@sideboard-ai/core 0.1.324 → 0.1.326

package/dist/{chunk-ODH3XHMI.js → chunk-C7HUCBX7.js}

@@ -4,7 +4,7 @@ import {
 import {
   getAbleTimeHost,
   isAbleTimeConnected
-} from "./chunk-EJ66LEKH.js";
+} from "./chunk-QPSKQP6E.js";
 
 // src/integrations/abletime-mcp.ts
 var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
@@ -153,7 +153,7 @@ function textsFromUnknown(value) {
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const rawToken = opts?.token ?? await import("./abletime-oauth-7EOSBEFM.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-OYGS2DAU.js").then((m) => m.ensureAbleTimeAccessToken());
   if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
@@ -224,9 +224,9 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
-  const rawToken = opts?.token ?? await import("./abletime-oauth-7EOSBEFM.js").then((m) => m.ensureAbleTimeAccessToken());
+  const rawToken = opts?.token ?? await import("./abletime-oauth-OYGS2DAU.js").then((m) => m.ensureAbleTimeAccessToken());
   if (rawToken && ableTimeUsesRest(rawToken)) {
-    const { callAbleTimeRestTool } = await import("./abletime-rest-KOKE7V4B.js");
+    const { callAbleTimeRestTool } = await import("./abletime-rest-BKYKNPTC.js");
     return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
   }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
@@ -242,7 +242,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
       return await call();
     }
     if (rawToken && ableTimeUsesRest(rawToken) && isAbleTimeRejectedCredential(message)) {
-      const { callAbleTimeRestTool } = await import("./abletime-rest-KOKE7V4B.js");
+      const { callAbleTimeRestTool } = await import("./abletime-rest-BKYKNPTC.js");
       return callAbleTimeRestTool(name, args, { ...opts, token: rawToken });
     }
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;

package/dist/{chunk-OIHRC2ZJ.js → chunk-D744HOI5.js}

@@ -471,6 +471,20 @@ function fromInclusiveInputUsage(opts) {
 function requestOccupancy(u) {
   return u.inputTokens + (u.cacheReadTokens ?? 0) + (u.cacheWriteTokens ?? 0);
 }
+function subtractUsage(total, part) {
+  if (!total) return null;
+  const cacheRead = Math.max(0, (total.cacheReadTokens ?? 0) - (part.cacheReadTokens ?? 0));
+  const cacheWrite = Math.max(0, (total.cacheWriteTokens ?? 0) - (part.cacheWriteTokens ?? 0));
+  return {
+    inputTokens: Math.max(0, total.inputTokens - part.inputTokens),
+    outputTokens: Math.max(0, total.outputTokens - part.outputTokens),
+    cacheReadTokens: cacheRead || void 0,
+    cacheWriteTokens: cacheWrite || void 0,
+    costUsd: total.costUsd != null && part.costUsd != null ? Math.max(0, total.costUsd - part.costUsd) : total.costUsd,
+    sessionCostUsd: total.sessionCostUsd,
+    lastRequestTokens: total.lastRequestTokens
+  };
+}
 function mergeUsage(a, b) {
   return {
     inputTokens: (a?.inputTokens ?? 0) + b.inputTokens,
@@ -517,10 +531,11 @@ function applyTurnUsage(current, incoming, scope = "request") {
         ...incoming.sessionCostUsd != null ? { sessionCostUsd: incoming.sessionCostUsd } : {}
       };
     }
+    const explicit = incoming.lastRequestTokens != null && incoming.lastRequestTokens > 0 ? incoming.lastRequestTokens : void 0;
     return {
       ...incoming,
       costUsd: incoming.costUsd ?? current?.costUsd,
-      lastRequestTokens: current?.lastRequestTokens ?? requestOccupancy(incoming),
+      lastRequestTokens: current?.lastRequestTokens ?? explicit,
       ...incoming.sessionCostUsd == null && current?.sessionCostUsd != null ? { sessionCostUsd: current.sessionCostUsd } : {}
     };
   }
@@ -562,7 +577,8 @@ function previousCostBaseline(messages) {
   }
   return {
     sessionCostUsd: lastSession ?? summed,
-    lastCostUsd: lastCost
+    lastCostUsd: lastCost,
+    hasSessionSnapshot: lastSession != null
   };
 }
 function turnCostUsdFromProviderSnapshot(opts) {
@@ -576,6 +592,9 @@ function turnCostUsdFromProviderSnapshot(opts) {
       if (session + USD_EPS >= previous) {
         return roundUsd(Math.max(0, session - previous));
       }
+      if (opts.previousHasSessionSnapshot) {
+        return roundUsd(session);
+      }
       if (last != null && session + USD_EPS >= last) {
         return roundUsd(Math.max(0, session - last));
       }
@@ -590,7 +609,8 @@ function withTurnScopedCost(usage, previousMessages) {
     reportedTurnCostUsd: usage.costUsd,
     sessionCostUsd: usage.sessionCostUsd,
     previousSessionCostUsd: baseline.sessionCostUsd,
-    previousLastCostUsd: baseline.lastCostUsd
+    previousLastCostUsd: baseline.lastCostUsd,
+    previousHasSessionSnapshot: baseline.hasSessionSnapshot
   });
   if (costUsd == null) {
     if (usage.costUsd == null) return usage;
@@ -2371,6 +2391,8 @@ export {
   formatViewerContextDirective,
   formatViewerContextReminder,
   fromInclusiveInputUsage,
+  requestOccupancy,
+  subtractUsage,
   sumUsageList,
   applyTurnUsage,
   contextTokens,

package/dist/chunk-DBKHL7NC.js

@@ -0,0 +1,214 @@
+import {
+  httpFetch
+} from "./chunk-JAT3JFOS.js";
+import {
+  ATTACHMENTS_DIR,
+  attachmentsGitignoreBody
+} from "./chunk-6K64FJDD.js";
+
+// src/integrations/issue-attachments.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { basename, extname, join } from "path";
+import { randomUUID } from "crypto";
+var ISSUE_ATTACHMENT_MAX_BYTES = 25 * 1024 * 1024;
+var MARKDOWN_IMAGE_RE = /!\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
+var MARKDOWN_LINK_RE = /(?<!!)\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
+var HTML_SRC_RE = /\b(?:src|href)\s*=\s*["'](https?:\/\/[^"']+)["']/gi;
+var BARE_URL_RE = /https?:\/\/[^\s<>"'`)]+/gi;
+var EXT_BY_MIME = {
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/jpg": ".jpg",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "image/svg+xml": ".svg",
+  "application/pdf": ".pdf",
+  "text/plain": ".txt",
+  "text/markdown": ".md",
+  "application/json": ".json",
+  "application/zip": ".zip"
+};
+function issueAttachmentWorktreePath(repoPath) {
+  const raw = (repoPath ?? "").trim();
+  return raw || process.cwd();
+}
+function ensureIssueAttachmentsDir(worktreePath) {
+  const dir = join(worktreePath, ATTACHMENTS_DIR);
+  mkdirSync(dir, { recursive: true });
+  const gi = join(dir, ".gitignore");
+  if (!existsSync(gi)) {
+    writeFileSync(gi, attachmentsGitignoreBody(), "utf8");
+  }
+  return dir;
+}
+function hostnameOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function hostMatches(url, suffixes) {
+  const host = hostnameOf(url);
+  if (!host) return false;
+  return suffixes.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+}
+function looksLikeHttpUrl(value) {
+  return /^https?:\/\//i.test(value.trim());
+}
+function looksLikeFileUrl(url) {
+  try {
+    const path = new URL(url).pathname;
+    return /\.[a-z0-9]{2,8}$/i.test(path);
+  } catch {
+    return false;
+  }
+}
+function filenameFromUrl(url, fallback = "attachment") {
+  try {
+    const parsed = new URL(url);
+    const last = decodeURIComponent(basename(parsed.pathname)).replace(/[/\\]/g, "_");
+    if (last && last !== "/" && last !== ".") return last;
+  } catch {
+  }
+  return fallback;
+}
+function filenameFromContentDisposition(header) {
+  if (!header) return void 0;
+  const star = header.match(/filename\*\s*=\s*(?:UTF-8''|utf-8'')([^;]+)/i);
+  if (star?.[1]) {
+    try {
+      return decodeURIComponent(star[1].trim().replace(/^["']|["']$/g, ""));
+    } catch {
+      return star[1].trim().replace(/^["']|["']$/g, "");
+    }
+  }
+  const plain = header.match(/filename\s*=\s*("(?:\\.|[^"])*"|[^;]+)/i);
+  if (!plain?.[1]) return void 0;
+  return plain[1].trim().replace(/^["']|["']$/g, "").replace(/\\"/g, '"');
+}
+function uniqueAttachmentFileName(dir, originalName) {
+  const safe = originalName.replace(/[/\\]/g, "_").replace(/^\.+/, "") || "file";
+  if (!existsSync(join(dir, safe))) return safe;
+  const ext = extname(safe);
+  const stem = ext ? safe.slice(0, -ext.length) : safe;
+  for (let i = 1; i < 1e4; i++) {
+    const candidate = `${stem}-${i}${ext}`;
+    if (!existsSync(join(dir, candidate))) return candidate;
+  }
+  return `${stem}-${randomUUID()}${ext}`;
+}
+function extractHttpUrls(markdown) {
+  const text = markdown ?? "";
+  if (!text.trim()) return [];
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (raw) => {
+    const url = raw.replace(/[).,;]+$/, "");
+    if (!looksLikeHttpUrl(url) || seen.has(url)) return;
+    seen.add(url);
+    found.push(url);
+  };
+  for (const re of [MARKDOWN_IMAGE_RE, MARKDOWN_LINK_RE, HTML_SRC_RE, BARE_URL_RE]) {
+    re.lastIndex = 0;
+    let match;
+    while (match = re.exec(text)) {
+      if (match[1]) push(match[1]);
+      else if (re === BARE_URL_RE) push(match[0]);
+    }
+  }
+  return found;
+}
+function mergeIssueAttachments(items) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of items) {
+    if (!item) continue;
+    const url = item.url.trim();
+    const id = item.id.trim() || url;
+    if (!id && !url) continue;
+    const key = url || id;
+    if (seen.has(key) || seen.has(id)) continue;
+    seen.add(key);
+    if (id !== key) seen.add(id);
+    out.push({
+      id: id || url,
+      name: item.name.trim() || filenameFromUrl(url),
+      url,
+      ...item.contentType ? { contentType: item.contentType } : {},
+      ...item.sourceType ? { sourceType: item.sourceType } : {}
+    });
+  }
+  return out;
+}
+function extensionForContentType(contentType, name) {
+  if (extname(name)) return name;
+  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+  const ext = EXT_BY_MIME[mime];
+  return ext ? `${name}${ext}` : name;
+}
+function assertNotHtml(contentType, url) {
+  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+  if (mime === "text/html" || mime === "application/xhtml+xml") {
+    throw new Error(
+      `Attachment at ${url} returned HTML, not a file. Use the listed file URL (uploads / user-attachments), not a ticket or PR page.`
+    );
+  }
+}
+async function downloadAuthenticatedFile(opts) {
+  const url = opts.url.trim();
+  if (!looksLikeHttpUrl(url)) {
+    throw new Error(`Attachment URL must be http(s) (got ${url || "empty"})`);
+  }
+  const res = await httpFetch(url, {
+    method: "GET",
+    redirect: "follow",
+    headers: {
+      Accept: "*/*",
+      ...opts.headers ?? {}
+    }
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `Attachment download failed ${res.status}${detail ? `: ${detail.slice(0, 200)}` : ""} (${url})`
+    );
+  }
+  const contentType = res.headers.get("content-type") ?? void 0;
+  assertNotHtml(contentType, url);
+  const lengthHeader = res.headers.get("content-length");
+  if (lengthHeader) {
+    const length = Number(lengthHeader);
+    if (Number.isFinite(length) && length > ISSUE_ATTACHMENT_MAX_BYTES) {
+      throw new Error(
+        `Attachment is ${length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
+      );
+    }
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > ISSUE_ATTACHMENT_MAX_BYTES) {
+    throw new Error(
+      `Attachment is ${buf.length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
+    );
+  }
+  const dir = ensureIssueAttachmentsDir(opts.worktreePath);
+  const hinted = opts.name?.trim() || filenameFromContentDisposition(res.headers.get("content-disposition")) || filenameFromUrl(url);
+  const name = uniqueAttachmentFileName(dir, extensionForContentType(contentType, hinted));
+  writeFileSync(join(dir, name), buf);
+  return {
+    name,
+    path: `${ATTACHMENTS_DIR}/${name}`,
+    bytes: buf.length,
+    ...contentType ? { contentType } : {}
+  };
+}
+
+export {
+  issueAttachmentWorktreePath,
+  hostMatches,
+  looksLikeHttpUrl,
+  looksLikeFileUrl,
+  extractHttpUrls,
+  mergeIssueAttachments,
+  downloadAuthenticatedFile
+};

package/dist/chunk-F6GE7V3Q.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+
+import {
+  ATTACHMENTS_DIR,
+  attachmentsGitignoreBody
+} from "./chunk-N2WW62LF.js";
+import {
+  httpFetch
+} from "./chunk-2GPQZZLY.js";
+
+// src/integrations/issue-attachments.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { basename, extname, join } from "path";
+import { randomUUID } from "crypto";
+var ISSUE_ATTACHMENT_MAX_BYTES = 25 * 1024 * 1024;
+var MARKDOWN_IMAGE_RE = /!\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
+var MARKDOWN_LINK_RE = /(?<!!)\[[^\]]*]\(\s*<?(https?:\/\/[^)\s>]+)>?/gi;
+var HTML_SRC_RE = /\b(?:src|href)\s*=\s*["'](https?:\/\/[^"']+)["']/gi;
+var BARE_URL_RE = /https?:\/\/[^\s<>"'`)]+/gi;
+var EXT_BY_MIME = {
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/jpg": ".jpg",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "image/svg+xml": ".svg",
+  "application/pdf": ".pdf",
+  "text/plain": ".txt",
+  "text/markdown": ".md",
+  "application/json": ".json",
+  "application/zip": ".zip"
+};
+function issueAttachmentWorktreePath(repoPath) {
+  const raw = (repoPath ?? "").trim();
+  return raw || process.cwd();
+}
+function ensureIssueAttachmentsDir(worktreePath) {
+  const dir = join(worktreePath, ATTACHMENTS_DIR);
+  mkdirSync(dir, { recursive: true });
+  const gi = join(dir, ".gitignore");
+  if (!existsSync(gi)) {
+    writeFileSync(gi, attachmentsGitignoreBody(), "utf8");
+  }
+  return dir;
+}
+function hostnameOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function hostMatches(url, suffixes) {
+  const host = hostnameOf(url);
+  if (!host) return false;
+  return suffixes.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+}
+function looksLikeHttpUrl(value) {
+  return /^https?:\/\//i.test(value.trim());
+}
+function looksLikeFileUrl(url) {
+  try {
+    const path = new URL(url).pathname;
+    return /\.[a-z0-9]{2,8}$/i.test(path);
+  } catch {
+    return false;
+  }
+}
+function filenameFromUrl(url, fallback = "attachment") {
+  try {
+    const parsed = new URL(url);
+    const last = decodeURIComponent(basename(parsed.pathname)).replace(/[/\\]/g, "_");
+    if (last && last !== "/" && last !== ".") return last;
+  } catch {
+  }
+  return fallback;
+}
+function filenameFromContentDisposition(header) {
+  if (!header) return void 0;
+  const star = header.match(/filename\*\s*=\s*(?:UTF-8''|utf-8'')([^;]+)/i);
+  if (star?.[1]) {
+    try {
+      return decodeURIComponent(star[1].trim().replace(/^["']|["']$/g, ""));
+    } catch {
+      return star[1].trim().replace(/^["']|["']$/g, "");
+    }
+  }
+  const plain = header.match(/filename\s*=\s*("(?:\\.|[^"])*"|[^;]+)/i);
+  if (!plain?.[1]) return void 0;
+  return plain[1].trim().replace(/^["']|["']$/g, "").replace(/\\"/g, '"');
+}
+function uniqueAttachmentFileName(dir, originalName) {
+  const safe = originalName.replace(/[/\\]/g, "_").replace(/^\.+/, "") || "file";
+  if (!existsSync(join(dir, safe))) return safe;
+  const ext = extname(safe);
+  const stem = ext ? safe.slice(0, -ext.length) : safe;
+  for (let i = 1; i < 1e4; i++) {
+    const candidate = `${stem}-${i}${ext}`;
+    if (!existsSync(join(dir, candidate))) return candidate;
+  }
+  return `${stem}-${randomUUID()}${ext}`;
+}
+function extractHttpUrls(markdown) {
+  const text = markdown ?? "";
+  if (!text.trim()) return [];
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (raw) => {
+    const url = raw.replace(/[).,;]+$/, "");
+    if (!looksLikeHttpUrl(url) || seen.has(url)) return;
+    seen.add(url);
+    found.push(url);
+  };
+  for (const re of [MARKDOWN_IMAGE_RE, MARKDOWN_LINK_RE, HTML_SRC_RE, BARE_URL_RE]) {
+    re.lastIndex = 0;
+    let match;
+    while (match = re.exec(text)) {
+      if (match[1]) push(match[1]);
+      else if (re === BARE_URL_RE) push(match[0]);
+    }
+  }
+  return found;
+}
+function mergeIssueAttachments(items) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of items) {
+    if (!item) continue;
+    const url = item.url.trim();
+    const id = item.id.trim() || url;
+    if (!id && !url) continue;
+    const key = url || id;
+    if (seen.has(key) || seen.has(id)) continue;
+    seen.add(key);
+    if (id !== key) seen.add(id);
+    out.push({
+      id: id || url,
+      name: item.name.trim() || filenameFromUrl(url),
+      url,
+      ...item.contentType ? { contentType: item.contentType } : {},
+      ...item.sourceType ? { sourceType: item.sourceType } : {}
+    });
+  }
+  return out;
+}
+function extensionForContentType(contentType, name) {
+  if (extname(name)) return name;
+  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+  const ext = EXT_BY_MIME[mime];
+  return ext ? `${name}${ext}` : name;
+}
+function assertNotHtml(contentType, url) {
+  const mime = (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+  if (mime === "text/html" || mime === "application/xhtml+xml") {
+    throw new Error(
+      `Attachment at ${url} returned HTML, not a file. Use the listed file URL (uploads / user-attachments), not a ticket or PR page.`
+    );
+  }
+}
+async function downloadAuthenticatedFile(opts) {
+  const url = opts.url.trim();
+  if (!looksLikeHttpUrl(url)) {
+    throw new Error(`Attachment URL must be http(s) (got ${url || "empty"})`);
+  }
+  const res = await httpFetch(url, {
+    method: "GET",
+    redirect: "follow",
+    headers: {
+      Accept: "*/*",
+      ...opts.headers ?? {}
+    }
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `Attachment download failed ${res.status}${detail ? `: ${detail.slice(0, 200)}` : ""} (${url})`
+    );
+  }
+  const contentType = res.headers.get("content-type") ?? void 0;
+  assertNotHtml(contentType, url);
+  const lengthHeader = res.headers.get("content-length");
+  if (lengthHeader) {
+    const length = Number(lengthHeader);
+    if (Number.isFinite(length) && length > ISSUE_ATTACHMENT_MAX_BYTES) {
+      throw new Error(
+        `Attachment is ${length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
+      );
+    }
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > ISSUE_ATTACHMENT_MAX_BYTES) {
+    throw new Error(
+      `Attachment is ${buf.length} bytes; max is ${ISSUE_ATTACHMENT_MAX_BYTES} (${url})`
+    );
+  }
+  const dir = ensureIssueAttachmentsDir(opts.worktreePath);
+  const hinted = opts.name?.trim() || filenameFromContentDisposition(res.headers.get("content-disposition")) || filenameFromUrl(url);
+  const name = uniqueAttachmentFileName(dir, extensionForContentType(contentType, hinted));
+  writeFileSync(join(dir, name), buf);
+  return {
+    name,
+    path: `${ATTACHMENTS_DIR}/${name}`,
+    bytes: buf.length,
+    ...contentType ? { contentType } : {}
+  };
+}
+
+export {
+  issueAttachmentWorktreePath,
+  hostMatches,
+  looksLikeHttpUrl,
+  looksLikeFileUrl,
+  extractHttpUrls,
+  mergeIssueAttachments,
+  downloadAuthenticatedFile
+};

package/dist/{chunk-JE3JLHMO.js → chunk-FWVUGLBG.js}

@@ -5,7 +5,7 @@ import {
   resolveGithubRepoSlug,
   resolveOriginRemote,
   resolveRepoRoot
-} from "./chunk-FUFNMUNR.js";
+} from "./chunk-KECHK3ZT.js";
 import {
   allocateTeamName,
   createEmptyThread,
@@ -14,7 +14,7 @@ import {
   teamSlugFromName,
   updateThread,
   writeThread
-} from "./chunk-IFWGG2M2.js";
+} from "./chunk-ZSHS46V5.js";
 import {
   ATTACHMENTS_DIR,
   attachmentsGitignoreBody
@@ -31,7 +31,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-EJ66LEKH.js";
+} from "./chunk-QPSKQP6E.js";
 import {
   appDataDir,
   globalAgentCwd,