@magland/mochi 0.3.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Jeremy Magland
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,108 @@
+# Mochi Forge
+
+A self-hosted git forge, GitHub-shaped: repository browsing, in-browser editing, issues, pull requests, releases, Actions-style workflows, static sites, and Git LFS. One Node process, no database, nothing installed beside it but git.
+
+Mochi Forge is usually shortened to *mochi*, which is how the command, the npm package, and the vault's own files are spelled.
+
+Reading is anonymous, unless a repository is made private, in which case it is visible only to its collaborators, its collection's owners, and site admins. Every write is authorized by a token, and users are created by an administrator rather than registering themselves. Permissions are GitHub-shaped: a user owns the collection named after them, repositories take collaborators with read, write, or admin roles, and one site-admin bit runs the vault.
+
+## Try it locally
+
+```bash
+mkdir myvault
+npx @magland/mochi serve myvault
+```
+
+The server initializes the vault and prints an owner token once (only its hash is stored). Open http://127.0.0.1:3000, sign in at `/login` as `owner`, then push a repository in - the push creates it:
+
+```bash
+cd ~/some/project
+git push http://127.0.0.1:3000/alice/myproject main   # user 'owner', password the token
+```
+
+## Put it on the internet
+
+With a [Fly.io](https://fly.io) account and flyctl installed, one command creates the app, the volume, and the machine:
+
+```bash
+npm install -g @magland/mochi
+mochi deploy fly my-vault-name       # -> https://my-vault-name.fly.dev
+mochi login https://my-vault-name.fly.dev
+mochi user add alice
+```
+
+The same command deploys updates. See [Deploying a vault](docs/deploying.md) for Docker, self-hosting, costs, and giving the vault a domain of your own.
+
+## What it does
+
+- **Browsing:** files at any ref, syntax highlighting, markdown with KaTeX, history, diffs, blame, compare, search, contributors, archives. Anonymous, apart from private repositories. A collection introduces itself with a profile README, from a `.mochi` repository in it.
+- **Editing in the browser:** files, uploads, branches, tags, repositories, collections, forks, users. Controls a token cannot use are not shown.
+- **Issues and pull requests,** stored as markdown in the vault. Merge or squash, refused on conflicts.
+- **Releases** tied to a tag, with Atom feeds.
+- **Workflows:** GitHub Actions workflows, planned by the server and run by a Docker runner you start elsewhere, including one deployed to Fly.io with a command, which stops when idle and is woken by the vault when a job is queued. A job marked `runs-on: manual` instead waits for a command you paste on a machine of your choosing, which shows the steps and asks before executing them.
+- **Sites:** a static site per repository, sandboxed by default, optionally on its own hostname.
+- **Git:** anonymous clone over smart HTTP for public repositories and authenticated clone for private ones, token-authenticated push including push-to-create, and LFS to S3 or to the vault.
+- **CLI and JSON API** covering everything the web UI does, plus a generic `mochi api`. Built for scripts: `--json` everywhere, distinct exit codes, no prompts.
+
+The frontend has no build step and no client framework: plain server-rendered HTML with a little vanilla JavaScript.
+
+## The vault
+
+A vault is one directory. Repositories are grouped into *collections*; a vault holds any number of them and knows nothing of any other vault.
+
+```
+<vault>/
+  vault.json                  users and hashed tokens
+  config.json                 vault settings
+  collections/
+    alice/
+      repos/
+        webapp.git/           bare repository
+        webapp.site/          its static site
+        webapp.issues/        .pulls/ .releases/ .runs/ .lfs/
+```
+
+No database, no state outside the directory. Backup is `cp -a`, migration is `rsync`, and `mochi backup <dir>` pulls the same copy over HTTP where you have no shell. The server reads disk on every request, so a running vault can be read and grepped with ordinary tools.
+
+## Documentation
+
+- [Getting started](docs/getting-started.md) - a local vault, a public one, and a domain of your own
+- [The command line](docs/cli.md) - the `mochi` command and its subcommands
+- [The vault](docs/vault.md) - the on-disk layout, tokens, and sessions
+- [Deploying a vault](docs/deploying.md) | [Backing up a vault](docs/backup.md)
+- [Workflows](docs/workflows.md) | [Sites](docs/sites.md) | [Git LFS](docs/lfs.md) | [Themes](docs/themes.md) | [Issues and pull requests](docs/issues-and-pull-requests.md)
+- [The JSON API](docs/api.md) - every route, body, and response
+- [Mochi Forge for an agent](docs/agents.md) - short enough to paste into a context window
+
+## Using a vault from Claude Code
+
+[mochi-skill](https://github.com/magland/mochi-skill) teaches an agent this CLI the way it already knows `gh`.
+
+```
+/plugin marketplace add magland/mochi-skill
+/plugin install mochi@mochi-skill
+```
+
+The agent needs `mochi` on its PATH and either `MOCHI_HOST`/`MOCHI_TOKEN` or a completed `mochi login`.
+
+## Development
+
+```bash
+npm install
+npm run example    # creates example-root/ with sample data and a dev user
+npm run dev        # serves example-root/ at http://127.0.0.1:3000
+npm run test:unit  # the pure modules, in milliseconds
+npm run smoke      # end to end; npm run smoke:slow adds containerized workflow jobs
+```
+
+The example vault has site admin `dev` with token `mochi_example_dev_token` (example vault only) and plain user `reader` with `mochi_example_reader_token`.
+
+## Roadmap
+
+- Secrets, and widening the per-job token (today it grants read for the clone, private repositories included) so a workflow can push to its own repository and call the API
+- `actions/cache`
+- Docker actions, `container:` jobs, and service containers
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

package/dist/ansi.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripAnsi = stripAnsi;
+exports.ansiLineHtml = ansiLineHtml;
+const render_1 = require("./render");
+const DEFAULT = { bold: false, dim: false, italic: false, underline: false, fgClass: null, fgColor: null };
+// Each class resolves to an --ansi-* token the active theme defines (see
+// themes.ts), so a dark theme brightens the palette and a light one darkens
+// it, like every other colour in the interface.
+const FG_CLASS = {
+    30: 'a-blk', 31: 'a-red', 32: 'a-grn', 33: 'a-yel',
+    34: 'a-blu', 35: 'a-mag', 36: 'a-cyn', 37: 'a-wht',
+    90: 'a-bblk', 91: 'a-bred', 92: 'a-bgrn', 93: 'a-byel',
+    94: 'a-bblu', 95: 'a-bmag', 96: 'a-bcyn', 97: 'a-bwht',
+};
+/** The 6x6x6 cube's channel values, per xterm. */
+const CUBE = [0, 95, 135, 175, 215, 255];
+/**
+ * A 256-colour or truecolour foreground as inline CSS, pulled towards the
+ * middle when it sits at either extreme: near-white is invisible on a light
+ * theme and near-black on a dark one, and a log has to be readable on both.
+ */
+function inlineColor(r, g, b) {
+    const l = (0.299 * r + 0.587 * g + 0.114 * b) / 255;
+    if (l > 0.82 || l < 0.18)
+        return 'var(--fg-muted, #6e7781)';
+    return `rgb(${r},${g},${b})`;
+}
+function color256(n) {
+    if (n < 0 || n > 255)
+        return null;
+    if (n < 8)
+        return null; // caller maps to the classed palette
+    if (n < 16)
+        return null;
+    if (n < 232) {
+        const c = n - 16;
+        return inlineColor(CUBE[Math.floor(c / 36)], CUBE[Math.floor(c / 6) % 6], CUBE[c % 6]);
+    }
+    const v = 8 + (n - 232) * 10;
+    return inlineColor(v, v, v);
+}
+/** Apply one SGR parameter list to a style, consuming extended-colour params. */
+function applySgr(params, style) {
+    const s = { ...style };
+    for (let i = 0; i < params.length; i++) {
+        const p = params[i];
+        if (p === 0)
+            Object.assign(s, DEFAULT);
+        else if (p === 1)
+            s.bold = true;
+        else if (p === 2)
+            s.dim = true;
+        else if (p === 3)
+            s.italic = true;
+        else if (p === 4)
+            s.underline = true;
+        else if (p === 22) {
+            s.bold = false;
+            s.dim = false;
+        }
+        else if (p === 23)
+            s.italic = false;
+        else if (p === 24)
+            s.underline = false;
+        else if (p === 39) {
+            s.fgClass = null;
+            s.fgColor = null;
+        }
+        else if (FG_CLASS[p]) {
+            s.fgClass = FG_CLASS[p];
+            s.fgColor = null;
+        }
+        else if (p === 38 || p === 48) {
+            // Extended colour; 48 (background) consumes its params and is dropped.
+            const mode = params[i + 1];
+            if (mode === 5) {
+                const n = params[i + 2] ?? -1;
+                if (p === 38) {
+                    if (n >= 0 && n < 8) {
+                        s.fgClass = FG_CLASS[30 + n];
+                        s.fgColor = null;
+                    }
+                    else if (n >= 8 && n < 16) {
+                        s.fgClass = FG_CLASS[90 + (n - 8)];
+                        s.fgColor = null;
+                    }
+                    else {
+                        const c = color256(n);
+                        if (c) {
+                            s.fgColor = c;
+                            s.fgClass = null;
+                        }
+                    }
+                }
+                i += 2;
+            }
+            else if (mode === 2) {
+                if (p === 38) {
+                    s.fgColor = inlineColor(params[i + 2] ?? 0, params[i + 3] ?? 0, params[i + 4] ?? 0);
+                    s.fgClass = null;
+                }
+                i += 4;
+            }
+        }
+        // 40-47, 100-107 backgrounds and everything else: dropped.
+    }
+    return s;
+}
+/**
+ * A terminal shows a line with carriage returns in it as whatever was written
+ * after the last one, so that is what the reader gets: `50%\r100%` is `100%`,
+ * and a line that ends mid-rewrite falls back to its last non-empty state.
+ */
+function resolveCr(line) {
+    if (!line.includes('\r'))
+        return line;
+    const parts = line.split('\r');
+    for (let i = parts.length - 1; i >= 0; i--) {
+        if (parts[i] !== '')
+            return parts[i];
+    }
+    return '';
+}
+// SGR is captured; every other escape -- cursor movement, OSC titles, stray
+// escapes -- matches an uncaptured alternative and is dropped.
+const TOKEN = /\x1b\[([0-9;]*)m|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b\[[0-9;?]*[A-Za-z]|\x1b./g;
+/** The line with every escape sequence removed and carriage returns resolved: what a live tail appends as text. */
+function stripAnsi(line) {
+    return resolveCr(line).replace(TOKEN, '');
+}
+/**
+ * The line as HTML: text escaped, SGR styling as spans. The classes and the
+ * clamped inline colours are the only markup that can come out of it, whatever
+ * bytes a job wrote.
+ */
+function ansiLineHtml(line) {
+    const resolved = resolveCr(line);
+    if (!resolved.includes('\x1b'))
+        return (0, render_1.esc)(resolved);
+    let out = '';
+    let style = { ...DEFAULT };
+    let last = 0;
+    const emit = (text) => {
+        if (text === '')
+            return;
+        const classes = [
+            style.fgClass,
+            style.bold ? 'a-b' : null,
+            style.dim ? 'a-d' : null,
+            style.italic ? 'a-i' : null,
+            style.underline ? 'a-u' : null,
+        ].filter((c) => c !== null);
+        const styled = classes.length > 0 || style.fgColor !== null;
+        if (!styled) {
+            out += (0, render_1.esc)(text);
+            return;
+        }
+        const cls = classes.length ? ` class="${classes.join(' ')}"` : '';
+        const inline = style.fgColor ? ` style="color:${style.fgColor}"` : '';
+        out += `<span${cls}${inline}>${(0, render_1.esc)(text)}</span>`;
+    };
+    TOKEN.lastIndex = 0;
+    for (let m = TOKEN.exec(resolved); m !== null; m = TOKEN.exec(resolved)) {
+        emit(resolved.slice(last, m.index));
+        last = m.index + m[0].length;
+        if (m[1] !== undefined) {
+            const params = m[1] === '' ? [0] : m[1].split(';').map((x) => (x === '' ? 0 : parseInt(x, 10)));
+            style = applySgr(params, style);
+        }
+    }
+    emit(resolved.slice(last));
+    return out;
+}