@levr-one/cli 0.12.8 → 0.12.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{addHandler-ybX54_3f.js → addHandler-CD1pda0z.js} +7 -7
- package/dist/{appendHandler-CKkl9ymw.js → appendHandler-BYOoCNXJ.js} +9 -9
- package/dist/{artifact-upload-Ba801tb6.js → artifact-upload-t6kL20b5.js} +2 -2
- package/dist/{attachHandler-CfNvVAV2.js → attachHandler-Ojk7mc2E.js} +9 -9
- package/dist/bindingsHandler-Dxx2LIci.js +2781 -0
- package/dist/change-scope-DBmyRWZV.js +379 -0
- package/dist/changedCoverageHandler-B8Zh5WIK.js +200 -0
- package/dist/cli.js +300 -15
- package/dist/{connect-yq3fGXkW.js → connect-A5VSJUv5.js} +3 -3
- package/dist/coverage-defaults-Ct3KNnGl.js +24 -0
- package/dist/{currentHandler-PaLZKLGF.js → currentHandler-DmffKHyZ.js} +1 -1
- package/dist/dependencyAuditHandler-CdpW-IvY.js +291 -0
- package/dist/dist-DU3htaZ_.js +325 -0
- package/dist/{find-workspace-4Us2vEb7.js → find-workspace-IWolSyrf.js} +1 -1
- package/dist/gate-op-BINrIT2l.js +278 -0
- package/dist/{importHandler-bYBWYC_0.js → importHandler-86cjc2Zs.js} +6 -6
- package/dist/inspect-CAxNgTwj.js +4 -0
- package/dist/{inspect-BbL7kDe-.js → inspect-CinRBSv6.js} +2 -277
- package/dist/{listHandler-Du_YGzre.js → listHandler-BoCzGUDK.js} +5 -5
- package/dist/{loginHandler-PbKmDAGo.js → loginHandler-CXmNViCo.js} +6 -6
- package/dist/{logoutHandler-DxnzGPYx.js → logoutHandler-DwTURB_A.js} +2 -2
- package/dist/{pushHandler-BulraEwP.js → pushHandler-BkCmzQz7.js} +9 -330
- package/dist/{resolve-token-DKEXT7SA.js → resolve-token-D1zteEfm.js} +2 -2
- package/dist/{resolve-workspace-D8y7twod.js → resolve-workspace-CJN1plpd.js} +2 -2
- package/dist/{runHandler-B-u-0eRk.js → runHandler-BLkPzImG.js} +8 -7
- package/dist/{sdk-client-BgzKzVIR.js → sdk-client-CSy2LOEh.js} +1 -1
- package/dist/{selectHandler-C0gs-Q70.js → selectHandler-Dp74pefc.js} +5 -5
- package/dist/{statusHandler-Dnnh80ZN.js → statusHandler-ByTUMdKK.js} +3 -3
- package/dist/{token-refresh-BpFuU4Ij.js → token-refresh-DEmYbJ8V.js} +1 -1
- package/package.json +1 -1
- package/dist/inspect-EGW-cgVD.js +0 -3
- /package/dist/{env-DjeRwmZ7.js → env-Cv-anxJA.js} +0 -0
- /package/dist/{refsHandler--ySvLjmX.js → refsHandler-BPlcdJvR.js} +0 -0
- /package/dist/{sleep-CGBHjsj5.js → sleep-DNLj0FMk.js} +0 -0
- /package/dist/{workspace-store-Bmw104Qa.js → workspace-store-BJyB_WEG.js} +0 -0
|
@@ -0,0 +1,278 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
|
|
3
|
+
//#region ../shared/dist/runs/gate-pattern.js
|
|
4
|
+
/**
|
|
5
|
+
* POSIX ERE → JS `RegExp` translation for gate patterns (ENG-7246).
|
|
6
|
+
*
|
|
7
|
+
* Moved from the CLI's `gates inspect` builtins so the server and the seed
|
|
8
|
+
* specs read a pattern with the same parser the CLI runs: a pattern the CLI
|
|
9
|
+
* refuses is caught before it ships, not when a gate is verified.
|
|
10
|
+
*/
|
|
11
|
+
const POSIX_CLASSES = {
|
|
12
|
+
alpha: "A-Za-z",
|
|
13
|
+
digit: "0-9",
|
|
14
|
+
alnum: "A-Za-z0-9",
|
|
15
|
+
upper: "A-Z",
|
|
16
|
+
lower: "a-z",
|
|
17
|
+
space: " \\t\\n\\r\\f\\v",
|
|
18
|
+
blank: " \\t",
|
|
19
|
+
punct: "!-\\/:-@\\[-`{-~",
|
|
20
|
+
xdigit: "0-9A-Fa-f",
|
|
21
|
+
cntrl: "\\x00-\\x1f\\x7f",
|
|
22
|
+
print: "\\x20-\\x7e",
|
|
23
|
+
graph: "\\x21-\\x7e",
|
|
24
|
+
word: "A-Za-z0-9_"
|
|
25
|
+
};
|
|
26
|
+
/**
|
|
27
|
+
* Translate a POSIX ERE (what `grep -E` read) into a JS `RegExp` source.
|
|
28
|
+
*
|
|
29
|
+
* Bracket classes become their JS ranges. Syntax that `grep` and JS read
|
|
30
|
+
* differently, and that has no faithful translation, is refused with a
|
|
31
|
+
* reason: GNU word anchors `\<` `\>`, buffer anchors, collating and
|
|
32
|
+
* equivalence classes, a backslash inside a bracket expression (literal to
|
|
33
|
+
* grep, an escape to JS), and a back-reference to a group that does not
|
|
34
|
+
* exist (an octal escape to JS). Refusing is the point: a `not_contains`
|
|
35
|
+
* whose pattern silently stopped matching is a false pass.
|
|
36
|
+
*/
|
|
37
|
+
function translatePosixEre(pattern) {
|
|
38
|
+
let out = "";
|
|
39
|
+
let groups = 0;
|
|
40
|
+
for (let i = 0; i < pattern.length; i++) if (pattern[i] === "\\") i += 1;
|
|
41
|
+
else if (pattern[i] === "(" && pattern[i + 1] !== "?") groups += 1;
|
|
42
|
+
for (let i = 0; i < pattern.length; i++) {
|
|
43
|
+
const ch = pattern[i] ?? "";
|
|
44
|
+
if (ch === "\\") {
|
|
45
|
+
const next = pattern[i + 1];
|
|
46
|
+
if (next === void 0) return { error: "pattern ends with a backslash" };
|
|
47
|
+
if (next === "<" || next === ">") return { error: `\\${next} is a GNU word anchor with no JS equivalent; use \\b` };
|
|
48
|
+
if (next === "`" || next === "'") return { error: `\\${next} is a GNU buffer anchor; use ^ or $` };
|
|
49
|
+
if (/[1-9]/.test(next) && Number(next) > groups) return { error: `back-reference \\${next} names a group the pattern does not have` };
|
|
50
|
+
out += ch + next;
|
|
51
|
+
i += 1;
|
|
52
|
+
continue;
|
|
53
|
+
}
|
|
54
|
+
if (ch !== "[") {
|
|
55
|
+
out += ch;
|
|
56
|
+
continue;
|
|
57
|
+
}
|
|
58
|
+
let j = i + 1;
|
|
59
|
+
let body = "";
|
|
60
|
+
if (pattern[j] === "^") {
|
|
61
|
+
body += "^";
|
|
62
|
+
j += 1;
|
|
63
|
+
}
|
|
64
|
+
if (pattern[j] === "]") {
|
|
65
|
+
body += "\\]";
|
|
66
|
+
j += 1;
|
|
67
|
+
}
|
|
68
|
+
let closed = false;
|
|
69
|
+
while (j < pattern.length) {
|
|
70
|
+
const c = pattern[j] ?? "";
|
|
71
|
+
if (c === "]") {
|
|
72
|
+
closed = true;
|
|
73
|
+
break;
|
|
74
|
+
}
|
|
75
|
+
if (c === "[" && (pattern[j + 1] === ":" || pattern[j + 1] === "=" || pattern[j + 1] === ".")) {
|
|
76
|
+
const kind = pattern[j + 1];
|
|
77
|
+
const end = pattern.indexOf(`${kind}]`, j + 2);
|
|
78
|
+
if (end === -1) return { error: `unterminated [${kind} in a bracket expression` };
|
|
79
|
+
const name = pattern.slice(j + 2, end);
|
|
80
|
+
if (kind !== ":") return { error: `[${kind}${name}${kind}] has no JS equivalent` };
|
|
81
|
+
const range = POSIX_CLASSES[name];
|
|
82
|
+
if (range === void 0) return { error: `unknown class [:${name}:]` };
|
|
83
|
+
body += range;
|
|
84
|
+
j = end + 2;
|
|
85
|
+
continue;
|
|
86
|
+
}
|
|
87
|
+
if (c === "\\") return { error: "a backslash inside [...] is literal to grep and an escape to JS; use a POSIX class or move it outside the brackets" };
|
|
88
|
+
if (c === "[") body += "\\[";
|
|
89
|
+
else body += c;
|
|
90
|
+
j += 1;
|
|
91
|
+
}
|
|
92
|
+
if (!closed) return { error: "unterminated bracket expression" };
|
|
93
|
+
out += `[${body}]`;
|
|
94
|
+
i = j;
|
|
95
|
+
}
|
|
96
|
+
return out;
|
|
97
|
+
}
|
|
98
|
+
|
|
99
|
+
//#endregion
|
|
100
|
+
//#region ../shared/dist/runs/gate-op.js
|
|
101
|
+
const GATE_OP_CONTRACT_VERSION = 1;
|
|
102
|
+
const REPO_RELATIVE = "path must be repo-relative and must not contain ..";
|
|
103
|
+
/** Repo-relative, no `..` segment, not absolute, not home-relative. */
|
|
104
|
+
function isRepoRelative(value) {
|
|
105
|
+
if (value.length === 0 || value.includes("\0")) return false;
|
|
106
|
+
if (value.startsWith("/") || value.startsWith("~") || /^[A-Za-z]:[\\/]/.test(value)) return false;
|
|
107
|
+
return !value.split(/[\\/]/).includes("..");
|
|
108
|
+
}
|
|
109
|
+
const RepoRelativeCwd = z.string().refine(isRepoRelative, REPO_RELATIVE);
|
|
110
|
+
const RepoRelativePath = z.string().refine(isRepoRelative, REPO_RELATIVE);
|
|
111
|
+
const SandboxProfileSchema = z.object({
|
|
112
|
+
network_hosts: z.array(z.string()),
|
|
113
|
+
ports: z.array(z.number().int().nonnegative()),
|
|
114
|
+
read_paths: z.array(z.string()),
|
|
115
|
+
write_paths: z.array(z.string()),
|
|
116
|
+
env_allow: z.array(z.string()),
|
|
117
|
+
loopback: z.boolean(),
|
|
118
|
+
unsandboxed_on: z.array(z.enum(["linux", "wsl2"])).optional(),
|
|
119
|
+
unsandboxed_reason: z.string().optional()
|
|
120
|
+
});
|
|
121
|
+
const InspectPathParams = z.object({
|
|
122
|
+
path: RepoRelativePath,
|
|
123
|
+
glob: z.boolean().optional()
|
|
124
|
+
}).strict();
|
|
125
|
+
const ContainsParams = z.object({
|
|
126
|
+
path: RepoRelativePath,
|
|
127
|
+
glob: z.boolean().optional(),
|
|
128
|
+
pattern: z.string().optional(),
|
|
129
|
+
keywords: z.array(z.string()).optional(),
|
|
130
|
+
literal: z.boolean().optional()
|
|
131
|
+
}).strict().superRefine((params, ctx) => {
|
|
132
|
+
const hasPattern = params.pattern != null && params.pattern.length > 0;
|
|
133
|
+
const hasKeywords = (params.keywords?.length ?? 0) > 0;
|
|
134
|
+
if (!hasPattern && !hasKeywords) ctx.addIssue({
|
|
135
|
+
code: z.ZodIssueCode.custom,
|
|
136
|
+
message: "contains needs a pattern or keywords"
|
|
137
|
+
});
|
|
138
|
+
});
|
|
139
|
+
const DoneCriteriaParams = z.object({
|
|
140
|
+
path: RepoRelativePath,
|
|
141
|
+
glob: z.boolean().optional(),
|
|
142
|
+
requirements: z.array(z.union([z.string(), z.object({
|
|
143
|
+
pattern: z.string(),
|
|
144
|
+
label: z.string().optional()
|
|
145
|
+
}).strict()])).nonempty()
|
|
146
|
+
}).strict();
|
|
147
|
+
const JsonHasKeyParams = z.object({
|
|
148
|
+
path: RepoRelativePath,
|
|
149
|
+
glob: z.boolean().optional(),
|
|
150
|
+
key: z.string().min(1),
|
|
151
|
+
object: z.string().min(1).optional()
|
|
152
|
+
}).strict();
|
|
153
|
+
const SpecColumnsParams = z.object({
|
|
154
|
+
path: RepoRelativePath,
|
|
155
|
+
glob: z.boolean().optional(),
|
|
156
|
+
required_columns: z.union([z.string().min(1), z.array(z.string()).nonempty()])
|
|
157
|
+
}).strict();
|
|
158
|
+
const ArgvOpSchema = z.object({
|
|
159
|
+
op: z.literal("argv"),
|
|
160
|
+
cwd: RepoRelativeCwd,
|
|
161
|
+
argv: z.array(z.string()).nonempty()
|
|
162
|
+
}).strict();
|
|
163
|
+
const InspectOpSchema = z.discriminatedUnion("check", [
|
|
164
|
+
z.object({
|
|
165
|
+
op: z.literal("inspect"),
|
|
166
|
+
check: z.literal("exists"),
|
|
167
|
+
params: InspectPathParams
|
|
168
|
+
}).strict(),
|
|
169
|
+
z.object({
|
|
170
|
+
op: z.literal("inspect"),
|
|
171
|
+
check: z.literal("not_exists"),
|
|
172
|
+
params: InspectPathParams
|
|
173
|
+
}).strict(),
|
|
174
|
+
z.object({
|
|
175
|
+
op: z.literal("inspect"),
|
|
176
|
+
check: z.literal("contains"),
|
|
177
|
+
params: ContainsParams
|
|
178
|
+
}).strict(),
|
|
179
|
+
z.object({
|
|
180
|
+
op: z.literal("inspect"),
|
|
181
|
+
check: z.literal("not_contains"),
|
|
182
|
+
params: ContainsParams
|
|
183
|
+
}).strict(),
|
|
184
|
+
z.object({
|
|
185
|
+
op: z.literal("inspect"),
|
|
186
|
+
check: z.literal("done_criteria"),
|
|
187
|
+
params: DoneCriteriaParams
|
|
188
|
+
}).strict(),
|
|
189
|
+
z.object({
|
|
190
|
+
op: z.literal("inspect"),
|
|
191
|
+
check: z.literal("json_has_key"),
|
|
192
|
+
params: JsonHasKeyParams
|
|
193
|
+
}).strict(),
|
|
194
|
+
z.object({
|
|
195
|
+
op: z.literal("inspect"),
|
|
196
|
+
check: z.literal("spec_columns"),
|
|
197
|
+
params: SpecColumnsParams
|
|
198
|
+
}).strict(),
|
|
199
|
+
z.object({
|
|
200
|
+
op: z.literal("inspect"),
|
|
201
|
+
check: z.literal("migration_down_scope"),
|
|
202
|
+
params: InspectPathParams
|
|
203
|
+
}).strict()
|
|
204
|
+
]);
|
|
205
|
+
const JudgeOpSchema = z.object({
|
|
206
|
+
op: z.literal("judge"),
|
|
207
|
+
path: RepoRelativePath,
|
|
208
|
+
rubric: z.string(),
|
|
209
|
+
output_schema: z.string(),
|
|
210
|
+
judge_prompt: z.string(),
|
|
211
|
+
model: z.string().min(1),
|
|
212
|
+
runner: z.literal("agy"),
|
|
213
|
+
max_input_bytes: z.number().int().positive()
|
|
214
|
+
}).strict();
|
|
215
|
+
const GateOpSchema = z.union([
|
|
216
|
+
ArgvOpSchema,
|
|
217
|
+
InspectOpSchema,
|
|
218
|
+
JudgeOpSchema
|
|
219
|
+
]);
|
|
220
|
+
const AuthoringSourceSchema = z.object({
|
|
221
|
+
kind: z.enum(["binding", "definition"]),
|
|
222
|
+
id: z.string().uuid(),
|
|
223
|
+
workspace_id: z.string().uuid()
|
|
224
|
+
}).strict();
|
|
225
|
+
/**
|
|
226
|
+
* fail_closed: both `op` and `legacy_command`, or neither, is refused.
|
|
227
|
+
* A legacy carrier also keeps its authored `legacy_template` when the
|
|
228
|
+
* converter could not turn the template into argv.
|
|
229
|
+
*/
|
|
230
|
+
const GateOpEnvelopeSchema = z.object({
|
|
231
|
+
contract_version: z.literal(GATE_OP_CONTRACT_VERSION),
|
|
232
|
+
op: GateOpSchema.optional(),
|
|
233
|
+
legacy_command: z.string().min(1).optional(),
|
|
234
|
+
legacy_template: z.string().optional(),
|
|
235
|
+
link_id: z.string().uuid(),
|
|
236
|
+
step_id: z.string().optional(),
|
|
237
|
+
rule_hash: z.string().optional(),
|
|
238
|
+
expected: z.string(),
|
|
239
|
+
provenance: z.enum([
|
|
240
|
+
"seeded",
|
|
241
|
+
"binding",
|
|
242
|
+
"workspace_template",
|
|
243
|
+
"legacy",
|
|
244
|
+
"replicated"
|
|
245
|
+
]),
|
|
246
|
+
authored_digest: z.string().min(1),
|
|
247
|
+
content_digest: z.string().min(1),
|
|
248
|
+
authoring_source: AuthoringSourceSchema.optional(),
|
|
249
|
+
approval: z.enum([
|
|
250
|
+
"server_approved",
|
|
251
|
+
"confirm",
|
|
252
|
+
"denied"
|
|
253
|
+
]),
|
|
254
|
+
approval_basis: z.enum([
|
|
255
|
+
"kind",
|
|
256
|
+
"default_list",
|
|
257
|
+
"workspace_list"
|
|
258
|
+
]).optional(),
|
|
259
|
+
matched_pattern: z.string().optional(),
|
|
260
|
+
suggested_pattern: z.string().optional(),
|
|
261
|
+
sandbox: z.object({
|
|
262
|
+
mode: z.enum(["on", "off-by-gate"]),
|
|
263
|
+
profile: SandboxProfileSchema
|
|
264
|
+
}).strict(),
|
|
265
|
+
untested: z.boolean().optional(),
|
|
266
|
+
display: z.object({
|
|
267
|
+
posix: z.string(),
|
|
268
|
+
powershell: z.string()
|
|
269
|
+
}).strict()
|
|
270
|
+
}).strict().superRefine((value, ctx) => {
|
|
271
|
+
if (value.op !== void 0 === (value.legacy_command !== void 0)) ctx.addIssue({
|
|
272
|
+
code: z.ZodIssueCode.custom,
|
|
273
|
+
message: "fail_closed: envelope must carry exactly one of op and legacy_command"
|
|
274
|
+
});
|
|
275
|
+
});
|
|
276
|
+
|
|
277
|
+
//#endregion
|
|
278
|
+
export { GateOpSchema, translatePosixEre };
|
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
import { authGetProfileV1, client, configureClient } from "./sdk-client-
|
|
2
|
-
import "./token-refresh-
|
|
3
|
-
import { getApiUrl, getTeamId } from "./env-
|
|
4
|
-
import { resolveToken } from "./resolve-token-
|
|
5
|
-
import "./workspace-store-
|
|
6
|
-
import { resolveWorkspaceFor } from "./resolve-workspace-
|
|
1
|
+
import { authGetProfileV1, client, configureClient } from "./sdk-client-CSy2LOEh.js";
|
|
2
|
+
import "./token-refresh-DEmYbJ8V.js";
|
|
3
|
+
import { getApiUrl, getTeamId } from "./env-Cv-anxJA.js";
|
|
4
|
+
import { resolveToken } from "./resolve-token-D1zteEfm.js";
|
|
5
|
+
import "./workspace-store-BJyB_WEG.js";
|
|
6
|
+
import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
|
|
7
7
|
import chalk from "chalk";
|
|
8
8
|
import { createReadStream } from "node:fs";
|
|
9
9
|
import { basename } from "node:path";
|
|
@@ -1,283 +1,8 @@
|
|
|
1
|
+
import { GateOpSchema, translatePosixEre } from "./gate-op-BINrIT2l.js";
|
|
1
2
|
import { buildCommand } from "@stricli/core";
|
|
2
|
-
import { z } from "zod";
|
|
3
3
|
import * as fs from "node:fs";
|
|
4
4
|
import path from "node:path";
|
|
5
5
|
|
|
6
|
-
//#region ../shared/dist/runs/gate-pattern.js
|
|
7
|
-
/**
|
|
8
|
-
* POSIX ERE → JS `RegExp` translation for gate patterns (ENG-7246).
|
|
9
|
-
*
|
|
10
|
-
* Moved from the CLI's `gates inspect` builtins so the server and the seed
|
|
11
|
-
* specs read a pattern with the same parser the CLI runs: a pattern the CLI
|
|
12
|
-
* refuses is caught before it ships, not when a gate is verified.
|
|
13
|
-
*/
|
|
14
|
-
const POSIX_CLASSES = {
|
|
15
|
-
alpha: "A-Za-z",
|
|
16
|
-
digit: "0-9",
|
|
17
|
-
alnum: "A-Za-z0-9",
|
|
18
|
-
upper: "A-Z",
|
|
19
|
-
lower: "a-z",
|
|
20
|
-
space: " \\t\\n\\r\\f\\v",
|
|
21
|
-
blank: " \\t",
|
|
22
|
-
punct: "!-\\/:-@\\[-`{-~",
|
|
23
|
-
xdigit: "0-9A-Fa-f",
|
|
24
|
-
cntrl: "\\x00-\\x1f\\x7f",
|
|
25
|
-
print: "\\x20-\\x7e",
|
|
26
|
-
graph: "\\x21-\\x7e",
|
|
27
|
-
word: "A-Za-z0-9_"
|
|
28
|
-
};
|
|
29
|
-
/**
|
|
30
|
-
* Translate a POSIX ERE (what `grep -E` read) into a JS `RegExp` source.
|
|
31
|
-
*
|
|
32
|
-
* Bracket classes become their JS ranges. Syntax that `grep` and JS read
|
|
33
|
-
* differently, and that has no faithful translation, is refused with a
|
|
34
|
-
* reason: GNU word anchors `\<` `\>`, buffer anchors, collating and
|
|
35
|
-
* equivalence classes, a backslash inside a bracket expression (literal to
|
|
36
|
-
* grep, an escape to JS), and a back-reference to a group that does not
|
|
37
|
-
* exist (an octal escape to JS). Refusing is the point: a `not_contains`
|
|
38
|
-
* whose pattern silently stopped matching is a false pass.
|
|
39
|
-
*/
|
|
40
|
-
function translatePosixEre(pattern) {
|
|
41
|
-
let out = "";
|
|
42
|
-
let groups = 0;
|
|
43
|
-
for (let i = 0; i < pattern.length; i++) if (pattern[i] === "\\") i += 1;
|
|
44
|
-
else if (pattern[i] === "(" && pattern[i + 1] !== "?") groups += 1;
|
|
45
|
-
for (let i = 0; i < pattern.length; i++) {
|
|
46
|
-
const ch = pattern[i] ?? "";
|
|
47
|
-
if (ch === "\\") {
|
|
48
|
-
const next = pattern[i + 1];
|
|
49
|
-
if (next === void 0) return { error: "pattern ends with a backslash" };
|
|
50
|
-
if (next === "<" || next === ">") return { error: `\\${next} is a GNU word anchor with no JS equivalent; use \\b` };
|
|
51
|
-
if (next === "`" || next === "'") return { error: `\\${next} is a GNU buffer anchor; use ^ or $` };
|
|
52
|
-
if (/[1-9]/.test(next) && Number(next) > groups) return { error: `back-reference \\${next} names a group the pattern does not have` };
|
|
53
|
-
out += ch + next;
|
|
54
|
-
i += 1;
|
|
55
|
-
continue;
|
|
56
|
-
}
|
|
57
|
-
if (ch !== "[") {
|
|
58
|
-
out += ch;
|
|
59
|
-
continue;
|
|
60
|
-
}
|
|
61
|
-
let j = i + 1;
|
|
62
|
-
let body = "";
|
|
63
|
-
if (pattern[j] === "^") {
|
|
64
|
-
body += "^";
|
|
65
|
-
j += 1;
|
|
66
|
-
}
|
|
67
|
-
if (pattern[j] === "]") {
|
|
68
|
-
body += "\\]";
|
|
69
|
-
j += 1;
|
|
70
|
-
}
|
|
71
|
-
let closed = false;
|
|
72
|
-
while (j < pattern.length) {
|
|
73
|
-
const c = pattern[j] ?? "";
|
|
74
|
-
if (c === "]") {
|
|
75
|
-
closed = true;
|
|
76
|
-
break;
|
|
77
|
-
}
|
|
78
|
-
if (c === "[" && (pattern[j + 1] === ":" || pattern[j + 1] === "=" || pattern[j + 1] === ".")) {
|
|
79
|
-
const kind = pattern[j + 1];
|
|
80
|
-
const end = pattern.indexOf(`${kind}]`, j + 2);
|
|
81
|
-
if (end === -1) return { error: `unterminated [${kind} in a bracket expression` };
|
|
82
|
-
const name = pattern.slice(j + 2, end);
|
|
83
|
-
if (kind !== ":") return { error: `[${kind}${name}${kind}] has no JS equivalent` };
|
|
84
|
-
const range = POSIX_CLASSES[name];
|
|
85
|
-
if (range === void 0) return { error: `unknown class [:${name}:]` };
|
|
86
|
-
body += range;
|
|
87
|
-
j = end + 2;
|
|
88
|
-
continue;
|
|
89
|
-
}
|
|
90
|
-
if (c === "\\") return { error: "a backslash inside [...] is literal to grep and an escape to JS; use a POSIX class or move it outside the brackets" };
|
|
91
|
-
if (c === "[") body += "\\[";
|
|
92
|
-
else body += c;
|
|
93
|
-
j += 1;
|
|
94
|
-
}
|
|
95
|
-
if (!closed) return { error: "unterminated bracket expression" };
|
|
96
|
-
out += `[${body}]`;
|
|
97
|
-
i = j;
|
|
98
|
-
}
|
|
99
|
-
return out;
|
|
100
|
-
}
|
|
101
|
-
|
|
102
|
-
//#endregion
|
|
103
|
-
//#region ../shared/dist/runs/gate-op.js
|
|
104
|
-
const GATE_OP_CONTRACT_VERSION = 1;
|
|
105
|
-
const REPO_RELATIVE = "path must be repo-relative and must not contain ..";
|
|
106
|
-
/** Repo-relative, no `..` segment, not absolute, not home-relative. */
|
|
107
|
-
function isRepoRelative(value) {
|
|
108
|
-
if (value.length === 0 || value.includes("\0")) return false;
|
|
109
|
-
if (value.startsWith("/") || value.startsWith("~") || /^[A-Za-z]:[\\/]/.test(value)) return false;
|
|
110
|
-
return !value.split(/[\\/]/).includes("..");
|
|
111
|
-
}
|
|
112
|
-
const RepoRelativeCwd = z.string().refine(isRepoRelative, REPO_RELATIVE);
|
|
113
|
-
const RepoRelativePath = z.string().refine(isRepoRelative, REPO_RELATIVE);
|
|
114
|
-
const SandboxProfileSchema = z.object({
|
|
115
|
-
network_hosts: z.array(z.string()),
|
|
116
|
-
ports: z.array(z.number().int().nonnegative()),
|
|
117
|
-
read_paths: z.array(z.string()),
|
|
118
|
-
write_paths: z.array(z.string()),
|
|
119
|
-
env_allow: z.array(z.string()),
|
|
120
|
-
loopback: z.boolean(),
|
|
121
|
-
unsandboxed_on: z.array(z.enum(["linux", "wsl2"])).optional(),
|
|
122
|
-
unsandboxed_reason: z.string().optional()
|
|
123
|
-
});
|
|
124
|
-
const InspectPathParams = z.object({
|
|
125
|
-
path: RepoRelativePath,
|
|
126
|
-
glob: z.boolean().optional()
|
|
127
|
-
}).strict();
|
|
128
|
-
const ContainsParams = z.object({
|
|
129
|
-
path: RepoRelativePath,
|
|
130
|
-
glob: z.boolean().optional(),
|
|
131
|
-
pattern: z.string().optional(),
|
|
132
|
-
keywords: z.array(z.string()).optional(),
|
|
133
|
-
literal: z.boolean().optional()
|
|
134
|
-
}).strict().superRefine((params, ctx) => {
|
|
135
|
-
const hasPattern = params.pattern != null && params.pattern.length > 0;
|
|
136
|
-
const hasKeywords = (params.keywords?.length ?? 0) > 0;
|
|
137
|
-
if (!hasPattern && !hasKeywords) ctx.addIssue({
|
|
138
|
-
code: z.ZodIssueCode.custom,
|
|
139
|
-
message: "contains needs a pattern or keywords"
|
|
140
|
-
});
|
|
141
|
-
});
|
|
142
|
-
const DoneCriteriaParams = z.object({
|
|
143
|
-
path: RepoRelativePath,
|
|
144
|
-
glob: z.boolean().optional(),
|
|
145
|
-
requirements: z.array(z.union([z.string(), z.object({
|
|
146
|
-
pattern: z.string(),
|
|
147
|
-
label: z.string().optional()
|
|
148
|
-
}).strict()])).nonempty()
|
|
149
|
-
}).strict();
|
|
150
|
-
const JsonHasKeyParams = z.object({
|
|
151
|
-
path: RepoRelativePath,
|
|
152
|
-
glob: z.boolean().optional(),
|
|
153
|
-
key: z.string().min(1),
|
|
154
|
-
object: z.string().min(1).optional()
|
|
155
|
-
}).strict();
|
|
156
|
-
const SpecColumnsParams = z.object({
|
|
157
|
-
path: RepoRelativePath,
|
|
158
|
-
glob: z.boolean().optional(),
|
|
159
|
-
required_columns: z.union([z.string().min(1), z.array(z.string()).nonempty()])
|
|
160
|
-
}).strict();
|
|
161
|
-
const ArgvOpSchema = z.object({
|
|
162
|
-
op: z.literal("argv"),
|
|
163
|
-
cwd: RepoRelativeCwd,
|
|
164
|
-
argv: z.array(z.string()).nonempty()
|
|
165
|
-
}).strict();
|
|
166
|
-
const InspectOpSchema = z.discriminatedUnion("check", [
|
|
167
|
-
z.object({
|
|
168
|
-
op: z.literal("inspect"),
|
|
169
|
-
check: z.literal("exists"),
|
|
170
|
-
params: InspectPathParams
|
|
171
|
-
}).strict(),
|
|
172
|
-
z.object({
|
|
173
|
-
op: z.literal("inspect"),
|
|
174
|
-
check: z.literal("not_exists"),
|
|
175
|
-
params: InspectPathParams
|
|
176
|
-
}).strict(),
|
|
177
|
-
z.object({
|
|
178
|
-
op: z.literal("inspect"),
|
|
179
|
-
check: z.literal("contains"),
|
|
180
|
-
params: ContainsParams
|
|
181
|
-
}).strict(),
|
|
182
|
-
z.object({
|
|
183
|
-
op: z.literal("inspect"),
|
|
184
|
-
check: z.literal("not_contains"),
|
|
185
|
-
params: ContainsParams
|
|
186
|
-
}).strict(),
|
|
187
|
-
z.object({
|
|
188
|
-
op: z.literal("inspect"),
|
|
189
|
-
check: z.literal("done_criteria"),
|
|
190
|
-
params: DoneCriteriaParams
|
|
191
|
-
}).strict(),
|
|
192
|
-
z.object({
|
|
193
|
-
op: z.literal("inspect"),
|
|
194
|
-
check: z.literal("json_has_key"),
|
|
195
|
-
params: JsonHasKeyParams
|
|
196
|
-
}).strict(),
|
|
197
|
-
z.object({
|
|
198
|
-
op: z.literal("inspect"),
|
|
199
|
-
check: z.literal("spec_columns"),
|
|
200
|
-
params: SpecColumnsParams
|
|
201
|
-
}).strict(),
|
|
202
|
-
z.object({
|
|
203
|
-
op: z.literal("inspect"),
|
|
204
|
-
check: z.literal("migration_down_scope"),
|
|
205
|
-
params: InspectPathParams
|
|
206
|
-
}).strict()
|
|
207
|
-
]);
|
|
208
|
-
const JudgeOpSchema = z.object({
|
|
209
|
-
op: z.literal("judge"),
|
|
210
|
-
path: RepoRelativePath,
|
|
211
|
-
rubric: z.string(),
|
|
212
|
-
output_schema: z.string(),
|
|
213
|
-
judge_prompt: z.string(),
|
|
214
|
-
model: z.string().min(1),
|
|
215
|
-
runner: z.literal("agy"),
|
|
216
|
-
max_input_bytes: z.number().int().positive()
|
|
217
|
-
}).strict();
|
|
218
|
-
const GateOpSchema = z.union([
|
|
219
|
-
ArgvOpSchema,
|
|
220
|
-
InspectOpSchema,
|
|
221
|
-
JudgeOpSchema
|
|
222
|
-
]);
|
|
223
|
-
const AuthoringSourceSchema = z.object({
|
|
224
|
-
kind: z.enum(["binding", "definition"]),
|
|
225
|
-
id: z.string().uuid(),
|
|
226
|
-
workspace_id: z.string().uuid()
|
|
227
|
-
}).strict();
|
|
228
|
-
/**
|
|
229
|
-
* fail_closed: both `op` and `legacy_command`, or neither, is refused.
|
|
230
|
-
* A legacy carrier also keeps its authored `legacy_template` when the
|
|
231
|
-
* converter could not turn the template into argv.
|
|
232
|
-
*/
|
|
233
|
-
const GateOpEnvelopeSchema = z.object({
|
|
234
|
-
contract_version: z.literal(GATE_OP_CONTRACT_VERSION),
|
|
235
|
-
op: GateOpSchema.optional(),
|
|
236
|
-
legacy_command: z.string().min(1).optional(),
|
|
237
|
-
legacy_template: z.string().optional(),
|
|
238
|
-
link_id: z.string().uuid(),
|
|
239
|
-
step_id: z.string().optional(),
|
|
240
|
-
rule_hash: z.string().optional(),
|
|
241
|
-
expected: z.string(),
|
|
242
|
-
provenance: z.enum([
|
|
243
|
-
"seeded",
|
|
244
|
-
"binding",
|
|
245
|
-
"workspace_template",
|
|
246
|
-
"legacy",
|
|
247
|
-
"replicated"
|
|
248
|
-
]),
|
|
249
|
-
authored_digest: z.string().min(1),
|
|
250
|
-
content_digest: z.string().min(1),
|
|
251
|
-
authoring_source: AuthoringSourceSchema.optional(),
|
|
252
|
-
approval: z.enum([
|
|
253
|
-
"server_approved",
|
|
254
|
-
"confirm",
|
|
255
|
-
"denied"
|
|
256
|
-
]),
|
|
257
|
-
approval_basis: z.enum([
|
|
258
|
-
"kind",
|
|
259
|
-
"default_list",
|
|
260
|
-
"workspace_list"
|
|
261
|
-
]).optional(),
|
|
262
|
-
matched_pattern: z.string().optional(),
|
|
263
|
-
suggested_pattern: z.string().optional(),
|
|
264
|
-
sandbox: z.object({
|
|
265
|
-
mode: z.enum(["on", "off-by-gate"]),
|
|
266
|
-
profile: SandboxProfileSchema
|
|
267
|
-
}).strict(),
|
|
268
|
-
untested: z.boolean().optional(),
|
|
269
|
-
display: z.object({
|
|
270
|
-
posix: z.string(),
|
|
271
|
-
powershell: z.string()
|
|
272
|
-
}).strict()
|
|
273
|
-
}).strict().superRefine((value, ctx) => {
|
|
274
|
-
if (value.op !== void 0 === (value.legacy_command !== void 0)) ctx.addIssue({
|
|
275
|
-
code: z.ZodIssueCode.custom,
|
|
276
|
-
message: "fail_closed: envelope must carry exactly one of op and legacy_command"
|
|
277
|
-
});
|
|
278
|
-
});
|
|
279
|
-
|
|
280
|
-
//#endregion
|
|
281
6
|
//#region src/commands/gates/migration-down-scope.ts
|
|
282
7
|
/**
|
|
283
8
|
* The `migration_revert_scope` check — ENG-5106 L3a.
|
|
@@ -1131,7 +856,7 @@ Examples:
|
|
|
1131
856
|
flags: {}
|
|
1132
857
|
},
|
|
1133
858
|
loader: async () => {
|
|
1134
|
-
const { gatesInspectHandler: handler } = await import("./inspect-
|
|
859
|
+
const { gatesInspectHandler: handler } = await import("./inspect-CAxNgTwj.js");
|
|
1135
860
|
return handler;
|
|
1136
861
|
}
|
|
1137
862
|
});
|
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
import { authGetSitesV1, configureClient } from "./sdk-client-
|
|
2
|
-
import "./token-refresh-
|
|
3
|
-
import "./env-
|
|
4
|
-
import { resolveToken } from "./resolve-token-
|
|
5
|
-
import { loadWorkspace } from "./workspace-store-
|
|
1
|
+
import { authGetSitesV1, configureClient } from "./sdk-client-CSy2LOEh.js";
|
|
2
|
+
import "./token-refresh-DEmYbJ8V.js";
|
|
3
|
+
import "./env-Cv-anxJA.js";
|
|
4
|
+
import { resolveToken } from "./resolve-token-D1zteEfm.js";
|
|
5
|
+
import { loadWorkspace } from "./workspace-store-BJyB_WEG.js";
|
|
6
6
|
|
|
7
7
|
//#region src/commands/workspace/listHandler.ts
|
|
8
8
|
async function listHandler() {
|
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
import { configureClient } from "./sdk-client-
|
|
2
|
-
import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-
|
|
3
|
-
import { saveWorkspace } from "./workspace-store-
|
|
4
|
-
import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-
|
|
5
|
-
import { sleep } from "./sleep-
|
|
6
|
-
import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-
|
|
1
|
+
import { configureClient } from "./sdk-client-CSy2LOEh.js";
|
|
2
|
+
import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-Cv-anxJA.js";
|
|
3
|
+
import { saveWorkspace } from "./workspace-store-BJyB_WEG.js";
|
|
4
|
+
import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-CJN1plpd.js";
|
|
5
|
+
import { sleep } from "./sleep-DNLj0FMk.js";
|
|
6
|
+
import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-IWolSyrf.js";
|
|
7
7
|
import chalk from "chalk";
|
|
8
8
|
import { createHash, randomBytes } from "node:crypto";
|
|
9
9
|
import { createServer } from "node:http";
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import { deleteCredentials, getPatToken } from "./env-
|
|
2
|
-
import { clearWorkspace } from "./workspace-store-
|
|
1
|
+
import { deleteCredentials, getPatToken } from "./env-Cv-anxJA.js";
|
|
2
|
+
import { clearWorkspace } from "./workspace-store-BJyB_WEG.js";
|
|
3
3
|
|
|
4
4
|
//#region src/commands/auth/logoutHandler.ts
|
|
5
5
|
function logoutHandler() {
|