@synap-core/cli 1.13.0 → 1.13.1-next.20261102.246dc73

package/dist/commands/worker-github-app.test.js

@@ -0,0 +1,102 @@
+import { createVerify, generateKeyPairSync } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { createInstallationTokenSource, githubAppFilesTooOpen, githubRunEnv, loadGithubAppConfig, parseEnvFile, signAppJwt, } from "./worker-github-app.js";
+const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" },
+});
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), "gh-app-"));
+describe("signAppJwt", () => {
+    it("is a RS256 JWT for the app id that its public key verifies, valid under 10 minutes", () => {
+        const now = Date.parse("2026-10-28T12:00:00Z");
+        const [h, b, s] = signAppJwt("123", privateKey, now).split(".");
+        expect(JSON.parse(Buffer.from(h, "base64url").toString())).toEqual({ alg: "RS256", typ: "JWT" });
+        const body = JSON.parse(Buffer.from(b, "base64url").toString());
+        expect(body.iss).toBe("123");
+        expect(body.exp - body.iat).toBeLessThanOrEqual(600);
+        expect(createVerify("RSA-SHA256").update(`${h}.${b}`).verify(publicKey, Buffer.from(s, "base64url"))).toBe(true);
+    });
+});
+describe("loadGithubAppConfig", () => {
+    it("no file is undefined (the caller warns), never a throw", () => {
+        expect(loadGithubAppConfig(path.join(tmp(), "none.env"))).toBeUndefined();
+    });
+    it("reads the id, the key by path and the installation id", () => {
+        const d = tmp();
+        fs.writeFileSync(path.join(d, "k.pem"), privateKey, { mode: 0o600 });
+        fs.writeFileSync(path.join(d, "a.env"), `# the Synap Agent App\nGITHUB_APP_ID=42\nGITHUB_APP_PRIVATE_KEY_FILE="${path.join(d, "k.pem")}"\nGITHUB_APP_INSTALLATION_ID=7\n`, { mode: 0o600 });
+        const cfg = loadGithubAppConfig(path.join(d, "a.env"));
+        expect(cfg).toMatchObject({ appId: "42", installationId: "7" });
+        expect(cfg?.privateKey).toContain("BEGIN PRIVATE KEY");
+        expect(githubAppFilesTooOpen(path.join(d, "a.env"))).toEqual([]);
+    });
+    it("a file that is there but unusable THROWS — never a silent fall back to a person's login", () => {
+        const d = tmp();
+        fs.writeFileSync(path.join(d, "a.env"), "GITHUB_APP_ID=42\n");
+        expect(() => loadGithubAppConfig(path.join(d, "a.env"))).toThrow(/GITHUB_APP_PRIVATE_KEY_FILE/);
+        fs.writeFileSync(path.join(d, "b.env"), `GITHUB_APP_ID=42\nGITHUB_APP_PRIVATE_KEY_FILE=${path.join(d, "missing.pem")}\n`);
+        expect(() => loadGithubAppConfig(path.join(d, "b.env"))).toThrow(/could not be read/);
+    });
+    it("names a key or env file that others can read", () => {
+        const d = tmp();
+        fs.writeFileSync(path.join(d, "k.pem"), privateKey, { mode: 0o644 });
+        fs.writeFileSync(path.join(d, "a.env"), `GITHUB_APP_ID=1\nGITHUB_APP_PRIVATE_KEY_FILE=${path.join(d, "k.pem")}\n`, { mode: 0o600 });
+        expect(githubAppFilesTooOpen(path.join(d, "a.env"))).toEqual([path.join(d, "k.pem")]);
+    });
+    it("parseEnvFile ignores comments and strips quotes", () => {
+        expect(parseEnvFile("# A=1\nB='x y'\nexport C=3")).toEqual({ B: "x y", C: "3" });
+    });
+});
+describe("createInstallationTokenSource", () => {
+    const T0 = Date.parse("2026-10-28T12:00:00Z");
+    const fakeFetch = (log, opts = {}) => (async (url, init) => {
+        log.push(`${init.method} ${url.replace("https://api.github.com", "")}`);
+        expect(init.headers.Authorization).toMatch(/^Bearer [\w-]+\.[\w-]+\.[\w-]+$/);
+        const ok = (opts.status ?? 200) < 400;
+        if (url.endsWith("/app/installations"))
+            return { ok, status: opts.status ?? 200, json: async () => opts.installations ?? [{ id: 9 }] };
+        return {
+            ok,
+            status: opts.status ?? 200,
+            json: async () => ({ token: `ghs_${log.length}`, expires_at: new Date(T0 + 3600_000).toISOString() }),
+        };
+    });
+    it("finds the single installation, mints a token, and reuses it until 5 min before it ends", async () => {
+        const log = [];
+        let t = T0;
+        const src = createInstallationTokenSource({ appId: "1", privateKey }, { fetchImpl: fakeFetch(log), now: () => t });
+        const a = await src.get();
+        expect(log).toEqual(["GET /app/installations", "POST /app/installations/9/access_tokens"]);
+        t = T0 + 50 * 60_000;
+        expect(await src.get()).toBe(a);
+        expect(log).toHaveLength(2);
+        t = T0 + 56 * 60_000;
+        expect(await src.get()).not.toBe(a);
+        expect(log).toHaveLength(3);
+    });
+    it("two installations and no id is an error, not a guess", async () => {
+        const src = createInstallationTokenSource({ appId: "1", privateKey }, { fetchImpl: fakeFetch([], { installations: [{ id: 1 }, { id: 2 }] }), now: () => T0 });
+        await expect(src.get()).rejects.toThrow(/GITHUB_APP_INSTALLATION_ID/);
+    });
+    it("a refused call throws (the worker then does not launch)", async () => {
+        const src = createInstallationTokenSource({ appId: "1", privateKey, installationId: "9" }, { fetchImpl: fakeFetch([], { status: 401 }), now: () => T0 });
+        await expect(src.get()).rejects.toThrow(/401/);
+    });
+});
+describe("githubRunEnv", () => {
+    const g = { token: "ghs_x", sock: "/s", binDir: "/b", gitHelper: "/b/git-credential-synap", ghConfigDir: "/c" };
+    it("puts the helpers first on PATH, gh on an empty config dir, and resets the credential helpers first", () => {
+        const e = githubRunEnv(g, "/usr/bin:/bin");
+        expect(e.PATH).toBe("/b:/usr/bin:/bin");
+        expect(e.GH_CONFIG_DIR).toBe("/c");
+        expect(e.SYNAP_GH_SOCK).toBe("/s");
+        expect(e.GH_TOKEN).toBe("ghs_x");
+        expect([e.GIT_CONFIG_KEY_0, e.GIT_CONFIG_VALUE_0]).toEqual(["credential.helper", ""]);
+        expect(e.GIT_CONFIG_VALUE_1).toBe("!/b/git-credential-synap");
+    });
+});
+//# sourceMappingURL=worker-github-app.test.js.map

package/dist/commands/worker-github-app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-app.test.js","sourceRoot":"","sources":["../../src/commands/worker-github-app.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,UAAU,GACX,MAAM,wBAAwB,CAAC;AAEhC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;IAC3D,aAAa,EAAE,IAAI;IACnB,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;IACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;CACnD,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAEpE,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EACrB,yEAAyE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,mCAAmC,EACjI,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAChG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,iDAAiD,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1H,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,gDAAgD,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpI,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,OAAuD,EAAE,EAAE,EAAE,CAC7F,CAAC,KAAK,EAAE,GAAW,EAAE,IAAyD,EAAE,EAAE;QAChF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACvI,OAAO;YACL,EAAE;YACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;SACtG,CAAC;IACJ,CAAC,CAA4B,CAAC;IAEhC,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,6BAA6B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC,CAAC;QAC3F,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,6BAA6B,CACvC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAC1B,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CACvF,CAAC;QACF,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,6BAA6B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzJ,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChH,EAAE,CAAC,oGAAoG,EAAE,GAAG,EAAE;QAC5G,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/worker-github-broker.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Keeps a long run on its GitHub identity.
+ *
+ * An installation token lasts 1 h; a static GH_TOKEN would stop working under
+ * a longer run. So a run's `gh` and `git` ask the WORKER for a token each time
+ * they need one, over an owner-only unix socket, and the worker mints or
+ * reuses one from the App key (worker-github-app.ts). The key stays in the
+ * worker process; a run is handed tokens, never the key, and its environment
+ * carries neither the key file's path nor a long-lived secret.
+ *
+ *   <binDir>/gh                     `gh` with GH_TOKEN set to a fresh token
+ *   <binDir>/git-credential-synap   git credential helper (https pushes)
+ *   <binDir>/synap-gh-token         asks the broker, prints the token
+ *
+ * The runs' PATH starts with <binDir>. An absolute /usr/bin/gh still finds no
+ * login: the run's GH_CONFIG_DIR is an empty folder (the person's hosts.yml is
+ * never read).
+ */
+import type { InstallationTokenSource } from "./worker-github-app.js";
+export interface TokenBroker {
+    /** The unix socket a run's helpers connect to (SYNAP_GH_SOCK). */
+    sock: string;
+    ready: Promise<void>;
+    close(): void;
+}
+/** One request = one connection: the answer is `OK <token>\n` or `ERR <message>\n`. */
+export declare function startTokenBroker(source: InstallationTokenSource): TokenBroker;
+/** The first `name` on PATH that is not inside `exclude`. */
+export declare function findOnPath(name: string, searchPath: string | undefined, exclude: string): string | undefined;
+/**
+ * Writes the three helpers. `realGh`: the `gh` to call (undefined: no `gh`
+ * wrapper, the box has none). Returns the helper paths.
+ */
+export declare function writeGithubHelpers(binDir: string, o?: {
+    realGh?: string;
+    nodeBin?: string;
+}): {
+    gitHelper: string;
+};

package/dist/commands/worker-github-broker.js

@@ -0,0 +1,106 @@
+/**
+ * Keeps a long run on its GitHub identity.
+ *
+ * An installation token lasts 1 h; a static GH_TOKEN would stop working under
+ * a longer run. So a run's `gh` and `git` ask the WORKER for a token each time
+ * they need one, over an owner-only unix socket, and the worker mints or
+ * reuses one from the App key (worker-github-app.ts). The key stays in the
+ * worker process; a run is handed tokens, never the key, and its environment
+ * carries neither the key file's path nor a long-lived secret.
+ *
+ *   <binDir>/gh                     `gh` with GH_TOKEN set to a fresh token
+ *   <binDir>/git-credential-synap   git credential helper (https pushes)
+ *   <binDir>/synap-gh-token         asks the broker, prints the token
+ *
+ * The runs' PATH starts with <binDir>. An absolute /usr/bin/gh still finds no
+ * login: the run's GH_CONFIG_DIR is an empty folder (the person's hosts.yml is
+ * never read).
+ */
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { writeSecretFile } from "../lib/atomic-file.js";
+/** One request = one connection: the answer is `OK <token>\n` or `ERR <message>\n`. */
+export function startTokenBroker(source) {
+    // Under the tmp dir, not the state dir: a unix socket path is limited to ~104 bytes.
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "synap-gh-"));
+    fs.chmodSync(dir, 0o700);
+    const sock = path.join(dir, "s");
+    const server = net.createServer((conn) => {
+        source.get().then((t) => conn.end(`OK ${t}\n`), (err) => conn.end(`ERR ${err.message.replace(/\s+/g, " ")}\n`));
+        conn.on("error", () => conn.destroy());
+    });
+    server.unref(); // never what keeps the worker process alive
+    const ready = new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(sock, () => {
+            fs.chmodSync(sock, 0o600);
+            resolve();
+        });
+    });
+    return {
+        sock,
+        ready,
+        close: () => {
+            server.close();
+            fs.rmSync(dir, { recursive: true, force: true });
+        },
+    };
+}
+const sh = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** The first `name` on PATH that is not inside `exclude`. */
+export function findOnPath(name, searchPath, exclude) {
+    for (const d of (searchPath ?? "").split(path.delimiter)) {
+        if (!d || path.resolve(d) === path.resolve(exclude))
+            continue;
+        const f = path.join(d, name);
+        try {
+            fs.accessSync(f, fs.constants.X_OK);
+            if (fs.statSync(f).isFile())
+                return f;
+        }
+        catch {
+            /* not here */
+        }
+    }
+    return undefined;
+}
+/**
+ * Writes the three helpers. `realGh`: the `gh` to call (undefined: no `gh`
+ * wrapper, the box has none). Returns the helper paths.
+ */
+export function writeGithubHelpers(binDir, o = {}) {
+    fs.mkdirSync(binDir, { recursive: true, mode: 0o700 });
+    const node = o.nodeBin ?? process.execPath;
+    const tokenBin = path.join(binDir, "synap-gh-token");
+    // writeSecretFile chmods after writing: a helper left by an earlier run is tightened too.
+    const put = (name, body) => writeSecretFile(path.join(binDir, name), body, { mode: 0o700 });
+    put("synap-gh-token", `#!${node}
+const net = require("node:net");
+const c = net.connect(process.env.SYNAP_GH_SOCK || "");
+let buf = "";
+c.on("data", (d) => (buf += d));
+c.on("error", (e) => { console.error("synap-gh-token: " + e.message); process.exit(1); });
+c.on("end", () => {
+  const m = /^OK (.+)\\n$/.exec(buf);
+  if (!m) { console.error("synap-gh-token: " + (buf.trim() || "no answer")); process.exit(1); }
+  process.stdout.write(m[1]);
+});
+`);
+    put("git-credential-synap", `#!/bin/sh
+# git credential helper: only "get" answers; the token is asked for now, never stored.
+[ "$1" = get ] || exit 0
+cat >/dev/null
+t=$(${sh(tokenBin)}) || exit 1
+printf 'username=x-access-token\\npassword=%s\\n' "$t"
+`);
+    if (o.realGh) {
+        put("gh", `#!/bin/sh
+t=$(${sh(tokenBin)}) || exit 1
+GH_TOKEN="$t" GITHUB_TOKEN="$t" exec ${sh(o.realGh)} "$@"
+`);
+    }
+    return { gitHelper: path.join(binDir, "git-credential-synap") };
+}
+//# sourceMappingURL=worker-github-broker.js.map

package/dist/commands/worker-github-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-broker.js","sourceRoot":"","sources":["../../src/commands/worker-github-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAUxD,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,qFAAqF;IACrF,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAQ,GAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAC1E,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,4CAA4C;IAC5D,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACvB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAE1D,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,UAA8B,EAAE,OAAe;IACtF,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAA2C,EAAE;IAC9F,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,0FAA0F;IAC1F,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,GAAG,CACD,gBAAgB,EAChB,KAAK,IAAI;;;;;;;;;;;CAWZ,CACE,CAAC;IACF,GAAG,CACD,sBAAsB,EACtB;;;;MAIE,EAAE,CAAC,QAAQ,CAAC;;CAEjB,CACE,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,GAAG,CACD,IAAI,EACJ;MACA,EAAE,CAAC,QAAQ,CAAC;uCACqB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAClD,CACI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;AAClE,CAAC"}

package/dist/commands/worker-github-broker.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/worker-github-broker.test.js

@@ -0,0 +1,90 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { generateKeyPairSync } from "node:crypto";
+import { afterEach, describe, expect, it } from "vitest";
+import { createInstallationTokenSource } from "./worker-github-app.js";
+import { findOnPath, startTokenBroker, writeGithubHelpers } from "./worker-github-broker.js";
+const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048, privateKeyEncoding: { type: "pkcs8", format: "pem" }, publicKeyEncoding: { type: "spki", format: "pem" } });
+const T0 = Date.parse("2026-10-28T12:00:00Z");
+let t = T0;
+let minted = 0;
+const fakeFetch = (async (url) => {
+    if (url.endsWith("/app/installations"))
+        return { ok: true, status: 200, json: async () => [{ id: 9 }] };
+    minted++;
+    return { ok: true, status: 200, json: async () => ({ token: `ghs_${minted}`, expires_at: new Date(t + 3600_000).toISOString() }) };
+});
+const run = (bin, args, env, input) => new Promise((resolve) => {
+    const c = execFile(bin, args, { env }, (err, stdout, stderr) => resolve({ code: err ? (err.code ?? 1) : 0, stdout, stderr }));
+    // A helper may exit without reading its stdin (the git helper on `store`):
+    // the write then fails with EPIPE, which is the child's choice, not a test failure.
+    c.stdin?.on("error", () => { });
+    c.stdin?.end(input ?? "");
+});
+const closers = [];
+afterEach(() => closers.splice(0).forEach((c) => c()));
+const setup = async (source = createInstallationTokenSource({ appId: "1", privateKey }, { fetchImpl: fakeFetch, now: () => t })) => {
+    t = T0;
+    minted = 0;
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "bk-"));
+    const realGh = path.join(dir, "real-gh");
+    fs.writeFileSync(realGh, '#!/bin/sh\necho "gh-as:$GH_TOKEN args:$*"\n', { mode: 0o755 });
+    const binDir = path.join(dir, "bin");
+    const { gitHelper } = writeGithubHelpers(binDir, { realGh });
+    const broker = startTokenBroker(source);
+    closers.push(() => broker.close());
+    await broker.ready;
+    const env = { SYNAP_GH_SOCK: broker.sock, PATH: `${binDir}:/usr/bin:/bin` };
+    return { binDir, gitHelper, env, broker };
+};
+describe("the GitHub helpers a run uses", () => {
+    it("gh runs with a token that is still valid after the first hour (the clock is stubbed)", async () => {
+        const { binDir, env } = await setup();
+        const first = await run(path.join(binDir, "gh"), ["pr", "list"], env);
+        expect(first.stdout.trim()).toBe("gh-as:ghs_1 args:pr list");
+        t = T0 + 30 * 60_000;
+        expect((await run(path.join(binDir, "gh"), [], env)).stdout).toContain("ghs_1"); // reused, not re-minted
+        t = T0 + 61 * 60_000; // past the first token's end
+        const later = await run(path.join(binDir, "gh"), ["pr", "list"], env);
+        expect(later.stdout.trim()).toBe("gh-as:ghs_2 args:pr list");
+    });
+    it("the git credential helper answers `get` with a fresh token and nothing for other operations", async () => {
+        const { gitHelper, env } = await setup();
+        const get = await run(gitHelper, ["get"], env, "protocol=https\nhost=github.com\n\n");
+        expect(get.stdout).toBe("username=x-access-token\npassword=ghs_1\n");
+        t = T0 + 61 * 60_000;
+        expect((await run(gitHelper, ["get"], env, "host=github.com\n\n")).stdout).toContain("password=ghs_2");
+        expect((await run(gitHelper, ["store"], env, "x\n")).stdout).toBe("");
+    });
+    it("a broker that cannot mint makes gh fail without calling the real gh (no fall back to another login)", async () => {
+        const { binDir, env } = await setup({
+            get: async () => {
+                throw new Error("GitHub answered 401");
+            },
+        });
+        const r = await run(path.join(binDir, "gh"), ["pr", "list"], env);
+        expect(r.code).not.toBe(0);
+        expect(r.stdout).not.toContain("gh-as");
+        expect(r.stderr).toContain("401");
+    });
+    it("the key is never handed over: neither helper nor answer carries it", async () => {
+        const { binDir, env } = await setup();
+        const out = (await run(path.join(binDir, "gh"), [], env)).stdout;
+        expect(out).not.toContain("PRIVATE KEY");
+        for (const f of fs.readdirSync(binDir))
+            expect(fs.readFileSync(path.join(binDir, f), "utf8")).not.toContain("PRIVATE KEY");
+    });
+});
+describe("findOnPath", () => {
+    it("skips the helpers' own folder, so the wrapper never calls itself", () => {
+        const a = fs.mkdtempSync(path.join(os.tmpdir(), "fp-"));
+        const b = fs.mkdtempSync(path.join(os.tmpdir(), "fp-"));
+        for (const d of [a, b])
+            fs.writeFileSync(path.join(d, "gh"), "#!/bin/sh\n", { mode: 0o755 });
+        expect(findOnPath("gh", `${a}:${b}`, a)).toBe(path.join(b, "gh"));
+        expect(findOnPath("nope", `${a}:${b}`, a)).toBeUndefined();
+    });
+});
+//# sourceMappingURL=worker-github-broker.test.js.map

package/dist/commands/worker-github-broker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-github-broker.test.js","sourceRoot":"","sources":["../../src/commands/worker-github-broker.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE7F,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAErL,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;AACX,IAAI,MAAM,GAAG,CAAC,CAAC;AACf,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;AACrI,CAAC,CAA4B,CAAC;AAE9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,GAA2B,EAAE,KAAc,EAAE,EAAE,CACvF,IAAI,OAAO,CAAmD,CAAC,OAAO,EAAE,EAAE;IACxE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAC7D,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpF,CAAC;IACF,2EAA2E;IAC3E,oFAAoF;IACpF,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAsB,EAAE,CAAC;AACtC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEvD,MAAM,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,6BAA6B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACjI,CAAC,GAAG,EAAE,CAAC;IACP,MAAM,GAAG,CAAC,CAAC;IACX,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;QACzG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,6BAA6B;QACnD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACvG,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC;YAClC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/worker-runs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/worker-runs.test.js

@@ -0,0 +1,150 @@
+/**
+ * The worker end to end with a fake `claude`: each code run gets its own tree
+ * folder, runs as the App token, and finished runs' trees are swept.
+ */
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { createWorker } from "./worker.js";
+import { sweepTreeFolder } from "./worker-worktrees.js";
+const git = (cwd, ...a) => execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", ...a], { cwd, encoding: "utf8" });
+let home;
+let oldHome;
+let root;
+let repo;
+let out;
+let claude;
+const workers = [];
+/** The nearest CLAUDE.md on the path above `dir` (Claude Code reads every CLAUDE.md on its cwd's parent path). */
+const claudeMdOnParentPath = (dir) => {
+    for (let d = dir; d !== path.dirname(d); d = path.dirname(d))
+        if (fs.existsSync(path.join(d, "CLAUDE.md")))
+            return path.join(d, "CLAUDE.md");
+    return undefined;
+};
+const SIDS = {
+    aaaaaaaa: "aaaaaaaa-0000-4000-8000-000000000001", // clean worktree
+    bbbbbbbb: "bbbbbbbb-0000-4000-8000-000000000002", // uncommitted change
+    cccccccc: "cccccccc-0000-4000-8000-000000000003", // unpushed commit
+};
+beforeEach(() => {
+    oldHome = process.env.HOME;
+    home = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "wk-home-")));
+    process.env.HOME = home;
+    root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "wk-root-")));
+    out = path.join(root, "out");
+    fs.mkdirSync(out);
+    const origin = path.join(root, "origin.git");
+    git(root, "init", "-q", "--bare", origin);
+    repo = path.join(root, "code", "repo");
+    fs.mkdirSync(repo, { recursive: true });
+    fs.writeFileSync(path.join(root, "code", "CLAUDE.md"), "the safety rules");
+    git(repo, "init", "-q", "-b", "main");
+    fs.writeFileSync(path.join(repo, "f"), "1");
+    git(repo, "add", "f");
+    git(repo, "commit", "-q", "-m", "init");
+    git(repo, "remote", "add", "origin", origin);
+    git(repo, "push", "-q", "origin", "main");
+    git(repo, "fetch", "-q", "origin");
+    claude = path.join(root, "fake-claude.sh");
+    // $2 is the prompt; the run makes its worktree in its own cwd, as the prompt tells it.
+    fs.writeFileSync(claude, `#!/bin/sh
+sid=$(printf '%s' "$2" | sed -n 's/^Session: \\(........\\).*/\\1/p')
+echo "$sid|$PWD|$GH_TOKEN|$VERCEL_TOKEN" >> "${out}/runs.log"
+git -C "${repo}" worktree add -q --no-track "$PWD/repo" -b "devbox/$sid-x" origin/main
+case "$sid" in
+  bbbbbbbb) echo dirty > "$PWD/repo/dirty" ;;
+  cccccccc) echo c > "$PWD/repo/c" && git -C "$PWD/repo" add c && git -C "$PWD/repo" -c user.email=t@t -c user.name=t commit -q -m c ;;
+esac
+sleep 1
+`, { mode: 0o755 });
+});
+afterEach(() => {
+    process.env.HOME = oldHome;
+    delete process.env.VERCEL_TOKEN;
+    for (const w of workers.splice(0))
+        w.stop();
+});
+const handed = (...ids) => JSON.stringify({ startHere: { pendingReview: { count: 0 }, handedToYou: { count: ids.length, items: ids.map((id) => ({ id, goal: "g" })) } } });
+const sessionText = JSON.stringify({ session: { id: "s", goal: "g" }, outcomes: { status: "ok", outcomes: [] } });
+const mk = (ids, deps = {}) => {
+    const lines = [];
+    const worker = createWorker({ agent: "w1-test", cwd: path.join(root, "code"), claudeBin: claude, maxParallel: "3" }, {
+        mcp: {
+            call: async (tool) => tool === "synap_orient" ? { isError: false, text: handed(...ids) } : { isError: false, text: sessionText },
+        },
+        podUrl: "http://pod.test",
+        apiKey: "k",
+        selfAgentId: "self",
+        say: (l) => lines.push(l),
+        ...deps,
+    });
+    workers.push(worker);
+    return { worker, lines };
+};
+describe("a code run gets a tree folder of its own", () => {
+    it("two runs at once work in different folders, as the App token; clean trees go, unpushed or dirty ones stay and are named", async () => {
+        process.env.VERCEL_TOKEN = "vercel-secret";
+        const { worker, lines } = mk(Object.values(SIDS), { githubToken: { get: async () => "ghs_app_token" } });
+        expect((await worker.tick()).launched).toBe(3);
+        await worker.waitForChildren();
+        const runs = fs.readFileSync(path.join(out, "runs.log"), "utf8").trim().split("\n").map((l) => l.split("|"));
+        const cwds = runs.map((r) => r[1]);
+        expect(new Set(cwds).size).toBe(3);
+        for (const [sid, cwd, token, vercel] of runs) {
+            expect(vercel).toBe(""); // the worker's own VERCEL_TOKEN never reaches a run
+            expect(cwd).toBe(path.join(root, "code", ".worker-trees", sid));
+            expect(claudeMdOnParentPath(cwd)).toBe(path.join(root, "code", "CLAUDE.md"));
+            expect(token).toBe("ghs_app_token");
+        }
+        const trees = path.join(root, "code", ".worker-trees");
+        expect(fs.existsSync(path.join(trees, "aaaaaaaa"))).toBe(false); // clean: removed with its folder
+        expect(fs.existsSync(path.join(trees, "bbbbbbbb", "repo", "dirty"))).toBe(true);
+        expect(fs.existsSync(path.join(trees, "cccccccc", "repo", "c"))).toBe(true);
+        expect(worker.state.runs[SIDS.aaaaaaaa].keptTrees).toBeUndefined();
+        expect(worker.state.runs[SIDS.bbbbbbbb].result).toMatch(/KEPT.*uncommitted changes/);
+        expect(worker.state.runs[SIDS.cccccccc].result).toMatch(/KEPT.*unpushed commits/);
+        expect(lines.join("\n")).not.toContain("ghs_app_token");
+    });
+    it("the same hand-off is not launched twice, before or after its tree is swept", async () => {
+        const { worker } = mk([SIDS.aaaaaaaa], { githubToken: { get: async () => "t" } });
+        expect((await worker.tick()).launched).toBe(1);
+        expect((await worker.tick()).launched).toBe(0); // still running
+        await worker.waitForChildren();
+        expect((await worker.tick()).launched).toBe(0); // done, tree swept
+        expect(fs.readFileSync(path.join(out, "runs.log"), "utf8").trim().split("\n")).toHaveLength(1);
+    });
+    it("without the App files it still runs, and says LOUDLY whose login it uses", async () => {
+        const { worker, lines } = mk([SIDS.aaaaaaaa]);
+        expect((await worker.tick()).launched).toBe(1);
+        await worker.waitForChildren();
+        expect(lines.filter((l) => l.includes("WARNING") && l.includes("environment's GitHub login"))).toHaveLength(1);
+    });
+    it("a failing App token does not launch the run, and does not record it (retried next tick)", async () => {
+        const { worker, lines } = mk([SIDS.aaaaaaaa], {
+            githubToken: {
+                get: async () => {
+                    throw new Error("GitHub POST … answered 401");
+                },
+            },
+        });
+        expect((await worker.tick()).launched).toBe(1); // counted as attempted; nothing ran
+        expect(worker.state.runs[SIDS.aaaaaaaa]).toBeUndefined();
+        expect(fs.existsSync(path.join(out, "runs.log"))).toBe(false);
+        expect(lines.join("\n")).toMatch(/no GitHub App token.*not launching/);
+    });
+});
+describe("sweepTreeFolder", () => {
+    it("an unreadable status keeps the folder (never deletes on doubt)", async () => {
+        const folder = path.join(root, "tree");
+        fs.mkdirSync(path.join(folder, "repo"), { recursive: true });
+        fs.writeFileSync(path.join(folder, "repo", ".git"), "gitdir: nowhere");
+        const r = await sweepTreeFolder(folder, async () => ({ code: 128, stdout: "" }));
+        expect(r.removed).toEqual([]);
+        expect(r.kept[0].why).toBe("git status failed");
+        expect(fs.existsSync(path.join(folder, "repo"))).toBe(true);
+    });
+});
+//# sourceMappingURL=worker-runs.test.js.map

package/dist/commands/worker-runs.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-runs.test.js","sourceRoot":"","sources":["../../src/commands/worker-runs.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,CAAW,EAAE,EAAE,CAC1C,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAEtG,IAAI,IAAY,CAAC;AACjB,IAAI,OAA2B,CAAC;AAChC,IAAI,IAAY,CAAC;AACjB,IAAI,IAAY,CAAC;AACjB,IAAI,GAAW,CAAC;AAChB,IAAI,MAAc,CAAC;AACnB,MAAM,OAAO,GAA4B,EAAE,CAAC;AAE5C,kHAAkH;AAClH,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAsB,EAAE;IAC/D,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC7I,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG;IACX,QAAQ,EAAE,sCAAsC,EAAE,iBAAiB;IACnE,QAAQ,EAAE,sCAAsC,EAAE,qBAAqB;IACvE,QAAQ,EAAE,sCAAsC,EAAE,kBAAkB;CACrE,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC3B,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IACxB,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC3E,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC3C,uFAAuF;IACvF,EAAE,CAAC,aAAa,CACd,MAAM,EACN;;+CAE2C,GAAG;UACxC,IAAI;;;;;;CAMb,EACG,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,GAAG,GAAa,EAAE,EAAE,CAClC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAClJ,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAElH,MAAM,EAAE,GAAG,CAAC,GAAa,EAAE,OAAqD,EAAE,EAAE,EAAE;IACpF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,YAAY,CACzB,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,EACvF;QACE,GAAG,EAAE;YACH,IAAI,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE,CAC3B,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;SAC7G;QACD,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,MAAM;QACnB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzB,GAAG,IAAI;KACR,CACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,yHAAyH,EAAE,KAAK,IAAI,EAAE;QACvI,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,eAAe,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzG,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAE/B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oDAAoD;YAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iCAAiC;QAClG,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;QAChE,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/B,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;QACnE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5C,WAAW,EAAE;gBACX,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,oCAAoC;QACpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/worker-worktrees.d.ts

@@ -0,0 +1,34 @@
+/**
+ * One tree folder per code run, so two runs at once never share a checkout
+ * (finding f94c0287: both worked in the one clone under `--cwd`).
+ *
+ * The worker's `--cwd` is usually a folder OF repos, not a repo, so the worker
+ * cannot create the worktree itself: it gives the run an empty folder
+ * (`<state>/trees/<short id>`) as its cwd, the prompt tells the run to make its
+ * worktrees there (`git -C <cwd>/<repo> worktree add <folder>/<repo> …`), and
+ * when the run ends the worker sweeps the folder: a worktree with no
+ * uncommitted change and no commit that is not on a remote is removed; any
+ * other is KEPT, and named in the run's result.
+ */
+export interface GitResult {
+    code: number;
+    stdout: string;
+}
+export type GitFn = (cwd: string, args: string[]) => Promise<GitResult>;
+export declare const defaultGit: GitFn;
+export declare function treeFolderFor(treesRoot: string, sessionId: string): string;
+/** The run's own folder under the trees root; created owner-only. */
+export declare function ensureTreeFolder(folder: string): void;
+export interface SweepResult {
+    removed: string[];
+    /** Worktrees left in place, each with why. */
+    kept: {
+        dir: string;
+        why: string;
+    }[];
+}
+/**
+ * Removes the run's clean worktrees. A failed check is a reason to KEEP, never
+ * "clean": an unreadable status must not delete work.
+ */
+export declare function sweepTreeFolder(folder: string, git?: GitFn): Promise<SweepResult>;