@skaile/workspaces 5.1.3 → 5.3.0

package/dist/factory-assets/connectors/flow/adapter.js

@@ -1,37 +1,37 @@
-export { FlowAdapter, createConnector, describeFlowOperations } from '../../../chunk-M4ISBWXR.js';
-import '../../../chunk-KC3OF6B2.js';
-import '../../../chunk-WKIOWDLQ.js';
-import '../../../chunk-QU4J5YSJ.js';
-import '../../../chunk-TVOODIZE.js';
+export { FlowAdapter, createConnector, describeFlowOperations } from '../../../chunk-OOKFZW6H.js';
+import '../../../chunk-QMWMSZQ4.js';
+import '../../../chunk-CZ35I4RK.js';
+import '../../../chunk-7L4WFH3Y.js';
+import '../../../chunk-LAI7X6I2.js';
 import '../../../chunk-EINLFFP6.js';
 import '../../../chunk-LOO5CB5M.js';
-import '../../../chunk-RDYI4MML.js';
-import '../../../chunk-KVAI5DGL.js';
+import '../../../chunk-BNUZEYC3.js';
+import '../../../chunk-ERCSHLTF.js';
 import '../../../chunk-XBSQ4KMC.js';
 import '../../../chunk-YROR332M.js';
-import '../../../chunk-ZD7CX25M.js';
+import '../../../chunk-FTYM4VRZ.js';
 import '../../../chunk-6E6PKKAD.js';
 import '../../../chunk-IFGTRL2I.js';
-export { isBlocking } from '../../../chunk-UMSWQKCY.js';
+export { isBlocking } from '../../../chunk-LM5XEFNS.js';
 import '../../../chunk-37FTLYFP.js';
 import '../../../chunk-QZLWJETK.js';
 import '../../../chunk-XUUYAS3Z.js';
 import '../../../chunk-NFGRW3L7.js';
 import '../../../chunk-QCI6D7E4.js';
-import '../../../chunk-IDEA6CYI.js';
-import '../../../chunk-IWCCZL7C.js';
+import '../../../chunk-K2K7OF4P.js';
+import '../../../chunk-6GBQND2F.js';
 import '../../../chunk-4GY63JU6.js';
-import '../../../chunk-YDJZRLGN.js';
-import '../../../chunk-U6K3I3AX.js';
-import '../../../chunk-K5GBV4SA.js';
+import '../../../chunk-4SSKKFDF.js';
+import '../../../chunk-XGIS325V.js';
+import '../../../chunk-5BEFNLOR.js';
 import '../../../chunk-A2ULN3KX.js';
-import '../../../chunk-MXXKTQXJ.js';
-import '../../../chunk-TLKM4M47.js';
+import '../../../chunk-KBAE7PU7.js';
+import '../../../chunk-MFHKHXDE.js';
 import '../../../chunk-TOSHZX4C.js';
-import '../../../chunk-AG44ZJ7W.js';
+import '../../../chunk-SR4RFKHM.js';
 import '../../../chunk-RVRB27AN.js';
-import '../../../chunk-DXUQCMVT.js';
-import '../../../chunk-43ZBF3WH.js';
+import '../../../chunk-LFMX2UEF.js';
+import '../../../chunk-WX74MVNA.js';
 import '../../../chunk-ICSCSM5D.js';
 import '../../../chunk-JMKB7IB4.js';
 import '../../../chunk-MJHSLODD.js';

package/dist/factory-assets/connectors/flow/engine.js

@@ -1,20 +1,20 @@
-export { FLOW_FILE_EXTENSIONS, FlowManifestSchema, appendAttempt, buildFlowExpressionContext, computeFlowState, computeFlowStateFromSnapshots, computeSkippable, countFailedAttempts, deriveCheckEvidence, findFlowFileInRoots, flowFileCandidates, flowKindProvider, flowLookupRoots, hasAutomaticRetryBudget, interpolateNodeInstruction, isActiveExecutionExpired, isBlocking, loadAllFlowEntries, loadAllFlows, loadFlow, loadFlowEntriesFromDir, loadFlowsFromDir, nextAttemptNumber, producerOutputObtainedBy, projectAiAssetsRoots, remainingActiveExecutionMs, resolveAvailableRouter, resolveFlowOutputFields, resolveNextNodes, resolveNodeBindings, resolveTerminalFailureStatus, validateConsumedNodeOutput, validateFlow } from '../../../chunk-UMSWQKCY.js';
+export { FLOW_FILE_EXTENSIONS, FlowManifestSchema, appendAttempt, buildFlowExpressionContext, computeFlowState, computeFlowStateFromSnapshots, computeSkippable, countFailedAttempts, deriveCheckEvidence, findFlowFileInRoots, flowFileCandidates, flowKindProvider, flowLookupRoots, hasAutomaticRetryBudget, interpolateNodeInstruction, isActiveExecutionExpired, isBlocking, loadAllFlowEntries, loadAllFlows, loadFlow, loadFlowEntriesFromDir, loadFlowsFromDir, nextAttemptNumber, producerOutputObtainedBy, projectAiAssetsRoots, remainingActiveExecutionMs, resolveAvailableRouter, resolveFlowOutputFields, resolveNextNodes, resolveNodeBindings, resolveTerminalFailureStatus, validateConsumedNodeOutput, validateFlow } from '../../../chunk-LM5XEFNS.js';
 import '../../../chunk-QZLWJETK.js';
 export { deterministicNodeKindLabel, flowDefaults, flowSkillVersionPins, isActiveRuntimeNode, isAgentNode, isCheckNode, isExecutableNode, isFunctionNode, isGateNode, isRouterNode, isSubFlowNode, isSubpromptNode, nodeAssets, nodeBindings, nodeInstruction, nodeIsInert, nodeIsOptional, nodeLabel, nodeRequiresApproval, nodeRunKind, nodeSkillAsset, nodeSkillId, nodeSkillVersionPins } from '../../../chunk-NFGRW3L7.js';
 export { getConsumedOutputSchema } from '../../../chunk-QCI6D7E4.js';
-import '../../../chunk-IWCCZL7C.js';
+import '../../../chunk-6GBQND2F.js';
 import '../../../chunk-4GY63JU6.js';
-import '../../../chunk-YDJZRLGN.js';
-import '../../../chunk-U6K3I3AX.js';
-import '../../../chunk-K5GBV4SA.js';
+import '../../../chunk-4SSKKFDF.js';
+import '../../../chunk-XGIS325V.js';
+import '../../../chunk-5BEFNLOR.js';
 import '../../../chunk-A2ULN3KX.js';
-import '../../../chunk-MXXKTQXJ.js';
-import '../../../chunk-TLKM4M47.js';
+import '../../../chunk-KBAE7PU7.js';
+import '../../../chunk-MFHKHXDE.js';
 import '../../../chunk-TOSHZX4C.js';
-import '../../../chunk-AG44ZJ7W.js';
+import '../../../chunk-SR4RFKHM.js';
 import '../../../chunk-RVRB27AN.js';
-import '../../../chunk-DXUQCMVT.js';
-import '../../../chunk-43ZBF3WH.js';
+import '../../../chunk-LFMX2UEF.js';
+import '../../../chunk-WX74MVNA.js';
 import '../../../chunk-ICSCSM5D.js';
 import '../../../chunk-JMKB7IB4.js';
 import '../../../chunk-MJHSLODD.js';

package/dist/factory-assets/connectors/flow/index.d.ts

@@ -1,4 +1,4 @@
-export type { FlowAdapterConnectOptions, FlowAdapterState, FlowAdapterStimulusBus, } from "./adapter.js";
+export type { FlowAdapterConnectOptions, FlowAdapterState, FlowAdapterStimulusBus, FlowRestoreKick, FlowRunTurnRule, } from "./adapter.js";
 export { createConnector, describeFlowOperations, FlowAdapter } from "./adapter.js";
 export { type InlineSubFlowAgentTurn, SessionInlineSubFlowRunner, type SessionInlineSubFlowRunnerOptions, } from "./inline-sub-flow-host.js";
 export { SessionNodeExecutor, type DeterministicFlowNode, type FunctionFlowNode, type NodeExecutor, type NodeExecutorOptions, type NodeExecutorRequest, type NodeExecutorResult, type SessionNodeExecutorOptions, } from "./node-executor.js";

package/dist/factory-assets/connectors/flow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../factory-assets/connectors/flow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,KAAK,sBAAsB,EAC3B,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../factory-assets/connectors/flow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,KAAK,sBAAsB,EAC3B,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC"}

package/dist/factory-assets/connectors/flow/run-flow.js

@@ -1,40 +1,40 @@
-export { awaitAgentEnd, resolveFlowPath, resumeFlow, runFlow } from '../../../chunk-ZVKJNNME.js';
+export { awaitAgentEnd, resolveFlowPath, resumeFlow, runFlow } from '../../../chunk-4257Q2LH.js';
 import '../../../chunk-4R6DROGN.js';
-import '../../../chunk-YV4J7V53.js';
-import '../../../chunk-M4ISBWXR.js';
-import '../../../chunk-KC3OF6B2.js';
-import '../../../chunk-WKIOWDLQ.js';
-import '../../../chunk-QU4J5YSJ.js';
-import '../../../chunk-TVOODIZE.js';
+import '../../../chunk-JAJG4G5E.js';
+import '../../../chunk-OOKFZW6H.js';
+import '../../../chunk-QMWMSZQ4.js';
+import '../../../chunk-CZ35I4RK.js';
+import '../../../chunk-7L4WFH3Y.js';
+import '../../../chunk-LAI7X6I2.js';
 import '../../../chunk-EINLFFP6.js';
 import '../../../chunk-LOO5CB5M.js';
-import '../../../chunk-RDYI4MML.js';
-import '../../../chunk-KVAI5DGL.js';
+import '../../../chunk-BNUZEYC3.js';
+import '../../../chunk-ERCSHLTF.js';
 import '../../../chunk-XBSQ4KMC.js';
 import '../../../chunk-YROR332M.js';
-import '../../../chunk-ZD7CX25M.js';
+import '../../../chunk-FTYM4VRZ.js';
 import '../../../chunk-6E6PKKAD.js';
 import '../../../chunk-IFGTRL2I.js';
-import '../../../chunk-UMSWQKCY.js';
+import '../../../chunk-LM5XEFNS.js';
 import '../../../chunk-37FTLYFP.js';
 import '../../../chunk-QZLWJETK.js';
 import '../../../chunk-XUUYAS3Z.js';
 import '../../../chunk-NFGRW3L7.js';
 import '../../../chunk-QCI6D7E4.js';
-import '../../../chunk-IDEA6CYI.js';
-import '../../../chunk-IWCCZL7C.js';
+import '../../../chunk-K2K7OF4P.js';
+import '../../../chunk-6GBQND2F.js';
 import '../../../chunk-4GY63JU6.js';
-import '../../../chunk-YDJZRLGN.js';
-import '../../../chunk-U6K3I3AX.js';
-import '../../../chunk-K5GBV4SA.js';
+import '../../../chunk-4SSKKFDF.js';
+import '../../../chunk-XGIS325V.js';
+import '../../../chunk-5BEFNLOR.js';
 import '../../../chunk-A2ULN3KX.js';
-import '../../../chunk-MXXKTQXJ.js';
-import '../../../chunk-TLKM4M47.js';
+import '../../../chunk-KBAE7PU7.js';
+import '../../../chunk-MFHKHXDE.js';
 import '../../../chunk-TOSHZX4C.js';
-import '../../../chunk-AG44ZJ7W.js';
+import '../../../chunk-SR4RFKHM.js';
 import '../../../chunk-RVRB27AN.js';
-import '../../../chunk-DXUQCMVT.js';
-import '../../../chunk-43ZBF3WH.js';
+import '../../../chunk-LFMX2UEF.js';
+import '../../../chunk-WX74MVNA.js';
 import '../../../chunk-ICSCSM5D.js';
 import '../../../chunk-JMKB7IB4.js';
 import '../../../chunk-MJHSLODD.js';

package/dist/factory-assets/connectors/flow.js

@@ -1,37 +1,37 @@
-export { ClassifierSubpromptRunner, FlowAdapter, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SubFlowContractError, buildFlowPromptEvent, classifierQuestion, createConnector, describeFlowOperations, driveOrchestratorTurn } from '../../chunk-M4ISBWXR.js';
-import '../../chunk-KC3OF6B2.js';
-import '../../chunk-WKIOWDLQ.js';
-import '../../chunk-QU4J5YSJ.js';
-import '../../chunk-TVOODIZE.js';
+export { ClassifierSubpromptRunner, FlowAdapter, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SubFlowContractError, buildFlowPromptEvent, classifierQuestion, createConnector, describeFlowOperations, driveOrchestratorTurn } from '../../chunk-OOKFZW6H.js';
+import '../../chunk-QMWMSZQ4.js';
+import '../../chunk-CZ35I4RK.js';
+import '../../chunk-7L4WFH3Y.js';
+import '../../chunk-LAI7X6I2.js';
 import '../../chunk-EINLFFP6.js';
 import '../../chunk-LOO5CB5M.js';
-import '../../chunk-RDYI4MML.js';
-import '../../chunk-KVAI5DGL.js';
+import '../../chunk-BNUZEYC3.js';
+import '../../chunk-ERCSHLTF.js';
 import '../../chunk-XBSQ4KMC.js';
 import '../../chunk-YROR332M.js';
-import '../../chunk-ZD7CX25M.js';
+import '../../chunk-FTYM4VRZ.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-IFGTRL2I.js';
-import '../../chunk-UMSWQKCY.js';
+import '../../chunk-LM5XEFNS.js';
 import '../../chunk-37FTLYFP.js';
 import '../../chunk-QZLWJETK.js';
 import '../../chunk-XUUYAS3Z.js';
 import '../../chunk-NFGRW3L7.js';
 import '../../chunk-QCI6D7E4.js';
-import '../../chunk-IDEA6CYI.js';
-import '../../chunk-IWCCZL7C.js';
+import '../../chunk-K2K7OF4P.js';
+import '../../chunk-6GBQND2F.js';
 import '../../chunk-4GY63JU6.js';
-import '../../chunk-YDJZRLGN.js';
-import '../../chunk-U6K3I3AX.js';
-import '../../chunk-K5GBV4SA.js';
+import '../../chunk-4SSKKFDF.js';
+import '../../chunk-XGIS325V.js';
+import '../../chunk-5BEFNLOR.js';
 import '../../chunk-A2ULN3KX.js';
-import '../../chunk-MXXKTQXJ.js';
-import '../../chunk-TLKM4M47.js';
+import '../../chunk-KBAE7PU7.js';
+import '../../chunk-MFHKHXDE.js';
 import '../../chunk-TOSHZX4C.js';
-import '../../chunk-AG44ZJ7W.js';
+import '../../chunk-SR4RFKHM.js';
 import '../../chunk-RVRB27AN.js';
-import '../../chunk-DXUQCMVT.js';
-import '../../chunk-43ZBF3WH.js';
+import '../../chunk-LFMX2UEF.js';
+import '../../chunk-WX74MVNA.js';
 import '../../chunk-ICSCSM5D.js';
 import '../../chunk-JMKB7IB4.js';
 import '../../chunk-MJHSLODD.js';

package/dist/factory-assets/connectors/git/checkout.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Checkout-level git operations that need no per-mount state: hold the index
+ * lock down, stage and commit, keep `.skaile/` out of the index, sync
+ * submodules, manage session-branch fetch refspecs.
+ *
+ * Every function takes the checkout path (and, for network commands, a
+ * {@link GitRemoteAuth}). The per-mount state those operations are sequenced
+ * with lives in the repo module.
+ */
+import type { Logger } from "@skaile/workspaces/types";
+import { type GitRemoteAuth } from "./exec.js";
+/**
+ * `git pull origin <branch>` in two processes: the fetch carries the token, the
+ * merge does not. A merge runs programs the checkout's config and attributes
+ * name (filters, merge drivers), which must never see the token.
+ *
+ * A clean divergence is merged (never rebased: both sides may be published),
+ * where `git pull` without `pull.rebase` would refuse. A conflicting one is
+ * aborted and thrown, naming the files: left in place, the auto-commit's
+ * `add -A` would complete the merge with the conflict markers and push them.
+ * An unfinished merge or rebase found beforehand is someone else's (the
+ * agent's): the pull throws without touching it, so the abort only ever undoes
+ * this pull's own merge.
+ */
+export declare function pullByMerge(branch: string, cwd: string, auth: GitRemoteAuth, timeout?: number): Promise<void>;
+/**
+ * Make the checkout ignore `SKAILE_INTERNAL_DIR`, and drop it from the index
+ * if a previous session already staged it.
+ *
+ * Written to `info/exclude` rather than `.gitignore`: the rule is a property
+ * of this machine's checkout, not of the user's project, so it must never show
+ * up in their diff, their history, or on their remote.
+ *
+ * Excluding — rather than filtering at `git add` time — keeps
+ * `status --porcelain` and `add -A` answering the same question, and covers
+ * git the *agent* runs by hand just as much as the driver's own commits.
+ *
+ * Resolved through `--git-common-dir` because a fleet worktree's `.git` is a
+ * file; `info/exclude` lives in the shared common dir in both layouts.
+ *
+ * The unstage is deliberately narrow. An ignore rule does not evict a path
+ * that is already in the index, so a checkout carrying a half-finished save
+ * from before this fix would still commit it on the next hibernate. Only
+ * entries that are in the index and *not* in `HEAD` are dropped, so a project
+ * that genuinely tracks a `.skaile/` of its own is left exactly as it is.
+ *
+ * Best effort throughout: a checkout whose git dir cannot be written is still
+ * a usable checkout, and failing `connect` over an ignore rule would trade a
+ * leak for an outage.
+ */
+export declare function ensureSkaileExcluded(cwd: string, log: Logger): Promise<void>;
+/**
+ * Drop a `.git/index.lock` orphaned by a SIGKILL'd git child.
+ *
+ * `runGit` kills on SIGKILL by design, which gives git no chance to release the
+ * lock, and the checkout outlives the container that made it — so one killed
+ * child wedges every later `connect()` on the same repo, permanently. Measured
+ * in prod: two sessions dead for 23 and 4 days, recoverable only by hand.
+ *
+ * Called from the connect path alone, which rules out this driver's own git:
+ * the periodic timers arm only once connect returns, and a fleet-managed mount
+ * (where the host owns git against this very path) takes another branch
+ * entirely. The mtime gate covers what ordering does not — a previous
+ * container still shutting down, and, on the hot-plug connect of a live
+ * session, git the AGENT is running, which is under no deadline of ours.
+ */
+export declare function clearStaleIndexLock(targetDir: string, log: Logger): Promise<void>;
+/**
+ * Whether a failed git child died on the checkout's `.git/index.lock` — held
+ * by another process (`Unable to create '<path>/index.lock': File exists.`) or
+ * unwritable. A lock young enough to survive {@link clearStaleIndexLock} still
+ * fails the connect, and no new credential fixes either case.
+ *
+ * Matches the lock path alone: the words around it go through gettext, and
+ * git inherits whatever locale the host runs it under.
+ */
+export declare function isIndexLockFailure(err: unknown): boolean;
+/**
+ * Run a purely local `git checkout` for the connect path, marking a refusal as
+ * repo-state: with no network in the command, only the checkout itself (a lock,
+ * local changes in the way, a broken HEAD) can be what refused it.
+ *
+ * Only a clean non-zero exit counts. A deadline kill (a wedged mount) or a
+ * failed spawn says nothing about the repository, so those stay unclassified.
+ */
+export declare function gitLocalCheckout(args: string[], cwd: string): Promise<string>;
+export declare function syncSubmodules(cwd: string, log: Logger, auth: GitRemoteAuth): Promise<void>;
+/**
+ * The agent's `pull` moves submodule pins without fetching them: a submodule
+ * fetch reads its URL from the agent-writable config and would carry the
+ * host-scoped header to any repo the agent names. Checks out pins whose commits
+ * are already local and returns the paths still behind, which the next driver
+ * sync fetches. Runs without the token; `--checkout` as in `syncSubmodules`.
+ */
+export declare function checkoutSubmodulesOffline(cwd: string): Promise<string[]>;
+/** The fetch refspec that maps `branch` on origin to `refs/remotes/origin/<branch>`. */
+export declare function trackingRefspec(branch: string): string;
+/**
+ * Make sure a fetch refspec of `origin` maps `branch` to its remote-tracking
+ * ref. Idempotent: adds nothing when the exact refspec or the default
+ * `refs/heads/*` wildcard (a full clone) is already configured.
+ *
+ * Needed because the clone is `--single-branch`: its only refspec maps the base
+ * branch. Without a mapping for the session branch, git does not resolve
+ * `@{upstream}`, and neither a fetch nor a push updates
+ * `refs/remotes/origin/<branch>`. `branch` must already be refname-validated.
+ */
+export declare function ensureTrackingRefspec(branch: string, cwd: string): Promise<void>;
+/**
+ * Remove the exact session-branch refspec that {@link ensureTrackingRefspec}
+ * adds. A configured refspec without a wildcard makes every plain
+ * `git fetch origin` fail with "couldn't find remote ref" while origin does
+ * not have the branch, which stops the periodic fetch and the agent's own
+ * `git fetch` / `git pull`. Never throws.
+ */
+export declare function dropTrackingRefspec(branch: string, cwd: string): Promise<void>;
+/**
+ * Before the base branch is pushed: fetch `origin/<branch>` and merge it in
+ * through {@link pullByMerge} (a fast-forward when the local branch has
+ * nothing of its own; the fetch authenticates per command), so the push that
+ * follows is a fast-forward. A merge, never a rebase: origin's commits
+ * may already be pulled elsewhere. A conflicting merge is aborted and thrown
+ * naming the files, so nothing is pushed and no conflict markers reach a later
+ * auto-commit. Unlike a session branch, the base branch gets no
+ * `.conflict`-file resolution: it is shared, and silently keeping "ours" there
+ * would bury someone else's change.
+ *
+ * Skipped (the push then runs as before) when HEAD is not `<branch>` — the
+ * agent checked out another branch or is mid-rebase — or when a merge,
+ * rebase, cherry-pick or revert is unfinished: that state is the agent's, and
+ * the abort in `pullByMerge` must only ever undo this function's own merge.
+ */
+export declare function integrateOriginBaseBranch(branch: string, cwd: string, auth: GitRemoteAuth): Promise<void>;
+/**
+ * Set `branch`'s upstream to `origin/<branch>` through config, as `push -u`
+ * does. Unlike `branch --set-upstream-to`, this works before a fetch refspec
+ * maps the branch.
+ */
+export declare function setSessionUpstream(branch: string, cwd: string): Promise<void>;
+/**
+ * True when `dir` is empty (no entries, including no dotfiles) or when the
+ * listing fails or misses its deadline (e.g. dir does not exist, wedged
+ * mount). The "fails → empty" mapping is intentional: the caller is about to
+ * `mkdir` and proceed, so a missing dir is functionally equivalent to an
+ * empty one.
+ */
+export declare function isDirEmpty(dir: string): Promise<boolean>;
+/**
+ * Stage everything and commit. Returns `null` without committing when there is
+ * nothing to commit, or when an unfinished merge or rebase would make the
+ * commit carry conflict markers (see {@link unfinishedGitOperation}).
+ */
+export declare function commitAll(cwd: string, message: string, log: Logger): Promise<string | null>;
+/**
+ * `git add -A` for the driver's own commits, minus any submodule pin it would
+ * move backwards. After a pull that could not fetch a submodule (the agent's
+ * `pull` never does), the submodule's checkout lags the merged pin, and a plain
+ * `add -A` would commit the old pin and so undo the upstream bump on push.
+ */
+export declare function stageAll(cwd: string, log: Logger): Promise<void>;
+//# sourceMappingURL=checkout.d.ts.map

package/dist/factory-assets/connectors/git/checkout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../../../factory-assets/connectors/git/checkout.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAEL,KAAK,aAAa,EAOnB,MAAM,WAAW,CAAC;AAcnB;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,aAAa,EACnB,OAAO,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ElF;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM7E;AAMD,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBjG;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAS9E;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAapF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnF;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOjG;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBtE"}

package/dist/factory-assets/connectors/git/config.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Git connector config - the session, sync and lifecycle blocks a mount
+ * declaration resolves to. `mode` seeds per-block defaults, explicit
+ * `options.{session,sync,lifecycle}` keys override them, and a read-only mount
+ * is forced onto the reference-checkout profile. Pure functions: no I/O, no
+ * per-mount state.
+ */
+import type { ConnectorDeclaration } from "@skaile/workspaces/connectors";
+export interface GitSessionConfig {
+    enabled: boolean;
+    slug?: string;
+    isMain: boolean;
+    branchPrefix: string;
+    /**
+     * Starting point for a freshly-created session branch. When set and the
+     * session branch does not already exist on origin, the driver fetches this
+     * ref and branches from it instead of from the base branch tip. Used by
+     * the platform's fork flow so a forked session branches off the source
+     * session's tip rather than off `main`. May be a branch name (e.g.
+     * `skaile/session-source-slug`) or a commit SHA. Ignored when the session
+     * branch already exists on origin (existing branch wins). No-op when
+     * `enabled = false` or `isMain = true` (only branch sessions cut new
+     * branches). The value is validated against `isValidGitRefOrSha` before
+     * use; refs with shell metacharacters are rejected and the driver falls
+     * back to branching off base.
+     */
+    fromRef?: string;
+}
+export interface GitSyncConfig {
+    fetchIntervalSec: number;
+    autoRebase: boolean;
+    autoPull: boolean;
+}
+export interface GitLifecycleConfig {
+    commitOnHibernate: boolean;
+    pushOnHibernate: boolean;
+    mergeOnClose: boolean;
+    pushOnClose: boolean;
+    /** Auto-commit after N ms of no file changes. 0 = disabled. Default: 30000 (30s). */
+    autoCommitIdleMs: number;
+    /** Push to remote after each auto-commit. */
+    pushAfterCommit: boolean;
+    /** Push freshly-created session branch to origin on connect. Best-effort — push
+     *  failures are swallowed; lifecycle push hooks remain the backstop. */
+    publishOnCreate: boolean;
+}
+/**
+ * True when at least one lifecycle hook may push to origin. With none on, the
+ * driver itself never writes to origin; the agent's explicit `push` op still can.
+ */
+export declare function lifecyclePushesEnabled(lc: GitLifecycleConfig): boolean;
+/** The session, sync and lifecycle blocks a git mount runs with. */
+export interface GitConfigBlocks {
+    session: GitSessionConfig;
+    sync: GitSyncConfig;
+    lifecycle: GitLifecycleConfig;
+}
+/**
+ * Resolve the session/sync/lifecycle config blocks for a git connector. `mode`
+ * seeds per-block defaults (`agent` / `sync`); explicit `options.{session,sync,
+ * lifecycle}` keys still override those defaults. Absent `mode` reproduces the
+ * legacy literals exactly, so behavior is unchanged for declarations that set none.
+ */
+export declare function resolveGitConfig(args: {
+    mode?: "agent" | "sync";
+    options?: Record<string, unknown>;
+}): GitConfigBlocks;
+/** The blocks a mount runs with, and whether it is a read-only reference checkout. */
+export interface GitMountConfig extends GitConfigBlocks {
+    readOnly: boolean;
+}
+/**
+ * Resolve the config a declaration mounts with. Only an explicit `read-only`
+ * counts: a mount that declared no `access` got the default from the parser and
+ * keeps the behaviour it had before the mode existed.
+ */
+export declare function resolveMountConfig(declaration: ConnectorDeclaration): GitMountConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/factory-assets/connectors/git/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../factory-assets/connectors/git/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,qFAAqF;IACrF,gBAAgB,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB;4EACwE;IACxE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAqGD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAQtE;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,eAAe,CAclB;AAoCD,sFAAsF;AACtF,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,GAAG,cAAc,CAKpF"}

package/dist/factory-assets/connectors/git/credentials.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Git connector credentials — everything between a mount's `auth:` declaration
+ * and a token a git command can use.
+ *
+ * Owns token acquisition (platform mediator or PAT), the proactive refresh
+ * timer, the Tier-2 managed gitconfig and credential file the agent's own `git`
+ * reads, atomic writes to that file, and the teardown fence that stops a late
+ * refresh from writing back after the mount is gone. The rest of the connector
+ * only holds a {@link GitCredentials} handle: it reads `token` and calls
+ * `teardown`; it never writes a credential file itself.
+ */
+import type { ConnectContext, ConnectorDeclaration, SecretProvider } from "@skaile/workspaces/connectors";
+import type { Logger } from "@skaile/workspaces/types";
+type ConnectorTokenMediator = NonNullable<ConnectContext["tokenMediator"]>;
+/**
+ * Longest delay ever handed to `setTimeout`, a margin below its 2^31-1 ms
+ * ceiling (above which the delay silently collapses to 1 ms). Same cap the
+ * runner's AI-credential scheduler uses.
+ */
+export declare const MAX_REARM_MS: number;
+export interface GitCredentialsInit {
+    declaration: ConnectorDeclaration;
+    /** The declared remote (`mount.source`), used as the log scope of a driver-only credential. */
+    url: string;
+    secrets?: SecretProvider;
+    tokenMediator?: ConnectorTokenMediator;
+    log: Logger;
+}
+/** One mount's credential, as the rest of the git connector sees it. */
+export interface GitCredentials {
+    /** The current token. Read per git command, so a rotated token reaches the next spawn. */
+    readonly token: string | undefined;
+    /** True once the agent's gitconfig carries this mount's credential (Tier-2). */
+    readonly exposedToAgent: boolean;
+    /**
+     * Tier-2: write the managed gitconfig block, helper script and credential
+     * file for `url`, and arm the refresh timer. Writes nothing (and leaves
+     * {@link exposedToAgent} false) when there is no token, the remote is not
+     * http(s) or `GIT_CONFIG_GLOBAL` is unset. Throws when the files cannot be written.
+     */
+    exposeToAgent(url: string): void;
+    /**
+     * Tier-1: the credential stays inside the driver's own git. Reports the mint
+     * and arms the refresh timer, which keeps the token fresh in memory only.
+     */
+    serveDriverOnly(): void;
+    /**
+     * The agent's git hit a 401 and asked for a new token. No-op unless the
+     * credential is exposed and backend-minted; never writes after teardown.
+     */
+    refreshAfterRejection(): Promise<void>;
+    /**
+     * Stop refreshing and remove what was exposed to the agent. Idempotent.
+     * A refresh whose mint is still in flight finds the fence down and writes nothing.
+     */
+    teardown(): void;
+}
+/**
+ * The sanitized full repository URL a credential helper is scoped to.
+ * Userinfo, query, and fragment data must never enter the managed gitconfig.
+ */
+export declare function credentialScope(url: string): string;
+/**
+ * Register a credential helper that *reports* why there is no credential,
+ * after this connector failed to connect.
+ *
+ * Without it git finds no helper for the host and asks the terminal for a
+ * username, so the agent sees `fatal: could not read Username for
+ * 'https://github.com'` — which names neither the mount nor the cause, and
+ * which only ever appears on a write, since reads against a public remote
+ * keep succeeding. The helper written here makes git stop with the mediator's
+ * actual refusal text instead.
+ *
+ * Entirely best-effort: it runs on the failure path and must never mask the
+ * connect error that is already on its way up.
+ */
+export declare function registerUnavailableCredentialHelper(connectorId: string, url: string, err: unknown, log: Logger): void;
+/**
+ * Best-effort removal of the unavailable-mount blocks that would answer this
+ * connector's git operations: its own from a previous failed session, and any
+ * left under the same repository scope by a sibling mount that failed earlier
+ * in this `connectAll` (git matches helpers by URL, not by mount id).
+ */
+export declare function clearUnavailableCredentialHelper(connectorId: string, url: string, log: Logger): void;
+/**
+ * Resolve a mount's credential: ask the mediator (or secrets chain) for the
+ * initial token. Throws a classified connect error when the mount has no usable
+ * credential. Nothing is written or scheduled until `exposeToAgent` /
+ * `serveDriverOnly`.
+ */
+export declare function acquireGitCredentials(init: GitCredentialsInit): Promise<GitCredentials>;
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/factory-assets/connectors/git/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../factory-assets/connectors/git/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EAGpB,cAAc,EAEf,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAsB,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAgB3E,KAAK,sBAAsB,GAAG,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;AAmB3E;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAA2B,CAAC;AAgCrD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,oBAAoB,CAAC;IAClC,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,eAAe,IAAI,IAAI,CAAC;IACxB;;;OAGG;IACH,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAAC;CAClB;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD;AAkBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GACV,IAAI,CA2CN;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,IAAI,CAuBN;AA2ED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkS7F"}