@nanonets/graft 0.16.0 → 0.19.0

package/README.md

@@ -8,7 +8,7 @@
 
 <p>
   <a href="https://github.com/NanoNets/Graft"><img src="https://img.shields.io/github/stars/NanoNets/Graft?style=for-the-badge&logo=github&logoColor=white&label=Star%20on%20GitHub&color=FFC83D" /></a>
-  <a href="https://graft.nanonets.ai"><img src="https://img.shields.io/badge/website-graft.nanonets.ai-546FFF?style=for-the-badge" /></a>
+  <a href="https://trailhq.com/graft"><img src="https://img.shields.io/badge/website-trailhq.com/graft-E5484D?style=for-the-badge" /></a>
   <a href="https://discord.gg/zxmKweAA29"><img src="https://img.shields.io/badge/Discord-join-5865F2?style=for-the-badge&logo=discord&logoColor=white" /></a>
   <a href="https://www.npmjs.com/package/@nanonets/graft"><img src="https://img.shields.io/npm/v/%40nanonets%2Fgraft?style=for-the-badge&logo=npm&logoColor=white&label=npm" /></a>
   <a href="https://www.npmjs.com/package/@nanonets/graft"><img src="https://img.shields.io/npm/dm/%40nanonets%2Fgraft?style=for-the-badge&logo=npm&logoColor=white&label=downloads" /></a>
@@ -17,7 +17,7 @@
   <img src="https://img.shields.io/badge/License-MIT-20C997?style=for-the-badge" />
   <a href="TELEMETRY.md"><img src="https://img.shields.io/badge/telemetry-anonymous%2C%20opt--out-546FFF?style=for-the-badge" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/NanoNets/Graft"><img src="https://img.shields.io/ossf-scorecard/github.com/NanoNets/Graft?style=for-the-badge&label=openssf%20scorecard" /></a>
-  <a href="https://github.com/apps/trailhq-graft"><img src="https://img.shields.io/badge/PR%20reviews-install%20GitHub%20App-546FFF?style=for-the-badge&logo=github&logoColor=white" /></a>
+  <a href="https://app.trailhq.com/get-started?step=pick"><img src="https://img.shields.io/badge/Trail%20Brain-try%20it-E5484D?style=for-the-badge&logoColor=white" /></a>
 </p>
 
 ### Up to **4× cheaper** and **3× faster**, with better or no loss of correctness.
@@ -31,7 +31,14 @@
 
 </div>
 
-<p align="center"><b>Reviewing pull requests?</b> <a href="https://github.com/apps/trailhq-graft">Add the graft GitHub App</a> to get an automatic blast-radius review on every PR.</p>
+<p align="center">
+  <b>This works beyond code too.</b><br/>
+  A living skill file that learns from every task and gets sharper the more your team works.
+</p>
+
+<p align="center">
+  <a href="https://app.trailhq.com/get-started?step=pick"><img src="https://img.shields.io/badge/Try%20Trail%20Brain%20%E2%86%92-E5484D?style=for-the-badge" alt="Try Trail Brain" height="34"/></a>
+</p>
 
 <p align="center">
   <img src="assets/graft-comparison-demo.gif" alt="Side-by-side comparison of a coding agent working with and without graft" width="820"/>

package/dist/app/brain-build-process.d.ts

@@ -0,0 +1,22 @@
+import { type BrainBuildDeps, type BrainBuildJob, type BrainBuildResult } from "./brain-build.js";
+export interface ChildBuilderOptions {
+    /** The module the child runs. Only tests pass this. */
+    entry?: string;
+    timeoutMs?: number;
+}
+/**
+ * The module a read runs in. `dist/app/brain-build-worker.js` when installed or
+ * containerised; the TypeScript source next door when run from a checkout,
+ * since `fork` inherits `process.execArgv` and a parent started through tsx
+ * hands the child the same loader.
+ */
+export declare function brainBuildWorkerEntry(): string;
+/**
+ * A builder with buildRepoIntoBrain's signature that runs the heavy half in a
+ * child process. Same shape on purpose: server.ts swaps one for the other in a
+ * single line, and a test injecting its own builder keeps running in-process.
+ */
+export declare function childBuilder(opts?: ChildBuilderOptions): (job: BrainBuildJob, deps: BrainBuildDeps) => Promise<BrainBuildResult>;
+/** The App's default builder. */
+export declare const buildRepoInChildProcess: (job: BrainBuildJob, deps: BrainBuildDeps) => Promise<BrainBuildResult>;
+//# sourceMappingURL=brain-build-process.d.ts.map

package/dist/app/brain-build-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-build-process.d.ts","sourceRoot":"","sources":["../../src/app/brain-build-process.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAmB,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAanH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAK9C;AAeD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAUpI;AAgED,iCAAiC;AACjC,eAAO,MAAM,uBAAuB,QA3EgC,aAAa,QAAQ,cAAc,KAAK,OAAO,CAAC,gBAAgB,CA2E/E,CAAC"}

package/dist/app/brain-build-process.js

@@ -0,0 +1,129 @@
+/**
+ * Running a repository read somewhere it cannot stop the App answering.
+ *
+ * The same problem the reviewer had, and the same fix — see review-process.ts
+ * for the full reasoning and the production measurements behind it. In short:
+ * every expensive step of a read is synchronous (git through `spawnSync`, the
+ * parse a loop of native tree-sitter calls, the graph written with a blocking
+ * stringify), so in-process one read holds the event loop for its whole
+ * duration.
+ *
+ * Onboarding made that visible in a way reviews did not. Measured on
+ * NanoNets/assign: 0.7s to check access, 7s to clone, 81s to build the symbol
+ * graph, 21s to walk the pull requests. During those 81 seconds the App
+ * answered nothing at all — including the one-second question "can we see this
+ * other repository", asked by the next person to paste a URL, who then waited
+ * out someone else's clone before being told their repo is private. At a
+ * hundred signups there is nearly always a read in flight, so that is not an
+ * edge case, it is the normal case.
+ *
+ * The split is where the credential is: the parent resolves access and mints
+ * the token (network, never blocking), and the child does the work with it.
+ */
+import { fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { resolveRepoRead } from "./brain-build.js";
+/**
+ * How long one read may take before the process running it is killed.
+ *
+ * Well above the worst honest read seen (110s on a large monorepo) plus the
+ * clone budget checkout.ts allows itself, because the cost of being wrong is a
+ * read that never happens. It bounds a lost slot, not responsiveness — the
+ * server stopped caring how long a read takes the moment it left this process.
+ */
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+/**
+ * The module a read runs in. `dist/app/brain-build-worker.js` when installed or
+ * containerised; the TypeScript source next door when run from a checkout,
+ * since `fork` inherits `process.execArgv` and a parent started through tsx
+ * hands the child the same loader.
+ */
+export function brainBuildWorkerEntry() {
+    const js = fileURLToPath(new URL("./brain-build-worker.js", import.meta.url));
+    if (existsSync(js))
+        return js;
+    const ts = js.replace(/\.js$/, ".ts");
+    return existsSync(ts) ? ts : js;
+}
+/** Reads in flight, so a shutdown does not leave a clone made with a token. */
+const live = new Set();
+let hooked = false;
+function track(child) {
+    live.add(child);
+    if (hooked)
+        return;
+    hooked = true;
+    process.on("exit", () => {
+        for (const c of live)
+            c.kill("SIGKILL");
+    });
+}
+/**
+ * A builder with buildRepoIntoBrain's signature that runs the heavy half in a
+ * child process. Same shape on purpose: server.ts swaps one for the other in a
+ * single line, and a test injecting its own builder keeps running in-process.
+ */
+export function childBuilder(opts = {}) {
+    const entry = opts.entry ?? brainBuildWorkerEntry();
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return async (job, deps) => {
+        // In the parent, deliberately: it is pure network, it is what decides
+        // whether there is anything to fork for, and a RepoNotAccessibleError has
+        // to reach the caller as itself rather than as a dead child process.
+        const auth = await resolveRepoRead(job, deps);
+        return runInChild(job, deps, auth, entry, timeoutMs);
+    };
+}
+async function runInChild(job, deps, auth, entry, timeoutMs) {
+    const log = deps.log ?? (() => { });
+    const tag = `${job.owner}/${job.repo}`;
+    // The repository as argv makes `ps` in a container say which read each
+    // process is; the token stays out of it.
+    const child = fork(entry, [tag], { stdio: ["ignore", "inherit", "inherit", "ipc"] });
+    track(child);
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                fn();
+            };
+            const timer = setTimeout(() => {
+                settle(() => reject(new Error(`read of ${tag} exceeded ${timeoutMs}ms and was killed`)));
+            }, timeoutMs);
+            timer.unref();
+            child.on("message", (raw) => {
+                const msg = raw;
+                if (msg.t === "log") {
+                    log(msg.msg);
+                    return;
+                }
+                if (msg.t === "done") {
+                    settle(() => resolve(msg.result));
+                    return;
+                }
+                settle(() => reject(new Error(msg.message)));
+            });
+            child.on("error", (err) => settle(() => reject(err)));
+            // The case that used to be an outage: a child that dies without
+            // reporting. An OOM kill on a large repository, a grammar segfault on a
+            // stranger's source. Now it costs one read, named, with the signal.
+            child.on("exit", (code, signal) => settle(() => reject(new Error(`read of ${tag} exited ${signal ? `on ${signal}` : `with code ${code}`} before reporting a result`))));
+            const start = { t: "start", job, auth, api: deps.api, githubHost: deps.githubHost };
+            if (child.connected)
+                child.send(start);
+        });
+    }
+    finally {
+        live.delete(child);
+        if (child.exitCode === null && child.signalCode === null)
+            child.kill("SIGKILL");
+    }
+}
+/** The App's default builder. */
+export const buildRepoInChildProcess = childBuilder();
+//# sourceMappingURL=brain-build-process.js.map

package/dist/app/brain-build-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-build-process.js","sourceRoot":"","sources":["../../src/app/brain-build-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAkE,MAAM,kBAAkB,CAAC;AAGnH;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ1C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;AACrC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,SAAS,KAAK,CAAC,KAAmB;IAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,IAAoB,EACpB,IAAiD,EACjD,KAAa,EACb,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IACvC,uEAAuE;IACvE,yCAAyC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,KAAK,CAAC,KAAK,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,aAAa,SAAS,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC3F,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,CAAC;YAEd,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,GAAgB,CAAC;gBAC7B,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;oBACrB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClC,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAEtD,gEAAgE;YAChE,wEAAwE;YACxE,oEAAoE;YACpE,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,WAAW,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,4BAA4B,CAAC,CAAC,CACtH,CACF,CAAC;YAEF,MAAM,KAAK,GAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YAClG,IAAI,KAAK,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,EAAE,CAAC"}

package/dist/app/brain-build-worker.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The process one repository read runs in.
+ *
+ * Forked by brain-build-process.ts, one per read, and it exits when the read
+ * does. It receives the credential it needs rather than the App's private key,
+ * for the same reason the reviewer's worker does: `ps` and `/proc/<pid>/environ`
+ * are readable, and a key that never crosses the boundary cannot leak across it.
+ *
+ * Everything expensive happens here — the clone, the tree-sitter parse, the
+ * pull-request walk — and none of it can reach the server's event loop.
+ */
+import { readRepository, type BrainBuildJob, type RepoReadAuth } from "./brain-build.js";
+/** Parent → child, once, immediately after the fork. */
+export interface StartMessage {
+    t: "start";
+    job: BrainBuildJob;
+    auth: RepoReadAuth;
+    api?: string;
+    githubHost?: string;
+}
+/** Child → parent: a line for the App's log, so a read is still traceable. */
+export interface LogMessage {
+    t: "log";
+    msg: string;
+}
+export interface DoneMessage {
+    t: "done";
+    result: Awaited<ReturnType<typeof readRepository>>;
+}
+export interface FailedMessage {
+    t: "failed";
+    message: string;
+}
+export type FromChild = LogMessage | DoneMessage | FailedMessage;
+//# sourceMappingURL=brain-build-worker.d.ts.map

package/dist/app/brain-build-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-build-worker.d.ts","sourceRoot":"","sources":["../../src/app/brain-build-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEzF,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,CAAC,EAAE,OAAO,CAAC;IACX,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,KAAK,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,QAAQ,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC"}

package/dist/app/brain-build-worker.js

@@ -0,0 +1,56 @@
+/**
+ * The process one repository read runs in.
+ *
+ * Forked by brain-build-process.ts, one per read, and it exits when the read
+ * does. It receives the credential it needs rather than the App's private key,
+ * for the same reason the reviewer's worker does: `ps` and `/proc/<pid>/environ`
+ * are readable, and a key that never crosses the boundary cannot leak across it.
+ *
+ * Everything expensive happens here — the clone, the tree-sitter parse, the
+ * pull-request walk — and none of it can reach the server's event loop.
+ */
+import { readRepository } from "./brain-build.js";
+/**
+ * Send, and tell me when it has actually gone.
+ *
+ * `process.send` is asynchronous, and a digest of a large repository is several
+ * megabytes — a thousand commits, four thousand symbols. Disconnecting on the
+ * next line tears the channel down mid-write: the child exits 0, having done
+ * every bit of the work, and the parent reports "exited before reporting a
+ * result". It only shows on big repositories, because a small payload clears
+ * the pipe in one write and survives the race.
+ */
+function send(msg, done) {
+    if (!process.send) {
+        done?.();
+        return;
+    }
+    try {
+        process.send(msg, undefined, undefined, () => done?.());
+    }
+    catch {
+        /* parent went away; the exit is the report */
+        done?.();
+    }
+}
+process.on("message", (raw) => {
+    const msg = raw;
+    if (msg.t !== "start")
+        return;
+    void readRepository(msg.job, {
+        // No creds: this half needs none. resolveRepoRead already did every call
+        // that requires the App's identity, and its answer is in `auth`.
+        creds: { appId: "", privateKey: "" },
+        fetch: globalThis.fetch,
+        api: msg.api,
+        githubHost: msg.githubHost,
+        log: (line) => send({ t: "log", msg: line }),
+    }, msg.auth)
+        .then((result) => {
+        send({ t: "done", result }, () => process.disconnect?.());
+    })
+        .catch((e) => {
+        send({ t: "failed", message: e instanceof Error ? e.message : String(e) }, () => process.disconnect?.());
+    });
+});
+//# sourceMappingURL=brain-build-worker.js.map

package/dist/app/brain-build-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-build-worker.js","sourceRoot":"","sources":["../../src/app/brain-build-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AA6BzF;;;;;;;;;GASG;AACH,SAAS,IAAI,CAAC,GAAc,EAAE,IAAiB;IAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,EAAE,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;QAC9C,IAAI,EAAE,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC5B,MAAM,GAAG,GAAG,GAAmB,CAAC;IAChC,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO;IAC9B,KAAK,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE;QAC3B,yEAAyE;QACzE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACpC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;KACrD,EAAE,GAAG,CAAC,IAAI,CAAC;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACpB,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/app/brain-build.d.ts

@@ -0,0 +1,160 @@
+import { type AppCredentials, type Fetch, type RepoAccessGap } from "./identity.js";
+import { type RepoDigest } from "./history.js";
+/** One request to build a repository into a brain. */
+export interface BrainBuildJob {
+    owner: string;
+    repo: string;
+    /** Branch to read; empty means the repository's default. */
+    ref?: string;
+    /**
+     * The brain the rules land in, and the workspace key to write it with.
+     *
+     * Both optional, and omitting them changes the mode: with them, the digest is
+     * posted straight to the brain and only a job id comes back; without them the
+     * digest is RETURNED and the caller ingests it itself.
+     *
+     * The second mode is what the platform's own proxy uses. It already holds the
+     * user's session and can write to the brain directly, so handing graft a
+     * workspace key just to have it call back would mean minting a credential per
+     * build for no gain.
+     */
+    brainId?: string;
+    brainToken?: string;
+    /** Platform base URL. Defaults to production. */
+    brainBaseUrl?: string;
+    /** File the rules as approved rather than as drafts. Onboarding sets it:
+     * a brain whose every rule is an invisible draft answers nothing. */
+    autoApprove?: boolean;
+}
+export interface BrainBuildResult {
+    /** Set only when the digest was posted; empty in return-the-digest mode. */
+    jobId: string;
+    headSha: string;
+    commits: number;
+    threads: number;
+    symbols: number;
+    sources: number;
+    /** Set only in return-the-digest mode. */
+    digest?: RepoDigest;
+}
+export interface BrainBuildDeps {
+    creds: AppCredentials;
+    fetch: Fetch;
+    api?: string;
+    githubHost?: string;
+    log?: (msg: string) => void;
+    now?: () => number;
+    /**
+     * Token used for a public repository the App is not installed on.
+     *
+     * Optional. Without it the read borrows one of our own installation's tokens,
+     * which GitHub answers for any public resource, and falls back to anonymous
+     * if the App has no installations at all. Anonymous works but is 60 requests
+     * an hour for the whole box — one pull-request walk — so it is the last
+     * resort, not the plan.
+     */
+    publicToken?: string;
+    /** Whose installation to borrow for those reads. Ours, so a public read
+     * spends our rate limit and not a customer's. */
+    publicOwner?: string;
+}
+/** Raised when the App cannot see the repository. Distinct because the caller
+ * turns it into a specific answer — "install the app, or run it locally" — and
+ * not into a 500. */
+export declare class RepoNotAccessibleError extends Error {
+    /** Which gap it is, so the caller can send the user to the right place. */
+    readonly gap: RepoAccessGap;
+    constructor(message: string, 
+    /** Which gap it is, so the caller can send the user to the right place. */
+    gap?: RepoAccessGap);
+}
+/** What a repository lets us do, before any of the work is started. */
+export interface RepoAccess {
+    /** True when we can read it: installed on it, or it is public. */
+    accessible: boolean;
+    isPrivate: boolean;
+    /** How we would read it — for the log, and for deciding nothing else. */
+    via: "installation" | "public" | "none";
+    /** Set only when accessible is false: what to tell the user, and where to
+     * send them. Same shape RepoNotAccessibleError carries. */
+    reason?: string;
+    gap?: RepoAccessGap;
+}
+/**
+ * Can we read this repository at all?
+ *
+ * The cheap half of a build, on its own: an installation lookup and at most
+ * one repository lookup, about a second in total, with no clone and no graph.
+ *
+ * It exists as its own call because the answer decides which screen the user
+ * sees next, and the rest of the read takes minutes. Waiting for the whole
+ * build to find out means either holding the person there or guessing from a
+ * timer, and a guess is wrong exactly when the box is busy — which is when
+ * two people are onboarding at once.
+ */
+export declare function checkRepoAccess(job: {
+    owner: string;
+    repo: string;
+}, deps: BrainBuildDeps): Promise<RepoAccess>;
+/**
+ * Read the repository and hand its history to the brain.
+ *
+ * An installation is the preferred way in: it is the only way into a private
+ * repository, and it carries a rate limit worth having. It is not required for
+ * a public one, though — those clone anonymously and answer the API
+ * anonymously — so a failed installation lookup is a reason to try the open
+ * door, not a reason to stop. Only a repository that is private or unreadable
+ * both ways is one we genuinely cannot see, and that is the case the UI turns
+ * into "read it on your machine".
+ */
+/** Everything the heavy half needs, and nothing it could mint for itself. */
+export interface RepoReadAuth {
+    /** Installation or public-read token, for the GitHub API calls. */
+    token: string;
+    /** Credential for the clone. Empty for a public repository we are not
+     * installed on: git serves those to anyone, and a token minted for another
+     * account is not promised to work on this one. */
+    cloneToken: string;
+    meta: RepoMeta;
+}
+/**
+ * Decide how this repository gets read, and mint the credential for it.
+ *
+ * The network half of a build, kept separate from the work: an installation
+ * lookup, a token, a repository lookup. About a second, none of it blocking.
+ *
+ * Throws RepoNotAccessibleError when there is no way in. That is the answer the
+ * onboarding UI turns into a choice, which is why it is raised here — before a
+ * single byte is cloned — rather than discovered somewhere inside the read.
+ */
+export declare function resolveRepoRead(job: BrainBuildJob, deps: BrainBuildDeps): Promise<RepoReadAuth>;
+/**
+ * Read the repository and hand its history to the brain.
+ *
+ * An installation is the preferred way in: it is the only way into a private
+ * repository, and it carries a rate limit worth having. It is not required for
+ * a public one, though — those clone anonymously and answer the API
+ * anonymously — so a failed installation lookup is a reason to try the open
+ * door, not a reason to stop. Only a repository that is private or unreadable
+ * both ways is one we genuinely cannot see, and that is the case the UI turns
+ * into "read it on your machine".
+ */
+export declare function buildRepoIntoBrain(job: BrainBuildJob, deps: BrainBuildDeps): Promise<BrainBuildResult>;
+/**
+ * The heavy half: clone, graph, history, digest.
+ *
+ * Takes its credential rather than minting one, because this is the half that
+ * runs somewhere else. Every expensive thing in it is synchronous — the git
+ * calls are spawnSync, the parse is a loop of native tree-sitter calls, the
+ * graph is written with a blocking stringify — so in the server process it
+ * holds the event loop for the whole read, and a second person pasting a URL
+ * waits behind the first. See brain-build-process.ts.
+ */
+export declare function readRepository(job: BrainBuildJob, deps: BrainBuildDeps, auth: RepoReadAuth): Promise<BrainBuildResult>;
+/** What the repository says about itself. */
+interface RepoMeta {
+    isPrivate: boolean;
+    defaultBranch: string;
+}
+export {};
+//# sourceMappingURL=brain-build.d.ts.map

package/dist/app/brain-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-build.d.ts","sourceRoot":"","sources":["../../src/app/brain-build.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAkE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAc/G,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;qDACiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;qBAEqB;AACrB,qBAAa,sBAAuB,SAAQ,KAAK;IAG7C,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,aAAa;gBAF3B,OAAO,EAAE,MAAM;IACf,2EAA2E;IAClE,GAAG,GAAE,aAAgF;CAIjG;AAED,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,GAAG,EAAE,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxC;+DAC2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBrH;AAED;;;;;;;;;;GAUG;AACH,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd;;sDAEkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BrG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE5G;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2G5H;AAED,6CAA6C;AAC7C,UAAU,QAAQ;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB"}