@haystackeditor/cli 0.15.28 → 0.15.30

package/dist/assets/telemetry/browser-runtime.js

@@ -2,8 +2,9 @@
  * Dependency-free browser half of Haystack's experimental web/Node behavior
  * atlas. A build transform supplies an exact manifest; this runtime records
  * only manifest-approved enumerated outcomes and propagates a random trace ID
- * to same-origin requests. It never reads DOM text, request bodies, headers,
- * cookies, storage values, or arbitrary object properties.
+ * to same-origin requests. It never reads DOM text, request bodies, header
+ * values beyond fixed protocol classification, cookies, storage values, or
+ * arbitrary object properties.
  */
 var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
   'use strict';
@@ -65,6 +66,10 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
   var nativeSetTimeout = nativeLooking(hostSetTimeout) ? function () {
     return nativeReflectApply(hostSetTimeout, host, arguments);
   } : null;
+  var hostClearTimeout = safeHostData('clearTimeout');
+  var nativeClearTimeout = nativeLooking(hostClearTimeout) ? function () {
+    return nativeReflectApply(hostClearTimeout, host, arguments);
+  } : null;
   var hostPromise = safeHostData('Promise');
   var promisePrototype = nativeLooking(hostPromise) ? safeNativeMember(hostPromise, 'prototype') : null;
   var promiseThen = promisePrototype ? safeNativeMember(promisePrototype, 'then') : null;
@@ -868,7 +873,7 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     return result;
   }
 
-  function axiosAt(token, owner, callable, receiver, configIndex, safeConfig, applicationArguments) {
+  function axiosAt(token, owner, callable, receiver, ownerProperty, configIndex, safeConfig, applicationArguments) {
     if (!nativeArrayIsArray(applicationArguments) || typeof callable !== 'function') {
       return nativeReflectApply(callable, receiver, applicationArguments);
     }
@@ -877,7 +882,10 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     if (context && !admitProbe(context)) return nativeReflectApply(callable, receiver, applicationArguments);
     var sites = context && context.runtimeConfig && context.runtimeConfig.fetchSites[token];
     if (!context || !sites) return nativeReflectApply(callable, receiver, applicationArguments);
-    if (safeConfig !== true || !Number.isInteger(configIndex) || configIndex < 0 || configIndex > 8 ||
+    if ((ownerProperty !== null && (typeof ownerProperty !== 'string' || ownerProperty.length === 0 ||
+          ownerProperty.length > 256 || ownerProperty === '__proto__' || ownerProperty === 'constructor' ||
+          ownerProperty === 'prototype')) || safeConfig !== true || !Number.isInteger(configIndex) ||
+        configIndex < 0 || configIndex > 8 ||
         !platformFetchCorrelationAllowed()) {
       omit(context);
       return nativeReflectApply(callable, receiver, applicationArguments);
@@ -886,6 +894,20 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     var args = [];
     var config;
     try {
+      if (ownerProperty !== null) {
+        if ((typeof receiver !== 'object' || receiver === null) && typeof receiver !== 'function') {
+          axiosOmission(state);
+          return nativeReflectApply(callable, receiver, applicationArguments);
+        }
+        var ownerDescriptor = nativeGetOwnPropertyDescriptor(receiver, ownerProperty);
+        if (!ownerDescriptor || !nativeReflectApply(nativeHasOwnProperty, ownerDescriptor, ['value']) ||
+            ((typeof ownerDescriptor.value !== 'object' || ownerDescriptor.value === null) &&
+              typeof ownerDescriptor.value !== 'function')) {
+          axiosOmission(state);
+          return nativeReflectApply(callable, receiver, applicationArguments);
+        }
+        owner = ownerDescriptor.value;
+      }
       for (var argumentIndex = 0; argumentIndex < applicationArguments.length; argumentIndex++) {
         args[argumentIndex] = applicationArguments[argumentIndex];
       }
@@ -1028,6 +1050,146 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     return correlatedFetch(fetchImplementation, input, init, sites, hasInit);
   }
 
+  function nextServerActionAt(token, callable, args) {
+    var context = active;
+    if (!context || context.saturated || !admitProbe(context)) {
+      return nativeReflectApply(callable, undefined, args);
+    }
+    var sites = context.runtimeConfig && context.runtimeConfig.fetchSites[token];
+    if (!sites || !nativeFetchFunction || typeof nativeDefineProperty !== 'function' ||
+        !nativeSetTimeout || !nativeClearTimeout) {
+      omit(context);
+      return nativeReflectApply(callable, undefined, args);
+    }
+    var originalDescriptor;
+    try {
+      originalDescriptor = nativeGetOwnPropertyDescriptor(host, 'fetch');
+    } catch (_) {
+      omit(context);
+      return nativeReflectApply(callable, undefined, args);
+    }
+    if (!originalDescriptor || originalDescriptor.configurable !== true ||
+        !nativeReflectApply(nativeHasOwnProperty, originalDescriptor, ['value']) ||
+        originalDescriptor.value !== nativeFetchFunction) {
+      omit(context);
+      return nativeReflectApply(callable, undefined, args);
+    }
+    var observed = false;
+    var restored = false;
+    var omissionRecorded = false;
+    var restoreTimer = null;
+    var recordMissing = function () {
+      if (observed || omissionRecorded) return;
+      omissionRecorded = true;
+      omit(context);
+    };
+    var restore = function () {
+      if (restored) return;
+      restored = true;
+      if (restoreTimer !== null && nativeClearTimeout) {
+        try { nativeClearTimeout(restoreTimer); } catch (_) { failOpen(); }
+      }
+      try {
+        var currentDescriptor = nativeGetOwnPropertyDescriptor(host, 'fetch');
+        if (currentDescriptor && currentDescriptor.configurable === originalDescriptor.configurable &&
+            currentDescriptor.enumerable === originalDescriptor.enumerable &&
+            currentDescriptor.writable === originalDescriptor.writable &&
+            currentDescriptor.value === scopedFetch) {
+          nativeDefineProperty(host, 'fetch', originalDescriptor);
+        } else {
+          // Application/framework mutation wins; never overwrite an owner we
+          // cannot identify exactly.
+          omit(context);
+        }
+      } catch (_) {
+        omit(context);
+        failOpen();
+      }
+    };
+    var exactNextActionInit = function (init) {
+      try {
+        if (!init || typeof init !== 'object' || nativeGetPrototypeOf(init) !== nativeObjectPrototype ||
+            typeof nativeGetOwnPropertyDescriptors !== 'function') return false;
+        var descriptors = nativeGetOwnPropertyDescriptors(init);
+        if (!descriptors.method || descriptors.method.value !== 'POST' || !descriptors.headers ||
+            !nativeReflectApply(nativeHasOwnProperty, descriptors.headers, ['value'])) return false;
+        var headers = descriptors.headers.value;
+        if (!headers || typeof headers !== 'object' || nativeGetPrototypeOf(headers) !== nativeObjectPrototype) return false;
+        var keys = nativeObjectKeys(headers);
+        if (keys.length > 32) return false;
+        var actionHeader = false;
+        var rscAccept = false;
+        for (var index = 0; index < keys.length; index++) {
+          var descriptor = nativeGetOwnPropertyDescriptor(headers, keys[index]);
+          if (!descriptor || !nativeReflectApply(nativeHasOwnProperty, descriptor, ['value']) ||
+              typeof descriptor.value !== 'string') return false;
+          var normalized = keys[index].toLowerCase();
+          if (normalized === 'next-action') actionHeader = descriptor.value.length > 0;
+          if (normalized === 'accept') rscAccept = descriptor.value.toLowerCase().indexOf('text/x-component') !== -1;
+        }
+        return actionHeader && rscAccept;
+      } catch (_) {
+        return false;
+      }
+    };
+    var scopedFetch = function haystackNextServerActionFetch(input, init) {
+      if (context !== active || observed || arguments.length !== 2 || !exactNextActionInit(init)) {
+        return nativeReflectApply(nativeFetchFunction, host, arguments);
+      }
+      observed = true;
+      restore();
+      return correlatedFetch(nativeFetchFunction, input, init, sites, arguments.length >= 2);
+    };
+    try {
+      nativeDefineProperty(host, 'fetch', {
+        configurable: originalDescriptor.configurable,
+        enumerable: originalDescriptor.enumerable,
+        writable: originalDescriptor.writable,
+        value: scopedFetch,
+      });
+    } catch (_) {
+      omit(context);
+      return nativeReflectApply(callable, undefined, args);
+    }
+    try {
+      restoreTimer = nativeSetTimeout(function () {
+        restore();
+        recordMissing();
+      }, 1000);
+    } catch (_) {
+      restore();
+      recordMissing();
+      return nativeReflectApply(callable, undefined, args);
+    }
+    var result;
+    try {
+      result = nativeReflectApply(callable, undefined, args);
+    } catch (error) {
+      restore();
+      recordMissing();
+      throw error;
+    }
+    if (nativePromiseThen && result !== null &&
+        (typeof result === 'object' || typeof result === 'function')) {
+      try {
+        nativeReflectApply(nativePromiseThen, result, [function () {
+          restore();
+          recordMissing();
+        }, function () {
+          restore();
+          recordMissing();
+        }]);
+      } catch (_) {
+        restore();
+        recordMissing();
+      }
+    } else {
+      restore();
+      recordMissing();
+    }
+    return result;
+  }
+
   function mergeAngularHttpContractOptions(options, headerPairs) {
     try {
       if (!options || typeof options !== 'object' || nativeGetPrototypeOf(options) !== nativeObjectPrototype ||
@@ -1430,6 +1592,7 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     condition: function (siteId, outcome) { if (admitProbe(active)) emit(siteId, 'condition', outcome); },
     fetch: correlatedFetch,
     fetchAt: fetchAt,
+    nextServerActionAt: nextServerActionAt,
     angularHttpAt: angularHttpAt,
     axiosAt: axiosAt,
     oazapftsAt: oazapftsAt,

package/dist/commands/precompute-delivery-contract.d.ts

@@ -0,0 +1,68 @@
+import type { FrontHalfEnqueueRequest, RepoWalkHookStatus } from './verify-precompute.js';
+/** FIXED CONTRACT: hook delivery captures the exact request before returning.
+ * Persist request and pending receipt with private permissions and durable,
+ * atomic publication before starting a detached sender. Do not persist tokens.
+ * The sender reads this immutable request, never reconstructs newer source,
+ * and performs one authenticated POST with a total 60-second bound. Pending
+ * is local custody only; acknowledged requires the existing validated server
+ * response. Each delivery owns its receipt so older senders cannot overwrite
+ * newer status. A latest-delivery pointer is written only by hook submission.
+ * Failures/timeouts remain inspectable and cannot imply remote acceptance.
+ * Terminal receipts retain exact request identity; after receipt fsync, remove
+ * the captured patch file. Keep at most 50 terminal delivery directories on
+ * later submissions, excluding the latest pointer and pending deliveries.
+ * Explicit non-hook invocation retains its current synchronous behavior.
+ * No new model/browser work, retry loop, or shared cache identity is added.
+ * On Windows, owner-only access uses a protected current-user SID ACL,
+ * established before capture and checked by the sender, not POSIX mode bits.
+ * File contents are flushed before rename on every platform. Directory fsync
+ * is POSIX-only; Windows publication does not promise power-loss durability.
+ * Windows requests remain logically immutable without the read-only attribute,
+ * so terminal cleanup can remove them. ACL setup/read failure fails closed.
+ * A safe regular captured file may be parsed and identity-validated locally
+ * before its privacy check. A rejected privacy check carries that identity
+ * only for recording a failed receipt, never for a POST. Both this failure
+ * path and the normal sender must acquire the same exclusive sender marker
+ * before changing a receipt or deleting the capture. Unsafe/corrupt paths or
+ * an unwritable store cannot authorize a fallback mutation.
+ */
+export interface PrecomputeDeliveryRequest {
+    schemaVersion: 'precompute-delivery-v1';
+    deliveryId: string;
+    request: FrontHalfEnqueueRequest;
+}
+export interface PrecomputeDeliveryAccessFailure extends Error {
+    readonly delivery: PrecomputeDeliveryRequest;
+}
+export type PrecomputeAcknowledgment = {
+    outcome: 'enqueued' | 'cached' | 'existing';
+    runId?: string;
+    walker?: RepoWalkHookStatus;
+};
+export type PrecomputeDeliveryReceipt = {
+    schemaVersion: 'precompute-delivery-receipt-v1';
+    deliveryId: string;
+    repository: string;
+    sourceCommit: string;
+    updatedAt: string;
+    requestIdentity: Pick<FrontHalfEnqueueRequest, 'baseCommit' | 'workCommit' | 'observedAt' | 'cacheKey' | 'patchSha256'>;
+} & ({
+    status: 'pending';
+} | {
+    status: 'acknowledged';
+    acknowledgment: PrecomputeAcknowledgment;
+} | {
+    status: 'failed' | 'timed-out';
+    reason: string;
+});
+export interface PrecomputeDeliveryPointer {
+    schemaVersion: 'precompute-delivery-pointer-v1';
+    deliveryId: string;
+    repository: string;
+    sourceCommit: string;
+}
+export type StartPrecomputeDelivery = (metadataDirectory: string, request: FrontHalfEnqueueRequest) => Promise<{
+    deliveryId: string;
+    requestPath: string;
+}>;
+export type DeliverPrecomputeRequest = (request: FrontHalfEnqueueRequest, signal: AbortSignal) => Promise<PrecomputeAcknowledgment>;

package/dist/commands/precompute-delivery-contract.js

@@ -0,0 +1 @@
+export {};

package/dist/commands/precompute-delivery-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/precompute-delivery-worker.js

@@ -0,0 +1,68 @@
+import { NotLoggedInError } from '../utils/auth.js';
+import { HaystackApiError } from '../utils/haystack-api.js';
+import { deliverPrecomputeRequest } from './verify-precompute.js';
+import { claimPrecomputeDelivery, PrecomputeDeliveryAccessError, readPrecomputeDelivery, writePrecomputeDeliveryReceipt } from './precompute-delivery.js';
+// Standalone compiled entry point. Its only argument is a captured request path.
+// Tokens are resolved in memory from the inherited auth environment/files.
+const controller = new AbortController();
+const requestPath = process.argv.length === 3 ? process.argv[2] : null;
+let delivery = null;
+let finished = false;
+function finish(result) {
+    finished = true;
+    clearTimeout(deadline);
+    try {
+        if (requestPath && delivery)
+            writePrecomputeDeliveryReceipt(requestPath, delivery, result);
+        process.exit(0);
+    }
+    catch {
+        process.exit(1);
+    }
+}
+function terminal(status, reason) {
+    if (!delivery)
+        process.exit(1);
+    return finish({ status, reason });
+}
+const deadline = setTimeout(() => {
+    controller.abort();
+    if (!finished)
+        terminal('timed-out', 'delivery-deadline-exceeded; remote-acceptance-unknown');
+}, 60_000);
+try {
+    if (!requestPath)
+        throw new Error('Missing captured request.');
+    let accessRejected = false;
+    try {
+        delivery = readPrecomputeDelivery(requestPath);
+    }
+    catch (error) {
+        if (!(error instanceof PrecomputeDeliveryAccessError))
+            throw error;
+        delivery = error.delivery;
+        accessRejected = true;
+    }
+    // A duplicate sender must not replace the first sender's receipt.
+    try {
+        claimPrecomputeDelivery(requestPath);
+    }
+    catch {
+        process.exit(1);
+    }
+    if (accessRejected)
+        terminal('failed', 'captured-request-access-rejected');
+    const acknowledgment = await deliverPrecomputeRequest(delivery.request, controller.signal);
+    finish({ status: 'acknowledged', acknowledgment });
+}
+catch (error) {
+    if (finished)
+        process.exit(0);
+    if (controller.signal.aborted)
+        terminal('timed-out', 'delivery-deadline-exceeded; remote-acceptance-unknown');
+    if (error instanceof NotLoggedInError)
+        terminal('failed', 'authentication-required');
+    if (error instanceof HaystackApiError)
+        terminal('failed', `server-http-${error.status}`);
+    terminal('failed', 'delivery-not-acknowledged; remote-acceptance-unknown');
+}

package/dist/commands/precompute-delivery.d.ts

@@ -0,0 +1,20 @@
+import type { PrecomputeDeliveryAccessFailure, PrecomputeDeliveryReceipt, PrecomputeDeliveryRequest, StartPrecomputeDelivery } from './precompute-delivery-contract.js';
+export declare class PrecomputeDeliveryAccessError extends Error implements PrecomputeDeliveryAccessFailure {
+    readonly delivery: PrecomputeDeliveryRequest;
+    constructor(delivery: PrecomputeDeliveryRequest);
+}
+export declare function readPrecomputeDelivery(requestPath: string): PrecomputeDeliveryRequest;
+export declare function writePrecomputeDeliveryReceipt(requestPath: string, delivery: PrecomputeDeliveryRequest, result: {
+    status: 'pending';
+} | {
+    status: 'acknowledged';
+    acknowledgment: Extract<PrecomputeDeliveryReceipt, {
+        status: 'acknowledged';
+    }>['acknowledgment'];
+} | {
+    status: 'failed' | 'timed-out';
+    reason: string;
+}): void;
+/** An exclusive durable marker prevents a second invocation from posting this delivery. */
+export declare function claimPrecomputeDelivery(requestPath: string): void;
+export declare const startPrecomputeDelivery: StartPrecomputeDelivery;