@dev-mainsequence/codex-plugin 0.0.0-stage → 0.4.2

package/dist/vendor/devtools/shared/devcontainerJsonc.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateDevcontainerJsonc = updateDevcontainerJsonc;
+const models_1 = require("./models.js");
+/** A small JSONC reader for targeted devcontainer edits. No evaluation or runtime dependency. */
+function readObject(text) {
+    let at = text.charCodeAt(0) === 0xfeff ? 1 : 0;
+    const fail = () => { throw new models_1.ToolingError('INVALID_REQUEST', 'The existing devcontainer configuration is not a supported JSONC object. No file was changed.'); };
+    function trivia() {
+        for (;;) {
+            while (/[\t\r\n ]/.test(text[at] ?? '\0'))
+                at++;
+            if (text.startsWith('//', at)) {
+                while (at < text.length && text[at] !== '\n')
+                    at++;
+            }
+            else if (text.startsWith('/*', at)) {
+                const end = text.indexOf('*/', at + 2);
+                if (end < 0)
+                    fail();
+                at = end + 2;
+            }
+            else
+                return;
+        }
+    }
+    function string() {
+        if (text[at] !== '"')
+            return fail();
+        const start = at++;
+        while (at < text.length) {
+            const char = text[at++];
+            if (char === '\\') {
+                at++;
+                continue;
+            }
+            if (char === '"') {
+                try {
+                    return JSON.parse(text.slice(start, at));
+                }
+                catch {
+                    return fail();
+                }
+            }
+        }
+        return fail();
+    }
+    function node(depth) {
+        if (depth > 100)
+            return fail();
+        trivia();
+        const start = at;
+        if (text[at] === '{') {
+            at++;
+            trivia();
+            const value = Object.create(null);
+            const properties = [];
+            let trailingComma = false;
+            while (text[at] !== '}') {
+                const key = string();
+                trivia();
+                if (text[at++] !== ':' || Object.hasOwn(value, key))
+                    return fail();
+                const child = node(depth + 1);
+                value[key] = child.value;
+                properties.push({ key, value: child });
+                trivia();
+                if (text[at] !== ',')
+                    break;
+                at++;
+                trivia();
+                trailingComma = text[at] === '}';
+            }
+            if (text[at++] !== '}')
+                return fail();
+            return { start, end: at, value, properties, trailingComma };
+        }
+        if (text[at] === '[') {
+            at++;
+            trivia();
+            const value = [];
+            while (text[at] !== ']') {
+                value.push(node(depth + 1).value);
+                trivia();
+                if (text[at] !== ',')
+                    break;
+                at++;
+                trivia();
+            }
+            if (text[at++] !== ']')
+                return fail();
+            return { start, end: at, value };
+        }
+        if (text[at] === '"')
+            return { start, value: string(), end: at };
+        for (const [literal, value] of [['true', true], ['false', false], ['null', null]]) {
+            if (text.startsWith(literal, at)) {
+                at += literal.length;
+                return { start, end: at, value };
+            }
+        }
+        const number = text.slice(at).match(/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/);
+        if (!number || !Number.isFinite(Number(number[0])))
+            return fail();
+        at += number[0].length;
+        return { start, end: at, value: Number(number[0]) };
+    }
+    const result = node(0);
+    trivia();
+    if (at !== text.length || !result.properties)
+        return fail();
+    return result;
+}
+/** Keeps every existing comment and unrelated value byte-for-byte; only edits owned fields. */
+function updateDevcontainerJsonc(source, image) {
+    const text = source || '{}\n';
+    const root = readObject(text);
+    const object = root.value;
+    if (object.build !== undefined || object.dockerComposeFile !== undefined) {
+        throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This devcontainer uses a build or Compose definition. An image-based rewrite would change its behavior, so the existing configuration was preserved.');
+    }
+    const desired = { image };
+    if (object.workspaceFolder == null || object.workspaceFolder === '')
+        desired.workspaceFolder = '/app';
+    if (object.workspaceMount == null || object.workspaceMount === '')
+        desired.workspaceMount = 'source=${localWorkspaceFolder},target=/app,type=bind,consistency=cached';
+    const edits = [];
+    const additions = [];
+    for (const [key, value] of Object.entries(desired)) {
+        const current = root.properties.find(property => property.key === key);
+        if (current) {
+            if (current.value.value !== value)
+                edits.push({ start: current.value.start, end: current.value.end, value: JSON.stringify(value) });
+        }
+        else
+            additions.push(`${JSON.stringify(key)}: ${JSON.stringify(value)}`);
+    }
+    if (additions.length) {
+        const newline = text.includes('\r\n') ? '\r\n' : '\n';
+        const indentation = text.match(/(?:\r?\n)([\t ]+)"/)?.[1] ?? '  ';
+        const last = root.properties.at(-1);
+        const needsComma = Boolean(last && !root.trailingComma);
+        const adjacent = last?.value.end === root.end - 1;
+        if (needsComma && !adjacent)
+            edits.push({ start: last.value.end, end: last.value.end, value: ',' });
+        edits.push({ start: root.end - 1, end: root.end - 1, value: `${needsComma && adjacent ? ',' : ''}${newline}${indentation}${additions.join(`,${newline}${indentation}`)}${newline}` });
+    }
+    let result = text;
+    for (const edit of edits.sort((a, b) => b.start - a.start))
+        result = result.slice(0, edit.start) + edit.value + result.slice(edit.end);
+    readObject(result);
+    return result;
+}

package/dist/vendor/devtools/shared/envfile.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasProjectCredentials = hasProjectCredentials;
+exports.renderMachineEnv = renderMachineEnv;
+exports.writeMachineEnv = writeMachineEnv;
+// Machine-mode extraction of VS Code envfile.ts. No token projection or private fallback.
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const models_1 = require("./models.js");
+const repositories_1 = require("./repositories.js");
+const session_1 = require("./session.js");
+const RETIRED = new Set(['MAINSEQUENCE_ACCESS_TOKEN', 'MAINSEQUENCE_REFRESH_TOKEN', 'MAINSEQUENCE_RUNTIME_CREDENTIAL_ID', 'MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET', 'MAINSEQUENCE_TOKEN']);
+// The block the VS Code extension owns in a project `.env`. In machine mode it holds the endpoint
+// only; the extension (0.1.45 and later) writes the same block, so both tools leave the same file.
+const MANAGED_START = '# BEGIN MAINSEQUENCE AUTH (managed by VS Code)';
+const MANAGED_END = '# END MAINSEQUENCE AUTH';
+// Every variable the extension manages in that file. They move into the block or, with no
+// credential belonging in the file, are dropped.
+const MANAGED = new Set([
+    ...RETIRED,
+    'MAINSEQUENCE_ENDPOINT',
+    'MAIN_SEQUENCE_PROJECT_UID',
+    'MAIN_SEQUENCE_PROJECT_BRANCH_UID',
+    'MAINSEQUENCE_REPOSITORY_BRANCH',
+    'MAIN_SEQUENCE_ORGANIZATION_PROJECT_ENVIRONMENT_UID',
+    'MAIN_SEQUENCE_PROJECT_ID'
+]);
+function hasProjectCredentials(env) {
+    return [...RETIRED].some(key => key in env) || env.MAINSEQUENCE_AUTH_MODE === 'runtime_credential';
+}
+/**
+ * The project `.env` in machine mode: every unrelated line as it was, no credential, and the
+ * endpoint in the extension's block at the end, exactly as the extension writes it.
+ */
+function renderMachineEnv(text, backend) {
+    let inside = false;
+    const lines = text.replace(/\r/g, '').split('\n').filter(line => {
+        if (/^# BEGIN MAINSEQUENCE AUTH/.test(line)) {
+            inside = true;
+            return false;
+        }
+        if (/^# END MAINSEQUENCE AUTH/.test(line)) {
+            inside = false;
+            return false;
+        }
+        if (inside)
+            return false;
+        const assignment = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (!assignment)
+            return true;
+        if (MANAGED.has(assignment[1]))
+            return false;
+        return !(assignment[1] === 'MAINSEQUENCE_AUTH_MODE' && /=\s*["']?runtime_credential["']?\s*(?:#.*)?$/.test(line));
+    });
+    while (lines.at(-1) === '')
+        lines.pop();
+    return [...lines, ...(lines.length ? [''] : []), MANAGED_START, `MAINSEQUENCE_ENDPOINT=${(0, session_1.requireBackend)(backend)}`, MANAGED_END, ''].join('\n');
+}
+/**
+ * Leave `root/.env` in its machine-mode form. A file that already has it is not written again:
+ * an editor holding the file with unsaved changes would then refuse to save over a newer copy.
+ */
+async function writeMachineEnv(host, root, backend) {
+    const envPath = path.join(root, '.env');
+    const stat = await fs.lstat(envPath).catch((error) => { if (error.code !== 'ENOENT')
+        throw error; return null; });
+    if (stat && (!stat.isFile() || stat.isSymbolicLink()))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Refusing to replace a non-regular project .env.');
+    const tracked = await host.runProcess({ executable: 'git', args: ['ls-files', '--error-unmatch', '--', '.env'], cwd: root, timeoutMs: 5000 });
+    if (tracked.exitCode === 0)
+        throw new models_1.ToolingError('INVALID_REQUEST', 'The project .env is tracked by Git. Untrack it before cleanup.');
+    if (tracked.exitCode !== 1)
+        throw new models_1.ToolingError('INVALID_GIT_CONTEXT', 'Could not check whether .env is tracked by Git.');
+    const original = stat ? await fs.readFile(envPath, 'utf8') : '';
+    const rendered = renderMachineEnv(original, backend);
+    if (stat && original === rendered)
+        return;
+    const ignore = await host.runProcess({ executable: 'git', args: ['check-ignore', '-q', '--', '.env'], cwd: root, timeoutMs: 5000 });
+    if (ignore.exitCode !== 0) {
+        const raw = await (0, repositories_1.git)(host, root, ['rev-parse', '--git-path', 'info/exclude']);
+        const exclude = path.resolve(root, raw);
+        await fs.mkdir(path.dirname(exclude), { recursive: true });
+        const current = await fs.readFile(exclude, 'utf8').catch(() => '');
+        await fs.appendFile(exclude, `${current && !current.endsWith('\n') ? '\n' : ''}/.env\n`);
+    }
+    const temporary = `${envPath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    try {
+        await fs.writeFile(temporary, rendered, { flag: 'wx', mode: 0o600 });
+        await fs.rename(temporary, envPath);
+    }
+    finally {
+        await fs.rm(temporary, { force: true });
+    }
+}

package/dist/vendor/devtools/shared/environments.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listEnvironments = listEnvironments;
+const models_1 = require("./models.js");
+const session_1 = require("./session.js");
+/** One bounded directory reader for all hosts and domain clients. No settings writes. */
+async function listEnvironments(session, inputBackend, signal) {
+    const backend = (0, session_1.requireBackend)(inputBackend), items = [], seen = new Set();
+    let expectedCount;
+    for (let offset = 0;;) {
+        signal?.throwIfAborted();
+        const page = await session.request(backend, 'GET', `/api/v1/organization-environments/?limit=100&offset=${offset}`);
+        signal?.throwIfAborted();
+        const rows = Array.isArray(page) ? page : page?.results;
+        const count = Array.isArray(page) ? page.length : page?.count;
+        if (!Array.isArray(rows) || !Number.isSafeInteger(count) || count < 0 || count > 10_000 || offset + rows.length > count
+            || (expectedCount !== undefined && expectedCount !== count) || (offset > 0 && Array.isArray(page))) {
+            throw new models_1.ToolingError('API_ERROR', 'The environment pagination is invalid or changed. Refresh the directory.');
+        }
+        expectedCount = count;
+        for (const row of rows) {
+            if (typeof row?.uid !== 'string' || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(row.uid)
+                || typeof row.name !== 'string' || !row.name.trim() || /[\r\n\0]/.test(row.name)) {
+                throw new models_1.ToolingError('API_ERROR', 'The backend returned an invalid organization environment.');
+            }
+            const uid = row.uid.toLowerCase();
+            if (seen.has(uid))
+                throw new models_1.ToolingError('API_ERROR', 'Environment pagination returned duplicate rows.');
+            seen.add(uid);
+            items.push({ uid, name: row.name.trim(), isProduction: row.is_production === true });
+        }
+        offset += rows.length;
+        if (offset === count)
+            return items;
+        if (!rows.length)
+            throw new models_1.ToolingError('API_ERROR', 'Environment pagination stopped before completion.');
+    }
+}

package/dist/vendor/devtools/shared/hostSession.js

@@ -0,0 +1,324 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostAuthSession = void 0;
+exports.authSecretKey = authSecretKey;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const config_1 = require("./config.js");
+const machineSession_1 = require("./machineSession.js");
+const SECRET_PREFIX = 'mainsequence.vscode.auth.v1';
+const PROJECTIONS_KEY = 'mainsequence.auth.environmentProjections.v1';
+const MACHINE_SESSION_AUTH_MODE = 'cli_browser';
+// How long a session read from the machine's store is reused before the store is read again.
+// Reading runs a program of the system, and the panel asks for the session many times in a row.
+const MACHINE_SESSION_REUSE_MS = 5000;
+/**
+ * The signed-in session of each backend.
+ *
+ * With a credential store of the operating system (`machineStore`), the session is the machine
+ * session the Main Sequence CLIs read and write: a login here serves them, and a login with a CLI
+ * serves the extension. Repository `.env` files then name the backend and hold no token. Without
+ * such a store the session stays in VS Code SecretStorage and its tokens are written to the
+ * registered repositories' `.env`, as before.
+ */
+class HostAuthSession {
+    secrets;
+    state;
+    now;
+    policy;
+    refreshes = new Map();
+    machineReads = new Map();
+    machineStore;
+    constructor(secrets, state, machineStore = null, now = Date.now, policy = {}) {
+        this.secrets = secrets;
+        this.state = state;
+        this.now = now;
+        this.policy = policy;
+        this.machineStore = machineStore;
+    }
+    /** Private host bridge. Never place these credentials in UI state, logs or action results. */
+    persistence() {
+        const owner = this;
+        return {
+            get name() { return owner.machineStore?.name ?? 'VS Code SecretStorage'; },
+            get mode() { return owner.usesMachineSession() ? 'machine' : 'host'; },
+            async read(backend) { const value = await owner.get(backend, true); return value.access || value.refresh ? value : null; },
+            async write(backend, value) { await owner.save(value, backend); },
+            async remove(backend) { await owner.clear(backend); }
+        };
+    }
+    /** Whether the session lives in the machine's credential store, shared with the CLIs. */
+    usesMachineSession() {
+        return this.machineStore !== null;
+    }
+    async initialize() {
+        const backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app');
+        this.checkMachineStore(backend);
+        this.policy.setTokenProjection?.(!this.machineStore);
+        if (this.machineStore) {
+            // Moves a session this extension saved before it used the machine's store.
+            await this.get(backend);
+            await this.removeProjectedTokens();
+        }
+        const legacy = normalizeTokens((this.policy.readLegacyTokens?.() ?? {}));
+        if (!legacy.access || !legacy.refresh)
+            return;
+        const existing = await this.get(backend);
+        if (!existing.access || !existing.refresh)
+            await this.save(legacy, backend);
+        if (!(this.policy.deleteLegacyTokens?.() ?? true))
+            throw new Error('Could not remove the legacy plaintext token store.');
+    }
+    async get(backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app'), fresh = false) {
+        if (!this.machineStore)
+            return this.storedInSecrets(backend);
+        const normalizedBackend = normalizeRequiredBackend(backend);
+        const reused = this.machineReads.get(normalizedBackend);
+        if (!fresh && reused && reused.until > this.now())
+            return reused.tokens;
+        return this.readMachineSession(normalizedBackend);
+    }
+    async save(tokens, backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app')) {
+        const normalizedBackend = normalizeRequiredBackend(backend);
+        const normalized = normalizeTokens(tokens);
+        if (!normalized.access || !normalized.refresh) {
+            throw new Error('Both access and refresh tokens are required.');
+        }
+        if (this.machineStore) {
+            (0, machineSession_1.saveSession)(this.machineStore, normalizedBackend, normalized);
+            await this.secrets.delete(authSecretKey(normalizedBackend));
+            return this.remember(normalizedBackend, { ...normalized, authMode: MACHINE_SESSION_AUTH_MODE });
+        }
+        await this.secrets.store(authSecretKey(normalizedBackend), JSON.stringify(normalized));
+        await this.synchronizeProjections(normalizedBackend, normalized);
+        return normalized;
+    }
+    async refresh(exchange, backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app')) {
+        const normalizedBackend = normalizeRequiredBackend(backend);
+        const key = authSecretKey(normalizedBackend);
+        const active = this.refreshes.get(key);
+        if (active)
+            return active;
+        const operation = (async () => {
+            // Read from the store itself: a CLI may have renewed or replaced the session meanwhile.
+            const current = this.machineStore
+                ? await this.readMachineSession(normalizedBackend)
+                : await this.get(normalizedBackend);
+            if (!current.refresh)
+                throw new Error('Not logged in.');
+            const refreshed = await exchange(current.refresh);
+            const access = String(refreshed.access || '').trim();
+            if (!access)
+                throw new Error('Refresh succeeded but no access token was returned.');
+            return this.save({
+                ...current,
+                access,
+                refresh: String(refreshed.refresh || '').trim() || current.refresh
+            }, normalizedBackend);
+        })();
+        this.refreshes.set(key, operation);
+        try {
+            return await operation;
+        }
+        finally {
+            if (this.refreshes.get(key) === operation)
+                this.refreshes.delete(key);
+        }
+    }
+    async environment(backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app')) {
+        const normalizedBackend = normalizeRequiredBackend(backend);
+        const tokens = await this.get(normalizedBackend);
+        if (!tokens.access || !tokens.refresh)
+            throw new Error('Sign in before running this operation.');
+        return {
+            MAINSEQUENCE_ENDPOINT: normalizedBackend,
+            MAINSEQUENCE_ACCESS_TOKEN: tokens.access,
+            MAINSEQUENCE_REFRESH_TOKEN: tokens.refresh
+        };
+    }
+    async registerProjection(repositoryPath, backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app')) {
+        const normalizedBackend = normalizeRequiredBackend(backend);
+        const projections = this.projections().filter(item => item.repositoryPath !== repositoryPath);
+        projections.push({ repositoryPath, backend: normalizedBackend });
+        await this.state.update(PROJECTIONS_KEY, projections);
+    }
+    async clear(backend = (this.policy.backend?.() ?? process.env.MAINSEQUENCE_ENDPOINT ?? 'https://api.main-sequence.app')) {
+        const normalizedBackend = normalizeRequiredBackend(backend);
+        await this.secrets.delete(authSecretKey(normalizedBackend));
+        if (this.machineStore) {
+            this.machineReads.delete(normalizedBackend);
+            // Removes an entry it cannot read as well: deleting needs no consent.
+            (0, machineSession_1.clearSession)(this.machineStore, normalizedBackend);
+        }
+        const retained = [];
+        for (const projection of this.projections()) {
+            if (projection.backend !== normalizedBackend) {
+                retained.push(projection);
+                continue;
+            }
+            try {
+                // A repository keeps naming its backend when the session lives in the machine's store.
+                if (this.machineStore)
+                    this.policy.writeProjection?.(projection.repositoryPath, '', '', normalizedBackend);
+                else
+                    this.policy.removeProjection?.(projection.repositoryPath);
+            }
+            catch {
+                retained.push(projection);
+            }
+        }
+        await this.state.update(PROJECTIONS_KEY, retained);
+        clearCanonicalProcessEnvironment(normalizedBackend);
+        if (!(this.policy.deleteLegacyTokens?.() ?? true))
+            throw new Error('Could not remove the legacy plaintext token store.');
+    }
+    /** A machine store that cannot be reached at all is not used: the extension works as before. */
+    checkMachineStore(backend) {
+        if (!this.machineStore)
+            return;
+        try {
+            (0, machineSession_1.readSession)(this.machineStore, backend);
+        }
+        catch (error) {
+            // An entry another program wrote is replaced by the next login; the store itself works.
+            if (!(error instanceof machineSession_1.ForeignEntryError))
+                this.machineStore = null;
+        }
+    }
+    async storedInSecrets(backend) {
+        const raw = await this.secrets.get(authSecretKey(backend));
+        if (!raw)
+            return emptyTokens();
+        try {
+            return normalizeTokens(JSON.parse(raw));
+        }
+        catch {
+            return emptyTokens();
+        }
+    }
+    remember(backend, tokens) {
+        this.machineReads.set(backend, { tokens, until: this.now() + MACHINE_SESSION_REUSE_MS });
+        return tokens;
+    }
+    async readMachineSession(backend) {
+        const store = this.machineStore;
+        try {
+            const session = (0, machineSession_1.readSession)(store, backend);
+            if (session)
+                return this.remember(backend, { ...session, authMode: MACHINE_SESSION_AUTH_MODE });
+        }
+        catch {
+            // Unreadable is not signed in: a login replaces the entry.
+        }
+        // A session this extension saved before it used the machine's store moves there once.
+        const earlier = await this.storedInSecrets(backend);
+        if (earlier.access && earlier.refresh) {
+            try {
+                (0, machineSession_1.saveSession)(store, backend, earlier);
+                await this.secrets.delete(authSecretKey(backend));
+                return this.remember(backend, { ...earlier, authMode: MACHINE_SESSION_AUTH_MODE });
+            }
+            catch {
+                return earlier;
+            }
+        }
+        return this.remember(backend, emptyTokens());
+    }
+    /** Once: repositories this extension wrote tokens into keep the backend and lose the tokens. */
+    async removeProjectedTokens() {
+        const retained = [];
+        for (const projection of this.projections()) {
+            // A repository that was deleted has nothing left to clean.
+            if (!fs.existsSync(projection.repositoryPath))
+                continue;
+            try {
+                this.policy.writeProjection?.(projection.repositoryPath, '', '', projection.backend);
+            }
+            catch {
+                retained.push(projection);
+            }
+        }
+        await this.state.update(PROJECTIONS_KEY, retained);
+    }
+    projections() {
+        const value = this.state.get(PROJECTIONS_KEY, []);
+        if (!Array.isArray(value))
+            return [];
+        return value.filter(item => Boolean(item?.repositoryPath && item?.backend));
+    }
+    async synchronizeProjections(backend, tokens) {
+        for (const projection of this.projections()) {
+            if (projection.backend !== backend)
+                continue;
+            try {
+                this.policy.writeProjection?.(projection.repositoryPath, tokens.access, tokens.refresh, backend);
+            }
+            catch {
+                // A missing or read-only checkout must not invalidate the authenticated session.
+            }
+        }
+    }
+}
+exports.HostAuthSession = HostAuthSession;
+function authSecretKey(backend) {
+    const normalized = normalizeRequiredBackend(backend);
+    const digest = crypto.createHash('sha256').update(normalized, 'utf8').digest('hex').slice(0, 16);
+    return `${SECRET_PREFIX}.${digest}`;
+}
+function normalizeRequiredBackend(backend) {
+    const normalized = (0, config_1.normalizeBackendUrl)(backend);
+    if (!normalized)
+        throw new Error('MainSequence backend URL is required.');
+    return normalized;
+}
+function normalizeTokens(value) {
+    return {
+        username: String(value?.username || ''),
+        access: String(value?.access || ''),
+        refresh: String(value?.refresh || ''),
+        authMode: String(value?.authMode || value?.auth_mode || 'cli_browser')
+    };
+}
+function emptyTokens() {
+    return { username: '', access: '', refresh: '', authMode: 'cli_browser' };
+}
+function clearCanonicalProcessEnvironment(backend) {
+    if ((0, config_1.normalizeBackendUrl)(process.env.MAINSEQUENCE_ENDPOINT) === backend) {
+        delete process.env.MAINSEQUENCE_ENDPOINT;
+        delete process.env.MAINSEQUENCE_ACCESS_TOKEN;
+        delete process.env.MAINSEQUENCE_REFRESH_TOKEN;
+    }
+}