@probelabs/visor 0.1.146 → 0.1.147

package/dist/sdk/{chunk-LVOWWALU.mjs → chunk-FBJ7MC7R.mjs}

@@ -1,11 +1,11 @@
 import {
   FailureConditionEvaluator,
   init_failure_condition_evaluator
-} from "./chunk-LSCWRTSY.mjs";
+} from "./chunk-V2QW6ECX.mjs";
 import {
   addEvent,
   init_trace_helpers
-} from "./chunk-Y4DBNDLQ.mjs";
+} from "./chunk-4F5UVWAN.mjs";
 import {
   createExtendedLiquid,
   init_liquid_extensions
@@ -1499,4 +1499,4 @@ export {
   evaluateTransitions,
   init_routing
 };
-//# sourceMappingURL=chunk-LVOWWALU.mjs.map
+//# sourceMappingURL=chunk-FBJ7MC7R.mjs.map

package/dist/sdk/{chunk-4SYQL5UQ.mjs → chunk-H23T7J6Y.mjs}

@@ -1,3 +1,7 @@
+import {
+  generateHumanId,
+  init_human_id
+} from "./chunk-KFKHU6CM.mjs";
 import {
   extractFileSections,
   init_markdown,
@@ -7,10 +11,6 @@ import {
   getPromptStateManager,
   init_prompt_state
 } from "./chunk-LG4AUKHB.mjs";
-import {
-  generateHumanId,
-  init_human_id
-} from "./chunk-KFKHU6CM.mjs";
 import {
   init_tracer_init,
   initializeTracer
@@ -33,7 +33,7 @@ import {
 import {
   config_exports,
   init_config
-} from "./chunk-YOKAA4IU.mjs";
+} from "./chunk-XNTBSV6M.mjs";
 import {
   ScheduleStore,
   buildScheduleToolContext,
@@ -53,11 +53,11 @@ import {
   init_routing,
   init_snapshot_store,
   snapshot_store_exports
-} from "./chunk-LVOWWALU.mjs";
+} from "./chunk-FBJ7MC7R.mjs";
 import {
   FailureConditionEvaluator,
   init_failure_condition_evaluator
-} from "./chunk-LSCWRTSY.mjs";
+} from "./chunk-V2QW6ECX.mjs";
 import {
   addEvent,
   emitNdjsonFallback,
@@ -68,7 +68,7 @@ import {
   setSpanAttributes,
   trace_helpers_exports,
   withActiveSpan
-} from "./chunk-Y4DBNDLQ.mjs";
+} from "./chunk-4F5UVWAN.mjs";
 import {
   addDiagramBlock,
   init_metrics
@@ -1576,12 +1576,15 @@ ${"=".repeat(60)}
           if (!systemPrompt && schema !== "code-review") {
             systemPrompt = "You are general assistant, follow user instructions.";
           }
+          log(
+            `\u{1F527} AIReviewService config: allowEdit=${this.config.allowEdit}, allowBash=${this.config.allowBash}, promptType=${this.config.promptType}`
+          );
           const options = {
             sessionId,
             // Prefer config promptType, then env override, else fallback to code-review when schema is set
             promptType: this.config.promptType && this.config.promptType.trim() ? this.config.promptType.trim() : explicitPromptType ? explicitPromptType : schema === "code-review" ? "code-review-template" : void 0,
             allowEdit: false,
-            // We don't want the agent to modify files
+            // Default: don't allow file modifications
             debug: this.config.debug || false,
             // Use systemPrompt (native in rc168+) with fallback to customPrompt for backward compat
             systemPrompt: systemPrompt || this.config.systemPrompt || this.config.customPrompt
@@ -1670,6 +1673,9 @@ ${"=".repeat(60)}
           if (this.config.model) {
             options.model = this.config.model;
           }
+          log(
+            `\u{1F527} ProbeAgent options: allowEdit=${options.allowEdit}, enableBash=${options.enableBash}, promptType=${options.promptType}`
+          );
           const agent = new ProbeAgent(options);
           if (typeof agent.initialize === "function") {
             await agent.initialize();
@@ -3947,7 +3953,7 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
     ...args,
     ...argsOverrides
   };
-  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-3N7HDIN6.mjs");
+  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-HMABCGB5.mjs");
   const provider = new WorkflowCheckProvider2();
   const checkConfig = {
     type: "workflow",
@@ -8202,7 +8208,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
           }
         }
         try {
-          const { evaluateTransitions } = await import("./routing-CQDKRPTO.mjs");
+          const { evaluateTransitions } = await import("./routing-CZ36LVVS.mjs");
           const transTarget = await evaluateTransitions(
             onFinish.transitions,
             forEachParent,
@@ -8262,7 +8268,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
             `[LevelDispatch] Error evaluating on_finish transitions for ${forEachParent}: ${e instanceof Error ? e.message : String(e)}`
           );
         }
-        const { evaluateGoto: evaluateGoto2 } = await import("./routing-CQDKRPTO.mjs");
+        const { evaluateGoto: evaluateGoto2 } = await import("./routing-CZ36LVVS.mjs");
         if (context2.debug) {
           logger.info(
             `[LevelDispatch] Evaluating on_finish.goto_js for forEach parent: ${forEachParent}`
@@ -10662,10 +10668,12 @@ var init_bubblewrap_sandbox = __esm({
       name;
       config;
       repoPath;
-      constructor(name, config, repoPath) {
+      visorDistPath;
+      constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
         this.repoPath = resolve(repoPath);
+        this.visorDistPath = resolve(visorDistPath);
       }
       /**
        * Check if bwrap binary is available on the system.
@@ -10746,6 +10754,8 @@ var init_bubblewrap_sandbox = __esm({
         } else {
           args.push("--bind", this.repoPath, workdir);
         }
+        const visorPath = this.config.visor_path || "/opt/visor";
+        args.push("--ro-bind", this.visorDistPath, visorPath);
         args.push("--chdir", workdir);
         args.push("--unshare-pid");
         args.push("--new-session");
@@ -10787,10 +10797,12 @@ var init_seatbelt_sandbox = __esm({
       name;
       config;
       repoPath;
-      constructor(name, config, repoPath) {
+      visorDistPath;
+      constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
         this.repoPath = realpathSync(resolve2(repoPath));
+        this.visorDistPath = realpathSync(resolve2(visorDistPath));
       }
       /**
        * Check if sandbox-exec binary is available on the system.
@@ -10891,6 +10903,8 @@ var init_seatbelt_sandbox = __esm({
         if (!this.config.read_only) {
           lines.push(`(allow file-write* (subpath "${repoPath}"))`);
         }
+        const visorDistPath = this.escapePath(this.visorDistPath);
+        lines.push(`(allow file-read* (subpath "${visorDistPath}"))`);
         if (this.config.network !== false) {
           lines.push("(allow network*)");
         }
@@ -10963,13 +10977,13 @@ var init_sandbox_manager = __esm({
         const mode = config.compose ? "compose" : "image";
         if (config.engine === "bubblewrap") {
           const { BubblewrapSandbox: BubblewrapSandbox2 } = (init_bubblewrap_sandbox(), __toCommonJS(bubblewrap_sandbox_exports));
-          const instance = new BubblewrapSandbox2(name, config, this.repoPath);
+          const instance = new BubblewrapSandbox2(name, config, this.repoPath, this.visorDistPath);
           this.instances.set(name, instance);
           return instance;
         }
         if (config.engine === "seatbelt") {
           const { SeatbeltSandbox: SeatbeltSandbox2 } = (init_seatbelt_sandbox(), __toCommonJS(seatbelt_sandbox_exports));
-          const instance = new SeatbeltSandbox2(name, config, this.repoPath);
+          const instance = new SeatbeltSandbox2(name, config, this.repoPath, this.visorDistPath);
           this.instances.set(name, instance);
           return instance;
         }
@@ -11801,7 +11815,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const map = options?.webhookContext?.webhookData;
             if (map) {
-              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-TSAMMJ7Q.mjs");
+              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-CDL5AJSI.mjs");
               const reg = CheckProviderRegistry2.getInstance();
               const p = reg.getProvider("http_input");
               if (p && typeof p.setWebhookContext === "function") p.setWebhookContext(map);
@@ -11914,7 +11928,7 @@ var init_state_machine_execution_engine = __esm({
           logger.info("[StateMachine] Using state machine engine");
         }
         if (!config) {
-          const { ConfigManager } = await import("./config-AAB2FL22.mjs");
+          const { ConfigManager } = await import("./config-G5UU4WXT.mjs");
           const configManager = new ConfigManager();
           config = await configManager.getDefaultConfig();
           logger.debug("[StateMachine] Using default configuration (no config provided)");
@@ -11924,7 +11938,7 @@ var init_state_machine_execution_engine = __esm({
           tag_filter: tagFilter
         } : config;
         try {
-          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-TSAMMJ7Q.mjs");
+          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-CDL5AJSI.mjs");
           const registry = CheckProviderRegistry2.getInstance();
           registry.setCustomTools(configWithTagFilter.tools || {});
         } catch (error) {
@@ -11988,7 +12002,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const webhookData = this.executionContext?.webhookContext?.webhookData;
             if (webhookData instanceof Map) {
-              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-4YUM6Z5F.mjs");
+              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-QUMAF2DJ.mjs");
               const slackCtx = extractSlackContext2(webhookData);
               if (slackCtx) {
                 const payload = Array.from(webhookData.values())[0];
@@ -12017,7 +12031,7 @@ var init_state_machine_execution_engine = __esm({
         if (Array.isArray(configWithTagFilter.frontends) && configWithTagFilter.frontends.length > 0) {
           try {
             const { EventBus } = await import("./event-bus-5K3Y2FCS.mjs");
-            const { FrontendsHost } = await import("./host-GYZ7XCLI.mjs");
+            const { FrontendsHost } = await import("./host-GVR4UGZ3.mjs");
             const bus = new EventBus();
             context2.eventBus = bus;
             frontendsHost = new FrontendsHost(bus, logger);
@@ -12367,9 +12381,9 @@ var init_state_machine_execution_engine = __esm({
        * @returns Array of failure condition evaluation results
        */
       async evaluateFailureConditions(checkName, reviewSummary, config, previousOutputs, authorAssociation) {
-        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-SMOVMMES.mjs");
+        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-FHNZL2US.mjs");
         const evaluator = new FailureConditionEvaluator2();
-        const { addEvent: addEvent3 } = await import("./trace-helpers-AWCFW5KG.mjs");
+        const { addEvent: addEvent3 } = await import("./trace-helpers-EHDZ42HH.mjs");
         const { addFailIfTriggered } = await import("./metrics-I6A7IHG4.mjs");
         const checkConfig = config.checks?.[checkName];
         if (!checkConfig) {
@@ -37694,7 +37708,7 @@ function buildBuiltinGlobals(opts) {
   const scheduleFn = async (args = {}) => {
     try {
       const { handleScheduleAction: handleScheduleAction2, buildScheduleToolContext: buildScheduleToolContext2 } = await import("./schedule-tool-2COUUTF7.mjs");
-      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-4YUM6Z5F.mjs");
+      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-QUMAF2DJ.mjs");
       const parentCtx = opts.sessionInfo?._parentContext;
       const webhookData = parentCtx?.prInfo?.eventContext?.webhookData;
       const visorCfg = parentCtx?.config;
@@ -38365,7 +38379,7 @@ var init_worktree_manager = __esm({
       /**
        * Get or create bare repository
        */
-      async getOrCreateBareRepo(repository, repoUrl, token, fetchDepth, cloneTimeoutMs) {
+      async getOrCreateBareRepo(repository, repoUrl, _token, fetchDepth, cloneTimeoutMs) {
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, "-");
         const bareRepoPath = path11.join(reposDir, `${repoName}.git`);
@@ -38381,11 +38395,12 @@ var init_worktree_manager = __esm({
             );
             await fsp2.rm(bareRepoPath, { recursive: true, force: true });
           } else {
+            await this.resetBareRepoRemoteUrl(bareRepoPath, repoUrl);
             await this.updateBareRepo(bareRepoPath);
             return bareRepoPath;
           }
         }
-        const cloneUrl = this.buildAuthenticatedUrl(repoUrl, token);
+        const cloneUrl = repoUrl;
         const redactedUrl = this.redactUrl(cloneUrl);
         logger.info(
           `Cloning bare repository: ${redactedUrl}${fetchDepth ? ` (depth: ${fetchDepth})` : ""}`
@@ -38466,6 +38481,33 @@ var init_worktree_manager = __esm({
           return false;
         }
       }
+      /**
+       * Ensure the origin remote URL of a bare repo is a plain URL (no embedded token).
+       *
+       * Older bare repos may have been cloned with a token in the URL
+       * (https://x-access-token:TOKEN@github.com/...). This causes stale-token
+       * failures because GIT_CONFIG insteadOf rules can't rewrite URLs that
+       * already have credentials. Resetting to the plain URL lets insteadOf
+       * handle auth with the freshest token.
+       */
+      async resetBareRepoRemoteUrl(bareRepoPath, plainRepoUrl) {
+        try {
+          const cmd = `git -C ${this.escapeShellArg(bareRepoPath)} remote set-url origin ${this.escapeShellArg(plainRepoUrl)}`;
+          const result = await this.executeGitCommand(cmd, { timeout: 1e4 });
+          if (result.exitCode !== 0) {
+            logger.warn(
+              `Failed to reset bare repo remote URL: ${result.stderr}. Git operations may fail with stale token if the URL has embedded credentials.`
+            );
+          } else {
+            logger.debug(`Reset bare repo remote URL to plain URL for ${bareRepoPath}`);
+          }
+        } catch (error) {
+          const msg = error instanceof Error ? error.message : String(error);
+          logger.warn(
+            `Error resetting bare repo remote URL: ${msg}. Git operations may fail with stale token if the URL has embedded credentials.`
+          );
+        }
+      }
       /**
        * Create a new worktree for the given repository/ref.
        *
@@ -40648,4 +40690,4 @@ undici/lib/fetch/body.js:
 undici/lib/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-4SYQL5UQ.mjs.map
+//# sourceMappingURL=chunk-H23T7J6Y.mjs.map