@sealant/mend 0.36.0-next.665 → 0.36.0-next.684

package/README.md

@@ -243,6 +243,8 @@ mend ssh                          # inspect config and this client's key registr
 mend ssh setup                    # register a key and reconcile this server's Host block
 mend ssh setup --key ./my-key      # explicitly select private key or its .pub file
 mend ssh setup --host mend.example.com
+mend ssh keys                     # your registered keys, from every machine; this one is marked
+mend ssh keys remove SHA256:…     # stop the gateway accepting one of them
 ```
 
 Setup puts the managed block before wildcard defaults and restores all-host scope before your
@@ -263,6 +265,23 @@ Status and setup report config and client-key registration, not a successful SSH
 verified host trust. The public Sealant SDK's gateway info supplies host, port and username prefix,
 not a host-key fingerprint. Mend cannot authenticate a rotated host key from that metadata.
 
+### Removing a key
+
+`mend ssh keys` lists every key your account registered, with its fingerprint, name, algorithm and
+the day it was registered; `--json` prints the same with `thisMachine` on each. The platform does
+not record when a key was last used. `mend ssh keys remove <fingerprint>` removes one of your own
+keys; another person's fingerprint answers as an unknown one. The gateway looks a key up on every
+new connection, so the next connection offering it is refused. A connection already open stays open
+until it ends. The key file and this server's `~/.ssh/config` block stay on the machine that
+registered it; `mend ssh setup` there registers it again.
+
+`mend uninstall --home` removes the key this machine registered before it revokes the terminal's
+device token, then deletes the key file and the managed block. The key is found by its public half,
+so an encrypted private key or a stopped agent does not hide it. When the server refuses the
+removal, or this machine's public key cannot be read, the uninstall still finishes and exits 1,
+naming the fingerprint that may still be registered and `mend ssh keys remove` to run from another
+signed-in machine.
+
 ### Gateway host-key rotation
 
 Mend uses a stable per-server `HostKeyAlias`. OpenSSH's `accept-new` policy accepts an unknown key

package/dist/{chunk-K5WNRH4V.js → chunk-DHM7VXTR.js}

@@ -26465,6 +26465,68 @@ var AuditEventId = Schema_exports.String.pipe(Schema_exports.brand("AuditEventId
 var SessionControlEventId = Schema_exports.String.pipe(Schema_exports.brand("SessionControlEventId"));
 var ChangeLandingId = Schema_exports.String.pipe(Schema_exports.brand("ChangeLandingId"));
 
+// ../../packages/domain/src/repository-url.ts
+var isSshScheme = (scheme) => /^(?:git\+)?ssh(?:\+git)?$/i.test(scheme);
+var authorityEnd = (text, from) => {
+  const rest = text.slice(from).search(/[/?#]/u);
+  return rest === -1 ? text.length : from + rest;
+};
+var keptUserinfo = (scheme, userinfo) => {
+  if (!isSshScheme(scheme)) return "";
+  const user = userinfo.split(":")[0] ?? "";
+  return user === "" || user.includes("@") ? "" : `${user}@`;
+};
+var isSchemeChar = (char) => /[a-z0-9+.-]/iu.test(char);
+var schemeBefore = (text, separator, floor2) => {
+  let start = separator;
+  while (start > floor2 && isSchemeChar(text.charAt(start - 1))) start -= 1;
+  while (start < separator && !/[a-z]/iu.test(text.charAt(start))) start += 1;
+  return start < separator ? text.slice(start, separator) : null;
+};
+var redact4 = (text) => {
+  let out = "";
+  let copied = 0;
+  let floor2 = 0;
+  for (let separator = text.indexOf("://"); separator !== -1; ) {
+    const authorityStart = separator + 3;
+    const scheme = schemeBefore(text, separator, floor2);
+    if (scheme !== null) {
+      const authority = text.slice(authorityStart, authorityEnd(text, authorityStart));
+      const at = authority.lastIndexOf("@");
+      if (at !== -1) {
+        const userinfo = authority.slice(0, at);
+        const kept = keptUserinfo(scheme, userinfo);
+        if (kept !== `${userinfo}@`) {
+          out += `${text.slice(copied, authorityStart)}${kept}`;
+          copied = authorityStart + at + 1;
+        }
+      }
+    }
+    floor2 = authorityStart;
+    separator = text.indexOf("://", authorityStart);
+  }
+  return copied === 0 ? text : out + text.slice(copied);
+};
+var parsedCredential = (url) => {
+  if (!URL.canParse(url)) return false;
+  const parsed = new URL(url);
+  const scheme = parsed.protocol.slice(0, -1);
+  return parsed.password !== "" || parsed.username !== "" && !isSshScheme(scheme);
+};
+var clearedByParser = (url) => {
+  const parsed = new URL(url);
+  parsed.password = "";
+  if (!isSshScheme(parsed.protocol.slice(0, -1))) parsed.username = "";
+  return parsed.toString();
+};
+var redactUrlCredentials = (text) => redact4(text);
+var redactRepositoryUrl = (url) => {
+  const scanned = redact4(url);
+  return parsedCredential(scanned) ? clearedByParser(scanned) : scanned;
+};
+var repositoryUrlHasCredential = (url) => redactRepositoryUrl(url) !== url || parsedCredential(url);
+var REPOSITORY_URL_CREDENTIAL_GUIDANCE = 'This URL carries a login or token before the "@". Mend shows a repository URL to everyone who can see the repository, so it never stores one. Use the SSH URL (git@host:owner/repo.git) with your Mend key (`mend keys` shows it), or your own key through the agent bridge (`--auth bridge`).';
+
 // ../../packages/domain/src/settings.ts
 var PrMode = Schema_exports.Literals(["draft-immediately", "pr-on-approval"]);
 var onByDefault = Schema_exports.Boolean.pipe(Schema_exports.withDecodingDefaultKey(Effect_exports.succeed(true)));
@@ -26692,6 +26754,7 @@ var repositoryCloneUrlIssue = (value3) => {
   !/^(?:[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.?|\[[0-9a-f:.]+\])$/i.test(url.hostname)) {
     return REPOSITORY_CLONE_URL_GUIDANCE;
   }
+  if (repositoryUrlHasCredential(value3)) return REPOSITORY_URL_CREDENTIAL_GUIDANCE;
   return null;
 };
 var RepositoryCloneUrl = Schema_exports.String.pipe(
@@ -27163,7 +27226,14 @@ var AuditAction = Schema_exports.Literals([
   "change.pull_request_refreshed",
   "change.bundle_downloaded",
   // A pull request opened outside Mend was read with the owner's `gh` and recorded.
-  "change.pull_request_adopted"
+  "change.pull_request_adopted",
+  // docs/WORKSPACE-SSH.md: a key the workspace SSH gateway accepts for an account was registered,
+  // or archived so the gateway refuses it. The subject is the member who holds the key.
+  "ssh_key.added",
+  "ssh_key.removed",
+  // A member was removed and some of their keys are still active (or unread): Mend keeps trying,
+  // and each key it archives later is its own `ssh_key.removed`.
+  "ssh_key.revocation_pending"
 ]);
 var AuditData = Schema_exports.Record(
   Schema_exports.String,
@@ -27627,6 +27697,7 @@ var AgentEvent = Schema_exports.Union([
 var CaptureDrainReason = Schema_exports.Literals(["stop", "relaunch", "replacement"]);
 var FALLBACK_REPLACEMENT_AGE_SECONDS = 7 * 60 * 60 + 30 * 60;
 var CAPTURE_EXECUTOR_RETAINED = "retained";
+var CAPTURE_SEAL_UNRESTORABLE = "unrestorable";
 var CAPTURE_COMPLETION_UNREPORTED = "unreported";
 var captureDurationWords = (ms) => {
   const seconds2 = Math.max(0, Math.floor(ms / 1e3));
@@ -27686,6 +27757,8 @@ var captureIncompleteWords = (reason) => {
       return "executor error";
     case CAPTURE_EXECUTOR_RETAINED:
       return "executor kept for recovery";
+    case CAPTURE_SEAL_UNRESTORABLE:
+      return "final seal refused \xB7 git section failed verification";
     default:
       return reason;
   }
@@ -27788,6 +27861,18 @@ var CheckpointTrigger = Schema_exports.Literals([
   "review-open",
   "user-mark"
 ]);
+var CheckpointSourceKind = Schema_exports.Literals(["stop-final", "stop-reading"]);
+var CheckpointSource = class extends Schema_exports.Class("CheckpointSource")({
+  kind: CheckpointSourceKind,
+  captureN: Schema_exports.NullOr(Schema_exports.Int),
+  observedAt: Timestamp
+}) {
+};
+var checkpointSourceWords = (source, at) => [
+  source.kind === "stop-final" ? "from the Stop's final save" : "from a Stop reading that did not save",
+  ...source.captureN === null ? [] : [`capture ${source.captureN}`],
+  at
+].join(" \xB7 ");
 var Checkpoint = class extends Schema_exports.Class("Checkpoint")({
   id: CheckpointId,
   worktreeId: WorktreeId,
@@ -27810,7 +27895,9 @@ var Checkpoint = class extends Schema_exports.Class("Checkpoint")({
   /** Record sequence the supervisor had seen when the snapshot was taken. */
   seq: SequenceNumber,
   trigger: CheckpointTrigger,
-  createdAt: Timestamp
+  createdAt: Timestamp,
+  /** Absent when the checkpoint observed the executor itself (`CheckpointSource`). */
+  source: Schema_exports.optionalKey(CheckpointSource)
 }) {
 };
 
@@ -28384,6 +28471,7 @@ var HotWorkspaceEnvironment = Schema_exports.Struct({
   clusterBindingNames: Schema_exports.optional(Schema_exports.Array(Schema_exports.String)),
   clusterServiceAccount: Schema_exports.optional(Schema_exports.NullOr(Schema_exports.String))
 });
+var RemoteSsh = Schema_exports.Literals(["owner", "unbound", "not-taken"]);
 var HotWorkspace = class extends Schema_exports.Class("HotWorkspace")({
   id: SessionId,
   projectId: ProjectId,
@@ -28410,6 +28498,13 @@ var HotWorkspace = class extends Schema_exports.Class("HotWorkspace")({
    * `shared`.
    */
   harnessLayout: HarnessLayout,
+  /**
+   * Who Remote-SSH into the standby runs as (docs/adr/0016, decision 10), decided at its create and
+   * kept for its claim: `owner` its owner's own user; `unbound` root, because Core could not bind
+   * the owner's person; `not-taken` root, because Core runs no SSH session as a user. Rows from
+   * before it are `not-taken`.
+   */
+  remoteSsh: RemoteSsh,
   /** Worktree directory name inside the project's store (derived from `id`). */
   worktree: Schema_exports.NullOr(Schema_exports.String),
   /** The pre-created session branch the worktree is on. */
@@ -28557,7 +28652,7 @@ var ProjectClusterBindingsSnapshot = class extends Schema_exports.Class(
 }) {
 };
 
-// ../../node_modules/.pnpm/@sealant+api-contracts-next@0.39.0-next.707_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts-next/dist/workspace-environment.js
+// ../../node_modules/.pnpm/@sealant+api-contracts-next@0.39.0-next.714_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts-next/dist/workspace-environment.js
 var RESERVED_NAMES = new Map([
   // Identity/process roots the daemon and shells own.
   ...[
@@ -29026,6 +29121,7 @@ var ServiceView = class extends Schema_exports.Class("ServiceView")({
   previousEndpoints: Schema_exports.Array(ServiceEndpoint)
 }) {
 };
+var serviceStartCorrelation = (serviceId, startId) => `service-start:${serviceId}:${startId}`;
 
 // ../../packages/domain/src/workbench/session-control.ts
 var SessionControlKind = Schema_exports.Literals([
@@ -29634,17 +29730,23 @@ var pasteBytes = (text, bracketed) => Buffer.from(bracketed ? `\x1B[200~${text}\
 var firstPositional = (args2, valued) => args2.find(
   (argument, index2) => !argument.startsWith("--") && (index2 === 0 || !valued.includes(args2[index2 - 1] ?? ""))
 );
-var redactCredentials = (text) => text.replace(
-  // Greedy up to the last `@` before the authority ends: a literal `@` in a password is userinfo.
-  /\b([a-z][a-z0-9+.-]*):\/\/([^/?#"<>`]*)@/giu,
-  (_whole, scheme, userinfo) => {
-    if (/^(git\+)?ssh$/iu.test(scheme)) {
-      const user = userinfo.split(":")[0] ?? "";
-      if (/^[a-z0-9._~-]+$/iu.test(user)) return `${scheme}://${user}@`;
-    }
-    return `${scheme}://`;
-  }
-);
+var redactCredentials = (text) => redactUrlCredentials(text);
+var redactKeys = (field) => Object.fromEntries(Object.entries(field).map(([key, value3]) => [redactCredentials(key), value3]));
+var isPlainObject = (field) => typeof field === "object" && field !== null && (Object.getPrototypeOf(field) === Object.prototype || Object.getPrototypeOf(field) === null);
+var jsonWithoutCredentials = (value3) => {
+  const printed = JSON.stringify(
+    value3,
+    (_key, field) => {
+      if (typeof field === "string") return redactCredentials(field);
+      if (Object.prototype.toString.call(field) === "[object String]") {
+        return redactCredentials(String(field));
+      }
+      return isPlainObject(field) ? redactKeys(field) : field;
+    },
+    2
+  );
+  return printed ?? "null";
+};
 
 // src/server-request.ts
 var MendRequestError = class extends Error {
@@ -29888,6 +29990,7 @@ export {
   AGENT_MEMORY_MAX_FILE_BYTES,
   AGENT_MEMORY_MAX_DATABASE_BYTES,
   agentMemoryNameOf,
+  checkpointSourceWords,
   narrowCredential,
   claudeGrantFacts,
   sameGrant,
@@ -29904,6 +30007,7 @@ export {
   validatePiProfile,
   servicesHoldLine,
   validateSecretFilePath,
+  serviceStartCorrelation,
   terminalReadOnlyLine,
   sharedControlLine,
   sharedControlConfirm,
@@ -29934,6 +30038,7 @@ export {
   pasteBytes,
   firstPositional,
   redactCredentials,
+  jsonWithoutCredentials,
   MendRequestError,
   spoken,
   noAnswerError,

package/dist/{dashboard-DQB5RNXJ.js → dashboard-OBFWHSPD.js}

@@ -5,6 +5,7 @@ import {
   agentIsLive,
   agentOutcome,
   captureLineOf,
+  checkpointSourceWords,
   createSseParser,
   cwdFacts,
   eventFamilies,
@@ -23,7 +24,7 @@ import {
   workspaceReadsOf,
   worktreeJoinLine,
   wrapWords
-} from "./chunk-K5WNRH4V.js";
+} from "./chunk-DHM7VXTR.js";
 
 // src/dashboard.tsx
 import { CliRenderEvents, createCliRenderer } from "@opentui/core";
@@ -1120,6 +1121,7 @@ var SYNTAX_FUNCTION = "#ffcd66";
 
 // src/review.tsx
 import { Fragment, jsx, jsxs } from "@opentui/react/jsx-runtime";
+var clockOf = (iso) => new Date(iso).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", hour12: false });
 var REVIEW_KEY = (changeId) => ["review", changeId];
 var EDITOR_KEY_BINDINGS = [{ name: "return", ctrl: true, action: "submit" }];
 var syntaxStyle = SyntaxStyle.fromStyles({
@@ -1165,6 +1167,7 @@ var fetchReview = async (ctx, changeId) => {
     sliceId: pinned.slice.id,
     checkpointAId: pinned.checkpointA.id,
     checkpointBId: pinned.checkpointB.id,
+    checkpointSource: pinned.checkpointB.source ?? null,
     diffDigest: pinned.slice.diffDigest,
     anchorFiles: pinned.anchorFiles,
     files: buildReviewFiles(wire.diff, wire.files),
@@ -1998,7 +2001,10 @@ function ReviewScreen({
             session.id.slice(0, 8)
           ] }),
           isFetching ? /* @__PURE__ */ jsx("span", { fg: FAINT, children: " \xB7 syncing" }) : null,
-          /* @__PURE__ */ jsx("span", { fg: checkpointState === "failed" ? MUTED : FAINT, children: checkpointState === "recording" ? " \xB7 checkpointing" : checkpointState === "failed" ? " \xB7 checkpoint incomplete" : " \xB7 checkpoint recorded" })
+          /* @__PURE__ */ jsx("span", { fg: checkpointState === "failed" ? MUTED : FAINT, children: checkpointState === "recording" ? " \xB7 checkpointing" : checkpointState === "failed" ? " \xB7 checkpoint incomplete" : data.checkpointSource === null ? " \xB7 checkpoint recorded" : ` \xB7 checkpoint ${checkpointSourceWords(
+            data.checkpointSource,
+            clockOf(data.checkpointSource.observedAt)
+          )}` })
         ] }),
         /* @__PURE__ */ jsxs("text", { height: 1, bg: "transparent", children: [
           /* @__PURE__ */ jsxs("span", { fg: FAINT, children: [