@koda-sl/baker-cli 0.531.0 → 0.533.0

package/dist/chunk-L4LNS54Y.js

@@ -0,0 +1,138 @@
+import {
+  cacheGet,
+  cacheSet,
+  handleConnectionError,
+  needsConnectionFix,
+  writeJsonEnvelope
+} from "./chunk-LV7EU6HM.js";
+import {
+  ApiError,
+  apiGet
+} from "./chunk-CIW3Q7B2.js";
+import {
+  getEnv,
+  optionalTargetCompany
+} from "./chunk-VPF5A7CM.js";
+
+// src/commands/gsc/errors.ts
+var RETRYABLE_CODES = /* @__PURE__ */ new Set(["RATE_LIMITED", "UNAVAILABLE", "INTERNAL_ERROR", "NETWORK_ERROR", "TIMEOUT"]);
+function handleGscError(err) {
+  if (!(err instanceof ApiError)) {
+    writeJsonEnvelope({
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : "Unexpected error",
+        retryable: true
+      }
+    });
+    process.exit(1);
+  }
+  if (needsConnectionFix(err.code, err.message)) {
+    handleConnectionError("gsc", err.message);
+  }
+  writeJsonEnvelope({
+    ok: false,
+    error: { code: err.code, message: err.message, retryable: RETRYABLE_CODES.has(err.code) }
+  });
+  process.exit(1);
+}
+
+// src/commands/gsc/resolve.ts
+function isReadableSite(site) {
+  return site.permissionLevel !== "siteUnverifiedUser";
+}
+async function handleGscSiteError(err, refusedSiteUrl) {
+  if (!(err instanceof ApiError) || err.code !== "FORBIDDEN" || !/permission/i.test(err.message)) {
+    return handleGscError(err);
+  }
+  let sites;
+  try {
+    sites = await fetchSites(false);
+  } catch {
+    return handleGscError(err);
+  }
+  const readable = sites.filter((site) => isReadableSite(site) && site.siteUrl !== refusedSiteUrl).map((site) => site.siteUrl);
+  writeJsonEnvelope({
+    ok: false,
+    error: {
+      code: err.code,
+      message: err.message,
+      retryable: false,
+      fix: readable.length > 0 ? useReadableSiteFix(readable) : noReadableSiteFix()
+    }
+  });
+  process.exit(1);
+}
+function useReadableSiteFix(readable) {
+  return {
+    action: "use_readable_site",
+    explanation: `The Google account connected to Search Console cannot read this site. Retrying will not help. Run the same read with --site-url set to one of: ${readable.join(", ")}.`,
+    validValues: readable
+  };
+}
+function noReadableSiteFix() {
+  if (optionalTargetCompany()) {
+    return {
+      action: "continue_without",
+      explanation: "The Google account connected to Search Console for that company cannot read any of its sites. It can only be reconnected in that company's own workspace, never with `request_connection` from here. Show that company's Search Console as unavailable and carry on with the others."
+    };
+  }
+  return {
+    action: "request_connection",
+    explanation: 'The Google account connected to Search Console cannot read any of this company\'s sites. Call the `request_connection` tool with { platform: "google-search-console", reason } so the user reconnects with a Google account that has access to the site, then carry on with the rest of the task.'
+  };
+}
+async function fetchSites(useCache = true) {
+  if (useCache) {
+    const cached = cacheGet("gsc-sites", "list");
+    if (cached) return cached.data;
+  }
+  const params = !useCache ? { "skip-cache": "true" } : void 0;
+  const data = await apiGet("/api/gsc/sites", params);
+  if (useCache) {
+    cacheSet("gsc-sites", "list", data, 60 * 60 * 1e3);
+  }
+  return data;
+}
+async function resolveSiteUrl(args) {
+  const fromArgs = args["site-url"];
+  const fromEnv = getEnv().BAKER_GSC_SITE_URL;
+  const siteUrl = fromArgs || fromEnv;
+  if (siteUrl) return siteUrl;
+  const useCache = !args["no-cache"];
+  try {
+    const listed = await fetchSites(useCache);
+    const readable = listed.filter(isReadableSite);
+    const sites = readable.length > 0 ? readable : listed;
+    const [single] = sites;
+    if (sites.length === 1 && single) {
+      process.stderr.write(`Using site "${single.siteUrl}"
+`);
+      return single.siteUrl;
+    }
+    if (sites.length === 0) {
+      handleConnectionError("gsc");
+    }
+    const list = sites.map((s) => `  ${s.siteUrl}  (${s.permissionLevel})`).join("\n");
+    writeJsonEnvelope({
+      ok: false,
+      error: {
+        code: "MULTIPLE_SITES",
+        message: `Multiple sites found. Pass --site-url or set BAKER_GSC_SITE_URL:
+${list}`
+      }
+    });
+    process.exit(1);
+  } catch (err) {
+    handleGscError(err);
+  }
+}
+
+export {
+  handleGscError,
+  isReadableSite,
+  handleGscSiteError,
+  resolveSiteUrl
+};
+//# sourceMappingURL=chunk-L4LNS54Y.js.map

package/dist/chunk-L4LNS54Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/gsc/errors.ts","../src/commands/gsc/resolve.ts"],"sourcesContent":["import { ApiError } from \"../../client.ts\";\nimport { handleConnectionError, needsConnectionFix } from \"../../error-handler.ts\";\nimport { writeJsonEnvelope } from \"../ads/output.ts\";\n\nconst RETRYABLE_CODES = new Set([\"RATE_LIMITED\", \"UNAVAILABLE\", \"INTERNAL_ERROR\", \"NETWORK_ERROR\", \"TIMEOUT\"]);\n\n/**\n * The one error shape for every Search Console read. A dead sign-in gets the\n * in-chat reconnect whatever its wording, and every other failure says whether\n * asking again can help, so an outage is never read as a broken connection.\n */\nexport function handleGscError(err: unknown): never {\n  if (!(err instanceof ApiError)) {\n    writeJsonEnvelope({\n      ok: false,\n      error: {\n        code: \"NETWORK_ERROR\",\n        message: err instanceof Error ? err.message : \"Unexpected error\",\n        retryable: true,\n      },\n    });\n    process.exit(1);\n  }\n  if (needsConnectionFix(err.code, err.message)) {\n    handleConnectionError(\"gsc\", err.message);\n  }\n  writeJsonEnvelope({\n    ok: false,\n    error: { code: err.code, message: err.message, retryable: RETRYABLE_CODES.has(err.code) },\n  });\n  process.exit(1);\n}\n","import { ApiError, apiGet } from \"../../client.ts\";\nimport { getEnv, optionalTargetCompany } from \"../../env.ts\";\nimport { handleConnectionError } from \"../../error-handler.ts\";\nimport { cacheGet, cacheSet } from \"../ads/cache.ts\";\nimport { writeJsonEnvelope } from \"../ads/output.ts\";\nimport { handleGscError } from \"./errors.ts\";\n\ninterface GscSite {\n  siteUrl: string;\n  permissionLevel: string;\n}\n\n/** Search Console lists a site to an unverified user but answers every read of it with a 403. */\nexport function isReadableSite(site: GscSite): boolean {\n  return site.permissionLevel !== \"siteUnverifiedUser\";\n}\n\n/**\n * A query or sitemap read refused because the signed-in Google account cannot\n * read that site: name the connected sites it can read now, or ask for a\n * reconnect with an account that has access when there are none.\n */\nexport async function handleGscSiteError(err: unknown, refusedSiteUrl: string): Promise<never> {\n  if (!(err instanceof ApiError) || err.code !== \"FORBIDDEN\" || !/permission/i.test(err.message)) {\n    return handleGscError(err);\n  }\n  // Permissions change under a cached listing: ask Search Console again, past both caches.\n  let sites: GscSite[];\n  try {\n    sites = await fetchSites(false);\n  } catch {\n    return handleGscError(err);\n  }\n  const readable = sites\n    .filter((site) => isReadableSite(site) && site.siteUrl !== refusedSiteUrl)\n    .map((site) => site.siteUrl);\n  writeJsonEnvelope({\n    ok: false,\n    error: {\n      code: err.code,\n      message: err.message,\n      retryable: false,\n      fix: readable.length > 0 ? useReadableSiteFix(readable) : noReadableSiteFix(),\n    },\n  });\n  process.exit(1);\n}\n\nfunction useReadableSiteFix(readable: string[]) {\n  return {\n    action: \"use_readable_site\",\n    explanation:\n      \"The Google account connected to Search Console cannot read this site. Retrying will not help. \" +\n      `Run the same read with --site-url set to one of: ${readable.join(\", \")}.`,\n    validValues: readable,\n  };\n}\n\nfunction noReadableSiteFix() {\n  // Read with `--company` from the organization workspace: reconnecting from here\n  // would connect the workspace, not the company the read named.\n  if (optionalTargetCompany()) {\n    return {\n      action: \"continue_without\",\n      explanation:\n        \"The Google account connected to Search Console for that company cannot read any of its sites. It can only \" +\n        \"be reconnected in that company's own workspace, never with `request_connection` from here. Show that \" +\n        \"company's Search Console as unavailable and carry on with the others.\",\n    };\n  }\n  return {\n    action: \"request_connection\",\n    explanation:\n      \"The Google account connected to Search Console cannot read any of this company's sites. Call the \" +\n      '`request_connection` tool with { platform: \"google-search-console\", reason } so the user reconnects ' +\n      \"with a Google account that has access to the site, then carry on with the rest of the task.\",\n  };\n}\n\nasync function fetchSites(useCache = true): Promise<GscSite[]> {\n  if (useCache) {\n    const cached = cacheGet<GscSite[]>(\"gsc-sites\", \"list\");\n    if (cached) return cached.data;\n  }\n  const params = !useCache ? { \"skip-cache\": \"true\" } : undefined;\n  const data = await apiGet<GscSite[]>(\"/api/gsc/sites\", params);\n  if (useCache) {\n    cacheSet(\"gsc-sites\", \"list\", data, 60 * 60 * 1000);\n  }\n  return data;\n}\n\nexport async function resolveSiteUrl(args: Record<string, unknown>): Promise<string> {\n  const fromArgs = args[\"site-url\"] as string | undefined;\n  const fromEnv = getEnv().BAKER_GSC_SITE_URL;\n  const siteUrl = fromArgs || fromEnv;\n\n  if (siteUrl) return siteUrl;\n\n  const useCache = !args[\"no-cache\"];\n\n  try {\n    const listed = await fetchSites(useCache);\n    const readable = listed.filter(isReadableSite);\n    // A site the account cannot read is never picked, matching what `gsc sites` promises.\n    const sites = readable.length > 0 ? readable : listed;\n    const [single] = sites;\n    if (sites.length === 1 && single) {\n      process.stderr.write(`Using site \"${single.siteUrl}\"\\n`);\n      return single.siteUrl;\n    }\n    if (sites.length === 0) {\n      handleConnectionError(\"gsc\");\n    }\n    const list = sites.map((s) => `  ${s.siteUrl}  (${s.permissionLevel})`).join(\"\\n\");\n    writeJsonEnvelope({\n      ok: false,\n      error: {\n        code: \"MULTIPLE_SITES\",\n        message: `Multiple sites found. Pass --site-url or set BAKER_GSC_SITE_URL:\\n${list}`,\n      },\n    });\n    process.exit(1);\n  } catch (err) {\n    handleGscError(err);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAIA,IAAM,kBAAkB,oBAAI,IAAI,CAAC,gBAAgB,eAAe,kBAAkB,iBAAiB,SAAS,CAAC;AAOtG,SAAS,eAAe,KAAqB;AAClD,MAAI,EAAE,eAAe,WAAW;AAC9B,sBAAkB;AAAA,MAChB,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,mBAAmB,IAAI,MAAM,IAAI,OAAO,GAAG;AAC7C,0BAAsB,OAAO,IAAI,OAAO;AAAA,EAC1C;AACA,oBAAkB;AAAA,IAChB,IAAI;AAAA,IACJ,OAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,WAAW,gBAAgB,IAAI,IAAI,IAAI,EAAE;AAAA,EAC1F,CAAC;AACD,UAAQ,KAAK,CAAC;AAChB;;;AClBO,SAAS,eAAe,MAAwB;AACrD,SAAO,KAAK,oBAAoB;AAClC;AAOA,eAAsB,mBAAmB,KAAc,gBAAwC;AAC7F,MAAI,EAAE,eAAe,aAAa,IAAI,SAAS,eAAe,CAAC,cAAc,KAAK,IAAI,OAAO,GAAG;AAC9F,WAAO,eAAe,GAAG;AAAA,EAC3B;AAEA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,WAAW,KAAK;AAAA,EAChC,QAAQ;AACN,WAAO,eAAe,GAAG;AAAA,EAC3B;AACA,QAAM,WAAW,MACd,OAAO,CAAC,SAAS,eAAe,IAAI,KAAK,KAAK,YAAY,cAAc,EACxE,IAAI,CAAC,SAAS,KAAK,OAAO;AAC7B,oBAAkB;AAAA,IAChB,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM,IAAI;AAAA,MACV,SAAS,IAAI;AAAA,MACb,WAAW;AAAA,MACX,KAAK,SAAS,SAAS,IAAI,mBAAmB,QAAQ,IAAI,kBAAkB;AAAA,IAC9E;AAAA,EACF,CAAC;AACD,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,mBAAmB,UAAoB;AAC9C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aACE,kJACoD,SAAS,KAAK,IAAI,CAAC;AAAA,IACzE,aAAa;AAAA,EACf;AACF;AAEA,SAAS,oBAAoB;AAG3B,MAAI,sBAAsB,GAAG;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,aACE;AAAA,IAGJ;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aACE;AAAA,EAGJ;AACF;AAEA,eAAe,WAAW,WAAW,MAA0B;AAC7D,MAAI,UAAU;AACZ,UAAM,SAAS,SAAoB,aAAa,MAAM;AACtD,QAAI,OAAQ,QAAO,OAAO;AAAA,EAC5B;AACA,QAAM,SAAS,CAAC,WAAW,EAAE,cAAc,OAAO,IAAI;AACtD,QAAM,OAAO,MAAM,OAAkB,kBAAkB,MAAM;AAC7D,MAAI,UAAU;AACZ,aAAS,aAAa,QAAQ,MAAM,KAAK,KAAK,GAAI;AAAA,EACpD;AACA,SAAO;AACT;AAEA,eAAsB,eAAe,MAAgD;AACnF,QAAM,WAAW,KAAK,UAAU;AAChC,QAAM,UAAU,OAAO,EAAE;AACzB,QAAM,UAAU,YAAY;AAE5B,MAAI,QAAS,QAAO;AAEpB,QAAM,WAAW,CAAC,KAAK,UAAU;AAEjC,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,UAAM,WAAW,OAAO,OAAO,cAAc;AAE7C,UAAM,QAAQ,SAAS,SAAS,IAAI,WAAW;AAC/C,UAAM,CAAC,MAAM,IAAI;AACjB,QAAI,MAAM,WAAW,KAAK,QAAQ;AAChC,cAAQ,OAAO,MAAM,eAAe,OAAO,OAAO;AAAA,CAAK;AACvD,aAAO,OAAO;AAAA,IAChB;AACA,QAAI,MAAM,WAAW,GAAG;AACtB,4BAAsB,KAAK;AAAA,IAC7B;AACA,UAAM,OAAO,MAAM,IAAI,CAAC,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,eAAe,GAAG,EAAE,KAAK,IAAI;AACjF,sBAAkB;AAAA,MAChB,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,EAAqE,IAAI;AAAA,MACpF;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AACZ,mBAAe,GAAG;AAAA,EACpB;AACF;","names":[]}

package/dist/chunk-L5VVKIMB.js

@@ -0,0 +1,203 @@
+import {
+  ACTION_TEMP_ID_PREFIX
+} from "./chunk-HVJJEQDQ.js";
+import {
+  ApiError
+} from "./chunk-CIW3Q7B2.js";
+import {
+  MissingChatIdError
+} from "./chunk-VPF5A7CM.js";
+import {
+  writeJson
+} from "./chunk-HZPTQRX6.js";
+
+// src/commands/actions/tagError.ts
+var UNKNOWN_TAG_RE = /Unknown action tag\(s\): ([^.]+)\. Valid tags: ([^.]+)\./;
+function splitSlugs(list) {
+  return list.split(",").map((slug) => slug.trim()).filter((slug) => slug.length > 0);
+}
+function actionTagFix(message) {
+  const match = UNKNOWN_TAG_RE.exec(message);
+  if (!match) {
+    return null;
+  }
+  const [, unknownList, validList] = match;
+  const unknownTags = splitSlugs(unknownList ?? "");
+  const validTags = splitSlugs(validList ?? "");
+  const first = unknownTags[0];
+  if (first === void 0 || validTags.length === 0) {
+    return null;
+  }
+  return {
+    action: "retry_with_a_valid_tag",
+    explanation: `The tag(s) ${unknownTags.join(", ")} are not in this company's taxonomy. \`validTags\` below is the complete accepted set \u2014 pick from it and re-run the same command. Only mint a new tag when none of them names this work; a near-duplicate of an existing tag splits the backlog's filter instead of extending it.`,
+    unknownTags,
+    validTags,
+    mintCommand: `baker actions tags create --slug ${first} --description "<what ${first} groups>"`,
+    listCommand: "baker actions tags list"
+  };
+}
+
+// src/commands/actions/shared.ts
+function writeOk(data) {
+  writeJson({ ok: true, data: data ?? null });
+}
+function failValidation(message) {
+  writeJson({ ok: false, error: { code: "VALIDATION_ERROR", message } });
+  process.exit(1);
+}
+function apiFailure(err) {
+  if (err instanceof ApiError) {
+    const fix = err.fix ?? actionTagFix(err.message);
+    return { ok: false, error: { code: err.code, message: err.message, ...fix ? { fix } : {} } };
+  }
+  if (err instanceof MissingChatIdError) {
+    const explanation = "This command stages its change on the chat this run belongs to, and this run has none. Don't retry: carry on with the rest of the job and tell the user this change couldn't be staged from here.";
+    return { ok: false, error: { code: err.code, message: err.message, fix: { action: "reject", explanation } } };
+  }
+  return {
+    ok: false,
+    error: { code: "INTERNAL_ERROR", message: err instanceof Error ? err.message : "Unexpected error" }
+  };
+}
+function failApi(err) {
+  writeJson(apiFailure(err));
+  process.exit(1);
+}
+function generateTempId() {
+  return `${ACTION_TEMP_ID_PREFIX}${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+}
+function isTempId(id) {
+  return id.startsWith(ACTION_TEMP_ID_PREFIX);
+}
+function parseTagList(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const tags = value.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+  return [...new Set(tags)];
+}
+var ACTION_PRIORITIES = ["urgent", "high", "medium", "low"];
+function parsePriority(value, { allowClear }) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    failValidation(
+      `--priority must be one of: ${ACTION_PRIORITIES.join(", ")}${allowClear ? ", or 'none' to clear" : ""}.`
+    );
+  }
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed === "") {
+    if (allowClear) {
+      return null;
+    }
+    return void 0;
+  }
+  if (allowClear && (trimmed === "none" || trimmed === "clear")) {
+    return null;
+  }
+  if (ACTION_PRIORITIES.includes(trimmed)) {
+    return trimmed;
+  }
+  failValidation(
+    `Unknown --priority "${value}". Expected one of: ${ACTION_PRIORITIES.join(", ")}${allowClear ? ", or 'none' to clear" : ""}.`
+  );
+}
+var FAN_OUT_NUDGE_THRESHOLD = 2;
+var FAN_OUT_THRESHOLD = 3;
+function buildCreateHints({
+  advisory,
+  name,
+  description,
+  tempId,
+  tags,
+  prioritySet,
+  draftCreateCount
+}) {
+  const hints = [];
+  const expanded = shellExpandedIn(`${name}
+${description}`);
+  if (expanded) {
+    hints.push(
+      `The text says \u201C${expanded}\u201D: the shell replaced a $ amount (like $0) inside double quotes before Baker saw it. Fix it now: baker actions update ${tempId} --description '<the text, with the amounts as you read them>' (and --name '\u2026' if the name has it) \u2014 single quotes keep $ as written.`
+    );
+  }
+  if (advisory) {
+    hints.push(
+      `${advisory.hint} If nothing actually blocks it: baker actions draft remove ${tempId}, then do the work.`
+    );
+  }
+  if (draftCreateCount >= FAN_OUT_THRESHOLD) {
+    hints.push(
+      `${draftCreateCount} Tasks are staged in this chat. Re-read them with \`baker actions draft\`: can any be done now with a surface you already have, and do any two touch the same system (same container, same campaign, same page)? Those belong in ONE Task \u2014 fold them together with \`baker actions update\` and drop the extras with \`baker actions draft remove <tempId>\`.`
+    );
+  } else if (draftCreateCount === FAN_OUT_NUDGE_THRESHOLD) {
+    hints.push(
+      `Second Task staged in this chat. If these two land on the same system (same container, same campaign, same page) they are ONE Task \u2014 fold them with \`baker actions update\` and drop the extra with \`baker actions draft remove ${tempId}\`.`
+    );
+  }
+  hints.push(`Link dependencies: baker actions link --blocker <id> --blocked ${tempId}`);
+  if (!description) {
+    hints.push("Add description: baker actions update <tempId> --description '...' (what/why/where/done-when)");
+  }
+  if (!tags || tags.length === 0) {
+    hints.push(
+      "MISSING --tags. This action is invisible to the backlog's tag filter. Re-run with --tags <slug,...> (`baker actions tags list` for the taxonomy, `baker actions tags create --slug <slug>` to mint) \u2014 or `baker actions update <tempId> --tags <slug,...>`."
+    );
+  }
+  if (!prioritySet) {
+    hints.push(
+      `MISSING --priority. Without it this action ranks as 'normal' (medium) in the do-first ordering, so urgent/high client work won't surface first. Re-run with --priority ${ACTION_PRIORITIES.join("|")} \u2014 or \`baker actions update <tempId> --priority <level>\`.`
+    );
+  }
+  return hints;
+}
+var SHELL_PATH = /(?:^|[\s(])((?:\/usr)?\/bin\/(?:ba|z|da|k)?sh|-(?:ba|z|da|k)sh)\b/;
+var MONEY_WORD = "spend|spent|spending|budget|revenue|sales|cost|costs|cpa|cpc|cpm|cpl|roas|profit|paid|earned";
+var BARE_SHELL = new RegExp(
+  `(?:\\b(?:${MONEY_WORD}|at|to|from|was|were|is)\\s+(bash|zsh)\\b|(?:^|[\\s(])(bash|zsh)(?=\\.\\d|\\s+(?:${MONEY_WORD})\\b))`,
+  "gi"
+);
+function shellExpandedIn(text) {
+  const path = SHELL_PATH.exec(text)?.[1];
+  if (path) return path;
+  for (const match of text.matchAll(BARE_SHELL)) {
+    const name = match[1] ?? match[2];
+    if (name && name === name.toLowerCase()) return name;
+  }
+  return null;
+}
+var ACTIONS_LIST_DEFAULT_LIMIT = 500;
+function buildListHints({ returned, limit }) {
+  if (returned < limit) {
+    return [];
+  }
+  return [
+    `This list is capped at ${limit} Tasks and came back full, so older Tasks exist that are NOT shown. Do not treat it as the whole backlog \u2014 re-run with --limit ${limit * 2} (or narrow with --status / --search).`
+  ];
+}
+function buildGetHints(detail) {
+  if (detail?.action.status !== "pending" || detail.activeChat !== null) {
+    return [];
+  }
+  return [
+    `If you are working on this Task in this chat, claim it first so the Tasks page shows it in progress: baker actions claim ${detail.action._id}`
+  ];
+}
+
+export {
+  writeOk,
+  failValidation,
+  failApi,
+  generateTempId,
+  isTempId,
+  parseTagList,
+  ACTION_PRIORITIES,
+  parsePriority,
+  buildCreateHints,
+  ACTIONS_LIST_DEFAULT_LIMIT,
+  buildListHints,
+  buildGetHints
+};
+//# sourceMappingURL=chunk-L5VVKIMB.js.map

package/dist/chunk-L763CNKH.js

@@ -0,0 +1,333 @@
+import {
+  captureProxyCredentials,
+  isChallengeBody,
+  isPrivateAddress,
+  isProxyFailure,
+  nextPlannedRoute,
+  plannedRoutes,
+  refuseNonPublicUrl,
+  shouldEscalate
+} from "./chunk-VPF5A7CM.js";
+
+// ../proxy/src/fetch.ts
+import { lookup as dnsLookup } from "dns";
+import { Agent, ProxyAgent, Response, fetch as undiciFetch } from "undici";
+
+// ../proxy/src/fetchDecision.ts
+function classifyFetchOutcome(signal) {
+  if (isProxyFailure(signal)) return "proxy_unavailable";
+  if (shouldEscalate(signal)) return "blocked";
+  if (signal.status != null && signal.status >= 200 && signal.status < 400 && !signal.challenge) return "ok";
+  return "failed";
+}
+function shouldTryNextRoute(outcome) {
+  return outcome === "blocked" || outcome === "proxy_unavailable";
+}
+var TIMEOUT_CODES = /* @__PURE__ */ new Set([
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "ETIMEDOUT"
+]);
+var RESET_CODES = /* @__PURE__ */ new Set(["ECONNRESET", "UND_ERR_SOCKET", "EPIPE"]);
+var PROXY_RESPONSE = /Proxy response \((\d+)\)/;
+function errorCode(error) {
+  if (typeof error !== "object" || error === null) return null;
+  const code = error.code;
+  if (typeof code === "string") return code;
+  const name = error.name;
+  return typeof name === "string" ? name : null;
+}
+function errorMessage(error) {
+  if (typeof error === "object" && error !== null) {
+    const message = error.message;
+    if (typeof message === "string") return message;
+  }
+  return String(error);
+}
+function errorBlockSignal(error, proxied) {
+  const proxyResponse = PROXY_RESPONSE.exec(errorMessage(error));
+  if (proxyResponse) {
+    const status = Number(proxyResponse[1]);
+    return status === 407 ? { status: 407 } : { netError: "ERR_TUNNEL_CONNECTION_FAILED" };
+  }
+  const code = errorCode(error);
+  if (code !== null && TIMEOUT_CODES.has(code)) return { timedOut: true };
+  if (code === "AbortError" || code === "TimeoutError") return { timedOut: true };
+  if (proxied) {
+    return { netError: "ERR_PROXY_CONNECTION_FAILED" };
+  }
+  if (code !== null && RESET_CODES.has(code)) return { netError: "ERR_CONNECTION_RESET" };
+  return { netError: code ?? "ERR_FAILED" };
+}
+function shouldSniffChallenge(contentType, contentLength, maxSniffBytes) {
+  if (contentLength !== null && contentLength > maxSniffBytes) return false;
+  if (contentType === null || contentType.trim() === "") return true;
+  const type = contentType.toLowerCase();
+  if (type.startsWith("image/") || type.startsWith("video/") || type.startsWith("audio/")) return false;
+  return type.includes("text/") || type.includes("html") || type.includes("json") || type.includes("xml");
+}
+
+// ../proxy/src/fetch.ts
+var DEFAULT_TIMEOUT_MS = 6e4;
+var MAX_SNIFF_BYTES = 64 * 1024;
+function tierOf(route) {
+  return route.kind === "proxy" ? route.tier : "direct";
+}
+function agentFor(route) {
+  if (route.kind !== "proxy") return directAgent();
+  const token = Buffer.from(`${route.username}:${route.password}`).toString("base64");
+  return new ProxyAgent({ uri: route.server, token: `Basic ${token}` });
+}
+function directAgent() {
+  return new Agent({
+    connect: {
+      lookup: (hostname, options, callback) => {
+        dnsLookup(hostname, options, (error, address, family) => {
+          if (error) {
+            callback(error, address, family);
+            return;
+          }
+          const found = Array.isArray(address) ? address.map((entry) => entry.address) : [address];
+          const blocked = found.find((entry) => isPrivateAddress(entry));
+          if (blocked !== void 0) {
+            callback(new Error(`${PRIVATE_ADDRESS_CODE}: ${hostname} resolves to ${blocked}`), "", 4);
+            return;
+          }
+          callback(null, address, family);
+        });
+      }
+    }
+  });
+}
+var PRIVATE_ADDRESS_CODE = "EPRIVATEADDR";
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function refuseRedirect(entry, to) {
+  if (refuseNonPublicUrl(to) === null) return false;
+  const destination = originOf(to);
+  return destination === null || destination !== originOf(entry);
+}
+async function followRedirects(url, init) {
+  let current = url;
+  let request = { ...init, redirect: "manual" };
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const response = await undiciFetch(current, request);
+    const location = response.headers.get("location");
+    if (!REDIRECT_STATUS.has(response.status) || location === null) return response;
+    await response.body?.cancel();
+    const next = new URL(location, current).toString();
+    if (refuseRedirect(url, next)) {
+      throw new Error(`${PRIVATE_ADDRESS_CODE}: redirected to ${next}`);
+    }
+    const method = (request.method ?? "GET").toUpperCase();
+    const downgrade = response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST";
+    request = downgrade ? { ...request, method: "GET", body: void 0 } : request;
+    current = next;
+  }
+  throw new Error(`too many redirects following ${url}`);
+}
+var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function rebuild(response, body) {
+  if (response.status < 200 || response.status > 599 || NULL_BODY_STATUS.has(response.status)) {
+    return new Response(null, { status: response.status, headers: response.headers });
+  }
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function declaredLength(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function readOnce(response, sniff, maxBytes) {
+  const declared = declaredLength(response);
+  if (maxBytes !== void 0 && declared !== null && declared > maxBytes) {
+    await response.body?.cancel();
+    return { response: rebuild(response, new ArrayBuffer(0)), challenge: false };
+  }
+  const body = await response.arrayBuffer();
+  const wantsSniff = sniff && shouldSniffChallenge(response.headers.get("content-type"), body.byteLength, MAX_SNIFF_BYTES);
+  const challenge = wantsSniff ? isChallengeBody(new TextDecoder().decode(body)) : false;
+  return { response: rebuild(response, body), challenge };
+}
+async function attemptRoute(url, init, route, options) {
+  const tier = tierOf(route);
+  const agent = agentFor(route);
+  const startedAt = Date.now();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+  try {
+    const raw = await followRedirects(url, { ...init, dispatcher: agent ?? void 0, signal });
+    const read = await readOnce(raw, options.sniffChallenge ?? true, options.maxBytes);
+    const outcome = classifyFetchOutcome({ status: raw.status, challenge: read.challenge });
+    return {
+      attempt: { tier, status: raw.status, ms: Date.now() - startedAt, outcome },
+      response: outcome === "proxy_unavailable" ? null : read.response
+    };
+  } catch (error) {
+    const blockSignal = errorBlockSignal(error, route.kind === "proxy");
+    return {
+      attempt: {
+        tier,
+        status: blockSignal.status ?? void 0,
+        ms: Date.now() - startedAt,
+        outcome: classifyFetchOutcome(blockSignal)
+      },
+      response: null,
+      error
+    };
+  } finally {
+    await agent?.close();
+  }
+}
+async function fetchWithEscalation(url, init, options) {
+  const attempts = [];
+  let originResponse = null;
+  let originTier = "direct";
+  let lastError;
+  const routes = plannedRoutes(url, options.credentials, options.routeOptions);
+  const tried = [];
+  for (let route = routes[0] ?? null; route !== null; route = nextPlannedRoute(routes, tried)) {
+    const rung = await attemptRoute(url, init, route, options);
+    attempts.push(rung.attempt);
+    tried.push({ tier: rung.attempt.tier, proxyFailure: rung.attempt.outcome === "proxy_unavailable" });
+    if (rung.response !== null) {
+      originResponse = rung.response;
+      originTier = rung.attempt.tier;
+    }
+    if (rung.error !== void 0) lastError = rung.error;
+    if (!shouldTryNextRoute(rung.attempt.outcome)) break;
+  }
+  return {
+    response: originResponse,
+    attempts,
+    finalTier: originResponse !== null ? originTier : lastAttempt(attempts)?.tier ?? "direct",
+    ...originResponse === null && lastError !== void 0 ? { error: lastError } : {}
+  };
+}
+function lastAttempt(attempts) {
+  return attempts[attempts.length - 1];
+}
+function describeLadder(result) {
+  const rungs = result.attempts.map((a) => `${a.tier}:${a.outcome}${a.status ? `(${a.status})` : ""}@${a.ms}ms`);
+  return `${rungs.join(" \u2192 ")} | final=${result.finalTier}`;
+}
+function rescued(result) {
+  return result.attempts.some((attempt) => attempt.outcome === "ok");
+}
+function endedBlocked(result) {
+  if (rescued(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "blocked");
+}
+function endedProxyUnavailable(result) {
+  if (rescued(result) || endedBlocked(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "proxy_unavailable");
+}
+function endedPrivateAddress(result) {
+  if (rescued(result)) return false;
+  for (let error = result.error, depth = 0; error instanceof Error && depth < 5; depth++) {
+    if (error.message.includes(PRIVATE_ADDRESS_CODE)) return true;
+    error = error.cause;
+  }
+  return false;
+}
+
+// src/lib/externalFetch.ts
+var BROWSER_HEADERS = {
+  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
+  Accept: "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
+  "Accept-Language": "en-US,en;q=0.9"
+};
+var NOT_PUBLIC_MESSAGE = "That address is not reachable from the public web, so there is nothing to read.";
+var MAX_REMOTE_IMAGE_BYTES = 25e6;
+var ExternalFetchError = class extends Error {
+  /** True when the fault was ours — a route we could not open, not a dead host. */
+  ourFault;
+  constructor(message, ourFault) {
+    super(message);
+    this.name = "ExternalFetchError";
+    this.ourFault = ourFault;
+  }
+};
+async function fetchExternal(url, options = {}) {
+  if (refuseNonPublicUrl(url) !== null) {
+    throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+  }
+  const result = await fetchWithEscalation(
+    url,
+    { headers: { ...BROWSER_HEADERS, ...options.headers } },
+    {
+      credentials: captureProxyCredentials(),
+      ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+      ...options.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes },
+      ...options.sniffChallenge === void 0 ? {} : { sniffChallenge: options.sniffChallenge }
+    }
+  );
+  if (result.attempts.length > 1) {
+    process.stderr.write(`fetch ladder ${url} \u2014 ${describeLadder(result)}
+`);
+  }
+  if (result.response === null) {
+    if (endedPrivateAddress(result)) {
+      throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+    }
+    const ourFault = endedProxyUnavailable(result);
+    throw new ExternalFetchError(
+      ourFault ? "Could not open a route to that address." : "That address did not answer.",
+      ourFault
+    );
+  }
+  return { response: result.response, blocked: endedBlocked(result) };
+}
+function refuseOversize(bytes, maxBytes) {
+  if (bytes === null || bytes <= maxBytes) return null;
+  return `That file is ${humanBytes(bytes)} \u2014 the limit is ${humanBytes(maxBytes)}.`;
+}
+function humanBytes(n) {
+  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${Math.max(1, Math.round(n / 1024))} KB`;
+}
+function declaredBytes(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function fetchExternalBytes(url, options) {
+  const { response, blocked } = await fetchExternal(url, options);
+  if (!response.ok) {
+    throw new ExternalFetchError(`${response.status} ${response.statusText}`, false);
+  }
+  if (blocked) {
+    throw new ExternalFetchError("That host served a security check instead of the file.", false);
+  }
+  const declared = refuseOversize(declaredBytes(response), options.maxBytes);
+  if (declared !== null) {
+    throw new ExternalFetchError(declared, false);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const actual = refuseOversize(buffer.byteLength, options.maxBytes);
+  if (actual !== null) {
+    throw new ExternalFetchError(actual, false);
+  }
+  return { buffer, contentType: response.headers.get("content-type") };
+}
+
+export {
+  MAX_REMOTE_IMAGE_BYTES,
+  fetchExternalBytes
+};
+//# sourceMappingURL=chunk-L763CNKH.js.map