@skaile/workspaces 0.28.1 → 0.29.1

package/dist/{chunk-XHBPQ7QP.js → chunk-OTFG5Q7H.js}

@@ -1,5 +1,5 @@
 import { renderWebDAVConfig, renderOneDriveConfig, renderGoogleDriveConfig } from './chunk-OVRSNIKJ.js';
-import { resolveAuthRef, resolveAuth } from './chunk-DGM74UP4.js';
+import { resolveAuthRef, resolveAuth, resolveMountCredentialString } from './chunk-CMG3GJ6B.js';
 import { createFsWatcher, RcloneProcessManager, ensureDirMode, PortPool } from './chunk-QMONOHXT.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeFlowStateFromSnapshots } from './chunk-W7W66MDZ.js';
@@ -103,6 +103,14 @@ function hasChanges(cwd) {
   const status = git("status --porcelain", cwd);
   return status.length > 0;
 }
+function localBranchExists(branch, cwd) {
+  try {
+    git(`rev-parse --verify --quiet refs/heads/${branch}`, cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isDirEmpty(dir) {
   try {
     return readdirSync(dir).length === 0;
@@ -203,37 +211,42 @@ var GitConnector = class extends AbstractConnector {
       if (!isValidGitRefOrSha(sessionBranch)) {
         throw new Error(`Git connector: invalid session branch name "${sessionBranch}"`);
       }
-      try {
-        git(`rev-parse --verify origin/${sessionBranch}`, targetDir);
-        git(`checkout -B ${sessionBranch} origin/${sessionBranch}`, targetDir);
-      } catch {
-        let anchored = false;
-        if (session.fromRef) {
-          if (!isValidGitRefOrSha(session.fromRef)) {
-            this.log.warn("fromRef rejected by refname validation, falling back to base branch", {
-              sessionBranch,
-              fromRef: session.fromRef
-            });
-          } else {
-            try {
-              git(`fetch origin ${session.fromRef}`, targetDir);
-              git(`checkout -b ${sessionBranch} FETCH_HEAD`, targetDir);
-              anchored = true;
-              this.log.info("session branch created from fromRef", {
+      if (localBranchExists(sessionBranch, targetDir)) {
+        git(`checkout ${sessionBranch}`, targetDir);
+        this.log.info("reusing existing local session branch", { sessionBranch });
+      } else {
+        try {
+          git(`rev-parse --verify origin/${sessionBranch}`, targetDir);
+          git(`checkout -B ${sessionBranch} origin/${sessionBranch}`, targetDir);
+        } catch {
+          let anchored = false;
+          if (session.fromRef) {
+            if (!isValidGitRefOrSha(session.fromRef)) {
+              this.log.warn("fromRef rejected by refname validation, falling back to base branch", {
                 sessionBranch,
                 fromRef: session.fromRef
               });
-            } catch (err) {
-              this.log.warn("fromRef fetch failed, falling back to base branch", {
-                sessionBranch,
-                fromRef: session.fromRef,
-                error: err instanceof Error ? err.message : String(err)
-              });
+            } else {
+              try {
+                git(`fetch origin ${session.fromRef}`, targetDir);
+                git(`checkout -b ${sessionBranch} FETCH_HEAD`, targetDir);
+                anchored = true;
+                this.log.info("session branch created from fromRef", {
+                  sessionBranch,
+                  fromRef: session.fromRef
+                });
+              } catch (err) {
+                this.log.warn("fromRef fetch failed, falling back to base branch", {
+                  sessionBranch,
+                  fromRef: session.fromRef,
+                  error: err instanceof Error ? err.message : String(err)
+                });
+              }
             }
           }
-        }
-        if (!anchored) {
-          git(`checkout -b ${sessionBranch}`, targetDir);
+          if (!anchored) {
+            git(`checkout -b ${sessionBranch}`, targetDir);
+          }
         }
       }
       syncSubmodules(targetDir);
@@ -1192,7 +1205,10 @@ var S3Connector = class extends AbstractConnector {
 function createConnector4(sdkOverride) {
   return new S3Connector(sdkOverride);
 }
-var CACHE_BASE = "/var/cache/skaile";
+var DEFAULT_CACHE_BASE = "/var/cache/skaile";
+function cacheBase() {
+  return process.env.SKAILE_RCLONE_CACHE_BASE ?? DEFAULT_CACHE_BASE;
+}
 var ALLOWED_VENDORS = /* @__PURE__ */ new Set([
   "nextcloud",
   "owncloud",
@@ -1202,6 +1218,13 @@ var ALLOWED_VENDORS = /* @__PURE__ */ new Set([
 ]);
 var execFileP = promisify(execFile);
 var WebDAVConnector = class extends AbstractConnector {
+  // Injectable so tests can stub the `rclone obscure` shell-out; production
+  // wires the real binary via createConnector().
+  constructor(obscure = obscurePassword) {
+    super();
+    this.obscure = obscure;
+  }
+  obscure;
   name = "webdav";
   rclone = new RcloneProcessManager();
   filesystem = {
@@ -1216,6 +1239,7 @@ var WebDAVConnector = class extends AbstractConnector {
       throw new Error("WebDAVConnector requires ctx.mountTarget to be set by the manager");
     }
     const secrets = ctx.secrets;
+    const tokenMediator = ctx.tokenMediator;
     const opts = declaration.options;
     this.log.info("mount called", {
       optionKeys: opts ? Object.keys(opts) : [],
@@ -1246,11 +1270,12 @@ var WebDAVConnector = class extends AbstractConnector {
     const vendor = vendorRaw;
     const basePath = String(opts?.basePath ?? "").replace(/^\/+|\/+$/g, "");
     const remotePath = basePath.length > 0 ? `/${basePath}` : "/";
-    const auth = parseAuth(resolveAuth(declaration.auth, secrets));
-    const obscuredPassword = auth.password ? await obscurePassword(auth.password) : null;
+    const auth = parseAuth(await resolveMountCredentialString(declaration, secrets, tokenMediator));
+    const obscuredPassword = auth.password ? await this.obscure(auth.password) : null;
     const remoteName = `skaile-${declaration.id}`;
     const remote = `${remoteName}:${remotePath}`;
-    const cacheDir = `${CACHE_BASE}/${declaration.id}`;
+    const base = cacheBase();
+    const cacheDir = `${base}/${declaration.id}`;
     const vfsCacheMode = declaration.access === "read-only" ? "minimal" : "full";
     this.log.info("mount params resolved", {
       url,
@@ -1268,7 +1293,7 @@ var WebDAVConnector = class extends AbstractConnector {
       obscuredPassword,
       bearerToken: auth.bearerToken
     });
-    await ensureDirMode(CACHE_BASE, this.log);
+    await ensureDirMode(base, this.log);
     await ensureDirMode(cacheDir, this.log);
     await ensureDirMode(targetDir, this.log);
     const cacheMaxSize = opts?.cacheMaxSize !== void 0 ? String(opts.cacheMaxSize) : void 0;
@@ -1367,9 +1392,9 @@ async function obscurePassword(plain) {
 }
 
 // factory-assets/connectors/sharepoint/driver.ts
-var DEFAULT_CACHE_BASE = "/var/cache/skaile";
-function cacheBase() {
-  return process.env.SKAILE_RCLONE_CACHE_BASE ?? DEFAULT_CACHE_BASE;
+var DEFAULT_CACHE_BASE2 = "/var/cache/skaile";
+function cacheBase2() {
+  return process.env.SKAILE_RCLONE_CACHE_BASE ?? DEFAULT_CACHE_BASE2;
 }
 var SharePointConnector = class extends AbstractConnector {
   name = "sharepoint";
@@ -1386,6 +1411,7 @@ var SharePointConnector = class extends AbstractConnector {
       throw new Error("SharePointConnector requires ctx.mountTarget to be set by the manager");
     }
     const secrets = ctx.secrets;
+    const tokenMediator = ctx.tokenMediator;
     const opts = declaration.options;
     this.log.info("mount called", {
       optionKeys: opts ? Object.keys(opts) : []
@@ -1413,14 +1439,19 @@ var SharePointConnector = class extends AbstractConnector {
       );
     }
     const basePath = String(opts?.basePath ?? "").replace(/^\/+|\/+$/g, "");
-    const auth = parseAuthBlob(resolveAuth(declaration.auth, secrets), this.log);
+    const auth = parseAuthBlob(
+      await resolveMountCredentialString(declaration, secrets, tokenMediator),
+      this.log
+    );
     if (!auth.accessToken) {
-      throw new Error("SharePoint connector requires auth token (e.g. auth: env:SHAREPOINT_TOKEN)");
+      throw new Error(
+        "SharePoint connector: no access token resolved. Use 'auth: backend' (platform) or 'auth: env:SHAREPOINT_TOKEN' (standalone)."
+      );
     }
     const remoteName = `skaile-${declaration.id}`;
     const remotePath = buildRemotePath(folderPath, basePath);
     const remote = `${remoteName}:${remotePath}`;
-    const base = cacheBase();
+    const base = cacheBase2();
     const cacheDir = `${base}/${declaration.id}`;
     const vfsCacheMode = declaration.access === "read-only" ? "minimal" : "full";
     this.log.info("mount params resolved", {
@@ -1552,7 +1583,10 @@ function buildRemotePath(folderPath, basePath) {
 }
 
 // factory-assets/connectors/googledrive/driver.ts
-var CACHE_BASE2 = "/var/cache/skaile";
+var DEFAULT_CACHE_BASE3 = "/var/cache/skaile";
+function cacheBase3() {
+  return process.env.SKAILE_RCLONE_CACHE_BASE ?? DEFAULT_CACHE_BASE3;
+}
 var ALLOWED_SCOPES = /* @__PURE__ */ new Set([
   "drive",
   "drive.readonly",
@@ -1575,6 +1609,7 @@ var GoogleDriveConnector = class extends AbstractConnector {
       throw new Error("GoogleDriveConnector requires ctx.mountTarget to be set by the manager");
     }
     const secrets = ctx.secrets;
+    const tokenMediator = ctx.tokenMediator;
     const opts = declaration.options;
     this.log.info("mount called", {
       optionKeys: opts ? Object.keys(opts) : []
@@ -1598,10 +1633,13 @@ var GoogleDriveConnector = class extends AbstractConnector {
       );
     }
     const scope = scopeRaw;
-    const auth = parseAuthBlob2(resolveAuth(declaration.auth, secrets), this.log);
+    const auth = parseAuthBlob2(
+      await resolveMountCredentialString(declaration, secrets, tokenMediator),
+      this.log
+    );
     if (!auth.accessToken && !auth.serviceAccountFile) {
       throw new Error(
-        "Google Drive connector requires auth token or serviceAccountFile (e.g. auth: env:GDRIVE_TOKEN)"
+        "Google Drive connector: no access token or serviceAccountFile resolved. Use 'auth: backend' (platform) or 'auth: env:GDRIVE_TOKEN' (standalone)."
       );
     }
     const rootFolderId = opts?.rootFolderId !== void 0 ? String(opts.rootFolderId) : null;
@@ -1610,7 +1648,8 @@ var GoogleDriveConnector = class extends AbstractConnector {
     const remoteName = `skaile-${declaration.id}`;
     const remotePath = basePath.length > 0 ? `/${basePath}` : "/";
     const remote = `${remoteName}:${remotePath}`;
-    const cacheDir = `${CACHE_BASE2}/${declaration.id}`;
+    const base = cacheBase3();
+    const cacheDir = `${base}/${declaration.id}`;
     const vfsCacheMode = declaration.access === "read-only" ? "minimal" : "full";
     this.log.info("mount params resolved", {
       scope,
@@ -1633,7 +1672,7 @@ var GoogleDriveConnector = class extends AbstractConnector {
       teamDrive,
       serviceAccountFile: auth.serviceAccountFile
     });
-    await ensureDirMode(CACHE_BASE2, this.log);
+    await ensureDirMode(base, this.log);
     await ensureDirMode(cacheDir, this.log);
     await ensureDirMode(targetDir, this.log);
     const cacheMaxSize = opts?.cacheMaxSize !== void 0 ? String(opts.cacheMaxSize) : void 0;
@@ -7795,6 +7834,6 @@ function createConnector() {
   return new FlowAdapter();
 }
 
-export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, parseAuthBlob2 as parseAuthBlob, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
-//# sourceMappingURL=chunk-XHBPQ7QP.js.map
-//# sourceMappingURL=chunk-XHBPQ7QP.js.map
+export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
+//# sourceMappingURL=chunk-OTFG5Q7H.js.map
+//# sourceMappingURL=chunk-OTFG5Q7H.js.map