@repo-os/repoos 0.5.66 → 0.5.67

package/dist/.build-info.json

@@ -1,5 +1,5 @@
 {
-  "hash": "90878be478d9457133036cf01bb56796b507ad255d1afc5321c1fb61bcec65a7",
-  "version": "0.5.66",
+  "hash": "93934ce20f177f2d06114caa9df33fcc13b17c9f8b1694247b2cb6282628fab8",
+  "version": "0.5.67",
   "devUi": false
 }

package/dist/.build-stamp.json

@@ -1,3 +1,3 @@
 {
-  "generatedAt": "2026-10-06T02:22:31.964Z"
+  "generatedAt": "2026-10-07T10:18:27.380Z"
 }

package/dist/cli/api-route-parity.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CLI/API parity map (#0723). Every registered `/api/*` route must match at
+ * least one rule here or the parity test fails.
+ *
+ * Allowlist entries use exact method + pattern strings from `Router.listRoutes()`
+ * — no broad substring matchers that could hide new routes.
+ */
+export interface ApiRouteRef {
+    method: string;
+    pattern: string;
+}
+export declare function isApiRouteCovered(route: ApiRouteRef): boolean;
+export declare function uncoveredApiRoutes(routes: readonly ApiRouteRef[]): ApiRouteRef[];

package/dist/cli/api-route-parity.js

@@ -0,0 +1,128 @@
+/**
+ * CLI/API parity map (#0723). Every registered `/api/*` route must match at
+ * least one rule here or the parity test fails.
+ *
+ * Allowlist entries use exact method + pattern strings from `Router.listRoutes()`
+ * — no broad substring matchers that could hide new routes.
+ */
+const exact = (method, pattern) => (r) => r.method === method && r.pattern === pattern;
+const re = (method, patternSource) => (r) => r.method === method && r.pattern === patternSource;
+/** Routes implemented by the server-backed control CLI (#0723). */
+const CONTROL_API_MATCHERS = [
+    re("POST", /^\/api\/tasks\/([^/]+)\/(start|pause|message|done)$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/preview$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/preview\/stop$/.source),
+    exact("GET", "/api/config"),
+    exact("PATCH", "/api/config"),
+    exact("GET", "/api/remote-validation/status"),
+    exact("POST", "/api/remote-validation/test"),
+    exact("GET", "/api/agents/running"),
+    exact("GET", "/api/stats/board"),
+    // `repoos review` → PATCH status=review; `repoos override` → PATCH overrides
+    re("PATCH", /^\/api\/tasks\/([^/]+)$/.source),
+];
+/** Routes covered by existing file-level CLI commands (not HTTP). */
+const FILE_CLI_MATCHERS = [
+    exact("GET", "/api/health"),
+    exact("GET", "/api/tasks"),
+    re("GET", /^\/api\/tasks\/([^/]+)$/.source),
+    exact("POST", "/api/tasks"),
+    re("DELETE", /^\/api\/tasks\/([^/]+)$/.source),
+    exact("GET", "/api/check-plan"),
+];
+/** UI-only, SSE/hub, auth, or internal routes — no CLI required. */
+const UI_ONLY_MATCHERS = [
+    (r) => r.pattern.startsWith("/api/auth/"),
+    (r) => r.pattern.startsWith("/api/hub/"),
+    (r) => r.pattern.startsWith("/api/telegram/"),
+    exact("GET", "/api/index"),
+    exact("GET", "/api/board"),
+    exact("GET", "/api/counts"),
+    exact("GET", "/api/docs"),
+    (r) => r.pattern.startsWith("/api/repo/"),
+    (r) => r.pattern.startsWith("/api/inputs"),
+    (r) => r.pattern.startsWith("/api/skills"),
+    (r) => r.pattern.startsWith("/api/skill-registry"),
+    (r) => r.pattern.startsWith("/api/stories"),
+    exact("GET", "/api/system"),
+    exact("GET", "/api/system/logs"),
+    (r) => r.pattern.startsWith("/api/support/"),
+    (r) => r.pattern.startsWith("/api/tunnel/"),
+    (r) => r.pattern.startsWith("/api/release"),
+    (r) => r.pattern.startsWith("/api/deployments"),
+    (r) => r.pattern.startsWith("/api/chat"),
+    (r) => r.pattern.startsWith("/api/debugger"),
+    re("GET", /^\/api\/tasks\/([^/]+)\/debugger$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/debugger\/message$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/debugger\/interrupt$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/debugger\/send-to-engineer$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/debugger\/send-to-pm$/.source),
+    re("POST", /^\/api\/agents\/built-in\/([^/]+)\/run$/.source),
+    (r) => r.pattern.startsWith("/api/cto"),
+    exact("GET", "/api/stats/by-type"),
+    exact("GET", "/api/stats/daily"),
+    exact("POST", "/api/system/kill-process"),
+    exact("GET", "/api/system/run-tests"),
+    exact("POST", "/api/system/run-tests"),
+    exact("GET", "/api/attention"),
+    exact("GET", "/api/check-runs"),
+    (r) => r.pattern.startsWith("/api/integration"),
+    exact("GET", "/api/close-out/outcomes"),
+    re("GET", /^\/api\/tasks\/([^/]+)\/integration-job$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/done\/cancel$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/worktree-handoff\/discard$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/review$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/review\/again$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/review\/message$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/pm\/message$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/pm\/interrupt$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/attachments\/([^/]+)$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/attachments$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/shots$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/shots$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/shots\/([^/]+)$/.source),
+    re("DELETE", /^\/api\/tasks\/([^/]+)\/shots\/([^/]+)$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/ui-verification$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/needs-input\/dismiss$/.source),
+    re("POST", /^\/api\/tasks\/([^/]+)\/clear-worktree$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/output$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/logs$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/checks$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/stats$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/diff-stats$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/diff$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/merge-conflict$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/worktree-dirty$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/file$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/remote-validation\/log$/.source),
+    re("GET", /^\/api\/tasks\/([^/]+)\/remote-validation\/events$/.source),
+    exact("GET", "/api/config/raw"),
+    exact("PUT", "/api/config/raw"),
+    (r) => r.pattern.startsWith("/api/dev/"),
+    (r) => r.pattern.startsWith("/api/models"),
+    (r) => r.pattern.startsWith("/api/playground"),
+    (r) => r.pattern.startsWith("/api/model-providers"),
+    exact("GET", "/api/agents/queued"),
+    exact("GET", "/api/agents/detect"),
+    exact("GET", "/api/agents/detect/stream"),
+    exact("POST", "/api/agents/updates"),
+    re("GET", /^\/api\/agents\/([^/]+)\/logs$/.source),
+    (r) => r.pattern.startsWith("/api/ntfy/"),
+    exact("POST", "/api/transcribe"),
+    (r) => r.pattern.startsWith("/api/service/"),
+    exact("POST", "/api/server/restart"),
+    re("POST", /^\/api\/tasks\/([^/]+)\/(sync|hotfix|abandon|reopen|archive|unarchive)$/.source),
+    exact("POST", "/api/tasks/freeform"),
+    exact("POST", "/api/docs/create"),
+    exact("POST", "/api/docs/freeform"),
+    re("GET", /^\/api\/freeform\/runs\/([^/]+)$/.source),
+];
+const ALL_MATCHERS = [...CONTROL_API_MATCHERS, ...FILE_CLI_MATCHERS, ...UI_ONLY_MATCHERS];
+export function isApiRouteCovered(route) {
+    if (!route.pattern.startsWith("/api/"))
+        return true;
+    return ALL_MATCHERS.some((m) => m(route));
+}
+export function uncoveredApiRoutes(routes) {
+    return routes.filter((r) => r.pattern.startsWith("/api/") && !isApiRouteCovered(r));
+}

package/dist/cli/cli-session.d.ts

@@ -0,0 +1,6 @@
+export declare function cliSessionPath(root: string, cacheDir: string): string;
+export declare function readCliSession(root: string, cacheDir: string): string | null;
+export declare function writeCliSession(root: string, cacheDir: string, token: string): void;
+export declare function clearCliSession(root: string, cacheDir: string): void;
+/** Parse `Set-Cookie` for the RepoOS session token value. */
+export declare function sessionTokenFromSetCookie(setCookie: string | string[] | undefined, cookieName: string): string | null;

package/dist/cli/cli-session.js

@@ -0,0 +1,56 @@
+/**
+ * Persisted RepoOS web session for the CLI (#0723).
+ *
+ * Stores the HttpOnly session token the server issued at login so repeat CLI
+ * calls do not need OTP every time. Mode 0600, never logged. Loopback calls
+ * still prefer the server's local-cli-token when present (#0582).
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+export function cliSessionPath(root, cacheDir) {
+    return join(root, cacheDir, "cli-session");
+}
+export function readCliSession(root, cacheDir) {
+    try {
+        const token = readFileSync(cliSessionPath(root, cacheDir), "utf8").trim();
+        return token || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeCliSession(root, cacheDir, token) {
+    const dir = join(root, cacheDir);
+    mkdirSync(dir, { recursive: true });
+    const path = cliSessionPath(root, cacheDir);
+    writeFileSync(path, `${token}\n`, { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+export function clearCliSession(root, cacheDir) {
+    try {
+        unlinkSync(cliSessionPath(root, cacheDir));
+    }
+    catch {
+        /* absent */
+    }
+}
+/** Parse `Set-Cookie` for the RepoOS session token value. */
+export function sessionTokenFromSetCookie(setCookie, cookieName) {
+    if (!setCookie)
+        return null;
+    const parts = Array.isArray(setCookie) ? setCookie : [setCookie];
+    for (const header of parts) {
+        const segment = header.split(";")[0]?.trim();
+        if (!segment?.startsWith(`${cookieName}=`))
+            continue;
+        const value = segment.slice(cookieName.length + 1);
+        if (value)
+            return value;
+    }
+    return null;
+}

package/dist/cli/effective-from-api.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Resolve the engineer a task will run with, from server API payloads (#0723).
+ * Uses the same rules as the UI (`effective-agent.ts`), not a local disk reindex.
+ */
+import { type EffectiveAgent, type EffectiveAgentInput } from "../ui-app/src/lib/effective-agent.js";
+export interface ApiTaskOverrides {
+    agentOverride?: string | null;
+    cliOverride?: string | null;
+    modelOverride?: string | null;
+}
+export declare function effectiveEngineerFromApi(agents: readonly EffectiveAgentInput[], task: ApiTaskOverrides): EffectiveAgent;

package/dist/cli/effective-from-api.js

@@ -0,0 +1,12 @@
+/**
+ * Resolve the engineer a task will run with, from server API payloads (#0723).
+ * Uses the same rules as the UI (`effective-agent.ts`), not a local disk reindex.
+ */
+import { resolveEffectiveAgent, } from "../ui-app/src/lib/effective-agent.js";
+export function effectiveEngineerFromApi(agents, task) {
+    return resolveEffectiveAgent(agents, {
+        agentOverride: task.agentOverride ?? null,
+        cliOverride: task.cliOverride ?? null,
+        modelOverride: task.modelOverride ?? null,
+    }, "engineer");
+}

package/dist/cli/help.js

@@ -71,9 +71,75 @@ const GROUPS = [
             {
                 name: "mv",
                 usage: "mv <id> <status> [--note <text>] [--force-not-merged]",
-                desc: "Move a task to a new status — never merges code",
+                desc: "Move a task to a new status (file write) — use review/done for handoff and close-out",
                 flags: '--note "..." · --force-not-merged',
             },
+            {
+                name: "start",
+                usage: "start <id> [--fresh] [--json] [--port N]",
+                desc: "Start or resume the engineer on a task (POST /api/tasks/:id/start)",
+                flags: "--fresh · --json · --port",
+            },
+            {
+                name: "pause",
+                usage: "pause <id> [--json] [--port N]",
+                desc: "Pause the running agent (POST /api/tasks/:id/pause)",
+                flags: "--json · --port",
+            },
+            {
+                name: "message",
+                usage: 'message <id> "<text>" [--json] [--port N]',
+                desc: "Send a follow-up to the task agent (POST /api/tasks/:id/message)",
+                flags: "--json · --port",
+            },
+            {
+                name: "review",
+                usage: "review <id> [--wait] [--json] [--port N]",
+                desc: "Request review synchronously (PATCH status=review; waits for handoff)",
+                flags: "--wait · --json · --port",
+            },
+            {
+                name: "done",
+                usage: "done <id> [--commit-dirty] [--wait] [--json] [--port N]",
+                desc: "Move to done through the close-out pipeline (POST /api/tasks/:id/done)",
+                flags: "--commit-dirty · --wait · --json · --port",
+            },
+            {
+                name: "override",
+                usage: "override <id> [--cli <name>] [--model <model>] [--json] [--port N]",
+                desc: "Set per-task engineer overrides (PATCH /api/tasks/:id)",
+                flags: "--cli · --model · --json · --port",
+            },
+            {
+                name: "preview",
+                usage: "preview <id> [--stop] [--json] [--port N]",
+                desc: "Start or stop the task preview (POST /api/tasks/:id/preview)",
+                flags: "--stop · --json · --port",
+            },
+            {
+                name: "config",
+                usage: "config get|set <key> [value] [--json] [--port N]",
+                desc: "Read or write server config (GET/PATCH /api/config)",
+                flags: "--json · --port",
+            },
+            {
+                name: "runners",
+                usage: "runners [--probe] [--json] [--port N]",
+                desc: "Remote validation runner status (and optional probe)",
+                flags: "--probe · --json · --port",
+            },
+            {
+                name: "agents",
+                usage: "agents [--json] [--port N]",
+                desc: "List running agents (GET /api/agents/running)",
+                flags: "--json · --port",
+            },
+            {
+                name: "stats",
+                usage: "stats [--json] [--port N]",
+                desc: "Board spend summary (GET /api/stats/board)",
+                flags: "--json · --port",
+            },
             {
                 name: "rm",
                 usage: "rm <id> --yes",

package/dist/cli/index.js

@@ -20,6 +20,7 @@ import { cmdDoctor } from "../commands/doctor.js";
 import { cmdCertify } from "../commands/certify.js";
 import { cmdSupport } from "../commands/support.js";
 import { cmdService } from "../commands/service.js";
+import { cmdAgentsRunning, cmdConfig, cmdDone, cmdMessage, cmdOverride, cmdPause, cmdPreview, cmdReview, cmdRunners, cmdStart, cmdStats, } from "../commands/control-api.js";
 import { checkBuild } from "../core/build.js";
 import { loadConfig } from "../core/config.js";
 import { reexecAfterStaleBuild, reexecUnderBunIfRequested } from "../core/runtime.js";
@@ -192,6 +193,72 @@ function main() {
         case "check":
             void cmdCheck(rest);
             break;
+        case "start":
+            void cmdStart(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "pause":
+            void cmdPause(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "message":
+            void cmdMessage(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "review":
+            void cmdReview(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "done":
+            void cmdDone(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "override":
+            void cmdOverride(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "preview":
+            void cmdPreview(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "config":
+            void cmdConfig(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "runners":
+            void cmdRunners(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "agents":
+            void cmdAgentsRunning(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
+        case "stats":
+            void cmdStats(rest).then((code) => {
+                if (code !== 0)
+                    process.exitCode = code;
+            });
+            break;
         case "shot":
             void cmdShot(rest)
                 .then((code) => {

package/dist/cli/repoos-api.d.ts

@@ -0,0 +1,52 @@
+/**
+ * HTTP client for the running RepoOS control plane (#0723).
+ *
+ * Authenticates with the loopback local-cli token when available (#0582), else a
+ * stored session cookie, and transparently re-logs in via the dev backdoor on
+ * 401 after a server reload (never prints the backdoor code).
+ */
+import { loadConfig } from "../core/config.js";
+export declare class RepoOsApiError extends Error {
+    readonly status: number;
+    readonly body?: unknown | undefined;
+    constructor(message: string, status: number, body?: unknown | undefined);
+}
+export interface RepoOsApiOptions {
+    root?: string;
+    port?: number;
+    json?: boolean;
+}
+export interface ApiJson {
+    ok?: boolean;
+    error?: string;
+    [key: string]: unknown;
+}
+export declare function resolveControlPlaneBase(opts?: RepoOsApiOptions): {
+    root: string;
+    baseUrl: string;
+    config: ReturnType<typeof loadConfig>;
+};
+export declare class RepoOsApi {
+    private readonly root;
+    private readonly baseUrl;
+    private readonly config;
+    private session;
+    constructor(opts?: RepoOsApiOptions);
+    private localToken;
+    get base(): string;
+    private buildHeaders;
+    private devBackdoorLogin;
+    health(): Promise<boolean>;
+    request(method: string, path: string, body?: unknown, opts?: {
+        retryAuth?: boolean;
+    }): Promise<{
+        status: number;
+        body: ApiJson;
+    }>;
+    requestOk(method: string, path: string, body?: unknown, allowedStatuses?: number[]): Promise<ApiJson>;
+}
+export declare function pollUntil<T>(fn: () => Promise<T | null>, opts: {
+    intervalMs?: number;
+    timeoutMs?: number;
+    label?: string;
+}): Promise<T>;

package/dist/cli/repoos-api.js

@@ -0,0 +1,164 @@
+/**
+ * HTTP client for the running RepoOS control plane (#0723).
+ *
+ * Authenticates with the loopback local-cli token when available (#0582), else a
+ * stored session cookie, and transparently re-logs in via the dev backdoor on
+ * 401 after a server reload (never prints the backdoor code).
+ */
+import { boardRoot, loadConfig, resolveServePort } from "../core/config.js";
+import { SESSION_COOKIE_NAME } from "../core/auth.js";
+import { readLocalCliToken } from "../server/local-token.js";
+import { clearCliSession, readCliSession, sessionTokenFromSetCookie, writeCliSession, } from "./cli-session.js";
+import { readServeLocks } from "../commands/status.js";
+export class RepoOsApiError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "RepoOsApiError";
+    }
+}
+function readApiError(body, status) {
+    if (body && typeof body === "object" && "error" in body) {
+        const err = body.error;
+        if (typeof err === "string" && err.trim())
+            return err.trim();
+    }
+    return `HTTP ${status}`;
+}
+export function resolveControlPlaneBase(opts = {}) {
+    const { root } = opts.root ? { root: opts.root } : boardRoot();
+    const config = loadConfig(root);
+    const configuredPort = resolveServePort(root, config);
+    const liveLock = readServeLocks(root, config.cacheDir).find((l) => l.alive && (l.port ?? configuredPort) > 0);
+    const port = opts.port ?? liveLock?.port ?? configuredPort;
+    return { root, baseUrl: `http://127.0.0.1:${port}`, config };
+}
+export class RepoOsApi {
+    root;
+    baseUrl;
+    config;
+    session;
+    constructor(opts = {}) {
+        const resolved = resolveControlPlaneBase(opts);
+        this.root = resolved.root;
+        this.baseUrl = resolved.baseUrl;
+        this.config = resolved.config;
+        this.session = readCliSession(this.root, this.config.cacheDir);
+    }
+    localToken() {
+        return readLocalCliToken(this.root, this.config.cacheDir);
+    }
+    get base() {
+        return this.baseUrl;
+    }
+    buildHeaders(jsonBody) {
+        const headers = {};
+        if (jsonBody)
+            headers["content-type"] = "application/json";
+        const token = this.localToken();
+        if (token)
+            headers["x-repoos-local-token"] = token;
+        if (this.session)
+            headers.cookie = `${SESSION_COOKIE_NAME}=${this.session}`;
+        return headers;
+    }
+    async devBackdoorLogin() {
+        if (this.config.auth?.enabled !== true)
+            return true;
+        const email = this.config.auth.bootstrapAdmin?.trim().toLowerCase();
+        const code = this.config.auth.devBackdoorCode?.trim();
+        if (!email || !code || process.env.NODE_ENV === "production")
+            return false;
+        let res;
+        try {
+            res = await fetch(`${this.baseUrl}/api/auth/verify-otp`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ email, code }),
+            });
+        }
+        catch {
+            return false;
+        }
+        if (!res.ok)
+            return false;
+        const setCookie = typeof res.headers.getSetCookie === "function"
+            ? res.headers.getSetCookie()
+            : (res.headers.get("set-cookie") ?? undefined);
+        const token = sessionTokenFromSetCookie(setCookie, SESSION_COOKIE_NAME);
+        if (!token)
+            return false;
+        this.session = token;
+        writeCliSession(this.root, this.config.cacheDir, token);
+        return true;
+    }
+    async health() {
+        try {
+            const res = await fetch(`${this.baseUrl}/api/health`);
+            return res.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async request(method, path, body, opts = {}) {
+        const jsonBody = body !== undefined;
+        const doFetch = async () => {
+            try {
+                return await fetch(`${this.baseUrl}${path}`, {
+                    method,
+                    headers: this.buildHeaders(jsonBody),
+                    body: jsonBody ? JSON.stringify(body) : undefined,
+                });
+            }
+            catch (err) {
+                throw new RepoOsApiError(`Can't reach the RepoOS server at ${this.baseUrl}. Is \`repoos serve\` running? ${err.message}`, 0);
+            }
+        };
+        let res = await doFetch();
+        if (res.status === 401 && opts.retryAuth !== false) {
+            const relogged = await this.devBackdoorLogin();
+            if (relogged) {
+                res = await doFetch();
+            }
+            else {
+                clearCliSession(this.root, this.config.cacheDir);
+                this.session = null;
+            }
+        }
+        let parsed = {};
+        const text = await res.text();
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = { error: text };
+            }
+        }
+        return { status: res.status, body: parsed };
+    }
+    async requestOk(method, path, body, allowedStatuses) {
+        const { status, body: data } = await this.request(method, path, body);
+        const allowed = allowedStatuses ?? [200];
+        if (!allowed.includes(status)) {
+            throw new RepoOsApiError(readApiError(data, status), status, data);
+        }
+        return data;
+    }
+}
+export async function pollUntil(fn, opts) {
+    const intervalMs = opts.intervalMs ?? 250;
+    const timeoutMs = opts.timeoutMs ?? 120_000;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const value = await fn();
+        if (value !== null)
+            return value;
+        await new Promise((r) => setTimeout(r, intervalMs));
+    }
+    throw new RepoOsApiError(opts.label ? `Timed out: ${opts.label}` : "Timed out waiting for operation", 408);
+}