@synap-core/cli 1.12.2 → 1.13.1-next.20261102.246dc73

package/dist/commands/worker-github-app.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The worker's GitHub identity: a GitHub App installation, never a person.
+ *
+ * An unattended run has Bash, so whatever `gh` and `git push` authenticate as
+ * is what a prompt injection can use. The founder's login is an org admin (it
+ * can `gh pr merge --admin` past the ruleset); the "Synap Agent" App has no
+ * administration, members or bypass permission (see docs/synap-agent-app.md).
+ *
+ * The App's id and private key live in an owner-only env file
+ * (default ~/.config/synap-agent-app.env):
+ *
+ *   GITHUB_APP_ID=123456
+ *   GITHUB_APP_PRIVATE_KEY_FILE=/home/me/.config/synap-agent-app.pem   (0600)
+ *   GITHUB_APP_INSTALLATION_ID=7890123      # optional: the org's installation
+ *
+ * Each launch mints an installation token (valid 1 h, cached until 5 min
+ * before it ends) and puts it in the run's GH_TOKEN. Neither the key nor a
+ * token is ever logged or written to state.
+ */
+export interface GithubAppConfig {
+    appId: string;
+    privateKey: string;
+    installationId?: string;
+}
+export declare function defaultGithubAppFile(): string;
+/** `KEY=value` lines, `#` comments, optional quotes. */
+export declare function parseEnvFile(text: string): Record<string, string>;
+/**
+ * `undefined`: no env file (the caller warns, loudly). Throws when the file is
+ * there but unusable, so a half-set-up App never silently falls back to a
+ * person's login.
+ */
+export declare function loadGithubAppConfig(file?: string): GithubAppConfig | undefined;
+/** The files a person must keep owner-only: any that others can read. */
+export declare function githubAppFilesTooOpen(file?: string): string[];
+/** The App JWT (RS256): 10 minutes at most, issued 60 s in the past for clock skew. */
+export declare function signAppJwt(appId: string, privateKey: string, nowMs: number): string;
+export interface InstallationTokenSource {
+    /** A token valid now; mints a new one when the cached one is near its end. Throws on failure. */
+    get(): Promise<string>;
+}
+export declare function createInstallationTokenSource(config: GithubAppConfig, o?: {
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}): InstallationTokenSource;
+export interface GithubRunEnv {
+    /** A token valid at launch: what a caller that skips the helpers (an absolute /usr/bin/gh) gets for its first hour. */
+    token: string;
+    /** The worker's token broker socket (worker-github-broker.ts). */
+    sock: string;
+    /** Holds the `gh` wrapper and the git credential helper; first on the run's PATH. */
+    binDir: string;
+    gitHelper: string;
+    /** An EMPTY folder: `gh` never reads the person's hosts.yml. */
+    ghConfigDir: string;
+}
+/**
+ * The environment that makes `gh` AND `git push` (https) act as the App for
+ * the whole run: both ask the broker for a fresh token each time, and the
+ * credential-helper list is reset first, so a helper holding a person's login
+ * is never asked.
+ */
+export declare function githubRunEnv(g: GithubRunEnv, basePath: string | undefined): NodeJS.ProcessEnv;

package/dist/commands/worker-github-app.js

@@ -0,0 +1,161 @@
+/**
+ * The worker's GitHub identity: a GitHub App installation, never a person.
+ *
+ * An unattended run has Bash, so whatever `gh` and `git push` authenticate as
+ * is what a prompt injection can use. The founder's login is an org admin (it
+ * can `gh pr merge --admin` past the ruleset); the "Synap Agent" App has no
+ * administration, members or bypass permission (see docs/synap-agent-app.md).
+ *
+ * The App's id and private key live in an owner-only env file
+ * (default ~/.config/synap-agent-app.env):
+ *
+ *   GITHUB_APP_ID=123456
+ *   GITHUB_APP_PRIVATE_KEY_FILE=/home/me/.config/synap-agent-app.pem   (0600)
+ *   GITHUB_APP_INSTALLATION_ID=7890123      # optional: the org's installation
+ *
+ * Each launch mints an installation token (valid 1 h, cached until 5 min
+ * before it ends) and puts it in the run's GH_TOKEN. Neither the key nor a
+ * token is ever logged or written to state.
+ */
+import { createSign } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+export function defaultGithubAppFile() {
+    return path.join(os.homedir(), ".config", "synap-agent-app.env");
+}
+/** `KEY=value` lines, `#` comments, optional quotes. */
+export function parseEnvFile(text) {
+    const out = {};
+    for (const line of text.split("\n")) {
+        const m = /^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*?)\s*$/.exec(line);
+        if (!m || line.trimStart().startsWith("#"))
+            continue;
+        out[m[1]] = m[2].replace(/^(["'])(.*)\1$/, "$2");
+    }
+    return out;
+}
+/**
+ * `undefined`: no env file (the caller warns, loudly). Throws when the file is
+ * there but unusable, so a half-set-up App never silently falls back to a
+ * person's login.
+ */
+export function loadGithubAppConfig(file = defaultGithubAppFile()) {
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw new Error(`GitHub App file ${file} could not be read: ${err.message}`);
+    }
+    const env = parseEnvFile(text);
+    const appId = env.GITHUB_APP_ID;
+    const keyFile = env.GITHUB_APP_PRIVATE_KEY_FILE;
+    if (!appId || !keyFile)
+        throw new Error(`GitHub App file ${file} needs GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY_FILE`);
+    const keyPath = keyFile.startsWith("~/") ? path.join(os.homedir(), keyFile.slice(2)) : keyFile;
+    let privateKey;
+    try {
+        privateKey = fs.readFileSync(keyPath, "utf8");
+    }
+    catch (err) {
+        throw new Error(`GitHub App private key ${keyPath} could not be read: ${err.message}`);
+    }
+    return { appId, privateKey, installationId: env.GITHUB_APP_INSTALLATION_ID || undefined };
+}
+/** The files a person must keep owner-only: any that others can read. */
+export function githubAppFilesTooOpen(file = defaultGithubAppFile()) {
+    const open = [];
+    const check = (f) => {
+        try {
+            if ((fs.statSync(f).mode & 0o077) !== 0)
+                open.push(f);
+        }
+        catch {
+            /* missing: loadGithubAppConfig reports it */
+        }
+    };
+    check(file);
+    try {
+        const keyFile = parseEnvFile(fs.readFileSync(file, "utf8")).GITHUB_APP_PRIVATE_KEY_FILE;
+        if (keyFile)
+            check(keyFile.startsWith("~/") ? path.join(os.homedir(), keyFile.slice(2)) : keyFile);
+    }
+    catch {
+        /* unreadable: loadGithubAppConfig reports it */
+    }
+    return open;
+}
+const b64url = (b) => Buffer.from(b).toString("base64url");
+/** The App JWT (RS256): 10 minutes at most, issued 60 s in the past for clock skew. */
+export function signAppJwt(appId, privateKey, nowMs) {
+    const iat = Math.floor(nowMs / 1000) - 60;
+    const head = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const body = b64url(JSON.stringify({ iat, exp: iat + 9 * 60, iss: appId }));
+    const sig = createSign("RSA-SHA256").update(`${head}.${body}`).sign(privateKey);
+    return `${head}.${body}.${b64url(sig)}`;
+}
+const API = "https://api.github.com";
+const REFRESH_BEFORE_MS = 5 * 60_000;
+export function createInstallationTokenSource(config, o = {}) {
+    const doFetch = o.fetchImpl ?? fetch;
+    const now = o.now ?? Date.now;
+    let cached;
+    let installationId = config.installationId;
+    const call = async (method, url) => {
+        const res = await doFetch(`${API}${url}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${signAppJwt(config.appId, config.privateKey, now())}`,
+                Accept: "application/vnd.github+json",
+                "X-GitHub-Api-Version": "2022-11-28",
+                "User-Agent": "synap-worker",
+            },
+        });
+        if (!res.ok)
+            throw new Error(`GitHub ${method} ${url} answered ${res.status}`);
+        return res.json();
+    };
+    return {
+        async get() {
+            if (cached && cached.expiresAt - now() > REFRESH_BEFORE_MS)
+                return cached.token;
+            if (!installationId) {
+                const list = (await call("GET", "/app/installations"));
+                if (!Array.isArray(list) || list.length !== 1) {
+                    throw new Error(`the App has ${Array.isArray(list) ? list.length : "an unreadable number of"} installations — set GITHUB_APP_INSTALLATION_ID`);
+                }
+                installationId = String(list[0].id);
+            }
+            const r = (await call("POST", `/app/installations/${installationId}/access_tokens`));
+            if (!r.token || !r.expires_at)
+                throw new Error("GitHub answered no installation token");
+            cached = { token: r.token, expiresAt: Date.parse(r.expires_at) };
+            return r.token;
+        },
+    };
+}
+/**
+ * The environment that makes `gh` AND `git push` (https) act as the App for
+ * the whole run: both ask the broker for a fresh token each time, and the
+ * credential-helper list is reset first, so a helper holding a person's login
+ * is never asked.
+ */
+export function githubRunEnv(g, basePath) {
+    return {
+        PATH: [g.binDir, basePath].filter(Boolean).join(path.delimiter),
+        SYNAP_GH_SOCK: g.sock,
+        GH_CONFIG_DIR: g.ghConfigDir,
+        GH_TOKEN: g.token,
+        GITHUB_TOKEN: g.token,
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_CONFIG_COUNT: "2",
+        GIT_CONFIG_KEY_0: "credential.helper",
+        GIT_CONFIG_VALUE_0: "",
+        GIT_CONFIG_KEY_1: "credential.helper",
+        GIT_CONFIG_VALUE_1: `!${g.gitHelper}`,
+    };
+}
+//# sourceMappingURL=worker-github-app.js.map

package/dist/commands/worker-github-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-app.js","sourceRoot":"","sources":["../../src/commands/worker-github-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;AACnE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACrD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,oBAAoB,EAAE;IACvE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,2BAA2B,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,sDAAsD,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/F,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,CAAC,0BAA0B,IAAI,SAAS,EAAE,CAAC;AAC5F,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,OAAe,oBAAoB,EAAE;IACzE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC;QACxF,IAAI,OAAO;YAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5E,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,UAAkB,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAOrC,MAAM,UAAU,6BAA6B,CAC3C,MAAuB,EACvB,IAAsD,EAAE;IAExD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAC9B,IAAI,MAAwD,CAAC;IAC7D,IAAI,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE3C,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,GAAW,EAAoB,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE;YACxC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE;gBAC7E,MAAM,EAAE,6BAA6B;gBACrC,sBAAsB,EAAE,YAAY;gBACpC,YAAY,EAAE,cAAc;aAC7B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,IAAI,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG;YACP,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,GAAG,iBAAiB;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YAChF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAA0B,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,iDAAiD,CAC9H,CAAC;gBACJ,CAAC;gBACD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,sBAAsB,cAAc,gBAAgB,CAAC,CAGlF,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACxF,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,CAAe,EAAE,QAA4B;IACxE,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,aAAa,EAAE,CAAC,CAAC,IAAI;QACrB,aAAa,EAAE,CAAC,CAAC,WAAW;QAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK;QACjB,YAAY,EAAE,CAAC,CAAC,KAAK;QACrB,mBAAmB,EAAE,GAAG;QACxB,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,mBAAmB;QACrC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,mBAAmB;QACrC,kBAAkB,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/commands/worker-github-app.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/worker-github-app.test.js

@@ -0,0 +1,102 @@
+import { createVerify, generateKeyPairSync } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { createInstallationTokenSource, githubAppFilesTooOpen, githubRunEnv, loadGithubAppConfig, parseEnvFile, signAppJwt, } from "./worker-github-app.js";
+const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" },
+});
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), "gh-app-"));
+describe("signAppJwt", () => {
+    it("is a RS256 JWT for the app id that its public key verifies, valid under 10 minutes", () => {
+        const now = Date.parse("2026-10-28T12:00:00Z");
+        const [h, b, s] = signAppJwt("123", privateKey, now).split(".");
+        expect(JSON.parse(Buffer.from(h, "base64url").toString())).toEqual({ alg: "RS256", typ: "JWT" });
+        const body = JSON.parse(Buffer.from(b, "base64url").toString());
+        expect(body.iss).toBe("123");
+        expect(body.exp - body.iat).toBeLessThanOrEqual(600);
+        expect(createVerify("RSA-SHA256").update(`${h}.${b}`).verify(publicKey, Buffer.from(s, "base64url"))).toBe(true);
+    });
+});
+describe("loadGithubAppConfig", () => {
+    it("no file is undefined (the caller warns), never a throw", () => {
+        expect(loadGithubAppConfig(path.join(tmp(), "none.env"))).toBeUndefined();
+    });
+    it("reads the id, the key by path and the installation id", () => {
+        const d = tmp();
+        fs.writeFileSync(path.join(d, "k.pem"), privateKey, { mode: 0o600 });
+        fs.writeFileSync(path.join(d, "a.env"), `# the Synap Agent App\nGITHUB_APP_ID=42\nGITHUB_APP_PRIVATE_KEY_FILE="${path.join(d, "k.pem")}"\nGITHUB_APP_INSTALLATION_ID=7\n`, { mode: 0o600 });
+        const cfg = loadGithubAppConfig(path.join(d, "a.env"));
+        expect(cfg).toMatchObject({ appId: "42", installationId: "7" });
+        expect(cfg?.privateKey).toContain("BEGIN PRIVATE KEY");
+        expect(githubAppFilesTooOpen(path.join(d, "a.env"))).toEqual([]);
+    });
+    it("a file that is there but unusable THROWS — never a silent fall back to a person's login", () => {
+        const d = tmp();
+        fs.writeFileSync(path.join(d, "a.env"), "GITHUB_APP_ID=42\n");
+        expect(() => loadGithubAppConfig(path.join(d, "a.env"))).toThrow(/GITHUB_APP_PRIVATE_KEY_FILE/);
+        fs.writeFileSync(path.join(d, "b.env"), `GITHUB_APP_ID=42\nGITHUB_APP_PRIVATE_KEY_FILE=${path.join(d, "missing.pem")}\n`);
+        expect(() => loadGithubAppConfig(path.join(d, "b.env"))).toThrow(/could not be read/);
+    });
+    it("names a key or env file that others can read", () => {
+        const d = tmp();
+        fs.writeFileSync(path.join(d, "k.pem"), privateKey, { mode: 0o644 });
+        fs.writeFileSync(path.join(d, "a.env"), `GITHUB_APP_ID=1\nGITHUB_APP_PRIVATE_KEY_FILE=${path.join(d, "k.pem")}\n`, { mode: 0o600 });
+        expect(githubAppFilesTooOpen(path.join(d, "a.env"))).toEqual([path.join(d, "k.pem")]);
+    });
+    it("parseEnvFile ignores comments and strips quotes", () => {
+        expect(parseEnvFile("# A=1\nB='x y'\nexport C=3")).toEqual({ B: "x y", C: "3" });
+    });
+});
+describe("createInstallationTokenSource", () => {
+    const T0 = Date.parse("2026-10-28T12:00:00Z");
+    const fakeFetch = (log, opts = {}) => (async (url, init) => {
+        log.push(`${init.method} ${url.replace("https://api.github.com", "")}`);
+        expect(init.headers.Authorization).toMatch(/^Bearer [\w-]+\.[\w-]+\.[\w-]+$/);
+        const ok = (opts.status ?? 200) < 400;
+        if (url.endsWith("/app/installations"))
+            return { ok, status: opts.status ?? 200, json: async () => opts.installations ?? [{ id: 9 }] };
+        return {
+            ok,
+            status: opts.status ?? 200,
+            json: async () => ({ token: `ghs_${log.length}`, expires_at: new Date(T0 + 3600_000).toISOString() }),
+        };
+    });
+    it("finds the single installation, mints a token, and reuses it until 5 min before it ends", async () => {
+        const log = [];
+        let t = T0;
+        const src = createInstallationTokenSource({ appId: "1", privateKey }, { fetchImpl: fakeFetch(log), now: () => t });
+        const a = await src.get();
+        expect(log).toEqual(["GET /app/installations", "POST /app/installations/9/access_tokens"]);
+        t = T0 + 50 * 60_000;
+        expect(await src.get()).toBe(a);
+        expect(log).toHaveLength(2);
+        t = T0 + 56 * 60_000;
+        expect(await src.get()).not.toBe(a);
+        expect(log).toHaveLength(3);
+    });
+    it("two installations and no id is an error, not a guess", async () => {
+        const src = createInstallationTokenSource({ appId: "1", privateKey }, { fetchImpl: fakeFetch([], { installations: [{ id: 1 }, { id: 2 }] }), now: () => T0 });
+        await expect(src.get()).rejects.toThrow(/GITHUB_APP_INSTALLATION_ID/);
+    });
+    it("a refused call throws (the worker then does not launch)", async () => {
+        const src = createInstallationTokenSource({ appId: "1", privateKey, installationId: "9" }, { fetchImpl: fakeFetch([], { status: 401 }), now: () => T0 });
+        await expect(src.get()).rejects.toThrow(/401/);
+    });
+});
+describe("githubRunEnv", () => {
+    const g = { token: "ghs_x", sock: "/s", binDir: "/b", gitHelper: "/b/git-credential-synap", ghConfigDir: "/c" };
+    it("puts the helpers first on PATH, gh on an empty config dir, and resets the credential helpers first", () => {
+        const e = githubRunEnv(g, "/usr/bin:/bin");
+        expect(e.PATH).toBe("/b:/usr/bin:/bin");
+        expect(e.GH_CONFIG_DIR).toBe("/c");
+        expect(e.SYNAP_GH_SOCK).toBe("/s");
+        expect(e.GH_TOKEN).toBe("ghs_x");
+        expect([e.GIT_CONFIG_KEY_0, e.GIT_CONFIG_VALUE_0]).toEqual(["credential.helper", ""]);
+        expect(e.GIT_CONFIG_VALUE_1).toBe("!/b/git-credential-synap");
+    });
+});
+//# sourceMappingURL=worker-github-app.test.js.map

package/dist/commands/worker-github-app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-app.test.js","sourceRoot":"","sources":["../../src/commands/worker-github-app.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,UAAU,GACX,MAAM,wBAAwB,CAAC;AAEhC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;IAC3D,aAAa,EAAE,IAAI;IACnB,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;IACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;CACnD,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAEpE,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EACrB,yEAAyE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,mCAAmC,EACjI,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAChG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,iDAAiD,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1H,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,gDAAgD,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpI,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,OAAuD,EAAE,EAAE,EAAE,CAC7F,CAAC,KAAK,EAAE,GAAW,EAAE,IAAyD,EAAE,EAAE;QAChF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACvI,OAAO;YACL,EAAE;YACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;SACtG,CAAC;IACJ,CAAC,CAA4B,CAAC;IAEhC,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,6BAA6B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC,CAAC;QAC3F,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,6BAA6B,CACvC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAC1B,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CACvF,CAAC;QACF,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,6BAA6B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzJ,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChH,EAAE,CAAC,oGAAoG,EAAE,GAAG,EAAE;QAC5G,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/worker-github-broker.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Keeps a long run on its GitHub identity.
+ *
+ * An installation token lasts 1 h; a static GH_TOKEN would stop working under
+ * a longer run. So a run's `gh` and `git` ask the WORKER for a token each time
+ * they need one, over an owner-only unix socket, and the worker mints or
+ * reuses one from the App key (worker-github-app.ts). The key stays in the
+ * worker process; a run is handed tokens, never the key, and its environment
+ * carries neither the key file's path nor a long-lived secret.
+ *
+ *   <binDir>/gh                     `gh` with GH_TOKEN set to a fresh token
+ *   <binDir>/git-credential-synap   git credential helper (https pushes)
+ *   <binDir>/synap-gh-token         asks the broker, prints the token
+ *
+ * The runs' PATH starts with <binDir>. An absolute /usr/bin/gh still finds no
+ * login: the run's GH_CONFIG_DIR is an empty folder (the person's hosts.yml is
+ * never read).
+ */
+import type { InstallationTokenSource } from "./worker-github-app.js";
+export interface TokenBroker {
+    /** The unix socket a run's helpers connect to (SYNAP_GH_SOCK). */
+    sock: string;
+    ready: Promise<void>;
+    close(): void;
+}
+/** One request = one connection: the answer is `OK <token>\n` or `ERR <message>\n`. */
+export declare function startTokenBroker(source: InstallationTokenSource): TokenBroker;
+/** The first `name` on PATH that is not inside `exclude`. */
+export declare function findOnPath(name: string, searchPath: string | undefined, exclude: string): string | undefined;
+/**
+ * Writes the three helpers. `realGh`: the `gh` to call (undefined: no `gh`
+ * wrapper, the box has none). Returns the helper paths.
+ */
+export declare function writeGithubHelpers(binDir: string, o?: {
+    realGh?: string;
+    nodeBin?: string;
+}): {
+    gitHelper: string;
+};

package/dist/commands/worker-github-broker.js

@@ -0,0 +1,106 @@
+/**
+ * Keeps a long run on its GitHub identity.
+ *
+ * An installation token lasts 1 h; a static GH_TOKEN would stop working under
+ * a longer run. So a run's `gh` and `git` ask the WORKER for a token each time
+ * they need one, over an owner-only unix socket, and the worker mints or
+ * reuses one from the App key (worker-github-app.ts). The key stays in the
+ * worker process; a run is handed tokens, never the key, and its environment
+ * carries neither the key file's path nor a long-lived secret.
+ *
+ *   <binDir>/gh                     `gh` with GH_TOKEN set to a fresh token
+ *   <binDir>/git-credential-synap   git credential helper (https pushes)
+ *   <binDir>/synap-gh-token         asks the broker, prints the token
+ *
+ * The runs' PATH starts with <binDir>. An absolute /usr/bin/gh still finds no
+ * login: the run's GH_CONFIG_DIR is an empty folder (the person's hosts.yml is
+ * never read).
+ */
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { writeSecretFile } from "../lib/atomic-file.js";
+/** One request = one connection: the answer is `OK <token>\n` or `ERR <message>\n`. */
+export function startTokenBroker(source) {
+    // Under the tmp dir, not the state dir: a unix socket path is limited to ~104 bytes.
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "synap-gh-"));
+    fs.chmodSync(dir, 0o700);
+    const sock = path.join(dir, "s");
+    const server = net.createServer((conn) => {
+        source.get().then((t) => conn.end(`OK ${t}\n`), (err) => conn.end(`ERR ${err.message.replace(/\s+/g, " ")}\n`));
+        conn.on("error", () => conn.destroy());
+    });
+    server.unref(); // never what keeps the worker process alive
+    const ready = new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(sock, () => {
+            fs.chmodSync(sock, 0o600);
+            resolve();
+        });
+    });
+    return {
+        sock,
+        ready,
+        close: () => {
+            server.close();
+            fs.rmSync(dir, { recursive: true, force: true });
+        },
+    };
+}
+const sh = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** The first `name` on PATH that is not inside `exclude`. */
+export function findOnPath(name, searchPath, exclude) {
+    for (const d of (searchPath ?? "").split(path.delimiter)) {
+        if (!d || path.resolve(d) === path.resolve(exclude))
+            continue;
+        const f = path.join(d, name);
+        try {
+            fs.accessSync(f, fs.constants.X_OK);
+            if (fs.statSync(f).isFile())
+                return f;
+        }
+        catch {
+            /* not here */
+        }
+    }
+    return undefined;
+}
+/**
+ * Writes the three helpers. `realGh`: the `gh` to call (undefined: no `gh`
+ * wrapper, the box has none). Returns the helper paths.
+ */
+export function writeGithubHelpers(binDir, o = {}) {
+    fs.mkdirSync(binDir, { recursive: true, mode: 0o700 });
+    const node = o.nodeBin ?? process.execPath;
+    const tokenBin = path.join(binDir, "synap-gh-token");
+    // writeSecretFile chmods after writing: a helper left by an earlier run is tightened too.
+    const put = (name, body) => writeSecretFile(path.join(binDir, name), body, { mode: 0o700 });
+    put("synap-gh-token", `#!${node}
+const net = require("node:net");
+const c = net.connect(process.env.SYNAP_GH_SOCK || "");
+let buf = "";
+c.on("data", (d) => (buf += d));
+c.on("error", (e) => { console.error("synap-gh-token: " + e.message); process.exit(1); });
+c.on("end", () => {
+  const m = /^OK (.+)\\n$/.exec(buf);
+  if (!m) { console.error("synap-gh-token: " + (buf.trim() || "no answer")); process.exit(1); }
+  process.stdout.write(m[1]);
+});
+`);
+    put("git-credential-synap", `#!/bin/sh
+# git credential helper: only "get" answers; the token is asked for now, never stored.
+[ "$1" = get ] || exit 0
+cat >/dev/null
+t=$(${sh(tokenBin)}) || exit 1
+printf 'username=x-access-token\\npassword=%s\\n' "$t"
+`);
+    if (o.realGh) {
+        put("gh", `#!/bin/sh
+t=$(${sh(tokenBin)}) || exit 1
+GH_TOKEN="$t" GITHUB_TOKEN="$t" exec ${sh(o.realGh)} "$@"
+`);
+    }
+    return { gitHelper: path.join(binDir, "git-credential-synap") };
+}
+//# sourceMappingURL=worker-github-broker.js.map

package/dist/commands/worker-github-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-broker.js","sourceRoot":"","sources":["../../src/commands/worker-github-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAUxD,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,qFAAqF;IACrF,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAQ,GAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAC1E,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,4CAA4C;IAC5D,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACvB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAE1D,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,UAA8B,EAAE,OAAe;IACtF,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAA2C,EAAE;IAC9F,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,0FAA0F;IAC1F,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,GAAG,CACD,gBAAgB,EAChB,KAAK,IAAI;;;;;;;;;;;CAWZ,CACE,CAAC;IACF,GAAG,CACD,sBAAsB,EACtB;;;;MAIE,EAAE,CAAC,QAAQ,CAAC;;CAEjB,CACE,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,GAAG,CACD,IAAI,EACJ;MACA,EAAE,CAAC,QAAQ,CAAC;uCACqB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAClD,CACI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;AAClE,CAAC"}

package/dist/commands/worker-github-broker.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/worker-github-broker.test.js

@@ -0,0 +1,90 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { generateKeyPairSync } from "node:crypto";
+import { afterEach, describe, expect, it } from "vitest";
+import { createInstallationTokenSource } from "./worker-github-app.js";
+import { findOnPath, startTokenBroker, writeGithubHelpers } from "./worker-github-broker.js";
+const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048, privateKeyEncoding: { type: "pkcs8", format: "pem" }, publicKeyEncoding: { type: "spki", format: "pem" } });
+const T0 = Date.parse("2026-10-28T12:00:00Z");
+let t = T0;
+let minted = 0;
+const fakeFetch = (async (url) => {
+    if (url.endsWith("/app/installations"))
+        return { ok: true, status: 200, json: async () => [{ id: 9 }] };
+    minted++;
+    return { ok: true, status: 200, json: async () => ({ token: `ghs_${minted}`, expires_at: new Date(t + 3600_000).toISOString() }) };
+});
+const run = (bin, args, env, input) => new Promise((resolve) => {
+    const c = execFile(bin, args, { env }, (err, stdout, stderr) => resolve({ code: err ? (err.code ?? 1) : 0, stdout, stderr }));
+    // A helper may exit without reading its stdin (the git helper on `store`):
+    // the write then fails with EPIPE, which is the child's choice, not a test failure.
+    c.stdin?.on("error", () => { });
+    c.stdin?.end(input ?? "");
+});
+const closers = [];
+afterEach(() => closers.splice(0).forEach((c) => c()));
+const setup = async (source = createInstallationTokenSource({ appId: "1", privateKey }, { fetchImpl: fakeFetch, now: () => t })) => {
+    t = T0;
+    minted = 0;
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "bk-"));
+    const realGh = path.join(dir, "real-gh");
+    fs.writeFileSync(realGh, '#!/bin/sh\necho "gh-as:$GH_TOKEN args:$*"\n', { mode: 0o755 });
+    const binDir = path.join(dir, "bin");
+    const { gitHelper } = writeGithubHelpers(binDir, { realGh });
+    const broker = startTokenBroker(source);
+    closers.push(() => broker.close());
+    await broker.ready;
+    const env = { SYNAP_GH_SOCK: broker.sock, PATH: `${binDir}:/usr/bin:/bin` };
+    return { binDir, gitHelper, env, broker };
+};
+describe("the GitHub helpers a run uses", () => {
+    it("gh runs with a token that is still valid after the first hour (the clock is stubbed)", async () => {
+        const { binDir, env } = await setup();
+        const first = await run(path.join(binDir, "gh"), ["pr", "list"], env);
+        expect(first.stdout.trim()).toBe("gh-as:ghs_1 args:pr list");
+        t = T0 + 30 * 60_000;
+        expect((await run(path.join(binDir, "gh"), [], env)).stdout).toContain("ghs_1"); // reused, not re-minted
+        t = T0 + 61 * 60_000; // past the first token's end
+        const later = await run(path.join(binDir, "gh"), ["pr", "list"], env);
+        expect(later.stdout.trim()).toBe("gh-as:ghs_2 args:pr list");
+    });
+    it("the git credential helper answers `get` with a fresh token and nothing for other operations", async () => {
+        const { gitHelper, env } = await setup();
+        const get = await run(gitHelper, ["get"], env, "protocol=https\nhost=github.com\n\n");
+        expect(get.stdout).toBe("username=x-access-token\npassword=ghs_1\n");
+        t = T0 + 61 * 60_000;
+        expect((await run(gitHelper, ["get"], env, "host=github.com\n\n")).stdout).toContain("password=ghs_2");
+        expect((await run(gitHelper, ["store"], env, "x\n")).stdout).toBe("");
+    });
+    it("a broker that cannot mint makes gh fail without calling the real gh (no fall back to another login)", async () => {
+        const { binDir, env } = await setup({
+            get: async () => {
+                throw new Error("GitHub answered 401");
+            },
+        });
+        const r = await run(path.join(binDir, "gh"), ["pr", "list"], env);
+        expect(r.code).not.toBe(0);
+        expect(r.stdout).not.toContain("gh-as");
+        expect(r.stderr).toContain("401");
+    });
+    it("the key is never handed over: neither helper nor answer carries it", async () => {
+        const { binDir, env } = await setup();
+        const out = (await run(path.join(binDir, "gh"), [], env)).stdout;
+        expect(out).not.toContain("PRIVATE KEY");
+        for (const f of fs.readdirSync(binDir))
+            expect(fs.readFileSync(path.join(binDir, f), "utf8")).not.toContain("PRIVATE KEY");
+    });
+});
+describe("findOnPath", () => {
+    it("skips the helpers' own folder, so the wrapper never calls itself", () => {
+        const a = fs.mkdtempSync(path.join(os.tmpdir(), "fp-"));
+        const b = fs.mkdtempSync(path.join(os.tmpdir(), "fp-"));
+        for (const d of [a, b])
+            fs.writeFileSync(path.join(d, "gh"), "#!/bin/sh\n", { mode: 0o755 });
+        expect(findOnPath("gh", `${a}:${b}`, a)).toBe(path.join(b, "gh"));
+        expect(findOnPath("nope", `${a}:${b}`, a)).toBeUndefined();
+    });
+});
+//# sourceMappingURL=worker-github-broker.test.js.map

package/dist/commands/worker-github-broker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-broker.test.js","sourceRoot":"","sources":["../../src/commands/worker-github-broker.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE7F,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAErL,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;AACX,IAAI,MAAM,GAAG,CAAC,CAAC;AACf,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;AACrI,CAAC,CAA4B,CAAC;AAE9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,GAA2B,EAAE,KAAc,EAAE,EAAE,CACvF,IAAI,OAAO,CAAmD,CAAC,OAAO,EAAE,EAAE;IACxE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAC7D,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpF,CAAC;IACF,2EAA2E;IAC3E,oFAAoF;IACpF,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAsB,EAAE,CAAC;AACtC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEvD,MAAM,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,6BAA6B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACjI,CAAC,GAAG,EAAE,CAAC;IACP,MAAM,GAAG,CAAC,CAAC;IACX,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;QACzG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,6BAA6B;QACnD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACvG,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC;YAClC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/worker-runs.test.d.ts

@@ -0,0 +1 @@
+export {};