@skaile/workspaces 0.45.0 → 0.47.0

package/dist/{chunk-LMRO2QNF.js → chunk-XUUMKMMJ.js}

@@ -1,11 +1,11 @@
 import { renderGoogleDriveConfig, renderOneDriveConfig, renderWebDAVConfig } from './chunk-OVRSNIKJ.js';
-import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-CBZEIFU4.js';
-import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-FYLIR4AV.js';
+import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-DDR4OSSM.js';
+import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-4OCZBSBY.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeFlowStateFromSnapshots } from './chunk-X46FY45B.js';
 import { renderStimulusPrompt } from './chunk-DEYYRFQU.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
-import { portableSpawn } from './chunk-BLGHFVXE.js';
+import { portableSpawn } from './chunk-G3GODNHM.js';
 import { createLogger } from './chunk-JB35MVBN.js';
 import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, cpSync, statSync, createReadStream, readdirSync, openSync, writeSync, closeSync, chmodSync } from 'fs';
 import path2, { join, dirname, resolve, sep } from 'path';
@@ -814,6 +814,46 @@ function hasChanges(cwd) {
   const status = git("status --porcelain", cwd);
   return status.length > 0;
 }
+function gitOrNull(cmd, cwd) {
+  try {
+    return git(cmd, cwd);
+  } catch {
+    return null;
+  }
+}
+function countAheadBehind(cwd, remoteRef) {
+  const out = gitOrNull(`rev-list --left-right --count ${remoteRef}...HEAD`, cwd);
+  if (!out) {
+    return { ahead: 0, behind: 0 };
+  }
+  const parts = out.split(/\s+/);
+  const behind = Number.parseInt(parts[0] ?? "0", 10);
+  const ahead = Number.parseInt(parts[1] ?? "0", 10);
+  return {
+    ahead: Number.isFinite(ahead) ? ahead : 0,
+    behind: Number.isFinite(behind) ? behind : 0
+  };
+}
+function readGitSyncStatus(cwd, baseBranch) {
+  const branchRaw = gitOrNull("rev-parse --abbrev-ref HEAD", cwd);
+  const branch = branchRaw && branchRaw !== "HEAD" ? branchRaw : null;
+  const dirty = (gitOrNull("status --porcelain", cwd) ?? "") !== "";
+  const hasUpstream = branch !== null && gitOrNull("rev-parse --abbrev-ref @{upstream}", cwd) !== null;
+  const upstream = countAheadBehind(cwd, "@{upstream}");
+  const baseRef = isValidGitRefOrSha(baseBranch) ? `origin/${baseBranch}` : "origin/main";
+  const base = countAheadBehind(cwd, baseRef);
+  const commitSha = gitOrNull("rev-parse HEAD", cwd);
+  return {
+    branch,
+    dirty,
+    ahead: upstream.ahead,
+    behind: upstream.behind,
+    hasUpstream,
+    mainAhead: base.ahead,
+    mainBehind: base.behind,
+    commitSha
+  };
+}
 function localBranchExists(branch, cwd) {
   try {
     git(`rev-parse --verify --quiet refs/heads/${branch}`, cwd);
@@ -849,6 +889,35 @@ var GitConnector = class extends AbstractConnector {
       return this._sync(handle, options);
     }
   };
+  tools = {
+    describeOperations: (handle) => this._describeOperations(handle),
+    executeOp: (handle, operation, args) => this._executeOp(handle, operation, args)
+  };
+  _describeOperations(_handle) {
+    return [
+      {
+        name: "sync_status",
+        description: "Report git sync status for this mount: current branch, dirty flag, ahead/behind vs the upstream, whether the branch has a configured upstream (never-pushed when false), and divergence vs the base branch. Read-only; performs no fetch.",
+        accessLevel: "read",
+        args: [],
+        examples: ["sync_status"]
+      }
+    ];
+  }
+  async _executeOp(handle, operation, _args) {
+    switch (operation) {
+      case "sync_status": {
+        const cwd = handle.mountPath;
+        if (!cwd) {
+          throw new Error("git sync_status: mount path unavailable");
+        }
+        const state = handle.state;
+        return JSON.stringify(readGitSyncStatus(cwd, state.branch));
+      }
+      default:
+        throw new Error(`GitConnector has no operation: ${operation}`);
+    }
+  }
   async connect(declaration, ctx) {
     const targetDir = ctx.mountTarget;
     if (!targetDir) {
@@ -902,6 +971,11 @@ var GitConnector = class extends AbstractConnector {
         throw err;
       }
     }
+    if (state.managedGitconfig) {
+      this.stripRemoteInlineToken(targetDir);
+    } else {
+      this.rebakeRemoteAuth(targetDir, state);
+    }
     this.log.info("mount ok", {
       targetDir,
       activeBranch: state.activeBranch,
@@ -1646,6 +1720,45 @@ var GitConnector = class extends AbstractConnector {
     }
     return s.url;
   }
+  /**
+   * Rewrite `origin` to drop any inline `user:password@` credentials, leaving
+   * a bare https(s) URL. Tier-2 only: the managed credential helper supplies
+   * (and refreshes) the token, but git ignores helpers when the URL already
+   * carries creds — so the baked-in token must go. Best-effort: a missing
+   * origin or a non-http(s) remote (e.g. file:// in tests) is left untouched.
+   */
+  stripRemoteInlineToken(targetDir) {
+    try {
+      const current = git("remote get-url origin", targetDir, 5e3);
+      if (!current.startsWith("https://") && !current.startsWith("http://")) return;
+      const u = new URL(current);
+      if (!u.username && !u.password) return;
+      u.username = "";
+      u.password = "";
+      git(`remote set-url origin ${u.toString()}`, targetDir, 5e3);
+    } catch (err) {
+      this.log.warn("managed-gitconfig: failed to strip inline token from origin", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  /**
+   * Tier-1 only: rewrite `origin` so it carries the token freshly minted on
+   * this connect. The "use as-is" wake path leaves whatever token the first
+   * connect baked in — long-dead for short-lived (GitHub App) tokens. Without
+   * a Tier-2 helper this URL token is the sole credential, so it must be
+   * refreshed here. No-op for anonymous (no token) or non-https remotes.
+   */
+  rebakeRemoteAuth(targetDir, state) {
+    if (!state.token || !state.url.startsWith("https://")) return;
+    try {
+      git(`remote set-url origin ${this.authUrl(state)}`, targetDir, 5e3);
+    } catch (err) {
+      this.log.warn("failed to refresh inline token on origin", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
   // ── Periodic fetch ─────────────────────────────────────────────────────────
   startPeriodicFetch(s, mountPath) {
     if (s.fetchTimer) clearInterval(s.fetchTimer);
@@ -8652,6 +8765,6 @@ function createConnector() {
   return new FlowAdapter();
 }
 
-export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DEFAULT_REACTIVE_COOLDOWN_MS, DeployConnector, DevServerConnector, FleetHealthGate, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PROACTIVE_RCLONE_REFRESH_MARGIN_MS, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createRcloneTokenRefresh, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, probeFleetHealth, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
-//# sourceMappingURL=chunk-LMRO2QNF.js.map
-//# sourceMappingURL=chunk-LMRO2QNF.js.map
+export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DEFAULT_REACTIVE_COOLDOWN_MS, DeployConnector, DevServerConnector, FleetHealthGate, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PROACTIVE_RCLONE_REFRESH_MARGIN_MS, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createRcloneTokenRefresh, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, probeFleetHealth, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
+//# sourceMappingURL=chunk-XUUMKMMJ.js.map
+//# sourceMappingURL=chunk-XUUMKMMJ.js.map