@on-par/factory-core 0.9.5-next.1 → 0.9.5-next.10

package/dist/utils/local-auth-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth-record.d.ts","sourceRoot":"","sources":["../../src/utils/local-auth-record.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,wCAAwC;IACxC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,CAAC;IACtB,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,kDAAkD;AAClD,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,mBAAwB,GAAG,MAAM,CAE1E;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAInG;AAED,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,GAAE,mBAAwB,GAAG,MAAM,CAKrG;AAkBD,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,GAAE,mBAAwB,GAAG,IAAI,CAkBlG;AAED;;;8FAG8F;AAC9F,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,cAAc,EACrB,IAAI,GAAE,mBAAwB,GAC7B,gBAAgB,GAAG,IAAI,CAWzB"}

package/dist/utils/local-auth-record.js

@@ -0,0 +1,92 @@
+// src/utils/local-auth-record.ts — the last run-time local_auth failure per agent (#2733).
+//
+// A refresh token that is present but already used or revoked looks fine on disk, and doctor
+// must not refresh it to find out (that would burn the token). So when a run hits local_auth,
+// the router records "<agent> failed local_auth at <time>" here, and doctor / models --doctor
+// fail that agent while the failure is newer than its credential file's mtime. A new login
+// rewrites the credential file, which clears the failure without touching this record.
+//
+// Machine-level state under ~/.factory/auth (credentials are per machine, not per repo, and
+// doctor can run outside a repo). Stores only the agent name and a timestamp: never a
+// credential value. Every function here never throws.
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { homedir as osHomedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { claudeConfigDirPath } from './claude-config.js';
+/** `~/.factory/auth/local-auth-failures.json`. */
+export function localAuthRecordPath(deps = {}) {
+    return join((deps.homedir ?? osHomedir)(), '.factory', 'auth', 'local-auth-failures.json');
+}
+/** Maps a harness id (or provider) to the agent whose login it uses; undefined for others. */
+export function localAuthAgentFor(harnessOrProvider) {
+    if (harnessOrProvider === 'claude-cli' || harnessOrProvider === 'anthropic')
+        return 'claude';
+    if (harnessOrProvider === 'codex-cli')
+        return 'codex';
+    return undefined;
+}
+/** Credential file whose mtime marks the agent's latest login. */
+export function localAuthCredentialPath(agent, deps = {}) {
+    const env = deps.env ?? process.env;
+    const home = (deps.homedir ?? osHomedir)();
+    if (agent === 'claude')
+        return resolve(claudeConfigDirPath(env, home), '.credentials.json');
+    return join(env.CODEX_HOME?.trim() || join(home, '.codex'), 'auth.json');
+}
+function readAll(deps) {
+    const readFile = deps.readFile ?? ((p) => readFileSync(p, 'utf8'));
+    try {
+        const parsed = JSON.parse(readFile(localAuthRecordPath(deps)));
+        if (typeof parsed !== 'object' || parsed === null)
+            return {};
+        const out = {};
+        for (const agent of ['claude', 'codex']) {
+            const at = parsed[agent]?.at;
+            if (typeof at === 'string' && Number.isFinite(Date.parse(at)))
+                out[agent] = { agent, at };
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+/** Records that `agent` just failed local_auth. Best effort; never throws. */
+export function recordLocalAuthFailure(agent, deps = {}) {
+    const now = deps.now ?? Date.now;
+    const path = localAuthRecordPath(deps);
+    const write = deps.writeFile ??
+        ((p, text) => {
+            mkdirSync(dirname(p), { recursive: true });
+            const tmp = `${p}.${process.pid}.tmp`;
+            writeFileSync(tmp, text, { mode: 0o600 });
+            renameSync(tmp, p);
+        });
+    try {
+        const all = readAll(deps);
+        all[agent] = { agent, at: new Date(now()).toISOString() };
+        write(path, `${JSON.stringify(all, null, 2)}\n`);
+    }
+    catch {
+        // bookkeeping only: never fail a run over it
+    }
+}
+/** The recorded local_auth failure for `agent` when it is newer than the agent's credential
+ *  file mtime (no login since), else null. With no credential file (macOS keychain storage,
+ *  env-token auth) nothing dates the latest login, and a re-login would never clear the
+ *  failure, so it is not reported (null) rather than failing doctor forever. Never throws. */
+export function localAuthFailureSinceLogin(agent, deps = {}) {
+    const failure = readAll(deps)[agent];
+    if (!failure)
+        return null;
+    const mtimeMs = deps.mtimeMs ?? ((p) => statSync(p).mtimeMs);
+    let loginAt;
+    try {
+        loginAt = mtimeMs(localAuthCredentialPath(agent, deps));
+    }
+    catch {
+        return null;
+    }
+    return Date.parse(failure.at) > loginAt ? failure : null;
+}
+//# sourceMappingURL=local-auth-record.js.map

package/dist/utils/local-auth-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth-record.js","sourceRoot":"","sources":["../../src/utils/local-auth-record.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,6FAA6F;AAC7F,8FAA8F;AAC9F,8FAA8F;AAC9F,2FAA2F;AAC3F,uFAAuF;AACvF,EAAE;AACF,4FAA4F;AAC5F,sFAAsF;AACtF,sDAAsD;AAEtD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAoBzD,kDAAkD;AAClD,MAAM,UAAU,mBAAmB,CAAC,IAAI,GAAwB,EAAE;IAChE,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;AAC7F,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,iBAAqC;IACrE,IAAI,iBAAiB,KAAK,YAAY,IAAI,iBAAiB,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC7F,IAAI,iBAAiB,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,uBAAuB,CAAC,KAAqB,EAAE,IAAI,GAAwB,EAAE;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,EAAE,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,IAAyB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC;QAC1E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAsD,EAAE,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;YACjD,MAAM,EAAE,GAAI,MAAuD,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YAC/E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,KAAqB,EAAE,IAAI,GAAwB,EAAE;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GACT,IAAI,CAAC,SAAS;QACd,CAAC,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE;YAC3B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACtC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;;8FAG8F;AAC9F,MAAM,UAAU,0BAA0B,CACxC,KAAqB,EACrB,IAAI,GAAwB,EAAE;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@on-par/factory-core",
-  "version": "0.9.5-next.1",
+  "version": "0.9.5-next.10",
   "description": "Core engine: model router, constitutions, checkers, and pipeline phases for the Software Factory.",
   "type": "module",
   "main": "dist/index.js",
@@ -54,18 +54,18 @@
     "prepack": "node ../../scripts/pack-hygiene-cli.ts prepack"
   },
   "dependencies": {
-    "@on-par/adr-kit": "0.9.5-next.1",
-    "@on-par/contracts": "0.9.5-next.1",
-    "@on-par/factory-config": "0.9.5-next.1",
-    "@on-par/repo-context": "0.9.5-next.1",
+    "@on-par/adr-kit": "0.9.5-next.10",
+    "@on-par/contracts": "0.9.5-next.10",
+    "@on-par/factory-config": "0.9.5-next.10",
+    "@on-par/repo-context": "0.9.5-next.10",
     "@octokit/rest": "^22.0.0",
-    "execa": "^10.0.1",
+    "execa": "^10.1.0",
     "gray-matter": "^4.0.3",
     "yaml": "^2.9.0",
     "zod": "^4.6.5"
   },
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^26.6.4"
+    "@types/node": "^26.6.5"
   }
 }

package/dist/daemon/repo-lane.d.ts

@@ -1,5 +0,0 @@
-import type { RepoSlug } from '../types/index.js';
-/** Render a repo slug and lane id as the canonical flat form `owner/name#laneId`,
- *  e.g. renderRepoLane('owner/example-app', 'lane-2') === 'owner/example-app#lane-2'. */
-export declare function renderRepoLane(repo: RepoSlug, laneId: string): string;
-//# sourceMappingURL=repo-lane.d.ts.map

package/dist/daemon/repo-lane.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"repo-lane.d.ts","sourceRoot":"","sources":["../../src/daemon/repo-lane.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;yFACyF;AACzF,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE"}

package/dist/daemon/repo-lane.js

@@ -1,9 +0,0 @@
-// src/daemon/repo-lane.ts — Canonical rendering of a (repo, lane) pair as the
-// flat string `owner/name#laneId`. Pure formatter, no I/O; not wired into any
-// event/log/URL/SSE path (#969).
-/** Render a repo slug and lane id as the canonical flat form `owner/name#laneId`,
- *  e.g. renderRepoLane('owner/example-app', 'lane-2') === 'owner/example-app#lane-2'. */
-export function renderRepoLane(repo, laneId) {
-    return `${repo}#${laneId}`;
-}
-//# sourceMappingURL=repo-lane.js.map

package/dist/daemon/repo-lane.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"repo-lane.js","sourceRoot":"","sources":["../../src/daemon/repo-lane.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,iCAAiC;AAIjC;yFACyF;AACzF,MAAM,UAAU,cAAc,CAAC,IAAc,EAAE,MAAc;IAC3D,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAC7B,CAAC"}