@skaile/workspaces 4.15.0 → 4.16.1

package/dist/{chunk-E4Q5GKO2.js → chunk-MY5TANRN.js}

@@ -1,11 +1,11 @@
 import { declaredConnectErrorKind, ClassifiedConnectError, withConnectErrorKind } from './chunk-UF4AEO54.js';
-import { OAuthRequiredError, ConnectorFieldMissingError, LegacyAuthGrammarError, resolveAuthRef, readUnavailableMarker, ConnectorStartupError } from './chunk-MK3OCWBG.js';
-import { EventNormalizer } from './chunk-W64ZXABT.js';
-import { resolveModelTier } from './chunk-ZXQMKXWR.js';
-import { createDriver } from './chunk-LQMALDDB.js';
+import { OAuthRequiredError, ConnectorFieldMissingError, LegacyAuthGrammarError, resolveAuthRef, readUnavailableMarker, ConnectorStartupError } from './chunk-MC2MF4U5.js';
+import { EventNormalizer } from './chunk-TEQDWOBS.js';
+import { resolveModelTier } from './chunk-LDT6NGSL.js';
+import { createDriver } from './chunk-CJGNYHPG.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
-import { interpolateNodeInstruction, resolveNodeBindings, getConsumedOutputSchema, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-A2T4WIZL.js';
+import { interpolateNodeInstruction, resolveNodeBindings, getConsumedOutputSchema, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-KTCMBEEB.js';
 import { INPUT_SCHEMA_SHAPES_HINT, coerceInputSchema } from './chunk-XPDB4O4H.js';
 import { parseFlowDefinition } from './chunk-ALLCAFHQ.js';
 import { describeStimulus, buildOrchestratorPrompt, renderSubpromptPrompt, renderStimulusPrompt } from './chunk-RQLL7L72.js';
@@ -2406,7 +2406,7 @@ var GitConnector = class extends AbstractConnector {
       clearTimeout(s.autoCommitTimer);
       s.autoCommitTimer = void 0;
     }
-    this.teardownManagedCredential(handle.id, s);
+    await this.teardownManagedCredential(handle.id, s);
   }
   async _sync(handle, _options) {
     const s = handle.state;
@@ -2528,7 +2528,7 @@ var GitConnector = class extends AbstractConnector {
       }
       return details.join("; ") || void 0;
     } finally {
-      this.teardownManagedCredential(handle.id, s);
+      await this.teardownManagedCredential(handle.id, s);
     }
   }
   // ── Private: managed gitconfig (Tier-2 credential exposure) ──────────────
@@ -2824,8 +2824,10 @@ var GitConnector = class extends AbstractConnector {
     state.refreshTimer.unref?.();
   }
   async refreshManagedCredential(connectorId, state) {
-    if (!state.tokenMediator) return;
-    const result = await state.tokenMediator({ connectorId, reason: "refresh" });
+    const mediator = state.tokenMediator;
+    if (!mediator) return;
+    const result = await mediator({ connectorId, reason: "refresh" });
+    if (state.tokenMediator !== mediator) return;
     if (!result.ok) {
       this.log.error("backend mediator refused refresh", void 0, {
         connectorId,
@@ -2855,7 +2857,14 @@ var GitConnector = class extends AbstractConnector {
         credentialsPath: state.managedGitconfig.credentialsPath
       });
     } else if (state.targetDir) {
-      await this.rebakeRemoteAuth(state.targetDir, state);
+      const rebake = this.rebakeRemoteAuth(state.targetDir, state);
+      state.rebakeInFlight = rebake;
+      try {
+        await rebake;
+      } finally {
+        if (state.rebakeInFlight === rebake) state.rebakeInFlight = void 0;
+      }
+      if (state.tokenMediator !== mediator) return;
     }
     this.log.info("refresh", {
       event: "refresh",
@@ -2869,13 +2878,17 @@ var GitConnector = class extends AbstractConnector {
       this.scheduleRefresh(connectorId, state, new Date(result.expiresAt));
     }
   }
-  teardownManagedCredential(connectorId, state) {
+  async teardownManagedCredential(connectorId, state) {
     if (state.refreshTimer) {
       clearTimeout(state.refreshTimer);
       state.refreshTimer = void 0;
     }
     state.tokenMediator = void 0;
-    if (!state.managedGitconfig) return;
+    if (state.rebakeInFlight) await state.rebakeInFlight;
+    if (!state.managedGitconfig) {
+      await this.stripRemoteAuth(state);
+      return;
+    }
     try {
       removeMountBlock({
         mountId: connectorId,
@@ -3163,6 +3176,31 @@ var GitConnector = class extends AbstractConnector {
       });
     }
   }
+  /**
+   * Tier-1: remove the userinfo from `origin`, so the token baked by
+   * connect/refresh does not stay in `.git/config` after teardown. No-op when
+   * `origin` carries none, or nothing was baked (no token, non-https remote).
+   */
+  async stripRemoteAuth(state) {
+    if (!state.token || !state.targetDir || !state.url.startsWith("https://")) return;
+    try {
+      const current = await git(["remote", "get-url", "origin"], state.targetDir, 5e3);
+      const bare = new URL(current);
+      if (!bare.username && !bare.password) return;
+      bare.username = "";
+      bare.password = "";
+      await git(["remote", "set-url", "origin", bare.toString()], state.targetDir, 5e3);
+      this.log.info("teardown", {
+        event: "teardown",
+        tier: 1,
+        scope: redactCredentials(state.url)
+      });
+    } catch (err) {
+      this.log.warn("failed to strip inline token from origin", {
+        error: redactCredentials(err instanceof Error ? err.message : String(err))
+      });
+    }
+  }
   // ── Periodic fetch ─────────────────────────────────────────────────────────
   startPeriodicFetch(s, mountPath) {
     if (s.fetchTimer) clearInterval(s.fetchTimer);
@@ -11881,5 +11919,5 @@ function describeFlowOperations() {
 }
 
 export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, ClassifierSubpromptRunner, ConnectorManager, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, MAX_REARM_MS, MIN_REFRESH_DELAY_MS, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NO_ACTIVE_FLOW_ERROR, PortPool, PostgresConnector, REFRESH_LEAD_MS, S3Connector, S3FetchStoppedError, S3PresignedRequestError, S3_PRESIGN_BATCH, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildConnectorToolDefs, buildFlowPromptEvent, buildFlowToolDefs, buildLazyFlowToolDefs, buildLazySdkFlowTools, buildSdkConnectorTools, buildSdkFlowTools, checkFleetMountLiveness, classifierQuestion, classifyConnectError, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, describeFlowOperations, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, parseListObjectsV2, presignScopePrefix, presignableKey, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock };
-//# sourceMappingURL=chunk-E4Q5GKO2.js.map
-//# sourceMappingURL=chunk-E4Q5GKO2.js.map
+//# sourceMappingURL=chunk-MY5TANRN.js.map
+//# sourceMappingURL=chunk-MY5TANRN.js.map