@ravefox/space 0.2.1 → 0.4.0

package/src/lib/commit-attribution.js

@@ -1,391 +0,0 @@
-import { Buffer } from 'node:buffer';
-import { createHash } from 'node:crypto';
-import {
-  accessSync,
-  closeSync,
-  constants,
-  fstatSync,
-  lstatSync,
-  mkdtempSync,
-  openSync,
-  readFileSync,
-  readlinkSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
-
-const GIT_HOOKS = [
-  'applypatch-msg',
-  'pre-applypatch',
-  'post-applypatch',
-  'pre-commit',
-  'pre-merge-commit',
-  'prepare-commit-msg',
-  'commit-msg',
-  'post-commit',
-  'pre-rebase',
-  'post-checkout',
-  'post-merge',
-  'pre-push',
-  'pre-receive',
-  'update',
-  'proc-receive',
-  'post-receive',
-  'post-update',
-  'reference-transaction',
-  'push-to-checkout',
-  'pre-auto-gc',
-  'post-rewrite',
-  'sendemail-validate',
-  'fsmonitor-watchman',
-  'p4-pre-submit',
-  'p4-prepare-changelist',
-  'p4-changelist',
-  'p4-post-changelist',
-  'post-index-change',
-];
-
-const cleanSingleLine = (value, fallback) => {
-  let cleaned = '';
-  for (const character of String(value ?? '')) {
-    const codePoint = character.codePointAt(0);
-    cleaned += codePoint <= 0x1f || codePoint === 0x7f ? ' ' : character;
-  }
-  cleaned = cleaned
-    .replace(/[<>]/g, '')
-    .replace(/\s+/g, ' ')
-    .trim();
-  return cleaned || fallback;
-};
-
-// Use an email-local-part-safe reversible id. URI escapes introduce `%`, which
-// Git does not accept in a co-author trailer address. Keep the reversible form
-// while it fits the 64-character email local-part limit; longer identities use
-// a stable hash so GitHub can still lift the co-author on squash.
-const seatAddressId = (agentName, instanceId) => {
-  const identity = JSON.stringify([
-    cleanSingleLine(agentName, 'agent'),
-    cleanSingleLine(instanceId, 'default'),
-  ]);
-  const reversibleId = Buffer.from(identity).toString('base64url');
-  if (reversibleId.length <= 64) return reversibleId;
-  return `sha256-${createHash('sha256').update(identity).digest('base64url')}`;
-};
-
-// This probe runs before every turn and blocks the listener's event loop, so a
-// git child that never exits (one waiting on an inherited stdin, or one whose
-// open() the OS holds pending consent) must not stall the seat. On timeout
-// spawnSync kills the child and sets result.error; the wrapper hook then
-// resolves the original hooks itself at commit time.
-const GIT_PROBE_TIMEOUT_MS = 5000;
-
-const directoryOrNull = (path) => {
-  try {
-    return statSync(path).isDirectory() ? path : null;
-  } catch {
-    return null;
-  }
-};
-
-// A regular file's text, or null. The open does not block, so a FIFO or a
-// device where git keeps a file is refused instead of hanging the caller.
-const readRegularFile = (path) => {
-  let fd = null;
-  try {
-    fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
-    return fstatSync(fd).isFile() ? readFileSync(fd, 'utf8') : null;
-  } catch {
-    return null;
-  } finally {
-    if (fd !== null) closeSync(fd);
-  }
-};
-
-// One git config value: quotes group, a backslash escapes the next character,
-// and an unquoted # or ; starts a comment. Whitespace around the value is
-// dropped unless it is quoted.
-const configValue = (raw) => {
-  let value = '';
-  let kept = 0;
-  let quoted = false;
-  for (let index = 0; index < raw.length; index += 1) {
-    const character = raw[index];
-    if (character === '\\' && index + 1 < raw.length) {
-      index += 1;
-      value += raw[index];
-      kept = value.length;
-    } else if (character === '"') {
-      quoted = !quoted;
-    } else if (!quoted && (character === '#' || character === ';')) {
-      break;
-    } else if (quoted || value || !/\s/.test(character)) {
-      value += character;
-      if (quoted) kept = value.length;
-    }
-  }
-  return value.slice(0, kept) + value.slice(kept).trimEnd();
-};
-
-// The last core.hooksPath in one config file, or null. `include` and
-// conditional includes are not followed.
-const configuredHooksPath = (configPath) => {
-  const text = readRegularFile(configPath);
-  if (text === null) return null;
-  let inCore = false;
-  let hooksPath = null;
-  for (const rawLine of text.split(/\r?\n/)) {
-    let line = rawLine.trim();
-    const section = /^\[\s*([A-Za-z0-9.-]+)\s*("[^"]*")?\s*\]/.exec(line);
-    if (section) {
-      inCore = section[1].toLowerCase() === 'core' && !section[2];
-      line = line.slice(section[0].length).trim();
-    }
-    const entry = inCore && /^hookspath\s*=(.*)$/i.exec(line);
-    if (entry) hooksPath = configValue(entry[1]);
-  }
-  return hooksPath || null;
-};
-
-// Git opens a git directory only if its HEAD names a ref or an object id and
-// its common directory holds objects/ and refs/.
-const isGitDirectory = (gitDir, commonDir) => {
-  if (!directoryOrNull(join(commonDir, 'objects')) || !directoryOrNull(join(commonDir, 'refs'))) {
-    return false;
-  }
-  const head = join(gitDir, 'HEAD');
-  try {
-    if (lstatSync(head).isSymbolicLink()) return readlinkSync(head).startsWith('refs/');
-    const line = (readRegularFile(head) ?? '').split('\n')[0];
-    return /^ref:\s*refs\//.test(line) || /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/.test(line);
-  } catch {
-    return false;
-  }
-};
-
-// Git refuses a repository whose files another user owns, unless global
-// safe.directory config allows it. That config is not read here, so such a
-// repository yields no hooks, which is git's own answer without it.
-const ownedByThisUser = (path) => {
-  if (typeof process.geteuid !== 'function') return false;
-  try {
-    return lstatSync(path).uid === process.geteuid();
-  } catch {
-    return false;
-  }
-};
-
-// The hooks directory a commit in `cwd` would use, read from the repository's
-// own files without running git: core.hooksPath from the repository config,
-// else the hooks folder of the common git directory (a linked worktree shares
-// its main repository's). Global config and includes are not read. `~` expands
-// against the HOME the probe gave git, as git itself would. The nearest .git
-// must be a repository this user owns, or there are no hooks. Git would walk
-// on past a .git directory that is not a repository, and this stops there.
-const hooksPathFromGitFiles = (cwd, env) => {
-  let top = resolve(cwd);
-  let entry = join(top, '.git');
-  let entryStat = null;
-  for (;;) {
-    try {
-      entryStat = statSync(entry);
-      break;
-    } catch {
-      if (dirname(top) === top) return null;
-      top = dirname(top);
-      entry = join(top, '.git');
-    }
-  }
-  // Ownership is settled before any of the repository's files is read.
-  if (!ownedByThisUser(top) || !ownedByThisUser(entry)) return null;
-  let gitDir = entry;
-  if (entryStat.isFile()) {
-    const pointer = /^gitdir:\s*(.+?)\s*$/m.exec(readRegularFile(entry) ?? '');
-    if (!pointer) return null;
-    gitDir = resolve(top, pointer[1]);
-    if (!ownedByThisUser(gitDir)) return null;
-  }
-  // A main repository has no commondir file.
-  const commonDirFile = readRegularFile(join(gitDir, 'commondir'));
-  const commonDir = commonDirFile === null ? gitDir : resolve(gitDir, commonDirFile.trim());
-  if (!isGitDirectory(gitDir, commonDir)) return null;
-  const configured = configuredHooksPath(join(commonDir, 'config'));
-  if (!configured) return directoryOrNull(join(commonDir, 'hooks'));
-  if (configured === '~' || configured.startsWith('~/')) {
-    return env.HOME ? directoryOrNull(join(env.HOME, configured.slice(1))) : null;
-  }
-  // Git runs hooks from the top of the working tree, so a relative path
-  // resolves there.
-  return directoryOrNull(resolve(top, configured));
-};
-
-const resolveOriginalHooksPath = (cwd, env) => {
-  const result = spawnSync(
-    'git',
-    ['rev-parse', '--path-format=absolute', '--git-path', 'hooks'],
-    {
-      cwd,
-      env,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-      timeout: GIT_PROBE_TIMEOUT_MS,
-      killSignal: 'SIGKILL',
-    },
-  );
-  if (result.error?.code === 'ETIMEDOUT') {
-    // The open() that stalled git would stall this process too, and a
-    // synchronous read cannot be timed out, so nothing is read here. A git
-    // that cannot open the repository cannot commit in it either.
-    // eslint-disable-next-line no-console
-    console.warn(`[commit-attribution] git did not answer in ${GIT_PROBE_TIMEOUT_MS / 1000}s in ${cwd}, `
-      + 'so a confined seat is not granted this repository\'s hooks this turn');
-    return null;
-  }
-  if (result.error || result.status !== 0 || !result.stdout?.trim()) {
-    // A confined seat can only run the hooks it is granted. A hook it is not
-    // granted is skipped without a word, or refuses the commit where the jail
-    // can see the file but not run it. So read the hooks directory from the
-    // repository's files instead.
-    const fallback = hooksPathFromGitFiles(cwd, env);
-    if (fallback) {
-      const reason = result.error?.code || `exit ${result.status}`;
-      // eslint-disable-next-line no-console
-      console.warn(`[commit-attribution] git could not report the hooks directory (${reason}), `
-        + `so ${fallback} was read from the repository's files`);
-    }
-    return fallback;
-  }
-  // Only git's newline ends the line, since a path can end in a space.
-  return directoryOrNull(resolve(result.stdout.replace(/\r?\n$/, '')));
-};
-
-const resolveGitConfigCount = (env) => {
-  const raw = env.GIT_CONFIG_COUNT ?? '0';
-  if (!/^(0|[1-9]\d*)$/.test(String(raw))) {
-    throw new Error(`cannot enable commit attribution: GIT_CONFIG_COUNT is invalid (${raw})`);
-  }
-  const count = Number(raw);
-  if (!Number.isSafeInteger(count)) {
-    throw new Error('cannot enable commit attribution: GIT_CONFIG_COUNT is out of range');
-  }
-  return count;
-};
-
-const wrapperHook = () => `#!/bin/sh
-# Space CLI commit attribution. Preserve the repository's configured hooks.
-hook_name=\${0##*/}
-config_index=$COMMONLY_AGENT_GIT_CONFIG_INDEX
-base_count=$COMMONLY_AGENT_GIT_CONFIG_BASE_COUNT
-case "$config_index:$base_count" in
-  *[!0-9:]*|:*) exit 1 ;;
-esac
-GIT_CONFIG_COUNT=$base_count
-export GIT_CONFIG_COUNT
-unset "GIT_CONFIG_KEY_$config_index" "GIT_CONFIG_VALUE_$config_index"
-
-# Read the target repository's file-backed config while excluding process-level
-# GIT_CONFIG_* overlays inherited from the workspace seat.
-if original_hooks=$(GIT_CONFIG_COUNT=0 git config --path --get core.hooksPath 2>/dev/null); then
-  :
-else
-  git_common_dir=$(GIT_CONFIG_COUNT=0 git rev-parse --path-format=absolute --git-common-dir 2>/dev/null) || git_common_dir=
-  original_hooks=
-  if [ -n "$git_common_dir" ]; then
-    original_hooks="$git_common_dir/hooks"
-  fi
-fi
-if [ -n "$original_hooks" ] && [ "$original_hooks" != "$COMMONLY_AGENT_HOOKS_PATH" ]; then
-  original_hook="$original_hooks/$hook_name"
-  if [ -x "$original_hook" ]; then
-    "$original_hook" "$@"
-    hook_status=$?
-    if [ "$hook_status" -ne 0 ]; then
-      exit "$hook_status"
-    fi
-  fi
-fi
-
-if [ "$hook_name" = "prepare-commit-msg" ] && [ -n "$1" ]; then
-  git interpret-trailers --in-place --if-exists=addIfDifferent \\
-    --trailer "Co-authored-by: $COMMONLY_AGENT_SEAT_NAME <$COMMONLY_AGENT_SEAT_ID@agents.commonly.invalid>" \\
-    --trailer "Agent-Model: $COMMONLY_AGENT_ADAPTER/$COMMONLY_AGENT_MODEL/$COMMONLY_AGENT_EFFORT" \\
-    "$1"
-  exit $?
-fi
-exit 0
-`;
-
-/**
- * Install a per-spawn Git hook proxy and return an environment for the CLI
- * child. The proxy delegates every standard hook to the repository's original
- * hook directory, then adds Commonly trailers after an existing
- * prepare-commit-msg hook has had its say.
- */
-export const prepareCommitAttribution = ({
-  cwd,
-  env = process.env,
-  agentName,
-  displayName,
-  instanceId = 'default',
-  adapter,
-  model,
-  effort,
-}) => {
-  const configIndex = resolveGitConfigCount(env);
-  const originalHooksPath = resolveOriginalHooksPath(cwd, env);
-  const hooksDirectory = mkdtempSync(join(tmpdir(), 'commonly-agent-hooks-'));
-  try {
-    const hookSource = wrapperHook();
-    for (const hookName of GIT_HOOKS) {
-      const hookPath = join(hooksDirectory, hookName);
-      writeFileSync(hookPath, hookSource, { encoding: 'utf8', mode: 0o700 });
-      accessSync(hookPath, constants.X_OK);
-    }
-  } catch (error) {
-    rmSync(hooksDirectory, { recursive: true, force: true });
-    throw error;
-  }
-
-  const safeAdapter = cleanSingleLine(adapter, 'unknown');
-  const metadataEnv = {
-    COMMONLY_AGENT_GIT_CONFIG_INDEX: String(configIndex),
-    COMMONLY_AGENT_GIT_CONFIG_BASE_COUNT: String(configIndex),
-    COMMONLY_AGENT_HOOKS_PATH: hooksDirectory,
-    // The sandbox adapters allow the workspace's existing hook files. The
-    // proxy resolves the target repo's path at hook time, and a confined seat
-    // cannot run a hook outside what it was granted.
-    ...(originalHooksPath ? { COMMONLY_AGENT_ORIGINAL_HOOKS_PATH: originalHooksPath } : {}),
-    COMMONLY_AGENT_SEAT_NAME: cleanSingleLine(displayName || agentName, 'agent'),
-    COMMONLY_AGENT_SEAT_ID: seatAddressId(agentName, instanceId),
-    COMMONLY_AGENT_ADAPTER: safeAdapter,
-    COMMONLY_AGENT_MODEL: cleanSingleLine(model, 'default'),
-    COMMONLY_AGENT_EFFORT: cleanSingleLine(effort, 'default'),
-  };
-  const attributionEnv = {
-    ...env,
-    GIT_CONFIG_COUNT: String(configIndex + 1),
-    [`GIT_CONFIG_KEY_${configIndex}`]: 'core.hooksPath',
-    [`GIT_CONFIG_VALUE_${configIndex}`]: hooksDirectory,
-    ...metadataEnv,
-  };
-  const sandboxEnv = {
-    ...metadataEnv,
-    GIT_CONFIG_COUNT: '1',
-    GIT_CONFIG_KEY_0: 'core.hooksPath',
-    GIT_CONFIG_VALUE_0: hooksDirectory,
-    COMMONLY_AGENT_GIT_CONFIG_INDEX: '0',
-    COMMONLY_AGENT_GIT_CONFIG_BASE_COUNT: '0',
-  };
-
-  return {
-    env: attributionEnv,
-    sandboxEnv,
-    hooksDirectory,
-    cleanup: () => rmSync(hooksDirectory, { recursive: true, force: true }),
-  };
-};
-
-export const supportedGitHooks = () => [...GIT_HOOKS];

package/src/lib/config.js

@@ -1,155 +0,0 @@
-/**
- * Config management — ~/.commonly/config.json
- *
- * Stores auth tokens and instance URLs across sessions.
- * Multiple instances supported (default, local, custom).
- */
-
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-
-const CONFIG_DIR = join(homedir(), '.commonly');
-const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
-
-const DEFAULT_INSTANCE_URL = 'https://space.ravefox.dev';
-const LOCAL_INSTANCE_URL = 'http://localhost:5000';
-
-const read = () => {
-  if (!existsSync(CONFIG_FILE)) return { instances: {}, active: 'default' };
-  try {
-    return JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
-  } catch {
-    return { instances: {}, active: 'default' };
-  }
-};
-
-// The file holds the login's bearer token, so only its owner may read it. The
-// mode on create is subject to the umask, and a file written before this fix is
-// still 0644, so every write ends with chmod. A new directory is made 0700; an
-// existing one is left as it is, because other tools keep files there too.
-const write = (config) => {
-  if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: 'utf8', mode: 0o600 });
-  chmodSync(CONFIG_FILE, 0o600);
-};
-
-export const getConfig = () => read();
-
-const normalizeUrl = (value) => (value || '').replace(/\/$/, '').toLowerCase();
-
-/**
- * Resolve an instance identifier to the saved instance record.
- *
- * Accepts either form:
- *   - A saved key:  'dev', 'default', 'local'
- *   - A URL:        'https://api.commonly.me' (any case; trailing / ok)
- *   - null:         falls back to config.active
- *
- * Historically `resolveInstanceUrl` treated the arg as a URL and `getToken`
- * treated it as a key — so `--instance dev` and `--instance <url>` each
- * worked for exactly one of URL-resolution or token-lookup and broke the
- * other. Funneling both through this helper closes that asymmetry.
- *
- * URL-shaped inputs (http[s]://) go through URL resolution first so a
- * hypothetical key named `"https-backup"` can't collide with a real URL.
- * For an unknown URL (no saved match) we return the URL with a null token,
- * which is needed for login bootstrap (there is no saved instance yet) and
- * for unauthenticated probe calls.
- */
-export const resolveInstance = (identifier = null) => {
-  const config = read();
-
-  if (!identifier) {
-    const key = config.active || 'default';
-    const inst = config.instances[key];
-    return inst ? { key, ...inst } : null;
-  }
-
-  // URL-shaped inputs: resolve by URL first. Case-insensitive match so that
-  // `HTTPS://API-DEV.commonly.me/` finds a record saved as the lowercased
-  // `https://api.commonly.me`.
-  const looksLikeUrl = /^https?:\/\//i.test(identifier);
-  if (looksLikeUrl) {
-    const normalized = normalizeUrl(identifier);
-    const matches = Object.entries(config.instances)
-      .filter(([, v]) => normalizeUrl(v.url) === normalized);
-    if (matches.length > 0) {
-      // Several keys can share one URL (`dev` and `default` both pointing at
-      // api.commonly.me after a re-login under a new key). The first entry in
-      // file order is then whichever was saved FIRST — the stale one — and
-      // every command that resolves by the token file's instanceUrl
-      // (detach, wake) got a 401 from a token the user had already replaced.
-      // Prefer the active instance, then the most recently saved.
-      const active = matches.find(([key]) => key === config.active);
-      const [key, value] = active || matches
-        .slice()
-        .sort(([, a], [, b]) => String(b.savedAt || '').localeCompare(String(a.savedAt || '')))[0];
-      return { key, ...value };
-    }
-    // Unknown URL — still usable for bootstrapping. Preserve the caller's
-    // original case in the returned URL (some servers are case-sensitive on
-    // paths; we only lowercase for match comparison above).
-    return { key: null, url: identifier.replace(/\/$/, ''), token: null };
-  }
-
-  // Key-shaped inputs: exact lookup only.
-  if (config.instances[identifier]) {
-    return { key: identifier, ...config.instances[identifier] };
-  }
-
-  // Unknown key — caller falls back to defaults.
-  return null;
-};
-
-// Alias kept for existing imports (login.js). Functionally identical to
-// resolveInstance; callers using this name pre-date the refactor.
-export const getActiveInstance = (instanceOverride = null) => resolveInstance(instanceOverride);
-
-export const resolveInstanceUrl = (instanceArg = null) => {
-  const inst = resolveInstance(instanceArg);
-  if (inst?.url) return inst.url.replace(/\/$/, '');
-  return DEFAULT_INSTANCE_URL;
-};
-
-export const saveInstance = ({ key = 'default', url, token, userId, username, tokenType = null }) => {
-  const config = read();
-  config.instances[key] = {
-    url: url.replace(/\/$/, ''),
-    token,
-    userId,
-    username,
-    // Device bearers are long-lived until revoked. Preserve the explicit kind
-    // so `whoami` can say that without guessing from a future token format.
-    ...(tokenType ? { tokenType } : {}),
-    savedAt: new Date().toISOString(),
-  };
-  config.active = key;
-  write(config);
-};
-
-export const setActive = (key) => {
-  const config = read();
-  if (!config.instances[key]) throw new Error(`Instance '${key}' not found in config`);
-  config.active = key;
-  write(config);
-};
-
-export const getToken = (instanceOverride = null) => {
-  // Env var takes precedence (CI, scripts)
-  if (process.env.COMMONLY_TOKEN) return process.env.COMMONLY_TOKEN;
-  const inst = resolveInstance(instanceOverride);
-  return inst?.token || null;
-};
-
-export const listInstances = () => {
-  const config = read();
-  return Object.entries(config.instances).map(([key, val]) => ({
-    key,
-    ...val,
-    active: key === config.active,
-  }));
-};
-
-export const LOCAL_URL = LOCAL_INSTANCE_URL;
-export const DEFAULT_URL = DEFAULT_INSTANCE_URL;

package/src/lib/content-refusal.js

@@ -1,94 +0,0 @@
-/**
- * A model provider that refuses a request's CONTENT (2026-10-16).
- *
- * A security-gate seat on codex was asked to review a PR whose request carried
- * SSRF, exfiltration and ReDoS test cases. The provider refused every turn
- * ("flagged for possible cybersecurity risk"). The run loop classed that as a
- * transient runtime failure, so it never acked and re-sent the same content on
- * backoff, five refusals in 52 minutes on a login every codex seat shares. The
- * seat handled nothing else until the kernel's requeue cap retired the event.
- *
- * A content refusal is deterministic: the same content is refused again. So it
- * is acked once, as refused, and never retried. A refused request addressed to
- * the seat is not dropped silently either: the wrapper, not the model, posts one
- * line naming the request (PR, head, message id, sender) and, when the seat is
- * run with `--refusal-handoff <agent>`, @mentions that agent to take it. The
- * line repeats nothing else from the request: the flagged text stays out of
- * the pod.
- *
- * Two later rules (2026-11-05, ADR-018 D9.2). A turn that carried unread message
- * bodies reruns once without them before any item is refused, since ambient text
- * may have drawn the refusal. And a refusal drops the pod's session: both CLIs
- * keep the refused prompt in their thread and would resend it on every resume.
- */
-import { classifySpawnFailure, SPAWN_FAILURE_CLASS } from './spawn-retry.js';
-
-/** The ack reason, so the event ledger counts refusals by name. */
-export const CONTENT_REFUSED_REASON = 'provider-refused';
-
-export const isContentRefusal = (error) => (
-  classifySpawnFailure(error) === SPAWN_FAILURE_CLASS.CONTENT_REFUSED
-);
-
-/**
- * The turn result for a refused item. `refused` releases its claim as
- * `upstream-refused` (claim-outcome.js): on a human broadcast the kernel hands
- * the message to one remaining listener, as it does for any upstream refusal.
- * `outcome: 'error'` is terminal on the kernel side; the event is acked, not
- * requeued.
- */
-export const contentRefusedResult = () => ({
-  outcome: 'error',
-  refused: { reason: 'upstream-refused' },
-  reason: CONTENT_REFUSED_REASON,
-  details: { failureClass: SPAWN_FAILURE_CLASS.CONTENT_REFUSED },
-});
-
-// A full 40-hex commit id. Shorter hex runs are not taken: the server's pod
-// context frame carries 24-hex pod ids, and a short match would name one as
-// the head.
-const FULL_SHA_RE = /\b[0-9a-f]{40}\b/g;
-const PR_REF_RE = /#\d{2,6}\b/;
-const MAX_HEADS = 3;
-
-/** An agent handle as the server resolves mentions; anything else is dropped. */
-export const sanitizeHandoffAgent = (value) => {
-  const name = String(value ?? '').trim().replace(/^@/, '');
-  return /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name) ? name : null;
-};
-
-/**
- * What the notice may name about a refused request: identifiers only. The PR is
- * the first `#N`; the heads are every distinct full commit id (a request that
- * names two is reported with both, rather than guessing which one is current).
- */
-export const refusedItemRef = (event) => {
-  const payload = event?.payload || {};
-  const content = String(payload.content || '');
-  const pr = content.match(PR_REF_RE)?.[0] || null;
-  const heads = [...new Set(content.match(FULL_SHA_RE) || [])].slice(0, MAX_HEADS);
-  const rawMessageId = String(payload.messageId ?? '');
-  const messageId = /^[A-Za-z0-9]{1,40}$/.test(rawMessageId) ? rawMessageId : null;
-  const from = String(payload.username || '').replace(/[^A-Za-z0-9._-]/g, '').slice(0, 40) || null;
-  return { pr, heads, messageId, from };
-};
-
-const describeItem = ({ pr, heads, messageId, from }) => {
-  const subject = pr ? `${pr}${heads.length ? ` at ${heads.map((head) => `\`${head}\``).join(' or ')}` : ' (no head named)'}` : 'a request';
-  const source = [messageId ? `message ${messageId}` : null, from ? `from ${from}` : null]
-    .filter(Boolean).join(' ');
-  return source ? `${subject} (${source})` : subject;
-};
-
-/**
- * The one line the wrapper posts. `mention` is false in a DM, where @mentioning
- * a third agent would pull it toward a 1:1 conversation it cannot join.
- */
-export const composeRefusalHandoff = ({ items, handoff = null, mention = true }) => {
-  const agent = sanitizeHandoffAgent(handoff);
-  const one = items.length === 1;
-  const what = one ? describeItem(items[0]) : `${items.length} requests: ${items.map(describeItem).join('; ')}`;
-  const lead = `The model provider refused the content of ${what}, so I could not read ${one ? 'it' : 'them'} and will not retry ${one ? 'it' : 'them'}.`;
-  if (agent && mention) return `${lead} @${agent}, please take ${one ? 'it' : 'them'}.`;
-  return `${lead} ${one ? 'It needs' : 'They need'} another reader.`;
-};