@kya-os/cli 1.5.9 → 1.6.0

package/dist/utils/dco/claude-config.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Claude Code integration: a managed block in CLAUDE.md instructs the agent
+ * harness to attribute PRs to the registered agent, and .claude/settings.json
+ * disables the stock "Generated with Claude Code" attribution.
+ *
+ * The PR byline can only be influenced through instructions because the PR
+ * body is composed by the model at PR time; commit trailers are enforced
+ * mechanically by the git hook instead (see git-config.ts).
+ */
+export declare const CLAUDE_MD_START = "<!-- mcpi:dco:start -->";
+export declare const CLAUDE_MD_END = "<!-- mcpi:dco:end -->";
+export interface AttributionBlockParams {
+    agentName: string;
+    agentUrl: string;
+    /**
+     * When the git hook could not be installed (foreign hook, unsafe
+     * core.hooksPath, or install failure), trailer duty falls back to
+     * instructions.
+     */
+    includeTrailerInstructions?: boolean;
+    humanName?: string;
+    humanEmail?: string;
+    agentEmail?: string;
+}
+export declare function buildAttributionBlock(params: AttributionBlockParams): string;
+export type UpsertResult = "created" | "updated" | "unchanged" | "would-change";
+export declare function upsertClaudeMdBlock(cwd: string, block: string, options?: {
+    dryRun?: boolean;
+}): {
+    result: UpsertResult;
+    path: string;
+};
+export type SettingsResult = "created" | "updated" | "unchanged" | "skipped-invalid" | "would-change";
+/**
+ * Set includeCoAuthoredBy: false in .claude/settings.json, preserving every
+ * other key. A file we cannot parse is left untouched: clobbering a user's
+ * settings is worse than leaving the stock byline on.
+ */
+export declare function updateClaudeSettings(cwd: string, options?: {
+    dryRun?: boolean;
+}): {
+    result: SettingsResult;
+    path: string;
+};
+//# sourceMappingURL=claude-config.d.ts.map

package/dist/utils/dco/claude-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AAEH,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAaD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAoB5E;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAC;AAEhF,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAiCxC;AAED,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,SAAS,GACT,WAAW,GACX,iBAAiB,GACjB,cAAc,CAAC;AAEnB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAqC1C"}

package/dist/utils/dco/claude-config.js

@@ -0,0 +1,112 @@
+import { existsSync, mkdirSync, readFileSync } from "fs";
+import { join } from "path";
+import { writeFileAtomicSafe } from "./fs-safe.js";
+/**
+ * Claude Code integration: a managed block in CLAUDE.md instructs the agent
+ * harness to attribute PRs to the registered agent, and .claude/settings.json
+ * disables the stock "Generated with Claude Code" attribution.
+ *
+ * The PR byline can only be influenced through instructions because the PR
+ * body is composed by the model at PR time; commit trailers are enforced
+ * mechanically by the git hook instead (see git-config.ts).
+ */
+export const CLAUDE_MD_START = "<!-- mcpi:dco:start -->";
+export const CLAUDE_MD_END = "<!-- mcpi:dco:end -->";
+/**
+ * Values interpolated into the managed block come from .mcpi/agent.json and
+ * git config, both attacker-influenceable in a cloned repo. Clamp everything
+ * to a single line with no control characters so crafted metadata cannot
+ * inject extra instructions into a block the harness treats as trusted.
+ */
+function singleLine(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+}
+export function buildAttributionBlock(params) {
+    const agentName = singleLine(params.agentName);
+    const agentUrl = singleLine(params.agentUrl);
+    const lines = [
+        CLAUDE_MD_START,
+        "## Agent attribution (managed by `mcpi dco setup`)",
+        "",
+        "- When creating pull requests, end the PR description with exactly this byline:",
+        `  \`Generated with [${agentName}](${agentUrl})\``,
+        '- Never add "Generated with Claude Code" or any other tool byline to PR descriptions or commit messages.',
+    ];
+    if (params.includeTrailerInstructions) {
+        lines.push("- End every commit message with these trailers:", `  \`Signed-off-by: ${singleLine(params.humanName ?? "")} <${singleLine(params.humanEmail ?? "")}>\``, `  \`Co-authored-by: ${agentName} <${singleLine(params.agentEmail ?? "")}>\``);
+    }
+    lines.push(CLAUDE_MD_END);
+    return lines.join("\n");
+}
+export function upsertClaudeMdBlock(cwd, block, options = {}) {
+    const path = join(cwd, "CLAUDE.md");
+    if (!existsSync(path)) {
+        if (options.dryRun) {
+            return { result: "would-change", path };
+        }
+        writeFileAtomicSafe(path, block + "\n");
+        return { result: "created", path };
+    }
+    const existing = readFileSync(path, "utf-8");
+    const startIdx = existing.indexOf(CLAUDE_MD_START);
+    const endIdx = existing.indexOf(CLAUDE_MD_END);
+    let next;
+    if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
+        const before = existing.slice(0, startIdx);
+        const after = existing.slice(endIdx + CLAUDE_MD_END.length);
+        next = before + block + after;
+    }
+    else {
+        const separator = existing.endsWith("\n") ? "\n" : "\n\n";
+        next = existing + separator + block + "\n";
+    }
+    if (next === existing) {
+        return { result: "unchanged", path };
+    }
+    if (options.dryRun) {
+        return { result: "would-change", path };
+    }
+    writeFileAtomicSafe(path, next);
+    return { result: "updated", path };
+}
+/**
+ * Set includeCoAuthoredBy: false in .claude/settings.json, preserving every
+ * other key. A file we cannot parse is left untouched: clobbering a user's
+ * settings is worse than leaving the stock byline on.
+ */
+export function updateClaudeSettings(cwd, options = {}) {
+    const dir = join(cwd, ".claude");
+    const path = join(dir, "settings.json");
+    let settings = {};
+    if (existsSync(path)) {
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return { result: "skipped-invalid", path };
+            }
+            settings = parsed;
+        }
+        catch {
+            return { result: "skipped-invalid", path };
+        }
+        if (settings.includeCoAuthoredBy === false) {
+            return { result: "unchanged", path };
+        }
+        if (options.dryRun) {
+            return { result: "would-change", path };
+        }
+        settings.includeCoAuthoredBy = false;
+        writeFileAtomicSafe(path, JSON.stringify(settings, null, 2) + "\n");
+        return { result: "updated", path };
+    }
+    if (options.dryRun) {
+        return { result: "would-change", path };
+    }
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    writeFileAtomicSafe(path, JSON.stringify({ includeCoAuthoredBy: false }, null, 2) + "\n");
+    return { result: "created", path };
+}
+//# sourceMappingURL=claude-config.js.map

package/dist/utils/dco/claude-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-config.js","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAgBrD;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,4CAA4C;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAa;QACtB,eAAe;QACf,oDAAoD;QACpD,EAAE;QACF,iFAAiF;QACjF,uBAAuB,SAAS,KAAK,QAAQ,KAAK;QAClD,0GAA0G;KAC3G,CAAC;IACF,IAAI,MAAM,CAAC,0BAA0B,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,iDAAiD,EACjD,sBAAsB,UAAU,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,KAAK,EACrG,uBAAuB,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,KAAK,CAC9E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,KAAa,EACb,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,mBAAmB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,QAAQ,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACrC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,mBAAmB,CACjB,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAC/D,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/utils/dco/fs-safe.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Atomic, symlink-safe file replace.
+ *
+ * For `mcpi dco`, the destination and its temp sibling live in the current
+ * working tree, which may be an untrusted cloned repo. A tracked symlink
+ * planted at the predictable `<path>.mcpi-tmp` sibling would otherwise make
+ * a plain writeFileSync follow it and clobber an arbitrary file the user can
+ * write. So: unlink any pre-existing temp (rmSync removes the link itself,
+ * never its target), then create it with O_EXCL (`wx`) so a planted or
+ * racing symlink makes the write fail closed instead of being followed.
+ * renameSync replaces the destination without following a symlink there.
+ */
+export declare function writeFileAtomicSafe(path: string, content: string, mode?: number): void;
+//# sourceMappingURL=fs-safe.d.ts.map

package/dist/utils/dco/fs-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-safe.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/fs-safe.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,SAAQ,GACX,IAAI,CAKN"}

package/dist/utils/dco/fs-safe.js

@@ -0,0 +1,20 @@
+import { renameSync, rmSync, writeFileSync } from "fs";
+/**
+ * Atomic, symlink-safe file replace.
+ *
+ * For `mcpi dco`, the destination and its temp sibling live in the current
+ * working tree, which may be an untrusted cloned repo. A tracked symlink
+ * planted at the predictable `<path>.mcpi-tmp` sibling would otherwise make
+ * a plain writeFileSync follow it and clobber an arbitrary file the user can
+ * write. So: unlink any pre-existing temp (rmSync removes the link itself,
+ * never its target), then create it with O_EXCL (`wx`) so a planted or
+ * racing symlink makes the write fail closed instead of being followed.
+ * renameSync replaces the destination without following a symlink there.
+ */
+export function writeFileAtomicSafe(path, content, mode = 0o644) {
+    const tempPath = `${path}.mcpi-tmp`;
+    rmSync(tempPath, { force: true });
+    writeFileSync(tempPath, content, { flag: "wx", mode });
+    renameSync(tempPath, path);
+}
+//# sourceMappingURL=fs-safe.js.map

package/dist/utils/dco/fs-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-safe.js","sourceRoot":"","sources":["../../../src/utils/dco/fs-safe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAAe,EACf,IAAI,GAAG,KAAK;IAEZ,MAAM,QAAQ,GAAG,GAAG,IAAI,WAAW,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/utils/dco/git-config.d.ts

@@ -0,0 +1,47 @@
+export declare const HOOK_MARKER = "# mcpi-dco-hook";
+export interface GitIdentity {
+    name: string;
+    email: string;
+}
+export declare function isGitRepo(cwd: string): Promise<boolean>;
+export declare function getGitConfigValue(key: string, cwd: string, scope?: "local" | "global"): Promise<string | null>;
+export declare function setGitConfig(entries: Record<string, string>, options: {
+    cwd: string;
+    global?: boolean;
+}): Promise<void>;
+export interface SigningConflict {
+    key: string;
+    current: string;
+    desired: string;
+}
+/**
+ * Detect pre-existing signing configuration that our setup would silently
+ * override, e.g. a user who already GPG-signs commits. Only differing values
+ * count; matching values mean a previous run and are fine to reapply.
+ *
+ * `scope` selects which config layer to read: the default (undefined) reads
+ * the effective value; "local" reads only repo-local entries, which is how a
+ * `--global` write detects repo-local values that would still shadow it.
+ */
+export declare function detectSigningConflicts(cwd: string, desired: Record<string, string>, scope?: "local" | "global"): Promise<SigningConflict[]>;
+export interface HooksDirInfo {
+    dir: string;
+    source: "core.hooksPath" | "default";
+}
+export declare function getHooksDir(cwd: string): Promise<HooksDirInfo>;
+export declare function buildTrailerHook(human: GitIdentity, agent: GitIdentity): string;
+export type HookInstallResult = "installed" | "updated" | "unchanged" | "foreign-hook" | "unsafe-hooks-path" | "would-change";
+/**
+ * Install (or refresh) the prepare-commit-msg trailer hook. A hook we did not
+ * write is never modified, and a core.hooksPath pointing outside the repo is
+ * never written to (a crafted repo config must not make us create files at
+ * arbitrary locations); the caller falls back to instruction-based trailers
+ * in both cases.
+ */
+export declare function installTrailerHook(cwd: string, human: GitIdentity, agent: GitIdentity, options?: {
+    dryRun?: boolean;
+}): Promise<{
+    result: HookInstallResult;
+    path: string;
+}>;
+//# sourceMappingURL=git-config.d.ts.map

package/dist/utils/dco/git-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAUD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM7D;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAS5B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACtC;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBpE;AAMD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,GACjB,MAAM,CAwBR;AAED,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,SAAS,GACT,WAAW,GACX,cAAc,GACd,mBAAmB,GACnB,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8CtD"}

package/dist/utils/dco/git-config.js

@@ -0,0 +1,159 @@
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { existsSync, mkdirSync, readFileSync, realpathSync } from "fs";
+import { isAbsolute, join, resolve, sep } from "path";
+import { writeFileAtomicSafe } from "./fs-safe.js";
+const execFileAsync = promisify(execFile);
+/** Resolve symlinks when the path exists; fall back to the input otherwise. */
+function realpathIfExists(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+export const HOOK_MARKER = "# mcpi-dco-hook";
+async function git(args, cwd) {
+    const { stdout } = await execFileAsync("git", args, {
+        cwd,
+        encoding: "utf8",
+    });
+    return stdout.trim();
+}
+export async function isGitRepo(cwd) {
+    try {
+        return (await git(["rev-parse", "--is-inside-work-tree"], cwd)) === "true";
+    }
+    catch {
+        return false;
+    }
+}
+export async function getGitConfigValue(key, cwd, scope) {
+    const args = ["config"];
+    if (scope) {
+        args.push(`--${scope}`);
+    }
+    args.push("--get", key);
+    try {
+        return await git(args, cwd);
+    }
+    catch {
+        return null;
+    }
+}
+export async function setGitConfig(entries, options) {
+    const scope = options.global ? "--global" : "--local";
+    for (const [key, value] of Object.entries(entries)) {
+        await git(["config", scope, key, value], options.cwd);
+    }
+}
+/**
+ * Detect pre-existing signing configuration that our setup would silently
+ * override, e.g. a user who already GPG-signs commits. Only differing values
+ * count; matching values mean a previous run and are fine to reapply.
+ *
+ * `scope` selects which config layer to read: the default (undefined) reads
+ * the effective value; "local" reads only repo-local entries, which is how a
+ * `--global` write detects repo-local values that would still shadow it.
+ */
+export async function detectSigningConflicts(cwd, desired, scope) {
+    const conflicts = [];
+    for (const [key, desiredValue] of Object.entries(desired)) {
+        const current = await getGitConfigValue(key, cwd, scope);
+        if (current !== null && current !== desiredValue) {
+            conflicts.push({ key, current, desired: desiredValue });
+        }
+    }
+    return conflicts;
+}
+export async function getHooksDir(cwd) {
+    const hooksPath = await getGitConfigValue("core.hooksPath", cwd);
+    if (hooksPath) {
+        // core.hooksPath is relative to the working-tree root, not cwd.
+        const topLevel = await git(["rev-parse", "--show-toplevel"], cwd);
+        const dir = isAbsolute(hooksPath) ? hooksPath : resolve(topLevel, hooksPath);
+        return { dir, source: "core.hooksPath" };
+    }
+    // --git-path resolves "hooks" against the COMMON git dir (where git actually
+    // runs hooks from, which matters in linked worktrees where the per-worktree
+    // git dir differs), and --path-format=absolute removes the cwd-relative
+    // ambiguity that made a bare --git-path point at the wrong directory from a
+    // subdirectory. Requires git >= 2.31, well below the >= 2.34 that SSH commit
+    // signing (the point of this feature) already needs.
+    const hooksDir = await git(["rev-parse", "--path-format=absolute", "--git-path", "hooks"], cwd);
+    return { dir: hooksDir, source: "default" };
+}
+function shQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+export function buildTrailerHook(human, agent) {
+    const signedOffBy = shQuote(`Signed-off-by: ${human.name} <${human.email}>`);
+    const coAuthoredBy = shQuote(`Co-authored-by: ${agent.name} <${agent.email}>`);
+    return `#!/bin/sh
+${HOOK_MARKER} v1
+# Managed by \`mcpi dco setup\`. Appends the DCO sign-off and agent
+# attribution trailers to commit messages when they are missing.
+
+COMMIT_MSG_FILE="$1"
+COMMIT_SOURCE="$2"
+
+case "$COMMIT_SOURCE" in
+  merge|squash)
+    exit 0
+    ;;
+esac
+
+git interpret-trailers --in-place --if-exists addIfDifferent \\
+  --trailer ${signedOffBy} \\
+  --trailer ${coAuthoredBy} \\
+  "$COMMIT_MSG_FILE"
+`;
+}
+/**
+ * Install (or refresh) the prepare-commit-msg trailer hook. A hook we did not
+ * write is never modified, and a core.hooksPath pointing outside the repo is
+ * never written to (a crafted repo config must not make us create files at
+ * arbitrary locations); the caller falls back to instruction-based trailers
+ * in both cases.
+ */
+export async function installTrailerHook(cwd, human, agent, options = {}) {
+    const { dir, source } = await getHooksDir(cwd);
+    const hookPath = join(dir, "prepare-commit-msg");
+    if (source === "core.hooksPath") {
+        const topLevel = realpathIfExists(await git(["rev-parse", "--show-toplevel"], cwd));
+        const gitDir = realpathIfExists(await git(["rev-parse", "--absolute-git-dir"], cwd));
+        const resolvedDir = realpathIfExists(dir);
+        const inside = (parent) => resolvedDir === parent || resolvedDir.startsWith(parent + sep);
+        if (!inside(topLevel) && !inside(gitDir)) {
+            return { result: "unsafe-hooks-path", path: hookPath };
+        }
+    }
+    const content = buildTrailerHook(human, agent);
+    if (existsSync(hookPath)) {
+        const existing = readFileSync(hookPath, "utf-8");
+        if (!existing.includes(HOOK_MARKER)) {
+            return { result: "foreign-hook", path: hookPath };
+        }
+        if (existing === content) {
+            return { result: "unchanged", path: hookPath };
+        }
+        if (options.dryRun) {
+            return { result: "would-change", path: hookPath };
+        }
+        // Symlink-safe: hookPath lives under a possibly-untrusted repo, and a
+        // planted symlink there would otherwise be followed. 0755 so git can
+        // execute the hook.
+        writeFileAtomicSafe(hookPath, content, 0o755);
+        return { result: "updated", path: hookPath };
+    }
+    if (options.dryRun) {
+        return { result: "would-change", path: hookPath };
+    }
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    writeFileAtomicSafe(hookPath, content, 0o755);
+    return { result: "installed", path: hookPath };
+}
+//# sourceMappingURL=git-config.js.map

package/dist/utils/dco/git-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-config.js","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAO7C,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG;QACH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAW,EACX,KAA0B;IAE1B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA+B,EAC/B,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,OAA+B,EAC/B,KAA0B;IAE1B,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,EAC9D,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAkB,EAClB,KAAkB;IAElB,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,CAC1B,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CACjD,CAAC;IACF,OAAO;EACP,WAAW;;;;;;;;;;;;;;cAcC,WAAW;cACX,YAAY;;CAEzB,CAAC;AACF,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAkB,EAClB,KAAkB,EAClB,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CACpD,CAAC;QACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,oBAAoB;QACpB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}

package/dist/utils/dco/github.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Thin wrapper around the GitHub CLI (`gh`). We deliberately shell out to gh
+ * instead of handling OAuth tokens ourselves: the user's existing gh auth is
+ * the credential, and it never passes through this process beyond gh's own
+ * environment.
+ */
+export declare const SIGNING_KEY_SCOPE = "admin:ssh_signing_key";
+export declare const SCOPE_REFRESH_COMMAND = "gh auth refresh -h github.com -s admin:ssh_signing_key";
+export declare class GhNotInstalledError extends Error {
+    constructor();
+}
+/**
+ * The default gh token does not include the admin:ssh_signing_key scope, so
+ * both listing and uploading signing keys fail until the user refreshes.
+ * GitHub reports the missing scope as HTTP 404 on these endpoints.
+ */
+export declare class GhScopeError extends Error {
+    readonly refreshCommand = "gh auth refresh -h github.com -s admin:ssh_signing_key";
+    constructor();
+}
+export interface GhUser {
+    login: string;
+    id: number;
+    name?: string | null;
+}
+export interface SigningKeyEntry {
+    id: number;
+    key: string;
+    title: string;
+}
+export declare function isGhInstalled(): Promise<boolean>;
+export declare function isGhAuthenticated(): Promise<boolean>;
+export declare function getGhUser(): Promise<GhUser>;
+/** GitHub's commit-attribution noreply address for the authenticated user. */
+export declare function githubNoreplyEmail(user: GhUser): string;
+export declare function listSigningKeys(): Promise<SigningKeyEntry[]>;
+export declare function uploadSigningKey(publicKeyLine: string, title: string): Promise<void>;
+/**
+ * Compare the base64 body of an authorized_keys style line against uploaded
+ * keys. GitHub returns keys without comments, so comparing the full line
+ * would always miss.
+ */
+export declare function signingKeyAlreadyUploaded(keys: SigningKeyEntry[], publicKeyLine: string): boolean;
+/**
+ * Run `gh auth refresh` interactively so the user can grant the signing key
+ * scope without leaving the flow. Requires a TTY; the caller must check.
+ */
+export declare function refreshAuthScope(): Promise<boolean>;
+//# sourceMappingURL=github.d.ts.map

package/dist/utils/dco/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/github.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AAEH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,eAAO,MAAM,qBAAqB,2DAA0D,CAAC;AAE7F,qBAAa,mBAAoB,SAAQ,KAAK;;CAO7C;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,cAAc,4DAAyB;;CAOjD;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AA+BD,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAOtD;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAU1D;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAYjD;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAalE;AAED,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,eAAe,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAWzD"}

package/dist/utils/dco/github.js

@@ -0,0 +1,154 @@
+import { execFile } from "child_process";
+import { promisify } from "util";
+const execFileAsync = promisify(execFile);
+/**
+ * Thin wrapper around the GitHub CLI (`gh`). We deliberately shell out to gh
+ * instead of handling OAuth tokens ourselves: the user's existing gh auth is
+ * the credential, and it never passes through this process beyond gh's own
+ * environment.
+ */
+export const SIGNING_KEY_SCOPE = "admin:ssh_signing_key";
+export const SCOPE_REFRESH_COMMAND = `gh auth refresh -h github.com -s ${SIGNING_KEY_SCOPE}`;
+export class GhNotInstalledError extends Error {
+    constructor() {
+        super("GitHub CLI (gh) is not installed. Install it from https://cli.github.com and run `gh auth login`.");
+        this.name = "GhNotInstalledError";
+    }
+}
+/**
+ * The default gh token does not include the admin:ssh_signing_key scope, so
+ * both listing and uploading signing keys fail until the user refreshes.
+ * GitHub reports the missing scope as HTTP 404 on these endpoints.
+ */
+export class GhScopeError extends Error {
+    constructor() {
+        super(`Your GitHub token is missing the ${SIGNING_KEY_SCOPE} scope. Run: ${SCOPE_REFRESH_COMMAND}`);
+        this.refreshCommand = SCOPE_REFRESH_COMMAND;
+        this.name = "GhScopeError";
+    }
+}
+async function gh(args) {
+    try {
+        const { stdout } = await execFileAsync("gh", args, {
+            encoding: "utf8",
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        return stdout;
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            throw new GhNotInstalledError();
+        }
+        throw error;
+    }
+}
+function isScopeError(error) {
+    const err = error;
+    const message = `${err?.stderr ?? ""} ${err?.message ?? ""}`;
+    // Deliberately narrow: never key off the bare 403 status, which GitHub
+    // also uses for rate limits and SSO enforcement where scope-refresh advice
+    // would be wrong. Only the explicit scope name, HTTP 404, or a "Resource
+    // not accessible" body count as scope problems.
+    return (message.includes(SIGNING_KEY_SCOPE) ||
+        /HTTP 404/.test(message) ||
+        /Resource not accessible/i.test(message));
+}
+export async function isGhInstalled() {
+    try {
+        await gh(["--version"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function isGhAuthenticated() {
+    try {
+        await gh(["auth", "status", "--hostname", "github.com"]);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof GhNotInstalledError) {
+            throw error;
+        }
+        return false;
+    }
+}
+export async function getGhUser() {
+    const stdout = await gh([
+        "api",
+        "user",
+        "--jq",
+        "{login: .login, id: .id, name: .name}",
+    ]);
+    const parsed = JSON.parse(stdout);
+    if (!parsed?.login || typeof parsed.id !== "number") {
+        throw new Error("Unexpected response from `gh api user`");
+    }
+    return parsed;
+}
+/** GitHub's commit-attribution noreply address for the authenticated user. */
+export function githubNoreplyEmail(user) {
+    return `${user.id}+${user.login}@users.noreply.github.com`;
+}
+export async function listSigningKeys() {
+    try {
+        const stdout = await gh(["api", "user/ssh_signing_keys", "--paginate"]);
+        return JSON.parse(stdout);
+    }
+    catch (error) {
+        if (error instanceof GhNotInstalledError) {
+            throw error;
+        }
+        if (isScopeError(error)) {
+            throw new GhScopeError();
+        }
+        throw error;
+    }
+}
+export async function uploadSigningKey(publicKeyLine, title) {
+    try {
+        await gh([
+            "api",
+            "user/ssh_signing_keys",
+            "-f",
+            `key=${publicKeyLine}`,
+            "-f",
+            `title=${title}`,
+        ]);
+    }
+    catch (error) {
+        if (error instanceof GhNotInstalledError) {
+            throw error;
+        }
+        if (isScopeError(error)) {
+            throw new GhScopeError();
+        }
+        throw error;
+    }
+}
+/**
+ * Compare the base64 body of an authorized_keys style line against uploaded
+ * keys. GitHub returns keys without comments, so comparing the full line
+ * would always miss.
+ */
+export function signingKeyAlreadyUploaded(keys, publicKeyLine) {
+    const body = publicKeyLine.split(/\s+/)[1];
+    if (!body) {
+        return false;
+    }
+    return keys.some((entry) => entry.key.split(/\s+/)[1] === body);
+}
+/**
+ * Run `gh auth refresh` interactively so the user can grant the signing key
+ * scope without leaving the flow. Requires a TTY; the caller must check.
+ */
+export async function refreshAuthScope() {
+    const { spawn } = await import("child_process");
+    return new Promise((resolve) => {
+        const child = spawn("gh", ["auth", "refresh", "-h", "github.com", "-s", SIGNING_KEY_SCOPE], { stdio: "inherit" });
+        child.on("error", () => resolve(false));
+        child.on("close", (code) => resolve(code === 0));
+    });
+}
+//# sourceMappingURL=github.js.map

package/dist/utils/dco/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/utils/dco/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,iBAAiB,EAAE,CAAC;AAE7F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C;QACE,KAAK,CACH,mGAAmG,CACpG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAErC;QACE,KAAK,CACH,oCAAoC,iBAAiB,gBAAgB,qBAAqB,EAAE,CAC7F,CAAC;QAJK,mBAAc,GAAG,qBAAqB,CAAC;QAK9C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAcD,KAAK,UAAU,EAAE,CAAC,IAAc;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;YACjD,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,KAA8C,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,MAAM,IAAI,EAAE,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;IAC7D,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gDAAgD;IAChD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;QACtB,KAAK;QACL,MAAM;QACN,MAAM;QACN,uCAAuC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAW,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,2BAA2B,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,uBAAuB,EAAE,YAAY,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,CAAC;YACP,KAAK;YACL,uBAAuB;YACvB,IAAI;YACJ,OAAO,aAAa,EAAE;YACtB,IAAI;YACJ,SAAS,KAAK,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAuB,EACvB,aAAqB;IAErB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CACjB,IAAI,EACJ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,CAAC,EAChE,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}