@telora/daemon 0.17.90 → 0.17.98
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build-info.json +6 -3
- package/dist/capability-pointer.d.ts +49 -0
- package/dist/capability-pointer.d.ts.map +1 -0
- package/dist/capability-pointer.js +54 -0
- package/dist/capability-pointer.js.map +1 -0
- package/dist/cli/codex-provision.d.ts +12 -29
- package/dist/cli/codex-provision.d.ts.map +1 -1
- package/dist/cli/codex-provision.js +15 -44
- package/dist/cli/codex-provision.js.map +1 -1
- package/dist/cli/session-state.d.ts +12 -9
- package/dist/cli/session-state.d.ts.map +1 -1
- package/dist/cli/session-state.js +14 -9
- package/dist/cli/session-state.js.map +1 -1
- package/dist/completion/merge-phase.d.ts.map +1 -1
- package/dist/completion/merge-phase.js +1 -0
- package/dist/completion/merge-phase.js.map +1 -1
- package/dist/completion/team-lifecycle.d.ts.map +1 -1
- package/dist/completion/team-lifecycle.js +1 -0
- package/dist/completion/team-lifecycle.js.map +1 -1
- package/dist/delivery-advance-block.d.ts +70 -13
- package/dist/delivery-advance-block.d.ts.map +1 -1
- package/dist/delivery-advance-block.js +200 -21
- package/dist/delivery-advance-block.js.map +1 -1
- package/dist/delivery-lifecycle.d.ts +1 -1
- package/dist/delivery-lifecycle.d.ts.map +1 -1
- package/dist/delivery-lifecycle.js +1 -1
- package/dist/delivery-lifecycle.js.map +1 -1
- package/dist/discovery-poll.d.ts +7 -14
- package/dist/discovery-poll.d.ts.map +1 -1
- package/dist/discovery-poll.js +14 -31
- package/dist/discovery-poll.js.map +1 -1
- package/dist/focus-executor.d.ts +10 -9
- package/dist/focus-executor.d.ts.map +1 -1
- package/dist/focus-executor.js +36 -23
- package/dist/focus-executor.js.map +1 -1
- package/dist/focus-lifecycle.d.ts.map +1 -1
- package/dist/focus-lifecycle.js +1 -0
- package/dist/focus-lifecycle.js.map +1 -1
- package/dist/focus-merge.d.ts +27 -17
- package/dist/focus-merge.d.ts.map +1 -1
- package/dist/focus-merge.js +84 -45
- package/dist/focus-merge.js.map +1 -1
- package/dist/queries/issues.d.ts +72 -0
- package/dist/queries/issues.d.ts.map +1 -1
- package/dist/queries/issues.js +131 -0
- package/dist/queries/issues.js.map +1 -1
- package/dist/queries/local-models.d.ts +13 -8
- package/dist/queries/local-models.d.ts.map +1 -1
- package/dist/queries/local-models.js +15 -6
- package/dist/queries/local-models.js.map +1 -1
- package/dist/queries/schemas.d.ts +4 -3
- package/dist/queries/schemas.d.ts.map +1 -1
- package/dist/queries/schemas.js +11 -7
- package/dist/queries/schemas.js.map +1 -1
- package/dist/resolvers/focus-context.d.ts +14 -3
- package/dist/resolvers/focus-context.d.ts.map +1 -1
- package/dist/resolvers/focus-context.js +21 -15
- package/dist/resolvers/focus-context.js.map +1 -1
- package/dist/resolvers/shared/wiki.d.ts +23 -4
- package/dist/resolvers/shared/wiki.d.ts.map +1 -1
- package/dist/resolvers/shared/wiki.js +32 -4
- package/dist/resolvers/shared/wiki.js.map +1 -1
- package/dist/supabase.d.ts +1 -1
- package/dist/supabase.d.ts.map +1 -1
- package/dist/supabase.js +1 -1
- package/dist/supabase.js.map +1 -1
- package/dist/worktree-safety.d.ts +36 -0
- package/dist/worktree-safety.d.ts.map +1 -1
- package/dist/worktree-safety.js +69 -0
- package/dist/worktree-safety.js.map +1 -1
- package/package.json +3 -3
- package/dist/local-model-key-env.d.ts +0 -41
- package/dist/local-model-key-env.d.ts.map +0 -1
- package/dist/local-model-key-env.js +0 -46
- package/dist/local-model-key-env.js.map +0 -1
|
@@ -7,6 +7,30 @@ export const WIKI_RETRIEVAL_BUDGET_CHARS = 10_000;
|
|
|
7
7
|
// Reserve a slice of the budget for the ancestors block. Empirically a few
|
|
8
8
|
// hundred characters per ancestor (title + 1-line summary) is plenty.
|
|
9
9
|
const WIKI_ANCESTORS_BUDGET_FRACTION = 0.25;
|
|
10
|
+
/**
|
|
11
|
+
* Deduplicate a flat list of hits by id, keeping the highest-ranked
|
|
12
|
+
* occurrence of any duplicate, and return them sorted by rank descending.
|
|
13
|
+
*
|
|
14
|
+
* PARITY NOTE: this is the SAME contract as the edge fn's `dedupeHitsByRank`
|
|
15
|
+
* (supabase/functions/product-api/handlers/context-assembly-compose.ts). The
|
|
16
|
+
* two retrieval paths intentionally remain separate sources -- the daemon
|
|
17
|
+
* (Node, registry-published `@telora/daemon`) and the edge fn (Deno) cannot
|
|
18
|
+
* share a single canonical module under the existing `_shared` mirror
|
|
19
|
+
* discipline, which bridges only the Vite<->Deno boundary (src/lib ->
|
|
20
|
+
* supabase/functions/_shared). Drift is held in check by twin parity tests
|
|
21
|
+
* asserting this identical contract on each side, not by a shared file. See
|
|
22
|
+
* docs/DECISIONS.md (Context Assembly convergence -- de-drift over mirror).
|
|
23
|
+
*/
|
|
24
|
+
export function dedupeHitsByRank(hits) {
|
|
25
|
+
const seen = new Map();
|
|
26
|
+
for (const hit of hits) {
|
|
27
|
+
const existing = seen.get(hit.id);
|
|
28
|
+
if (!existing || hit.rank > existing.rank) {
|
|
29
|
+
seen.set(hit.id, hit);
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
return Array.from(seen.values()).sort((a, b) => b.rank - a.rank);
|
|
33
|
+
}
|
|
10
34
|
export async function searchWiki(productId, query, limit = 8) {
|
|
11
35
|
try {
|
|
12
36
|
const result = await callApi('wiki_search', {
|
|
@@ -42,10 +66,14 @@ export async function fetchAncestorsForHits(productId, pageIds) {
|
|
|
42
66
|
}
|
|
43
67
|
}
|
|
44
68
|
/**
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
*
|
|
69
|
+
* Fetch full page bodies for a set of ids, one `wiki_page_get` call per id.
|
|
70
|
+
*
|
|
71
|
+
* NOTE: this fetches raw page bodies DIRECTLY via the dedicated `wiki_page_get`
|
|
72
|
+
* data endpoint -- it does NOT round-trip through the `context_assemble`
|
|
73
|
+
* assembly endpoint. (An earlier version of this comment claimed a
|
|
74
|
+
* context_assemble round-trip; that was never what the code did. The
|
|
75
|
+
* execution plane depends only on the raw-data endpoints, not on the
|
|
76
|
+
* harness-facing assembly surface.)
|
|
49
77
|
*/
|
|
50
78
|
export async function fetchPageBodies(productId, ids) {
|
|
51
79
|
const bodies = new Map();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wiki.js","sourceRoot":"","sources":["../../../src/resolvers/shared/wiki.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAqClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,2EAA2E;AAC3E,sEAAsE;AACtE,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,KAAa,EAAE,KAAK,GAAG,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAqB,aAAa,EAAE;YAC9D,SAAS;YACT,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,mDAAmD,KAAK,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrG,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAiB;IAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAmC,0BAA0B,EAAE;YACzF,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sDAAuD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"wiki.js","sourceRoot":"","sources":["../../../src/resolvers/shared/wiki.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAqClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,2EAA2E;AAC3E,sEAAsE;AACtE,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,KAAa,EAAE,KAAK,GAAG,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAqB,aAAa,EAAE;YAC9D,SAAS;YACT,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,mDAAmD,KAAK,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrG,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAiB;IAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAmC,0BAA0B,EAAE;YACzF,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sDAAuD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,GAAa;IAEb,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAyB,eAAe,EAAE;gBACpE,SAAS;gBACT,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,IAAqB,EACrB,MAAiC,EACjC,WAAmB,EACnB,YAA+B,EAAE;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,GAAG,GAAa,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;IACxC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEzB,2EAA2E;IAC3E,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,8BAA8B,CAAC,CAAC;QAChF,MAAM,KAAK,GAAa,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,2BAA2B;QACtF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO;gBAClB,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE;gBAC7C,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YACrD,IAAI,aAAa,GAAG,IAAI,CAAC,MAAM,GAAG,cAAc;gBAAE,MAAM;YACxD,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,eAAe;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,WAAW,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC5G,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,WAAW,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QAC/D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC"}
|
package/dist/supabase.d.ts
CHANGED
|
@@ -14,7 +14,7 @@ export type { CreateSessionParams, SessionAggregates } from './queries/sessions.
|
|
|
14
14
|
export { getReadyDeliveries, getDeliveryContext, updateDeliveryStatus, recordDeliveryTransition, markDeliveryAutoApproved, updateDeliveryMergeCommitSha, getDoneDeliveries, getReadyFocuses, getActiveFocuses, getMergeConflictDeliveries, reportGitState, recordFocusMerge, clearAnswerRearm, } from './queries/deliveries.js';
|
|
15
15
|
export type { TransitionRecord } from './queries/deliveries.js';
|
|
16
16
|
export { fetchEffectiveWorkflow, fetchEffectiveWorkflowWithTransitions } from './queries/workflows.js';
|
|
17
|
-
export { getDeliveryIssues, getDeliverySessionCount, updateIssueStatus, createEscalation, hasOpenEscalationForDelivery, createIssue, } from './queries/issues.js';
|
|
17
|
+
export { getDeliveryIssues, getDeliverySessionCount, updateIssueStatus, createEscalation, hasOpenEscalationForDelivery, hasOpenWorktreeDirtyEscalation, resolveOpenWorktreeDirtyEscalations, WORKTREE_DIRTY_ESCALATION_KINDS, MERGE_CONFLICT_ESCALATION_KIND, MERGE_REFUSED_DIRTY_ESCALATION_KIND, createIssue, } from './queries/issues.js';
|
|
18
18
|
export type { CreateEscalationParams } from './queries/issues.js';
|
|
19
19
|
export { fetchTransitionGuards, createTransitionEvaluation, createTransitionBlock, getActiveTransitionBlock, getResolvedTransitionBlockForDelivery, } from './queries/guards.js';
|
|
20
20
|
export { sendHeartbeat, sendDisconnect, claimProduct } from './queries/daemon-connection.js';
|
package/dist/supabase.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGjE,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGpF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAGvG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAG7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAG/D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG/F,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIrF;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAGtF;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,KAAK,CAEnC"}
|
|
1
|
+
{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGjE,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGpF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAGvG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,+BAA+B,EAC/B,8BAA8B,EAC9B,mCAAmC,EACnC,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAG7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAG/D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG/F,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIrF;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAGtF;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,KAAK,CAEnC"}
|
package/dist/supabase.js
CHANGED
|
@@ -18,7 +18,7 @@ export { getReadyDeliveries, getDeliveryContext, updateDeliveryStatus, recordDel
|
|
|
18
18
|
// -- Workflows --
|
|
19
19
|
export { fetchEffectiveWorkflow, fetchEffectiveWorkflowWithTransitions } from './queries/workflows.js';
|
|
20
20
|
// -- Issues & Escalations --
|
|
21
|
-
export { getDeliveryIssues, getDeliverySessionCount, updateIssueStatus, createEscalation, hasOpenEscalationForDelivery, createIssue, } from './queries/issues.js';
|
|
21
|
+
export { getDeliveryIssues, getDeliverySessionCount, updateIssueStatus, createEscalation, hasOpenEscalationForDelivery, hasOpenWorktreeDirtyEscalation, resolveOpenWorktreeDirtyEscalations, WORKTREE_DIRTY_ESCALATION_KINDS, MERGE_CONFLICT_ESCALATION_KIND, MERGE_REFUSED_DIRTY_ESCALATION_KIND, createIssue, } from './queries/issues.js';
|
|
22
22
|
// -- Guards (Workflow System) --
|
|
23
23
|
export { fetchTransitionGuards, createTransitionEvaluation, createTransitionBlock, getActiveTransitionBlock, getResolvedTransitionBlockForDelivery, } from './queries/guards.js';
|
|
24
24
|
// -- Daemon Connection --
|
package/dist/supabase.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,mCAAmC;AACnC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAExE,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE,uBAAuB;AACvB,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,6BAA6B;AAC7B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,kBAAkB;AAClB,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAEvG,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,iCAAiC;AACjC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,qBAAqB,CAAC;AAE7B,0BAA0B;AAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE7F,4BAA4B;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,uCAAuC;AACvC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAG9B,uBAAuB;AACvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAGhC,sBAAsB;AACtB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAGpC,iBAAiB;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAG/D,8CAA8C;AAE9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,eAAuB;IAClE,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC7F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;AAC3F,CAAC"}
|
|
1
|
+
{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,mCAAmC;AACnC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAExE,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE,uBAAuB;AACvB,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,6BAA6B;AAC7B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,kBAAkB;AAClB,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAEvG,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,+BAA+B,EAC/B,8BAA8B,EAC9B,mCAAmC,EACnC,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,iCAAiC;AACjC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,qBAAqB,CAAC;AAE7B,0BAA0B;AAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE7F,4BAA4B;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,uCAAuC;AACvC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAG9B,uBAAuB;AACvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAGhC,sBAAsB;AACtB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAGpC,iBAAiB;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAG/D,8CAA8C;AAE9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,eAAuB;IAClE,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC7F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;AAC3F,CAAC"}
|
|
@@ -17,6 +17,42 @@ export declare function branchHasUnmergedCommits(branchName: string, targetBranc
|
|
|
17
17
|
* Returns the commit hash if successful, null otherwise.
|
|
18
18
|
*/
|
|
19
19
|
export declare function safetyCommitWorktree(worktreePath: string, deliveryName: string): string | null;
|
|
20
|
+
/**
|
|
21
|
+
* Generated lockfile basenames the daemon may safely auto-commit. These are
|
|
22
|
+
* machine-regenerated (never hand-authored), so a worktree whose ONLY dirt is
|
|
23
|
+
* one of these can be committed by the daemon without losing intent -- the
|
|
24
|
+
* cheapest auto-remediation branch for an agent_resolvable dirty-worktree
|
|
25
|
+
* condition (see ensureWorktreeCommittedBeforeAdvance).
|
|
26
|
+
*/
|
|
27
|
+
export declare const GENERATED_LOCKFILE_BASENAMES: readonly string[];
|
|
28
|
+
/**
|
|
29
|
+
* True iff the worktree is dirty AND every changed path is a generated
|
|
30
|
+
* lockfile (by basename). A clean tree returns false (nothing to commit), and
|
|
31
|
+
* any non-lockfile change returns false (a human/agent must handle real work).
|
|
32
|
+
*
|
|
33
|
+
* This is the classifier the disposition-aware advance-block path uses to
|
|
34
|
+
* decide whether a dirty worktree is "pure generated-lockfile churn" that the
|
|
35
|
+
* daemon can auto-commit, versus uncommitted agent work that needs the team
|
|
36
|
+
* re-woken (or, past the retry budget, a human).
|
|
37
|
+
*
|
|
38
|
+
* Implementation note: we enumerate changed paths via name-only commands
|
|
39
|
+
* (`git diff --name-only HEAD` for tracked changes + `git ls-files --others
|
|
40
|
+
* --exclude-standard` for untracked, non-ignored files) rather than parsing
|
|
41
|
+
* the 2-column `git status --porcelain` status prefix. runGit trims its output,
|
|
42
|
+
* which strips the leading-space status of the first porcelain line and would
|
|
43
|
+
* corrupt a fixed-width parse; name-only output is an unambiguous list of
|
|
44
|
+
* repo-relative paths.
|
|
45
|
+
*/
|
|
46
|
+
export declare function dirtyChangesAreGeneratedLockfilesOnly(worktreePath: string): boolean;
|
|
47
|
+
/**
|
|
48
|
+
* Auto-commit a worktree whose only dirt is generated lockfile churn.
|
|
49
|
+
*
|
|
50
|
+
* Stages everything and commits with a clear daemon-remediation message.
|
|
51
|
+
* Callers MUST gate this behind dirtyChangesAreGeneratedLockfilesOnly so real
|
|
52
|
+
* agent work is never silently committed here. Returns the commit hash, or
|
|
53
|
+
* null if staging/committing failed (e.g. nothing staged).
|
|
54
|
+
*/
|
|
55
|
+
export declare function commitGeneratedLockfiles(worktreePath: string): string | null;
|
|
20
56
|
/**
|
|
21
57
|
* Remove a worktree when an agent session ends.
|
|
22
58
|
* The branch is preserved for PR creation.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"worktree-safety.d.ts","sourceRoot":"","sources":["../src/worktree-safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAI3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqB9F;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;CACrB,GACL,OAAO,CAgDT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzF"}
|
|
1
|
+
{"version":3,"file":"worktree-safety.d.ts","sourceRoot":"","sources":["../src/worktree-safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAI3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqB9F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAWnF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;CACrB,GACL,OAAO,CAgDT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzF"}
|
package/dist/worktree-safety.js
CHANGED
|
@@ -44,6 +44,75 @@ export function safetyCommitWorktree(worktreePath, deliveryName) {
|
|
|
44
44
|
const hashResult = runGitSync(['rev-parse', 'HEAD'], worktreePath);
|
|
45
45
|
return hashResult.success ? hashResult.output : null;
|
|
46
46
|
}
|
|
47
|
+
/**
|
|
48
|
+
* Generated lockfile basenames the daemon may safely auto-commit. These are
|
|
49
|
+
* machine-regenerated (never hand-authored), so a worktree whose ONLY dirt is
|
|
50
|
+
* one of these can be committed by the daemon without losing intent -- the
|
|
51
|
+
* cheapest auto-remediation branch for an agent_resolvable dirty-worktree
|
|
52
|
+
* condition (see ensureWorktreeCommittedBeforeAdvance).
|
|
53
|
+
*/
|
|
54
|
+
export const GENERATED_LOCKFILE_BASENAMES = [
|
|
55
|
+
'package-lock.json',
|
|
56
|
+
'npm-shrinkwrap.json',
|
|
57
|
+
'yarn.lock',
|
|
58
|
+
'pnpm-lock.yaml',
|
|
59
|
+
'deno.lock',
|
|
60
|
+
];
|
|
61
|
+
/**
|
|
62
|
+
* True iff the worktree is dirty AND every changed path is a generated
|
|
63
|
+
* lockfile (by basename). A clean tree returns false (nothing to commit), and
|
|
64
|
+
* any non-lockfile change returns false (a human/agent must handle real work).
|
|
65
|
+
*
|
|
66
|
+
* This is the classifier the disposition-aware advance-block path uses to
|
|
67
|
+
* decide whether a dirty worktree is "pure generated-lockfile churn" that the
|
|
68
|
+
* daemon can auto-commit, versus uncommitted agent work that needs the team
|
|
69
|
+
* re-woken (or, past the retry budget, a human).
|
|
70
|
+
*
|
|
71
|
+
* Implementation note: we enumerate changed paths via name-only commands
|
|
72
|
+
* (`git diff --name-only HEAD` for tracked changes + `git ls-files --others
|
|
73
|
+
* --exclude-standard` for untracked, non-ignored files) rather than parsing
|
|
74
|
+
* the 2-column `git status --porcelain` status prefix. runGit trims its output,
|
|
75
|
+
* which strips the leading-space status of the first porcelain line and would
|
|
76
|
+
* corrupt a fixed-width parse; name-only output is an unambiguous list of
|
|
77
|
+
* repo-relative paths.
|
|
78
|
+
*/
|
|
79
|
+
export function dirtyChangesAreGeneratedLockfilesOnly(worktreePath) {
|
|
80
|
+
if (!existsSync(worktreePath))
|
|
81
|
+
return false;
|
|
82
|
+
const tracked = runGitSync(['diff', '--name-only', 'HEAD'], worktreePath);
|
|
83
|
+
const untracked = runGitSync(['ls-files', '--others', '--exclude-standard'], worktreePath);
|
|
84
|
+
if (!tracked.success || !untracked.success)
|
|
85
|
+
return false;
|
|
86
|
+
const paths = [...tracked.output.split('\n'), ...untracked.output.split('\n')]
|
|
87
|
+
.map((p) => p.trim())
|
|
88
|
+
.filter((p) => p.length > 0);
|
|
89
|
+
if (paths.length === 0)
|
|
90
|
+
return false; // clean tree -- nothing to auto-commit
|
|
91
|
+
const lockfiles = new Set(GENERATED_LOCKFILE_BASENAMES);
|
|
92
|
+
return paths.every((p) => lockfiles.has(p.split('/').pop() ?? p));
|
|
93
|
+
}
|
|
94
|
+
/**
|
|
95
|
+
* Auto-commit a worktree whose only dirt is generated lockfile churn.
|
|
96
|
+
*
|
|
97
|
+
* Stages everything and commits with a clear daemon-remediation message.
|
|
98
|
+
* Callers MUST gate this behind dirtyChangesAreGeneratedLockfilesOnly so real
|
|
99
|
+
* agent work is never silently committed here. Returns the commit hash, or
|
|
100
|
+
* null if staging/committing failed (e.g. nothing staged).
|
|
101
|
+
*/
|
|
102
|
+
export function commitGeneratedLockfiles(worktreePath) {
|
|
103
|
+
const addResult = runGitSync(['add', '-A'], worktreePath);
|
|
104
|
+
if (!addResult.success) {
|
|
105
|
+
console.error(`[worktree] lockfile auto-commit: failed to stage changes: ${addResult.error}`);
|
|
106
|
+
return null;
|
|
107
|
+
}
|
|
108
|
+
const commitResult = runGitSync(['commit', '-m', 'chore: auto-commit generated lockfile churn (daemon remediation)'], worktreePath);
|
|
109
|
+
if (!commitResult.success) {
|
|
110
|
+
console.warn(`[worktree] lockfile auto-commit: commit failed (may be empty): ${commitResult.error}`);
|
|
111
|
+
return null;
|
|
112
|
+
}
|
|
113
|
+
const hashResult = runGitSync(['rev-parse', 'HEAD'], worktreePath);
|
|
114
|
+
return hashResult.success ? hashResult.output : null;
|
|
115
|
+
}
|
|
47
116
|
/**
|
|
48
117
|
* Remove a worktree when an agent session ends.
|
|
49
118
|
* The branch is preserved for PR creation.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"worktree-safety.js","sourceRoot":"","sources":["../src/worktree-safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,SAAS,EACT,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CACvB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,YAAY,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,EAC5D,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,YAAoB;IAC7E,mBAAmB;IACnB,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS;IACT,MAAM,YAAY,GAAG,UAAU,CAC7B,CAAC,QAAQ,EAAE,IAAI,EAAE,oCAAoC,YAAY,mBAAmB,CAAC,EACrF,YAAY,CACb,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,gDAAgD,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,YAAoB,EACpB,UAKI,EAAE;IAEN,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gEAAgE;QAChE,IAAI,6BAA6B,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CACV,qCAAqC,YAAY,IAAI;gBACrD,4CAA4C,CAC7C,CAAC;YACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;YAC3E,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,uCAAuC;gBACvC,OAAO,CAAC,KAAK,CACX,+BAA+B,YAAY,IAAI;oBAC/C,oDAAoD;oBACpD,0BAA0B,CAC3B,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,IAAI,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,OAAO,CAAC,KAAK,CACX,+BAA+B,YAAY,IAAI;oBAC/C,UAAU,UAAU,8BAA8B,iBAAiB,IAAI;oBACvE,2CAA2C,CAC5C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,WAAmB;IACxE,OAAO,CAAC,GAAG,CAAC,wCAAwC,YAAY,SAAS,WAAW,GAAG,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,YAAY,EAAE,sDAAsD,WAAW,GAAG,CAAC,CAAC;AACvG,CAAC"}
|
|
1
|
+
{"version":3,"file":"worktree-safety.js","sourceRoot":"","sources":["../src/worktree-safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,SAAS,EACT,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CACvB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,YAAY,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,EAC5D,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,YAAoB;IAC7E,mBAAmB;IACnB,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS;IACT,MAAM,YAAY,GAAG,UAAU,CAC7B,CAAC,QAAQ,EAAE,IAAI,EAAE,oCAAoC,YAAY,mBAAmB,CAAC,EACrF,YAAY,CACb,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,gDAAgD,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,WAAW;CACZ,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,6DAA6D,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAC7B,CAAC,QAAQ,EAAE,IAAI,EAAE,kEAAkE,CAAC,EACpF,YAAY,CACb,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,kEAAkE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,YAAoB,EACpB,UAKI,EAAE;IAEN,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gEAAgE;QAChE,IAAI,6BAA6B,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CACV,qCAAqC,YAAY,IAAI;gBACrD,4CAA4C,CAC7C,CAAC;YACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;YAC3E,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,uCAAuC;gBACvC,OAAO,CAAC,KAAK,CACX,+BAA+B,YAAY,IAAI;oBAC/C,oDAAoD;oBACpD,0BAA0B,CAC3B,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,IAAI,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,OAAO,CAAC,KAAK,CACX,+BAA+B,YAAY,IAAI;oBAC/C,UAAU,UAAU,8BAA8B,iBAAiB,IAAI;oBACvE,2CAA2C,CAC5C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,WAAmB;IACxE,OAAO,CAAC,GAAG,CAAC,wCAAwC,YAAY,SAAS,WAAW,GAAG,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,YAAY,EAAE,sDAAsD,WAAW,GAAG,CAAC,CAAC;AACvG,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@telora/daemon",
|
|
3
|
-
"version": "0.17.
|
|
3
|
+
"version": "0.17.98",
|
|
4
4
|
"description": "Agent orchestration daemon for Telora - spawns and manages Claude Code instances",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -36,8 +36,8 @@
|
|
|
36
36
|
},
|
|
37
37
|
"//testRunner": "Uses Node.js built-in test runner (node:test) via tsx for TypeScript support. The root package uses Vitest; this is a deliberate choice for the daemon package to avoid framework dependencies. See src/__tests__/ for test files.",
|
|
38
38
|
"dependencies": {
|
|
39
|
-
"@telora/daemon-core": "^0.2.
|
|
40
|
-
"@telora/mcp-products": "^0.22.
|
|
39
|
+
"@telora/daemon-core": "^0.2.45",
|
|
40
|
+
"@telora/mcp-products": "^0.22.72",
|
|
41
41
|
"commander": "^14.0.3",
|
|
42
42
|
"yaml": "^2.4.0",
|
|
43
43
|
"zod": "^4.3.6"
|
|
@@ -1,41 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Local-model API-key env-var name allow-list (TEL-5 credential-exfiltration guard).
|
|
3
|
-
*
|
|
4
|
-
* A local model / discovery request carries `api_key_env`: the NAME of a host
|
|
5
|
-
* environment variable the daemon dereferences and sends as
|
|
6
|
-
* `Authorization: Bearer <value>` to an operator-supplied `base_url`. Both the
|
|
7
|
-
* name and the URL are operator-supplied, so a malicious or compromised
|
|
8
|
-
* org-admin could name ANY host env var (e.g. an unrelated cloud secret) and
|
|
9
|
-
* point base_url at an endpoint they control -- exfiltrating that secret's value.
|
|
10
|
-
*
|
|
11
|
-
* The defense is a naming convention enforced at EVERY dereference point: the
|
|
12
|
-
* daemon will only ever read an env var whose NAME follows the local-model
|
|
13
|
-
* convention (`TELORA_LOCAL*`). A non-empty name that does not match is REFUSED:
|
|
14
|
-
* the daemon does not read or send it. An empty / blank / absent name is allowed
|
|
15
|
-
* and simply means "no key / unauthenticated" -- it is not a violation.
|
|
16
|
-
*
|
|
17
|
-
* This is the real security boundary and is write-path-agnostic: it does not
|
|
18
|
-
* matter how the row got into the DB, the daemon refuses to dereference a
|
|
19
|
-
* non-conforming name. This module is the single source of truth for that
|
|
20
|
-
* predicate, shared by the discovery fetch (discovery-poll) and the registry
|
|
21
|
-
* spawn (cli/codex-provision) dereference points.
|
|
22
|
-
*/
|
|
23
|
-
/**
|
|
24
|
-
* Allowed env-var name pattern for a local-model bearer key. Must start with
|
|
25
|
-
* `TELORA_LOCAL` and contain only uppercase ASCII letters, digits, and
|
|
26
|
-
* underscores thereafter (e.g. `TELORA_LOCAL`, `TELORA_LOCAL_API_KEY`,
|
|
27
|
-
* `TELORA_LOCAL_API_KEY_2`). Case-sensitive by design -- a lowercase name is
|
|
28
|
-
* NOT a host env var by Telora convention and is refused.
|
|
29
|
-
*/
|
|
30
|
-
export declare const ALLOWED_API_KEY_ENV_RE: RegExp;
|
|
31
|
-
/**
|
|
32
|
-
* True when `name` is safe to dereference as a local-model bearer key:
|
|
33
|
-
* - empty / blank / null / undefined (the trimmed name is empty) -> true
|
|
34
|
-
* ("no key / unauthenticated"; not a violation), OR
|
|
35
|
-
* - a non-empty name that matches {@link ALLOWED_API_KEY_ENV_RE}.
|
|
36
|
-
*
|
|
37
|
-
* False for a non-empty name that does NOT match the convention -- the daemon
|
|
38
|
-
* must not read or send that env var.
|
|
39
|
-
*/
|
|
40
|
-
export declare function isAllowedApiKeyEnvName(name: string | null | undefined): boolean;
|
|
41
|
-
//# sourceMappingURL=local-model-key-env.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"local-model-key-env.d.ts","sourceRoot":"","sources":["../src/local-model-key-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AAEjE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAI/E"}
|
|
@@ -1,46 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Local-model API-key env-var name allow-list (TEL-5 credential-exfiltration guard).
|
|
3
|
-
*
|
|
4
|
-
* A local model / discovery request carries `api_key_env`: the NAME of a host
|
|
5
|
-
* environment variable the daemon dereferences and sends as
|
|
6
|
-
* `Authorization: Bearer <value>` to an operator-supplied `base_url`. Both the
|
|
7
|
-
* name and the URL are operator-supplied, so a malicious or compromised
|
|
8
|
-
* org-admin could name ANY host env var (e.g. an unrelated cloud secret) and
|
|
9
|
-
* point base_url at an endpoint they control -- exfiltrating that secret's value.
|
|
10
|
-
*
|
|
11
|
-
* The defense is a naming convention enforced at EVERY dereference point: the
|
|
12
|
-
* daemon will only ever read an env var whose NAME follows the local-model
|
|
13
|
-
* convention (`TELORA_LOCAL*`). A non-empty name that does not match is REFUSED:
|
|
14
|
-
* the daemon does not read or send it. An empty / blank / absent name is allowed
|
|
15
|
-
* and simply means "no key / unauthenticated" -- it is not a violation.
|
|
16
|
-
*
|
|
17
|
-
* This is the real security boundary and is write-path-agnostic: it does not
|
|
18
|
-
* matter how the row got into the DB, the daemon refuses to dereference a
|
|
19
|
-
* non-conforming name. This module is the single source of truth for that
|
|
20
|
-
* predicate, shared by the discovery fetch (discovery-poll) and the registry
|
|
21
|
-
* spawn (cli/codex-provision) dereference points.
|
|
22
|
-
*/
|
|
23
|
-
/**
|
|
24
|
-
* Allowed env-var name pattern for a local-model bearer key. Must start with
|
|
25
|
-
* `TELORA_LOCAL` and contain only uppercase ASCII letters, digits, and
|
|
26
|
-
* underscores thereafter (e.g. `TELORA_LOCAL`, `TELORA_LOCAL_API_KEY`,
|
|
27
|
-
* `TELORA_LOCAL_API_KEY_2`). Case-sensitive by design -- a lowercase name is
|
|
28
|
-
* NOT a host env var by Telora convention and is refused.
|
|
29
|
-
*/
|
|
30
|
-
export const ALLOWED_API_KEY_ENV_RE = /^TELORA_LOCAL[A-Z0-9_]*$/;
|
|
31
|
-
/**
|
|
32
|
-
* True when `name` is safe to dereference as a local-model bearer key:
|
|
33
|
-
* - empty / blank / null / undefined (the trimmed name is empty) -> true
|
|
34
|
-
* ("no key / unauthenticated"; not a violation), OR
|
|
35
|
-
* - a non-empty name that matches {@link ALLOWED_API_KEY_ENV_RE}.
|
|
36
|
-
*
|
|
37
|
-
* False for a non-empty name that does NOT match the convention -- the daemon
|
|
38
|
-
* must not read or send that env var.
|
|
39
|
-
*/
|
|
40
|
-
export function isAllowedApiKeyEnvName(name) {
|
|
41
|
-
const trimmed = typeof name === 'string' ? name.trim() : '';
|
|
42
|
-
if (trimmed.length === 0)
|
|
43
|
-
return true;
|
|
44
|
-
return ALLOWED_API_KEY_ENV_RE.test(trimmed);
|
|
45
|
-
}
|
|
46
|
-
//# sourceMappingURL=local-model-key-env.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"local-model-key-env.js","sourceRoot":"","sources":["../src/local-model-key-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA+B;IACpE,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC"}
|