@quikit/quikpilot-runner 7.0.2

package/README.md

@@ -0,0 +1,27 @@
+# @quikit/quikpilot-runner
+
+QuikPilot's CI runner. Invoked automatically by the `.github/workflows/quikpilot.yml` file QuikPilot
+installs in an onboarded repository — it fetches the run's work packet, runs your setup/lint/test
+commands, reports results to QuikTest, enforces the denied-path guardrail, commits, pushes, and
+reports back to QuikTrack.
+
+This package is not meant to be installed or run by hand. It exists so a fix to QuikPilot's runner
+logic ships as a new package version rather than a new pull request into every onboarded repository
+— the workflow file itself lives in your repository (QuikIT cannot update it directly), so it stays a
+thin, ~25-line launcher that invokes an exact, pinned version of this package via `npx`.
+
+It carries no secrets and needs none of your credentials: it authenticates to QuikTrack and to GitHub
+using short-lived tokens exchanged at runtime, never a value baked into the workflow file or this
+package.
+
+## Versioning and support
+
+Every workflow file pins an **exact** version of this package (`npx --yes
+@quikit/quikpilot-runner@<version>`, never a range or `latest`) — a repository never picks up a new
+release on its own. Older published versions are not removed from npm and keep working as long as a
+repository's workflow file keeps pinning them; upgrading to a newer version only happens through a new
+pull request into that repository (QuikTrack's "re-bootstrap" flow), never silently.
+
+Releases follow [SemVer](https://semver.org/): a major version bump means the workflow file's own
+shape changed (inputs, permissions) and requires a new pull request regardless of this package's
+version; minor/patch releases are runner-logic fixes safe to pick up on the next re-bootstrap.

package/dist/index.js

@@ -0,0 +1,380 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/callback.ts
+async function reportBack(params) {
+  const { callbackUrl, runToken, status, branch } = params;
+  const body = { status };
+  if (branch) body.branch = branch;
+  const res = await fetch(callbackUrl, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${runToken}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    throw new Error(`Report back to QuikTrack failed: ${res.status} ${res.statusText}`);
+  }
+}
+
+// src/commands.ts
+var import_node_child_process = require("node:child_process");
+function runCommand(command, label) {
+  if (!command) return;
+  try {
+    (0, import_node_child_process.execSync)(command, { shell: "/bin/bash", stdio: "inherit" });
+  } catch (err) {
+    throw new Error(`${label} failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function runTestCommand(command) {
+  if (!command) return "success";
+  try {
+    (0, import_node_child_process.execSync)(command, { shell: "/bin/bash", stdio: "inherit" });
+    return "success";
+  } catch {
+    return "failure";
+  }
+}
+
+// src/git.ts
+var import_node_child_process2 = require("node:child_process");
+function git(args, extraEnv = {}) {
+  return (0, import_node_child_process2.execFileSync)("git", args, {
+    encoding: "utf8",
+    env: { ...process.env, ...extraEnv }
+  }).trim();
+}
+function currentBranch() {
+  return git(["rev-parse", "--abbrev-ref", "HEAD"]);
+}
+function checkoutTargetBranch(targetBranch) {
+  if (!targetBranch || targetBranch === currentBranch()) return;
+  git(["fetch", "origin", targetBranch]);
+  git(["checkout", targetBranch]);
+}
+function addAll() {
+  git(["add", "-A"]);
+}
+function diffCachedNamesMatching(pattern) {
+  const out = git(["diff", "--cached", "--name-only", "--", `:(glob)${pattern}`]);
+  return out ? out.split("\n").filter(Boolean) : [];
+}
+function hasStagedChanges() {
+  try {
+    (0, import_node_child_process2.execFileSync)("git", ["diff", "--cached", "--quiet"]);
+    return false;
+  } catch {
+    return true;
+  }
+}
+function configureCommitIdentity() {
+  git(["config", "user.name", "quikpilot[bot]"]);
+  git(["config", "user.email", "quikpilot@users.noreply.github.com"]);
+}
+function checkoutNewBranch(branch) {
+  git(["checkout", "-b", branch]);
+}
+function commit(message) {
+  git(["commit", "-m", message]);
+}
+function clearCheckoutExtraHeader() {
+  try {
+    git(["config", "--unset-all", "http.https://github.com/.extraheader"]);
+  } catch (err) {
+    const status = err.status;
+    if (status !== 5) throw err;
+  }
+}
+function push(branch, installationToken) {
+  clearCheckoutExtraHeader();
+  const basicAuth = Buffer.from(`x-access-token:${installationToken}`).toString("base64");
+  git(["push", "--set-upstream", "origin", branch], {
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basicAuth}`
+  });
+}
+
+// src/commit.ts
+function commitAndPush(branch, runId, installationToken) {
+  if (!hasStagedChanges()) return { changed: false };
+  if (!branch) {
+    throw new Error("packet carried no branch name");
+  }
+  configureCommitIdentity();
+  checkoutNewBranch(branch);
+  commit(`QuikPilot Phase 0 skeleton (run ${runId})`);
+  push(branch, installationToken);
+  return { changed: true, branch };
+}
+
+// src/env.ts
+function required(name, value) {
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+}
+function readRunnerEnv(env = process.env) {
+  return {
+    runId: required("RUN_ID", env.RUN_ID),
+    callbackUrl: required("CALLBACK_URL", env.CALLBACK_URL),
+    packetUrl: required("PACKET_URL", env.PACKET_URL),
+    tokenUrl: required("TOKEN_URL", env.TOKEN_URL),
+    installationTokenUrl: required("INSTALLATION_TOKEN_URL", env.INSTALLATION_TOKEN_URL),
+    githubRunId: required("GITHUB_RUN_ID", env.GITHUB_RUN_ID),
+    githubServerUrl: env.GITHUB_SERVER_URL ?? "https://github.com",
+    githubRepository: required("GITHUB_REPOSITORY", env.GITHUB_REPOSITORY)
+  };
+}
+
+// src/guardrail.ts
+function checkGuardrail(deniedPaths) {
+  addAll();
+  const violations = deniedPaths.flatMap((pattern) => diffCachedNamesMatching(pattern));
+  if (violations.length > 0) {
+    throw new Error(`QuikPilot touched denied paths:
+${violations.join("\n")}`);
+  }
+}
+
+// src/installationToken.ts
+async function exchangeForInstallationToken(installationTokenUrl, runToken) {
+  const res = await fetch(installationTokenUrl, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${runToken}` }
+  });
+  if (!res.ok) {
+    throw new Error(`Exchange installation token failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  if (body.success !== true) {
+    throw new Error("Exchange installation token failed: response did not carry success:true");
+  }
+  return body.data.token;
+}
+
+// src/oidc.ts
+var QUIKPILOT_OIDC_AUDIENCE = "quiktrack-quikpilot";
+async function fetchGithubOidcToken(env = process.env) {
+  const requestUrl = required(
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+    env.ACTIONS_ID_TOKEN_REQUEST_URL
+  );
+  const requestToken = required(
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+    env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
+  );
+  const separator = requestUrl.includes("?") ? "&" : "?";
+  const url = `${requestUrl}${separator}audience=${encodeURIComponent(QUIKPILOT_OIDC_AUDIENCE)}`;
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${requestToken}` }
+  });
+  if (!res.ok) {
+    throw new Error(`Fetch GitHub OIDC token failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  if (!body.value) {
+    throw new Error("GitHub OIDC token response carried no value");
+  }
+  return body.value;
+}
+
+// src/packet.ts
+async function fetchPacket(packetUrl, runToken, githubRunId) {
+  const url = `${packetUrl}?githubRunId=${encodeURIComponent(githubRunId)}`;
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${runToken}` }
+  });
+  if (!res.ok) {
+    throw new Error(`Fetch work packet failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  if (body.success !== true) {
+    throw new Error("Fetch work packet failed: response did not carry success:true");
+  }
+  return body.data;
+}
+
+// src/phase0.ts
+var import_node_fs = require("node:fs");
+function writePhase0Marker(runId) {
+  (0, import_node_fs.mkdirSync)(".quikpilot", { recursive: true });
+  (0, import_node_fs.appendFileSync)(".quikpilot/phase0-marker.txt", `QuikPilot Phase 0 skeleton marker for run ${runId}
+`);
+}
+
+// src/quiktest.ts
+var import_node_fs2 = require("node:fs");
+var import_node_path = require("node:path");
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function walkForJUnitByName(dir) {
+  let entries;
+  try {
+    entries = (0, import_node_fs2.readdirSync)(dir);
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry)) continue;
+    const full = (0, import_node_path.join)(dir, entry);
+    let stat;
+    try {
+      stat = (0, import_node_fs2.statSync)(full);
+    } catch {
+      continue;
+    }
+    if (stat.isDirectory()) {
+      const found = walkForJUnitByName(full);
+      if (found) return found;
+    } else if (/^junit.*\.xml$/.test(entry)) {
+      return full;
+    }
+  }
+  return null;
+}
+function firstXmlIn(dir, namePattern) {
+  let entries;
+  try {
+    entries = (0, import_node_fs2.readdirSync)(dir);
+  } catch {
+    return null;
+  }
+  const match = entries.find((e) => namePattern.test(e));
+  return match ? (0, import_node_path.join)(dir, match) : null;
+}
+function findJUnitReport(cwd = process.cwd()) {
+  return walkForJUnitByName(cwd) ?? firstXmlIn((0, import_node_path.join)(cwd, "test-results"), /\.xml$/) ?? firstXmlIn((0, import_node_path.join)(cwd, "reports"), /^junit.*\.xml$/) ?? firstXmlIn((0, import_node_path.join)(cwd, "target", "surefire-reports"), /\.xml$/);
+}
+function buildCiUrl(serverUrl, repository, githubRunId) {
+  return `${serverUrl}/${repository}/actions/runs/${githubRunId}`;
+}
+async function reportToQuikTest(params) {
+  const { resultsUrl, runToken, githubServerUrl, githubRepository, githubRunId, cwd } = params;
+  if (!resultsUrl) {
+    console.log("packet.quikTest is null \u2014 this run has no QuikTest run to report into.");
+    return;
+  }
+  const report = findJUnitReport(cwd);
+  if (!report) {
+    console.warn("::warning::QuikPilot found no JUnit report \u2014 no results reported to QuikTest.");
+    return;
+  }
+  try {
+    console.log(`reporting ${report}`);
+    const ciUrl = buildCiUrl(githubServerUrl, githubRepository, githubRunId);
+    const { readFileSync } = await import("node:fs");
+    const body = readFileSync(report);
+    const url = `${resultsUrl}?ciUrl=${encodeURIComponent(ciUrl)}`;
+    const res = await fetch(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${runToken}`, "Content-Type": "text/xml" },
+      body
+    });
+    if (!res.ok) {
+      throw new Error(`QuikTest report POST failed: ${res.status} ${res.statusText}`);
+    }
+    (0, import_node_fs2.rmSync)(report, { force: true });
+  } catch (err) {
+    console.warn(`::warning::QuikPilot failed to report results to QuikTest: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+// src/tokenExchange.ts
+async function exchangeForRunToken(tokenUrl, oidcToken) {
+  const res = await fetch(tokenUrl, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${oidcToken}` }
+  });
+  if (!res.ok) {
+    throw new Error(`Exchange run token failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  if (body.success !== true) {
+    throw new Error("Exchange run token failed: response did not carry success:true");
+  }
+  return body.data.runToken;
+}
+
+// src/run.ts
+async function run(env = readRunnerEnv()) {
+  let hardFailure = false;
+  let packet;
+  let branch;
+  let runToken;
+  try {
+    runToken = await exchangeForRunToken(env.tokenUrl, await fetchGithubOidcToken());
+    packet = await fetchPacket(env.packetUrl, runToken, env.githubRunId);
+    checkoutTargetBranch(packet.targetBranch);
+    writePhase0Marker(env.runId);
+    runCommand(packet.commands.setup, "Setup");
+    runCommand(packet.commands.lint, "Lint");
+    runTestCommand(packet.commands.test);
+  } catch (err) {
+    hardFailure = true;
+    console.error(err instanceof Error ? err.message : String(err));
+  }
+  if (!runToken) {
+    console.error("No run token \u2014 the OIDC exchange failed before QuikTrack could be reached.");
+    return { hardFailure: true };
+  }
+  await reportToQuikTest({
+    resultsUrl: packet?.quikTest?.resultsUrl,
+    runToken,
+    githubServerUrl: env.githubServerUrl,
+    githubRepository: env.githubRepository,
+    githubRunId: env.githubRunId
+  });
+  if (!hardFailure && packet) {
+    try {
+      checkGuardrail(packet.guardrails.deniedPaths);
+      const installationToken = await exchangeForInstallationToken(
+        env.installationTokenUrl,
+        runToken
+      );
+      const result = commitAndPush(packet.branch, env.runId, installationToken);
+      branch = result.branch;
+    } catch (err) {
+      hardFailure = true;
+      console.error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  await reportBack({
+    callbackUrl: env.callbackUrl,
+    runToken,
+    status: hardFailure ? "failed" : "completed",
+    branch
+  });
+  return { hardFailure };
+}
+
+// src/index.ts
+run().then(({ hardFailure }) => {
+  process.exitCode = hardFailure ? 1 : 0;
+}).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/callback.ts", "../src/commands.ts", "../src/git.ts", "../src/commit.ts", "../src/env.ts", "../src/guardrail.ts", "../src/installationToken.ts", "../src/oidc.ts", "../src/packet.ts", "../src/phase0.ts", "../src/quiktest.ts", "../src/tokenExchange.ts", "../src/run.ts", "../src/index.ts"],
+  "sourcesContent": ["export type RunStatus = \"completed\" | \"failed\";\n\n/** Always fires, regardless of what failed upstream \u2014 a run that fails silently is worse than one\n *  that fails loudly. `branch` is omitted entirely (not sent as null/empty) when no push happened,\n *  matching the original `jq ... | with_entries(select(.value != null and .value != \"\"))`. */\nexport async function reportBack(params: {\n  callbackUrl: string;\n  runToken: string;\n  status: RunStatus;\n  branch?: string;\n}): Promise<void> {\n  const { callbackUrl, runToken, status, branch } = params;\n  const body: Record<string, string> = { status };\n  if (branch) body.branch = branch;\n  const res = await fetch(callbackUrl, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${runToken}`, \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) {\n    throw new Error(`Report back to QuikTrack failed: ${res.status} ${res.statusText}`);\n  }\n}\n", "import { execSync } from \"node:child_process\";\n\n/** Runs a packet-supplied command through bash \u2014 same interpreter GitHub's own `run:` steps used,\n *  so a command written against that shell (e.g. `set -o pipefail`-reliant) behaves the same way.\n *  A null/empty command is a no-op, matching the original `[ -n \"$CMD\" ]` guard. */\nexport function runCommand(command: string | null, label: string): void {\n  if (!command) return;\n  try {\n    execSync(command, { shell: \"/bin/bash\", stdio: \"inherit\" });\n  } catch (err) {\n    throw new Error(`${label} failed: ${err instanceof Error ? err.message : String(err)}`);\n  }\n}\n\nexport type TestOutcome = \"success\" | \"failure\";\n\n/** The Test step alone is soft \u2014 a failing suite must not hide the rest of the run (guardrail,\n *  commit, push) from happening, and must not flip the final callback to `failed`. QuikTest owns\n *  per-test outcomes; this is only ever logged, never reported. */\nexport function runTestCommand(command: string | null): TestOutcome {\n  if (!command) return \"success\";\n  try {\n    execSync(command, { shell: \"/bin/bash\", stdio: \"inherit\" });\n    return \"success\";\n  } catch {\n    return \"failure\";\n  }\n}\n", "import { execFileSync } from \"node:child_process\";\n\n/** Thin wrapper around `execFileSync` \u2014 args passed as an array, never through a shell, so a\n *  branch name or guardrail pattern can never be interpreted as shell syntax. `extraEnv` layers\n *  on top of the inherited environment; every existing call site is unaffected since it defaults\n *  to empty. */\nfunction git(args: string[], extraEnv: NodeJS.ProcessEnv = {}): string {\n  return execFileSync(\"git\", args, {\n    encoding: \"utf8\",\n    env: { ...process.env, ...extraEnv },\n  }).trim();\n}\n\nexport function currentBranch(): string {\n  return git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n}\n\n/** Only fetches + checks out when the packet names a target branch different from the one the\n *  workflow_dispatch already put us on \u2014 dispatch always runs against the default branch (the\n *  only place `workflow_dispatch` can find the file), but the PR base may differ. */\nexport function checkoutTargetBranch(targetBranch: string | null): void {\n  if (!targetBranch || targetBranch === currentBranch()) return;\n  git([\"fetch\", \"origin\", targetBranch]);\n  git([\"checkout\", targetBranch]);\n}\n\nexport function addAll(): void {\n  git([\"add\", \"-A\"]);\n}\n\n/** `:(glob)` pathspec \u2014 same semantics `**` needs that a hand-rolled glob-to-regex would risk\n *  getting wrong. */\nexport function diffCachedNamesMatching(pattern: string): string[] {\n  const out = git([\"diff\", \"--cached\", \"--name-only\", \"--\", `:(glob)${pattern}`]);\n  return out ? out.split(\"\\n\").filter(Boolean) : [];\n}\n\nexport function hasStagedChanges(): boolean {\n  try {\n    execFileSync(\"git\", [\"diff\", \"--cached\", \"--quiet\"]);\n    return false;\n  } catch {\n    return true;\n  }\n}\n\nexport function configureCommitIdentity(): void {\n  git([\"config\", \"user.name\", \"quikpilot[bot]\"]);\n  git([\"config\", \"user.email\", \"quikpilot@users.noreply.github.com\"]);\n}\n\nexport function checkoutNewBranch(branch: string): void {\n  git([\"checkout\", \"-b\", branch]);\n}\n\nexport function commit(message: string): void {\n  git([\"commit\", \"-m\", message]);\n}\n\n/**\n * Push, authenticated with a repo-scoped GitHub installation token (QUIKTR-804, D16) rather than\n * whatever ambient credential checkout configured. `x-access-token:<token>` Basic-auth, GitHub's\n * documented scheme for installation tokens over HTTPS git.\n *\n * Carried via `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_0`/`GIT_CONFIG_VALUE_0` env vars rather than a\n * `-c http.extraheader=...` argv flag or a `.git/config` write: env vars are not visible to `ps`,\n * argv is \u2014 the same class of exposure `packet.ts`'s own header comment already avoids for this\n * runner's other credential. Scoped to this one invocation only; never persisted.\n *\n * QUIKTR-943 rehearsal, 7.0.1 \u2014 the key MUST be `http.https://github.com/.extraheader`\n * (URL-scoped), not the unscoped `http.extraheader`. `actions/checkout` persists its own\n * credential under the URL-scoped key, pointing at the job's ambient token (contents: read since\n * QUIKTR-804 dropped it). Git prefers the more specific URL-scoped key, so an unscoped header here\n * silently loses to checkout's read-only one \u2014 the push then fails with \"denied to\n * github-actions[bot]\" even though this token itself has write access and the exchange succeeded.\n *\n * QUIKTR-943 rehearsal, 7.0.2 \u2014 url-scoping alone re-broke the push a second way:\n * `http.<url>.extraheader` is multi-valued (git appends, it doesn't replace), so checkout's\n * `.git/config` entry and this call's env-var entry are BOTH sent, and GitHub 400s with\n * `Duplicate header: \"Authorization\"`. `--unset-all` clears checkout's entry from `.git/config`\n * first, so our env-var header (scoped to this one invocation, never written to disk) is the only\n * one on the wire. Tolerates the key already being absent (exit 5) \u2014 nothing to clear is not a\n * failure, and a workflow that ever runs with `persist-credentials: false` shouldn't crash here.\n */\nfunction clearCheckoutExtraHeader(): void {\n  try {\n    git([\"config\", \"--unset-all\", \"http.https://github.com/.extraheader\"]);\n  } catch (err: unknown) {\n    const status = (err as { status?: number }).status;\n    if (status !== 5) throw err;\n  }\n}\n\nexport function push(branch: string, installationToken: string): void {\n  clearCheckoutExtraHeader();\n  const basicAuth = Buffer.from(`x-access-token:${installationToken}`).toString(\"base64\");\n  git([\"push\", \"--set-upstream\", \"origin\", branch], {\n    GIT_CONFIG_COUNT: \"1\",\n    GIT_CONFIG_KEY_0: \"http.https://github.com/.extraheader\",\n    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basicAuth}`,\n  });\n}\n", "import {\n  checkoutNewBranch,\n  commit,\n  configureCommitIdentity,\n  hasStagedChanges,\n  push,\n} from \"./git\";\n\nexport interface CommitResult {\n  changed: boolean;\n  branch?: string;\n}\n\n/** Runs regardless of the Test step's outcome \u2014 a failing suite must not hide the generated diff\n *  from a reviewer (the whole reason Test alone is a soft failure). Only reached when Setup, Lint,\n *  and the guardrail check all passed. The branch name comes from the packet, not `runId`: QuikTrack\n *  already computed and stored it, and two sources for one value will eventually disagree.\n *  `installationToken` (QUIKTR-804) is the repo-scoped GitHub credential the push authenticates\n *  with \u2014 see git.ts's `push` for why. */\nexport function commitAndPush(\n  branch: string | null,\n  runId: string,\n  installationToken: string,\n): CommitResult {\n  if (!hasStagedChanges()) return { changed: false };\n  if (!branch) {\n    throw new Error(\"packet carried no branch name\");\n  }\n  configureCommitIdentity();\n  checkoutNewBranch(branch);\n  commit(`QuikPilot Phase 0 skeleton (run ${runId})`);\n  push(branch, installationToken);\n  return { changed: true, branch };\n}\n", "/** The `workflow_dispatch` inputs QuikTrack's `dispatch.ts` sends, unchanged by QUIKTR-572 \u2014 the\n *  generated workflow file still passes them through as job-level env vars under these exact\n *  names. QUIKTR-805: `runToken`/`RUN_TOKEN` (a bearer, visible in the Actions UI as a dispatch\n *  input) was replaced with `tokenUrl`/`TOKEN_URL` \u2014 the runner now exchanges a GitHub OIDC ID\n *  token there for a run token at runtime; see `oidc.ts` and `tokenExchange.ts`. QUIKTR-804 adds\n *  `installationTokenUrl`/`INSTALLATION_TOKEN_URL` \u2014 the run token is exchanged there for a\n *  repo-scoped GitHub push credential; see `installationToken.ts`. */\nexport interface RunnerEnv {\n  runId: string;\n  callbackUrl: string;\n  packetUrl: string;\n  tokenUrl: string;\n  installationTokenUrl: string;\n  /** GitHub Actions built-ins, read directly from `process.env` rather than threaded through here\n   *  individually. */\n  githubRunId: string;\n  githubServerUrl: string;\n  githubRepository: string;\n}\n\nexport function required(name: string, value: string | undefined): string {\n  if (!value) {\n    throw new Error(`Missing required environment variable: ${name}`);\n  }\n  return value;\n}\n\nexport function readRunnerEnv(env: NodeJS.ProcessEnv = process.env): RunnerEnv {\n  return {\n    runId: required(\"RUN_ID\", env.RUN_ID),\n    callbackUrl: required(\"CALLBACK_URL\", env.CALLBACK_URL),\n    packetUrl: required(\"PACKET_URL\", env.PACKET_URL),\n    tokenUrl: required(\"TOKEN_URL\", env.TOKEN_URL),\n    installationTokenUrl: required(\"INSTALLATION_TOKEN_URL\", env.INSTALLATION_TOKEN_URL),\n    githubRunId: required(\"GITHUB_RUN_ID\", env.GITHUB_RUN_ID),\n    githubServerUrl: env.GITHUB_SERVER_URL ?? \"https://github.com\",\n    githubRepository: required(\"GITHUB_REPOSITORY\", env.GITHUB_REPOSITORY),\n  };\n}\n", "import { addAll, diffCachedNamesMatching } from \"./git\";\n\n/** Stages everything, then refuses to proceed if any staged file matches a denied-path glob.\n *  Public and inspectable on purpose (Suyash, 2026-09-10): moving this into a published package\n *  doesn't hide the enforcement \u2014 it's the same check, just no longer duplicated per customer repo. */\nexport function checkGuardrail(deniedPaths: string[]): void {\n  addAll();\n  const violations = deniedPaths.flatMap((pattern) => diffCachedNamesMatching(pattern));\n  if (violations.length > 0) {\n    throw new Error(`QuikPilot touched denied paths:\\n${violations.join(\"\\n\")}`);\n  }\n}\n", "interface InstallationTokenResponse {\n  success: boolean;\n  data: { token: string; expiresAt: string };\n}\n\n/** Exchange the QuikPilot run token for a repo-scoped GitHub installation token (QUIKTR-804) \u2014\n *  mirrors `tokenExchange.ts`'s `exchangeForRunToken` shape: bearer auth, `{success,data}`\n *  envelope, same error-message style. */\nexport async function exchangeForInstallationToken(\n  installationTokenUrl: string,\n  runToken: string,\n): Promise<string> {\n  const res = await fetch(installationTokenUrl, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${runToken}` },\n  });\n  if (!res.ok) {\n    throw new Error(`Exchange installation token failed: ${res.status} ${res.statusText}`);\n  }\n  const body = (await res.json()) as InstallationTokenResponse;\n  if (body.success !== true) {\n    throw new Error(\"Exchange installation token failed: response did not carry success:true\");\n  }\n  return body.data.token;\n}\n", "import { required } from \"./env\";\n\n/** Must equal `apps/quiktrack/lib/services/github/oidc.ts`'s own copy of this literal \u2014 that app\n *  verifies the token this package requests. Duplicated because this package is published outside\n *  the monorepo and cannot import from the app; same reasoning `packet.ts`'s header gives for\n *  duplicating `PilotPacket`'s shape. */\nconst QUIKPILOT_OIDC_AUDIENCE = \"quiktrack-quikpilot\";\n\ninterface OidcTokenResponse {\n  value: string;\n}\n\n/** Request a GitHub Actions OIDC ID token \u2014 the runner's proof of identity, exchanged at\n *  `TOKEN_URL` for a QuikPilot run token (QUIKTR-805). `ACTIONS_ID_TOKEN_REQUEST_URL` and\n *  `ACTIONS_ID_TOKEN_REQUEST_TOKEN` are ambient GitHub Actions env vars, present only because the\n *  generated workflow declares `permissions: id-token: write` \u2014 no dispatch input carries them. */\nexport async function fetchGithubOidcToken(\n  env: NodeJS.ProcessEnv = process.env,\n): Promise<string> {\n  const requestUrl = required(\n    \"ACTIONS_ID_TOKEN_REQUEST_URL\",\n    env.ACTIONS_ID_TOKEN_REQUEST_URL,\n  );\n  const requestToken = required(\n    \"ACTIONS_ID_TOKEN_REQUEST_TOKEN\",\n    env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,\n  );\n  const separator = requestUrl.includes(\"?\") ? \"&\" : \"?\";\n  const url = `${requestUrl}${separator}audience=${encodeURIComponent(QUIKPILOT_OIDC_AUDIENCE)}`;\n  const res = await fetch(url, {\n    headers: { Authorization: `Bearer ${requestToken}` },\n  });\n  if (!res.ok) {\n    throw new Error(`Fetch GitHub OIDC token failed: ${res.status} ${res.statusText}`);\n  }\n  const body = (await res.json()) as OidcTokenResponse;\n  if (!body.value) {\n    throw new Error(\"GitHub OIDC token response carried no value\");\n  }\n  return body.value;\n}\n", "/** Mirrors `apps/quiktrack/lib/services/pilot/packet.ts`'s `PilotPacket` shape. Duplicated rather\n *  than imported \u2014 this package is published outside the monorepo and cannot depend on the app. */\nexport interface PilotPacket {\n  runId: string;\n  issueKey: string | null;\n  branch: string | null;\n  targetBranch: string | null;\n  commands: {\n    setup: string | null;\n    test: string | null;\n    e2e: string | null;\n    lint: string | null;\n  };\n  guardrails: {\n    deniedPaths: string[];\n    maxHealIterations: number;\n    maxRunUsd: string;\n    maxWallClockMinutes: number;\n  };\n  quikTest: { testRunId: string; resultsUrl: string } | null;\n}\n\ninterface PacketResponse {\n  success: boolean;\n  data: PilotPacket;\n}\n\n/** GET the run's work packet. Bearer auth via the run token, matching the header curl sent on\n *  stdin (`--config -`) so it never showed up in `ps` \u2014 an HTTP client's header option is already\n *  invisible to `ps`, so no equivalent trick is needed here. */\nexport async function fetchPacket(\n  packetUrl: string,\n  runToken: string,\n  githubRunId: string,\n): Promise<PilotPacket> {\n  const url = `${packetUrl}?githubRunId=${encodeURIComponent(githubRunId)}`;\n  const res = await fetch(url, {\n    headers: { Authorization: `Bearer ${runToken}` },\n  });\n  if (!res.ok) {\n    throw new Error(`Fetch work packet failed: ${res.status} ${res.statusText}`);\n  }\n  const body = (await res.json()) as PacketResponse;\n  if (body.success !== true) {\n    throw new Error(\"Fetch work packet failed: response did not carry success:true\");\n  }\n  return body.data;\n}\n", "import { appendFileSync, mkdirSync } from \"node:fs\";\n\n/** Phase 0 has no agent. This proves the loop end to end without touching real source, which would\n *  risk breaking the build for a reason nobody would connect back to QuikPilot. Verbatim carry-over\n *  from the inlined workflow \u2014 real codegen is separate, not-yet-built work. */\nexport function writePhase0Marker(runId: string): void {\n  mkdirSync(\".quikpilot\", { recursive: true });\n  appendFileSync(\".quikpilot/phase0-marker.txt\", `QuikPilot Phase 0 skeleton marker for run ${runId}\\n`);\n}\n", "import { readdirSync, rmSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nconst SKIP_DIRS = new Set([\"node_modules\", \".git\"]);\n\nfunction walkForJUnitByName(dir: string): string | null {\n  let entries: string[];\n  try {\n    entries = readdirSync(dir);\n  } catch {\n    return null;\n  }\n  for (const entry of entries) {\n    if (SKIP_DIRS.has(entry)) continue;\n    const full = join(dir, entry);\n    let stat;\n    try {\n      stat = statSync(full);\n    } catch {\n      continue;\n    }\n    if (stat.isDirectory()) {\n      const found = walkForJUnitByName(full);\n      if (found) return found;\n    } else if (/^junit.*\\.xml$/.test(entry)) {\n      return full;\n    }\n  }\n  return null;\n}\n\nfunction firstXmlIn(dir: string, namePattern: RegExp): string | null {\n  let entries: string[];\n  try {\n    entries = readdirSync(dir);\n  } catch {\n    return null;\n  }\n  const match = entries.find((e) => namePattern.test(e));\n  return match ? join(dir, match) : null;\n}\n\n/** QtPilotConfig has no column for the report path, so this is a convention over a short list of\n *  common locations rather than a configurable setting. A project that writes its report elsewhere\n *  reports nothing and finds out from the log \u2014 a missing artefact must not fail the run. Checked\n *  in the same priority the original `find` clause listed them, though exact traversal order was\n *  never guaranteed there either. */\nexport function findJUnitReport(cwd = process.cwd()): string | null {\n  return (\n    walkForJUnitByName(cwd) ??\n    firstXmlIn(join(cwd, \"test-results\"), /\\.xml$/) ??\n    firstXmlIn(join(cwd, \"reports\"), /^junit.*\\.xml$/) ??\n    firstXmlIn(join(cwd, \"target\", \"surefire-reports\"), /\\.xml$/)\n  );\n}\n\nfunction buildCiUrl(serverUrl: string, repository: string, githubRunId: string): string {\n  return `${serverUrl}/${repository}/actions/runs/${githubRunId}`;\n}\n\n/** Best-effort \u2014 every branch here is designed to never throw, matching the bash step's own\n *  `if: always()` + internally tolerant logic (null resultsUrl and \"no report found\" are both the\n *  common path in Phase 0, not edge cases \u2014 D19). Deletes the report after a successful POST so the\n *  guardrail's `git add -A` never commits a CI artefact into the customer's pull request. */\nexport async function reportToQuikTest(params: {\n  resultsUrl: string | null | undefined;\n  runToken: string;\n  githubServerUrl: string;\n  githubRepository: string;\n  githubRunId: string;\n  cwd?: string;\n}): Promise<void> {\n  const { resultsUrl, runToken, githubServerUrl, githubRepository, githubRunId, cwd } = params;\n  if (!resultsUrl) {\n    console.log(\"packet.quikTest is null \u2014 this run has no QuikTest run to report into.\");\n    return;\n  }\n  const report = findJUnitReport(cwd);\n  if (!report) {\n    console.warn(\"::warning::QuikPilot found no JUnit report \u2014 no results reported to QuikTest.\");\n    return;\n  }\n  try {\n    console.log(`reporting ${report}`);\n    const ciUrl = buildCiUrl(githubServerUrl, githubRepository, githubRunId);\n    const { readFileSync } = await import(\"node:fs\");\n    const body = readFileSync(report);\n    const url = `${resultsUrl}?ciUrl=${encodeURIComponent(ciUrl)}`;\n    const res = await fetch(url, {\n      method: \"POST\",\n      headers: { Authorization: `Bearer ${runToken}`, \"Content-Type\": \"text/xml\" },\n      body,\n    });\n    if (!res.ok) {\n      throw new Error(`QuikTest report POST failed: ${res.status} ${res.statusText}`);\n    }\n    rmSync(report, { force: true });\n  } catch (err) {\n    console.warn(`::warning::QuikPilot failed to report results to QuikTest: ${err instanceof Error ? err.message : String(err)}`);\n  }\n}\n", "interface TokenExchangeResponse {\n  success: boolean;\n  data: { runToken: string; expiresAt: string };\n}\n\n/** Exchange a GitHub OIDC ID token for a QuikPilot run token (QUIKTR-805) \u2014 mirrors `packet.ts`'s\n *  `fetchPacket` shape: bearer auth, `{success,data}` envelope, same error-message style. */\nexport async function exchangeForRunToken(tokenUrl: string, oidcToken: string): Promise<string> {\n  const res = await fetch(tokenUrl, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${oidcToken}` },\n  });\n  if (!res.ok) {\n    throw new Error(`Exchange run token failed: ${res.status} ${res.statusText}`);\n  }\n  const body = (await res.json()) as TokenExchangeResponse;\n  if (body.success !== true) {\n    throw new Error(\"Exchange run token failed: response did not carry success:true\");\n  }\n  return body.data.runToken;\n}\n", "import { reportBack } from \"./callback\";\nimport { runCommand, runTestCommand } from \"./commands\";\nimport { commitAndPush } from \"./commit\";\nimport { readRunnerEnv } from \"./env\";\nimport { checkGuardrail } from \"./guardrail\";\nimport { checkoutTargetBranch } from \"./git\";\nimport { exchangeForInstallationToken } from \"./installationToken\";\nimport { fetchGithubOidcToken } from \"./oidc\";\nimport { fetchPacket, type PilotPacket } from \"./packet\";\nimport { writePhase0Marker } from \"./phase0\";\nimport { reportToQuikTest } from \"./quiktest\";\nimport { exchangeForRunToken } from \"./tokenExchange\";\n\n/**\n * QUIKTR-572 \u2014 the run sequence, preserving the original inlined workflow's error semantics exactly:\n * Fetch packet / Checkout branch / Setup / Lint / Guardrail are hard failures that skip everything\n * remaining except the QuikTest report and the final callback (both ran under `if: always()`\n * before). Test alone is soft \u2014 its failure never blocks Guardrail/Commit/Push and never flips the\n * final callback to `failed` (QuikTest owns per-test outcomes; captured here only for the log).\n *\n * QUIKTR-805 \u2014 the very first thing the run does is exchange a GitHub OIDC ID token for a run\n * token (no QuikPilot credential exists before this). It is folded into the same top-level try as\n * every other hard failure, with one deliberate exception: if THIS step fails, there is no run\n * token to report failure with either, so reportToQuikTest/reportBack are skipped rather than\n * called with nothing to authenticate \u2014 the job's own log is the only record, and the run's\n * existing DISPATCHING-expiry sweep is what notices it (same accepted fallback dispatch.ts's own\n * docblock documents for its \"RESIDUAL WINDOW\" crash case).\n *\n * QUIKTR-804 \u2014 immediately before pushing, the run token (already in hand by this point) is\n * exchanged for a repo-scoped GitHub installation token, which authenticates the push itself\n * instead of the ambient `github.token`. Folded into the EXISTING Guardrail/Commit/Push try block\n * below rather than given its own \u2014 a failure here is just another commit/push hard failure, with\n * no new edge case: unlike the OIDC exchange above, the run token already exists, so\n * reportToQuikTest/reportBack fire normally either way.\n */\nexport async function run(env = readRunnerEnv()): Promise<{ hardFailure: boolean }> {\n  let hardFailure = false;\n  let packet: PilotPacket | undefined;\n  let branch: string | undefined;\n  let runToken: string | undefined;\n\n  try {\n    runToken = await exchangeForRunToken(env.tokenUrl, await fetchGithubOidcToken());\n    packet = await fetchPacket(env.packetUrl, runToken, env.githubRunId);\n    checkoutTargetBranch(packet.targetBranch);\n    writePhase0Marker(env.runId);\n    runCommand(packet.commands.setup, \"Setup\");\n    runCommand(packet.commands.lint, \"Lint\");\n    runTestCommand(packet.commands.test);\n  } catch (err) {\n    hardFailure = true;\n    console.error(err instanceof Error ? err.message : String(err));\n  }\n\n  if (!runToken) {\n    console.error(\"No run token \u2014 the OIDC exchange failed before QuikTrack could be reached.\");\n    return { hardFailure: true };\n  }\n\n  await reportToQuikTest({\n    resultsUrl: packet?.quikTest?.resultsUrl,\n    runToken,\n    githubServerUrl: env.githubServerUrl,\n    githubRepository: env.githubRepository,\n    githubRunId: env.githubRunId,\n  });\n\n  if (!hardFailure && packet) {\n    try {\n      checkGuardrail(packet.guardrails.deniedPaths);\n      const installationToken = await exchangeForInstallationToken(\n        env.installationTokenUrl,\n        runToken,\n      );\n      const result = commitAndPush(packet.branch, env.runId, installationToken);\n      branch = result.branch;\n    } catch (err) {\n      hardFailure = true;\n      console.error(err instanceof Error ? err.message : String(err));\n    }\n  }\n\n  await reportBack({\n    callbackUrl: env.callbackUrl,\n    runToken,\n    status: hardFailure ? \"failed\" : \"completed\",\n    branch,\n  });\n\n  return { hardFailure };\n}\n", "import { run } from \"./run\";\n\nrun()\n  .then(({ hardFailure }) => {\n    process.exitCode = hardFailure ? 1 : 0;\n  })\n  .catch((err) => {\n    // reportBack itself throwing is the one failure mode `run()` can't recover from internally \u2014\n    // still exit non-zero so the raw Actions UI shows the run as failed.\n    console.error(err instanceof Error ? err.message : String(err));\n    process.exitCode = 1;\n  });\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,eAAsB,WAAW,QAKf;AAChB,QAAM,EAAE,aAAa,UAAU,QAAQ,OAAO,IAAI;AAClD,QAAM,OAA+B,EAAE,OAAO;AAC9C,MAAI,OAAQ,MAAK,SAAS;AAC1B,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,QAAQ,IAAI,gBAAgB,mBAAmB;AAAA,IACnF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,IAAI,IAAI,UAAU,EAAE;AAAA,EACpF;AACF;;;ACtBA,gCAAyB;AAKlB,SAAS,WAAW,SAAwB,OAAqB;AACtE,MAAI,CAAC,QAAS;AACd,MAAI;AACF,4CAAS,SAAS,EAAE,OAAO,aAAa,OAAO,UAAU,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,UAAM,IAAI,MAAM,GAAG,KAAK,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACxF;AACF;AAOO,SAAS,eAAe,SAAqC;AAClE,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,4CAAS,SAAS,EAAE,OAAO,aAAa,OAAO,UAAU,CAAC;AAC1D,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC3BA,IAAAA,6BAA6B;AAM7B,SAAS,IAAI,MAAgB,WAA8B,CAAC,GAAW;AACrE,aAAO,yCAAa,OAAO,MAAM;AAAA,IAC/B,UAAU;AAAA,IACV,KAAK,EAAE,GAAG,QAAQ,KAAK,GAAG,SAAS;AAAA,EACrC,CAAC,EAAE,KAAK;AACV;AAEO,SAAS,gBAAwB;AACtC,SAAO,IAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AAClD;AAKO,SAAS,qBAAqB,cAAmC;AACtE,MAAI,CAAC,gBAAgB,iBAAiB,cAAc,EAAG;AACvD,MAAI,CAAC,SAAS,UAAU,YAAY,CAAC;AACrC,MAAI,CAAC,YAAY,YAAY,CAAC;AAChC;AAEO,SAAS,SAAe;AAC7B,MAAI,CAAC,OAAO,IAAI,CAAC;AACnB;AAIO,SAAS,wBAAwB,SAA2B;AACjE,QAAM,MAAM,IAAI,CAAC,QAAQ,YAAY,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC;AAC9E,SAAO,MAAM,IAAI,MAAM,IAAI,EAAE,OAAO,OAAO,IAAI,CAAC;AAClD;AAEO,SAAS,mBAA4B;AAC1C,MAAI;AACF,iDAAa,OAAO,CAAC,QAAQ,YAAY,SAAS,CAAC;AACnD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,0BAAgC;AAC9C,MAAI,CAAC,UAAU,aAAa,gBAAgB,CAAC;AAC7C,MAAI,CAAC,UAAU,cAAc,oCAAoC,CAAC;AACpE;AAEO,SAAS,kBAAkB,QAAsB;AACtD,MAAI,CAAC,YAAY,MAAM,MAAM,CAAC;AAChC;AAEO,SAAS,OAAO,SAAuB;AAC5C,MAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAC/B;AA2BA,SAAS,2BAAiC;AACxC,MAAI;AACF,QAAI,CAAC,UAAU,eAAe,sCAAsC,CAAC;AAAA,EACvE,SAAS,KAAc;AACrB,UAAM,SAAU,IAA4B;AAC5C,QAAI,WAAW,EAAG,OAAM;AAAA,EAC1B;AACF;AAEO,SAAS,KAAK,QAAgB,mBAAiC;AACpE,2BAAyB;AACzB,QAAM,YAAY,OAAO,KAAK,kBAAkB,iBAAiB,EAAE,EAAE,SAAS,QAAQ;AACtF,MAAI,CAAC,QAAQ,kBAAkB,UAAU,MAAM,GAAG;AAAA,IAChD,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,oBAAoB,wBAAwB,SAAS;AAAA,EACvD,CAAC;AACH;;;AClFO,SAAS,cACd,QACA,OACA,mBACc;AACd,MAAI,CAAC,iBAAiB,EAAG,QAAO,EAAE,SAAS,MAAM;AACjD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,0BAAwB;AACxB,oBAAkB,MAAM;AACxB,SAAO,mCAAmC,KAAK,GAAG;AAClD,OAAK,QAAQ,iBAAiB;AAC9B,SAAO,EAAE,SAAS,MAAM,OAAO;AACjC;;;ACbO,SAAS,SAAS,MAAc,OAAmC;AACxE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,0CAA0C,IAAI,EAAE;AAAA,EAClE;AACA,SAAO;AACT;AAEO,SAAS,cAAc,MAAyB,QAAQ,KAAgB;AAC7E,SAAO;AAAA,IACL,OAAO,SAAS,UAAU,IAAI,MAAM;AAAA,IACpC,aAAa,SAAS,gBAAgB,IAAI,YAAY;AAAA,IACtD,WAAW,SAAS,cAAc,IAAI,UAAU;AAAA,IAChD,UAAU,SAAS,aAAa,IAAI,SAAS;AAAA,IAC7C,sBAAsB,SAAS,0BAA0B,IAAI,sBAAsB;AAAA,IACnF,aAAa,SAAS,iBAAiB,IAAI,aAAa;AAAA,IACxD,iBAAiB,IAAI,qBAAqB;AAAA,IAC1C,kBAAkB,SAAS,qBAAqB,IAAI,iBAAiB;AAAA,EACvE;AACF;;;ACjCO,SAAS,eAAe,aAA6B;AAC1D,SAAO;AACP,QAAM,aAAa,YAAY,QAAQ,CAAC,YAAY,wBAAwB,OAAO,CAAC;AACpF,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,MAAM;AAAA,EAAoC,WAAW,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7E;AACF;;;ACHA,eAAsB,6BACpB,sBACA,UACiB;AACjB,QAAM,MAAM,MAAM,MAAM,sBAAsB;AAAA,IAC5C,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,QAAQ,GAAG;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,uCAAuC,IAAI,MAAM,IAAI,IAAI,UAAU,EAAE;AAAA,EACvF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,KAAK,YAAY,MAAM;AACzB,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,SAAO,KAAK,KAAK;AACnB;;;AClBA,IAAM,0BAA0B;AAUhC,eAAsB,qBACpB,MAAyB,QAAQ,KAChB;AACjB,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,IAAI;AAAA,EACN;AACA,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,IAAI;AAAA,EACN;AACA,QAAM,YAAY,WAAW,SAAS,GAAG,IAAI,MAAM;AACnD,QAAM,MAAM,GAAG,UAAU,GAAG,SAAS,YAAY,mBAAmB,uBAAuB,CAAC;AAC5F,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,SAAS,EAAE,eAAe,UAAU,YAAY,GAAG;AAAA,EACrD,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,IAAI,IAAI,UAAU,EAAE;AAAA,EACnF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,OAAO;AACf,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO,KAAK;AACd;;;ACVA,eAAsB,YACpB,WACA,UACA,aACsB;AACtB,QAAM,MAAM,GAAG,SAAS,gBAAgB,mBAAmB,WAAW,CAAC;AACvE,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,SAAS,EAAE,eAAe,UAAU,QAAQ,GAAG;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,6BAA6B,IAAI,MAAM,IAAI,IAAI,UAAU,EAAE;AAAA,EAC7E;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,KAAK,YAAY,MAAM;AACzB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,KAAK;AACd;;;AC/CA,qBAA0C;AAKnC,SAAS,kBAAkB,OAAqB;AACrD,gCAAU,cAAc,EAAE,WAAW,KAAK,CAAC;AAC3C,qCAAe,gCAAgC,6CAA6C,KAAK;AAAA,CAAI;AACvG;;;ACRA,IAAAC,kBAA8C;AAC9C,uBAAqB;AAErB,IAAM,YAAY,oBAAI,IAAI,CAAC,gBAAgB,MAAM,CAAC;AAElD,SAAS,mBAAmB,KAA4B;AACtD,MAAI;AACJ,MAAI;AACF,kBAAU,6BAAY,GAAG;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,IAAI,KAAK,EAAG;AAC1B,UAAM,WAAO,uBAAK,KAAK,KAAK;AAC5B,QAAI;AACJ,QAAI;AACF,iBAAO,0BAAS,IAAI;AAAA,IACtB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,QAAQ,mBAAmB,IAAI;AACrC,UAAI,MAAO,QAAO;AAAA,IACpB,WAAW,iBAAiB,KAAK,KAAK,GAAG;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,KAAa,aAAoC;AACnE,MAAI;AACJ,MAAI;AACF,kBAAU,6BAAY,GAAG;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC;AACrD,SAAO,YAAQ,uBAAK,KAAK,KAAK,IAAI;AACpC;AAOO,SAAS,gBAAgB,MAAM,QAAQ,IAAI,GAAkB;AAClE,SACE,mBAAmB,GAAG,KACtB,eAAW,uBAAK,KAAK,cAAc,GAAG,QAAQ,KAC9C,eAAW,uBAAK,KAAK,SAAS,GAAG,gBAAgB,KACjD,eAAW,uBAAK,KAAK,UAAU,kBAAkB,GAAG,QAAQ;AAEhE;AAEA,SAAS,WAAW,WAAmB,YAAoB,aAA6B;AACtF,SAAO,GAAG,SAAS,IAAI,UAAU,iBAAiB,WAAW;AAC/D;AAMA,eAAsB,iBAAiB,QAOrB;AAChB,QAAM,EAAE,YAAY,UAAU,iBAAiB,kBAAkB,aAAa,IAAI,IAAI;AACtF,MAAI,CAAC,YAAY;AACf,YAAQ,IAAI,6EAAwE;AACpF;AAAA,EACF;AACA,QAAM,SAAS,gBAAgB,GAAG;AAClC,MAAI,CAAC,QAAQ;AACX,YAAQ,KAAK,oFAA+E;AAC5F;AAAA,EACF;AACA,MAAI;AACF,YAAQ,IAAI,aAAa,MAAM,EAAE;AACjC,UAAM,QAAQ,WAAW,iBAAiB,kBAAkB,WAAW;AACvE,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,SAAS;AAC/C,UAAM,OAAO,aAAa,MAAM;AAChC,UAAM,MAAM,GAAG,UAAU,UAAU,mBAAmB,KAAK,CAAC;AAC5D,UAAM,MAAM,MAAM,MAAM,KAAK;AAAA,MAC3B,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,QAAQ,IAAI,gBAAgB,WAAW;AAAA,MAC3E;AAAA,IACF,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,gCAAgC,IAAI,MAAM,IAAI,IAAI,UAAU,EAAE;AAAA,IAChF;AACA,gCAAO,QAAQ,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC,SAAS,KAAK;AACZ,YAAQ,KAAK,8DAA8D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC/H;AACF;;;AC7FA,eAAsB,oBAAoB,UAAkB,WAAoC;AAC9F,QAAM,MAAM,MAAM,MAAM,UAAU;AAAA,IAChC,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,SAAS,GAAG;AAAA,EAClD,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,IAAI,IAAI,UAAU,EAAE;AAAA,EAC9E;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,KAAK,YAAY,MAAM;AACzB,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,SAAO,KAAK,KAAK;AACnB;;;ACeA,eAAsB,IAAI,MAAM,cAAc,GAAsC;AAClF,MAAI,cAAc;AAClB,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,eAAW,MAAM,oBAAoB,IAAI,UAAU,MAAM,qBAAqB,CAAC;AAC/E,aAAS,MAAM,YAAY,IAAI,WAAW,UAAU,IAAI,WAAW;AACnE,yBAAqB,OAAO,YAAY;AACxC,sBAAkB,IAAI,KAAK;AAC3B,eAAW,OAAO,SAAS,OAAO,OAAO;AACzC,eAAW,OAAO,SAAS,MAAM,MAAM;AACvC,mBAAe,OAAO,SAAS,IAAI;AAAA,EACrC,SAAS,KAAK;AACZ,kBAAc;AACd,YAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,EAChE;AAEA,MAAI,CAAC,UAAU;AACb,YAAQ,MAAM,iFAA4E;AAC1F,WAAO,EAAE,aAAa,KAAK;AAAA,EAC7B;AAEA,QAAM,iBAAiB;AAAA,IACrB,YAAY,QAAQ,UAAU;AAAA,IAC9B;AAAA,IACA,iBAAiB,IAAI;AAAA,IACrB,kBAAkB,IAAI;AAAA,IACtB,aAAa,IAAI;AAAA,EACnB,CAAC;AAED,MAAI,CAAC,eAAe,QAAQ;AAC1B,QAAI;AACF,qBAAe,OAAO,WAAW,WAAW;AAC5C,YAAM,oBAAoB,MAAM;AAAA,QAC9B,IAAI;AAAA,QACJ;AAAA,MACF;AACA,YAAM,SAAS,cAAc,OAAO,QAAQ,IAAI,OAAO,iBAAiB;AACxE,eAAS,OAAO;AAAA,IAClB,SAAS,KAAK;AACZ,oBAAc;AACd,cAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAChE;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,aAAa,IAAI;AAAA,IACjB;AAAA,IACA,QAAQ,cAAc,WAAW;AAAA,IACjC;AAAA,EACF,CAAC;AAED,SAAO,EAAE,YAAY;AACvB;;;ACxFA,IAAI,EACD,KAAK,CAAC,EAAE,YAAY,MAAM;AACzB,UAAQ,WAAW,cAAc,IAAI;AACvC,CAAC,EACA,MAAM,CAAC,QAAQ;AAGd,UAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,UAAQ,WAAW;AACrB,CAAC;",
+  "names": ["import_node_child_process", "import_node_fs"]
+}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@quikit/quikpilot-runner",
+  "version": "7.0.2",
+  "description": "QuikPilot's CI runner. Fetches the run's work packet, runs setup/lint/test, reports results to QuikTest, enforces path guardrails, commits and pushes, and reports back to QuikTrack. Published publicly (Q12): the workflow file that invokes it lives in the customer's own repository, so this package is how a fix ships without a new pull request into every onboarded repo.",
+  "bin": {
+    "quikpilot-runner": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.10",
+    "esbuild": "^0.28.1",
+    "typescript": "^5.3.3",
+    "vitest": "^4.1.4"
+  }
+}