@sealant/mend 0.22.0 → 0.23.0

package/dist/login.js

@@ -1,240 +0,0 @@
-import { spawn } from "node:child_process";
-import * as os from "node:os";
-import { groupCode } from "./pair.js";
-/**
- * The opened request as the server's JSON, checked field by field before the
- * CLI acts on it — a captive portal or a non-Mend server answering 200 must
- * read as "not a Mend server", never as a crash. Null follows the CLI's
- * absence idiom (chooseUrl, minutesUntil); the one caller turns it into the
- * exit message.
- */
-const parseCliAuthStart = (json) => {
-    if (typeof json !== "object" || json === null)
-        return null;
-    if (!("deviceCode" in json &&
-        "code" in json &&
-        "verifyPath" in json &&
-        "expiresAt" in json &&
-        "intervalSeconds" in json)) {
-        return null;
-    }
-    const { deviceCode, code, verifyPath, expiresAt, intervalSeconds } = json;
-    if (typeof deviceCode !== "string" ||
-        typeof code !== "string" ||
-        typeof verifyPath !== "string" ||
-        typeof expiresAt !== "string" ||
-        typeof intervalSeconds !== "number") {
-        return null;
-    }
-    return { deviceCode, code, verifyPath, expiresAt, intervalSeconds };
-};
-/** A poll answer's JSON, checked the same way; anything off-shape answers null. */
-const parseCliAuthPoll = (json) => {
-    if (typeof json !== "object" || json === null || !("status" in json))
-        return null;
-    if (json.status === "pending")
-        return { status: "pending" };
-    if (json.status !== "approved")
-        return null;
-    if (!("token" in json && "user" in json && "device" in json))
-        return null;
-    const { token, user, device } = json;
-    if (typeof token !== "string")
-        return null;
-    if (typeof user !== "object" || user === null)
-        return null;
-    if (!("id" in user && "name" in user && "email" in user))
-        return null;
-    if (typeof user.id !== "string" ||
-        typeof user.name !== "string" ||
-        typeof user.email !== "string") {
-        return null;
-    }
-    if (typeof device !== "object" || device === null)
-        return null;
-    if (!("id" in device && "name" in device))
-        return null;
-    if (typeof device.id !== "string" || typeof device.name !== "string")
-        return null;
-    return {
-        status: "approved",
-        token,
-        user: { id: user.id, name: user.name, email: user.email },
-        device: { id: device.id, name: device.name },
-    };
-};
-const paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}` : text;
-const dim = paint("2");
-const green = paint("32");
-const cobalt = paint("34");
-const say = (line) => process.stdout.write(`${line}\n`);
-const fail = (message) => {
-    process.stderr.write(`mend: ${message}\n`);
-    process.exit(1);
-};
-const takeFlagValue = (args, flag) => {
-    const at = args.indexOf(flag);
-    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
-};
-/**
- * The server URL as a human types it: a bare `host:port` gets http://, a
- * trailing slash goes, anything the URL parser rejects answers null so the
- * caller can say so. The path is kept — an instance can live under one.
- */
-export const normalizeServerUrl = (input) => {
-    const trimmed = input.trim();
-    if (trimmed === "")
-        return null;
-    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
-    let url;
-    try {
-        url = new URL(withScheme);
-    }
-    catch {
-        return null;
-    }
-    if (url.protocol !== "http:" && url.protocol !== "https:")
-        return null;
-    return `${url.origin}${url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "")}`;
-};
-/** The page a human approves on — the verify path resolved against the URL the CLI dialed. */
-export const authorizeUrl = (base, verifyPath) => `${base}${verifyPath}`;
-/** How the browser opens on this platform; null means print the URL and let the human click. */
-export const browserCommand = (platform) => {
-    if (platform === "darwin")
-        return { command: "open", args: [] };
-    if (platform === "linux")
-        return { command: "xdg-open", args: [] };
-    return null;
-};
-/** Polling cadence: what the server asked for, held to a sane band. */
-export const pollDelayMs = (intervalSeconds) => Math.min(Math.max(Math.round(intervalSeconds), 1), 10) * 1000;
-/** When to stop polling: the request's own expiry, or ten minutes for an unreadable date. */
-export const pollDeadline = (expiresAt, now = Date.now()) => {
-    const at = Date.parse(expiresAt);
-    return Number.isNaN(at) ? now + 10 * 60_000 : at;
-};
-/** Fire-and-forget: a browser that fails to open must never take the login down. */
-const openBrowser = (url) => {
-    const opener = browserCommand(process.platform);
-    if (opener === null || process.stdout.isTTY !== true)
-        return;
-    try {
-        const child = spawn(opener.command, [...opener.args, url], {
-            stdio: "ignore",
-            detached: true,
-        });
-        child.on("error", () => undefined);
-        child.unref();
-    }
-    catch {
-        // The URL is already printed; clicking it is the fallback.
-    }
-};
-/** One unauthenticated POST to the authorize surface; anything but 2xx surfaces as a status. */
-const post = async (url, body) => {
-    let response;
-    try {
-        response = await fetch(url, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify(body),
-        });
-    }
-    catch {
-        return fail(`cannot reach the Mend server at ${new URL(url).origin} — is it running?`);
-    }
-    const text = await response.text();
-    let json = null;
-    try {
-        json = JSON.parse(text);
-    }
-    catch {
-        // A non-JSON body only matters for the happy path, which always is JSON.
-    }
-    return { status: response.status, json };
-};
-const retryAfterSecondsOf = (json) => {
-    if (typeof json === "object" && json !== null && "retryAfterSeconds" in json) {
-        const seconds = Number(json.retryAfterSeconds);
-        if (Number.isFinite(seconds) && seconds > 0)
-            return seconds;
-    }
-    return 5;
-};
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
- * Where this login points: `--url` wins, then whatever is already configured
- * (MEND_URL or the config file) — a set URL is never asked about again;
- * `--url` is how you point somewhere else. Only a fresh machine prompts, and
- * only on a terminal; a piped stdin takes the default silently.
- */
-const resolveServerUrl = async (args, deps) => {
-    const given = takeFlagValue(args, "--url") ?? deps.configuredUrl;
-    if (given !== null) {
-        return normalizeServerUrl(given) ?? fail(`"${given}" is not a URL the CLI can dial`);
-    }
-    if (process.stdin.isTTY !== true) {
-        return (normalizeServerUrl(deps.defaultUrl) ??
-            fail(`"${deps.defaultUrl}" is not a URL the CLI can dial`));
-    }
-    const readline = await import("node:readline/promises");
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const typed = (await rl.question(`mend server url ${dim(`[${deps.defaultUrl}]`)}: `)).trim();
-    rl.close();
-    const chosen = typed === "" ? deps.defaultUrl : typed;
-    return normalizeServerUrl(chosen) ?? fail(`"${chosen}" is not a URL the CLI can dial`);
-};
-/**
- * `mend login [--url <server>]` — open, show, wait, save. The token lands in
- * the CLI config (0600) together with the device id, so `mend logout` can
- * revoke the token server-side instead of merely forgetting it.
- */
-export const loginCommand = async (args, deps) => {
-    const base = await resolveServerUrl(args, deps);
-    const started = await post(`${base}/api/cli/auth`, { name: os.hostname() });
-    if (started.status === 429) {
-        return fail(`the server asked for a pause — try again in ${retryAfterSecondsOf(started.json)}s`);
-    }
-    if (started.status < 200 || started.status >= 300) {
-        return fail(`the server at ${base} refused to open an authorize request (${started.status})`);
-    }
-    const opened = parseCliAuthStart(started.json) ??
-        fail(`the server at ${base} did not answer like a Mend server — is that the right URL?`);
-    const url = authorizeUrl(base, opened.verifyPath);
-    say(`${green("✓")} authorize request open at ${base}`);
-    say(`  ${dim("code")}    ${groupCode(opened.code)} ${dim("· approve only if the browser shows the same code")}`);
-    say(`  ${dim("browser")} ${cobalt(url)}`);
-    say("");
-    say(dim("  waiting for approval… Ctrl-C stops; nothing is granted until someone approves"));
-    openBrowser(url);
-    const deadline = pollDeadline(opened.expiresAt);
-    const delay = pollDelayMs(opened.intervalSeconds);
-    while (Date.now() < deadline) {
-        await sleep(delay);
-        const poll = await post(`${base}/api/cli/auth/token`, { deviceCode: opened.deviceCode });
-        if (poll.status === 429) {
-            await sleep(retryAfterSecondsOf(poll.json) * 1000);
-            continue;
-        }
-        if (poll.status === 403)
-            return fail("denied in the browser; nothing was granted");
-        if (poll.status === 404 || poll.status === 410) {
-            return fail("the authorize request is no longer open — run mend login again");
-        }
-        if (poll.status < 200 || poll.status >= 300) {
-            return fail(`the server answered ${poll.status} while waiting — run mend login again`);
-        }
-        const result = parseCliAuthPoll(poll.json);
-        if (result === null) {
-            return fail("the server's answer stopped making sense while waiting — run mend login again");
-        }
-        if (result.status === "pending")
-            continue;
-        deps.save({ url: base, token: result.token, deviceId: result.device.id });
-        say(`${green("✓")} signed in as ${result.user.email}`);
-        say(`  ${dim("this terminal is the device")} ${result.device.name} ${dim("· revoke it any time under Settings → Devices")}`);
-        return;
-    }
-    return fail("the authorize request expired before anyone approved — run mend login again");
-};

package/dist/pair.js

@@ -1,83 +0,0 @@
-const paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}` : text;
-const dim = paint("2");
-const green = paint("32");
-const say = (line) => process.stdout.write(`${line}\n`);
-const fail = (message) => {
-    process.stderr.write(`mend: ${message}\n`);
-    process.exit(1);
-};
-const takeFlagValue = (args, flag) => {
-    const at = args.indexOf(flag);
-    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
-};
-/**
- * The code as a human reads it aloud: 8 Crockford characters in two groups. The
- * server compares case-insensitively with dashes stripped, so the dash is purely
- * for the eye and either form can be typed back.
- */
-export const groupCode = (code) => {
-    const bare = code.replace(/[^0-9a-z]/gi, "").toUpperCase();
-    return bare.length <= 4 ? bare : `${bare.slice(0, 4)}-${bare.slice(4)}`;
-};
-/** The scanned string. The device reads the base URL and the code out of it, nothing else. */
-export const pairingLink = (url, code) => `mend://pair?u=${encodeURIComponent(url)}&c=${code}`;
-/**
- * Tailscale hands every node an IPv4 in the CGNAT range 100.64.0.0/10 — the same
- * observation packages/api/src/machine.ts makes. A tailnet URL is preferred because
- * it keeps working when the phone leaves the LAN.
- */
-const isTailnetUrl = (value) => {
-    let host;
-    try {
-        host = new URL(value).hostname;
-    }
-    catch {
-        return false;
-    }
-    const parts = host.split(".").map(Number);
-    const [first, second] = parts;
-    if (parts.length !== 4 || first === undefined || second === undefined)
-        return false;
-    return first === 100 && second >= 64 && second <= 127;
-};
-/** `--url` wins; otherwise the tailnet address, otherwise the first candidate the server offered. */
-export const chooseUrl = (urls, override) => override ?? urls.find(isTailnetUrl) ?? urls[0] ?? null;
-/** Whole minutes left, floored at 0; null when the server sent a date this CLI cannot read. */
-export const minutesUntil = (expiresAt, now = Date.now()) => {
-    const at = Date.parse(expiresAt);
-    if (Number.isNaN(at))
-        return null;
-    return Math.max(0, Math.round((at - now) / 60_000));
-};
-/** The QR as block characters. Deliberately not gated on isTTY — a piped QR still scans. */
-export const renderQr = async (text) => {
-    const { toString: toQrString } = await import("qrcode");
-    const options = { type: "terminal", small: true };
-    return (await toQrString(text, options)).trimEnd();
-};
-/**
- * `mend pair [--url <base url>]`: mint a pairing code and show it. The device names
- * itself when it claims the code, so this side sends nothing but the request.
- */
-export const pairCommand = async (args, api) => {
-    const pairing = await api("POST", "/me/devices/pairings");
-    const url = chooseUrl(pairing.urls, takeFlagValue(args, "--url"));
-    if (url === null) {
-        return fail("no LAN or tailnet address to hand the device — pass one: mend pair --url http://<host>:<port>");
-    }
-    const minutes = minutesUntil(pairing.expiresAt);
-    say(await renderQr(pairingLink(url, pairing.code)));
-    say(`${green("✓")} pairing code ${groupCode(pairing.code)}`);
-    say(`  ${dim("url")}     ${url}`);
-    say(`  ${dim("expires")} ${minutes === null ? pairing.expiresAt : `in ${minutes} min`} ${dim("· one device, once")}`);
-    say("");
-    say(dim("  scan it in the Mend app, or enter the url and the code there by hand"));
-    say(dim("  the app is apps/mobile — build it yourself; it is not published yet"));
-};
-/** `mend qr <text>`: print a terminal QR of anything. Hidden from help; the installer uses it. */
-export const qrCommand = async (args) => {
-    const text = args.join(" ").trim();
-    if (text === "")
-        return fail("usage: mend qr <text>");
-    say(await renderQr(text));
-};

package/dist/review-model.js

@@ -1,212 +0,0 @@
-import * as path from "node:path";
-const FILETYPE_BY_EXTENSION = {
-    c: "c",
-    cc: "cpp",
-    cpp: "cpp",
-    css: "css",
-    go: "go",
-    h: "c",
-    hpp: "cpp",
-    html: "html",
-    java: "java",
-    js: "javascript",
-    json: "json",
-    jsx: "javascript",
-    md: "markdown",
-    mjs: "javascript",
-    py: "python",
-    rb: "ruby",
-    rs: "rust",
-    sh: "bash",
-    sql: "sql",
-    swift: "swift",
-    toml: "toml",
-    ts: "typescript",
-    tsx: "tsx",
-    yaml: "yaml",
-    yml: "yaml",
-    zsh: "bash",
-};
-const filetypeOf = (name) => {
-    const extension = path.extname(name).slice(1).toLowerCase();
-    return extension === "" ? undefined : (FILETYPE_BY_EXTENSION[extension] ?? extension);
-};
-const statusOf = (patch) => {
-    if (/^new file mode /m.test(patch))
-        return "added";
-    if (/^deleted file mode /m.test(patch))
-        return "deleted";
-    if (/^rename (?:from|to) /m.test(patch))
-        return "renamed";
-    return "modified";
-};
-const isLikelyGenerated = (name) => /(^|\/)(?:dist|build|generated)(?:\/|$)/i.test(name) ||
-    /(?:\.generated\.|\.min\.(?:js|css)$|(?:^|\/)(?:pnpm-lock\.yaml|package-lock\.json|yarn\.lock)$)/i.test(name);
-/** A legible terminal whitespace mode that preserves git's control prefixes. */
-export const visibleWhitespace = (patch) => patch
-    .split("\n")
-    .map((line) => {
-    const hunkContent = (line.startsWith("+") && !line.startsWith("+++")) ||
-        (line.startsWith("-") && !line.startsWith("---")) ||
-        line.startsWith(" ");
-    if (!hunkContent)
-        return line;
-    const prefix = line.slice(0, 1);
-    const content = line.slice(1).replaceAll("\t", "→····").replaceAll(" ", "·");
-    return `${prefix}${content}`;
-})
-    .join("\n");
-/**
- * Git is the source of this wire value, so a file begins only at a column-zero
- * `diff --git` header. A changed source line is prefixed with +/− and cannot
- * accidentally split the patch.
- */
-const splitFilePatches = (diff) => {
-    const starts = [...diff.matchAll(/^diff --git /gm)].map((match) => match.index);
-    return starts.map((start, index) => {
-        const end = starts[index + 1] ?? diff.length;
-        const patch = diff.slice(start, end);
-        return patch.endsWith("\n") ? patch : `${patch}\n`;
-    });
-};
-const parseRows = (patch) => {
-    const patchLines = patch.split("\n");
-    const lines = [];
-    const hunks = [];
-    let unifiedRow = 0;
-    let splitRow = 0;
-    let hunkIndex = -1;
-    let oldLine = 0;
-    let newLine = 0;
-    for (let index = 0; index < patchLines.length; index += 1) {
-        const header = patchLines[index] ?? "";
-        const hunkMatch = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(header);
-        if (hunkMatch === null)
-            continue;
-        hunkIndex += 1;
-        oldLine = Number(hunkMatch[1]);
-        newLine = Number(hunkMatch[2]);
-        hunks.push({ index: hunkIndex, header, unifiedRow, splitRow });
-        const body = [];
-        let bodyIndex = index + 1;
-        while (bodyIndex < patchLines.length) {
-            const bodyLine = patchLines[bodyIndex] ?? "";
-            if (bodyLine.startsWith("@@ "))
-                break;
-            if (bodyLine.startsWith("+") && !bodyLine.startsWith("+++")) {
-                body.push({ kind: "addition" });
-            }
-            else if (bodyLine.startsWith("-") && !bodyLine.startsWith("---")) {
-                body.push({ kind: "deletion" });
-            }
-            else if (bodyLine.startsWith(" ")) {
-                body.push({ kind: "context" });
-            }
-            bodyIndex += 1;
-        }
-        let cursor = 0;
-        while (cursor < body.length) {
-            const current = body[cursor];
-            if (current?.kind === "context") {
-                lines.push({
-                    kind: "context",
-                    oldLine,
-                    newLine,
-                    unifiedRow,
-                    splitRow,
-                    hunk: hunkIndex,
-                    commentable: true,
-                });
-                oldLine += 1;
-                newLine += 1;
-                unifiedRow += 1;
-                splitRow += 1;
-                cursor += 1;
-                continue;
-            }
-            // Git groups a replacement as a run of deletions/additions. Unified
-            // stacks every row; split aligns the Nth deletion with the Nth addition.
-            const groupStart = cursor;
-            while (cursor < body.length && body[cursor]?.kind !== "context")
-                cursor += 1;
-            const group = body.slice(groupStart, cursor);
-            let deletionOffset = 0;
-            let additionOffset = 0;
-            for (const entry of group) {
-                if (entry.kind === "deletion") {
-                    lines.push({
-                        kind: entry.kind,
-                        oldLine,
-                        newLine: null,
-                        unifiedRow,
-                        splitRow: splitRow + deletionOffset,
-                        hunk: hunkIndex,
-                        // ReviewComment persists a line number but no old/new side. Like
-                        // the web review, deletions therefore abstain instead of storing
-                        // a confidently wrong new-file anchor.
-                        commentable: false,
-                    });
-                    oldLine += 1;
-                    deletionOffset += 1;
-                }
-                else {
-                    lines.push({
-                        kind: entry.kind,
-                        oldLine: null,
-                        newLine,
-                        unifiedRow,
-                        splitRow: splitRow + additionOffset,
-                        hunk: hunkIndex,
-                        commentable: true,
-                    });
-                    newLine += 1;
-                    additionOffset += 1;
-                }
-                unifiedRow += 1;
-            }
-            splitRow += Math.max(deletionOffset, additionOffset);
-        }
-        index = bodyIndex - 1;
-    }
-    return { lines, hunks, unifiedRows: unifiedRow, splitRows: splitRow };
-};
-/** Public review seam: the API's live git diff becomes the terminal's files, hunks, and anchors. */
-export const buildReviewFiles = (diff, stats) => {
-    const patches = splitFilePatches(diff);
-    return stats.map((stat, index) => {
-        const patch = patches[index] ?? "";
-        const rows = parseRows(patch);
-        return {
-            ...stat,
-            patch,
-            filetype: filetypeOf(stat.path),
-            status: statusOf(patch),
-            binary: /^Binary files |^GIT binary patch$/m.test(patch),
-            likelyGenerated: isLikelyGenerated(stat.path),
-            ...rows,
-        };
-    });
-};
-/** The mechanically assembled draft remains editable before the API receives it. */
-export const assembleReviewInstruction = (change, comments) => {
-    const points = comments
-        .map((comment, index) => {
-        const anchor = comment.file === null
-            ? "the change as a whole"
-            : `${comment.file}${comment.line === null ? "" : `:${comment.line}${comment.endLine === null || comment.endLine === comment.line ? "" : `-${comment.endLine}`}`}`;
-        const proposal = comment.suggestion === null
-            ? ""
-            : `\n   Proposed replacement:\n${comment.suggestion
-                .split("\n")
-                .map((line) => `   ${line}`)
-                .join("\n")}`;
-        return `${index + 1}. ${anchor} — ${comment.body}${proposal}`;
-    })
-        .join("\n");
-    return `This is a follow-up on your earlier work in this worktree, responding to review feedback. The branch ${change.branch} is already checked out with your work on it: keep working there, and do not start a new branch or reset it.
-
-Review comments:
-${points}
-
-Address each point using your own judgment about how. Check your work with the repository's own build, tests, or typecheck; a check that still fails is something to report, not to force green. Report honestly what you changed and what you did not — if a point cannot or should not be done, say so plainly.`;
-};

package/dist/review-workflow.js

@@ -1,8 +0,0 @@
-export const reviewTargetForSession = (session, annotation, projectName) => annotation?.changeId === null || annotation?.changeId === undefined
-    ? null
-    : { session, changeId: annotation.changeId, projectName };
-export const commentRange = (start, current) => start === null
-    ? { line: current, endLine: null }
-    : { line: Math.min(start, current), endLine: Math.max(start, current) };
-/** One server-owned operation: persist intent, launch, correlate, finalize. */
-export const deliverReview = (api, sessionId, input) => api("POST", `/sessions/${sessionId}/follow-up/deliver`, input);