@skaile/workspaces 6.9.1 → 6.10.0

package/dist/{chunk-AQTAULXT.js → chunk-SKG6G4HO.js}

@@ -1,30 +1,30 @@
 import { declaredConnectErrorKind, ClassifiedConnectError, withConnectErrorKind } from './chunk-BRPEW3UL.js';
-import { readUnavailableMarker, OAuthRequiredError, ConnectorFieldMissingError, LegacyAuthGrammarError, ConnectorStartupError, resolveAuthRef } from './chunk-LMADWO4Q.js';
-import { EventNormalizer } from './chunk-7UCPGQCW.js';
+import { readUnavailableMarker, OAuthRequiredError, ConnectorFieldMissingError, LegacyAuthGrammarError, ConnectorStartupError, resolveAuthRef } from './chunk-SBAUZ7XH.js';
+import { EventNormalizer } from './chunk-NTFP2XF4.js';
 import { resolveModelTier } from './chunk-3AIEJSQR.js';
-import { createHarness } from './chunk-7TF5MNFK.js';
+import { createHarness } from './chunk-KE5HDORU.js';
 import { pluginRegistry } from './chunk-G5SUWZEU.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
-import { resolveFlowOutputFields, interpolateNodeInstruction, resolveNodeBindings, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-5J6JWGY4.js';
+import { resolveFlowOutputFields, interpolateNodeInstruction, resolveNodeBindings, validateConsumedNodeOutput, appendAttempt, resolveTerminalFailureStatus, remainingActiveExecutionMs, deriveCheckEvidence, computeFlowStateFromSnapshots, availableRouterFrontier, evaluateRouterSelection, routerSelectionOutput, planRouterSkips, unsettledRouterBranchIds, countFailedAttempts, hasAutomaticRetryBudget, persistedRouterSelection } from './chunk-WDG5IVEA.js';
 import { describeStimulus, buildOrchestratorPrompt, renderSubpromptPrompt, renderStimulusPrompt } from './chunk-WD3L5QSU.js';
 import { deterministicNodeKindLabel, nodeInstruction, flowDefaults, isAgentNode, isGateNode, isCheckNode, nodeRequiresApproval, isSubFlowNode, isActiveRuntimeNode, isFunctionNode, isSubpromptNode, isRouterNode, nodeIsOptional, nodeLabel, nodeAssets } from './chunk-7RGTAEG6.js';
 import { withActivityLabelDefs } from './chunk-7NN3P6VF.js';
 import { undeclaredSubFlowOutputReads, mismatchedSubFlowOutputTypes, INPUT_SCHEMA_SHAPES_HINT, coerceInputSchema } from './chunk-LNFKL23K.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
 import { classifierDecision, getConsumedOutputSchema, withoutReservedClassifierFields, FLOW_CAPTURE_CHANNELS, captureDestinationFieldName, invalidCaptureDestinationMessage } from './chunk-NUELZWCF.js';
-import { loadHarnessSdk } from './chunk-4KPQ6ILH.js';
+import { loadHarnessSdk } from './chunk-MEU2HHGV.js';
 import { processAlive } from './chunk-4GY63JU6.js';
-import { symlinkEscapeOfProject, isInsideProject } from './chunk-FZO64PLQ.js';
-import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-GNUA7XT2.js';
+import { symlinkEscapeOfProject, isInsideProject } from './chunk-BNLXZXZN.js';
+import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-VS6XC5JE.js';
 import { portableSpawn } from './chunk-VSX2G7LA.js';
-import { pathTag, scrubLogText } from './chunk-MDCI4RSG.js';
+import { pathTag, scrubLogText } from './chunk-RZL4TOK3.js';
 import { createLogger, redactCredentials } from './chunk-BOFL7GIF.js';
 import { resolve, relative, sep, isAbsolute, join, dirname, basename } from 'path';
 import { mkdir, stat, cp, writeFile, readFile, chmod, realpath, rename, readdir, rmdir, rm } from 'fs/promises';
 import * as z4 from 'zod';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
-import { tmpdir } from 'os';
+import { tmpdir, homedir } from 'os';
 import { createReadStream, existsSync, mkdirSync, openSync, closeSync, chmodSync, utimesSync, writeFileSync, readFileSync, writeSync, renameSync } from 'fs';
 import { createServer } from 'http';
 import mime from 'mime';
@@ -1512,6 +1512,19 @@ var execFileAsync2 = promisify(execFile);
 function isHttpUrl(url) {
   return url.startsWith("https://") || url.startsWith("http://");
 }
+function isLoopbackHttpUrl(url) {
+  if (!url.startsWith("http://")) return false;
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return host === "localhost" || host === "[::1]" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+function carriesToken(url) {
+  return url.startsWith("https://") || isLoopbackHttpUrl(url);
+}
 function redactError(err) {
   const original = err instanceof Error ? err : new Error(String(err));
   const copy = new Error(redactCredentials(original.message));
@@ -1583,7 +1596,7 @@ var NETWORK_GIT_ARGS = [
   "maintenance.auto=false"
 ];
 function plainRemoteUrl(auth) {
-  if (!auth.credentials?.token || !auth.url.startsWith("https://")) return auth.url;
+  if (!auth.credentials?.token || !carriesToken(auth.url)) return auth.url;
   const u = new URL(auth.url);
   u.username = "";
   u.password = "";
@@ -1591,7 +1604,7 @@ function plainRemoteUrl(auth) {
 }
 function networkGitEnv(auth, base = process.env) {
   const env = { ...base, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "" };
-  if (!auth?.credentials?.token || !auth.url.startsWith("https://")) return env;
+  if (!auth?.credentials?.token || !carriesToken(auth.url)) return env;
   const { protocol, host } = new URL(auth.url);
   const basic = Buffer.from(`${TOKEN_USERNAME}:${auth.credentials.token}`).toString("base64");
   const existing = Number.parseInt(base.GIT_CONFIG_COUNT ?? "", 10);
@@ -1600,13 +1613,13 @@ function networkGitEnv(auth, base = process.env) {
   env[`GIT_CONFIG_KEY_${index}`] = `http.${scope}.extraHeader`;
   env[`GIT_CONFIG_VALUE_${index}`] = `Authorization: Basic ${basic}`;
   env.GIT_CONFIG_COUNT = String(index + 1);
-  env.GIT_ALLOW_PROTOCOL = "https";
+  env.GIT_ALLOW_PROTOCOL = protocol.slice(0, -1);
   return env;
 }
 async function runRemoteGit(args, auth, options) {
   const keys = subcommandOf(args) === "submodule" ? CHECKOUT_UNSAFE_KEY_RE : TLS_TRUST_KEY_RE;
   const hasToken = auth?.credentials?.token !== void 0 && auth.credentials.token !== "";
-  const plainHttp = hasToken && auth !== void 0 && auth.url.startsWith("http://");
+  const plainHttp = hasToken && auth !== void 0 && auth.url.startsWith("http://") && !carriesToken(auth.url);
   const withheld = hasToken && !plainHttp ? await tlsTrustOverride(options, keys) : null;
   let withheldNote;
   if (withheld !== null) {
@@ -1696,7 +1709,18 @@ async function tlsTrustOverride(options, keyRe = TLS_TRUST_KEY_RE) {
   }
 }
 function isUnsafeConfigLine(line) {
-  return !/^(system|command)\s/.test(line);
+  if (/^(system|command)\s/.test(line)) return false;
+  return !isTrustedCaInfoLine(line);
+}
+function isTrustedCaInfoLine(line) {
+  const trusted = process.env[TRUSTED_GIT_CA_ENV];
+  if (!trusted) return false;
+  const m = /^\S+\s+http\.sslcainfo (.*)$/.exec(line);
+  if (!m) return false;
+  const value = (m[1] ?? "").trim();
+  const home = process.env.HOME || homedir();
+  const expanded = value.startsWith("~/") && home ? join(home, value.slice(2)) : value;
+  return expanded === trusted;
 }
 async function configMatch(globalArgs, cwd, selector, keyRe) {
   try {
@@ -1815,7 +1839,7 @@ async function gitOrNull(args, cwd) {
   }
 }
 function comparableRemoteUrl(url) {
-  if (!url.startsWith("https://")) return url;
+  if (!carriesToken(url)) return url;
   try {
     const u = new URL(url);
     return `${u.protocol}//${u.host}${u.pathname}`;
@@ -4103,7 +4127,7 @@ var GitRepo = class {
     try {
       const current = await gitOrNull(["remote", "get-url", "origin"], targetDir);
       let wanted = null;
-      if (this.credentials?.token && this.url.startsWith("https://")) {
+      if (this.credentials?.token && carriesToken(this.url)) {
         wanted = plainRemoteUrl(this.auth);
       } else if (current?.startsWith("https://")) {
         const u = new URL(current);
@@ -4750,9 +4774,14 @@ var GmailConnector = class extends AbstractConnector {
     }
     this.log.info("connect", { account });
     const googleapisPkg = "googleapis";
-    const { google } = await import(
-      /* @vite-ignore */
-      googleapisPkg
+    const { google } = await loadHarnessSdk(
+      googleapisPkg,
+      ctx.projectDir ?? process.cwd(),
+      () => import(
+        /* @vite-ignore */
+        googleapisPkg
+      ),
+      "the gmail connector needs googleapis, which is"
     );
     const auth = new google.auth.OAuth2();
     auth.setCredentials({ access_token: accessToken });
@@ -5712,9 +5741,14 @@ var MinIOConnector = class extends AbstractConnector {
     this.log.info("connect start", { endpoint, bucket });
     try {
       const minioMod = "minio";
-      const { Client } = await import(
-        /* @vite-ignore */
-        minioMod
+      const { Client } = await loadHarnessSdk(
+        minioMod,
+        ctx.projectDir ?? process.cwd(),
+        () => import(
+          /* @vite-ignore */
+          minioMod
+        ),
+        "the minio connector needs minio, which is"
       );
       const url = new URL(endpoint);
       const client = new Client({
@@ -5945,9 +5979,14 @@ var PostgresConnector = class extends AbstractConnector {
     this.log.info("connect start", { host });
     try {
       const pgPkg = "pg";
-      const pg = await import(
-        /* @vite-ignore */
-        pgPkg
+      const pg = await loadHarnessSdk(
+        pgPkg,
+        ctx.projectDir ?? process.cwd(),
+        () => import(
+          /* @vite-ignore */
+          pgPkg
+        ),
+        "the postgres connector needs pg, which is"
       );
       const Pool = pg.default?.Pool ?? pg.Pool;
       const pool = new Pool({ connectionString: dsn });
@@ -6210,11 +6249,16 @@ var S3Connector = class extends AbstractConnector {
       return this._sync(handle, options);
     }
   };
-  async _loadSdk() {
+  async _loadSdk(projectDir) {
     if (this._sdkOverride) return this._sdkOverride;
-    return await import(
-      /* @vite-ignore */
-      s3Pkg
+    return loadHarnessSdk(
+      s3Pkg,
+      projectDir ?? process.cwd(),
+      () => import(
+        /* @vite-ignore */
+        s3Pkg
+      ),
+      "the s3 connector needs @aws-sdk/client-s3, which is"
     );
   }
   async connect(declaration, ctx) {
@@ -6237,7 +6281,7 @@ var S3Connector = class extends AbstractConnector {
     const region = String(opts?.region ?? "us-east-1");
     const endpoint = opts?.endpoint ? String(opts.endpoint) : void 0;
     this.log.info("mount start", { bucket, prefix, region, endpoint, targetDir });
-    const s3Mod = await this._loadSdk();
+    const s3Mod = await this._loadSdk(ctx.projectDir);
     const { S3Client } = s3Mod;
     const clientConfig = { region };
     if (endpoint) clientConfig.endpoint = endpoint;
@@ -6246,7 +6290,7 @@ var S3Connector = class extends AbstractConnector {
       clientConfig.profile = profile;
     }
     const client = new S3Client(clientConfig);
-    const state = { kind: "sdk", client, bucket, prefix, region };
+    const state = { kind: "sdk", client, sdk: s3Mod, bucket, prefix, region };
     await withFsDeadline(`mkdir ${targetDir}`, () => mkdir(targetDir, { recursive: true }));
     try {
       const result = await this.downloadAll(state, targetDir);
@@ -6346,7 +6390,7 @@ var S3Connector = class extends AbstractConnector {
         (deadlineAt) => this.presignedBodies(state, entries2, deadlineAt)
       );
     }
-    const s3Mod = await this._loadSdk();
+    const s3Mod = state.sdk;
     const entries = await this.listSdk(s3Mod, state);
     const bodies = async function* (self) {
       for (const { key } of entries) yield await self.fetchObject(s3Mod, state, key);
@@ -6775,9 +6819,14 @@ var SQLiteConnector = class extends AbstractConnector {
     }
     this.log.info("connect start", { dbPath });
     const sqljsPkg = "sql.js";
-    const initSqlJs = await import(
-      /* @vite-ignore */
-      sqljsPkg
+    const initSqlJs = await loadHarnessSdk(
+      sqljsPkg,
+      ctx.projectDir ?? process.cwd(),
+      () => import(
+        /* @vite-ignore */
+        sqljsPkg
+      ),
+      "the sqlite connector needs sql.js, which is"
     ).then((m) => m.default ?? m);
     const SQL = await initSqlJs();
     const isReadonly = declaration.access === "read-only";
@@ -10811,26 +10860,41 @@ function scopesTargetSameRepository(left, right) {
 function isUnavailableBlock(block) {
   return block.lines.some((l) => l.trim() === UNAVAILABLE_MARKER);
 }
+var TRUSTED_GIT_CA_ENV = "SKAILE_GIT_TRUSTED_CAINFO";
 var USER_GITCONFIG_BLOCK = ".user-gitconfig";
+var USER_CA_BLOCK = ".user-ca-info";
+function quoteConfigValue(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
 function writeUserGitconfigInclude(opts) {
   if ("userGitconfigPath" in opts) {
     throw new TypeError(
       "writeUserGitconfigInclude: `userGitconfigPath` was replaced by `userGitconfigPaths` (an array of paths); pass `userGitconfigPaths: [path]`"
     );
   }
-  const { gitconfigPath, userGitconfigPaths = [] } = opts;
+  const { gitconfigPath, userGitconfigPaths = [], userCaInfo } = opts;
   const text = readFileOrEmpty(gitconfigPath);
-  const blocks = parseBlocks(text).filter((b) => b.mountId !== USER_GITCONFIG_BLOCK);
+  const blocks = parseBlocks(text).filter(
+    (b) => b.mountId !== USER_GITCONFIG_BLOCK && b.mountId !== USER_CA_BLOCK
+  );
+  if (userCaInfo) {
+    blocks.unshift({
+      mountId: USER_CA_BLOCK,
+      lines: [
+        blockStart(USER_CA_BLOCK),
+        "[http]",
+        `	sslCAInfo = ${quoteConfigValue(userCaInfo)}`,
+        blockEnd(USER_CA_BLOCK)
+      ]
+    });
+  }
   if (userGitconfigPaths.length > 0) {
     blocks.unshift({
       mountId: USER_GITCONFIG_BLOCK,
       lines: [
         blockStart(USER_GITCONFIG_BLOCK),
         "[include]",
-        // Git config values: a backslash or a double quote needs an escape.
-        ...userGitconfigPaths.map(
-          (p) => `	path = "${p.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`
-        ),
+        ...userGitconfigPaths.map((p) => `	path = ${quoteConfigValue(p)}`),
         blockEnd(USER_GITCONFIG_BLOCK)
       ]
     });
@@ -13982,6 +14046,6 @@ function describeFlowOperations() {
   return new FlowAdapter().tools.describeOperations({ access: "read-write" });
 }
 
-export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, CONNECT_FAILURE_CARRY_OVER_TTL_MS, ClassifierSubpromptRunner, ConnectFailureCarryOver, ConnectorConnectingError, ConnectorManager, DeployConnector, DevServerConnector, FleetMountConnectingError, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NO_ACTIVE_FLOW_ERROR, PortPool, PostgresConnector, S3Connector, S3FetchStoppedError, S3PresignedRequestError, S3_PRESIGN_BATCH, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, SubFlowContractError, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, atomicReplaceCredential, buildConnectorListPayload, buildConnectorPromptSection, buildConnectorToolDefs, buildFlowPromptEvent, buildFlowToolDefs, buildLazyFlowToolDefs, buildLazySdkFlowTools, buildSdkConnectorTools, buildSdkFlowTools, checkFleetMountLiveness, classifierQuestion, classifyConnectError, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, describeFlowOperations, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, fleetMountConnectingMessage, getConnector, installNpmPackages, isFleetManaged, isFleetMountConnectingError, isPackageResolvable, listConnectors, listWorktrees, missingTokenMediatorMessage, normalizeRuntimeFlow, parseListObjectsV2, presignScopePrefix, presignableKey, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, resolveAccessPolicy, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock, writeUserGitconfigInclude };
-//# sourceMappingURL=chunk-AQTAULXT.js.map
-//# sourceMappingURL=chunk-AQTAULXT.js.map
+export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, CONNECT_FAILURE_CARRY_OVER_TTL_MS, ClassifierSubpromptRunner, ConnectFailureCarryOver, ConnectorConnectingError, ConnectorManager, DeployConnector, DevServerConnector, FleetMountConnectingError, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NO_ACTIVE_FLOW_ERROR, PortPool, PostgresConnector, S3Connector, S3FetchStoppedError, S3PresignedRequestError, S3_PRESIGN_BATCH, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, SubFlowContractError, TRUSTED_GIT_CA_ENV, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, atomicReplaceCredential, buildConnectorListPayload, buildConnectorPromptSection, buildConnectorToolDefs, buildFlowPromptEvent, buildFlowToolDefs, buildLazyFlowToolDefs, buildLazySdkFlowTools, buildSdkConnectorTools, buildSdkFlowTools, checkFleetMountLiveness, classifierQuestion, classifyConnectError, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, describeFlowOperations, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, fleetMountConnectingMessage, getConnector, installNpmPackages, isFleetManaged, isFleetMountConnectingError, isPackageResolvable, listConnectors, listWorktrees, missingTokenMediatorMessage, normalizeRuntimeFlow, parseListObjectsV2, presignScopePrefix, presignableKey, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, resolveAccessPolicy, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock, writeUserGitconfigInclude };
+//# sourceMappingURL=chunk-SKG6G4HO.js.map
+//# sourceMappingURL=chunk-SKG6G4HO.js.map