@rallycry/conveyor-agent 10.13.59 → 10.13.61

package/dist/{chunk-JCRP6K6T.js → chunk-LXSQ3AQN.js}

@@ -3535,6 +3535,12 @@ var CATALOG = {
       command: FIREBASE_EMULATOR_COMMAND,
       environment: FIREBASE_EMULATOR_ENV,
       healthcheck: {
+        // Probe with node, the one runtime this image guarantees. The image
+        // (`andreysenov/firebase-tools`) is a slim Node image that ships
+        // NEITHER `wget` NOR `curl`, so the `wget -qO- …` probe this replaced
+        // exited 127 on every attempt: a healthy emulator burned all 20 retries
+        // and every bake reported it unhealthy. See the catalog invariant in
+        // `service-definitions.test.ts`, which also executes this probe.
         test: [
           "CMD-SHELL",
           `node -e "fetch('http://localhost:9099/').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"`
@@ -3910,7 +3916,7 @@ var ClaudeCodeHarness = class {
 // src/harness/pty/session.ts
 import { randomUUID } from "crypto";
 import { mkdtemp, mkdir as mkdir3, rm as rm2, writeFile as writeFile5 } from "fs/promises";
-import { join as join5, dirname } from "path";
+import { join as join6, dirname } from "path";
 
 // src/harness/opencode/plugin.ts
 import { writeFile } from "fs/promises";
@@ -5358,15 +5364,68 @@ async function startToolServers(mcpServers, tempDir) {
 // src/harness/pty/credentials.ts
 import { chmod as chmod2, mkdir as mkdir2, readFile, rm, writeFile as writeFile4 } from "fs/promises";
 import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+
+// src/harness/pty/credentials-marker.ts
+import { createHash } from "crypto";
 import { join as join4 } from "path";
+function conveyorCredentialsMarkerPath() {
+  return join4(claudeConfigHome(), ".conveyor-credentials.json");
+}
+function tokenFingerprint(accessToken) {
+  return createHash("sha256").update(accessToken).digest("hex");
+}
+function buildCredentialsMarker(accessToken, now, previousHash) {
+  const accessTokenSha256 = tokenFingerprint(accessToken);
+  return JSON.stringify({
+    accessTokenSha256,
+    ...previousHash && previousHash !== accessTokenSha256 ? { previousAccessTokenSha256: previousHash } : {},
+    writtenAt: now
+  });
+}
+function parseCredentialsMarker(raw) {
+  if (!raw || raw.trim() === "") return [];
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return [];
+    const record = parsed;
+    return [record.accessTokenSha256, record.previousAccessTokenSha256].filter(
+      (hash) => typeof hash === "string" && hash.length > 0
+    );
+  } catch {
+    return [];
+  }
+}
+
+// src/harness/pty/credentials.ts
 var SYNTH_TOKEN_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
 var REFRESH_SKEW_MS = 30 * 24 * 60 * 60 * 1e3;
 function claudeCredentialsPath() {
-  return join4(claudeConfigHome(), ".credentials.json");
+  return join5(claudeConfigHome(), ".credentials.json");
 }
 function isConveyorCloudEnv(env = process.env) {
   return Boolean(env.CLAUDESPACE_NAME || env.CODESPACE_NAME || env.CODESPACES);
 }
+function parseClaudeOauthEnv(blob) {
+  if (!blob) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(blob, "base64").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const record = parsed;
+    if (typeof record.access !== "string" || record.access === "") return null;
+    const scopes = Array.isArray(record.scopes) ? record.scopes.filter((s) => typeof s === "string" && s.length > 0) : [];
+    return {
+      access: record.access,
+      refresh: typeof record.refresh === "string" && record.refresh ? record.refresh : void 0,
+      expires: typeof record.expires === "number" ? record.expires : void 0,
+      refreshExpires: typeof record.refreshExpires === "number" ? record.refreshExpires : void 0,
+      scopes: scopes.length > 0 ? scopes : void 0,
+      rateLimitTier: typeof record.rateLimitTier === "string" ? record.rateLimitTier : void 0
+    };
+  } catch {
+    return null;
+  }
+}
 function parseClaudeAiOauth(raw) {
   if (!raw || raw.trim() === "") return null;
   try {
@@ -5384,28 +5443,51 @@ function parseClaudeAiOauth(raw) {
     return null;
   }
 }
-function buildSynthesizedCredentials(token, now) {
+var LEGACY_SCOPES = ["user:inference", "user:profile"];
+function buildCredentialsFile(material, now) {
+  const refresh = material.refresh;
   return JSON.stringify({
     claudeAiOauth: {
-      accessToken: token,
-      expiresAt: now + SYNTH_TOKEN_TTL_MS,
-      scopes: ["user:inference", "user:profile"],
+      accessToken: material.access,
+      ...refresh ? { refreshToken: refresh } : {},
+      // With a refresh token the CLI can recover from a real expiry, so report
+      // the true one. Without, claim a far-future expiry (see SYNTH_TOKEN_TTL_MS)
+      // because a refresh attempt would be unrecoverable.
+      expiresAt: refresh && material.expires ? material.expires : now + SYNTH_TOKEN_TTL_MS,
+      // The refresh token has its own expiry; the CLI records it, so mirror it
+      // when the grant told us rather than leaving the field off.
+      ...material.refreshExpires ? { refreshTokenExpiresAt: material.refreshExpires } : {},
+      scopes: material.scopes?.length ? material.scopes : LEGACY_SCOPES,
+      ...material.rateLimitTier ? { rateLimitTier: material.rateLimitTier } : {},
       subscriptionType: "max"
     }
   });
 }
+function buildSynthesizedCredentials(token, now) {
+  return buildCredentialsFile({ access: token }, now);
+}
+function isConveyorOwnedCredentials(existing, markerHashes) {
+  const hasRefresh = typeof existing.refreshToken === "string" && existing.refreshToken.length > 0;
+  if (!hasRefresh) return true;
+  if (markerHashes.length === 0) return false;
+  if (typeof existing.accessToken !== "string") return false;
+  return markerHashes.includes(tokenFingerprint(existing.accessToken));
+}
 function planCredentialsWrite(input) {
   if (!input.isCloud) return { action: "skip", reason: "not-cloud" };
-  if (!input.token) return { action: "skip", reason: "no-token" };
-  const contents = buildSynthesizedCredentials(input.token, input.now);
+  const material = parseClaudeOauthEnv(input.oauthBlob) ?? (input.token ? { access: input.token } : null);
+  if (!material) return { action: "skip", reason: "no-token" };
+  const markerHashes = parseCredentialsMarker(input.markerRaw ?? null);
+  const contents = buildCredentialsFile(material, input.now);
+  const marker = buildCredentialsMarker(material.access, input.now, markerHashes[0] ?? null);
   const existing = parseClaudeAiOauth(input.existingRaw);
-  if (!existing) return { action: "write", contents };
-  if (typeof existing.refreshToken === "string" && existing.refreshToken.length > 0) {
+  if (!existing) return { action: "write", contents, marker };
+  if (!isConveyorOwnedCredentials(existing, markerHashes)) {
     return { action: "skip", reason: "foreign-credentials" };
   }
-  const fresh = existing.accessToken === input.token && typeof existing.expiresAt === "number" && existing.expiresAt > input.now + REFRESH_SKEW_MS;
+  const fresh = material.refresh ? existing.accessToken === material.access : existing.accessToken === material.access && typeof existing.expiresAt === "number" && existing.expiresAt > input.now + REFRESH_SKEW_MS;
   if (fresh) return { action: "skip", reason: "current" };
-  return { action: "write", contents };
+  return { action: "write", contents, marker };
 }
 async function readRaw(path2) {
   try {
@@ -5460,19 +5542,25 @@ function fsWriteIo(path2, mode) {
 async function ensureClaudeCredentials(env = process.env) {
   const isCloud = isConveyorCloudEnv(env);
   const token = env.CLAUDE_CODE_OAUTH_TOKEN;
-  if (isCloud && token) {
-    await sanitizeApprovedApiKeys(token);
+  const material = parseClaudeOauthEnv(env.CONVEYOR_CLAUDE_OAUTH);
+  const accessToken = material?.access ?? token;
+  if (isCloud && accessToken) {
+    await sanitizeApprovedApiKeys(accessToken);
   }
   try {
     const path2 = claudeCredentialsPath();
+    const markerPath = conveyorCredentialsMarkerPath();
     const plan = planCredentialsWrite({
       isCloud,
       token,
+      oauthBlob: env.CONVEYOR_CLAUDE_OAUTH,
       existingRaw: await readRaw(path2),
+      markerRaw: await readRaw(markerPath),
       now: Date.now()
     });
     if (plan.action === "skip") return;
     await mkdir2(claudeConfigHome(), { recursive: true });
+    await writeWithReadBackRetry(fsWriteIo(markerPath, 384), plan.marker);
     const verified = await writeWithReadBackRetry(fsWriteIo(path2, 384), plan.contents);
     if (!verified) {
       process.stderr.write(
@@ -5525,7 +5613,7 @@ async function sanitizeApprovedApiKeys(oauthToken) {
 }
 function claudeJsonPath() {
   const configDir = process.env.CLAUDE_CONFIG_DIR;
-  return configDir ? join4(configDir, ".claude.json") : join4(homedir2(), ".claude.json");
+  return configDir ? join5(configDir, ".claude.json") : join5(homedir2(), ".claude.json");
 }
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
@@ -5618,7 +5706,7 @@ function planClaudeJsonSeed(existingRaw, trustCwd, oauthIdentity) {
   return changed ? JSON.stringify(config) : null;
 }
 function conveyorOauthMarkerPath() {
-  return join4(claudeConfigHome(), "conveyor-oauth-account.json");
+  return join5(claudeConfigHome(), "conveyor-oauth-account.json");
 }
 function parseOauthIdentity(raw) {
   if (!raw || raw.trim() === "") return null;
@@ -5683,11 +5771,13 @@ async function removeConveyorCredentials(env = process.env) {
   try {
     if (!isConveyorCloudEnv(env)) return;
     const path2 = claudeCredentialsPath();
+    const markerPath = conveyorCredentialsMarkerPath();
     const existing = parseClaudeAiOauth(await readRaw(path2));
-    if (existing && typeof existing.refreshToken === "string" && existing.refreshToken.length > 0) {
+    if (existing && !isConveyorOwnedCredentials(existing, parseCredentialsMarker(await readRaw(markerPath)))) {
       return;
     }
     await rm(path2, { force: true });
+    await rm(markerPath, { force: true });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     process.stderr.write(`[conveyor-agent] claude credentials removal failed: ${message}
@@ -6073,7 +6163,7 @@ var PtySession = class {
         const { settingsPath, socketPath } = await this.startStructuredEventSources(sessionId);
         await this.spawn(settingsPath, socketPath);
       } else {
-        this.tempDir = await mkdtemp(join5(sessionTempBase(), "conveyor-pty-"));
+        this.tempDir = await mkdtemp(join6(sessionTempBase(), "conveyor-pty-"));
         await this.spawn();
         this.pushEvent({
           type: "system",
@@ -6118,7 +6208,7 @@ var PtySession = class {
    * moment it is known, which is how the runner learns the resume target.
    */
   async startOpenCodeEventSources() {
-    this.tempDir = await mkdtemp(join5(sessionTempBase(), "conveyor-pty-"));
+    this.tempDir = await mkdtemp(join6(sessionTempBase(), "conveyor-pty-"));
     const { servers, entries } = await startToolServers(
       this.options.mcpServers ?? {},
       this.tempDir
@@ -6128,7 +6218,7 @@ var PtySession = class {
     let instructionsPath;
     const systemPrompt = this.options.appendSystemPrompt;
     if (systemPrompt && systemPrompt.trim() !== "") {
-      instructionsPath = join5(this.tempDir, "conveyor-instructions.md");
+      instructionsPath = join6(this.tempDir, "conveyor-instructions.md");
       await writeFile5(instructionsPath, systemPrompt, "utf8");
     }
     this.opencodeSource = new OpenCodeEventSource(
@@ -6167,8 +6257,8 @@ var PtySession = class {
    * paths spawn() must wire into the child's argv/env.
    */
   async startStructuredEventSources(sessionId) {
-    this.tempDir = await mkdtemp(join5(sessionTempBase(), "conveyor-pty-"));
-    const socketPath = join5(this.tempDir, "hook.sock");
+    this.tempDir = await mkdtemp(join6(sessionTempBase(), "conveyor-pty-"));
+    const socketPath = join6(this.tempDir, "hook.sock");
     this.socket = new HookSocketServer(
       socketPath,
       (progress) => this.handleProgress(progress),
@@ -6757,7 +6847,7 @@ var PtySession = class {
 // src/harness/pty/config-home-health.ts
 import { lstat, mkdir as mkdir4, symlink, unlink as unlink2 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var MOUNT_DISCONNECT_CODES = /* @__PURE__ */ new Set(["ENOTCONN", "EIO", "ESTALE", "ENXIO"]);
 var MOUNT_DISCONNECT_MESSAGES = [
   "socket is not connected",
@@ -6773,10 +6863,10 @@ function isMountDisconnectError(err) {
   return MOUNT_DISCONNECT_MESSAGES.some((needle) => lower.includes(needle));
 }
 function podLocalConfigHome() {
-  return join6(homedir3(), ".claude-local");
+  return join7(homedir3(), ".claude-local");
 }
 function sharedConfigHomePath() {
-  return join6(homedir3(), ".claude");
+  return join7(homedir3(), ".claude");
 }
 function isConfigHomeFallbackActive() {
   return claudeConfigHome() === podLocalConfigHome();
@@ -6807,7 +6897,7 @@ async function repointSharedConfigHomeSymlink(fallback, log) {
 }
 async function isConfigHomeMountDead(cwd) {
   try {
-    await mkdir4(join6(claudeConfigHome(), "projects", projectSlug(cwd)), { recursive: true });
+    await mkdir4(join7(claudeConfigHome(), "projects", projectSlug(cwd)), { recursive: true });
     return false;
   } catch (err) {
     return isMountDisconnectError(err);
@@ -6816,7 +6906,7 @@ async function isConfigHomeMountDead(cwd) {
 async function ensureUsableClaudeConfigHome(cwd, log) {
   const configHome = claudeConfigHome();
   try {
-    await mkdir4(join6(configHome, "projects", projectSlug(cwd)), { recursive: true });
+    await mkdir4(join7(configHome, "projects", projectSlug(cwd)), { recursive: true });
     return { configHome, fellBack: false };
   } catch (err) {
     if (!isMountDisconnectError(err)) throw err;
@@ -6830,7 +6920,7 @@ async function ensureUsableClaudeConfigHome(cwd, log) {
       }
     );
     process.env.CLAUDE_CONFIG_DIR = fallback;
-    await mkdir4(join6(fallback, "projects", projectSlug(cwd)), { recursive: true });
+    await mkdir4(join7(fallback, "projects", projectSlug(cwd)), { recursive: true });
     await repointSharedConfigHomeSymlink(fallback, log);
     return { configHome: fallback, fellBack: true };
   }
@@ -7186,7 +7276,7 @@ import { spawn } from "child_process";
 
 // src/harness/pty/adapters/types.ts
 import { accessSync, constants, statSync } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var TuiUnavailableError = class extends Error {
   constructor(tui, message) {
     super(message);
@@ -7210,7 +7300,7 @@ function findOnPath(binary, env = process.env) {
   }
   for (const dir of (env.PATH ?? "").split(":")) {
     if (!dir) continue;
-    const candidate = join7(dir, binary);
+    const candidate = join8(dir, binary);
     if (isExecutable(candidate)) return candidate;
   }
   return null;
@@ -7218,18 +7308,18 @@ function findOnPath(binary, env = process.env) {
 
 // src/harness/pty/adapters/opencode-auth.ts
 import { promises as fs } from "fs";
-import { dirname as dirname2, join as join8 } from "path";
+import { dirname as dirname2, join as join9 } from "path";
 import { homedir as homedir4 } from "os";
 var logger = createServiceLogger("opencode-auth");
 var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
 var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
 function opencodeAuthPath(env) {
-  const dataHome = env.XDG_DATA_HOME ?? join8(env.HOME ?? homedir4(), ".local", "share");
-  return join8(dataHome, "opencode", "auth.json");
+  const dataHome = env.XDG_DATA_HOME ?? join9(env.HOME ?? homedir4(), ".local", "share");
+  return join9(dataHome, "opencode", "auth.json");
 }
 function opencodeConfigPath(env) {
-  const configHome = env.XDG_CONFIG_HOME ?? join8(env.HOME ?? homedir4(), ".config");
-  return join8(configHome, "opencode", "opencode.json");
+  const configHome = env.XDG_CONFIG_HOME ?? join9(env.HOME ?? homedir4(), ".config");
+  return join9(configHome, "opencode", "opencode.json");
 }
 function parseOauthSeed(b64) {
   if (!b64) return null;
@@ -7407,7 +7497,7 @@ function buildOpenCodeConfigContent(input) {
 
 // src/harness/opencode/index.ts
 import { mkdtemp as mkdtemp2, rm as rm3, writeFile as writeFile6 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var MAX_STDERR_TAIL = 4e3;
 var OpenCodeHeadlessHarness = class {
   /** NDJSON from `--format json` is a trusted structured source. */
@@ -7429,7 +7519,7 @@ var OpenCodeHeadlessHarness = class {
     const prompt = await collectPrompt(opts.prompt);
     const binary = resolveOpenCodeBinary(process.env);
     await prepareOpenCodeCredentials(process.env);
-    this.tempDir = await mkdtemp2(join9(sessionTempBase(), "opencode-headless-"));
+    this.tempDir = await mkdtemp2(join10(sessionTempBase(), "opencode-headless-"));
     const { servers, entries } = await startToolServers(
       opts.options.mcpServers ?? {},
       this.tempDir
@@ -7511,7 +7601,7 @@ var OpenCodeHeadlessHarness = class {
    */
   async writeSystemPrompt(text) {
     if (!text || text.trim() === "") return null;
-    const path2 = join9(this.tempDir, "conveyor-instructions.md");
+    const path2 = join10(this.tempDir, "conveyor-instructions.md");
     await writeFile6(path2, text, "utf8");
     return path2;
   }
@@ -7975,7 +8065,7 @@ function wrapBridgeWithDirectStream(inner, reporter, options = {}) {
 }
 
 // src/execution/query-executor.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync2, readFileSync as readFileSync2, truncateSync } from "fs";
 
 // src/execution/chat-instructions.ts
@@ -11271,7 +11361,7 @@ function buildMutationTools(connection, config) {
 }
 
 // src/tools/attachment-tools.ts
-import { basename, extname, isAbsolute, join as join10 } from "path";
+import { basename, extname, isAbsolute, join as join11 } from "path";
 var MIME_BY_EXT = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -11322,7 +11412,7 @@ ${snippet}`;
 function buildUploadAttachmentTool(connection, config) {
   return defineContractTool(uploadAttachmentContract, async ({ path: path2, title, tags }) => {
     try {
-      const filePath = isAbsolute(path2) ? path2 : join10(config.workspaceDir, path2);
+      const filePath = isAbsolute(path2) ? path2 : join11(config.workspaceDir, path2);
       const mimeType = inferMimeType(filePath);
       const info = await statWorkspacePath(filePath);
       if (!info.isFile) {
@@ -11834,7 +11924,7 @@ import { z as z16 } from "zod";
 
 // src/execution/context-path-verifier.ts
 import { readFile as readFile2 } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join11, normalize } from "path";
+import { isAbsolute as isAbsolute2, join as join12, normalize } from "path";
 var PROBLEM_TEXT = {
   not_found: "does not exist in the repo",
   expected_folder: "is a file, not a folder \u2014 use type 'file', 'rule', or 'doc'",
@@ -11879,7 +11969,7 @@ async function verifyContextPaths(links, workspaceDir) {
       problems.push({ type: link.type, path: link.path, reason: shape });
       continue;
     }
-    const absolutePath = join11(workspaceDir, toRelativePath(link.path));
+    const absolutePath = join12(workspaceDir, toRelativePath(link.path));
     const stat = await statWorkspacePath(absolutePath);
     const wantsDirectory = expectsDirectory(link.type);
     if (!stat.exists) {
@@ -13008,6 +13098,7 @@ function applyCycledKeyEnv(envVars, env = process.env) {
   for (const [key, value] of Object.entries(envVars)) {
     env[key] = value;
   }
+  if (!envVars.CONVEYOR_CLAUDE_OAUTH) delete env.CONVEYOR_CLAUDE_OAUTH;
   if (envVars.CLAUDE_CODE_OAUTH_TOKEN) {
     delete env.ANTHROPIC_API_KEY;
     if (!envVars.CONVEYOR_AGENT_KEY) delete env.CONVEYOR_AGENT_KEY;
@@ -13486,7 +13577,7 @@ function buildHooks(host) {
   };
 }
 function taskIdToSessionUuid(lineageKey) {
-  const hash = createHash("sha256").update(lineageKey).digest("hex");
+  const hash = createHash2("sha256").update(lineageKey).digest("hex");
   return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
 }
 function sessionLineageKey(taskId, agentMode, runnerMode) {
@@ -16192,6 +16283,7 @@ var SessionRunner = class _SessionRunner {
       }
     });
     this.connection.onApiKeyUpdate((data) => {
+      delete process.env.CONVEYOR_CLAUDE_OAUTH;
       if (data.isSubscription) {
         process.env.CLAUDE_CODE_OAUTH_TOKEN = data.apiKey;
         delete process.env.ANTHROPIC_API_KEY;
@@ -16343,12 +16435,12 @@ var SessionRunner = class _SessionRunner {
 };
 
 // src/setup/config.ts
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var DEVCONTAINER_PATH = ".devcontainer/conveyor/devcontainer.json";
 var DEVCONTAINER_PORT_DENY_LIST = /* @__PURE__ */ new Set([5432, 6379, 9200]);
 async function loadForwardPorts(workspaceDir) {
   try {
-    const raw = await readWorkspaceFile(join12(workspaceDir, DEVCONTAINER_PATH));
+    const raw = await readWorkspaceFile(join13(workspaceDir, DEVCONTAINER_PATH));
     const parsed = JSON.parse(raw);
     const ports = (parsed.forwardPorts ?? []).filter(
       (p) => typeof p === "number" && !DEVCONTAINER_PORT_DENY_LIST.has(p)
@@ -16438,4 +16530,4 @@ export {
   loadConveyorConfig,
   unshallowRepo
 };
-//# sourceMappingURL=chunk-JCRP6K6T.js.map
+//# sourceMappingURL=chunk-LXSQ3AQN.js.map