@rallycry/conveyor-agent 10.13.56 → 10.13.58

package/dist/{boot-RW7SNO6X.js → boot-7OPX55AO.js}

@@ -9,14 +9,14 @@ import {
   readAgentVersion,
   redactToken,
   reportBootMilestone
-} from "./chunk-7765OQU5.js";
+} from "./chunk-QZN6HVUY.js";
 import {
   workbenchPort
 } from "./chunk-4VUQ2NPF.js";
 import {
   startWorkbenchServer
-} from "./chunk-DSP4KR4B.js";
-import "./chunk-UAGIXPYD.js";
+} from "./chunk-AXA55U4Z.js";
+import "./chunk-NAK6FY5U.js";
 import {
   DEFAULT_WORKBENCH_PORT
 } from "./chunk-JIGG755T.js";
@@ -1316,4 +1316,4 @@ export {
   runBoot,
   workbenchBootSteps
 };
-//# sourceMappingURL=boot-RW7SNO6X.js.map
+//# sourceMappingURL=boot-7OPX55AO.js.map

package/dist/{chunk-DSP4KR4B.js → chunk-AXA55U4Z.js}

@@ -1,7 +1,7 @@
 import {
   loadPtySpawn,
   terminateProcessGroup
-} from "./chunk-UAGIXPYD.js";
+} from "./chunk-NAK6FY5U.js";
 import {
   FrameReader,
   timingSafeTokenEqual,
@@ -296,4 +296,4 @@ async function runReaddir(socket, req) {
 export {
   startWorkbenchServer
 };
-//# sourceMappingURL=chunk-DSP4KR4B.js.map
+//# sourceMappingURL=chunk-AXA55U4Z.js.map

package/dist/{chunk-PG3Z6RIC.js → chunk-HYP7BK2B.js}

@@ -3,13 +3,11 @@ import {
   DEFAULT_RETRY_DELAY_MS,
   FETCH_TIMEOUT_MS,
   GIT_PREP_MAX_RETRIES,
-  gitCredentialHelper,
   mapChatHistory,
   readAgentVersion,
   registerBootMilestoneSocketFallback,
-  reportBootMilestone,
-  writeGitCredential
-} from "./chunk-7765OQU5.js";
+  reportBootMilestone
+} from "./chunk-QZN6HVUY.js";
 import {
   LoopLagMonitor,
   buildConveyorSocketOptions,
@@ -32,6 +30,9 @@ import {
   buildPromptBytes,
   buildSpawnArgs,
   cleanTerminalOutput,
+  ghHostsExternallyOwned,
+  gitCredentialHelper,
+  githubTokenFilePath,
   inheritedEnv,
   killPtyWithEscalation,
   needsRawReadyGate,
@@ -49,9 +50,11 @@ import {
   sessionTempBase,
   sleep,
   spawnOptionsFingerprint,
+  syncGithubTokenFiles,
   transcriptSize,
-  turnOptionsFrom
-} from "./chunk-UAGIXPYD.js";
+  turnOptionsFrom,
+  writeGitCredential
+} from "./chunk-NAK6FY5U.js";
 
 // src/setup/bootstrap.ts
 var BOOTSTRAP_TIMEOUT_MS = 3e4;
@@ -1159,6 +1162,8 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
     if (!result.ok) return { refreshedClaude: false, refreshedTaskToken: false };
     const previousTaskToken = process.env.CONVEYOR_TASK_TOKEN;
     applyBootstrapToEnv(result.config);
+    const env = result.config.envVars ?? {};
+    syncGithubTokenFiles(env.CONVEYOR_GITHUB_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN);
     const refreshedTaskToken = result.config.mode !== "project" && Boolean(result.config.taskToken) && result.config.taskToken !== previousTaskToken;
     if (refreshedTaskToken && result.config.taskToken) {
       this.config.taskToken = result.config.taskToken;
@@ -1188,7 +1193,10 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
     for (const [key, value] of Object.entries(bundle.envVars ?? {})) {
       process.env[key] = value;
     }
-    if (bundle.githubToken) process.env.CONVEYOR_GITHUB_TOKEN = bundle.githubToken;
+    if (bundle.githubToken) {
+      process.env.CONVEYOR_GITHUB_TOKEN = bundle.githubToken;
+      syncGithubTokenFiles(bundle.githubToken);
+    }
     if (bundle.anthropicKey) process.env.ANTHROPIC_API_KEY = bundle.anthropicKey;
     if (bundle.gcpToken) process.env.CLOUDSDK_AUTH_ACCESS_TOKEN = bundle.gcpToken;
     const refreshedTaskToken = Boolean(bundle.sessionJwt) && bundle.sessionJwt !== previousTaskToken;
@@ -1456,23 +1464,43 @@ async function isAuthError(cwd) {
     return errLooksLikeAuth(err);
   }
 }
+function credentialErrorText(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return raw.replace(/\/\/[^@\s]+@/g, "//***@");
+}
 async function updateRemoteCredential(cwd, credential) {
+  const result = { ok: false, storeWritten: false, helperConfigured: false };
   try {
     const currentUrl = await git(cwd, ["remote", "get-url", "origin"]);
     const cloneUrl = credential.cloneUrl ?? currentUrl;
-    writeGitCredential(cwd, cloneUrl, credential);
-    if (currentUrl !== cloneUrl) {
-      await git(cwd, ["remote", "set-url", "origin", cloneUrl]);
+    const normalizedUrl = writeGitCredential(cwd, cloneUrl, credential);
+    result.storeWritten = true;
+    if (currentUrl !== normalizedUrl) {
+      await git(cwd, ["remote", "set-url", "origin", normalizedUrl]);
     }
     await git(cwd, ["config", "--local", "credential.helper", gitCredentialHelper(cwd)]);
-  } catch {
+    result.helperConfigured = true;
+    result.ok = true;
+  } catch (err) {
+    result.error = credentialErrorText(err);
   }
+  return result;
 }
 async function updateRemoteToken(cwd, token) {
   const username = process.env.CONVEYOR_GIT_USERNAME || "x-access-token";
   const cloneUrl = process.env.CONVEYOR_GIT_CLONE_URL || void 0;
-  await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
+  const credential = await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
   process.env.CONVEYOR_GIT_SECRET = token;
+  const files = syncGithubTokenFiles(token);
+  return { credential, files };
+}
+async function verifyGitCredential(cwd) {
+  try {
+    await git(cwd, ["ls-remote", "--heads", "origin"], 3e4);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: credentialErrorText(err) };
+  }
 }
 function wipRefForBranch(branch) {
   return `conveyor-wip/${branch}`;
@@ -2625,6 +2653,20 @@ var GetProjectTagRequestSchema = z5.object({
   /** Tag id or exact (case-insensitive) tag name. */
   tag: z5.string().min(1).max(100)
 });
+var ListProjectTagAttachmentsRequestSchema = z5.object({
+  projectId: z5.string(),
+  /** Tag id or exact (case-insensitive) tag name. */
+  tag: z5.string().min(1).max(100),
+  limit: z5.number().int().min(1).max(60).optional(),
+  offset: z5.number().int().min(0).optional()
+});
+var SetProjectFileTagsRequestSchema = z5.object({
+  projectId: z5.string(),
+  taskId: z5.string(),
+  fileId: z5.string(),
+  tags: z5.array(z5.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS),
+  requestingUserId: z5.string().optional()
+});
 var GetProjectSummaryRequestSchema = z5.object({
   projectId: z5.string()
 });
@@ -9936,11 +9978,11 @@ var readTaskChatContract = defineToolContract({
 var listTagsContract = defineToolContract({
   name: "list_tags",
   agent: {
-    description: "List the project glossary: every tag's id, name, color, description, parent/child tag ids, its contextPaths (the rule/doc/file/folder links it wires into agent context \u2014 `[]` means none), and whether it carries a full overview (fetch that with get_tag). The context links ship inline, so you only need get_tag for a term's full overview. Use the ids with get_tag / update_tag.",
+    description: "List the project glossary: every tag's id, name, color, description, parent/child tag ids, its contextPaths (the rule/doc/file/folder links it wires into agent context \u2014 `[]` means none), whether it carries a full overview (fetch that with get_tag), and its attachmentCount (files labelled as examples of the term). The context links ship inline, so you only need get_tag for a term's full overview. Use the ids with get_tag / update_tag.",
     fields: {}
   },
   mcp: {
-    description: "List all project tags with names, IDs, colors, descriptions, hierarchy (parent/child ids), contextPaths (the rule/doc/file/folder links each tag wires into agent context \u2014 `[]` means none), and a hasOverview flag. Context links ship inline; call get_tag only for a term's full overview. Pass projectId to target a specific project; otherwise the configured default project is used.",
+    description: "List all project tags with names, IDs, colors, descriptions, hierarchy (parent/child ids), contextPaths (the rule/doc/file/folder links each tag wires into agent context \u2014 `[]` means none), a hasOverview flag, and an attachmentCount (files labelled as examples of the term \u2014 read the tiles with list_tag_attachments). Context links ship inline; call get_tag only for a term's full overview. Pass projectId to target a specific project; otherwise the configured default project is used.",
     fields: {
       projectId: mcpProjectId
     }
@@ -10047,13 +10089,13 @@ var tagRef = f.string({
 var getTagContract = defineToolContract({
   name: "get_tag",
   agent: {
-    description: "Read one tag's full glossary entry: description, the full markdown overview (the term's spec \u2014 philosophy, mechanics, invariants), linked files/rules (each with its verified-link status \u2014 ok/stale/unchecked \u2014 from the periodic repo check), parent/child tags, active-card count, and recent revisions with their reasons. Call this whenever a chat message, plan, or tag list points at a term you need the full context for. A response with `overviewPath` set means the overview is sourced from that repo file \u2014 prefer Reading the path from your checkout (branch-correct); the served overview is the base-branch materialization (`overviewSource.state`: ok/pending/stale).",
+    description: "Read one tag's full glossary entry: description, the full markdown overview (the term's spec \u2014 philosophy, mechanics, invariants), linked files/rules (each with its verified-link status \u2014 ok/stale/unchecked \u2014 from the periodic repo check), parent/child tags, active-card count, attachment count (files labelled as examples of the term), and recent revisions with their reasons. Call this whenever a chat message, plan, or tag list points at a term you need the full context for. A response with `overviewPath` set means the overview is sourced from that repo file \u2014 prefer Reading the path from your checkout (branch-correct); the served overview is the base-branch materialization (`overviewSource.state`: ok/pending/stale).",
     fields: {
       tag: tagRef
     }
   },
   mcp: {
-    description: "Read one tag's full glossary entry \u2014 description, markdown overview, context links (each with its verified-link status: ok/stale/unchecked plus last-checked provenance), parent/child tags, active-card count, and recent revisions with provenance. A response with `overviewPath` set means the overview is sourced from that repo file at the base branch (`overviewSource.state`: ok/pending/stale) \u2014 clients with a checkout can read the path directly for the branch-correct copy. Pass projectId to target a specific project; otherwise the configured default project is used.",
+    description: "Read one tag's full glossary entry \u2014 description, markdown overview, context links (each with its verified-link status: ok/stale/unchecked plus last-checked provenance), parent/child tags, active-card count, attachment count (files labelled as examples of the term \u2014 read the tiles with list_tag_attachments), and recent revisions with provenance. A response with `overviewPath` set means the overview is sourced from that repo file at the base branch (`overviewSource.state`: ok/pending/stale) \u2014 clients with a checkout can read the path directly for the branch-correct copy. Pass projectId to target a specific project; otherwise the configured default project is used.",
     fields: {
       projectId: mcpProjectId,
       tag: tagRef
@@ -11137,10 +11179,75 @@ function buildVoteSuggestionTool(connection) {
     }
   );
 }
+function buildRefreshGithubTokenTool(connection, config) {
+  return defineTool(
+    "refresh_github_token",
+    "Mint a fresh GitHub token for this pod when git or gh fails with a 401 / 'Bad credentials'. The pod's token expires about every hour. This updates the git credential store and the gh CLI config, and returns the shell command that puts a current token in your environment.",
+    {},
+    async () => {
+      try {
+        const result = await connection.call("refreshGithubToken", {
+          sessionId: connection.sessionId
+        });
+        const written = await updateRemoteToken(config.workspaceDir, result.token);
+        process.env.GITHUB_TOKEN = result.token;
+        process.env.GH_TOKEN = result.token;
+        const tokenFile = githubTokenFilePath();
+        const failures = [];
+        if (!written.credential.storeWritten) {
+          failures.push(
+            `- git credential store NOT written${written.credential.error ? `: ${written.credential.error}` : ""}`
+          );
+        } else if (!written.credential.helperConfigured) {
+          failures.push(
+            `- git credential helper NOT configured${written.credential.error ? `: ${written.credential.error}` : ""}`
+          );
+        }
+        if (!written.files.tokenFile) failures.push(`- token file ${tokenFile} NOT written`);
+        if (!written.files.ghHosts && !ghHostsExternallyOwned()) {
+          failures.push("- gh CLI config NOT written");
+        }
+        const probe = await verifyGitCredential(config.workspaceDir);
+        if (!probe.ok) {
+          failures.push(
+            `- git could not authenticate to origin: ${probe.error ?? "unknown error"}`
+          );
+        }
+        if (failures.length > 0) {
+          return textResult(
+            [
+              probe.ok ? "GitHub token refreshed, but some credential copies did not update." : "GitHub token refresh did NOT produce a working git credential.",
+              ...failures,
+              `A current token is available at ${tokenFile} when that file was written.`,
+              "Do not retry this tool more than once. Report the failing lines above to the team \u2014 the GitHub App install may be missing for this project, or the pod's credential directory may not be writable."
+            ].join("\n")
+          );
+        }
+        return textResult(
+          [
+            "GitHub token refreshed and verified against origin.",
+            "- git: the credential store and helper are updated, so `git push` works now with no extra step.",
+            "- gh: the CLI config is updated, so `gh` works now with no extra step.",
+            `- shell/scripts: read the current token from ${tokenFile}.`,
+            `  For a command that needs it in the environment: GITHUB_TOKEN=$(cat ${tokenFile}) <command>`,
+            "Retry the failed command."
+          ].join("\n")
+        );
+      } catch (error) {
+        return textResult(
+          `Failed to refresh the GitHub token: ${error instanceof Error ? error.message : "Unknown error"}
+
+The agent's connection to the API may be down. Wait for it to reconnect and try again.`
+        );
+      }
+    }
+  );
+}
 function buildMutationTools(connection, config) {
   return [
     buildPostToChatTool(connection),
     buildCreatePullRequestTool(connection, config),
+    buildRefreshGithubTokenTool(connection, config),
     buildAddDependencyTool(connection),
     buildRemoveDependencyTool(connection),
     buildCreateFollowUpTaskTool(connection),
@@ -16091,10 +16198,17 @@ var SessionRunner = class _SessionRunner {
       const res = await this.connection.call("refreshGithubToken", {
         sessionId: this.connection.sessionId
       });
-      await updateRemoteToken(this.config.workspaceDir, res.token);
+      const written = await updateRemoteToken(this.config.workspaceDir, res.token);
       process.env.GITHUB_TOKEN = res.token;
       process.env.GH_TOKEN = res.token;
-      process.stderr.write("[conveyor-agent] Proactively refreshed GitHub token\n");
+      if (written.credential.ok) {
+        process.stderr.write("[conveyor-agent] Proactively refreshed GitHub token\n");
+      } else {
+        process.stderr.write(
+          `[conveyor-agent] Warning: refreshed GitHub token but the git credential did not update: ${written.credential.error ?? "unknown error"}
+`
+        );
+      }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`[conveyor-agent] Warning: proactive token refresh failed: ${msg}
@@ -16308,4 +16422,4 @@ export {
   loadConveyorConfig,
   unshallowRepo
 };
-//# sourceMappingURL=chunk-PG3Z6RIC.js.map
+//# sourceMappingURL=chunk-HYP7BK2B.js.map