@minionry/minion 0.7.36

package/dist/server/services/analytics.js

@@ -0,0 +1,197 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { arch, platform } from 'node:os';
+import { PostHog } from 'posthog-node';
+import { ensureMachineDir, machineFile } from '../../bin/machine-layout.js';
+import { getClientId } from './client-id.js';
+import { DEFAULT_PLATFORM_URL } from './platform-url.js';
+function telemetryFile() {
+    return machineFile('telemetry');
+}
+function getServerUrl() {
+    try {
+        const content = readFileSync(machineFile('devEnv'), 'utf-8');
+        const match = content.match(/^SERVER_URL=(.+)$/m);
+        if (match)
+            return match[1].trim();
+    }
+    catch { }
+    return DEFAULT_PLATFORM_URL;
+}
+function platformUrl() {
+    return process.env.PLATFORM_URL || getServerUrl();
+}
+let client = null;
+let telemetryEnabled = null;
+let analyticsConfig = null;
+function isTelemetryEnabled() {
+    if (telemetryEnabled !== null) {
+        return telemetryEnabled;
+    }
+    const envValue = process.env.MINIONRY_TELEMETRY;
+    if (envValue === '0' || envValue === 'false') {
+        telemetryEnabled = false;
+        return false;
+    }
+    const configFile = telemetryFile();
+    if (existsSync(configFile)) {
+        try {
+            const config = JSON.parse(readFileSync(configFile, 'utf-8'));
+            if (config.telemetry === false) {
+                telemetryEnabled = false;
+                return false;
+            }
+        }
+        catch {
+        }
+    }
+    telemetryEnabled = true;
+    return true;
+}
+async function fetchAnalyticsConfig() {
+    try {
+        const response = await fetch(`${platformUrl()}/api/config/client`, {
+            method: 'GET',
+            headers: { 'Content-Type': 'application/json' },
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const data = await response.json();
+        return {
+            posthogKey: data.analytics?.posthogKey || '',
+            posthogHost: data.analytics?.posthogHost || 'https://eu.i.posthog.com',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function initAnalytics() {
+    if (!isTelemetryEnabled()) {
+        return;
+    }
+    analyticsConfig = await fetchAnalyticsConfig();
+    if (!analyticsConfig?.posthogKey) {
+        return;
+    }
+    client = new PostHog(analyticsConfig.posthogKey, {
+        host: `${platformUrl()}/a`,
+        flushAt: 20,
+        flushInterval: 10000,
+    });
+    client.on('error', () => { });
+}
+export async function shutdownAnalytics() {
+    if (client) {
+        try {
+            await client.shutdown();
+        }
+        catch {
+        }
+        client = null;
+    }
+}
+function getDistinctId() {
+    return getClientId();
+}
+function getCommonProperties() {
+    return {
+        os: platform(),
+        arch: arch(),
+        node_version: process.version,
+        minionry_version: process.env.npm_package_version || 'unknown',
+        source: 'client',
+    };
+}
+export function trackEvent(event, properties) {
+    if (!client || !isTelemetryEnabled())
+        return;
+    client.capture({
+        distinctId: getDistinctId(),
+        event,
+        properties: {
+            ...getCommonProperties(),
+            ...properties,
+        },
+    });
+}
+export function identifyUser(userId, properties) {
+    if (!client || !isTelemetryEnabled())
+        return;
+    client.alias({
+        distinctId: userId,
+        alias: getDistinctId(),
+    });
+    client.identify({
+        distinctId: userId,
+        properties: {
+            ...getCommonProperties(),
+            ...properties,
+        },
+    });
+}
+export function setTelemetryEnabled(enabled) {
+    let config = {};
+    const configFile = telemetryFile();
+    if (existsSync(configFile)) {
+        try {
+            config = JSON.parse(readFileSync(configFile, 'utf-8'));
+        }
+        catch {
+        }
+    }
+    config.telemetry = enabled;
+    ensureMachineDir('config');
+    writeFileSync(configFile, JSON.stringify(config, null, 2), { mode: 0o600 });
+    telemetryEnabled = enabled;
+}
+export function getTelemetryStatus() {
+    const envValue = process.env.MINIONRY_TELEMETRY;
+    if (envValue === '0' || envValue === 'false') {
+        return { enabled: false, reason: 'Disabled via MINIONRY_TELEMETRY environment variable' };
+    }
+    const configFile = telemetryFile();
+    if (existsSync(configFile)) {
+        try {
+            const config = JSON.parse(readFileSync(configFile, 'utf-8'));
+            if (config.telemetry === false) {
+                return { enabled: false, reason: 'Disabled via ~/.minionry/config/telemetry.json' };
+            }
+        }
+        catch {
+        }
+    }
+    if (!analyticsConfig?.posthogKey) {
+        return { enabled: false, reason: 'Analytics not configured on platform' };
+    }
+    return { enabled: true, reason: 'Enabled (opt-out with MINIONRY_TELEMETRY=0)' };
+}
+export const AnalyticsEvents = {
+    CLI_STARTED: 'cli_started',
+    CLI_COMMAND: 'cli_command',
+    CLI_LOGIN: 'cli_login',
+    CLI_LOGOUT: 'cli_logout',
+    CLI_ERROR: 'cli_error',
+    SERVER_STARTED: 'server_started',
+    SERVER_STOPPED: 'server_stopped',
+    PLATFORM_CONNECTED: 'platform_connected',
+    PLATFORM_DISCONNECTED: 'platform_disconnected',
+    WEB_CLIENT_CONNECTED: 'web_client_connected',
+    WEB_CLIENT_DISCONNECTED: 'web_client_disconnected',
+    IMPROVISE_SESSION_STARTED: 'improvise_session_started',
+    IMPROVISE_PROMPT_RECEIVED: 'improvise_prompt_received',
+    IMPROVISE_MOVEMENT_STARTED: 'improvise_movement_started',
+    IMPROVISE_MOVEMENT_COMPLETED: 'improvise_movement_completed',
+    IMPROVISE_MOVEMENT_ERROR: 'improvise_movement_error',
+    IMPROVISE_SESSION_ENDED: 'improvise_session_ended',
+    IMPROVISE_ABORTED: 'improvise_aborted',
+    IMPROVISE_TOOL_TIMEOUT: 'improvise_tool_timeout',
+    IMPROVISE_AUTO_RETRY: 'improvise_auto_retry',
+    TERMINAL_SESSION_CREATED: 'terminal_session_created',
+    TERMINAL_SESSION_CLOSED: 'terminal_session_closed',
+    BOUNCER_TOOL_ALLOWED: 'bouncer_tool_allowed',
+    BOUNCER_TOOL_DENIED: 'bouncer_tool_denied',
+    BOUNCER_HAIKU_REVIEW: 'bouncer_haiku_review',
+};

package/dist/server/services/apps/build.js

@@ -0,0 +1,249 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { spawn } from 'node:child_process';
+import { copyFileSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { BUILD_COMMANDS, BUILD_COMMANDS_WITH_SCRIPTS, isBuildApproved, isLifecycleScriptsApproved, } from './greenlight.js';
+import { errorText, getAppStatePaths, isRealDirectory } from './layout.js';
+const BUILD_STEP_TIMEOUT_MS = 15 * 60 * 1000;
+const BUILD_LOG_STREAM_LIMIT = 1_000_000;
+const BUILD_LOG_TAIL_CHARS = 2000;
+const CONVENTIONAL_OUTPUT_DIRS = ['dist', 'build', 'out'];
+const inflightBuilds = new Set();
+class BuildLogSink {
+    onLog;
+    streamed = 0;
+    capped = false;
+    tail = '';
+    constructor(onLog) {
+        this.onLog = onLog;
+    }
+    write(stream, text) {
+        if (text === '')
+            return;
+        this.tail = (this.tail + text).slice(-BUILD_LOG_TAIL_CHARS);
+        if (!this.onLog)
+            return;
+        if (this.streamed >= BUILD_LOG_STREAM_LIMIT) {
+            if (!this.capped) {
+                this.capped = true;
+                this.onLog({ stream: 'stderr', chunk: '\n[minionry] build log stream limit reached — further output is kept for the failure tail only\n' });
+            }
+            return;
+        }
+        this.streamed += text.length;
+        this.onLog({ stream, chunk: text });
+    }
+    tailText() {
+        return this.tail.trim();
+    }
+}
+function killProcessGroup(child) {
+    if (child.pid === undefined)
+        return;
+    if (process.platform !== 'win32') {
+        try {
+            process.kill(-child.pid, 'SIGKILL');
+        }
+        catch {   }
+    }
+    try {
+        child.kill('SIGKILL');
+    }
+    catch {   }
+}
+function scrubbedBuildEnv(buildHomeDir) {
+    const env = {
+        PATH: process.env.PATH ?? '/usr/local/bin:/usr/bin:/bin',
+        HOME: buildHomeDir,
+        npm_config_update_notifier: 'false',
+        npm_config_audit: 'false',
+        npm_config_fund: 'false',
+        npm_config_progress: 'false',
+    };
+    for (const key of ['TMPDIR', 'LANG', 'LC_ALL', 'TZ']) {
+        const value = process.env[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    return env;
+}
+function runBuildCommand(command, cwd, env, sink) {
+    return new Promise((resolve) => {
+        const [bin, ...args] = command.split(' ');
+        const child = spawn(bin, args, {
+            cwd,
+            env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32',
+        });
+        let settled = false;
+        let timedOut = false;
+        const settle = (failure) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(failure);
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killProcessGroup(child);
+        }, BUILD_STEP_TIMEOUT_MS);
+        child.stdout?.on('data', (data) => sink.write('stdout', data.toString()));
+        child.stderr?.on('data', (data) => sink.write('stderr', data.toString()));
+        child.on('error', (err) => {
+            killProcessGroup(child);
+            settle(`failed to spawn \`${command}\`: ${err.message}`);
+        });
+        child.on('exit', () => killProcessGroup(child));
+        child.on('close', (code, signal) => {
+            if (timedOut) {
+                settle(`\`${command}\` timed out after ${BUILD_STEP_TIMEOUT_MS / 60_000} minutes and was killed`);
+            }
+            else if (code === 0) {
+                settle(null);
+            }
+            else {
+                settle(`\`${command}\` failed (${signal ? `killed by ${signal}` : `exit ${code ?? 'unknown'}`})`);
+            }
+        });
+    });
+}
+function readScriptPackages(srcDir) {
+    let raw;
+    try {
+        raw = readFileSync(join(srcDir, 'package-lock.json'), 'utf8');
+    }
+    catch {
+        return { ok: false, error: 'src/package-lock.json is missing — the listing checks (IS-020) require a committed lockfile, and `npm ci` cannot run without one' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        return { ok: false, error: `src/package-lock.json is not valid JSON: ${errorText(err)}` };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return { ok: false, error: 'src/package-lock.json is not a lockfile object' };
+    }
+    const packages = parsed.packages;
+    const found = new Set();
+    if (typeof packages === 'object' && packages !== null && !Array.isArray(packages)) {
+        for (const [pkgPath, entry] of Object.entries(packages)) {
+            const id = scriptPackageId(pkgPath, entry);
+            if (id)
+                found.add(id);
+        }
+    }
+    return { ok: true, scriptPackages: [...found].sort() };
+}
+function scriptPackageId(pkgPath, entry) {
+    if (pkgPath === '' || typeof entry !== 'object' || entry === null)
+        return null;
+    const record = entry;
+    if (record.hasInstallScript !== true)
+        return null;
+    const pathName = pkgPath.split('node_modules/').pop() || pkgPath;
+    const name = typeof record.name === 'string' && record.name !== '' ? record.name : pathName;
+    const version = typeof record.version === 'string' && record.version !== '' ? record.version : 'unknown';
+    return `${name}@${version}`;
+}
+function copyTreeRejectingSymlinks(src, dest) {
+    mkdirSync(dest, { recursive: true });
+    for (const entry of readdirSync(src, { withFileTypes: true })) {
+        const from = join(src, entry.name);
+        const to = join(dest, entry.name);
+        if (entry.isSymbolicLink()) {
+            throw new Error(`build output contains a symlink (${from}) — refusing to stage it into build/`);
+        }
+        if (entry.isDirectory()) {
+            copyTreeRejectingSymlinks(from, to);
+        }
+        else if (entry.isFile()) {
+            copyFileSync(from, to);
+        }
+        else {
+            throw new Error(`build output contains a non-regular file (${from}) — refusing to stage it into build/`);
+        }
+    }
+}
+function stageBuildOutput(paths) {
+    const outputDir = CONVENTIONAL_OUTPUT_DIRS.map((dir) => join(paths.srcDir, dir)).find(isRealDirectory);
+    if (!outputDir) {
+        return `the build completed but produced no output directory — expected one of ${CONVENTIONAL_OUTPUT_DIRS.map((dir) => `src/${dir}/`).join(', ')}`;
+    }
+    if (readdirSync(outputDir).length === 0) {
+        return `the build completed but its output directory (${outputDir}) is empty`;
+    }
+    try {
+        rmSync(paths.buildStagingDir, { recursive: true, force: true });
+        copyTreeRejectingSymlinks(outputDir, paths.buildStagingDir);
+        rmSync(paths.buildDir, { recursive: true, force: true });
+        renameSync(paths.buildStagingDir, paths.buildDir);
+        return null;
+    }
+    catch (err) {
+        rmSync(paths.buildStagingDir, { recursive: true, force: true });
+        return `failed to stage the build output into build/: ${errorText(err)}`;
+    }
+}
+export async function buildClonedApp(request) {
+    let paths;
+    try {
+        paths = getAppStatePaths(request.workingDir, request.appId);
+    }
+    catch (err) {
+        return { ok: false, code: 'BAD_REQUEST', error: errorText(err) };
+    }
+    if (!isRealDirectory(paths.srcDir)) {
+        return { ok: false, code: 'BAD_REQUEST', error: `nothing to build for '${request.appId}': no clone at src/ — the install step (IS-027) must land first` };
+    }
+    const buildTerms = { repoUrl: request.repoUrl, commitSha: request.commitSha, commands: BUILD_COMMANDS };
+    if (!isBuildApproved(request.workingDir, request.appId, buildTerms)) {
+        return { ok: false, code: 'FORBIDDEN', error: `no recorded build greenlight for '${request.appId}' at ${request.commitSha} — consent (IS-028) must approve exactly these terms before anything runs` };
+    }
+    const lock = readScriptPackages(paths.srcDir);
+    if (!lock.ok) {
+        return { ok: false, code: 'INTERNAL', error: lock.error };
+    }
+    const withScripts = lock.scriptPackages.length > 0 &&
+        isLifecycleScriptsApproved(request.workingDir, request.appId, {
+            commitSha: request.commitSha,
+            scriptPackages: lock.scriptPackages,
+        });
+    const commands = withScripts ? BUILD_COMMANDS_WITH_SCRIPTS : BUILD_COMMANDS;
+    if (inflightBuilds.has(paths.root)) {
+        return { ok: false, code: 'INTERNAL', error: `a build for '${request.appId}' is already in progress in this Space — wait for it to finish` };
+    }
+    inflightBuilds.add(paths.root);
+    const sink = new BuildLogSink(request.onLog);
+    try {
+        mkdirSync(paths.buildHomeDir, { recursive: true, mode: 0o700 });
+        const env = scrubbedBuildEnv(paths.buildHomeDir);
+        for (const command of commands) {
+            sink.write('stdout', `$ ${command}\n`);
+            const failure = await runBuildCommand(command, paths.srcDir, env, sink);
+            if (failure) {
+                return { ok: false, code: 'INTERNAL', error: withLogTail(failure, sink) };
+            }
+        }
+        const stagingFailure = stageBuildOutput(paths);
+        if (stagingFailure) {
+            return { ok: false, code: 'INTERNAL', error: stagingFailure };
+        }
+        return { ok: true, paths, withScripts };
+    }
+    catch (err) {
+        rmSync(paths.buildStagingDir, { recursive: true, force: true });
+        return { ok: false, code: 'INTERNAL', error: `build failed: ${errorText(err)}` };
+    }
+    finally {
+        inflightBuilds.delete(paths.root);
+    }
+}
+function withLogTail(failure, sink) {
+    const tail = sink.tailText();
+    return tail ? `${failure} — log tail:\n${tail}` : failure;
+}

package/dist/server/services/apps/greenlight.js

@@ -0,0 +1,199 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { writeFileAtomic } from '../../utils/file-store.js';
+import { cancelPendingQuestionsForTab, getPendingQuestionTab, registerPendingQuestion, resolvePendingQuestion, } from '../websocket/ask-user-question-bridge.js';
+import { getAppStatePaths } from './layout.js';
+export const BUILD_COMMANDS = ['npm ci --ignore-scripts', 'npm run build'];
+export const BUILD_COMMANDS_WITH_SCRIPTS = ['npm ci', 'npm run build'];
+function shortSha(sha) {
+    return sha.slice(0, 12);
+}
+function greenlightScope(appId) {
+    return `apps:${appId}`;
+}
+function readConsentFile(consentFile) {
+    try {
+        const parsed = JSON.parse(readFileSync(consentFile, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+function writeConsentFile(consentFile, shape) {
+    writeFileAtomic(consentFile, `${JSON.stringify(shape, null, 2)}\n`, { mode: 0o600 });
+}
+function sameCommands(recorded, requested) {
+    return (Array.isArray(recorded) &&
+        recorded.length === requested.length &&
+        requested.every((cmd, i) => recorded[i] === cmd));
+}
+function consentFilePath(workingDir, appId) {
+    try {
+        return getAppStatePaths(workingDir, appId).consentFile;
+    }
+    catch {
+        return null;
+    }
+}
+export function isBuildApproved(workingDir, appId, terms) {
+    const consentFile = consentFilePath(workingDir, appId);
+    if (!consentFile)
+        return false;
+    const record = readConsentFile(consentFile).build;
+    if (!record)
+        return false;
+    return (record.repoUrl === terms.repoUrl &&
+        record.commitSha === terms.commitSha &&
+        sameCommands(record.commands, terms.commands));
+}
+export function isLifecycleScriptsApproved(workingDir, appId, terms) {
+    const consentFile = consentFilePath(workingDir, appId);
+    if (!consentFile)
+        return false;
+    const record = readConsentFile(consentFile).lifecycleScripts;
+    if (!record || record.commitSha !== terms.commitSha || !Array.isArray(record.scriptPackages)) {
+        return false;
+    }
+    const approved = new Set(record.scriptPackages);
+    return terms.scriptPackages.every((pkg) => approved.has(pkg));
+}
+function buildConsentStatement(terms) {
+    return [
+        `This downloads and runs code from ${terms.repoUrl} at ${shortSha(terms.commitSha)} on your machine.`,
+        '',
+        'Commands that will run:',
+        ...terms.commands.map((cmd) => `  $ ${cmd}`),
+    ].join('\n');
+}
+function lifecycleConsentStatement(terms) {
+    return [
+        `This enables dependency install scripts for code from ${terms.repoUrl} at ${shortSha(terms.commitSha)} — the packages below will run their own scripts on your machine during dependency install.`,
+        '',
+        'Packages declaring install scripts:',
+        ...terms.scriptPackages.map((pkg) => `  - ${pkg}`),
+        '',
+        'Commands that will run:',
+        ...BUILD_COMMANDS_WITH_SCRIPTS.map((cmd) => `  $ ${cmd}`),
+    ].join('\n');
+}
+async function promptGreenlight(appId, card, statement, opts) {
+    const scope = greenlightScope(appId);
+    cancelPendingQuestionsForTab(scope);
+    const greenlightId = randomUUID();
+    const question = {
+        question: statement,
+        header: 'Greenlight',
+        options: [
+            { label: 'Approve', description: 'Run exactly the commands listed above on this machine' },
+            { label: 'Deny', description: 'Abort — nothing is downloaded further and nothing runs' },
+        ],
+        multiSelect: false,
+    };
+    const pending = registerPendingQuestion({
+        toolUseId: greenlightId,
+        tabId: scope,
+        questions: [question],
+        ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
+        computeTimeoutAnswers: () => ({ approved: 'false' }),
+    });
+    opts.broadcast({ greenlightId, ...card });
+    try {
+        const resolved = await pending;
+        if (resolved.timedOut)
+            return 'timeout';
+        return resolved.answers.approved === 'true' ? 'approved' : 'user-denied';
+    }
+    catch {
+        return 'superseded';
+    }
+}
+function deniedOutcome(decision, appId, what) {
+    const detail = decision === 'user-denied'
+        ? `the user denied the ${what} greenlight for ${appId}`
+        : decision === 'timeout'
+            ? `the ${what} greenlight for ${appId} timed out without approval (consent never defaults to yes)`
+            : `the ${what} greenlight for ${appId} was superseded by a newer request`;
+    return { ok: false, code: 'FORBIDDEN', error: `${detail} — aborted; nothing was built` };
+}
+export async function ensureBuildGreenlight(workingDir, appId, terms, opts) {
+    const consentFile = consentFilePath(workingDir, appId);
+    if (!consentFile) {
+        return { ok: false, code: 'BAD_REQUEST', error: `cannot resolve app state for '${appId}' in this Space` };
+    }
+    if (terms.commands.length === 0) {
+        return { ok: false, code: 'BAD_REQUEST', error: 'a build greenlight needs at least one command to consent to' };
+    }
+    if (isBuildApproved(workingDir, appId, terms)) {
+        return { ok: true, alreadyApproved: true };
+    }
+    const decision = await promptGreenlight(appId, {
+        appId,
+        kind: 'build',
+        repoUrl: terms.repoUrl,
+        commitSha: terms.commitSha,
+        commands: [...terms.commands],
+    }, buildConsentStatement(terms), opts);
+    if (decision !== 'approved') {
+        if (decision === 'user-denied') {
+            const shape = readConsentFile(consentFile);
+            delete shape.build;
+            writeConsentFile(consentFile, shape);
+        }
+        return deniedOutcome(decision, appId, 'build');
+    }
+    const shape = readConsentFile(consentFile);
+    shape.build = {
+        repoUrl: terms.repoUrl,
+        commitSha: terms.commitSha,
+        commands: [...terms.commands],
+        approvedAt: new Date().toISOString(),
+    };
+    writeConsentFile(consentFile, shape);
+    return { ok: true, alreadyApproved: false };
+}
+export async function ensureLifecycleScriptsGreenlight(workingDir, appId, terms, opts) {
+    const consentFile = consentFilePath(workingDir, appId);
+    if (!consentFile) {
+        return { ok: false, code: 'BAD_REQUEST', error: `cannot resolve app state for '${appId}' in this Space` };
+    }
+    if (terms.scriptPackages.length === 0) {
+        return { ok: false, code: 'BAD_REQUEST', error: 'no packages declare install scripts — nothing to enable' };
+    }
+    if (isLifecycleScriptsApproved(workingDir, appId, terms)) {
+        return { ok: true, alreadyApproved: true };
+    }
+    const decision = await promptGreenlight(appId, {
+        appId,
+        kind: 'lifecycle-scripts',
+        repoUrl: terms.repoUrl,
+        commitSha: terms.commitSha,
+        commands: [...BUILD_COMMANDS_WITH_SCRIPTS],
+        scriptPackages: [...terms.scriptPackages],
+    }, lifecycleConsentStatement(terms), opts);
+    if (decision !== 'approved') {
+        if (decision === 'user-denied') {
+            const shape = readConsentFile(consentFile);
+            delete shape.lifecycleScripts;
+            writeConsentFile(consentFile, shape);
+        }
+        return deniedOutcome(decision, appId, 'lifecycle-scripts');
+    }
+    const shape = readConsentFile(consentFile);
+    shape.lifecycleScripts = {
+        commitSha: terms.commitSha,
+        scriptPackages: [...terms.scriptPackages],
+        approvedAt: new Date().toISOString(),
+    };
+    writeConsentFile(consentFile, shape);
+    return { ok: true, alreadyApproved: false };
+}
+export function resolveGreenlightDecision(greenlightId, appId, approved) {
+    if (getPendingQuestionTab(greenlightId) !== greenlightScope(appId))
+        return false;
+    return resolvePendingQuestion(greenlightId, { approved: approved ? 'true' : 'false' });
+}