@pome-sh/cli 0.1.0 → 0.2.0

package/dist/src/twin-github/errors.d.ts

@@ -1,14 +0,0 @@
-export declare class TwinError extends Error {
-    readonly status: number;
-    readonly errors?: unknown[] | undefined;
-    constructor(message: string, status: number, errors?: unknown[] | undefined);
-}
-export declare function githubError(message: string, status: number, errors?: unknown[]): {
-    errors?: unknown[] | undefined;
-    message: string;
-    documentation_url: string;
-    status: number;
-};
-export declare function notFound(message?: string): never;
-export declare function conflict(message: string): never;
-export declare function validationFailed(field: string, code: string, value?: unknown): never;

package/dist/src/twin-github/errors.js

@@ -1,34 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-export class TwinError extends Error {
-    status;
-    errors;
-    constructor(message, status, errors) {
-        super(message);
-        this.status = status;
-        this.errors = errors;
-    }
-}
-export function githubError(message, status, errors) {
-    return {
-        message,
-        documentation_url: "https://docs.github.com/rest",
-        status,
-        ...(errors ? { errors } : {})
-    };
-}
-export function notFound(message = "Not Found") {
-    throw new TwinError(message, 404);
-}
-export function conflict(message) {
-    throw new TwinError(message, 409);
-}
-export function validationFailed(field, code, value) {
-    throw new TwinError("Validation Failed", 422, [
-        {
-            resource: "Request",
-            field,
-            code,
-            ...(value === undefined ? {} : { value })
-        }
-    ]);
-}

package/dist/src/twin-github/index.d.ts

@@ -1,9 +0,0 @@
-export { createGitHubCloneApp } from "./app.js";
-export { bearerAuth, localhostOnly, resolveAuthSecret } from "./auth.js";
-export type { SessionClaims } from "./auth.js";
-export { openGitHubCloneDatabase, resetDatabase } from "./db.js";
-export { GitHubDomain } from "./domain.js";
-export { defaultSeedState, parseSeed } from "./seed.js";
-export { executeTool, listTools, toolDefinitions } from "./tools.js";
-export type { GitHubCloneAppOptions } from "./app.js";
-export type { GitHubCloneDatabase, GitHubStateSeed, Recorder } from "./types.js";

package/dist/src/twin-github/index.js

@@ -1,7 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-export { createGitHubCloneApp } from "./app.js";
-export { bearerAuth, localhostOnly, resolveAuthSecret } from "./auth.js";
-export { openGitHubCloneDatabase, resetDatabase } from "./db.js";
-export { GitHubDomain } from "./domain.js";
-export { defaultSeedState, parseSeed } from "./seed.js";
-export { executeTool, listTools, toolDefinitions } from "./tools.js";

package/dist/src/twin-github/mcp.d.ts

@@ -1,17 +0,0 @@
-import type { Context } from "hono";
-import type { GitHubDomain } from "./domain.js";
-import type { Recorder } from "./types.js";
-export type McpDeps = {
-    domain: GitHubDomain;
-    recorder?: Recorder;
-    runId: string;
-};
-export declare function mcpMethodNotAllowed(c: Context): Response & import("hono").TypedResponse<{
-    jsonrpc: string;
-    id: null;
-    error: {
-        code: number;
-        message: string;
-    };
-}, 405, "json">;
-export declare function handleMcpRequest(c: Context, deps: McpDeps): Promise<Response>;

package/dist/src/twin-github/mcp.js

@@ -1,281 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// Real MCP JSON-RPC endpoint (Streamable HTTP, stateless tools-only).
-//
-// Wire contract: POST /s/:sid/mcp with JSON-RPC 2.0 body. We implement
-// the minimum subset required by `@modelcontextprotocol/sdk`'s
-// `Client` + `StreamableHTTPClientTransport`:
-//   - initialize           (request)  → server info + capabilities
-//   - notifications/*      (notif)    → HTTP 202, empty body
-//   - ping                 (request)  → result: {}
-//   - tools/list           (request)  → { tools: [...] } with camelCase inputSchema
-//   - tools/call           (request)  → { content: [{type:"text",text:JSON}], isError? }
-//
-// Recorder parity: every successful `tools/call` produces one RecorderEvent
-// whose request_body is `{ tool, arguments }` and whose response_body is the
-// raw domain return value — byte-identical to what the legacy
-// POST /s/:sid/mcp/call route records. Transport framing (JSON-RPC envelope)
-// is intentionally NOT recorded; downstream analytics/replay dispatch on
-// "tool X called with args Y" regardless of whether the request came in
-// over MCP, the legacy custom route, or a REST shim.
-//
-// Stateless: each POST is independent. No Mcp-Session-Id, no SSE, no
-// server→client notifications. GET/DELETE return 405.
-import { z } from "zod";
-import { TwinError } from "./errors.js";
-import { executeTool, isMutatingTool, listToolsForMcp, toolDefinitions } from "./tools.js";
-import { requestId } from "./util.js";
-import { twinBuildInfo } from "./build-info.js";
-// JSON-RPC 2.0 error codes (https://www.jsonrpc.org/specification)
-const PARSE_ERROR = -32700;
-const INVALID_REQUEST = -32600;
-const METHOD_NOT_FOUND = -32601;
-const INVALID_PARAMS = -32602;
-const INTERNAL_ERROR = -32603;
-// Latest MCP protocol version this server speaks. The MCP handshake says the
-// server MAY echo the client's requested version if it supports it, otherwise
-// reply with a version the server supports. We echo when the client requests
-// a known-shaped string; otherwise fall back to this.
-const DEFAULT_PROTOCOL_VERSION = "2025-06-18";
-const SUPPORTED_PROTOCOL_VERSIONS = new Set([
-    "2024-11-05",
-    "2025-03-26",
-    "2025-06-18"
-]);
-// Hono GET/DELETE handler — Streamable HTTP requires both to exist; in
-// stateless mode the only sensible answer is 405.
-export function mcpMethodNotAllowed(c) {
-    return c.json({ jsonrpc: "2.0", id: null, error: { code: METHOD_NOT_FOUND, message: "Method not allowed in stateless mode" } }, 405, { Allow: "POST" });
-}
-export async function handleMcpRequest(c, deps) {
-    // Body must be JSON. Failure → parse error per JSON-RPC.
-    let body;
-    try {
-        body = await c.req.json();
-    }
-    catch {
-        return jsonRpcErrorResponse(null, PARSE_ERROR, "Problems parsing JSON");
-    }
-    // Batch: process each, return array of responses (omitting notifications).
-    if (Array.isArray(body)) {
-        if (body.length === 0) {
-            return jsonRpcErrorResponse(null, INVALID_REQUEST, "Invalid Request");
-        }
-        const out = [];
-        for (const message of body) {
-            const response = await dispatch(message, deps, c);
-            if (response)
-                out.push(response);
-        }
-        // If every message was a notification → 202 with empty body.
-        if (out.length === 0)
-            return new Response(null, { status: 202 });
-        return Response.json(out, {
-            status: 200,
-            headers: { "content-type": "application/json" }
-        });
-    }
-    // Single message.
-    const response = await dispatch(body, deps, c);
-    if (!response)
-        return new Response(null, { status: 202 });
-    // Pick HTTP status from the JSON-RPC payload kind: error → still 200 per spec
-    // (errors travel inside the envelope), except for parse/invalid-request which
-    // are signaled by the dispatch path itself.
-    return Response.json(response, {
-        status: 200,
-        headers: { "content-type": "application/json" }
-    });
-}
-// Returns null for notifications (no response). Returns a JSON-RPC response
-// envelope otherwise.
-async function dispatch(message, deps, c) {
-    if (!isObject(message)) {
-        return errorEnvelope(null, INVALID_REQUEST, "Invalid Request");
-    }
-    if (message.jsonrpc !== "2.0" || typeof message.method !== "string") {
-        return errorEnvelope(idOf(message), INVALID_REQUEST, "Invalid Request");
-    }
-    const method = message.method;
-    const params = isObject(message.params) ? message.params : {};
-    // Notification: no `id` → MUST NOT respond. Caller turns this into HTTP 202.
-    // Per MCP, `notifications/initialized` and `notifications/cancelled` are the
-    // most common; the right behavior is to swallow silently. Any unknown
-    // notification is also swallowed (notifications cannot return errors).
-    const rawId = message.id;
-    if (rawId === undefined || rawId === null) {
-        return null;
-    }
-    if (typeof rawId !== "string" && typeof rawId !== "number") {
-        return errorEnvelope(null, INVALID_REQUEST, "Invalid Request: id must be string or number");
-    }
-    const id = rawId;
-    try {
-        switch (method) {
-            case "initialize":
-                return { jsonrpc: "2.0", id, result: buildInitializeResult(params) };
-            case "ping":
-                return { jsonrpc: "2.0", id, result: {} };
-            case "tools/list":
-                return { jsonrpc: "2.0", id, result: { tools: listToolsForMcp() } };
-            case "tools/call":
-                return await handleToolsCall(id, params, deps, c);
-            default:
-                return errorEnvelope(id, METHOD_NOT_FOUND, `Method not found: ${method}`);
-        }
-    }
-    catch (err) {
-        return errorEnvelope(id, INTERNAL_ERROR, err instanceof Error ? err.message : "Internal error");
-    }
-}
-function buildInitializeResult(params) {
-    const requested = typeof params.protocolVersion === "string" ? params.protocolVersion : undefined;
-    const protocolVersion = requested && SUPPORTED_PROTOCOL_VERSIONS.has(requested) ? requested : DEFAULT_PROTOCOL_VERSION;
-    return {
-        protocolVersion,
-        capabilities: {
-            tools: { listChanged: false }
-        },
-        serverInfo: {
-            name: "twin-github",
-            version: twinBuildInfo().version
-        }
-    };
-}
-async function handleToolsCall(id, params, deps, c) {
-    const name = params.name;
-    const args = params.arguments === undefined || params.arguments === null
-        ? {}
-        : isObject(params.arguments)
-            ? params.arguments
-            : undefined;
-    if (typeof name !== "string" || name.length === 0 || args === undefined) {
-        return errorEnvelope(id, INVALID_PARAMS, "Invalid params: expected { name: string, arguments?: object }");
-    }
-    if (!toolDefinitions.some((t) => t.name === name)) {
-        // Per MCP convention, an unknown tool surfaces as a tool-call error
-        // (isError: true) rather than a JSON-RPC error, so the client sees it
-        // alongside other tool errors.
-        return {
-            jsonrpc: "2.0",
-            id,
-            result: makeToolErrorResult(`Unknown tool: ${name}`)
-        };
-    }
-    const started = Date.now();
-    const recordedRequestBody = { tool: name, arguments: args };
-    let delta = null;
-    let status = 200;
-    let responseBody = null;
-    let toolError = null;
-    let mcpResult;
-    try {
-        const value = executeTool(deps.domain, name, args, (d) => {
-            delta = d;
-        });
-        responseBody = value;
-        mcpResult = { content: [{ type: "text", text: jsonText(value) }] };
-    }
-    catch (err) {
-        if (err instanceof TwinError) {
-            status = err.status;
-            const ghError = {
-                message: err.message,
-                documentation_url: "https://docs.github.com/rest",
-                status: err.status,
-                ...(err.errors ? { errors: err.errors } : {})
-            };
-            responseBody = ghError;
-            toolError = err.message;
-            mcpResult = { content: [{ type: "text", text: jsonText(ghError) }], isError: true };
-        }
-        else if (err instanceof z.ZodError) {
-            status = 422;
-            const ghError = {
-                message: "Validation Failed",
-                documentation_url: "https://docs.github.com/rest",
-                status: 422,
-                errors: err.issues.map((issue) => ({
-                    resource: "Request",
-                    field: issue.path.join("."),
-                    code: issue.code
-                }))
-            };
-            responseBody = ghError;
-            toolError = "Validation Failed";
-            mcpResult = { content: [{ type: "text", text: jsonText(ghError) }], isError: true };
-        }
-        else {
-            status = 500;
-            const message = err instanceof Error ? err.message : "Internal Server Error";
-            const ghError = { message, documentation_url: "https://docs.github.com/rest", status: 500 };
-            responseBody = ghError;
-            toolError = message;
-            mcpResult = { content: [{ type: "text", text: jsonText(ghError) }], isError: true };
-        }
-    }
-    recordToolCall(c, deps, {
-        started,
-        status,
-        requestBody: recordedRequestBody,
-        responseBody,
-        mutation: status < 400 && isMutatingTool(name),
-        stateDelta: status < 400 ? delta : null,
-        error: toolError
-    });
-    return { jsonrpc: "2.0", id, result: mcpResult };
-}
-function recordToolCall(c, deps, fields) {
-    if (!deps.recorder)
-        return;
-    const reqId = requestId();
-    const correlationHeader = c.req.header("x-pome-correlation-id") ?? null;
-    deps.recorder.record({
-        ts: new Date().toISOString(),
-        run_id: deps.runId,
-        twin: "github",
-        request_id: reqId,
-        // FDRS-402: see app.ts respond() for the rationale.
-        correlation_id: correlationHeader ?? reqId,
-        scenario_step_id: c.req.header("x-pome-scenario-step-id") ?? null,
-        step_id: null,
-        tool_call_id: correlationHeader,
-        method: c.req.method,
-        path: new URL(c.req.url).pathname,
-        request_body: fields.requestBody,
-        status: fields.status,
-        response_body: fields.responseBody,
-        latency_ms: Date.now() - fields.started,
-        fidelity: "semantic",
-        state_mutation: fields.mutation,
-        state_delta: fields.stateDelta,
-        error: fields.error
-    });
-}
-function makeToolErrorResult(message) {
-    return {
-        content: [{ type: "text", text: jsonText({ message }) }],
-        isError: true
-    };
-}
-function errorEnvelope(id, code, message) {
-    return { jsonrpc: "2.0", id, error: { code, message } };
-}
-function jsonRpcErrorResponse(id, code, message) {
-    return Response.json(errorEnvelope(id, code, message), {
-        status: 200,
-        headers: { "content-type": "application/json" }
-    });
-}
-function idOf(message) {
-    const id = message.id;
-    if (typeof id === "string" || typeof id === "number")
-        return id;
-    return null;
-}
-function isObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function jsonText(value) {
-    return JSON.stringify(value);
-}

package/dist/src/twin-github/recorder.d.ts

@@ -1,2 +0,0 @@
-import type { Recorder } from "./types.js";
-export declare function createRecorder(): Recorder;

package/dist/src/twin-github/recorder.js

@@ -1,29 +0,0 @@
-import { redactSecrets } from "../recorder/redaction.js";
-// In-memory, run-scoped recorder for the twin pod. Events live for the
-// lifetime of the machine — discarded when Fly destroys the pod (DELETE
-// /v1/sessions/:id or 30-min TTL). This is intentional: the trace is
-// fetched once via GET /_pome/events at end-of-run by the CLI; any
-// post-mortem inspection happens via the cloud-side trace blob the CLI
-// uploads after.
-//
-// Memory cap: bounded by session timeout × max-rps. A 30-min session at
-// 10 rps × ~500B per event ≈ 9 MB. Comfortably below the pod's 256 MB.
-//
-// Centralized secret redaction (FDRS-402): request_body / response_body run
-// through the CLI's shared `redactSecrets` here so every call site benefits
-// without each route remembering to do it.
-export function createRecorder() {
-    const items = [];
-    return {
-        record(event) {
-            items.push({
-                ...event,
-                request_body: redactSecrets(event.request_body),
-                response_body: redactSecrets(event.response_body),
-            });
-        },
-        events() {
-            return [...items];
-        },
-    };
-}

package/dist/src/twin-github/seed.d.ts

@@ -1,74 +0,0 @@
-import { z } from "zod";
-import type { GitHubStateSeed } from "./types.js";
-export declare const seedSchema: z.ZodObject<{
-    users: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        login: z.ZodString;
-        type: z.ZodDefault<z.ZodEnum<{
-            User: "User";
-            Organization: "Organization";
-        }>>;
-        name: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip>>>;
-    repositories: z.ZodArray<z.ZodObject<{
-        owner: z.ZodString;
-        name: z.ZodString;
-        description: z.ZodDefault<z.ZodString>;
-        private: z.ZodDefault<z.ZodBoolean>;
-        default_branch: z.ZodDefault<z.ZodString>;
-        collaborators: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        labels: z.ZodDefault<z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-            color: z.ZodDefault<z.ZodString>;
-            description: z.ZodDefault<z.ZodString>;
-        }, z.core.$strip>>>;
-        files: z.ZodDefault<z.ZodArray<z.ZodObject<{
-            path: z.ZodString;
-            content: z.ZodString;
-            branch: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>>;
-        issues: z.ZodDefault<z.ZodArray<z.ZodObject<{
-            number: z.ZodOptional<z.ZodNumber>;
-            title: z.ZodString;
-            body: z.ZodDefault<z.ZodString>;
-            state: z.ZodDefault<z.ZodEnum<{
-                open: "open";
-                closed: "closed";
-            }>>;
-            labels: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            assignees: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        }, z.core.$strip>>>;
-        pull_requests: z.ZodDefault<z.ZodArray<z.ZodObject<{
-            number: z.ZodOptional<z.ZodNumber>;
-            title: z.ZodString;
-            body: z.ZodDefault<z.ZodString>;
-            head: z.ZodString;
-            base: z.ZodDefault<z.ZodString>;
-            state: z.ZodDefault<z.ZodEnum<{
-                open: "open";
-                closed: "closed";
-            }>>;
-            author: z.ZodOptional<z.ZodString>;
-            reviews: z.ZodDefault<z.ZodArray<z.ZodObject<{
-                author: z.ZodString;
-                state: z.ZodDefault<z.ZodEnum<{
-                    APPROVED: "APPROVED";
-                    CHANGES_REQUESTED: "CHANGES_REQUESTED";
-                    COMMENTED: "COMMENTED";
-                }>>;
-                body: z.ZodDefault<z.ZodString>;
-            }, z.core.$strip>>>;
-            statuses: z.ZodDefault<z.ZodArray<z.ZodObject<{
-                context: z.ZodDefault<z.ZodString>;
-                state: z.ZodDefault<z.ZodEnum<{
-                    error: "error";
-                    success: "success";
-                    failure: "failure";
-                    pending: "pending";
-                }>>;
-                description: z.ZodDefault<z.ZodString>;
-            }, z.core.$strip>>>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare function parseSeed(input: unknown): GitHubStateSeed;
-export declare function defaultSeedState(): GitHubStateSeed;

package/dist/src/twin-github/seed.js

@@ -1,107 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { z } from "zod";
-export const seedSchema = z.object({
-    users: z
-        .array(z.object({
-        login: z.string().min(1),
-        type: z.enum(["User", "Organization"]).default("User"),
-        name: z.string().default("")
-    }))
-        .default([]),
-    repositories: z.array(z.object({
-        owner: z.string().min(1),
-        name: z.string().min(1),
-        description: z.string().default(""),
-        private: z.boolean().default(false),
-        default_branch: z.string().min(1).default("main"),
-        collaborators: z.array(z.string().min(1)).default([]),
-        labels: z
-            .array(z.object({
-            name: z.string().min(1),
-            color: z.string().default("ededed"),
-            description: z.string().default("")
-        }))
-            .default([]),
-        files: z.array(z.object({ path: z.string().min(1), content: z.string(), branch: z.string().optional() })).default([]),
-        issues: z
-            .array(z.object({
-            number: z.number().int().positive().optional(),
-            title: z.string().min(1),
-            body: z.string().default(""),
-            state: z.enum(["open", "closed"]).default("open"),
-            labels: z.array(z.string().min(1)).default([]),
-            assignees: z.array(z.string().min(1)).default([])
-        }))
-            .default([]),
-        pull_requests: z
-            .array(z.object({
-            number: z.number().int().positive().optional(),
-            title: z.string().min(1),
-            body: z.string().default(""),
-            head: z.string().min(1),
-            base: z.string().min(1).default("main"),
-            state: z.enum(["open", "closed"]).default("open"),
-            author: z.string().min(1).optional(),
-            // Reviews seeded on this PR. `state` mirrors GitHub's review
-            // state enum; `author` must exist in the user/collaborator set.
-            reviews: z
-                .array(z.object({
-                author: z.string().min(1),
-                state: z.enum(["APPROVED", "CHANGES_REQUESTED", "COMMENTED"]).default("APPROVED"),
-                body: z.string().default("")
-            }))
-                .default([]),
-            // Commit statuses applied to this PR's head SHA. Wired into the
-            // commit_statuses table so get_pull_request_status and the merge
-            // path see them without needing a separate setup call.
-            statuses: z
-                .array(z.object({
-                context: z.string().min(1).default("ci/build"),
-                state: z.enum(["error", "failure", "pending", "success"]).default("success"),
-                description: z.string().default("")
-            }))
-                .default([])
-        }))
-            .default([])
-    }))
-});
-export function parseSeed(input) {
-    return seedSchema.parse(input);
-}
-export function defaultSeedState() {
-    return {
-        users: [
-            { login: "acme", type: "Organization", name: "Acme" },
-            { login: "alice", type: "User", name: "Alice" },
-            { login: "bob", type: "User", name: "Bob" },
-            { login: "pome-agent", type: "User", name: "Pome Agent" }
-        ],
-        repositories: [
-            {
-                owner: "acme",
-                name: "api",
-                description: "Example API service used by GitHub twin tests.",
-                default_branch: "main",
-                collaborators: ["alice", "bob", "pome-agent"],
-                labels: [
-                    { name: "bug", color: "d73a4a", description: "Something is not working" },
-                    { name: "feature", color: "a2eeef", description: "New feature or request" },
-                    { name: "question", color: "d876e3", description: "More information needed" }
-                ],
-                files: [
-                    { path: "README.md", content: "# Acme API\n\nA seeded repository for local GitHub twin tests.\n" },
-                    { path: "src/index.ts", content: "export function handler() {\n  return 'ok';\n}\n" }
-                ],
-                issues: [
-                    {
-                        number: 1,
-                        title: "500 error on POST /orders after deploy",
-                        body: "Started failing right after the 14:00 deploy. Stack trace points to OrderController#create.",
-                        labels: ["bug"],
-                        assignees: []
-                    }
-                ]
-            }
-        ]
-    };
-}