@shepai/cli 1.116.3-pr375.ea5b2a2 → 1.117.0-pr367.ca5b6ac

package/dist/packages/core/src/infrastructure/services/tunnel/cloudflare-tunnel.service.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Cloudflare Tunnel Service
+ *
+ * Manages a `cloudflared` quick-tunnel that exposes ONLY the webhook
+ * API routes to the public internet via a random *.trycloudflare.com
+ * subdomain.
+ *
+ * Uses the `cloudflared` npm package which handles binary installation
+ * and provides a typed Tunnel API — no need for the user to install
+ * cloudflared separately.
+ *
+ * Security: A lightweight proxy HTTP server is started on a random port
+ * that only forwards requests matching the allowed path prefix
+ * (/api/webhooks) to the main app. The tunnel connects to this proxy,
+ * not the main app server. All other paths return 404.
+ */
+import type { ITunnelService, TunnelUrlChangeHandler } from '../../../application/ports/output/services/tunnel-service.interface.js';
+export interface CloudflareTunnelDeps {
+    createTunnel: (origin: string) => TunnelLike | Promise<TunnelLike>;
+}
+export interface TunnelLike {
+    on(event: 'url', handler: (url: string) => void): void;
+    on(event: 'connected', handler: (connection: {
+        id: string;
+        ip: string;
+        location: string;
+    }) => void): void;
+    on(event: 'error', handler: (error: Error) => void): void;
+    on(event: 'exit', handler: (code: number | null, signal: string | null) => void): void;
+    once(event: string, handler: (...args: unknown[]) => void): void;
+    stop(): void;
+}
+export declare class CloudflareTunnelService implements ITunnelService {
+    private tunnel;
+    private proxyServer;
+    private publicUrl;
+    private readonly urlChangeHandlers;
+    private readonly deps;
+    constructor(deps?: Partial<CloudflareTunnelDeps>);
+    start(localPort: number): Promise<string>;
+    stop(): Promise<void>;
+    getPublicUrl(): string | null;
+    onUrlChange(handler: TunnelUrlChangeHandler): void;
+    isRunning(): boolean;
+    /**
+     * Start a lightweight HTTP proxy on a random port that only forwards
+     * requests with paths starting with ALLOWED_PATH_PREFIX to the main app.
+     * Everything else gets a 404.
+     */
+    private startProxyServer;
+    private stopProxyServer;
+    private stopTunnel;
+    private notifyUrlChange;
+}
+//# sourceMappingURL=cloudflare-tunnel.service.d.ts.map

package/dist/packages/core/src/infrastructure/services/tunnel/cloudflare-tunnel.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-tunnel.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/tunnel/cloudflare-tunnel.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACvB,MAAM,wEAAwE,CAAC;AAMhF,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACvD,EAAE,CACA,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,CAAC,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAC1E,IAAI,CAAC;IACR,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1D,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC;IACvF,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,IAAI,IAAI,IAAI,CAAC;CACd;AAWD,qBAAa,uBAAwB,YAAW,cAAc;IAC5D,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAClE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;gBAEhC,IAAI,GAAE,OAAO,CAAC,oBAAoB,CAAM;IAI9C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuEzC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,WAAW,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAIlD,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA0DxB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,eAAe;CAgBxB"}

package/dist/packages/core/src/infrastructure/services/tunnel/cloudflare-tunnel.service.js

@@ -0,0 +1,203 @@
+/**
+ * Cloudflare Tunnel Service
+ *
+ * Manages a `cloudflared` quick-tunnel that exposes ONLY the webhook
+ * API routes to the public internet via a random *.trycloudflare.com
+ * subdomain.
+ *
+ * Uses the `cloudflared` npm package which handles binary installation
+ * and provides a typed Tunnel API — no need for the user to install
+ * cloudflared separately.
+ *
+ * Security: A lightweight proxy HTTP server is started on a random port
+ * that only forwards requests matching the allowed path prefix
+ * (/api/webhooks) to the main app. The tunnel connects to this proxy,
+ * not the main app server. All other paths return 404.
+ */
+import { createServer, request as httpRequest } from 'node:http';
+const TAG = '[CloudflareTunnel]';
+const STARTUP_TIMEOUT_MS = 30_000;
+const ALLOWED_PATH_PREFIX = '/api/webhooks';
+async function defaultCreateTunnel(origin) {
+    const { Tunnel } = await import('cloudflared');
+    return Tunnel.quick(origin);
+}
+const defaultDeps = {
+    createTunnel: defaultCreateTunnel,
+};
+export class CloudflareTunnelService {
+    tunnel = null;
+    proxyServer = null;
+    publicUrl = null;
+    urlChangeHandlers = [];
+    deps;
+    constructor(deps = {}) {
+        this.deps = { ...defaultDeps, ...deps };
+    }
+    async start(localPort) {
+        if (this.tunnel) {
+            throw new Error(`${TAG} Tunnel already running at ${this.publicUrl}`);
+        }
+        // Start a proxy server that only forwards webhook routes
+        const proxyPort = await this.startProxyServer(localPort);
+        let tunnel;
+        try {
+            tunnel = await Promise.resolve(this.deps.createTunnel(`http://localhost:${proxyPort}`));
+        }
+        catch (err) {
+            this.stopProxyServer();
+            throw new Error(`${TAG} Failed to create tunnel: ${err.message}`);
+        }
+        this.tunnel = tunnel;
+        return new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                this.stopTunnel();
+                reject(new Error(`${TAG} Timed out waiting for tunnel URL (${STARTUP_TIMEOUT_MS}ms)`));
+            }, STARTUP_TIMEOUT_MS);
+            tunnel.on('url', (url) => {
+                if (!this.publicUrl) {
+                    // First URL — startup complete
+                    this.publicUrl = url;
+                    clearTimeout(timeout);
+                    // eslint-disable-next-line no-console
+                    console.log(`${TAG} Tunnel ready: ${url} (proxying ${ALLOWED_PATH_PREFIX}/* to port ${localPort})`);
+                    resolve(url);
+                }
+                else if (url !== this.publicUrl) {
+                    // URL changed — reconnection with new subdomain
+                    const oldUrl = this.publicUrl;
+                    this.publicUrl = url;
+                    // eslint-disable-next-line no-console
+                    console.log(`${TAG} Tunnel URL changed: ${oldUrl} -> ${url}`);
+                    this.notifyUrlChange(url);
+                }
+            });
+            tunnel.on('error', (err) => {
+                clearTimeout(timeout);
+                this.tunnel = null;
+                this.publicUrl = null;
+                this.stopProxyServer();
+                reject(new Error(`${TAG} Failed to start tunnel: ${err.message}`));
+            });
+            tunnel.on('exit', (code) => {
+                clearTimeout(timeout);
+                if (this.tunnel === tunnel) {
+                    this.tunnel = null;
+                    const wasRunning = this.publicUrl !== null;
+                    this.publicUrl = null;
+                    this.stopProxyServer();
+                    if (wasRunning) {
+                        // eslint-disable-next-line no-console
+                        console.log(`${TAG} Tunnel process exited (code ${code})`);
+                    }
+                    else {
+                        reject(new Error(`${TAG} cloudflared exited with code ${code} before producing a URL`));
+                    }
+                }
+            });
+        });
+    }
+    async stop() {
+        this.stopTunnel();
+        this.publicUrl = null;
+    }
+    getPublicUrl() {
+        return this.publicUrl;
+    }
+    onUrlChange(handler) {
+        this.urlChangeHandlers.push(handler);
+    }
+    isRunning() {
+        return this.tunnel !== null && this.publicUrl !== null;
+    }
+    /**
+     * Start a lightweight HTTP proxy on a random port that only forwards
+     * requests with paths starting with ALLOWED_PATH_PREFIX to the main app.
+     * Everything else gets a 404.
+     */
+    startProxyServer(targetPort) {
+        return new Promise((resolve, reject) => {
+            const server = createServer((req, res) => {
+                const url = req.url ?? '';
+                if (!url.startsWith(ALLOWED_PATH_PREFIX)) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Not found' }));
+                    return;
+                }
+                // Proxy the request to the main app
+                const proxyReq = httpRequest({
+                    hostname: 'localhost',
+                    port: targetPort,
+                    path: url,
+                    method: req.method,
+                    headers: req.headers,
+                }, (proxyRes) => {
+                    res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+                    proxyRes.pipe(res);
+                });
+                proxyReq.on('error', (err) => {
+                    // eslint-disable-next-line no-console
+                    console.warn(`${TAG} Proxy error: ${err.message}`);
+                    if (!res.headersSent) {
+                        res.writeHead(502, { 'Content-Type': 'application/json' });
+                    }
+                    res.end(JSON.stringify({ error: 'Bad gateway' }));
+                });
+                req.pipe(proxyReq);
+            });
+            // Listen on port 0 = OS assigns a random available port
+            server.listen(0, '127.0.0.1', () => {
+                const addr = server.address();
+                if (addr && typeof addr === 'object') {
+                    this.proxyServer = server;
+                    // eslint-disable-next-line no-console
+                    console.log(`${TAG} Webhook proxy listening on port ${addr.port}`);
+                    resolve(addr.port);
+                }
+                else {
+                    server.close();
+                    reject(new Error(`${TAG} Failed to start proxy server`));
+                }
+            });
+            server.on('error', (err) => {
+                reject(new Error(`${TAG} Proxy server error: ${err.message}`));
+            });
+        });
+    }
+    stopProxyServer() {
+        if (this.proxyServer) {
+            this.proxyServer.close();
+            this.proxyServer = null;
+        }
+    }
+    stopTunnel() {
+        if (this.tunnel) {
+            const tunnel = this.tunnel;
+            this.tunnel = null;
+            try {
+                tunnel.stop();
+            }
+            catch {
+                // Tunnel already stopped
+            }
+        }
+        this.stopProxyServer();
+    }
+    notifyUrlChange(newUrl) {
+        for (const handler of this.urlChangeHandlers) {
+            try {
+                const result = handler(newUrl);
+                if (result instanceof Promise) {
+                    result.catch((err) => {
+                        // eslint-disable-next-line no-console
+                        console.warn(`${TAG} URL change handler failed:`, err);
+                    });
+                }
+            }
+            catch (err) {
+                // eslint-disable-next-line no-console
+                console.warn(`${TAG} URL change handler threw:`, err);
+            }
+        }
+    }
+}

package/dist/packages/core/src/infrastructure/services/webhook/github-webhook.service.d.ts

@@ -0,0 +1,75 @@
+/**
+ * GitHub Webhook Service
+ *
+ * Manages GitHub webhook registration and incoming event processing.
+ * Uses the GitHub CLI (`gh api`) for webhook CRUD operations.
+ *
+ * Webhook events supplement the existing PR sync polling:
+ * - Webhooks provide near-instant event delivery
+ * - Polling remains as a fallback for missed events
+ *
+ * Registered events: pull_request, check_suite, check_run
+ */
+import type { IWebhookService, WebhookEvent, WebhookValidationResult } from '../../../application/ports/output/services/webhook-service.interface.js';
+import type { IFeatureRepository } from '../../../application/ports/output/repositories/feature-repository.interface.js';
+import type { IGitPrService } from '../../../application/ports/output/services/git-pr-service.interface.js';
+import type { INotificationService } from '../../../application/ports/output/services/notification-service.interface.js';
+export type ExecFunction = (file: string, args: string[], options?: object) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export interface RegisteredWebhook {
+    repoFullName: string;
+    webhookId: number;
+    repositoryPath: string;
+}
+export type WebhookDeliveryStatus = 'success' | 'ignored' | 'error';
+export interface WebhookDeliveryRecord {
+    deliveryId: string;
+    eventType: string;
+    source: string;
+    receivedAt: string;
+    status: WebhookDeliveryStatus;
+    statusMessage: string;
+    durationMs: number;
+    payload: Record<string, unknown>;
+}
+export declare class GitHubWebhookService implements IWebhookService {
+    private readonly featureRepo;
+    private readonly gitPrService;
+    private readonly notificationService;
+    private readonly execFn;
+    private readonly registeredWebhooks;
+    private readonly deliveryHistory;
+    private webhookSecret;
+    constructor(featureRepo: IFeatureRepository, gitPrService: IGitPrService, notificationService: INotificationService, execFn: ExecFunction);
+    /**
+     * Get the webhook secret for signature validation.
+     * Exposed so the API route can validate incoming requests.
+     */
+    getSecret(): string;
+    /**
+     * Get the list of registered webhooks (for dashboard display).
+     */
+    getRegisteredWebhooks(): readonly RegisteredWebhook[];
+    /**
+     * Get recent delivery history (newest first).
+     */
+    getDeliveryHistory(): readonly WebhookDeliveryRecord[];
+    registerWebhooks(publicUrl: string): Promise<void>;
+    updateWebhookUrl(newUrl: string): Promise<void>;
+    removeWebhooks(): Promise<void>;
+    validateSignature(payload: string, signature: string, secret: string): WebhookValidationResult;
+    handleEvent(event: WebhookEvent): Promise<void>;
+    private recordDelivery;
+    private handlePullRequestEvent;
+    private handleCheckSuiteEvent;
+    private handleCheckRunEvent;
+    private findFeatureByPrOrBranch;
+    private findFeatureByBranch;
+    private updateFeaturePrStatus;
+    private updateFeatureCiStatus;
+    private registerWebhookForRepo;
+    private getRepoFullName;
+}
+//# sourceMappingURL=github-webhook.service.d.ts.map

package/dist/packages/core/src/infrastructure/services/webhook/github-webhook.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-webhook.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/webhook/github-webhook.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACZ,uBAAuB,EACxB,MAAM,yEAAyE,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wEAAwE,CAAC;AAC5G,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8EAA8E,CAAC;AASzH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuB;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,aAAa,CAAS;gBAG5B,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,aAAa,EAC3B,mBAAmB,EAAE,oBAAoB,EACzC,MAAM,EAAE,YAAY;IAStB;;;OAGG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,qBAAqB,IAAI,SAAS,iBAAiB,EAAE;IAIrD;;OAEG;IACH,kBAAkB,IAAI,SAAS,qBAAqB,EAAE;IAIhD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBlD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC/C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BrC,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,uBAAuB;IAgCxF,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IA4CrD,OAAO,CAAC,cAAc;YAOR,sBAAsB;YAsBtB,qBAAqB;YAiBrB,mBAAmB;YAoBnB,uBAAuB;YAWvB,mBAAmB;YAKnB,qBAAqB;YA6CrB,qBAAqB;YA4BrB,sBAAsB;YAqDtB,eAAe;CAe9B"}