.d.ts","sourceRoot":"","sources":["../src/job-scheduler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,UAAU,EAAoC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAclD;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAa;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAQ;IAClE,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,kBAAkB,CAAqC;IAC/D,OAAO,CAAC,iBAAiB,CAAqC;IAC9D,OAAO,CAAC,iBAAiB,CAA6C;IACtE,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,aAAa,CAAC,CAAmC;IACzD,OAAO,CAAC,kBAAkB,CAAwB;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAErC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC;IAcrH;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;IAoDlD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IAInC;;;;OAIG;IACH,QAAQ,IAAI,GAAG,EAAE;IAIjB;;OAEG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IA0EtC;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAuMlB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,mBAAmB;IA4B3B,OAAO,CAAC,mBAAmB;IAuD3B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,4BAA4B;IA0BpC,OAAO,CAAC,cAAc;IAKtB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,yBAAyB;IAIjC;;OAEG;IACH,OAAO,CAAC,WAAW;IAsCnB,OAAO,CAAC,gBAAgB;IAYxB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,MAAM,GAAG,IAAI;IAS5D,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoB5E,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,cAAc,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAQ7E,YAAY,IAAI;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IAqBrD;;OAEG;IACH,QAAQ,IAAI,IAAI;CAqDjB"}
+{"version":3,"file":"job-scheduler.d.ts","sourceRoot":"","sources":["../src/job-scheduler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,UAAU,EAAoC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAclD;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAa;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAQ;IAClE,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,kBAAkB,CAAqC;IAC/D,OAAO,CAAC,iBAAiB,CAAqC;IAC9D,OAAO,CAAC,iBAAiB,CAA6C;IACtE,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,aAAa,CAAC,CAAmC;IACzD,OAAO,CAAC,kBAAkB,CAAwB;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAErC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC;IAcrH;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;IAoDlD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IAInC;;;;OAIG;IACH,QAAQ,IAAI,GAAG,EAAE;IAIjB;;OAEG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IA0EtC;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAiNlB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,mBAAmB;IA4B3B,OAAO,CAAC,mBAAmB;IAuD3B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,4BAA4B;IA0BpC,OAAO,CAAC,cAAc;IAKtB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,yBAAyB;IAIjC;;OAEG;IACH,OAAO,CAAC,WAAW;IAsCnB,OAAO,CAAC,gBAAgB;IAYxB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,MAAM,GAAG,IAAI;IAS5D,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoB5E,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,cAAc,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAQ7E,YAAY,IAAI;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IAqBrD;;OAEG;IACH,QAAQ,IAAI,IAAI;CAqDjB"}

package/dist/job-scheduler.js

@@ -224,24 +224,33 @@ export class JobScheduler {
             // directory so the API does not accidentally reserve the final result path.
             KASEKI_LOG_DIR: this.config.resultsDir,
             KASEKI_TASK_MODE: job.request.taskMode || this.config.defaultTaskMode,
-            ...(job.request.publishMode ? { KASEKI_PUBLISH_MODE: job.request.publishMode } : {}),
+            KASEKI_PUBLISH_MODE: job.request.publishMode || 'draft_pr',
             KASEKI_MAX_DIFF_BYTES: String(job.request.maxDiffBytes || this.config.maxDiffBytes),
             KASEKI_AGENT_TIMEOUT_SECONDS: String(effectiveTimeoutSeconds),
         };
         this.populateGitHubAppEnv(env);
+        const validationCommands = job.request.validationCommands ?? job.request.validation?.commands;
+        const startupCheckMode = job.request.startupCheckMode || (job.request.startupCheck && validationCommands ? 'baseline-validation' : 'boot');
         if (job.request.startupCheck) {
             env.KASEKI_DRY_RUN = '1';
             env.KASEKI_TASK_MODE = 'inspect';
-            env.KASEKI_VALIDATION_COMMANDS = 'none';
+            env.KASEKI_STARTUP_CHECK_MODE = startupCheckMode;
+            if (startupCheckMode === 'baseline-validation') {
+                env.KASEKI_BASELINE_VALIDATION_DRY_RUN = '1';
+            }
+            else {
+                env.KASEKI_VALIDATION_COMMANDS = 'none';
+            }
             env.TASK_PROMPT =
                 job.request.taskPrompt ||
-                    'Run Kaseki startup checks only. Verify container boot and dependencies, then exit without agent work.';
+                    (startupCheckMode === 'baseline-validation'
+                        ? 'Run Kaseki baseline validation startup checks only. Clone the repo, install dependencies, run pre-agent validation, then exit without Pi agent work.'
+                        : 'Run Kaseki startup checks only. Verify container boot and dependencies, then exit without agent work.');
         }
         const changedFilesAllowlist = job.request.changedFilesAllowlist ?? job.request.allowlist?.include;
         if (changedFilesAllowlist) {
             env.KASEKI_CHANGED_FILES_ALLOWLIST = changedFilesAllowlist.join(' ');
         }
-        const validationCommands = job.request.validationCommands ?? job.request.validation?.commands;
         if (validationCommands) {
             env.KASEKI_VALIDATION_COMMANDS = validationCommands.join(';');
         }