@dev-mainsequence/codex-plugin 0.0.0-stage → 0.3.0

package/dist/vendor/devtools/shared/projects.js

@@ -0,0 +1,390 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DRY_RUN_ACTIONS = void 0;
+exports.projectCli = projectCli;
+exports.projectEnvironment = projectEnvironment;
+exports.projectCapabilities = projectCapabilities;
+exports.npmCommand = npmCommand;
+exports.withProjectLock = withProjectLock;
+exports.runProjectAction = runProjectAction;
+exports.setupRepository = setupRepository;
+// Project-local CLI selection and argv contracts extracted from codeRepositoryCli.ts.
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const models_1 = require("./models.js");
+const repositories_1 = require("./repositories.js");
+const envfile_1 = require("./envfile.js");
+const repositoryIdentity_1 = require("./repositoryIdentity.js");
+const cli_1 = require("./cli.js");
+const session_1 = require("./session.js");
+const pythonSdkStatus_1 = require("./pythonSdkStatus.js");
+async function projectCli(context) {
+    if (!context.projectType)
+        throw new models_1.ToolingError('PROJECT_TYPE_REQUIRED', 'Select --type python or --type vite_react for an ambiguous or unknown project.');
+    const cli = (0, cli_1.resolveCodeRepositoryCli)(context.root, context.projectType);
+    return { executable: cli.executable, prefix: cli.prefixArgs, available: cli.available };
+}
+async function isFile(value) { return fs.stat(value).then(s => s.isFile()).catch(() => false); }
+/** The project actions with a read-only preview. Sync has none. */
+exports.DRY_RUN_ACTIONS = ['update-sdk', 'install-skills'];
+function commandArgs(context, action, dryRun) {
+    const python = context.projectType === 'python';
+    let args;
+    switch (action) {
+        // Sync only refreshes dependency files: Python runs uv lock, uv sync and the locked requirements.txt
+        // export; Node refreshes package-lock.json and runs npm ci. It takes no commit message and runs no
+        // Git command or backend request. The person commits and pushes.
+        case 'sync':
+            args = ['code-repository', 'sync', '--path', '.'];
+            break;
+        case 'sdk-status':
+            if (python)
+                return;
+            args = ['application', 'sdk-status', '--path', '.', '--json'];
+            break;
+        case 'update-sdk':
+            args = [python ? 'code-repository' : 'application', 'update-sdk', '--path', '.'];
+            break;
+        case 'update-agents':
+            if (!python)
+                return;
+            args = ['code-repository', 'update', 'AGENTS.md', '--path', '.'];
+            break;
+        case 'install-skills':
+            if (python)
+                return;
+            args = ['skills', 'install', '--path', '.'];
+            break;
+        default: return;
+    }
+    if (dryRun) {
+        if (!exports.DRY_RUN_ACTIONS.includes(action))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'This action has no read-only dry-run mode.');
+        args.push('--dry-run');
+    }
+    return args;
+}
+/** SDK CLIs from before sync became a dependency refresh still advertise its commit and preview options. */
+function advertisesReleaseSync(help, python) {
+    // The Node CLI prints one usage text for every command; only its sync line describes sync.
+    const text = python ? help : help.split(/\r?\n/).filter(line => line.includes('code-repository sync')).join('\n');
+    return /--dry-run|--message/.test(text);
+}
+async function probe(host, context, action, cli, env, signal) {
+    if (!cli.available)
+        return { action, state: 'unavailable', reason: 'The project-local SDK CLI is missing. Run install in this project.' };
+    const args = commandArgs(context, action);
+    if (!args)
+        return { action, state: 'unsupported', reason: 'This operation is not provided by this project SDK.' };
+    const command = args.slice(0, 2);
+    const help = await host.runProcess({ executable: cli.executable, args: [...cli.prefix, ...(context.projectType === 'python' ? command : []), '--help'], cwd: context.root, env, signal, timeoutMs: 20_000 });
+    if (help.cancelled)
+        throw new models_1.ToolingError('CANCELLED', 'The action was cancelled.');
+    if (help.exitCode !== 0 || !help.stdout.includes('--path') || (context.projectType !== 'python' && !help.stdout.includes(command.join(' ')))) {
+        return { action, state: 'unavailable', reason: 'The installed SDK CLI does not advertise this command. Update the project SDK or fix its environment.' };
+    }
+    // Never run the old sync: it commits, tags and pushes, and fails at a backend route that no longer exists.
+    if (action === 'sync' && advertisesReleaseSync(help.stdout, context.projectType === 'python')) {
+        const required = context.projectType === 'python' ? 'mainsequence 9.0.5' : '@dev-mainsequence/command-center-sdk 0.5.13';
+        return { action, state: 'unavailable', reason: `The installed SDK still has the retired release sync, which commits, tags and pushes. Run update-sdk: sync needs ${required} or later.` };
+    }
+    return { action, state: 'available' };
+}
+/** Scope inherited credentials to their explicit backend, then let the installed SDK read its store. */
+function projectEnvironment(context, inherited) {
+    const env = { ...inherited };
+    const credentialKeys = ['MAINSEQUENCE_ACCESS_TOKEN', 'MAINSEQUENCE_REFRESH_TOKEN', 'MAINSEQUENCE_TOKEN', 'MAINSEQUENCE_RUNTIME_CREDENTIAL_ID', 'MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET'];
+    if (credentialKeys.some(key => env[key])) {
+        if (!env.MAINSEQUENCE_ENDPOINT || (0, session_1.requireBackend)(env.MAINSEQUENCE_ENDPOINT) !== context.backend) {
+            throw new models_1.ToolingError('BACKEND_MISMATCH', 'Inherited process credentials belong to another or unspecified backend.');
+        }
+        if (env.MAINSEQUENCE_TOKEN || env.MAINSEQUENCE_RUNTIME_CREDENTIAL_ID || env.MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET) {
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Unsupported or runtime credentials cannot be used for developer project actions.');
+        }
+    }
+    env.MAINSEQUENCE_ENDPOINT = context.backend;
+    return env;
+}
+async function projectCapabilities(host, context, env, signal, allowMcpSkills = false) {
+    const actions = ['sync', 'sdk-status', 'update-sdk', 'update-agents', 'install-skills', 'skills-sync', 'install', 'env-cleanup', 'open-folder', 'signed-terminal'];
+    if (!context.projectType)
+        return actions.map(action => ({ action, state: 'unavailable', reason: 'Project type is ambiguous. Select --type.' }));
+    const cli = await projectCli(context);
+    const scoped = projectEnvironment(context, env);
+    const results = [];
+    for (const action of actions) {
+        if (action === 'skills-sync')
+            results.push({ action, state: allowMcpSkills ? (cli.available ? 'available' : 'unavailable') : 'unsupported',
+                reason: !allowMcpSkills ? 'Backend-owned skills currently require MainSequence MCP.' : !cli.available ? 'Install the project SDK before synchronizing its skills.' : undefined });
+        else if (action === 'open-folder' || action === 'signed-terminal')
+            results.push({ action, state: (action === 'open-folder' ? host.openFolder : host.openTerminal) ? 'available' : 'unsupported', reason: (action === 'open-folder' ? host.openFolder : host.openTerminal) ? undefined : 'This host has no native folder/terminal capability.' });
+        else if (action === 'env-cleanup')
+            results.push({ action, state: 'available' });
+        else if (action === 'install') {
+            const command = context.projectType === 'python' ? { executable: 'uv', args: ['--version'] } : npmCommand('--version');
+            const result = await host.runProcess({ ...command, cwd: context.root, env: scoped, signal, timeoutMs: 10_000 });
+            if (result.cancelled)
+                throw new models_1.ToolingError('CANCELLED', 'The action was cancelled.');
+            results.push({ action, state: result.exitCode === 0 ? 'available' : 'unavailable', reason: result.exitCode === 0 ? undefined : `${context.projectType === 'python' ? 'uv' : 'npm'} is required.` });
+        }
+        else if (action === 'sdk-status' && context.projectType === 'python') {
+            results.push({ action, state: await isFile(pythonExecutable(context.root)) ? 'available' : 'unavailable', reason: await isFile(pythonExecutable(context.root)) ? undefined : 'Build the project .venv first.' });
+        }
+        else
+            results.push(await probe(host, context, action, cli, scoped, signal));
+    }
+    return results;
+}
+function npmCommand(command, platform = process.platform) {
+    // Windows npm.cmd needs cmd.exe. This is a fixed command, with no user arguments or secrets.
+    return platform === 'win32' ? { executable: 'cmd.exe', args: ['/d', '/s', '/c', `npm ${command}`] } : { executable: 'npm', args: [command] };
+}
+function pythonExecutable(root) { return path.join(root, '.venv', process.platform === 'win32' ? 'Scripts' : 'bin', process.platform === 'win32' ? 'python.exe' : 'python'); }
+async function execute(host, spec, state, mutating) {
+    spec.signal?.throwIfAborted();
+    if (mutating)
+        state.mutationStarted = true;
+    const result = await host.runProcess(spec);
+    if (result.cancelled)
+        throw new models_1.ToolingError('CANCELLED', 'The action was cancelled; inspect the project before retrying.');
+    if (result.timedOut)
+        throw new models_1.ToolingError('PROCESS_TIMEOUT', 'The project command timed out; inspect the project before retrying.');
+    if (result.unavailable)
+        throw new models_1.ToolingError('MISSING_PREREQUISITE', 'The required project executable could not be started.');
+    if (result.exitCode !== 0)
+        throw new models_1.ToolingError('PROCESS_FAILED', `The project command failed (exit ${result.exitCode ?? 'unknown'}). No automatic retry or rollback was attempted.`);
+    return result.stdout;
+}
+async function withProjectLock(commonDir, work) {
+    return withFileLock(path.join(commonDir, 'mainsequence-devtools.lock'), work);
+}
+async function withFileLock(lock, work) {
+    let handle;
+    try {
+        handle = await fs.open(lock, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            throw new models_1.ToolingError('PROJECT_BUSY', `Another tooling action holds this repository lock: ${lock}. After an interrupted run, verify no action is running before removing it.`);
+        throw new models_1.ToolingError('INVALID_GIT_CONTEXT', 'Could not acquire the repository action lock.');
+    }
+    try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, id: crypto.randomUUID() }));
+        return await work();
+    }
+    finally {
+        await handle.close();
+        await fs.unlink(lock);
+    }
+}
+async function runProjectAction(host, session, context, action, options) {
+    const env = projectEnvironment(context, options.env);
+    if (action === 'skills-sync') {
+        if (!options.allowMcpSkills)
+            throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'Backend-owned skills require MainSequence MCP. This runner does not invoke it.');
+        if (!context.projectType)
+            throw new models_1.ToolingError('PROJECT_TYPE_REQUIRED', 'A supported project type is required.');
+        const cli = (0, cli_1.resolveCodeRepositoryCli)(context.root, context.projectType);
+        if (!cli.available)
+            throw new models_1.ToolingError('MISSING_PREREQUISITE', cli.missingMessage);
+        await session.status(context.backend, true);
+        for (const invocation of (0, cli_1.buildCodeRepositoryCliInvocations)(cli, 'skills')) {
+            await execute(host, { executable: invocation.executable, args: invocation.args, cwd: context.root, env, signal: options.signal }, options.state, true);
+        }
+        return { root: context.root, projectType: context.projectType };
+    }
+    if (action === 'open-folder') {
+        if (!host.openFolder)
+            throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This host does not expose a native folder opener. The project path is available through status.');
+        await host.openFolder(context.root);
+        return { root: context.root };
+    }
+    if (action === 'signed-terminal') {
+        if (!host.openTerminal)
+            throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This host does not expose a native terminal opener.');
+        await session.status(context.backend, true);
+        const { keyPath, pubPath } = (0, repositoryIdentity_1.repositorySshKeyPaths)(context.origin);
+        if (!(0, repositoryIdentity_1.repositorySshKeyIdentity)(context.origin).usesSsh || !(await isFile(keyPath)) || !(await isFile(pubPath)))
+            throw new models_1.ToolingError('MISSING_PREREQUISITE', 'A repository-specific SSH keypair is required. Set up this repository first.');
+        env.GIT_SSH_COMMAND = `ssh -i ${quoteSshPath(keyPath)} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`;
+        // Store-aware SDKs acquire access themselves. Never return or print a token-bearing shell command.
+        await host.openTerminal({ root: context.root, env });
+        return { root: context.root };
+    }
+    if (action === 'env-cleanup') {
+        options.state.mutationStarted = true;
+        await (0, envfile_1.writeMachineEnv)(host, context.root, context.backend);
+        return { root: context.root, endpointOnly: true };
+    }
+    if (!context.projectType)
+        throw new models_1.ToolingError('PROJECT_TYPE_REQUIRED', 'Select --type python or --type vite_react.');
+    if (action === 'install') {
+        if (options.dryRun)
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Install has no dry-run mode.');
+        host.progress?.(context.projectType === 'python' ? 'Building the project environment with uv sync.' : 'Installing locked npm dependencies.');
+        const command = context.projectType === 'python' ? { executable: 'uv', args: ['sync'] } : npmCommand('ci');
+        await execute(host, { ...command, cwd: context.root, env, signal: options.signal }, options.state, true);
+        return { root: context.root, projectType: context.projectType };
+    }
+    if (action === 'sdk-status' && context.projectType === 'python') {
+        const output = await execute(host, { executable: pythonExecutable(context.root), args: ['-I', '-c', "import importlib.metadata as m, json\ntry: v = m.version('mainsequence')\nexcept m.PackageNotFoundError: v = None\nprint(json.dumps({'installed': v}))"], cwd: context.root, env, signal: options.signal, timeoutMs: 10_000 }, options.state, false);
+        let installed;
+        try {
+            installed = JSON.parse(output).installed;
+            if (installed !== null && typeof installed !== 'string')
+                throw new Error();
+        }
+        catch {
+            throw new models_1.ToolingError('PROCESS_FAILED', 'The Python interpreter did not return valid distribution metadata.');
+        }
+        return (0, pythonSdkStatus_1.readPythonSdkStatus)(installed, options.fetch, options.signal);
+    }
+    const cli = await projectCli(context);
+    const capability = await probe(host, context, action, cli, env, options.signal);
+    if (capability.state !== 'available')
+        throw new models_1.ToolingError(capability.state === 'unsupported' ? 'UNSUPPORTED_ACTION' : 'MISSING_PREREQUISITE', capability.reason);
+    const args = commandArgs(context, action, options.dryRun);
+    if (options.dryRun) {
+        const help = await host.runProcess({ executable: cli.executable, args: [...cli.prefix, ...(context.projectType === 'python' ? args.slice(0, 2) : []), '--help'], cwd: context.root, env, signal: options.signal, timeoutMs: 20_000 });
+        if (!help.stdout.includes('--dry-run'))
+            throw new models_1.ToolingError('MISSING_PREREQUISITE', 'The installed CLI does not advertise dry-run support.');
+    }
+    // Old .env credentials would change the SDK's identity. Require explicit cleanup first.
+    if (!options.allowLegacyProjectCredentials && (0, envfile_1.hasProjectCredentials)(await (0, repositories_1.readProjectEnv)(context.root)))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'The project .env contains retired credentials. Run env-cleanup before dispatching SDK commands.');
+    host.progress?.(`Running ${action} with the project-installed ${context.projectType === 'python' ? 'Python' : 'Node'} SDK CLI.`);
+    const output = await execute(host, { executable: cli.executable, args: [...cli.prefix, ...args], cwd: context.root, env, signal: options.signal }, options.state, action !== 'sdk-status' && !options.dryRun);
+    if (action === 'sdk-status') {
+        let report;
+        try {
+            report = JSON.parse(output);
+        }
+        catch {
+            throw new models_1.ToolingError('PROCESS_FAILED', 'The SDK status command returned invalid JSON.');
+        }
+        const result = {};
+        for (const key of ['package', 'declared', 'locked', 'installed', 'wanted', 'latest', 'status', 'dependencyType', 'updateAvailable', 'updateSupported', 'hint']) {
+            if (report[key] === null || typeof report[key] === 'string' || typeof report[key] === 'boolean')
+                result[key] = report[key];
+        }
+        return result;
+    }
+    return { root: context.root, projectType: context.projectType, dryRun: Boolean(options.dryRun) };
+}
+function quoteSshPath(value) {
+    if (process.platform === 'win32') {
+        if (/["%\r\n]/.test(value))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'The SSH key path cannot be quoted safely on this platform.');
+        return `"${value}"`;
+    }
+    return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+async function setupRepository(host, session, input, options) {
+    const { repository, binding, orgSlug } = await (0, repositories_1.repositorySetupInfo)(session, input.backend, input.repositoryUid, input.branch);
+    const type = repository.code_repository_type;
+    if (type !== 'python' && type !== 'vite_react')
+        throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This CodeRepository type is not supported.');
+    const cloneUrl = binding.git_ssh_url;
+    if (!cloneUrl || !(0, repositoryIdentity_1.repositorySshKeyIdentity)(cloneUrl).usesSsh)
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Repository setup requires the existing SSH GitHub binding.');
+    const destination = options.destination ? path.resolve(options.destination) : (0, repositories_1.canonicalRepositoryDir)(input.baseDir, orgSlug, repository.uid, repository.code_repository_name);
+    const relative = path.relative(path.resolve(input.baseDir), destination);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'The checkout must be inside its selected base folder.');
+    const env = projectEnvironment({ backend: input.backend }, options.env);
+    // No replacement of existing folders. A failed clone is retained for inspection.
+    if (await fs.lstat(destination).then(() => true).catch((error) => { if (error.code === 'ENOENT')
+        return false; throw error; })) {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'The canonical checkout folder already exists. Select it with --path.');
+    }
+    options.signal?.throwIfAborted();
+    options.state.mutationStarted = true;
+    await fs.mkdir(path.resolve(input.baseDir), { recursive: true });
+    const baseReal = await fs.realpath(path.resolve(input.baseDir));
+    // Reject existing symlink components before creating folders or other setup effects.
+    const parents = [];
+    for (let current = path.dirname(destination); current !== path.resolve(input.baseDir); current = path.dirname(current))
+        parents.unshift(current);
+    for (const segment of parents) {
+        const stat = await fs.lstat(segment).catch((error) => { if (error.code === 'ENOENT')
+            return null; throw error; });
+        if (stat?.isSymbolicLink() || (stat && !stat.isDirectory()))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'The canonical checkout parent must contain ordinary directories, not symlinks.');
+    }
+    await fs.mkdir(path.dirname(destination), { recursive: true });
+    const parentReal = await fs.realpath(path.dirname(destination));
+    if (!parentReal.startsWith(baseReal + path.sep))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'The canonical checkout parent escapes the base directory through a symlink.');
+    const setupLock = path.join(parentReal, `.${path.basename(destination)}.mainsequence-devtools.lock`);
+    return withFileLock(setupLock, async () => {
+        if (await fs.lstat(destination).then(() => true).catch((error) => { if (error.code === 'ENOENT')
+            return false; throw error; }))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'The canonical checkout folder already exists. Select it with --path.');
+        const { keyPath, pubPath } = (0, repositoryIdentity_1.repositorySshKeyPaths)(cloneUrl);
+        const privateKey = await isFile(keyPath), publicKey = await isFile(pubPath);
+        if (privateKey !== publicKey)
+            throw new models_1.ToolingError('INVALID_REQUEST', 'The repository SSH keypair is incomplete. Repair it before setup.');
+        await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 });
+        if (!privateKey) {
+            await execute(host, { executable: 'ssh-keygen', args: ['-t', 'ed25519', '-C', 'mainsequence@main-sequence.io', '-f', keyPath, '-N', ''], cwd: baseReal, env, signal: options.signal, timeoutMs: 30_000 }, options.state, true);
+        }
+        const key = (await fs.readFile(pubPath, 'utf8')).trim();
+        if (!key || /[\r\n]/.test(key))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'The repository SSH public key is invalid.');
+        // Register only when access with the repository key is denied, matching VS Code setup.
+        env.GIT_SSH_COMMAND = `ssh -i ${quoteSshPath(keyPath)} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`;
+        const check = await host.runProcess({ executable: 'git', args: ['ls-remote', '--exit-code', cloneUrl, 'HEAD'], cwd: path.resolve(input.baseDir), env, signal: options.signal, timeoutMs: 15_000 });
+        if (check.cancelled)
+            throw new models_1.ToolingError('CANCELLED', 'Setup was cancelled.');
+        if (check.exitCode !== 0) {
+            await session.request(input.backend, 'POST', `/api/v1/code-repositories/${encodeURIComponent(repository.uid)}/add-deploy-key/`, { key_title: (0, repositoryIdentity_1.repositorySshKeyName)(cloneUrl), public_key: key });
+            await execute(host, { executable: 'git', args: ['ls-remote', '--exit-code', cloneUrl, 'HEAD'], cwd: path.resolve(input.baseDir), env, signal: options.signal, timeoutMs: 15_000 }, options.state, false);
+        }
+        host.progress?.('Cloning the registered repository branch into its canonical folder.');
+        await execute(host, { executable: 'git', args: ['clone', ...(options.reference ? ['--reference-if-able', options.reference, '--dissociate'] : []), '--branch', input.branch, '--single-branch', '--', cloneUrl, destination], cwd: baseReal, env, signal: options.signal }, options.state, true);
+        const context = await (0, repositories_1.projectContext)(host, destination, input.backend, type, env, options.signal);
+        if (context.repositoryIdentity !== (0, repositoryIdentity_1.repositorySshKeyIdentity)(cloneUrl).identity || context.branch !== input.branch)
+            throw new models_1.ToolingError('INVALID_GIT_CONTEXT', 'The cloned identity or branch does not match the selected repository.');
+        await withProjectLock(context.gitCommonDir, async () => {
+            await (0, repositories_1.git)(host, destination, ['config', 'core.sshCommand', env.GIT_SSH_COMMAND], options.signal);
+            await (0, envfile_1.writeMachineEnv)(host, destination, input.backend);
+            if (input.install)
+                await runProjectAction(host, session, context, 'install', options);
+        });
+        return { root: destination, repositoryUid: repository.uid, projectType: type, endpointOnly: true, dependenciesInstalled: Boolean(input.install) };
+    });
+}

package/dist/vendor/devtools/shared/pythonProjectStatus.js

@@ -0,0 +1,86 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PYTHON_SDK_PROJECT_URL = void 0;
+exports.pythonExecutable = pythonExecutable;
+exports.hasPythonProject = hasPythonProject;
+exports.projectVersion = projectVersion;
+exports.readPythonSdkStatus = readPythonSdkStatus;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+exports.PYTHON_SDK_PROJECT_URL = 'https://raw.githubusercontent.com/mainsequence-sdk/mainsequence-sdk/main/pyproject.toml';
+function pythonExecutable(root) {
+    return process.platform === 'win32'
+        ? path.join(root, '.venv', 'Scripts', 'python.exe')
+        : path.join(root, '.venv', 'bin', 'python');
+}
+function hasPythonProject(root) {
+    return fs.existsSync(path.join(root, 'pyproject.toml')) && !fs.existsSync(path.join(root, 'package.json'));
+}
+function projectVersion(content) {
+    let inProject = false;
+    for (const line of content.split(/\r?\n/)) {
+        if (/^\s*\[/.test(line))
+            inProject = /^\s*\[project\]\s*(?:#.*)?$/.test(line);
+        if (!inProject)
+            continue;
+        const match = line.match(/^\s*version\s*=\s*["']([^"']+)["']\s*(?:#.*)?$/);
+        if (match)
+            return match[1];
+    }
+    throw new Error('The public SDK pyproject.toml has no project version.');
+}
+async function publicProject() {
+    const response = await fetch(exports.PYTHON_SDK_PROJECT_URL, { headers: { Accept: 'text/plain' }, signal: AbortSignal.timeout(10_000) });
+    if (!response.ok)
+        throw new Error('The public SDK version could not be read.');
+    return response.text();
+}
+async function readPythonSdkStatus(root, capture, fetchProject = publicProject) {
+    const latest = projectVersion(await fetchProject());
+    // Import distribution metadata only: do not import the SDK or its auth bootstrap.
+    const code = [
+        'import importlib.metadata as metadata, json, sys',
+        'from packaging.version import Version',
+        'try:',
+        "    local = metadata.version('mainsequence')",
+        'except metadata.PackageNotFoundError:',
+        '    local = None',
+        'latest = sys.argv[1]',
+        "status = 'not_installed' if local is None else ('update_available' if Version(local) < Version(latest) else ('ahead' if Version(local) > Version(latest) else 'current'))",
+        "print(json.dumps(dict(latest=latest, installed=local, status=status, updateAvailable=status == 'update_available', updateSupported=False)))"
+    ].join('\n');
+    return { registryPublicationVerified: false, latestSourceVersion: latest, ...JSON.parse(await capture(pythonExecutable(root), ['-I', '-c', code, latest], root)) };
+}

package/dist/vendor/devtools/shared/pythonSdkStatus.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PYTHON_SDK_PROJECT_URL = void 0;
+exports.readPythonSdkStatus = readPythonSdkStatus;
+// Metadata-only status adapted from VS Code's pythonSdkStatus.ts.
+// main is the stable source; analyzing development never opts projects into prereleases.
+exports.PYTHON_SDK_PROJECT_URL = 'https://raw.githubusercontent.com/mainsequence-sdk/mainsequence-sdk/main/pyproject.toml';
+async function readPythonSdkStatus(installed, fetchProject = fetch, signal) {
+    const base = { package: 'mainsequence', installed, dependencyPolicy: 'project-declared', releaseChannel: 'project-declared', sourceUrl: exports.PYTHON_SDK_PROJECT_URL };
+    try {
+        const response = await fetchProject(exports.PYTHON_SDK_PROJECT_URL, { headers: { Accept: 'text/plain' }, signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000) });
+        if (!response.ok)
+            throw new Error('unavailable');
+        const text = await response.text();
+        const project = text.split(/^\s*\[project\]\s*(?:#.*)?$/m)[1]?.split(/^\s*\[/m)[0];
+        const version = project?.match(/^\s*version\s*=\s*["']([^"']+)["']\s*(?:#.*)?$/m)?.[1];
+        if (!version)
+            throw new Error('invalid source');
+        return { ...base, latestSourceVersion: version, registryPublicationVerified: false,
+            hint: 'This compares installed metadata with the stable source tree. SDK updates preserve the project dependency policy; no prerelease channel is selected.' };
+    }
+    catch {
+        signal?.throwIfAborted();
+        return { ...base, sourceStatus: 'unavailable', hint: 'Installed metadata is available; the stable source version could not be read.' };
+    }
+}