@skaile/workspaces 4.9.3 → 4.10.0

package/dist/{chunk-JU736VOI.js → chunk-CTQ4G3UY.js}

@@ -1,16 +1,16 @@
-import { declaredConnectErrorKind, ClassifiedConnectError, withConnectErrorKind } from './chunk-SDNGG6FB.js';
-import { OAuthRequiredError, ConnectorFieldMissingError, LegacyAuthGrammarError, resolveAuthRef, readUnavailableMarker, ConnectorStartupError } from './chunk-JUZJUKWM.js';
-import { EventNormalizer } from './chunk-ZVYWMD6Q.js';
-import { resolveModelTier } from './chunk-YCIW4YOT.js';
-import { createDriver } from './chunk-LDQB5VEC.js';
+import { declaredConnectErrorKind, ClassifiedConnectError, withConnectErrorKind } from './chunk-YZSMZK37.js';
+import { OAuthRequiredError, ConnectorFieldMissingError, LegacyAuthGrammarError, resolveAuthRef, readUnavailableMarker, ConnectorStartupError } from './chunk-MMLXSVQ3.js';
+import { EventNormalizer } from './chunk-VLXODO37.js';
+import { resolveModelTier } from './chunk-BXV6RLF4.js';
+import { createDriver } from './chunk-3T5DRUNZ.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
-import { interpolateNodeInstruction, resolveNodeBindings, getConsumedOutputSchema, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-AOE4KOMJ.js';
+import { interpolateNodeInstruction, resolveNodeBindings, getConsumedOutputSchema, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-O3DHAGBO.js';
 import { INPUT_SCHEMA_SHAPES_HINT, coerceInputSchema } from './chunk-KLMXMW6Z.js';
 import { classifierDecision, withoutReservedClassifierFields, parseFlowDefinition } from './chunk-REYJKU7T.js';
 import { describeStimulus, buildOrchestratorPrompt, renderSubpromptPrompt, renderStimulusPrompt } from './chunk-2D5BYAL6.js';
 import { deterministicNodeKindLabel, nodeInstruction, flowDefaults, isAgentNode, isGateNode, isCheckNode, nodeRequiresApproval, isSubFlowNode, isFunctionNode, isSubpromptNode, isRouterNode, isActiveRuntimeNode, nodeIsOptional, nodeLabel, nodeAssets } from './chunk-ELPR5XBG.js';
-import { withActivityLabelDefs } from './chunk-QAH24E5U.js';
+import { withActivityLabelDefs } from './chunk-O64WU6WS.js';
 import { processAlive } from './chunk-4GY63JU6.js';
 import { withFsDeadline, tryWithFsDeadline, FsDeadlineError, fsDeadlineMs } from './chunk-MKZOK4JU.js';
 import { portableSpawn } from './chunk-KSIRR5PL.js';
@@ -1749,6 +1749,32 @@ async function ensureTrackingRefspec(branch, cwd) {
   }
   await git(["config", "--add", "remote.origin.fetch", wanted], cwd);
 }
+async function dropTrackingRefspec(branch, cwd) {
+  const name = branch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  await gitOrNull(
+    [
+      "config",
+      "--unset-all",
+      "remote.origin.fetch",
+      `^\\+?refs/heads/${name}:refs/remotes/origin/${name}$`
+    ],
+    cwd
+  );
+}
+async function isAncestor(ancestor, descendant, cwd) {
+  return await gitOrNull(["merge-base", "--is-ancestor", ancestor, descendant], cwd) !== null;
+}
+async function originTrackingRef(branch, cwd) {
+  const ref = `refs/remotes/origin/${branch}`;
+  return await gitOrNull(["rev-parse", "--verify", "--quiet", ref], cwd) === null ? null : ref;
+}
+async function setSessionUpstream(branch, cwd) {
+  await git(["config", `branch.${branch}.remote`, "origin"], cwd);
+  await git(["config", `branch.${branch}.merge`, `refs/heads/${branch}`], cwd);
+}
+function cLocaleEnv() {
+  return { ...process.env, LC_ALL: "C", LANGUAGE: "" };
+}
 async function readGitSyncStatus(cwd, baseBranch) {
   const branchRaw = await gitOrNull(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
   const branch = branchRaw && branchRaw !== "HEAD" ? branchRaw : null;
@@ -1878,6 +1904,9 @@ var GitConnector = class extends AbstractConnector {
       const authUrl = this.authUrl(state);
       await this.prepareCheckout(targetDir, url, branch, authUrl, declaration.access, started);
       if (session.enabled && !session.isMain && session.slug) {
+        if (declaration.mount?.exposeAccessToken !== true) {
+          await this.rebakeRemoteAuth(targetDir, state);
+        }
         await this.checkoutSessionBranch(state, session, targetDir);
       }
       if (sync.fetchIntervalSec > 0) {
@@ -1917,8 +1946,13 @@ var GitConnector = class extends AbstractConnector {
       }
       if (state.sessionBranchFetch === "failed") {
         state.sessionBranchFetch = await this.trackSessionBranch(state.activeBranch, targetDir);
-        if (state.sessionBranchFetch === "fetched" && state.sessionBranchCreated) {
-          await this.adoptOriginSessionBranch(state.activeBranch, targetDir);
+        if (state.sessionBranchFetch === "fetched") {
+          if (state.sessionBranchCreated) {
+            await this.adoptOriginSessionBranch(state.activeBranch, targetDir);
+          } else {
+            await this.reconcileLocalSessionBranch(state, state.activeBranch, targetDir);
+            await syncSubmodules(targetDir, this.log);
+          }
         }
       }
       await ensureSkaileExcluded(targetDir, this.log);
@@ -2040,6 +2074,9 @@ var GitConnector = class extends AbstractConnector {
     if (await localBranchExists(sessionBranch, targetDir)) {
       await gitLocalCheckout([sessionBranch], targetDir);
       this.log.info("reusing existing local session branch", { sessionBranch });
+      if (state.sessionBranchFetch === "fetched") {
+        await this.reconcileLocalSessionBranch(state, sessionBranch, targetDir);
+      }
     } else {
       let originHasBranch = false;
       try {
@@ -2063,6 +2100,7 @@ var GitConnector = class extends AbstractConnector {
     if (created && state.lifecycle.publishOnCreate) {
       try {
         await git(["push", "-u", "origin", sessionBranch], targetDir, 6e4);
+        await this.recordPushedSessionBranch(sessionBranch, targetDir);
         this.log.info("published new session branch", { sessionBranch });
       } catch (err) {
         this.log.warn("publish-on-create push failed; deferring to lifecycle push", {
@@ -2073,36 +2111,47 @@ var GitConnector = class extends AbstractConnector {
     }
   }
   /**
-   * Map the session branch to `refs/remotes/origin/<sessionBranch>` (fetch
-   * refspec) and fetch it once. Never throws: a missing remote branch is the
-   * normal case for a new session, and any other failure leaves the checkout as
-   * it was before this fix (the caller creates the branch from the base).
+   * Fetch the session branch into `refs/remotes/origin/<sessionBranch>` and,
+   * when origin has it, map it with a fetch refspec. Never throws: a missing
+   * remote branch is the normal case for a new session, and any other failure
+   * leaves the checkout as it was (the caller creates the branch from the base).
    *
-   * Also repairs a checkout cloned before this refspec existed, because it runs
-   * on every connect.
+   * The refspec is added only once origin has the branch, and removed when
+   * origin does not have it: a configured refspec for a missing branch makes
+   * every plain `git fetch origin` fail. Runs on every connect, so it also
+   * repairs a checkout cloned before the refspec existed.
    */
   async trackSessionBranch(sessionBranch, targetDir) {
-    try {
-      await ensureTrackingRefspec(sessionBranch, targetDir);
-    } catch (err) {
-      this.log.warn("could not add session-branch fetch refspec", {
-        sessionBranch,
-        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
-      });
-    }
+    let outcome;
     try {
       await runGit([...gitPrefix(targetDir), "fetch", "origin", trackingRefspec(sessionBranch)], {
         cwd: targetDir,
         timeout: 6e4,
-        env: { ...process.env, LC_ALL: "C", LANGUAGE: "" }
+        env: cLocaleEnv()
       });
-      return "fetched";
+      outcome = "fetched";
     } catch (err) {
       const message = redactUrlAuth(err instanceof Error ? err.message : String(err));
-      if (/couldn't find remote ref/i.test(message)) return "absent";
-      this.log.warn("session-branch fetch failed", { sessionBranch, error: message });
-      return "failed";
+      if (!/couldn't find remote ref/i.test(message)) {
+        this.log.warn("session-branch fetch failed", { sessionBranch, error: message });
+        return "failed";
+      }
+      outcome = "absent";
+    }
+    try {
+      if (outcome === "fetched") {
+        await ensureTrackingRefspec(sessionBranch, targetDir);
+      } else {
+        await dropTrackingRefspec(sessionBranch, targetDir);
+        await gitOrNull(["update-ref", "-d", `refs/remotes/origin/${sessionBranch}`], targetDir);
+      }
+    } catch (err) {
+      this.log.warn("could not update session-branch fetch refspec", {
+        sessionBranch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
     }
+    return outcome;
   }
   /**
    * Re-point a session branch that this connect cut from the base at
@@ -2124,25 +2173,101 @@ var GitConnector = class extends AbstractConnector {
     }
   }
   /**
-   * Push the active branch. A session branch is pushed with `-u` after its
-   * fetch refspec is ensured, so the push also updates
-   * `refs/remotes/origin/<branch>` and `@{upstream}` resolves — the platform's
-   * hibernate save gate reads exactly that. The base branch keeps its plain push.
+   * Line up a reused local session branch (checked out) with
+   * `origin/<sessionBranch>` after a successful fetch. Never rewrites local
+   * history and never throws:
+   *   - local is an ancestor of origin → fast-forward (another node pushed
+   *     newer work);
+   *   - local has commits that origin does not have → keep them and log a
+   *     warning; when origin also has commits that local lacks (diverged),
+   *     merge origin in with {@link integrateOriginSessionBranch};
+   *   - origin has no such branch → nothing to do.
+   * In the first two cases the upstream is set to `origin/<sessionBranch>`.
    */
-  async pushActiveBranch(s, cwd) {
-    if (s.activeBranch === s.branch) {
-      await git(["push", "origin", s.activeBranch], cwd, 6e4);
-      return;
+  async reconcileLocalSessionBranch(state, sessionBranch, targetDir) {
+    const originRef = await originTrackingRef(sessionBranch, targetDir);
+    if (originRef === null) return;
+    try {
+      await setSessionUpstream(sessionBranch, targetDir);
+      if (await isAncestor("HEAD", originRef, targetDir)) {
+        const before = await git(["rev-parse", "HEAD"], targetDir);
+        await git(["merge", "--ff-only", originRef], targetDir, 6e4);
+        if (await git(["rev-parse", "HEAD"], targetDir) !== before) {
+          this.log.info("session branch fast-forwarded to origin", { sessionBranch });
+        }
+        return;
+      }
+      const { ahead, behind } = await countAheadBehind(targetDir, originRef);
+      this.log.warn("local session branch has commits not on origin; kept", {
+        sessionBranch,
+        ahead,
+        behind
+      });
+      if (behind > 0) await this.integrateOriginSessionBranch(state, targetDir, sessionBranch);
+    } catch (err) {
+      this.log.warn("could not line up the local session branch with origin", {
+        sessionBranch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
     }
+  }
+  /**
+   * Merge `origin/<branch>` into the checked-out session branch when origin
+   * holds commits that the local branch lacks (another node or the agent
+   * pushed, or an older driver rewrote the local branch). A merge, never a
+   * rebase: the commits on origin are published. After this, a push of the
+   * branch is a fast-forward and needs no force. Never throws; a merge that
+   * cannot complete is aborted, and the push that follows fails as before.
+   */
+  async integrateOriginSessionBranch(s, cwd, branch = s.activeBranch) {
+    const originRef = await originTrackingRef(branch, cwd);
+    if (originRef === null || await isAncestor(originRef, "HEAD", cwd)) return;
     try {
-      await ensureTrackingRefspec(s.activeBranch, cwd);
+      await gitCommitting(["merge", "--no-edit", originRef], cwd, 6e4);
+      this.log.info("merged origin session branch", { branch });
     } catch (err) {
-      this.log.warn("could not add session-branch fetch refspec", {
-        branch: s.activeBranch,
+      this.log.warn("merge of origin session branch failed", {
+        branch,
         error: redactUrlAuth(err instanceof Error ? err.message : String(err))
       });
+      await this.resolveConflictsOrAbort(s, cwd, "merge");
     }
+  }
+  /**
+   * After a successful push of a session branch: map it with a fetch refspec
+   * and point `refs/remotes/origin/<branch>` at the pushed tip. The push ran
+   * before the refspec existed (a refspec for a branch that origin does not
+   * have yet would break `git fetch origin`), so git did not update the
+   * tracking ref itself. With both, `@{upstream}` resolves and the platform's
+   * hibernate save gate sees `ahead` 0. Never throws.
+   */
+  async recordPushedSessionBranch(branch, cwd) {
+    try {
+      await ensureTrackingRefspec(branch, cwd);
+      await git(["update-ref", `refs/remotes/origin/${branch}`, `refs/heads/${branch}`], cwd);
+    } catch (err) {
+      this.log.warn("could not record the pushed session branch", {
+        branch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
+    }
+  }
+  /**
+   * Push the active branch. A session branch first gets any commits that are
+   * only on `origin/<branch>` merged in, so the push is a fast-forward and
+   * never needs a force. It is pushed with `-u` and then recorded (see
+   * {@link recordPushedSessionBranch}), so `@{upstream}` resolves — the
+   * platform's hibernate save gate reads exactly that. The base branch keeps
+   * its plain push.
+   */
+  async pushActiveBranch(s, cwd) {
+    if (s.activeBranch === s.branch) {
+      await git(["push", "origin", s.activeBranch], cwd, 6e4);
+      return;
+    }
+    await this.integrateOriginSessionBranch(s, cwd);
     await git(["push", "-u", "origin", s.activeBranch], cwd, 6e4);
+    await this.recordPushedSessionBranch(s.activeBranch, cwd);
   }
   /**
    * Attempt to create `sessionBranch` anchored on `session.fromRef`. Returns
@@ -3056,7 +3181,7 @@ var GitConnector = class extends AbstractConnector {
       s.fetchInFlight = true;
       void this.runPeriodicFetch(s, mountPath).catch((err) => {
         this.log.debug("periodic fetch failed", {
-          error: err instanceof Error ? err.message : String(err)
+          error: redactUrlAuth(err instanceof Error ? err.message : String(err))
         });
       }).finally(() => {
         s.fetchInFlight = false;
@@ -3065,9 +3190,17 @@ var GitConnector = class extends AbstractConnector {
   }
   /** One periodic-fetch tick. Bails out at each resumption point once disconnected. */
   async runPeriodicFetch(s, mountPath) {
-    await git(["fetch", "origin"], mountPath, 6e4);
+    await this.fetchOrigin(s, mountPath);
     if (s.disposed) return;
     if (s.sync.autoRebase && s.activeBranch !== s.branch) {
+      const onOrigin = await this.trackSessionBranch(s.activeBranch, mountPath);
+      if (s.disposed) return;
+      if (onOrigin !== "absent") {
+        await this.mergeBaseIntoSessionBranch(s, mountPath);
+        if (s.disposed) return;
+        await syncSubmodules(mountPath, this.log);
+        return;
+      }
       try {
         await gitCommitting(["rebase", `origin/${s.branch}`], mountPath, 6e4);
       } catch (err) {
@@ -3085,6 +3218,59 @@ var GitConnector = class extends AbstractConnector {
       await syncSubmodules(mountPath, this.log);
     }
   }
+  /**
+   * `git fetch origin` for the periodic tick. When origin no longer has a
+   * branch that a session refspec names (for example a session branch deleted
+   * after a merge, or one from an earlier session on this checkout), that
+   * refspec fails the whole fetch. Drop it and fetch again. The base branch
+   * refspec is never dropped.
+   */
+  async fetchOrigin(s, mountPath) {
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await runGit([...gitPrefix(mountPath), "fetch", "origin"], {
+          cwd: mountPath,
+          timeout: 6e4,
+          env: cLocaleEnv()
+        });
+        return;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const missing = /couldn't find remote ref refs\/heads\/(\S+)/.exec(message)?.[1];
+        if (missing === void 0 || missing === s.branch || !isValidGitRefOrSha(missing)) {
+          throw err;
+        }
+        if (attempt >= 3) throw err;
+        this.log.info("branch not on origin; dropping its fetch refspec", { branch: missing });
+        await dropTrackingRefspec(missing, mountPath);
+        await gitOrNull(["update-ref", "-d", `refs/remotes/origin/${missing}`], mountPath);
+      }
+    }
+  }
+  /**
+   * Merge `origin/<base>` into a published session branch (periodic tick with
+   * `autoRebase`). No-op when the base is already contained. Conflicts are
+   * handled like the merge on close: keep "ours" (the session branch) and
+   * save "theirs" as `.conflict` files.
+   */
+  async mergeBaseIntoSessionBranch(s, mountPath) {
+    const baseRef = `origin/${s.branch}`;
+    if (await isAncestor(baseRef, "HEAD", mountPath)) return;
+    try {
+      await gitCommitting(["merge", "--no-edit", baseRef], mountPath, 6e4);
+      this.log.info("merged base into published session branch", {
+        branch: s.activeBranch,
+        base: s.branch
+      });
+    } catch (err) {
+      this.log.warn("merge of base into session branch failed", {
+        branch: s.activeBranch,
+        base: s.branch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
+      await this.resolveConflictsOrAbort(s, mountPath, "merge");
+    }
+  }
   // ── Conflict resolution ──────────────────────────────────────────────────
   /**
    * Attempt to resolve merge/rebase conflicts by keeping "ours" and copying
@@ -11245,5 +11431,5 @@ function describeFlowOperations() {
 }
 
 export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, ClassifierSubpromptRunner, ConnectorManager, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, MAX_REARM_MS, MIN_REFRESH_DELAY_MS, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NO_ACTIVE_FLOW_ERROR, PortPool, PostgresConnector, REFRESH_LEAD_MS, S3Connector, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildConnectorToolDefs, buildFlowPromptEvent, buildFlowToolDefs, buildLazyFlowToolDefs, buildLazySdkFlowTools, buildSdkConnectorTools, buildSdkFlowTools, classifierQuestion, classifyConnectError, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, describeFlowOperations, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock };
-//# sourceMappingURL=chunk-JU736VOI.js.map
-//# sourceMappingURL=chunk-JU736VOI.js.map
+//# sourceMappingURL=chunk-CTQ4G3UY.js.map
+//# sourceMappingURL=chunk-CTQ4G3UY.js.map