@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

package/src/sweeps.js

@@ -0,0 +1,241 @@
+import { repoRoot } from "./git.js";
+import {
+  alertsError,
+  isPlainPath,
+  LIST_CAP,
+  listCodeScanningAlerts,
+  listDependabotAlerts,
+  listDependabotPrs,
+  listOpenIssues,
+  listSecretScanningAlerts,
+  severityRank
+} from "./github.js";
+const NOT_A_FIX = /^(question|wontfix|won't fix|duplicate|invalid|discussion|needs[- ]info)$/i;
+async function listSweep(repo, kind, runs) {
+  const list = kind === "issues" ? await issueItems(repo) : kind === "dependabot" ? await dependabotItems(repo) : await alertItems(repo);
+  const root = await repoRoot(repo).catch(() => repo);
+  for (const item of list.items) {
+    const covering = item.source ? coveringRun(runs, root, item.source) : void 0;
+    if (covering) {
+      item.existingRun = covering.id;
+      item.selected = false;
+      item.note = covering.status === "running" ? "A run is working on it" : "Already has a run";
+    }
+  }
+  return list;
+}
+const cutShort = (what, cap) => `Only the first ${cap} ${what} are listed; sweep again once these are done`;
+async function issueItems(repo) {
+  const issues = await listOpenIssues(repo);
+  return {
+    kind: "issues",
+    notices: issues.truncated ? [cutShort("open issues", LIST_CAP)] : [],
+    items: issues.items.map((i) => {
+      const skip = i.labels.find((l) => NOT_A_FIX.test(l));
+      return {
+        key: `issue#${i.number}`,
+        ref: `#${i.number}`,
+        title: i.title,
+        detail: i.labels.join(" \xB7 "),
+        labels: i.labels,
+        url: i.url,
+        selected: !skip,
+        note: skip ? `Labelled \u201C${skip}\u201D` : void 0,
+        // Not the title: whoever opened the issue wrote it, and the task is read as instructions.
+        // The run gets the title with the issue's text, fenced as information.
+        task: `Fix issue #${i.number}. Add a test that fails without the fix.`,
+        source: { kind: "issue", number: i.number }
+      };
+    })
+  };
+}
+const CI_NOTE = { pass: "CI passes \u2014 ready for you to merge", pending: "CI is still running", none: "No CI checks reported" };
+async function dependabotItems(repo) {
+  const prs = await listDependabotPrs(repo);
+  return {
+    kind: "dependabot",
+    notices: prs.truncated ? [cutShort("Dependabot pull requests", prs.items.length)] : [],
+    items: prs.items.map((pr) => ({
+      key: `pr#${pr.number}`,
+      ref: `#${pr.number}`,
+      title: pr.title,
+      detail: `${pr.ci === "fail" ? "CI failing" : pr.ci === "pass" ? "CI green" : pr.ci === "pending" ? "CI running" : "no CI"} \xB7 ${pr.headRefName}`,
+      url: pr.url,
+      // Only a failing PR needs an agent; code-flow never merges the green ones for you.
+      selected: pr.ci === "fail",
+      note: pr.ci === "fail" ? void 0 : CI_NOTE[pr.ci],
+      // The PR's title stays out of the task: package names and versions come from upstream.
+      task: `Make CI pass on Dependabot's pull request #${pr.number}. The failing checks and their logs are below. Fix the cause by adapting the code to the new version; don't pin it back, and don't disable, skip or weaken tests.`,
+      source: { kind: "pr", number: pr.number, ciLogs: true }
+    }))
+  };
+}
+async function alertItems(repo) {
+  const [dependabot, codeScanning, secrets, prs] = await Promise.allSettled([
+    listDependabotAlerts(repo),
+    listCodeScanningAlerts(repo),
+    listSecretScanningAlerts(repo),
+    listDependabotPrs(repo)
+  ]);
+  const notices = [];
+  const items = [];
+  const openPrs = prs.status === "fulfilled" ? prs.value.items : [];
+  const note = (what, list) => list.truncated && notices.push(cutShort(what, list.items.length));
+  if (dependabot.status === "fulfilled") {
+    items.push(...dependabotAlertItems(dependabot.value.items, openPrs));
+    note("Dependabot alerts", dependabot.value);
+  } else notices.push(alertsError("Dependabot alerts", dependabot.reason));
+  if (codeScanning.status === "fulfilled") {
+    note("code scanning alerts", codeScanning.value);
+    for (const a of codeScanning.value.items) {
+      const rule = a.rule ?? {};
+      const where = a.most_recent_instance?.location ?? {};
+      const severity = String(rule.security_severity_level ?? rule.severity ?? "unknown");
+      const serious = severityRank(severity) <= severityRank("medium");
+      const title = rule.description || rule.name || rule.id;
+      const at = where.path ? `${where.path}${where.start_line ? `:${where.start_line}` : ""}` : "";
+      items.push({
+        key: `code-scanning#${a.number}`,
+        ref: `#${a.number}`,
+        title,
+        detail: [at, a.tool?.name].filter(Boolean).join(" \xB7 "),
+        url: a.html_url,
+        severity,
+        selected: serious,
+        note: serious ? void 0 : "Low severity",
+        // The path is the code's: one that carries words stays out of the task (the run's prompt
+        // has it in the alert's fence).
+        task: `Fix code scanning alert #${a.number}: ${title}${at && isPlainPath(at) ? ` in ${at}` : ""}. Fix the cause rather than suppressing the alert, and add a test where it makes sense.`,
+        source: { kind: "alert", tool: "code-scanning", number: a.number }
+      });
+    }
+  } else notices.push(alertsError("Code scanning alerts", codeScanning.reason));
+  if (secrets.status === "fulfilled") {
+    note("leaked secrets", secrets.value);
+    for (const a of secrets.value.items) {
+      items.push({
+        key: `secret#${a.number}`,
+        ref: `#${a.number}`,
+        title: a.secret_type_display_name || a.secret_type || "Leaked secret",
+        detail: "Leaked secret \u2014 revoke and rotate it, then close the alert",
+        url: a.html_url,
+        severity: "critical",
+        selected: false,
+        manual: true,
+        note: "Needs you: agents never get secrets"
+      });
+    }
+  } else notices.push(alertsError("Secret scanning alerts", secrets.reason));
+  items.sort((a, b) => severityRank(a.severity) - severityRank(b.severity) || a.key.localeCompare(b.key));
+  return { kind: "alerts", items, notices };
+}
+function dependabotAlertItems(alerts, prs) {
+  const byPackage = /* @__PURE__ */ new Map();
+  for (const a of alerts) {
+    const pkg = a.dependency?.package ?? a.security_vulnerability?.package ?? {};
+    const key = `${pkg.ecosystem}/${pkg.name}`;
+    byPackage.set(key, [...byPackage.get(key) ?? [], a]);
+  }
+  return [...byPackage.entries()].map(([key, group]) => {
+    group.sort((a, b) => severityRank(a.security_advisory?.severity) - severityRank(b.security_advisory?.severity));
+    const worst = group[0];
+    const pkg = worst.dependency?.package ?? worst.security_vulnerability?.package ?? {};
+    const numbers = group.map((a) => a.number).sort((a, b) => a - b);
+    const severity = String(worst.security_advisory?.severity ?? "unknown");
+    const patched = group.map((a) => a.security_vulnerability?.first_patched_version?.identifier).filter((v) => !!v).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).at(-1);
+    const covered = prs.find((pr) => upgrades(pr, pkg.name));
+    const manifest = worst.dependency?.manifest_path;
+    const count = numbers.length > 1 ? `${numbers.length} Dependabot alerts` : `Dependabot alert #${numbers[0]}`;
+    return {
+      key: `dependabot#${numbers[0]}`,
+      legacyKey: `dependabot:${key}`,
+      ref: numbers.length > 1 ? `${numbers.length} alerts` : `#${numbers[0]}`,
+      title: `${pkg.name} (${pkg.ecosystem})`,
+      detail: [`${worst.security_vulnerability?.vulnerable_version_range ?? "?"} \u2192 ${patched ?? "no fix yet"}`, worst.security_advisory?.summary].filter(Boolean).join(" \xB7 "),
+      url: worst.html_url,
+      severity,
+      selected: !covered && !!patched,
+      note: covered ? `Dependabot PR #${covered.number} already upgrades it` : patched ? void 0 : "No patched version yet",
+      task: patched ? `Fix ${count} in ${pkg.name} (${pkg.ecosystem}): upgrade it to ${patched} or later${manifest ? ` in ${manifest}` : ""}. Update anything the upgrade breaks and keep the tests passing.` : `Mitigate ${count} in ${pkg.name} (${pkg.ecosystem}): no patched version exists yet. Avoid the vulnerable code path or replace the package, and explain what you did.`,
+      source: { kind: "alert", tool: "dependabot", number: numbers[0], numbers }
+    };
+  });
+}
+function upgrades(pr, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\bbump ${escaped} from\\b`, "i").test(pr.title) || new RegExp(`/${escaped.replace(/\//g, "\\/")}-\\d`).test(pr.headRefName);
+}
+function coveringRun(runs, repo, source) {
+  const standing = runs.filter(
+    (r) => r.repo === repo && !r.archived && r.triage?.state !== "rejected" && r.status !== "failed" && r.status !== "cancelled" && r.source?.kind === source.kind
+  );
+  if (source.kind !== "alert") return standing.find((r) => r.source.number === source.number);
+  const numbers = source.numbers?.length ? source.numbers : [source.number];
+  const covers = numbers.map((n) => standing.find((r) => r.source.alert?.tool === source.tool && (r.source.alert?.numbers ?? [r.source.number]).includes(n)));
+  return covers.every(Boolean) ? covers[0] : void 0;
+}
+function sourceKeys(source) {
+  if (source.kind !== "alert") return [`${source.kind}#${source.number}`];
+  const numbers = source.numbers?.length ? source.numbers : [source.number];
+  return numbers.map((n) => `${source.tool ?? "alert"}#${n}`);
+}
+const SWEEP_SOURCE = { issues: "issue", dependabot: "pr", alerts: "alert" };
+const sweepTakes = (kind, source) => SWEEP_SOURCE[kind] === source.kind;
+function findSweepItem(list, source) {
+  return list.items.find((i) => {
+    const s = i.source;
+    if (!s || s.kind !== source.kind) return false;
+    if (s.kind !== "alert") return s.number === source.number;
+    return s.tool === source.tool && (s.numbers ?? [s.number]).includes(source.number);
+  });
+}
+function upgradeLegacyKeys(list, handled) {
+  let changed = false;
+  for (const item of list.items) {
+    if (!item.legacyKey || !item.source || !handled.has(item.legacyKey)) continue;
+    handled.delete(item.legacyKey);
+    for (const key of sourceKeys(item.source)) handled.add(key);
+    changed = true;
+  }
+  return changed;
+}
+async function runSweep(input) {
+  const outcome = { started: [], skipped: [], failed: [] };
+  const root = await repoRoot(input.repo).catch(() => input.repo);
+  const queue = [...input.items];
+  const seen = /* @__PURE__ */ new Set();
+  const worker = async () => {
+    for (let item = queue.shift(); item; item = queue.shift()) {
+      if (seen.has(item.key)) continue;
+      seen.add(item.key);
+      const covering = coveringRun(input.runs, root, item.source);
+      if (covering) {
+        outcome.skipped.push({ key: item.key, why: `already has run ${covering.id}` });
+        continue;
+      }
+      try {
+        const run = await input.start(item);
+        outcome.started.push({ key: item.key, id: run.id });
+      } catch (err) {
+        outcome.failed.push({ key: item.key, error: err.message });
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, input.concurrency ?? 2) }, worker));
+  const order = new Map(input.items.map((item, i) => [item.key, i]));
+  for (const list of [outcome.started, outcome.skipped, outcome.failed]) list.sort((a, b) => order.get(a.key) - order.get(b.key));
+  return outcome;
+}
+function nextSweepItems(list, handled, max) {
+  return list.items.filter((i) => i.selected && !i.manual && i.source && i.task && !sourceKeys(i.source).every((k) => handled.has(k))).slice(0, max).map((i) => ({ key: i.key, task: i.task, source: i.source }));
+}
+export {
+  coveringRun,
+  findSweepItem,
+  listSweep,
+  nextSweepItems,
+  runSweep,
+  sourceKeys,
+  sweepTakes,
+  upgradeLegacyKeys
+};

package/src/tailscale.js

@@ -0,0 +1,101 @@
+import { execFile } from "node:child_process";
+import { isIPv4 } from "node:net";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { certificateHostname, validateRemoteCertificate } from "./remote-tls.js";
+import { childEnv } from "./env.js";
+function isTailscaleIPv4(address) {
+  if (!isIPv4(address)) return false;
+  const [a, b] = address.split(".").map(Number);
+  return a === 100 && b >= 64 && b <= 127;
+}
+function parseTailscaleStatus(output) {
+  const raw = JSON.parse(output);
+  if (!raw || typeof raw !== "object") throw new Error("Invalid Tailscale status");
+  switch (raw.BackendState) {
+    case "NeedsLogin":
+      return { state: "needs-login", message: "Sign in to Tailscale on this computer, then refresh." };
+    case "NeedsMachineAuth":
+      return { state: "needs-approval", message: "Ask your tailnet administrator to approve this computer, then refresh." };
+    case "Stopped":
+      return { state: "stopped", message: "Turn on Tailscale on this computer, then refresh." };
+    case "Starting":
+      return { state: "starting", message: "Tailscale is connecting. Codeflow will check again automatically." };
+    case "Running":
+      break;
+    default:
+      return { state: "unavailable", message: "Tailscale is not ready. Open Tailscale on this computer and check its connection." };
+  }
+  if (raw.TUN === false) return { state: "unavailable", message: "Direct access needs Tailscale's network interface. Userspace networking is not supported." };
+  if (raw.Self?.Online === false) return { state: "unavailable", message: "Tailscale reports this computer offline. Reconnect Tailscale, then refresh." };
+  const ip = Array.isArray(raw.TailscaleIPs) ? raw.TailscaleIPs.find((value) => typeof value === "string" && isTailscaleIPv4(value)) : void 0;
+  if (!ip) return { state: "unavailable", message: "Tailscale has no usable IPv4 address. Reconnect Tailscale, then refresh." };
+  const dns = typeof raw.Self?.DNSName === "string" ? raw.Self.DNSName.replace(/\.$/, "").toLowerCase() : "";
+  const dnsName = dns.length <= 253 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?\.ts\.net$/.test(dns) ? dns : void 0;
+  return { state: "connected", message: "Tailscale is connected.", ip, ...dnsName ? { dnsName } : {} };
+}
+const run = promisify(execFile);
+function commands() {
+  const names = ["tailscale"];
+  if (process.platform === "darwin") names.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
+  if (process.platform === "win32") names.push(join(process.env.ProgramFiles || "C:\\Program Files", "Tailscale", "tailscale.exe"));
+  return names;
+}
+async function detectTailscale(candidates = commands()) {
+  for (const command of candidates) {
+    try {
+      const { stdout } = await run(command, ["status", "--json", "--peers=false"], {
+        env: childEnv({ TAILSCALE_BE_CLI: "1" }),
+        timeout: 4e3,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true
+      });
+      return parseTailscaleStatus(stdout);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      const stdout = error.stdout;
+      if (stdout) {
+        try {
+          return parseTailscaleStatus(stdout);
+        } catch {
+        }
+      }
+      return { state: "unavailable", message: "Could not read Tailscale status. Open Tailscale and check that its service is running, then refresh." };
+    }
+  }
+  return { state: "not-installed", message: "Install Tailscale on this computer and your remote device, sign in to the same tailnet, then refresh." };
+}
+async function requestTailscaleCertificate(hostname, candidates = commands()) {
+  const host = certificateHostname(hostname);
+  if (!host.endsWith(".ts.net")) throw new Error("Connect Tailscale with a valid tailnet DNS name first");
+  const directory = await mkdtemp(join(tmpdir(), "codeflow-tls-"));
+  try {
+    for (const command of candidates) {
+      try {
+        await run(command, ["cert", `--cert-file=${join(directory, "cert.pem")}`, `--key-file=${join(directory, "key.pem")}`, "--min-validity=720h", host], {
+          env: childEnv({ TAILSCALE_BE_CLI: "1" }),
+          timeout: 6e4,
+          maxBuffer: 64 * 1024,
+          windowsHide: true
+        });
+        const value = { hostname: host, source: "tailscale", cert: await readFile(join(directory, "cert.pem"), "utf8"), key: await readFile(join(directory, "key.pem"), "utf8") };
+        validateRemoteCertificate(value);
+        return value;
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw new Error("Tailscale could not issue the certificate. Enable HTTPS certificates in your tailnet DNS settings, check that this user can run tailscale cert, and use a current Tailscale version. Then retry or import certificate files.");
+      }
+    }
+    throw new Error("Tailscale CLI was not found. Install Tailscale or import certificate files.");
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+export {
+  detectTailscale,
+  isTailscaleIPv4,
+  parseTailscaleStatus,
+  requestTailscaleCertificate
+};

package/src/task-draft.js

@@ -0,0 +1,23 @@
+const TASK_DRAFT_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["title", "goal", "acceptance"],
+  properties: {
+    title: { type: "string", minLength: 1, maxLength: 200 },
+    goal: { type: "string", minLength: 1, maxLength: 16384 },
+    acceptance: { type: "string", minLength: 1, maxLength: 8192 }
+  }
+};
+function taskDraftProblem(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "Expected a task draft object";
+  const draft = value;
+  if (Object.keys(draft).some((key) => !["title", "goal", "acceptance"].includes(key))) return "Unexpected task draft field";
+  for (const [key, limit] of [["title", 200], ["goal", 16384], ["acceptance", 8192]]) {
+    const text = draft[key];
+    if (typeof text !== "string" || !text.trim() || text.length > limit || text.includes("\0")) return `Draft ${key} must contain 1\u2013${limit} characters`;
+  }
+}
+export {
+  TASK_DRAFT_SCHEMA,
+  taskDraftProblem
+};

package/src/task-team.js

@@ -0,0 +1,164 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { git, worktreeGit } from "./git.js";
+import { validateAgentSettings } from "./adapters/index.js";
+class TaskTeamConflict extends Error {
+  constructor(reconciliation) {
+    super("Your edits overlap the team's changes. Review the conflicting files; both versions are preserved.");
+    this.reconciliation = reconciliation;
+  }
+}
+const normalizedRequest = (request) => request.trim().toLowerCase().replace(/[’‘]/g, "'").replace(/^(?:(?:please|can you|could you|would you)\s+)+/, "");
+function taskTeamControl(request) {
+  const text = normalizedRequest(request);
+  const match = /^(stop|cancel|pause|wait|hold on)(?:\s+(?:(?:the|this|all|current)\s+)?(?:team|task|run|work|execution|everything|working))?(?=\s*(?:[.!?]|$|(?:and|for now|please)\b))/.exec(text);
+  return match ? /^(pause|wait|hold on)$/.test(match[1]) ? "pause" : "stop" : void 0;
+}
+function taskTeamQuestionReply(request) {
+  const text = normalizedRequest(request);
+  if (taskTeamControl(text)) return false;
+  if (/^(?:what|why|how|explain|summari[sz]e|describe|tell me|status)\b/.test(text)) return false;
+  if (/^(?:implement|build|add|remove|delete|refactor|fix|update|change|create|deploy|commit|push|run|test|keep|preserve|stop|avoid|leave|don't|do not)\b/.test(text)) return false;
+  if (/(?:[;.!?]|\bbut|\bthen)\s*(?:please\s+)?(?:fix|update|change|stop|keep|preserve|use|switch)\b/.test(text)) return false;
+  return true;
+}
+function taskTeamRoute(request, active = false) {
+  const text = normalizedRequest(request);
+  if (/\b(use|ask|start|run|delegate|bring in)\b.{0,32}\b(team|teammates|workers)\b/.test(text)) return "team";
+  const work = "implement|build|add|remove|delete|refactor|fix|update|change|create|deploy|commit|push|run|test|upload|download|click|type|keep|preserve|stop|avoid|leave|don't|do not";
+  const alsoWork = new RegExp(`(?:\\b(?:and|then|also|now|but|instead)\\b|[.;?!,]|\\n)\\s*(?:(?:can|could|would) you\\s+|please\\s+)?(?:${work}|use|switch|assign|delegate)\\b`).test(text);
+  if (alsoWork || /^(?:keep|preserve|stop|avoid|leave|don't|do not)\b/.test(text) || /^what about (?:keeping|preserving|leaving|stopping|avoiding|changing|updating)\b/.test(text)) return "team";
+  if (/^(hi|hello|hey|thanks|thank you|ok|okay|great|got it)[.! ]*$/.test(text)) return "direct";
+  if (/^(what\b|why\b|how (?:does|do|did|is|are|can|would)\b|explain\b|summari[sz]e\b|describe\b|tell me\b|status\b|any (?:update|progress))/.test(text) && text.length < 3e3) return "direct";
+  if (/^(?:is|are|was|were|does|should)\b/.test(text) && text.endsWith("?")) return "direct";
+  if (!active && /^(?:just|only) (?:rename|change|fix|update|remove)\b/.test(text) && text.length < 300 && !/\b(?:and|then|also)\b|[;\n]/.test(text)) return "direct";
+  return "team";
+}
+function validateTaskTeam(raw) {
+  const v = raw;
+  if (!v || typeof v !== "object" || typeof v.enabled !== "boolean") throw new Error("Choose whether Team is enabled");
+  const supported = (id) => ["claude", "codex", "agy"].includes(String(id));
+  if (!supported(v.coordinator) || !Array.isArray(v.providers) || !v.providers.length || v.providers.length > 3 || !v.providers.every(supported) || new Set(v.providers).size !== v.providers.length) throw new Error("Choose a coordinator and at least one available team provider");
+  if (!["adaptive", "build-review", "investigate"].includes(v.preset)) throw new Error("Choose a team template");
+  for (const [name, min, max] of [["maxMembers", 3, 6], ["maxCalls", 4, 200], ["maxMinutes", 1, 720]]) if (!Number.isInteger(v[name]) || v[name] < min || v[name] > max) throw new Error(`${name} must be between ${min} and ${max}`);
+  if (typeof v.approvePlan !== "boolean") throw new Error("Choose a plan approval preference");
+  const settings = validateAgentSettings(v.settings ?? {});
+  let template;
+  if (v.template) {
+    const t = v.template;
+    if (typeof t.id !== "string" || !Number.isInteger(t.version) || t.version < 1 || !t.inputs || typeof t.inputs !== "object" || Array.isArray(t.inputs) || Object.values(t.inputs).some((value) => typeof value !== "string" || value.length > 1e5)) throw new Error("Invalid saved team template");
+    template = { id: t.id, version: t.version, inputs: { ...t.inputs } };
+  }
+  return { enabled: v.enabled, preset: v.preset, coordinator: v.coordinator, providers: [...v.providers], settings, maxMembers: v.maxMembers, maxCalls: v.maxCalls, maxMinutes: v.maxMinutes, approvePlan: v.approvePlan, ...template ? { template } : {} };
+}
+async function checked(at, args, extra = {}) {
+  const r = await git(args, at, extra);
+  if (r.code !== 0) throw new Error(r.stderr || "Could not prepare the team workspace");
+  return r.stdout.trim();
+}
+async function taskCheckpoint(repo, path) {
+  const at = await worktreeGit(repo, path), temp = await mkdtemp(join(tmpdir(), "codeflow-team-index-"));
+  try {
+    const env = { GIT_INDEX_FILE: join(temp, "index") };
+    await checked(at, ["read-tree", "HEAD"], { env });
+    await checked(at, ["add", "-A", "--", ".", ":(exclude)**/.codeflow-context/**"], { env });
+    const tree = await checked(at, ["write-tree"], { env });
+    const head = await checked(at, ["rev-parse", "HEAD"]);
+    return await checked(at, ["-c", "user.name=code-flow", "-c", "user.email=code-flow@local.invalid", "commit-tree", tree, "-p", head, "-m", "Private team handoff checkpoint"]);
+  } finally {
+    await rm(temp, { recursive: true, force: true });
+  }
+}
+async function applyTaskTeamResult(repo, path, baseline, result) {
+  const at = await worktreeGit(repo, path);
+  const current = await taskCheckpoint(repo, path);
+  const tree = (ref) => checked(at, ["rev-parse", `${ref}^{tree}`]);
+  const [before, after, now] = await Promise.all([tree(baseline), tree(result), tree(current)]);
+  if (now === after || before === after) return { reconciled: false };
+  let target = result;
+  if (now !== before) {
+    const merge = await prepareTaskReconciliation(repo, path, baseline, result, current);
+    if (merge.conflicts.length) throw new TaskTeamConflict(merge);
+    target = merge.merged;
+  }
+  await applySnapshot(at, current, target);
+  return { reconciled: now !== before };
+}
+async function applySnapshot(at, current, result) {
+  const diff = await git(["diff", "--binary", "--no-ext-diff", "--no-textconv", current, result, "--"], at);
+  if (diff.code) throw new Error(diff.stderr);
+  if (!diff.stdout) return;
+  await checked(at, ["apply", "--check", "--whitespace=nowarn", "-"], { input: diff.stdout });
+  await checked(at, ["apply", "--whitespace=nowarn", "-"], { input: diff.stdout });
+}
+async function prepareTaskReconciliation(repo, path, baseline, result, current) {
+  const at = await worktreeGit(repo, path);
+  current ??= await taskCheckpoint(repo, path);
+  const sibling = async (ref) => checked(at, ["-c", "user.name=code-flow", "-c", "user.email=code-flow@local.invalid", "commit-tree", await checked(at, ["rev-parse", `${ref}^{tree}`]), "-p", baseline, "-m", "Private reconciliation snapshot"]);
+  const merged = await git(["merge-tree", "--write-tree", "--name-only", "-z", await sibling(current), await sibling(result)], at);
+  if (merged.code !== 0 && merged.code !== 1) throw new Error(merged.stderr || "Could not compare workspace changes");
+  const fields = merged.stdout.split("\0"), tree = fields.shift();
+  if (!/^[a-f0-9]{40,64}$/.test(tree)) throw new Error("Invalid reconciliation tree");
+  const end = fields.indexOf("");
+  const conflicts = merged.code === 1 ? fields.slice(0, end < 0 ? fields.length : end) : [];
+  if (merged.code === 1 && !conflicts.length) throw new Error("Could not identify conflicting files");
+  return { current, result, merged: tree, conflicts: [...new Set(conflicts)] };
+}
+async function reconciliationFile(repo, path, ref, file) {
+  const at = await worktreeGit(repo, path);
+  const entry = await checked(at, ["ls-tree", "-z", ref, "--", file]);
+  if (!entry) return { exists: false, text: "", mode: "" };
+  const [mode, kind, object] = entry.split(/\s/);
+  if (kind !== "blob" || !object) return { exists: true, binary: true, text: "", mode };
+  const size = Number(await checked(at, ["cat-file", "-s", object]));
+  if (size > 256 * 1024 || mode === "120000") return { exists: true, binary: true, text: "", mode };
+  const value = await git(["cat-file", "blob", object], at);
+  if (value.code) throw new Error("Could not read conflict version");
+  return { exists: true, binary: value.stdout.includes("\0") || value.stdout.includes("\uFFFD"), text: value.stdout, mode };
+}
+async function resolveTaskReconciliation(repo, path, merge, choices) {
+  if (!Array.isArray(choices) || choices.length !== merge.conflicts.length || new Set(choices.map((choice) => choice.path)).size !== choices.length || choices.some((choice) => !merge.conflicts.includes(choice.path) || !["current", "team", "edited"].includes(choice.choice))) throw new Error("Choose a resolution for each conflicting file");
+  const at = await worktreeGit(repo, path), current = await taskCheckpoint(repo, path);
+  if (await checked(at, ["rev-parse", `${current}^{tree}`]) !== await checked(at, ["rev-parse", `${merge.current}^{tree}`])) throw new Error("Your workspace changed since this comparison. Refresh the comparison before applying.");
+  const temp = await mkdtemp(join(tmpdir(), "codeflow-resolution-"));
+  try {
+    const env = { GIT_INDEX_FILE: join(temp, "index") };
+    await checked(at, ["read-tree", merge.merged], { env });
+    for (const choice of choices) {
+      if (choice.choice === "edited") {
+        if (typeof choice.text !== "string" || Buffer.byteLength(choice.text) > 256 * 1024 || /^(<<<<<<<|=======|>>>>>>>)(?: |$)/m.test(choice.text)) throw new Error("Provide resolved text without conflict markers (up to 256 KB)");
+        const versions = await Promise.all([merge.current, merge.result].map((ref) => reconciliationFile(repo, path, ref, choice.path)));
+        if (versions.some((version) => version.binary)) throw new Error("Choose an existing version for binary or symbolic-link conflicts");
+        const mode = versions.find((version) => version.exists)?.mode || "100644";
+        const object = await checked(at, ["hash-object", "-w", "--stdin"], { input: choice.text });
+        await checked(at, ["update-index", "--add", "--cacheinfo", `${mode},${object},${choice.path}`], { env });
+      } else {
+        const ref = choice.choice === "current" ? merge.current : merge.result;
+        const entry = await checked(at, ["ls-tree", "-z", ref, "--", choice.path]);
+        if (!entry) await checked(at, ["update-index", "--force-remove", "--", choice.path], { env });
+        else {
+          const [mode, , object] = entry.split(/\s/);
+          await checked(at, ["update-index", "--add", "--cacheinfo", `${mode},${object},${choice.path}`], { env });
+        }
+      }
+    }
+    const tree = await checked(at, ["write-tree"], { env });
+    await applySnapshot(at, current, tree);
+    return tree;
+  } finally {
+    await rm(temp, { recursive: true, force: true });
+  }
+}
+export {
+  TaskTeamConflict,
+  applyTaskTeamResult,
+  prepareTaskReconciliation,
+  reconciliationFile,
+  resolveTaskReconciliation,
+  taskCheckpoint,
+  taskTeamControl,
+  taskTeamQuestionReply,
+  taskTeamRoute,
+  validateTaskTeam
+};