@kynver-app/runtime 0.1.103 → 0.1.105

package/dist/server/pr-evidence.js

@@ -0,0 +1,163 @@
+// src/vercel/vercel-url.ts
+var VERCEL_HOST_RE = /(^|\.)vercel\.app$/i;
+var DPL_ID_RE = /^dpl_[a-z0-9]+$/i;
+function tryParseUrl(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  try {
+    return new URL(trimmed);
+  } catch {
+    return null;
+  }
+}
+function parseDashboardDeployment(url) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length < 3) return null;
+  const deploymentId = parts[parts.length - 1]?.trim();
+  if (!deploymentId || deploymentId === "deployments") return null;
+  return deploymentId;
+}
+function parseDeploymentsSegment(url) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  const idx = parts.indexOf("deployments");
+  if (idx < 0 || idx >= parts.length - 1) return null;
+  const deploymentId = parts[idx + 1]?.trim();
+  return deploymentId || null;
+}
+function classifyVercelUrl(raw) {
+  const empty = {
+    kind: "unknown",
+    previewUrl: null,
+    inspectTarget: null,
+    deploymentId: null
+  };
+  const trimmed = raw.trim();
+  if (!trimmed) return empty;
+  if (/^dpl_[a-z0-9]+$/i.test(trimmed)) {
+    return {
+      kind: "deployment_id",
+      previewUrl: null,
+      inspectTarget: trimmed,
+      deploymentId: trimmed
+    };
+  }
+  const url = tryParseUrl(trimmed);
+  if (!url) return empty;
+  if (VERCEL_HOST_RE.test(url.hostname)) {
+    const hostUrl = url.origin;
+    return {
+      kind: "deployment_host",
+      previewUrl: hostUrl,
+      inspectTarget: hostUrl,
+      deploymentId: null
+    };
+  }
+  if (url.hostname === "vercel.com" || url.hostname.endsWith(".vercel.com")) {
+    const deploymentId = parseDeploymentsSegment(url) ?? parseDashboardDeployment(url);
+    const inspectTarget = deploymentId && DPL_ID_RE.test(deploymentId) ? deploymentId : null;
+    return {
+      kind: "dashboard",
+      previewUrl: null,
+      inspectTarget,
+      deploymentId
+    };
+  }
+  return empty;
+}
+
+// src/vercel/vercel-github-status.ts
+var VERCEL_CONTEXT_RE = /vercel/i;
+function normalizeGitHubStatusState(state) {
+  const value = typeof state === "string" ? state.trim().toLowerCase() : "";
+  if (value === "success") return "success";
+  if (value === "pending") return "pending";
+  if (value === "failure") return "failure";
+  if (value === "error") return "error";
+  return "unknown";
+}
+function isVercelStatusContext(context) {
+  const label = typeof context === "string" ? context.trim() : "";
+  return Boolean(label && VERCEL_CONTEXT_RE.test(label));
+}
+function pickVercelStatusContext(statuses) {
+  const rows = Array.isArray(statuses) ? statuses : [];
+  const vercelRows = rows.filter((row) => isVercelStatusContext(row.context));
+  if (vercelRows.length === 0) return null;
+  const score = (state) => {
+    if (state === "failure" || state === "error") return 0;
+    if (state === "pending") return 1;
+    if (state === "success") return 2;
+    return 1;
+  };
+  let best = null;
+  let bestScore = Infinity;
+  for (const row of vercelRows) {
+    const rowScore = score(normalizeGitHubStatusState(row.state));
+    if (rowScore < bestScore) {
+      best = row;
+      bestScore = rowScore;
+    }
+  }
+  if (!best) return null;
+  const targetUrl = typeof best.target_url === "string" && best.target_url.trim() ? best.target_url.trim() : null;
+  const classified = targetUrl ? classifyVercelUrl(targetUrl) : null;
+  return {
+    context: String(best.context ?? "Vercel").trim(),
+    state: normalizeGitHubStatusState(best.state),
+    targetUrl,
+    description: typeof best.description === "string" && best.description.trim() ? best.description.trim() : null,
+    deploymentId: classified?.deploymentId ?? null,
+    previewUrl: classified?.previewUrl ?? null,
+    dashboardUrl: classified?.kind === "dashboard" ? targetUrl : null
+  };
+}
+
+// src/vercel/vercel-evidence.ts
+function mapGitHubStateToEvidence(state) {
+  if (state === "success") return "ready";
+  if (state === "pending") return "building";
+  if (state === "failure" || state === "error") return "error";
+  return "unavailable";
+}
+function evidenceSummary(parts) {
+  return parts.filter(Boolean).join("; ");
+}
+function evidenceFromGitHubVercelStatus(statuses, options = {}) {
+  const observedAt = options.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const row = pickVercelStatusContext(statuses);
+  if (!row) {
+    return {
+      status: "not_run",
+      previewUrl: null,
+      deploymentUrl: null,
+      summary: "No Vercel GitHub status context on commit",
+      observedAt,
+      inspectSkipped: true,
+      inspectReason: "no_vercel_status_context",
+      githubState: null,
+      vercelContext: null
+    };
+  }
+  const status = mapGitHubStateToEvidence(row.state);
+  const previewUrl = row.previewUrl ?? row.dashboardUrl;
+  const deploymentUrl = row.previewUrl ?? row.dashboardUrl;
+  return {
+    status,
+    previewUrl,
+    deploymentUrl,
+    summary: evidenceSummary([
+      `GitHub ${row.context}=${row.state}`,
+      row.description ?? "",
+      row.dashboardUrl ? "dashboard target_url (API lookup skipped)" : ""
+    ]),
+    observedAt,
+    inspectSkipped: true,
+    inspectReason: row.dashboardUrl && row.state === "success" ? "trusted_github_status_dashboard_url" : row.dashboardUrl ? "dashboard_url_not_api_inspectable" : "github_status_only",
+    githubState: row.state,
+    vercelContext: row.context
+  };
+}
+export {
+  evidenceFromGitHubVercelStatus
+};
+//# sourceMappingURL=pr-evidence.js.map

package/dist/server/pr-evidence.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/vercel/vercel-url.ts", "../../src/vercel/vercel-github-status.ts", "../../src/vercel/vercel-evidence.ts"],
+  "sourcesContent": ["// Classify Vercel URLs from GitHub StatusContext.target_url for REST API lookup vs trust-github.\r\n\r\nexport type VercelUrlKind =\r\n  | \"deployment_host\"\r\n  | \"dashboard\"\r\n  | \"deployment_id\"\r\n  | \"unknown\";\r\n\r\nexport interface ClassifiedVercelUrl {\r\n  kind: VercelUrlKind;\r\n  /** Original URL when it is a usable preview/deployment host. */\r\n  previewUrl: string | null;\r\n  /** Deployment id or host URL suitable for Vercel REST API lookup \u2014 never a dashboard page URL. */\r\n  inspectTarget: string | null;\r\n  /** Deployment id extracted from dashboard paths when present. */\r\n  deploymentId: string | null;\r\n}\r\n\r\nconst VERCEL_HOST_RE = /(^|\\.)vercel\\.app$/i;\r\nconst DPL_ID_RE = /^dpl_[a-z0-9]+$/i;\r\n\r\n/** True when the string is safe for Vercel REST API deployment lookup (never a dashboard page URL). */\r\nexport function isInspectableVercelTarget(target: string): boolean {\r\n  const trimmed = target.trim();\r\n  if (!trimmed) return false;\r\n  if (/vercel\\.com/i.test(trimmed)) return false;\r\n  if (DPL_ID_RE.test(trimmed)) return true;\r\n  try {\r\n    const url = new URL(trimmed.startsWith(\"http\") ? trimmed : `https://${trimmed}`);\r\n    return VERCEL_HOST_RE.test(url.hostname);\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\nfunction tryParseUrl(raw: string): URL | null {\r\n  const trimmed = raw.trim();\r\n  if (!trimmed) return null;\r\n  try {\r\n    return new URL(trimmed);\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\n/** Dashboard deployment pages: /{team}/{project}/{deploymentId} */\r\nfunction parseDashboardDeployment(url: URL): string | null {\r\n  const parts = url.pathname.split(\"/\").filter(Boolean);\r\n  if (parts.length < 3) return null;\r\n  const deploymentId = parts[parts.length - 1]?.trim();\r\n  if (!deploymentId || deploymentId === \"deployments\") return null;\r\n  return deploymentId;\r\n}\r\n\r\n/** Alternate dashboard shape: .../deployments/{id} */\r\nfunction parseDeploymentsSegment(url: URL): string | null {\r\n  const parts = url.pathname.split(\"/\").filter(Boolean);\r\n  const idx = parts.indexOf(\"deployments\");\r\n  if (idx < 0 || idx >= parts.length - 1) return null;\r\n  const deploymentId = parts[idx + 1]?.trim();\r\n  return deploymentId || null;\r\n}\r\n\r\n/**\r\n * Classify a Vercel-related URL from GitHub commit status target_url.\r\n * Vercel REST API accepts deployment ids and `*.vercel.app` hosts \u2014 not vercel.com dashboard links.\r\n */\r\nexport function classifyVercelUrl(raw: string): ClassifiedVercelUrl {\r\n  const empty: ClassifiedVercelUrl = {\r\n    kind: \"unknown\",\r\n    previewUrl: null,\r\n    inspectTarget: null,\r\n    deploymentId: null,\r\n  };\r\n\r\n  const trimmed = raw.trim();\r\n  if (!trimmed) return empty;\r\n\r\n  if (/^dpl_[a-z0-9]+$/i.test(trimmed)) {\r\n    return {\r\n      kind: \"deployment_id\",\r\n      previewUrl: null,\r\n      inspectTarget: trimmed,\r\n      deploymentId: trimmed,\r\n    };\r\n  }\r\n\r\n  const url = tryParseUrl(trimmed);\r\n  if (!url) return empty;\r\n\r\n  if (VERCEL_HOST_RE.test(url.hostname)) {\r\n    const hostUrl = url.origin;\r\n    return {\r\n      kind: \"deployment_host\",\r\n      previewUrl: hostUrl,\r\n      inspectTarget: hostUrl,\r\n      deploymentId: null,\r\n    };\r\n  }\r\n\r\n  if (url.hostname === \"vercel.com\" || url.hostname.endsWith(\".vercel.com\")) {\r\n    const deploymentId =\r\n      parseDeploymentsSegment(url) ?? parseDashboardDeployment(url);\r\n    const inspectTarget =\r\n      deploymentId && DPL_ID_RE.test(deploymentId) ? deploymentId : null;\r\n    return {\r\n      kind: \"dashboard\",\r\n      previewUrl: null,\r\n      inspectTarget,\r\n      deploymentId,\r\n    };\r\n  }\r\n\r\n  return empty;\r\n}\r\n\r\nexport function isDashboardVercelUrl(raw: string): boolean {\r\n  return classifyVercelUrl(raw).kind === \"dashboard\";\r\n}\r\n", "// GitHub commit StatusContext rows for the Vercel GitHub app integration.\r\n\r\nimport { classifyVercelUrl } from \"./vercel-url.js\";\r\n\r\nexport type GitHubStatusState = \"success\" | \"pending\" | \"failure\" | \"error\" | \"unknown\";\r\n\r\nexport interface GitHubCommitStatusRow {\r\n  context?: string | null;\r\n  state?: string | null;\r\n  target_url?: string | null;\r\n  description?: string | null;\r\n}\r\n\r\nexport interface GitHubVercelStatusContext {\r\n  context: string;\r\n  state: GitHubStatusState;\r\n  targetUrl: string | null;\r\n  description: string | null;\r\n  deploymentId: string | null;\r\n  previewUrl: string | null;\r\n  dashboardUrl: string | null;\r\n}\r\n\r\nconst VERCEL_CONTEXT_RE = /vercel/i;\r\n\r\nexport function normalizeGitHubStatusState(state: unknown): GitHubStatusState {\r\n  const value = typeof state === \"string\" ? state.trim().toLowerCase() : \"\";\r\n  if (value === \"success\") return \"success\";\r\n  if (value === \"pending\") return \"pending\";\r\n  if (value === \"failure\") return \"failure\";\r\n  if (value === \"error\") return \"error\";\r\n  return \"unknown\";\r\n}\r\n\r\nexport function isVercelStatusContext(context: unknown): boolean {\r\n  const label = typeof context === \"string\" ? context.trim() : \"\";\r\n  return Boolean(label && VERCEL_CONTEXT_RE.test(label));\r\n}\r\n\r\nexport function pickVercelStatusContext(\r\n  statuses: GitHubCommitStatusRow[] | null | undefined,\r\n): GitHubVercelStatusContext | null {\r\n  const rows = Array.isArray(statuses) ? statuses : [];\r\n  const vercelRows = rows.filter((row) => isVercelStatusContext(row.context));\r\n  if (vercelRows.length === 0) return null;\r\n\r\n  const score = (state: GitHubStatusState): number => {\r\n    if (state === \"failure\" || state === \"error\") return 0;\r\n    if (state === \"pending\") return 1;\r\n    if (state === \"success\") return 2;\r\n    return 1;\r\n  };\r\n\r\n  let best: GitHubCommitStatusRow | null = null;\r\n  let bestScore = Infinity;\r\n  for (const row of vercelRows) {\r\n    const rowScore = score(normalizeGitHubStatusState(row.state));\r\n    if (rowScore < bestScore) {\r\n      best = row;\r\n      bestScore = rowScore;\r\n    }\r\n  }\r\n  if (!best) return null;\r\n\r\n  const targetUrl =\r\n    typeof best.target_url === \"string\" && best.target_url.trim()\r\n      ? best.target_url.trim()\r\n      : null;\r\n  const classified = targetUrl ? classifyVercelUrl(targetUrl) : null;\r\n\r\n  return {\r\n    context: String(best.context ?? \"Vercel\").trim(),\r\n    state: normalizeGitHubStatusState(best.state),\r\n    targetUrl,\r\n    description:\r\n      typeof best.description === \"string\" && best.description.trim()\r\n        ? best.description.trim()\r\n        : null,\r\n    deploymentId: classified?.deploymentId ?? null,\r\n    previewUrl: classified?.previewUrl ?? null,\r\n    dashboardUrl: classified?.kind === \"dashboard\" ? targetUrl : null,\r\n  };\r\n}\r\n", "// Build merge-gate Vercel evidence from GitHub status and optional Vercel REST API.\r\n\r\nimport {\r\n  fetchVercelDeploymentStatus,\r\n  mapVercelReadyStateToEvidenceStatus,\r\n  type VercelDeploymentLookupResult,\r\n} from \"./vercel-api.js\";\r\nimport {\r\n  pickVercelStatusContext,\r\n  type GitHubCommitStatusRow,\r\n  type GitHubStatusState,\r\n  type GitHubVercelStatusContext,\r\n} from \"./vercel-github-status.js\";\r\nimport {\r\n  classifyVercelUrl,\r\n  isInspectableVercelTarget,\r\n  type ClassifiedVercelUrl,\r\n} from \"./vercel-url.js\";\r\n\r\nexport type VercelEvidenceStatus =\r\n  | \"ready\"\r\n  | \"building\"\r\n  | \"error\"\r\n  | \"unavailable\"\r\n  | \"not_run\";\r\n\r\nexport interface VercelEvidenceResult {\r\n  status: VercelEvidenceStatus;\r\n  previewUrl: string | null;\r\n  deploymentUrl: string | null;\r\n  summary: string | null;\r\n  observedAt: string | null;\r\n  /** True when Vercel API lookup was not run (GitHub-only or missing token). */\r\n  inspectSkipped: boolean;\r\n  inspectReason: string | null;\r\n  githubState: GitHubStatusState | null;\r\n  vercelContext: string | null;\r\n}\r\n\r\n/** @deprecated Renamed \u2014 use VercelDeploymentLookupResult from vercel-api. */\r\nexport type VercelInspectCommandResult = VercelDeploymentLookupResult;\r\n\r\nexport type RunVercelDeploymentLookup = (\r\n  target: string,\r\n) => Promise<VercelDeploymentLookupResult>;\r\n\r\n/** @deprecated Renamed \u2014 use RunVercelDeploymentLookup. */\r\nexport type RunVercelInspect = RunVercelDeploymentLookup;\r\n\r\nfunction mapGitHubStateToEvidence(state: GitHubStatusState): VercelEvidenceStatus {\r\n  if (state === \"success\") return \"ready\";\r\n  if (state === \"pending\") return \"building\";\r\n  if (state === \"failure\" || state === \"error\") return \"error\";\r\n  return \"unavailable\";\r\n}\r\n\r\nfunction evidenceSummary(parts: string[]): string {\r\n  return parts.filter(Boolean).join(\"; \");\r\n}\r\n\r\n/**\r\n * Resolve the deployment lookup target. Never returns a vercel.com dashboard page URL.\r\n */\r\nexport function resolveVercelInspectTarget(rawUrl: string | null | undefined): {\r\n  target: string | null;\r\n  classified: ClassifiedVercelUrl | null;\r\n  reason: string | null;\r\n} {\r\n  const trimmed = typeof rawUrl === \"string\" ? rawUrl.trim() : \"\";\r\n  if (!trimmed) {\r\n    return { target: null, classified: null, reason: \"missing target_url\" };\r\n  }\r\n\r\n  const classified = classifyVercelUrl(trimmed);\r\n  if (classified.inspectTarget && isInspectableVercelTarget(classified.inspectTarget)) {\r\n    return { target: classified.inspectTarget, classified, reason: null };\r\n  }\r\n\r\n  if (classified.kind === \"dashboard\") {\r\n    return {\r\n      target: null,\r\n      classified,\r\n      reason: classified.deploymentId\r\n        ? \"dashboard deployment id is not API-inspectable; trust GitHub Vercel status\"\r\n        : \"dashboard URL is not valid for Vercel API lookup\",\r\n    };\r\n  }\r\n\r\n  return { target: null, classified, reason: \"unrecognized Vercel URL\" };\r\n}\r\n\r\nexport function evidenceFromGitHubVercelStatus(\r\n  statuses: GitHubCommitStatusRow[] | null | undefined,\r\n  options: { observedAt?: string } = {},\r\n): VercelEvidenceResult {\r\n  const observedAt = options.observedAt ?? new Date().toISOString();\r\n  const row = pickVercelStatusContext(statuses);\r\n\r\n  if (!row) {\r\n    return {\r\n      status: \"not_run\",\r\n      previewUrl: null,\r\n      deploymentUrl: null,\r\n      summary: \"No Vercel GitHub status context on commit\",\r\n      observedAt,\r\n      inspectSkipped: true,\r\n      inspectReason: \"no_vercel_status_context\",\r\n      githubState: null,\r\n      vercelContext: null,\r\n    };\r\n  }\r\n\r\n  const status = mapGitHubStateToEvidence(row.state);\r\n  const previewUrl = row.previewUrl ?? row.dashboardUrl;\r\n  const deploymentUrl = row.previewUrl ?? row.dashboardUrl;\r\n\r\n  return {\r\n    status,\r\n    previewUrl,\r\n    deploymentUrl,\r\n    summary: evidenceSummary([\r\n      `GitHub ${row.context}=${row.state}`,\r\n      row.description ?? \"\",\r\n      row.dashboardUrl ? \"dashboard target_url (API lookup skipped)\" : \"\",\r\n    ]),\r\n    observedAt,\r\n    inspectSkipped: true,\r\n    inspectReason:\r\n      row.dashboardUrl && row.state === \"success\"\r\n        ? \"trusted_github_status_dashboard_url\"\r\n        : row.dashboardUrl\r\n          ? \"dashboard_url_not_api_inspectable\"\r\n          : \"github_status_only\",\r\n    githubState: row.state,\r\n    vercelContext: row.context,\r\n  };\r\n}\r\n\r\nexport interface CollectVercelEvidenceInput {\r\n  statuses?: GitHubCommitStatusRow[] | null;\r\n  /** When false, never call Vercel REST API (GitHub status only). Default path. */\r\n  allowInspect?: boolean;\r\n  /** @deprecated waitSeconds was for CLI inspect; ignored for API lookup. */\r\n  waitSeconds?: number;\r\n  runInspect?: RunVercelDeploymentLookup;\r\n  observedAt?: string;\r\n}\r\n\r\n/**\r\n * Prefer GitHub Vercel StatusContext.state for gates. Call Vercel REST API only when\r\n * inspectable (deployment host or id), GitHub state is not terminal success, and\r\n * `allowInspect` is true with VERCEL_TOKEN configured.\r\n */\r\nexport async function collectVercelEvidence(\r\n  input: CollectVercelEvidenceInput,\r\n): Promise<VercelEvidenceResult> {\r\n  const observedAt = input.observedAt ?? new Date().toISOString();\r\n  const base = evidenceFromGitHubVercelStatus(input.statuses ?? [], { observedAt });\r\n  const row = pickVercelStatusContext(input.statuses ?? []);\r\n\r\n  if (!row) return base;\r\n\r\n  if (row.state === \"success\") {\r\n    return {\r\n      ...base,\r\n      inspectSkipped: true,\r\n      inspectReason: row.dashboardUrl\r\n        ? \"trusted_github_status_dashboard_url\"\r\n        : \"trusted_github_status\",\r\n    };\r\n  }\r\n\r\n  if (!input.allowInspect) {\r\n    return {\r\n      ...base,\r\n      inspectSkipped: true,\r\n      inspectReason: \"api_lookup_disabled\",\r\n    };\r\n  }\r\n\r\n  const { target, reason } = resolveVercelInspectTarget(row.targetUrl);\r\n  if (!target) {\r\n    return {\r\n      ...base,\r\n      inspectSkipped: true,\r\n      inspectReason: reason ?? \"not_api_inspectable\",\r\n      summary: evidenceSummary([\r\n        base.summary ?? \"\",\r\n        reason ?? \"skipped Vercel API lookup\",\r\n      ]),\r\n    };\r\n  }\r\n\r\n  const runLookup = input.runInspect ?? fetchVercelDeploymentStatus;\r\n  const lookedUp = await runLookup(target);\r\n  const observed = new Date().toISOString();\r\n\r\n  if (!lookedUp.ok && lookedUp.error?.includes(\"VERCEL_TOKEN\")) {\r\n    return {\r\n      status: \"unavailable\",\r\n      previewUrl: base.previewUrl,\r\n      deploymentUrl: base.deploymentUrl,\r\n      summary: \"VERCEL_TOKEN not configured for API fallback\",\r\n      observedAt: observed,\r\n      inspectSkipped: true,\r\n      inspectReason: \"vercel_token_missing\",\r\n      githubState: row.state,\r\n      vercelContext: row.context,\r\n    };\r\n  }\r\n\r\n  if (!lookedUp.ok) {\r\n    return {\r\n      status: row.state === \"pending\" ? \"building\" : \"error\",\r\n      previewUrl: base.previewUrl,\r\n      deploymentUrl: target.startsWith(\"http\") ? target : base.deploymentUrl,\r\n      summary: evidenceSummary([\r\n        `Vercel API lookup ${target} failed`,\r\n        lookedUp.error ?? \"\",\r\n      ]),\r\n      observedAt: observed,\r\n      inspectSkipped: false,\r\n      inspectReason: null,\r\n      githubState: row.state,\r\n      vercelContext: row.context,\r\n    };\r\n  }\r\n\r\n  const mapped = mapVercelReadyStateToEvidenceStatus(\r\n    lookedUp.readyState,\r\n    row.state === \"pending\",\r\n  );\r\n  const previewUrl =\r\n    lookedUp.previewUrl ??\r\n    (target.startsWith(\"http\") ? target : base.previewUrl);\r\n\r\n  return {\r\n    status: mapped,\r\n    previewUrl,\r\n    deploymentUrl: previewUrl ?? base.deploymentUrl,\r\n    summary: evidenceSummary([\r\n      `Vercel API ${target}=${lookedUp.readyState ?? \"unknown\"}`,\r\n      mapped === \"ready\" ? \"preview ready\" : \"\",\r\n    ]),\r\n    observedAt: observed,\r\n    inspectSkipped: false,\r\n    inspectReason: null,\r\n    githubState: row.state,\r\n    vercelContext: row.context,\r\n  };\r\n}\r\n\r\nexport type { GitHubVercelStatusContext };\r\n"],
+  "mappings": ";AAkBA,IAAM,iBAAiB;AACvB,IAAM,YAAY;AAgBlB,SAAS,YAAY,KAAyB;AAC5C,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,WAAO,IAAI,IAAI,OAAO;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,yBAAyB,KAAyB;AACzD,QAAM,QAAQ,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,QAAM,eAAe,MAAM,MAAM,SAAS,CAAC,GAAG,KAAK;AACnD,MAAI,CAAC,gBAAgB,iBAAiB,cAAe,QAAO;AAC5D,SAAO;AACT;AAGA,SAAS,wBAAwB,KAAyB;AACxD,QAAM,QAAQ,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,QAAM,MAAM,MAAM,QAAQ,aAAa;AACvC,MAAI,MAAM,KAAK,OAAO,MAAM,SAAS,EAAG,QAAO;AAC/C,QAAM,eAAe,MAAM,MAAM,CAAC,GAAG,KAAK;AAC1C,SAAO,gBAAgB;AACzB;AAMO,SAAS,kBAAkB,KAAkC;AAClE,QAAM,QAA6B;AAAA,IACjC,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,eAAe;AAAA,IACf,cAAc;AAAA,EAChB;AAEA,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI,mBAAmB,KAAK,OAAO,GAAG;AACpC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,cAAc;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,MAAM,YAAY,OAAO;AAC/B,MAAI,CAAC,IAAK,QAAO;AAEjB,MAAI,eAAe,KAAK,IAAI,QAAQ,GAAG;AACrC,UAAM,UAAU,IAAI;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,cAAc;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,IAAI,aAAa,gBAAgB,IAAI,SAAS,SAAS,aAAa,GAAG;AACzE,UAAM,eACJ,wBAAwB,GAAG,KAAK,yBAAyB,GAAG;AAC9D,UAAM,gBACJ,gBAAgB,UAAU,KAAK,YAAY,IAAI,eAAe;AAChE,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;AC3FA,IAAM,oBAAoB;AAEnB,SAAS,2BAA2B,OAAmC;AAC5E,QAAM,QAAQ,OAAO,UAAU,WAAW,MAAM,KAAK,EAAE,YAAY,IAAI;AACvE,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,UAAU,QAAS,QAAO;AAC9B,SAAO;AACT;AAEO,SAAS,sBAAsB,SAA2B;AAC/D,QAAM,QAAQ,OAAO,YAAY,WAAW,QAAQ,KAAK,IAAI;AAC7D,SAAO,QAAQ,SAAS,kBAAkB,KAAK,KAAK,CAAC;AACvD;AAEO,SAAS,wBACd,UACkC;AAClC,QAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AACnD,QAAM,aAAa,KAAK,OAAO,CAAC,QAAQ,sBAAsB,IAAI,OAAO,CAAC;AAC1E,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,QAAQ,CAAC,UAAqC;AAClD,QAAI,UAAU,aAAa,UAAU,QAAS,QAAO;AACrD,QAAI,UAAU,UAAW,QAAO;AAChC,QAAI,UAAU,UAAW,QAAO;AAChC,WAAO;AAAA,EACT;AAEA,MAAI,OAAqC;AACzC,MAAI,YAAY;AAChB,aAAW,OAAO,YAAY;AAC5B,UAAM,WAAW,MAAM,2BAA2B,IAAI,KAAK,CAAC;AAC5D,QAAI,WAAW,WAAW;AACxB,aAAO;AACP,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,YACJ,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,IACxD,KAAK,WAAW,KAAK,IACrB;AACN,QAAM,aAAa,YAAY,kBAAkB,SAAS,IAAI;AAE9D,SAAO;AAAA,IACL,SAAS,OAAO,KAAK,WAAW,QAAQ,EAAE,KAAK;AAAA,IAC/C,OAAO,2BAA2B,KAAK,KAAK;AAAA,IAC5C;AAAA,IACA,aACE,OAAO,KAAK,gBAAgB,YAAY,KAAK,YAAY,KAAK,IAC1D,KAAK,YAAY,KAAK,IACtB;AAAA,IACN,cAAc,YAAY,gBAAgB;AAAA,IAC1C,YAAY,YAAY,cAAc;AAAA,IACtC,cAAc,YAAY,SAAS,cAAc,YAAY;AAAA,EAC/D;AACF;;;ACjCA,SAAS,yBAAyB,OAAgD;AAChF,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,UAAU,UAAW,QAAO;AAChC,MAAI,UAAU,aAAa,UAAU,QAAS,QAAO;AACrD,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SAAO,MAAM,OAAO,OAAO,EAAE,KAAK,IAAI;AACxC;AAiCO,SAAS,+BACd,UACA,UAAmC,CAAC,GACd;AACtB,QAAM,aAAa,QAAQ,eAAc,oBAAI,KAAK,GAAE,YAAY;AAChE,QAAM,MAAM,wBAAwB,QAAQ;AAE5C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,SAAS;AAAA,MACT;AAAA,MACA,gBAAgB;AAAA,MAChB,eAAe;AAAA,MACf,aAAa;AAAA,MACb,eAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,SAAS,yBAAyB,IAAI,KAAK;AACjD,QAAM,aAAa,IAAI,cAAc,IAAI;AACzC,QAAM,gBAAgB,IAAI,cAAc,IAAI;AAE5C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,gBAAgB;AAAA,MACvB,UAAU,IAAI,OAAO,IAAI,IAAI,KAAK;AAAA,MAClC,IAAI,eAAe;AAAA,MACnB,IAAI,eAAe,8CAA8C;AAAA,IACnE,CAAC;AAAA,IACD;AAAA,IACA,gBAAgB;AAAA,IAChB,eACE,IAAI,gBAAgB,IAAI,UAAU,YAC9B,wCACA,IAAI,eACF,sCACA;AAAA,IACR,aAAa,IAAI;AAAA,IACjB,eAAe,IAAI;AAAA,EACrB;AACF;",
+  "names": []
+}

package/dist/server/repo-search.d.ts

@@ -0,0 +1 @@
+export { classifyRepoSearchMeta, diagnoseRepoSearchFailure, extractSearchMetaFromToolLine, formatRepoSearchGuidance, } from "../repo-search.js";

package/dist/server/repo-search.js

@@ -0,0 +1,224 @@
+// src/repo-search.ts
+var RG_BINARIES = /* @__PURE__ */ new Set(["rg", "ripgrep", "grep"]);
+var RG_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "-e",
+  "--regexp",
+  "-f",
+  "--file",
+  "-m",
+  "--max-count",
+  "-A",
+  "--after-context",
+  "-B",
+  "--before-context",
+  "-C",
+  "--context",
+  "-g",
+  "--glob",
+  "--iglob"
+]);
+function binaryName(token) {
+  if (!token) return null;
+  const base = token.split("/").pop() ?? token;
+  return base.replace(/\.exe$/i, "").toLowerCase();
+}
+function splitShellWords(input) {
+  if (!input) return [];
+  const words = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  for (const char of input) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = void 0;
+      else current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current) {
+        words.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (current) words.push(current);
+  return words;
+}
+function isRgArgv(argv) {
+  const bin = binaryName(argv[0]);
+  return Boolean(bin && RG_BINARIES.has(bin));
+}
+function isSingleFileSearchTarget(target) {
+  if (!target || target.includes("/") || target.includes("*")) return false;
+  return /\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(target);
+}
+function isRgExcludeScopeTarget(target) {
+  if (!target) return false;
+  const t = target.trim();
+  return t.startsWith("!") && !t.includes("/") && !t.endsWith("/**");
+}
+function fixRgGlobToken(token) {
+  if (!token.startsWith("--glob=")) return token;
+  const value = token.slice("--glob=".length);
+  if (value.startsWith("!") && !value.includes("/") && !value.endsWith("/**")) {
+    return `--glob=${value}/**`;
+  }
+  return token;
+}
+function collectRgPositional(argv) {
+  const positional = [];
+  for (let i = 1; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token) continue;
+    if (token === "--") {
+      positional.push(...argv.slice(i + 1));
+      break;
+    }
+    if (token.startsWith("-")) {
+      if (token.includes("=")) continue;
+      if (RG_OPTS_WITH_VALUE.has(token)) i += 1;
+      continue;
+    }
+    positional.push(token);
+  }
+  return positional;
+}
+function normalizeRgArgv(argv) {
+  let changed = false;
+  const out = argv.map((token) => {
+    const fixed = fixRgGlobToken(token);
+    if (fixed !== token) changed = true;
+    return fixed;
+  });
+  const positional = collectRgPositional(out);
+  if (positional.length === 2) {
+    const [pattern, target] = positional;
+    if (isSingleFileSearchTarget(target)) {
+      return { argv: [out[0] ?? "rg", "-g", target, pattern, "."], changed: true };
+    }
+  }
+  return { argv: out, changed };
+}
+function normalizeRepoSearchCommand(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return { command: trimmed, changed: false };
+  const joiner = trimmed.includes("&&") ? " && " : trimmed.includes("||") ? " || " : "; ";
+  const stages = trimmed.split(/\s*(?:&&|\|\||;)\s*/u);
+  let changed = false;
+  const normalizedStages = stages.map((stage) => {
+    const argv = splitShellWords(stage.trim());
+    if (!argv.length || !isRgArgv(argv)) return stage;
+    const normalized = normalizeRgArgv(argv);
+    if (normalized.changed) {
+      changed = true;
+      return normalized.argv.join(" ");
+    }
+    return stage;
+  });
+  if (!changed) return { command: trimmed, changed: false };
+  return { command: normalizedStages.join(joiner), changed: true };
+}
+function extractSearchMeta(meta) {
+  if (!meta) return {};
+  const pipelineMatch = meta.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);
+  if (pipelineMatch) {
+    return { pattern: pipelineMatch[1], target: pipelineMatch[2]?.trim() };
+  }
+  const match = meta.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);
+  if (!match) return {};
+  return { pattern: match[1], target: match[2]?.trim() };
+}
+function classifyRepoSearchMeta(meta) {
+  const { pattern, target } = extractSearchMeta(meta);
+  if (!pattern) return { kind: "not_repo_search" };
+  if (isRgExcludeScopeTarget(target)) {
+    return { kind: "rg_exclude_syntax", pattern, target };
+  }
+  if (isSingleFileSearchTarget(target)) {
+    return { kind: "bad_scope", pattern, target };
+  }
+  return { kind: "not_repo_search", pattern, target };
+}
+function metaToNormalizedRgCommand(meta) {
+  const { pattern, target } = extractSearchMeta(meta);
+  if (!pattern) return null;
+  if (isRgExcludeScopeTarget(target)) {
+    const glob = `${target.trim()}/**`;
+    return {
+      command: `rg "${pattern}" -g '${glob}' .`,
+      changed: true
+    };
+  }
+  if (target && isSingleFileSearchTarget(target)) {
+    return {
+      command: `rg -g ${target} "${pattern}" .`,
+      changed: true
+    };
+  }
+  return null;
+}
+function formatRepoSearchGuidance(ctx) {
+  if (ctx.kind === "bad_scope" && ctx.pattern?.includes("agent-os-land-pr") && ctx.target === "package.json") {
+    return "Search package.json with a glob from the repo root: `rg -g package.json agent-os-land-pr .` \u2014 or run `node scripts/agent-os-land-pr.mjs <pr-url>` directly.";
+  }
+  if (ctx.kind === "bad_scope" && ctx.pattern && ctx.target) {
+    return `Use \`rg -g '${ctx.target}' ${ctx.pattern} .\` from the repo root instead of treating ${ctx.target} as a folder.`;
+  }
+  if (ctx.kind === "rg_exclude_syntax" && ctx.pattern) {
+    const glob = ctx.target ? `${ctx.target.trim()}/**` : "!node_modules/**";
+    return `Repo search scope \`${ctx.target ?? "!node_modules"}\` is not a valid ripgrep path. Use \`rg "${ctx.pattern}" -g '${glob}' .\` from the repo root (exclude globs need a \`/**\` suffix).`;
+  }
+  if (ctx.kind === "no_matches" && ctx.pattern) {
+    return `No matches for "${ctx.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${ctx.pattern}" .\`.`;
+  }
+  return null;
+}
+function extractSearchMetaFromToolLine(line) {
+  const match = line.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);
+  if (!match) return null;
+  return `search "${match[1]}" in ${match[2]?.trim()}`;
+}
+function diagnoseRepoSearchFailure(input) {
+  const meta = input.meta?.trim() || (input.command ? extractSearchMetaFromToolLine(input.command) : null) || null;
+  if (meta) {
+    const ctx = classifyRepoSearchMeta(meta);
+    const guidance = formatRepoSearchGuidance(ctx);
+    if (guidance) return guidance;
+    const normalized = metaToNormalizedRgCommand(meta);
+    if (normalized?.changed) {
+      return `Repo search used an invalid scope. Retry with: \`${normalized.command}\`.`;
+    }
+  }
+  if (input.command && /\b(rg|ripgrep)\b/i.test(input.command)) {
+    const normalized = normalizeRepoSearchCommand(input.command);
+    if (normalized.changed) {
+      return `Ripgrep scope may be invalid. Retry with: \`${normalized.command}\`.`;
+    }
+    if (input.exitCode === 1) {
+      return "Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root.";
+    }
+  }
+  return null;
+}
+export {
+  classifyRepoSearchMeta,
+  diagnoseRepoSearchFailure,
+  extractSearchMetaFromToolLine,
+  formatRepoSearchGuidance
+};
+//# sourceMappingURL=repo-search.js.map

package/dist/server/repo-search.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/repo-search.ts"],
+  "sourcesContent": ["/**\r\n * Normalize and classify repo text-search commands for harness operators and chat agents.\r\n *\r\n * Codex/OpenClaw often emit `search \"pattern\" in <scope>` meta that maps poorly to ripgrep\r\n * (e.g. `in !node_modules` instead of `-g '!node_modules/**'`, or `in package.json` as a path).\r\n */\r\n\r\nconst RG_BINARIES = new Set([\"rg\", \"ripgrep\", \"grep\"]);\r\nconst RG_OPTS_WITH_VALUE = new Set([\r\n  \"-e\",\r\n  \"--regexp\",\r\n  \"-f\",\r\n  \"--file\",\r\n  \"-m\",\r\n  \"--max-count\",\r\n  \"-A\",\r\n  \"--after-context\",\r\n  \"-B\",\r\n  \"--before-context\",\r\n  \"-C\",\r\n  \"--context\",\r\n  \"-g\",\r\n  \"--glob\",\r\n  \"--iglob\",\r\n]);\r\n\r\nexport type RepoSearchKind =\r\n  | \"not_repo_search\"\r\n  | \"bad_scope\"\r\n  | \"rg_exclude_syntax\"\r\n  | \"no_matches\";\r\n\r\nexport interface RepoSearchContext {\r\n  kind: RepoSearchKind;\r\n  pattern?: string;\r\n  target?: string;\r\n}\r\n\r\nfunction binaryName(token: string | undefined): string | null {\r\n  if (!token) return null;\r\n  const base = token.split(\"/\").pop() ?? token;\r\n  return base.replace(/\\.exe$/i, \"\").toLowerCase();\r\n}\r\n\r\nfunction splitShellWords(input: string): string[] {\r\n  if (!input) return [];\r\n  const words: string[] = [];\r\n  let current = \"\";\r\n  let quote: string | undefined;\r\n  let escaped = false;\r\n  for (const char of input) {\r\n    if (escaped) {\r\n      current += char;\r\n      escaped = false;\r\n      continue;\r\n    }\r\n    if (char === \"\\\\\") {\r\n      escaped = true;\r\n      continue;\r\n    }\r\n    if (quote) {\r\n      if (char === quote) quote = undefined;\r\n      else current += char;\r\n      continue;\r\n    }\r\n    if (char === '\"' || char === \"'\") {\r\n      quote = char;\r\n      continue;\r\n    }\r\n    if (/\\s/.test(char)) {\r\n      if (current) {\r\n        words.push(current);\r\n        current = \"\";\r\n      }\r\n      continue;\r\n    }\r\n    current += char;\r\n  }\r\n  if (current) words.push(current);\r\n  return words;\r\n}\r\n\r\nfunction isRgArgv(argv: string[]): boolean {\r\n  const bin = binaryName(argv[0]);\r\n  return Boolean(bin && RG_BINARIES.has(bin));\r\n}\r\n\r\nexport function isSingleFileSearchTarget(target: string | undefined): boolean {\r\n  if (!target || target.includes(\"/\") || target.includes(\"*\")) return false;\r\n  return /\\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(target);\r\n}\r\n\r\n/** `!node_modules` as a path is invalid \u2014 ripgrep needs `-g '!node_modules/**'`. */\r\nexport function isRgExcludeScopeTarget(target: string | undefined): boolean {\r\n  if (!target) return false;\r\n  const t = target.trim();\r\n  return t.startsWith(\"!\") && !t.includes(\"/\") && !t.endsWith(\"/**\");\r\n}\r\n\r\nfunction fixRgGlobToken(token: string): string {\r\n  if (!token.startsWith(\"--glob=\")) return token;\r\n  const value = token.slice(\"--glob=\".length);\r\n  if (value.startsWith(\"!\") && !value.includes(\"/\") && !value.endsWith(\"/**\")) {\r\n    return `--glob=${value}/**`;\r\n  }\r\n  return token;\r\n}\r\n\r\nfunction collectRgPositional(argv: string[]): string[] {\r\n  const positional: string[] = [];\r\n  for (let i = 1; i < argv.length; i += 1) {\r\n    const token = argv[i];\r\n    if (!token) continue;\r\n    if (token === \"--\") {\r\n      positional.push(...argv.slice(i + 1));\r\n      break;\r\n    }\r\n    if (token.startsWith(\"-\")) {\r\n      if (token.includes(\"=\")) continue;\r\n      if (RG_OPTS_WITH_VALUE.has(token)) i += 1;\r\n      continue;\r\n    }\r\n    positional.push(token);\r\n  }\r\n  return positional;\r\n}\r\n\r\nexport function normalizeRgArgv(argv: string[]): { argv: string[]; changed: boolean } {\r\n  let changed = false;\r\n  const out = argv.map((token) => {\r\n    const fixed = fixRgGlobToken(token);\r\n    if (fixed !== token) changed = true;\r\n    return fixed;\r\n  });\r\n  const positional = collectRgPositional(out);\r\n  if (positional.length === 2) {\r\n    const [pattern, target] = positional;\r\n    if (isSingleFileSearchTarget(target)) {\r\n      return { argv: [out[0] ?? \"rg\", \"-g\", target, pattern, \".\"], changed: true };\r\n    }\r\n  }\r\n  return { argv: out, changed };\r\n}\r\n\r\nexport function normalizeRepoSearchCommand(command: string): { command: string; changed: boolean } {\r\n  const trimmed = command.trim();\r\n  if (!trimmed) return { command: trimmed, changed: false };\r\n  const joiner = trimmed.includes(\"&&\") ? \" && \" : trimmed.includes(\"||\") ? \" || \" : \"; \";\r\n  const stages = trimmed.split(/\\s*(?:&&|\\|\\||;)\\s*/u);\r\n  let changed = false;\r\n  const normalizedStages = stages.map((stage) => {\r\n    const argv = splitShellWords(stage.trim());\r\n    if (!argv.length || !isRgArgv(argv)) return stage;\r\n    const normalized = normalizeRgArgv(argv);\r\n    if (normalized.changed) {\r\n      changed = true;\r\n      return normalized.argv.join(\" \");\r\n    }\r\n    return stage;\r\n  });\r\n  if (!changed) return { command: trimmed, changed: false };\r\n  return { command: normalizedStages.join(joiner), changed: true };\r\n}\r\n\r\nexport function extractSearchMeta(meta: string): { pattern?: string; target?: string } {\r\n  if (!meta) return {};\r\n  const pipelineMatch = meta.match(/search\\s+\"(.+)\"\\s+in\\s+([^()]+?)(?:\\s*\\(|$)/iu);\r\n  if (pipelineMatch) {\r\n    return { pattern: pipelineMatch[1], target: pipelineMatch[2]?.trim() };\r\n  }\r\n  const match = meta.match(/^search\\s+\"(.+)\"\\s+in\\s+(.+)$/iu);\r\n  if (!match) return {};\r\n  return { pattern: match[1], target: match[2]?.trim() };\r\n}\r\n\r\nexport function classifyRepoSearchMeta(meta: string): RepoSearchContext {\r\n  const { pattern, target } = extractSearchMeta(meta);\r\n  if (!pattern) return { kind: \"not_repo_search\" };\r\n  if (isRgExcludeScopeTarget(target)) {\r\n    return { kind: \"rg_exclude_syntax\", pattern, target };\r\n  }\r\n  if (isSingleFileSearchTarget(target)) {\r\n    return { kind: \"bad_scope\", pattern, target };\r\n  }\r\n  return { kind: \"not_repo_search\", pattern, target };\r\n}\r\n\r\nexport function metaToNormalizedRgCommand(meta: string): { command: string; changed: boolean } | null {\r\n  const { pattern, target } = extractSearchMeta(meta);\r\n  if (!pattern) return null;\r\n  if (isRgExcludeScopeTarget(target)) {\r\n    const glob = `${target!.trim()}/**`;\r\n    return {\r\n      command: `rg \"${pattern}\" -g '${glob}' .`,\r\n      changed: true,\r\n    };\r\n  }\r\n  if (target && isSingleFileSearchTarget(target)) {\r\n    return {\r\n      command: `rg -g ${target} \"${pattern}\" .`,\r\n      changed: true,\r\n    };\r\n  }\r\n  return null;\r\n}\r\n\r\nexport function formatRepoSearchGuidance(ctx: RepoSearchContext): string | null {\r\n  if (\r\n    ctx.kind === \"bad_scope\" &&\r\n    ctx.pattern?.includes(\"agent-os-land-pr\") &&\r\n    ctx.target === \"package.json\"\r\n  ) {\r\n    return (\r\n      \"Search package.json with a glob from the repo root: \" +\r\n      \"`rg -g package.json agent-os-land-pr .` \u2014 or run `node scripts/agent-os-land-pr.mjs <pr-url>` directly.\"\r\n    );\r\n  }\r\n  if (ctx.kind === \"bad_scope\" && ctx.pattern && ctx.target) {\r\n    return `Use \\`rg -g '${ctx.target}' ${ctx.pattern} .\\` from the repo root instead of treating ${ctx.target} as a folder.`;\r\n  }\r\n  if (ctx.kind === \"rg_exclude_syntax\" && ctx.pattern) {\r\n    const glob = ctx.target ? `${ctx.target.trim()}/**` : \"!node_modules/**\";\r\n    return (\r\n      `Repo search scope \\`${ctx.target ?? \"!node_modules\"}\\` is not a valid ripgrep path. ` +\r\n      `Use \\`rg \"${ctx.pattern}\" -g '${glob}' .\\` from the repo root (exclude globs need a \\`/**\\` suffix).`\r\n    );\r\n  }\r\n  if (ctx.kind === \"no_matches\" && ctx.pattern) {\r\n    return `No matches for \"${ctx.pattern}\". Try a broader pattern, drop overly short tokens, or search from the repo root with \\`rg \"${ctx.pattern}\" .\\`.`;\r\n  }\r\n  return null;\r\n}\r\n\r\n/** Extract `search \"\u2026\" in \u2026` from a tool-failure line or command string. */\r\nexport function extractSearchMetaFromToolLine(line: string): string | null {\r\n  const match = line.match(/search\\s+\"(.+)\"\\s+in\\s+([^()]+?)(?:\\s*\\(agent\\)|\\s*failed|$)/iu);\r\n  if (!match) return null;\r\n  return `search \"${match[1]}\" in ${match[2]?.trim()}`;\r\n}\r\n\r\nexport function diagnoseRepoSearchFailure(input: {\r\n  meta?: string;\r\n  command?: string;\r\n  exitCode?: number;\r\n}): string | null {\r\n  const meta =\r\n    input.meta?.trim() ||\r\n    (input.command ? extractSearchMetaFromToolLine(input.command) : null) ||\r\n    null;\r\n  if (meta) {\r\n    const ctx = classifyRepoSearchMeta(meta);\r\n    const guidance = formatRepoSearchGuidance(ctx);\r\n    if (guidance) return guidance;\r\n    const normalized = metaToNormalizedRgCommand(meta);\r\n    if (normalized?.changed) {\r\n      return `Repo search used an invalid scope. Retry with: \\`${normalized.command}\\`.`;\r\n    }\r\n  }\r\n  if (input.command && /\\b(rg|ripgrep)\\b/i.test(input.command)) {\r\n    const normalized = normalizeRepoSearchCommand(input.command);\r\n    if (normalized.changed) {\r\n      return `Ripgrep scope may be invalid. Retry with: \\`${normalized.command}\\`.`;\r\n    }\r\n    if (input.exitCode === 1) {\r\n      return \"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root.\";\r\n    }\r\n  }\r\n  return null;\r\n}\r\n"],
+  "mappings": ";AAOA,IAAM,cAAc,oBAAI,IAAI,CAAC,MAAM,WAAW,MAAM,CAAC;AACrD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,WAAW,OAA0C;AAC5D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,MAAM,MAAM,GAAG,EAAE,IAAI,KAAK;AACvC,SAAO,KAAK,QAAQ,WAAW,EAAE,EAAE,YAAY;AACjD;AAEA,SAAS,gBAAgB,OAAyB;AAChD,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,UAAU;AACd,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS;AACX,iBAAW;AACX,gBAAU;AACV;AAAA,IACF;AACA,QAAI,SAAS,MAAM;AACjB,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO;AACT,UAAI,SAAS,MAAO,SAAQ;AAAA,UACvB,YAAW;AAChB;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR;AAAA,IACF;AACA,QAAI,KAAK,KAAK,IAAI,GAAG;AACnB,UAAI,SAAS;AACX,cAAM,KAAK,OAAO;AAClB,kBAAU;AAAA,MACZ;AACA;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,SAAS,MAAyB;AACzC,QAAM,MAAM,WAAW,KAAK,CAAC,CAAC;AAC9B,SAAO,QAAQ,OAAO,YAAY,IAAI,GAAG,CAAC;AAC5C;AAEO,SAAS,yBAAyB,QAAqC;AAC5E,MAAI,CAAC,UAAU,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG,EAAG,QAAO;AACpE,SAAO,8CAA8C,KAAK,MAAM;AAClE;AAGO,SAAS,uBAAuB,QAAqC;AAC1E,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO,EAAE,WAAW,GAAG,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,EAAE,SAAS,KAAK;AACnE;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,CAAC,MAAM,WAAW,SAAS,EAAG,QAAO;AACzC,QAAM,QAAQ,MAAM,MAAM,UAAU,MAAM;AAC1C,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,KAAK,GAAG;AAC3E,WAAO,UAAU,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,MAA0B;AACrD,QAAM,aAAuB,CAAC;AAC9B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,CAAC,MAAO;AACZ,QAAI,UAAU,MAAM;AAClB,iBAAW,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC;AACpC;AAAA,IACF;AACA,QAAI,MAAM,WAAW,GAAG,GAAG;AACzB,UAAI,MAAM,SAAS,GAAG,EAAG;AACzB,UAAI,mBAAmB,IAAI,KAAK,EAAG,MAAK;AACxC;AAAA,IACF;AACA,eAAW,KAAK,KAAK;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,MAAsD;AACpF,MAAI,UAAU;AACd,QAAM,MAAM,KAAK,IAAI,CAAC,UAAU;AAC9B,UAAM,QAAQ,eAAe,KAAK;AAClC,QAAI,UAAU,MAAO,WAAU;AAC/B,WAAO;AAAA,EACT,CAAC;AACD,QAAM,aAAa,oBAAoB,GAAG;AAC1C,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,CAAC,SAAS,MAAM,IAAI;AAC1B,QAAI,yBAAyB,MAAM,GAAG;AACpC,aAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,MAAM,QAAQ,SAAS,GAAG,GAAG,SAAS,KAAK;AAAA,IAC7E;AAAA,EACF;AACA,SAAO,EAAE,MAAM,KAAK,QAAQ;AAC9B;AAEO,SAAS,2BAA2B,SAAwD;AACjG,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,SAAS,SAAS,MAAM;AACxD,QAAM,SAAS,QAAQ,SAAS,IAAI,IAAI,SAAS,QAAQ,SAAS,IAAI,IAAI,SAAS;AACnF,QAAM,SAAS,QAAQ,MAAM,sBAAsB;AACnD,MAAI,UAAU;AACd,QAAM,mBAAmB,OAAO,IAAI,CAAC,UAAU;AAC7C,UAAM,OAAO,gBAAgB,MAAM,KAAK,CAAC;AACzC,QAAI,CAAC,KAAK,UAAU,CAAC,SAAS,IAAI,EAAG,QAAO;AAC5C,UAAM,aAAa,gBAAgB,IAAI;AACvC,QAAI,WAAW,SAAS;AACtB,gBAAU;AACV,aAAO,WAAW,KAAK,KAAK,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,SAAS,SAAS,MAAM;AACxD,SAAO,EAAE,SAAS,iBAAiB,KAAK,MAAM,GAAG,SAAS,KAAK;AACjE;AAEO,SAAS,kBAAkB,MAAqD;AACrF,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,QAAM,gBAAgB,KAAK,MAAM,+CAA+C;AAChF,MAAI,eAAe;AACjB,WAAO,EAAE,SAAS,cAAc,CAAC,GAAG,QAAQ,cAAc,CAAC,GAAG,KAAK,EAAE;AAAA,EACvE;AACA,QAAM,QAAQ,KAAK,MAAM,iCAAiC;AAC1D,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,EAAE,SAAS,MAAM,CAAC,GAAG,QAAQ,MAAM,CAAC,GAAG,KAAK,EAAE;AACvD;AAEO,SAAS,uBAAuB,MAAiC;AACtE,QAAM,EAAE,SAAS,OAAO,IAAI,kBAAkB,IAAI;AAClD,MAAI,CAAC,QAAS,QAAO,EAAE,MAAM,kBAAkB;AAC/C,MAAI,uBAAuB,MAAM,GAAG;AAClC,WAAO,EAAE,MAAM,qBAAqB,SAAS,OAAO;AAAA,EACtD;AACA,MAAI,yBAAyB,MAAM,GAAG;AACpC,WAAO,EAAE,MAAM,aAAa,SAAS,OAAO;AAAA,EAC9C;AACA,SAAO,EAAE,MAAM,mBAAmB,SAAS,OAAO;AACpD;AAEO,SAAS,0BAA0B,MAA4D;AACpG,QAAM,EAAE,SAAS,OAAO,IAAI,kBAAkB,IAAI;AAClD,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,uBAAuB,MAAM,GAAG;AAClC,UAAM,OAAO,GAAG,OAAQ,KAAK,CAAC;AAC9B,WAAO;AAAA,MACL,SAAS,OAAO,OAAO,SAAS,IAAI;AAAA,MACpC,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,UAAU,yBAAyB,MAAM,GAAG;AAC9C,WAAO;AAAA,MACL,SAAS,SAAS,MAAM,KAAK,OAAO;AAAA,MACpC,SAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,yBAAyB,KAAuC;AAC9E,MACE,IAAI,SAAS,eACb,IAAI,SAAS,SAAS,kBAAkB,KACxC,IAAI,WAAW,gBACf;AACA,WACE;AAAA,EAGJ;AACA,MAAI,IAAI,SAAS,eAAe,IAAI,WAAW,IAAI,QAAQ;AACzD,WAAO,gBAAgB,IAAI,MAAM,KAAK,IAAI,OAAO,+CAA+C,IAAI,MAAM;AAAA,EAC5G;AACA,MAAI,IAAI,SAAS,uBAAuB,IAAI,SAAS;AACnD,UAAM,OAAO,IAAI,SAAS,GAAG,IAAI,OAAO,KAAK,CAAC,QAAQ;AACtD,WACE,uBAAuB,IAAI,UAAU,eAAe,6CACvC,IAAI,OAAO,SAAS,IAAI;AAAA,EAEzC;AACA,MAAI,IAAI,SAAS,gBAAgB,IAAI,SAAS;AAC5C,WAAO,mBAAmB,IAAI,OAAO,+FAA+F,IAAI,OAAO;AAAA,EACjJ;AACA,SAAO;AACT;AAGO,SAAS,8BAA8B,MAA6B;AACzE,QAAM,QAAQ,KAAK,MAAM,gEAAgE;AACzF,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,WAAW,MAAM,CAAC,CAAC,QAAQ,MAAM,CAAC,GAAG,KAAK,CAAC;AACpD;AAEO,SAAS,0BAA0B,OAIxB;AAChB,QAAM,OACJ,MAAM,MAAM,KAAK,MAChB,MAAM,UAAU,8BAA8B,MAAM,OAAO,IAAI,SAChE;AACF,MAAI,MAAM;AACR,UAAM,MAAM,uBAAuB,IAAI;AACvC,UAAM,WAAW,yBAAyB,GAAG;AAC7C,QAAI,SAAU,QAAO;AACrB,UAAM,aAAa,0BAA0B,IAAI;AACjD,QAAI,YAAY,SAAS;AACvB,aAAO,oDAAoD,WAAW,OAAO;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,MAAM,WAAW,oBAAoB,KAAK,MAAM,OAAO,GAAG;AAC5D,UAAM,aAAa,2BAA2B,MAAM,OAAO;AAC3D,QAAI,WAAW,SAAS;AACtB,aAAO,+CAA+C,WAAW,OAAO;AAAA,IAC1E;AACA,QAAI,MAAM,aAAa,GAAG;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/server/worker-policy.d.ts

@@ -0,0 +1,2 @@
+export { auditWorkerEnv, scrubWorkerEnv, listForbiddenWorkerEnvKeys, isForbiddenWorkerEnvKey, } from "../worker-env.js";
+export { DEFAULT_WORKER_PROVIDER, resolveConfiguredWorkerProvider, isClaudeFamilyProvider, taskAllowsClaudeWorker, enforceCursorWorkerProvider, preferCursorExecutor, type EnforceCursorWorkerProviderInput, } from "../worker-provider-policy.js";

package/dist/server/worker-policy.js

@@ -0,0 +1,177 @@
+// src/worker-env.ts
+var FORBIDDEN_WORKER_ENV_KEYS = [
+  "ANTHROPIC_API_KEY",
+  "ANALYST_API_KEY",
+  "RECRUITER_API_KEY",
+  "AUTH_SECRET",
+  "NEXTAUTH_SECRET",
+  "DATABASE_URL",
+  "PRODUCTION_DATABASE_URL",
+  "KYNVER_PRODUCTION_DATABASE_URL",
+  "REDIS_URL",
+  "GOOGLE_CLIENT_SECRET",
+  "GITHUB_CLIENT_SECRET",
+  "KYNVER_API_KEY",
+  "KYNVER_SERVICE_SECRET",
+  "KYNVER_RUNTIME_SECRET",
+  "KYNVER_CRON_SECRET",
+  "OPENCLAW_CRON_SECRET",
+  "QSTASH_TOKEN",
+  "QSTASH_CURRENT_SIGNING_KEY",
+  "QSTASH_NEXT_SIGNING_KEY",
+  "TOOL_SECRETS_KEK",
+  "TOOL_EXECUTOR_DISPATCH_SECRET",
+  "CLOUDFLARE_API_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "STRIPE_WEBHOOK_SECRET",
+  "STRIPE_IDENTITY_WEBHOOK_SECRET",
+  "VOYAGE_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "FRED_API_KEY",
+  "FMP_API_KEY",
+  "CURSOR_API_KEY"
+];
+var FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
+var FORBIDDEN_SUFFIXES = ["_SECRET", "_API_KEY"];
+function isForbiddenWorkerEnvKey(key) {
+  if (FORBIDDEN_KEY_SET.has(key)) return true;
+  return FORBIDDEN_SUFFIXES.some((suffix) => key.endsWith(suffix));
+}
+function listForbiddenWorkerEnvKeys(env) {
+  return Object.keys(env).filter(isForbiddenWorkerEnvKey).sort();
+}
+function scrubWorkerEnv(env) {
+  const next = { ...env };
+  for (const key of Object.keys(next)) {
+    if (isForbiddenWorkerEnvKey(key)) delete next[key];
+  }
+  return next;
+}
+function auditWorkerEnv(env) {
+  const forbiddenPresent = listForbiddenWorkerEnvKeys(env);
+  return { forbiddenPresent, safe: forbiddenPresent.length === 0 };
+}
+
+// src/config.ts
+import { homedir as homedir2, totalmem } from "node:os";
+import path2 from "node:path";
+
+// src/wsl-host.ts
+var DEFAULT_WSL_HOST_WARN_FREE_BYTES = 25 * 1024 * 1024 * 1024;
+var DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES = 12 * 1024 * 1024 * 1024;
+
+// src/disk-gate.ts
+var DEFAULT_WARN_FREE_BYTES = 30 * 1024 * 1024 * 1024;
+var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
+
+// src/paths.ts
+import { homedir } from "node:os";
+import path from "node:path";
+var LEGACY_ROOT = path.join(homedir(), ".openclaw", "harness");
+
+// src/resource-gate.ts
+var DEFAULT_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+var DEFAULT_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+
+// src/config.ts
+var CONFIG_DIR = path2.join(homedir2(), ".kynver");
+var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path2.join(CONFIG_DIR, "credentials");
+var SETUP_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+var SETUP_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+
+// src/model-routing.ts
+var CURSOR_DEFAULT_MODEL = "composer-2.5";
+
+// src/worker-provider-policy.ts
+var DEFAULT_WORKER_PROVIDER = "cursor";
+var CLAUDE_FAMILY = /* @__PURE__ */ new Set(["claude", "opus", "anthropic"]);
+var TASK_OVERRIDE_MARKERS = [
+  /\[worker-provider:\s*claude\]/i,
+  /\[use-claude-worker\]/i,
+  /\[operator-worker-provider:\s*claude\]/i
+];
+function taskString(task, key) {
+  const v = task[key];
+  return typeof v === "string" ? v.trim() : "";
+}
+function isClaudeFamilyProvider(provider) {
+  if (!provider?.trim()) return false;
+  const normalized = provider.trim().toLowerCase();
+  if (CLAUDE_FAMILY.has(normalized)) return true;
+  return normalized.includes("claude") || normalized.includes("opus");
+}
+function taskAllowsClaudeWorker(task) {
+  if (!task) return false;
+  const override = task.workerProviderOverride;
+  if (typeof override === "string" && isClaudeFamilyProvider(override)) return true;
+  const ref = taskString(task, "executorRef").toLowerCase();
+  if (ref === "provider:claude" || ref.startsWith("provider:claude:")) return true;
+  if (ref.includes("claude-worker-override") || ref.includes("operator-claude")) return true;
+  const description = taskString(task, "description");
+  if (TASK_OVERRIDE_MARKERS.some((re) => re.test(description))) return true;
+  const title = taskString(task, "title");
+  if (/\[use-claude-worker\]/i.test(title)) return true;
+  return false;
+}
+function coerceCursorModel(model, ruleSuffix) {
+  const coerced = {
+    provider: DEFAULT_WORKER_PROVIDER,
+    model: CURSOR_DEFAULT_MODEL,
+    rule: `policy:cursor_default${ruleSuffix}`,
+    requestedModel: model
+  };
+  return coerced;
+}
+function enforceCursorWorkerProvider(input) {
+  const { routing, task } = input;
+  const explicit = input.explicitProvider?.trim().toLowerCase();
+  if (input.explicitProviderIsOperatorOverride && isClaudeFamilyProvider(explicit)) {
+    return {
+      ...routing,
+      provider: "claude",
+      rule: routing.rule.startsWith("explicit:") ? routing.rule : "explicit:operator_provider"
+    };
+  }
+  if (taskAllowsClaudeWorker(task)) {
+    return routing;
+  }
+  if (routing.rule === "explicit:cli" && isClaudeFamilyProvider(routing.provider)) {
+    return routing;
+  }
+  if (!isClaudeFamilyProvider(routing.provider)) {
+    return routing;
+  }
+  const suffix = routing.rule && routing.rule !== "default:global" ? `:${routing.rule.replace(/:/g, "_")}` : "";
+  return coerceCursorModel(routing.model, suffix);
+}
+function resolveConfiguredWorkerProvider(configured, fallback = DEFAULT_WORKER_PROVIDER) {
+  const trimmed = configured?.trim();
+  if (!trimmed) return fallback;
+  if (isClaudeFamilyProvider(trimmed)) return DEFAULT_WORKER_PROVIDER;
+  if (trimmed === "codex") return "codex";
+  return trimmed;
+}
+function preferCursorExecutor(executors) {
+  const unique = [...new Set(executors.map((e) => e.trim().toLowerCase()).filter(Boolean))];
+  if (unique.includes(DEFAULT_WORKER_PROVIDER)) {
+    return [...new Set(unique.map((e) => isClaudeFamilyProvider(e) ? DEFAULT_WORKER_PROVIDER : e))];
+  }
+  if (unique.every((e) => isClaudeFamilyProvider(e))) {
+    return [DEFAULT_WORKER_PROVIDER];
+  }
+  return unique;
+}
+export {
+  DEFAULT_WORKER_PROVIDER,
+  auditWorkerEnv,
+  enforceCursorWorkerProvider,
+  isClaudeFamilyProvider,
+  isForbiddenWorkerEnvKey,
+  listForbiddenWorkerEnvKeys,
+  preferCursorExecutor,
+  resolveConfiguredWorkerProvider,
+  scrubWorkerEnv,
+  taskAllowsClaudeWorker
+};
+//# sourceMappingURL=worker-policy.js.map