@gh-symphony/cli 0.1.4 → 0.2.2

package/dist/{chunk-EWTMSDCE.js → chunk-3SKN5L3I.js}

@@ -53,6 +53,7 @@ var DEFAULT_WORKFLOW_TRACKER = {
   terminalStates: DEFAULT_WORKFLOW_LIFECYCLE.terminalStates,
   projectId: null,
   stateFieldName: DEFAULT_WORKFLOW_LIFECYCLE.stateFieldName,
+  priority: null,
   priorityFieldName: null,
   blockerCheckStates: DEFAULT_WORKFLOW_LIFECYCLE.blockerCheckStates
 };
@@ -169,6 +170,7 @@ function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
       terminalStates,
       projectId: readOptionalString(tracker, "project_id", env),
       stateFieldName: readOptionalString(tracker, "state_field", env) ?? DEFAULT_WORKFLOW_TRACKER.stateFieldName,
+      priority: readPriorityConfig(tracker, env),
       priorityFieldName: readOptionalString(tracker, "priority_field", env),
       blockerCheckStates
     },
@@ -235,6 +237,52 @@ function validateTrackerConfig(tracker, trackerKind, env) {
     }
   }
 }
+function readPriorityConfig(tracker, env) {
+  if (tracker.priority === void 0 || tracker.priority === null) {
+    return null;
+  }
+  const priority = readObject(tracker, "priority", "tracker.priority");
+  const source = readRequiredString(priority, "source", env);
+  const keys = new Set(Object.keys(priority));
+  if (source === "project-field") {
+    rejectPriorityKeys(keys, ["source", "field", "values"], source);
+    const field = readRequiredString(priority, "field", env);
+    const values = readNumberMap(priority, "values", "tracker.priority.values");
+    if (Object.keys(values).length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.priority.values" must be a non-empty object for tracker.priority.source "project-field".'
+      );
+    }
+    return { source, field, values };
+  }
+  if (source === "labels") {
+    rejectPriorityKeys(keys, ["source", "labels"], source);
+    const labels = readNumberMap(priority, "labels", "tracker.priority.labels");
+    if (Object.keys(labels).length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.priority.labels" must be a non-empty object for tracker.priority.source "labels".'
+      );
+    }
+    return { source, labels };
+  }
+  if (source === "disabled") {
+    rejectPriorityKeys(keys, ["source"], source);
+    return { source };
+  }
+  throw new Error(
+    `Unsupported workflow tracker.priority.source "${source}". Supported values: project-field, labels, disabled.`
+  );
+}
+function rejectPriorityKeys(keys, allowedKeys, source) {
+  const allowed = new Set(allowedKeys);
+  for (const key of keys) {
+    if (!allowed.has(key)) {
+      throw new Error(
+        `Workflow front matter field "tracker.priority.${key}" is not supported for tracker.priority.source "${source}".`
+      );
+    }
+  }
+}
 function parseLegacyWorkflowMarkdown(markdown) {
   const promptGuidelines = matchOptionalSection(markdown, "Prompt Guidelines") ?? "";
   return {
@@ -262,6 +310,10 @@ function parseBlock(lines, startIndex, indent) {
       index += 1;
       continue;
     }
+    if (line.trim().startsWith("#")) {
+      index += 1;
+      continue;
+    }
     const lineIndent = countIndent(line);
     if (lineIndent < indent) {
       break;
@@ -306,11 +358,16 @@ function parseBlock(lines, startIndex, indent) {
       );
     }
     collectionType = "object";
-    const separatorIndex = trimmed.indexOf(":");
+    const separatorIndex = findMappingSeparator(trimmed);
     if (separatorIndex < 0) {
       throw new Error(`Invalid workflow front matter line "${trimmed}".`);
     }
-    const key = trimmed.slice(0, separatorIndex).trim();
+    const rawKey = trimmed.slice(0, separatorIndex).trim();
+    const parsedKey = parseScalar(rawKey);
+    if (typeof parsedKey !== "string") {
+      throw new Error(`Invalid workflow front matter key "${rawKey}".`);
+    }
+    const key = parsedKey;
     const remainder = trimmed.slice(separatorIndex + 1).trim();
     if (remainder === "|" || remainder === "|-") {
       const [multiline, nextIndex2] = parseMultilineScalar(
@@ -355,6 +412,30 @@ function parseMultilineScalar(lines, startIndex, indent) {
 function countIndent(line) {
   return line.match(/^ */)?.[0].length ?? 0;
 }
+function findMappingSeparator(value) {
+  let quote = null;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (quote) {
+      if (char === "\\") {
+        index += 1;
+        continue;
+      }
+      if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (char === ":") {
+      return index;
+    }
+  }
+  return -1;
+}
 function parseScalar(value) {
   if (value === "null") return null;
   if (value === "true") return true;
@@ -363,8 +444,18 @@ function parseScalar(value) {
     return parseInlineArray(value);
   }
   if (/^-?\d+$/.test(value)) return Number.parseInt(value, 10);
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    return value.slice(1, -1);
+  if (value.startsWith('"') && value.endsWith('"')) {
+    try {
+      const parsed = JSON.parse(value);
+      if (typeof parsed === "string") {
+        return parsed;
+      }
+    } catch {
+      throw new Error(`Invalid quoted workflow front matter scalar "${value}".`);
+    }
+  }
+  if (value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).replace(/''/g, "'");
   }
   return value;
 }
@@ -559,13 +650,13 @@ function readOptionalIntegerLike(input, key) {
   }
   throw new Error(`Workflow front matter field "${key}" must be an integer.`);
 }
-function readNumberMap(input, key) {
+function readNumberMap(input, key, path = key) {
   const value = input[key];
   if (value === void 0 || value === null) {
     return {};
   }
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`Workflow front matter field "${key}" must be an object.`);
+    throw new Error(`Workflow front matter field "${path}" must be an object.`);
   }
   const result = {};
   for (const [entryKey, entryValue] of Object.entries(value)) {
@@ -573,12 +664,12 @@ function readNumberMap(input, key) {
       result[entryKey] = entryValue;
       continue;
     }
-    if (typeof entryValue === "string" && /^\d+$/.test(entryValue)) {
+    if (typeof entryValue === "string" && /^-?\d+$/.test(entryValue)) {
       result[entryKey] = Number.parseInt(entryValue, 10);
       continue;
     }
     throw new Error(
-      `Workflow front matter field "${key}.${entryKey}" must be an integer.`
+      `Workflow front matter field "${path}.${entryKey}" must be an integer.`
     );
   }
   return result;
@@ -1464,6 +1555,10 @@ function isFileMissing(error) {
 // ../core/src/observability/event-formatter.ts
 function formatEventMessage(event) {
   switch (event.event) {
+    case "tracker.list":
+      return `Tracker list saw ${event.issue.identifier}`;
+    case "tracker.fetchByIds":
+      return `Tracker fetch refreshed ${event.issue.identifier}`;
     case "run-dispatched":
       return event.issueState ? `Dispatched from ${event.issueState}` : "Dispatched";
     case "run-recovered":
@@ -1538,31 +1633,176 @@ var SENSITIVE_KEY_SUBSTRINGS = [
   "api_key"
 ];
 function redactObservabilitySecrets(value) {
-  return redactValue(value);
+  return redactObservabilitySecretsWithStats(value).value;
+}
+function redactObservabilitySecretsWithStats(value) {
+  const counts = createRedactionCounts();
+  const redacted = redactValue(value, counts, {
+    redactStringValues: false
+  });
+  return { value: redacted, redactions: summarizeRedactionCounts(counts) };
+}
+function redactObservabilityDiagnosticsWithStats(value) {
+  const counts = createRedactionCounts();
+  const redacted = redactValue(value, counts, {
+    redactStringValues: true
+  });
+  return { value: redacted, redactions: summarizeRedactionCounts(counts) };
 }
-function redactValue(value) {
+function redactObservabilityTextWithStats(text) {
+  const counts = createRedactionCounts();
+  return {
+    value: redactTextValue(text, counts),
+    redactions: summarizeRedactionCounts(counts)
+  };
+}
+function redactValue(value, counts, options) {
   if (Array.isArray(value)) {
-    return value.map((item) => redactValue(item));
+    return value.map((item) => redactValue(item, counts, options));
+  }
+  if (typeof value === "string" && options.redactStringValues) {
+    return redactTextValue(value, counts);
   }
   if (!isRecord3(value)) {
     return value;
   }
   return Object.fromEntries(
-    Object.entries(value).map(([key, nested]) => [
-      key,
-      shouldRedactKey(key) ? REDACTED : redactValue(nested)
-    ])
+    Object.entries(value).map(([key, nested]) => {
+      const redactionClass = redactionClassForKey(key);
+      if (redactionClass) {
+        incrementRedaction(counts, redactionClass);
+        return [key, REDACTED];
+      }
+      return [key, redactValue(nested, counts, options)];
+    })
   );
 }
-function shouldRedactKey(key) {
+function redactionClassForKey(key) {
   const normalizedKey = key.toLowerCase();
-  return normalizedKey === "token" || normalizedKey.endsWith("token") || SENSITIVE_KEY_SUBSTRINGS.some(
+  if (normalizedKey.includes("authorization")) {
+    return "authorization_header";
+  }
+  if (normalizedKey.includes("apikey") || normalizedKey.includes("api-key") || normalizedKey.includes("api_key")) {
+    return "api_key";
+  }
+  if (normalizedKey.includes("secret")) {
+    return "secret_key";
+  }
+  if (normalizedKey === "token" || normalizedKey.endsWith("token")) {
+    return "env_token";
+  }
+  if (SENSITIVE_KEY_SUBSTRINGS.some(
     (pattern) => normalizedKey.includes(pattern.toLowerCase())
-  );
+  )) {
+    return "secret_key";
+  }
+  return null;
 }
 function isRecord3(value) {
   return value != null && typeof value === "object";
 }
+function redactTextValue(text, counts) {
+  let redacted = replaceAndCount(
+    text,
+    /\b(Authorization\s*:\s*Bearer\s+)([^\s]+)/gi,
+    "authorization_header",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\b(X-API-Key\s*:\s*)([^\s]+)/gi,
+    "api_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:TOKEN)\w*\s*=\s*)([^\s]+)/gim,
+    "env_token",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:API_KEY)\w*\s*=\s*)([^\s]+)/gim,
+    "api_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:SECRET)\w*\s*=\s*)([^\s]+)/gim,
+    "secret_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"token"|'token'|token)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/gi,
+    "env_token",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"secret"|'secret'|secret)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/gi,
+    "secret_key",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"apiKey"|'apiKey'|apiKey)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/g,
+    "api_key",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\bghp_[A-Za-z0-9_]+/g,
+    "env_token",
+    counts,
+    "[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\blin_[A-Za-z0-9_]+/g,
+    "api_key",
+    counts,
+    "[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\bsk-[A-Za-z0-9_-]+/g,
+    "api_key",
+    counts,
+    "[REDACTED]"
+  );
+  return redacted;
+}
+function replaceAndCount(text, pattern, redactionClass, counts, replacement) {
+  return text.replace(pattern, (...args) => {
+    const matched = typeof args[0] === "string" ? args[0] : "";
+    if (matched.includes(REDACTED)) {
+      return matched;
+    }
+    incrementRedaction(counts, redactionClass);
+    return replacement.replace(/\$(\d+)/g, (_placeholder, index) => {
+      const group = args[Number.parseInt(index, 10)];
+      return typeof group === "string" ? group : "";
+    });
+  });
+}
+function createRedactionCounts() {
+  return /* @__PURE__ */ new Map();
+}
+function incrementRedaction(counts, redactionClass) {
+  counts.set(redactionClass, (counts.get(redactionClass) ?? 0) + 1);
+}
+function summarizeRedactionCounts(counts) {
+  return Array.from(counts.entries()).filter(([, count]) => count > 0).map(([redactionClass, count]) => ({ class: redactionClass, count })).sort((left, right) => left.class.localeCompare(right.class));
+}
 
 // ../core/src/observability/status-assembler.ts
 function isMatchingIssueRun(run, issueId, issueIdentifier) {
@@ -6304,6 +6544,8 @@ export {
   isFileMissing,
   parseRecentEvents,
   redactObservabilitySecrets,
+  redactObservabilityDiagnosticsWithStats,
+  redactObservabilityTextWithStats,
   isMatchingIssueRun,
   mapIssueOrchestrationStateToStatus,
   resolveGitHubGraphQLToken,

package/dist/{chunk-WOVNN5NW.js → chunk-4ICDSQCJ.js}

@@ -106,6 +106,7 @@ export {
   REPO_RUNTIME_DIR,
   resolveConfigDir,
   configFilePath,
+  projectConfigPath,
   daemonPidPath,
   orchestratorLogPath,
   httpStatusPath,

package/dist/{chunk-DW63WPRE.js → chunk-6PFFGP7S.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   resolveRepoRuntimeRoot
-} from "./chunk-6I753NYO.js";
+} from "./chunk-RZ3WO7OV.js";
 import {
   parseWorkflowMarkdown
-} from "./chunk-EWTMSDCE.js";
+} from "./chunk-3SKN5L3I.js";
 import {
   saveGlobalConfig,
   saveProjectConfig
-} from "./chunk-WOVNN5NW.js";
+} from "./chunk-4ICDSQCJ.js";
 
 // src/repo-runtime.ts
 import { execFileSync } from "child_process";
@@ -58,6 +58,7 @@ async function initRepoRuntime(flags) {
   await migrateLegacyRuntime(runtimeRoot);
   const workflowPath = resolve(repoDir, flags.workflowFile ?? "WORKFLOW.md");
   const workflow = parseWorkflowMarkdown(await readFile(workflowPath, "utf8"));
+  validateRepoInitWorkflow(workflow);
   const repository = resolveRepository(repoDir);
   const trackerAdapter = workflow.tracker.kind ?? "github-project";
   const trackerBindingId = workflow.tracker.projectId ?? workflow.tracker.projectSlug ?? "";
@@ -70,6 +71,9 @@ async function initRepoRuntime(flags) {
   if (flags.assignedOnly) {
     trackerSettings.assignedOnly = true;
   }
+  if (workflow.tracker.priorityFieldName) {
+    trackerSettings.priorityFieldName = workflow.tracker.priorityFieldName;
+  }
   if (trackerAdapter === "file") {
     if (!process.env.GH_SYMPHONY_FILE_TRACKER_ISSUES_PATH) {
       throw new Error(
@@ -88,6 +92,7 @@ async function initRepoRuntime(flags) {
       adapter: trackerAdapter,
       bindingId: trackerBindingId,
       ...workflow.tracker.endpoint ? { apiUrl: workflow.tracker.endpoint } : {},
+      priority: workflow.tracker.priority,
       settings: trackerSettings
     }
   };
@@ -112,6 +117,16 @@ async function initRepoRuntime(flags) {
     repository
   };
 }
+function validateRepoInitWorkflow(workflow) {
+  if (workflow.tracker.kind !== "linear") {
+    return;
+  }
+  if (!workflow.tracker.apiKey?.trim()) {
+    throw new Error(
+      'Linear tracker repo init requires WORKFLOW.md field "tracker.api_key" to reference a resolvable environment variable such as "$LINEAR_API_KEY".'
+    );
+  }
+}
 async function migrateLegacyRuntime(runtimeRoot) {
   const projectsDir = join(runtimeRoot, "projects");
   const projectIds = await readDirectoryNames(projectsDir);

package/dist/{chunk-Z3NZOPLZ.js → chunk-BOM2BYZQ.js}

@@ -32,6 +32,48 @@ function createClient(token, options) {
     fetchImpl: options?.fetchImpl ?? fetch
   };
 }
+async function listRepositoryLabels(client, owner, name) {
+  const restUrl = client.apiUrl.replace("/graphql", "");
+  const baseUrl = restUrl === client.apiUrl ? REST_API_URL : restUrl;
+  const labels = [];
+  let page = 1;
+  while (true) {
+    const response = await client.fetchImpl(
+      `${baseUrl}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/labels?per_page=100&page=${page}`,
+      {
+        headers: {
+          authorization: `Bearer ${client.token}`,
+          accept: "application/vnd.github+json"
+        }
+      }
+    );
+    if (!response.ok) {
+      const payload = await response.json().catch(() => null);
+      const message = payload?.message?.trim() || response.statusText;
+      throw new GitHubApiError(
+        `GitHub label lookup failed for ${owner}/${name}: ${response.status} ${message}`.trim(),
+        response.status
+      );
+    }
+    const pageLabels = await response.json();
+    labels.push(
+      ...pageLabels.flatMap(
+        (label) => typeof label.name === "string" ? [
+          {
+            name: label.name,
+            color: label.color ?? null,
+            description: label.description ?? null
+          }
+        ] : []
+      )
+    );
+    if (pageLabels.length < 100) {
+      break;
+    }
+    page += 1;
+  }
+  return labels;
+}
 async function validateToken(client) {
   const restUrl = client.apiUrl.replace("/graphql", "");
   const baseUrl = restUrl === client.apiUrl ? REST_API_URL : restUrl;
@@ -739,6 +781,7 @@ export {
   GitHubApiError,
   GitHubScopeError,
   createClient,
+  listRepositoryLabels,
   validateToken,
   checkRequiredScopes,
   discoverUserProjects,

package/dist/{chunk-E7OCBNB2.js → chunk-FAU72YC2.js}

@@ -10,7 +10,7 @@ import {
   resolveGitHubGraphQLToken,
   shouldReuseAgentCredentialCache,
   writeAgentCredentialCache
-} from "./chunk-EWTMSDCE.js";
+} from "./chunk-3SKN5L3I.js";
 
 // ../runtime-codex/src/runtime.ts
 import { spawn } from "child_process";