@skaile/workspaces 3.8.1 → 3.9.1

package/dist/{chunk-Q57ZGD4V.js → chunk-BO4NC4G7.js}

@@ -1,7 +1,7 @@
 import { resolveAuthRef } from './chunk-3UU3D2Q3.js';
-import { EventNormalizer } from './chunk-KLATRNFG.js';
+import { EventNormalizer } from './chunk-32MHUAED.js';
 import { resolveModelTier } from './chunk-V34ZEXSE.js';
-import { createDriver } from './chunk-5YIGODSZ.js';
+import { createDriver } from './chunk-BIA7TJWH.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
 import { resolveNodeBindings, getConsumedOutputSchema, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, interpolateNodeInstruction, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-OYZIURPH.js';
@@ -1353,11 +1353,14 @@ function git(args, cwd, timeout = 3e4) {
 function pathExists(path) {
   return tryWithFsDeadline(`stat ${path}`, () => stat(path).then(() => true), false);
 }
-async function syncSubmodules(cwd) {
+async function syncSubmodules(cwd, log) {
   if (!await pathExists(join(cwd, ".gitmodules"))) return;
   try {
     await git(["submodule", "update", "--init", "--recursive"], cwd, 12e4);
-  } catch {
+  } catch (err) {
+    log.warn("git submodule update failed \u2014 checkout may be incomplete", {
+      error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+    });
   }
 }
 function isValidGitRefOrSha(ref) {
@@ -1487,6 +1490,8 @@ var GitConnector = class extends AbstractConnector {
     const opts = declaration.options;
     const url = String(declaration.mount?.source ?? "");
     const branch = String(opts?.branch ?? "main");
+    let credentialScopeUrl = url;
+    let credentialAlignmentAttempted = false;
     if (!url) {
       this.log.error("connect failed: missing mount.source URL", void 0);
       throw new Error("Git connector requires a mount.source URL");
@@ -1523,15 +1528,17 @@ var GitConnector = class extends AbstractConnector {
       }
       if (declaration.mount?.exposeAccessToken === true) {
         try {
-          this.exposeManagedCredential(declaration, state, url, initial);
+          if (initial.token && (url.startsWith("https://") || url.startsWith("http://")) && process.env.GIT_CONFIG_GLOBAL) {
+            credentialAlignmentAttempted = true;
+            credentialScopeUrl = await this.alignRemoteWithCredentialScope(targetDir, url);
+          }
+          this.exposeManagedCredential(declaration, state, credentialScopeUrl, initial);
         } catch (err) {
           this.log.error("managed-gitconfig write failed", err, { connectorId: declaration.id });
           throw err;
         }
       }
-      if (state.managedGitconfig) {
-        await this.stripRemoteInlineToken(targetDir);
-      } else {
+      if (!state.managedGitconfig) {
         await this.rebakeRemoteAuth(targetDir, state);
         if (initial.authRef?.kind === "backend" && initial.expiresAt && state.tokenMediator) {
           this.scheduleRefresh(declaration.id, state, initial.expiresAt);
@@ -1544,7 +1551,18 @@ var GitConnector = class extends AbstractConnector {
       });
       return this.makeHandle(declaration, state, targetDir);
     } catch (err) {
-      this.registerUnavailableCredentialHelper(declaration, url, err);
+      if (declaration.mount?.exposeAccessToken === true && (url.startsWith("https://") || url.startsWith("http://")) && process.env.GIT_CONFIG_GLOBAL && !credentialAlignmentAttempted && await pathExists(join(targetDir, ".git"))) {
+        try {
+          credentialAlignmentAttempted = true;
+          credentialScopeUrl = await this.alignRemoteWithCredentialScope(targetDir, url);
+        } catch (alignErr) {
+          this.log.warn("failed to align origin for unavailable credential helper", {
+            connectorId: declaration.id,
+            error: alignErr instanceof Error ? alignErr.message : String(alignErr)
+          });
+        }
+      }
+      this.registerUnavailableCredentialHelper(declaration, credentialScopeUrl, err);
       throw err;
     }
   }
@@ -1654,7 +1672,7 @@ var GitConnector = class extends AbstractConnector {
         created = true;
       }
     }
-    await syncSubmodules(targetDir);
+    await syncSubmodules(targetDir, this.log);
     state.activeBranch = sessionBranch;
     this.log.info("session branch checked out", { sessionBranch });
     if (created && state.lifecycle.publishOnCreate) {
@@ -1819,7 +1837,7 @@ var GitConnector = class extends AbstractConnector {
     this.log.debug("sync (pull) start", { branch: s.activeBranch });
     try {
       await git(["pull", "origin", s.activeBranch], handle.mountPath, 6e4);
-      await syncSubmodules(handle.mountPath);
+      await syncSubmodules(handle.mountPath, this.log);
       this.log.debug("sync ok");
     } catch (err) {
       this.log.error("sync failed", err, { branch: s.activeBranch });
@@ -1892,51 +1910,46 @@ var GitConnector = class extends AbstractConnector {
     }
     const lc = s.lifecycle;
     const details = [];
-    const commitResult = await commitAll(handle.mountPath, `skaile: session close`);
-    if (commitResult) {
-      const sha = await git(["rev-parse", "--short", "HEAD"], handle.mountPath);
-      details.push(`Committed ${sha}`);
-    }
-    if (lc.pushOnClose || lc.mergeOnClose) {
-      await git(["push", "origin", s.activeBranch], handle.mountPath, 6e4);
-      details.push(`Pushed ${s.activeBranch}`);
-    }
-    if (lc.mergeOnClose && s.activeBranch !== s.branch) {
-      await git(["checkout", s.branch], handle.mountPath);
-      await git(["pull", "origin", s.branch], handle.mountPath, 6e4);
-      await syncSubmodules(handle.mountPath);
-      try {
-        await git(["merge", s.activeBranch], handle.mountPath);
-      } catch {
-        const resolved = await this.resolveConflictsOrAbort(s, handle.mountPath, "merge");
-        if (resolved) {
-          details.push("Resolved merge conflicts (created .conflict files)");
-        }
+    try {
+      const commitResult = await commitAll(handle.mountPath, `skaile: session close`);
+      if (commitResult) {
+        const sha = await git(["rev-parse", "--short", "HEAD"], handle.mountPath);
+        details.push(`Committed ${sha}`);
       }
-      if (lc.pushOnClose) {
-        await git(["push", "origin", s.branch], handle.mountPath, 6e4);
+      if (lc.pushOnClose || lc.mergeOnClose) {
+        await git(["push", "origin", s.activeBranch], handle.mountPath, 6e4);
+        details.push(`Pushed ${s.activeBranch}`);
       }
-      details.push(`Merged ${s.activeBranch} into ${s.branch}`);
+      if (lc.mergeOnClose && s.activeBranch !== s.branch) {
+        await git(["checkout", s.branch], handle.mountPath);
+        await git(["pull", "origin", s.branch], handle.mountPath, 6e4);
+        await syncSubmodules(handle.mountPath, this.log);
+        try {
+          await git(["merge", s.activeBranch], handle.mountPath);
+        } catch {
+          const resolved = await this.resolveConflictsOrAbort(s, handle.mountPath, "merge");
+          if (resolved) {
+            details.push("Resolved merge conflicts (created .conflict files)");
+          }
+        }
+        if (lc.pushOnClose) {
+          await git(["push", "origin", s.branch], handle.mountPath, 6e4);
+        }
+        details.push(`Merged ${s.activeBranch} into ${s.branch}`);
+      }
+      return details.join("; ") || void 0;
+    } finally {
+      this.teardownManagedCredential(handle.id, s);
     }
-    this.teardownManagedCredential(handle.id, s);
-    return details.join("; ") || void 0;
   }
   // ── Private: managed gitconfig (Tier-2 credential exposure) ──────────────
   /**
-   * Compute the URL prefix used to scope the credential helper. We key on
-   * host plus the first path segment when one is present (e.g. for
-   * `https://github.com/orgA/repo.git` we register
-   * `https://github.com/orgA/`). This lets two connectors on the same host
-   * with disjoint org prefixes coexist; same-host repos under one org just
-   * share the same scope.
+   * Scope the credential helper to the sanitized full repository URL.
+   * Userinfo, query, and fragment data must never enter managed gitconfig.
    */
-  deriveUrlPrefix(url) {
+  deriveCredentialScope(url) {
     const u = new URL(url);
-    const segments = u.pathname.split("/").filter(Boolean);
-    if (segments.length > 0) {
-      return `${u.protocol}//${u.host}/${segments[0]}/`;
-    }
-    return `${u.protocol}//${u.host}`;
+    return `${u.protocol}//${u.host}${u.pathname}`;
   }
   /**
    * Acquire the initial credential for a connector.
@@ -2021,7 +2034,7 @@ var GitConnector = class extends AbstractConnector {
       if (!gitconfigPath) return;
       const skaileDir = dirname(gitconfigPath);
       const credentialsPath = join(skaileDir, "git-credentials");
-      const urlPrefix = this.deriveUrlPrefix(url);
+      const urlPrefix = this.deriveCredentialScope(url);
       const helperScriptPath = join(skaileDir, `credential-helper-${declaration.id}.sh`);
       const refreshAttemptPath = join(skaileDir, `refresh-attempt-${declaration.id}`);
       const reason = redactUrlAuth(err instanceof Error ? err.message : String(err));
@@ -2072,8 +2085,8 @@ var GitConnector = class extends AbstractConnector {
   /**
    * Best-effort removal of the unavailable-mount blocks that would answer this
    * connector's git operations: its own from a previous failed session, and any
-   * left under the same URL prefix by a sibling mount that failed earlier in
-   * this `connectAll` (git matches helpers by URL, not by mount id).
+   * left under the same repository scope by a sibling mount that failed earlier
+   * in this `connectAll` (git matches helpers by URL, not by mount id).
    */
   clearUnavailableCredentialHelper(connectorId, url) {
     const gitconfigPath = process.env.GIT_CONFIG_GLOBAL;
@@ -2081,7 +2094,7 @@ var GitConnector = class extends AbstractConnector {
     let urlPrefix;
     if (url.startsWith("https://") || url.startsWith("http://")) {
       try {
-        urlPrefix = this.deriveUrlPrefix(url);
+        urlPrefix = this.deriveCredentialScope(url);
       } catch {
       }
     }
@@ -2122,7 +2135,7 @@ var GitConnector = class extends AbstractConnector {
     }
     const skaileDir = dirname(gitconfigPath);
     const credentialsPath = join(skaileDir, "git-credentials");
-    const urlPrefix = this.deriveUrlPrefix(url);
+    const urlPrefix = this.deriveCredentialScope(url);
     const refreshFlagPath = join(skaileDir, "refresh-request");
     const helperScriptPath = join(skaileDir, `credential-helper-${declaration.id}.sh`);
     const refreshAttemptPath = join(skaileDir, `refresh-attempt-${declaration.id}`);
@@ -2446,7 +2459,7 @@ var GitConnector = class extends AbstractConnector {
     await git(["fetch", "--depth=1", "origin", branch], targetDir, 12e4);
     await this.preserveConflictingUntracked(targetDir, branch);
     await git(["checkout", "-B", branch, `origin/${branch}`], targetDir, 3e4);
-    await syncSubmodules(targetDir);
+    await syncSubmodules(targetDir, this.log);
     try {
       await git(["branch", `--set-upstream-to=origin/${branch}`, branch], targetDir, 5e3);
     } catch {
@@ -2507,26 +2520,20 @@ var GitConnector = class extends AbstractConnector {
     return s.url;
   }
   /**
-   * Rewrite `origin` to drop any inline `user:password@` credentials, leaving
-   * a bare https(s) URL. Tier-2 only: the managed credential helper supplies
-   * (and refreshes) the token, but git ignores helpers when the URL already
-   * carries creds — so the baked-in token must go. Best-effort: a missing
-   * origin or a non-http(s) remote (e.g. file:// in tests) is left untouched.
+   * Align `origin` with the exact sanitized URL used by the Tier-2 helper.
+   * Git does not normalize query/fragment data, path case, or `.git` aliases
+   * when matching `credential.<url>` sections, so the two strings must agree.
+   * The declared mount source remains authoritative over an existing remote.
    */
-  async stripRemoteInlineToken(targetDir) {
-    try {
-      const current = await git(["remote", "get-url", "origin"], targetDir, 5e3);
-      if (!current.startsWith("https://") && !current.startsWith("http://")) return;
-      const u = new URL(current);
-      if (!u.username && !u.password) return;
-      u.username = "";
-      u.password = "";
-      await git(["remote", "set-url", "origin", u.toString()], targetDir, 5e3);
-    } catch (err) {
-      this.log.warn("managed-gitconfig: failed to strip inline token from origin", {
-        error: err instanceof Error ? err.message : String(err)
-      });
+  async alignRemoteWithCredentialScope(targetDir, declaredUrl) {
+    const credentialScopeUrl = this.deriveCredentialScope(declaredUrl);
+    const remotes = (await git(["remote"], targetDir, 5e3)).split(/\r?\n/);
+    if (!remotes.includes("origin")) {
+      await git(["remote", "add", "origin", credentialScopeUrl], targetDir, 5e3);
+    } else if (await git(["remote", "get-url", "origin"], targetDir, 5e3) !== credentialScopeUrl) {
+      await git(["remote", "set-url", "origin", credentialScopeUrl], targetDir, 5e3);
     }
+    return credentialScopeUrl;
   }
   /**
    * Tier-1 only: rewrite `origin` so it carries the token freshly minted on
@@ -2579,11 +2586,11 @@ var GitConnector = class extends AbstractConnector {
         await this.resolveConflictsOrAbort(s, mountPath, "rebase");
       }
       if (s.disposed) return;
-      await syncSubmodules(mountPath);
+      await syncSubmodules(mountPath, this.log);
     } else if (s.sync.autoPull) {
       await git(["pull", "origin", s.activeBranch], mountPath, 6e4);
       if (s.disposed) return;
-      await syncSubmodules(mountPath);
+      await syncSubmodules(mountPath, this.log);
     }
   }
   // ── Conflict resolution ──────────────────────────────────────────────────
@@ -7573,7 +7580,7 @@ var ManagedGitconfigCollisionError = class extends Error {
   newMountId;
   constructor(urlPrefix, existingMountId, newMountId) {
     super(
-      `Mount '${newMountId}' tried to register URL prefix '${urlPrefix}' but mount '${existingMountId}' already owns it with a different credential. Narrow the prefixes (e.g. include the org segment) or consolidate the mounts.`
+      `Mount '${newMountId}' tried to register repository credential scope '${urlPrefix}' but mount '${existingMountId}' already owns the same repository identity. Use one credential-exposing mount per repository or disable exposeAccessToken on one mount.`
     );
     this.name = "ManagedGitconfigCollisionError";
     this.urlPrefix = urlPrefix;
@@ -7689,6 +7696,21 @@ function blockUrlPrefix(block) {
   }
   return void 0;
 }
+function repositoryScopeIdentity(scope) {
+  try {
+    const url = new URL(scope);
+    let pathname = url.pathname.replace(/\/+$/, "").replace(/\.git$/i, "");
+    if (url.hostname === "github.com") {
+      pathname = pathname.toLowerCase();
+    }
+    return `${url.protocol}//${url.host}${pathname}`;
+  } catch {
+    return scope;
+  }
+}
+function scopesTargetSameRepository(left, right) {
+  return repositoryScopeIdentity(left) === repositoryScopeIdentity(right);
+}
 function isUnavailableBlock(block) {
   return block.lines.some((l) => l.trim() === UNAVAILABLE_MARKER);
 }
@@ -7700,11 +7722,14 @@ function writeMountBlock(opts) {
     if (b.mountId === "" || b.mountId === mountId) continue;
     if (isUnavailableBlock(b)) continue;
     const otherPrefix = blockUrlPrefix(b);
-    if (otherPrefix === urlPrefix) {
+    if (otherPrefix !== void 0 && scopesTargetSameRepository(otherPrefix, urlPrefix)) {
       throw new ManagedGitconfigCollisionError(urlPrefix, b.mountId, mountId);
     }
   }
-  const blocks = parsed.filter((b) => !(isUnavailableBlock(b) && blockUrlPrefix(b) === urlPrefix));
+  const blocks = parsed.filter((b) => {
+    const otherPrefix = blockUrlPrefix(b);
+    return !(isUnavailableBlock(b) && otherPrefix !== void 0 && scopesTargetSameRepository(otherPrefix, urlPrefix));
+  });
   const newBlock = {
     mountId,
     lines: buildBlock(mountId, urlPrefix, credentialsPath, helperScriptPath)
@@ -7734,7 +7759,8 @@ function writeUnavailableMountBlock(opts) {
   for (const b of blocks) {
     if (b.mountId === "" || b.mountId === mountId) continue;
     if (isUnavailableBlock(b)) continue;
-    if (blockUrlPrefix(b) === urlPrefix) return;
+    const otherPrefix = blockUrlPrefix(b);
+    if (otherPrefix !== void 0 && scopesTargetSameRepository(otherPrefix, urlPrefix)) return;
   }
   const newLines = [
     blockStart(mountId),
@@ -7757,9 +7783,12 @@ function removeUnavailableMountBlock(opts) {
   if (text.length === 0) return;
   const blocks = parseBlocks(text);
   const doomed = new Set(
-    blocks.filter(
-      (b) => isUnavailableBlock(b) && (b.mountId === mountId || urlPrefix !== void 0 && blockUrlPrefix(b) === urlPrefix)
-    )
+    blocks.filter((b) => {
+      if (!isUnavailableBlock(b)) return false;
+      if (b.mountId === mountId) return true;
+      const otherPrefix = blockUrlPrefix(b);
+      return urlPrefix !== void 0 && otherPrefix !== void 0 && scopesTargetSameRepository(otherPrefix, urlPrefix);
+    })
   );
   if (doomed.size === 0) return;
   atomicWrite(gitconfigPath, renderBlocks(blocks.filter((b) => !doomed.has(b))), 416);
@@ -10553,5 +10582,5 @@ function createConnector() {
 }
 
 export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, PortPool, PostgresConnector, S3Connector, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildFlowPromptEvent, buildSdkConnectorTools, buildSdkFlowTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock };
-//# sourceMappingURL=chunk-Q57ZGD4V.js.map
-//# sourceMappingURL=chunk-Q57ZGD4V.js.map
+//# sourceMappingURL=chunk-BO4NC4G7.js.map
+//# sourceMappingURL=chunk-BO4NC4G7.js.map