@repo-os/repoos 0.5.45

package/dist/core/auth.js

@@ -0,0 +1,124 @@
+/**
+ * Authentication module for RepoOS.
+ *
+ * Opt-in, disabled by default. When enabled, protects all UI, API, and SSE
+ * routes with server-side sessions and HttpOnly cookies. Supports email OTP
+ * (via Resend) and Google OAuth as login methods.
+ *
+ * Zero runtime dependencies — native crypto, fetch, and SQLite.
+ */
+import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
+// ---------------------------------------------------------------------------
+// Crypto utilities
+// ---------------------------------------------------------------------------
+/** Generate a cryptographically random hex string. */
+export function randomHex(bytes = 32) {
+    return randomBytes(bytes).toString("hex");
+}
+/** Generate a 6-digit OTP code. */
+export function generateOtp() {
+    return String(randomBytes(4).readUInt32BE(0) % 1_000_000).padStart(6, "0");
+}
+/** SHA-256 hash a string (for OTP storage). */
+export function hashOtp(code) {
+    return createHash("sha256").update(code).digest("hex");
+}
+/** Constant-time string comparison. */
+export function timingSafeEqualStr(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+}
+/** Generate a random session token. */
+export function generateSessionToken() {
+    return randomHex(32);
+}
+/** Hash a session token for storage. */
+export function hashSessionToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+/** Generate a CSRF-like state parameter for OAuth. */
+export function generateOAuthState() {
+    return randomHex(16);
+}
+/** Generate a PKCE code verifier (43-128 chars, unreserved chars only). */
+export function generatePkceVerifier() {
+    const buf = randomBytes(32);
+    // base64url encode
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** SHA-256 hash for PKCE code challenge, base64url encoded. */
+export function pkceChallenge(verifier) {
+    return createHash("sha256")
+        .update(verifier)
+        .digest("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+// ---------------------------------------------------------------------------
+// Session cookie helpers
+// ---------------------------------------------------------------------------
+export const SESSION_COOKIE_NAME = "repoos_session";
+export const DEFAULT_SESSION_MAX_AGE = 7 * 24 * 60 * 60; // 7 days
+export function buildSessionCookie(token, maxAge, secure) {
+    const parts = [
+        `${SESSION_COOKIE_NAME}=${token}`,
+        "HttpOnly",
+        `Path=/`,
+        `SameSite=Lax`,
+        `Max-Age=${maxAge}`,
+    ];
+    if (secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+export function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const part of header.split(";")) {
+        const [key, ...rest] = part.split("=");
+        if (key && rest.length)
+            out[key.trim()] = rest.join("=").trim();
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Email validation
+// ---------------------------------------------------------------------------
+export function isValidEmail(email) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+export class RateLimiter {
+    entries = new Map();
+    windowMs;
+    maxAttempts;
+    constructor(windowMs, maxAttempts) {
+        this.windowMs = windowMs;
+        this.maxAttempts = maxAttempts;
+    }
+    /** Returns true if the request should be allowed. */
+    tryAcquire(key) {
+        const now = Date.now();
+        const entry = this.entries.get(key);
+        if (!entry || now > entry.resetAt) {
+            this.entries.set(key, { count: 1, resetAt: now + this.windowMs });
+            return true;
+        }
+        if (entry.count >= this.maxAttempts)
+            return false;
+        entry.count++;
+        return true;
+    }
+    /** Reset a key (e.g. after successful OTP verify). */
+    reset(key) {
+        this.entries.delete(key);
+    }
+}
+// OTP request: max 5 per email per 10 minutes
+export const otpRequestLimiter = new RateLimiter(10 * 60 * 1000, 5);
+// OTP verify: max 5 failed attempts per email per 10 minutes
+export const otpVerifyLimiter = new RateLimiter(10 * 60 * 1000, 5);
+// Global: max 100 OTP requests per IP per hour
+export const globalRateLimiter = new RateLimiter(60 * 60 * 1000, 100);

package/dist/core/bootstrap.d.ts

@@ -0,0 +1,41 @@
+import type { RepoOSConfig, Task } from "./types.js";
+/** Outcome of a single bootstrap step. */
+export interface BootstrapStep {
+    name: string;
+    ok: boolean;
+    durationMs: number;
+    detail?: string;
+}
+/** Full bootstrap result — surfaced in the context pack and telemetry. */
+export interface BootstrapResult {
+    ok: boolean;
+    /** All steps executed (successful or failed). */
+    steps: BootstrapStep[];
+    /** Total wall-clock duration in ms. */
+    durationMs: number;
+    /** When !ok, the first failing reason (human-readable). */
+    reason?: string;
+}
+/** The package manager detected in a worktree, or null. */
+export type PackageManager = "bun" | "npm" | null;
+/**
+ * Detect the package manager for a directory. Checks lockfiles first (the
+ * authoritative signal) then falls back to binary probe.
+ */
+export declare function detectPackageManager(dir: string): PackageManager;
+/**
+ * Run the bootstrap phase for a task in its worktree. Returns a structured
+ * result with per-step timing — callers surface failures as launch blockers
+ * and record telemetry.
+ *
+ * Steps (in order):
+ * 1. Validate the repo root is readable and has a valid config
+ * 2. Validate the worktree path exists and is within expected bounds
+ * 3. Check the orchestration build is not obviously broken
+ * 4. Install dependencies if node_modules is missing
+ *
+ * The agent is never launched on step failure (the caller checks `result.ok`).
+ * Every step that fails stops the bootstrap: later steps are skipped and
+ * recorded as such.
+ */
+export declare function bootstrap(config: RepoOSConfig, task: Task, branch: string, cwd: string): Promise<BootstrapResult>;

package/dist/core/bootstrap.js

@@ -0,0 +1,236 @@
+/**
+ * Bootstrap phase that runs before every agent turn (initial and resumed).
+ *
+ * RepoOS can deterministically prepare a worktree before an agent sees it:
+ * validate the root/worktree/branch, make dev dependencies available, and
+ * confirm the RepoOS CLI used for orchestration is trustworthy. Agents should
+ * never spend tokens on predictable setup.
+ *
+ * All mutations are safe: bootsrap never rewrites source, task content,
+ * lockfiles, or unrelated user changes. Failures stop the launch with a clear
+ * actionable error and the worktree stays recoverable.
+ *
+ * Zero runtime deps — `node:child_process` only. Like the rest of core, every
+ * check here is best-effort and degrades gracefully.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * Detect the package manager for a directory. Checks lockfiles first (the
+ * authoritative signal) then falls back to binary probe.
+ */
+export function detectPackageManager(dir) {
+    if (existsSync(join(dir, "bun.lock")) || existsSync(join(dir, "bun.lockb"))) {
+        return "bun";
+    }
+    if (existsSync(join(dir, "package-lock.json"))) {
+        return "npm";
+    }
+    if (existsSync(join(dir, "package.json"))) {
+        const probe = spawnSync("bun", ["--version"], { cwd: dir, timeout: 4000 });
+        if (probe.status === 0)
+            return "bun";
+        const npmProbe = spawnSync("npm", ["--version"], { cwd: dir, timeout: 4000 });
+        if (npmProbe.status === 0)
+            return "npm";
+    }
+    return null;
+}
+/**
+ * Which install command to use. `bun install --frozen-lockfile` never mutates
+ * the lockfile; `npm ci` does the same (requires an existing lockfile). Both
+ * reuse the package manager's cache/store so the cost on a warm cache is low.
+ */
+function installCommand(pm, dir) {
+    if (pm === "bun") {
+        return { cmd: "bun", args: ["install", "--frozen-lockfile"] };
+    }
+    if (pm === "npm") {
+        if (!existsSync(join(dir, "package-lock.json"))) {
+            return { cmd: "npm", args: ["install"] };
+        }
+        return { cmd: "npm", args: ["ci"] };
+    }
+    return null;
+}
+async function timed(fn) {
+    const start = Date.now();
+    const value = await fn();
+    return { value, durationMs: Date.now() - start };
+}
+function timedSync(fn) {
+    const start = Date.now();
+    const value = fn();
+    return { value, durationMs: Date.now() - start };
+}
+const STEP_NAMES = {
+    VALIDATE_ROOT: "validate-repo-root",
+    VALIDATE_WORKTREE: "validate-worktree",
+    CHECK_BUILD: "check-orchestration-build",
+    INSTALL_DEPS: "install-dependencies",
+};
+/**
+ * Check whether the RepoOS build used for orchestration (the CLI the agent
+ * will run for `repoos check` inside the worktree) is trustworthy.
+ *
+ * The check only blocks when evidence of a compiled build system exists:
+ * a `src/` directory AND a `package.json` with a build script. Without both,
+ * there is no compiled output to check — the bootstrap skips this step.
+ */
+function checkOrchestrationBuild(config, cwd) {
+    const hasSrc = existsSync(join(config.root, "src"));
+    const pkgPath = join(config.root, "package.json");
+    let hasBuild = false;
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+            hasBuild = typeof pkg?.scripts?.build === "string";
+        }
+        catch {
+            /* unreadable */
+        }
+    }
+    if (!hasSrc || !hasBuild) {
+        return { ok: true, detail: "no compiled build system detected — skipping build check" };
+    }
+    const buildMarker = join(config.root, "dist", ".build-info.json");
+    if (!existsSync(buildMarker)) {
+        return {
+            ok: false,
+            detail: "dist/.build-info.json missing — run `bun run build` in the main checkout",
+        };
+    }
+    return { ok: true, detail: "build marker present" };
+}
+/**
+ * Validate the worktree directory exists and is safe to use. Returns true
+ * when the cwd is a real directory inside (or equal to) the repo root or
+ * its worktrees directory. Never rewrites anything.
+ *
+ * Uses realpathSync on all paths so macOS symlinks (/var → /private/var)
+ * don't cause false mismatches.
+ */
+function validateWorktree(config, cwd) {
+    if (!existsSync(cwd)) {
+        return { ok: false, detail: `worktree path does not exist: ${cwd}` };
+    }
+    try {
+        const normalizedCwd = realpathSync(cwd);
+        const normalizedRoot = realpathSync(config.root);
+        const wtDir = join(config.root, "..");
+        const normalizedWtDir = realpathSync(wtDir);
+        if (normalizedCwd === normalizedRoot ||
+            normalizedCwd.startsWith(normalizedRoot + "/") ||
+            normalizedCwd.startsWith(normalizedWtDir + "/")) {
+            return { ok: true, detail: "worktree path valid" };
+        }
+        return { ok: false, detail: `worktree path outside expected locations: ${cwd}` };
+    }
+    catch {
+        // realpathSync fails if the path doesn't exist (already caught above)
+        return { ok: false, detail: `cannot resolve worktree path: ${cwd}` };
+    }
+}
+/**
+ * Install development dependencies in the worktree when `node_modules` is
+ * missing. Uses the detected package manager with a lockfile-respecting command
+ * so the lockfile is never mutated. No-op when `node_modules` already exists.
+ *
+ * Safe: `--frozen-lockfile` / `npm ci` never rewrite lockfiles or package.json.
+ * The package-manager cache (e.g. `~/.bun/install/cache`) is reused so a cold
+ * network fetch is only needed on the first-ever install.
+ */
+function installDeps(dir) {
+    if (existsSync(join(dir, "node_modules"))) {
+        return { ok: true, detail: "node_modules already present" };
+    }
+    const pm = detectPackageManager(dir);
+    if (!pm) {
+        return { ok: true, detail: "no package.json — nothing to install" };
+    }
+    const cmd = installCommand(pm, dir);
+    if (!cmd) {
+        return { ok: true, detail: `package manager ${pm} detected but no install command available` };
+    }
+    const proc = spawnSync(cmd.cmd, cmd.args, { cwd: dir, timeout: 120_000 });
+    if (proc.status !== 0) {
+        const err = proc.stderr?.toString("utf8").trim().split("\n").slice(-3).join(" ") || "unknown error";
+        return { ok: false, detail: `${cmd.cmd} install failed: ${err}` };
+    }
+    return { ok: true, detail: `dependencies installed with ${cmd.cmd}` };
+}
+/**
+ * Run the bootstrap phase for a task in its worktree. Returns a structured
+ * result with per-step timing — callers surface failures as launch blockers
+ * and record telemetry.
+ *
+ * Steps (in order):
+ * 1. Validate the repo root is readable and has a valid config
+ * 2. Validate the worktree path exists and is within expected bounds
+ * 3. Check the orchestration build is not obviously broken
+ * 4. Install dependencies if node_modules is missing
+ *
+ * The agent is never launched on step failure (the caller checks `result.ok`).
+ * Every step that fails stops the bootstrap: later steps are skipped and
+ * recorded as such.
+ */
+export async function bootstrap(config, task, branch, cwd) {
+    const overallStart = Date.now();
+    const steps = [];
+    const add = (name, ok, durationMs, detail) => {
+        steps.push({ name, ok, durationMs, detail });
+        return ok;
+    };
+    // Step 1: validate repo root
+    const { value: rootOk, durationMs: rootDur } = timedSync(() => {
+        if (!existsSync(config.root)) {
+            return { ok: false, detail: `repo root does not exist: ${config.root}` };
+        }
+        if (!existsSync(join(config.root, config.workDir))) {
+            return { ok: false, detail: `work dir missing in root: ${config.workDir}` };
+        }
+        return { ok: true, detail: "repo root valid" };
+    });
+    if (!add(STEP_NAMES.VALIDATE_ROOT, rootOk.ok, rootDur, rootOk.detail)) {
+        return {
+            ok: false,
+            steps,
+            durationMs: Date.now() - overallStart,
+            reason: rootOk.detail,
+        };
+    }
+    // Step 2: validate worktree
+    const { value: wtOk, durationMs: wtDur } = timedSync(() => validateWorktree(config, cwd));
+    if (!add(STEP_NAMES.VALIDATE_WORKTREE, wtOk.ok, wtDur, wtOk.detail)) {
+        return {
+            ok: false,
+            steps,
+            durationMs: Date.now() - overallStart,
+            reason: wtOk.detail,
+        };
+    }
+    // Step 3: check orchestration build
+    const { value: buildOk, durationMs: buildDur } = timedSync(() => checkOrchestrationBuild(config, cwd));
+    if (!add(STEP_NAMES.CHECK_BUILD, buildOk.ok, buildDur, buildOk.detail)) {
+        return {
+            ok: false,
+            steps,
+            durationMs: Date.now() - overallStart,
+            reason: buildOk.detail,
+        };
+    }
+    // Step 4: install dependencies (async — may spawn a child process)
+    const { value: depsOk, durationMs: depsDur } = await timed(async () => installDeps(cwd));
+    add(STEP_NAMES.INSTALL_DEPS, depsOk.ok, depsDur, depsOk.detail);
+    const durationMs = Date.now() - overallStart;
+    if (!depsOk.ok) {
+        return {
+            ok: false,
+            steps,
+            durationMs,
+            reason: depsOk.detail,
+        };
+    }
+    return { ok: true, steps, durationMs };
+}

package/dist/core/build.d.ts

@@ -0,0 +1,92 @@
+export interface BuildCheckResult {
+    stale: boolean;
+    /** Human-readable message, or null if no issue. */
+    message: string | null;
+    /**
+     * Machine-readable code:
+     *   'fresh'       — build is up to date
+     *   'stale'       — src/ changed since last build
+     *   'no-marker'   — dist/.build-info.json missing (not a RepoOS build)
+     *   'no-build'    — dist/ does not exist
+     *   'corrupt'     — dist/.build-info.json exists but is unreadable
+     *   'dev-mode'    — running from src/, not dist/ (node --strip-types)
+     *   'published'   — no src/ directory (npm/published install)
+     */
+    code: "fresh" | "stale" | "no-marker" | "no-build" | "corrupt" | "dev-mode" | "published";
+    /**
+     * Whether RepoOS's build-staleness contract applies to this checkout. True
+     * only once a `dist/.build-info.json` marker exists: that marker is written
+     * by RepoOS's own `bun run build`, so its absence (or the absence of `dist/`
+     * entirely) means the project uses a different build pipeline and staleness
+     * cannot be assessed there. `repoos check` degrades those to a skip instead
+     * of a hard failure; `stale` stays true so callers that need a usable build
+     * still trigger one.
+     */
+    applicable: boolean;
+}
+/**
+ * Resolve the package root relative to the running binary.
+ * Same resolution pattern as findUiHtml in server.ts.
+ */
+export declare function findPackageRoot(): string | null;
+/**
+ * Staleness check against an explicit repo root — used for a task's worktree
+ * before previewing it. A worktree is stale when its `src/` hash no longer
+ * matches its own `dist/.build-info.json` (or the marker is missing). A
+ * checkout with no `src/` is treated as published (nothing to check).
+ */
+export declare function checkBuildForRoot(root: string): BuildCheckResult;
+/**
+ * Whether a build invocation may skip its work entirely. Only a checkout whose
+ * marker proves `src/` is unchanged (`code: "fresh"`) may skip; every other
+ * outcome — a missing or mismatched marker, a missing `dist/`, a published
+ * install — must build. `force` (the `--force` flag / `REPOOS_FORCE_BUILD=1`)
+ * always builds, even when the marker says fresh.
+ *
+ * This is the single decision every build caller shares. `scripts/build.mjs`
+ * turns it into the skip; `repoos check` calls `bun run build` and inherits it,
+ * so staleness is never silently absorbed (check reports staleness first in its
+ * own step, then the build step repairs).
+ */
+export declare function shouldSkipBuild(result: BuildCheckResult, force?: boolean): boolean;
+export declare function checkBuild(): BuildCheckResult;
+/**
+ * Read the build timestamp for a checkout. The timestamp lives in
+ * `dist/.build-stamp.json` (gitignored) rather than `dist/.build-info.json`,
+ * so the marker that staleness and reload compare stays byte-identical across
+ * rebuilds of identical source. Falls back to a legacy inline `generatedAt` in
+ * the marker so installs built before the split still report a build age.
+ * Best-effort: null when neither file is readable.
+ */
+export declare function readBuildStamp(root: string): string | null;
+/**
+ * Build version + timestamp for the running install, resolved relative to THIS
+ * module so it works for every layout:
+ *
+ *   - standalone (curl / `repoos upgrade`):  <installRoot>/core/build.js
+ *       → `.build-info.json` + `.build-stamp.json` sit at <installRoot>
+ *   - linked dev build (compiled):           <repo>/dist/core/build.js
+ *       → both files sit at <repo>/dist
+ *   - source run (`bun src/cli/index.ts`):   <repo>/src/core/build.ts
+ *       → no marker beside it; fall back to <repo>/dist, then package.json
+ *
+ * The old path read `package.json` only — but the release tarball
+ * (`tar -C dist .`) ships `.build-info.json` (`{ hash, version }`) and
+ * `.build-stamp.json`, NOT `package.json`, so every standalone install
+ * reported its version as "unknown". `.build-info.json` is the source of truth
+ * here; `package.json` is just the last-resort fallback for a source checkout.
+ */
+export declare function readBuildMeta(): {
+    version: string | null;
+    buildAt: string | null;
+};
+/**
+ * The dir-relative core of {@link readBuildMeta}, split out so it can be tested
+ * against synthetic layouts. `markerDir` is where `.build-info.json` /
+ * `.build-stamp.json` are expected to sit (with `<markerDir>/../dist` tried as
+ * the source-checkout fallback).
+ */
+export declare function readBuildMetaFrom(markerDir: string): {
+    version: string | null;
+    buildAt: string | null;
+};