@tokenfactory/acc-runner 0.27.0 → 0.27.1

package/dist/git.d.ts

@@ -0,0 +1,50 @@
+export declare const ACC_BRANCH_PATTERN: RegExp;
+export declare function isAccBranch(name: string | null | undefined): boolean;
+export interface GitRunner {
+    fetch(repoPath: string): Promise<void>;
+    checkout(repoPath: string, branch: string): Promise<void>;
+    push(repoPath: string, branch: string): Promise<void>;
+    /** True when the working tree has no uncommitted changes. */
+    isClean(repoPath: string): Promise<boolean>;
+    /**
+     * v0.53 T-53-4: the EARLIEST commit on `branch` that is not reachable
+     * from `baseRef` — i.e. the first commit the task produced on its branch
+     * — as `{ sha, ts }` where `ts` is the committer date (ISO-8601), or
+     * null when the branch has no commits ahead of the base. Powers the
+     * `task.first_commit` SLO signal (when coding actually started).
+     *
+     * Optional on the interface so existing GitRunner test stubs that omit
+     * it keep compiling; the default implementation below provides it and
+     * the task-runner guards the call with `?.`.
+     */
+    firstCommit?(repoPath: string, baseRef: string, branch: string): Promise<{
+        sha: string;
+        ts: string;
+    } | null>;
+}
+export type PushErrorKind = "transient" | "terminal";
+/**
+ * Classify a `git push` failure. Terminal = the operator has to fix
+ * something (credentials, permissions, branch protection). Transient =
+ * worth retrying (network drop, GitHub 5xx, TLS hiccup, RPC hangup).
+ *
+ * Heuristics walk stderr because git surfaces all of these as
+ * non-zero exits with explanatory text. We do not parse git's exit
+ * code — it's `1` for everything.
+ */
+export declare function classifyPushError(err: unknown): PushErrorKind;
+export interface PushRetryOptions {
+    attempts?: number;
+    /** Milliseconds between attempt N and N+1. Defaults to 1s/2s/4s. */
+    backoffMs?: readonly number[];
+    /** Test seam — overrides setTimeout. */
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * Run `pushFn` with up to N attempts and exponential backoff between
+ * attempts. Terminal errors short-circuit immediately so callers don't
+ * wait through three rejected pushes when the GitHub token expired.
+ */
+export declare function pushWithRetry(pushFn: () => Promise<void>, options?: PushRetryOptions): Promise<void>;
+export declare const git: GitRunner;
+//# sourceMappingURL=git.d.ts.map

package/dist/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,kBAAkB,QAAsC,CAAC;AAEtE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,WAAW,CAAC,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChD;AAMD,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CA0B7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wCAAwC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAQD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,eAAO,MAAM,GAAG,EAAE,SAkCjB,CAAC"}

package/dist/git.js

@@ -0,0 +1,127 @@
+/**
+ * Thin git wrappers using execa. The CLI never edits the user's git
+ * config — it relies on whatever credentials they already have set up.
+ *
+ * Push uses an exponential-backoff retry (v0.5.0+): three attempts with
+ * 1s/2s/4s sleeps in between. Transient failures (network, 5xx from
+ * GitHub, hangups) retry; terminal failures (auth, permission) fail
+ * fast so an operator can fix credentials without waiting 7s.
+ */
+import { execa } from "execa";
+import { buildEnv } from "./bin-resolve.js";
+// Matches branches the runner should treat as ACC-owned, including the
+// `chore/acc-…` and `feat/acc-…` conventional-commit forms that the CLI
+// agent opens in some flows. The original `acc/…` form is preserved.
+export const ACC_BRANCH_PATTERN = /^(?:acc\/|chore\/acc-|feat\/acc-)/;
+export function isAccBranch(name) {
+    return typeof name === "string" && ACC_BRANCH_PATTERN.test(name);
+}
+async function run(repoPath, args) {
+    return execa("git", args, { cwd: repoPath, env: buildEnv() });
+}
+/**
+ * Classify a `git push` failure. Terminal = the operator has to fix
+ * something (credentials, permissions, branch protection). Transient =
+ * worth retrying (network drop, GitHub 5xx, TLS hiccup, RPC hangup).
+ *
+ * Heuristics walk stderr because git surfaces all of these as
+ * non-zero exits with explanatory text. We do not parse git's exit
+ * code — it's `1` for everything.
+ */
+export function classifyPushError(err) {
+    const e = err;
+    const stderr = typeof e?.stderr === "string" ? e.stderr : "";
+    const message = typeof e?.message === "string" ? e.message : "";
+    const haystack = `${stderr}\n${message}`.toLowerCase();
+    // Terminal — auth / permission / branch protection. No amount of
+    // retrying fixes any of these.
+    const terminalPatterns = [
+        "authentication failed",
+        "permission denied",
+        "remote: permission",
+        "could not read username",
+        "could not read password",
+        "403 forbidden",
+        "401 unauthorized",
+        "protected branch",
+        "gh auth login",
+        "support for password authentication was removed",
+    ];
+    if (terminalPatterns.some((p) => haystack.includes(p)))
+        return "terminal";
+    // Everything else (network errors, 5xx, RPC failures, generic hangups)
+    // is treated as transient so the retry loop gives the network a chance
+    // to recover.
+    return "transient";
+}
+const DEFAULT_BACKOFF_MS = [1_000, 2_000, 4_000];
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Run `pushFn` with up to N attempts and exponential backoff between
+ * attempts. Terminal errors short-circuit immediately so callers don't
+ * wait through three rejected pushes when the GitHub token expired.
+ */
+export async function pushWithRetry(pushFn, options = {}) {
+    const attempts = options.attempts ?? 3;
+    const backoff = options.backoffMs ?? DEFAULT_BACKOFF_MS;
+    const sleep = options.sleep ?? defaultSleep;
+    let lastError = null;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        try {
+            await pushFn();
+            return;
+        }
+        catch (err) {
+            lastError = err;
+            const kind = classifyPushError(err);
+            if (kind === "terminal")
+                throw err;
+            if (attempt === attempts)
+                break;
+            const wait = backoff[attempt - 1] ?? backoff[backoff.length - 1] ?? 0;
+            if (wait > 0)
+                await sleep(wait);
+        }
+    }
+    throw lastError;
+}
+export const git = {
+    async fetch(repoPath) {
+        await run(repoPath, ["fetch", "--prune", "--all"]);
+    },
+    async checkout(repoPath, branch) {
+        // First try `checkout -B`, which also creates the branch if missing.
+        await run(repoPath, ["checkout", "-B", branch]);
+    },
+    async push(repoPath, branch) {
+        await pushWithRetry(async () => {
+            await run(repoPath, ["push", "-u", "origin", branch]);
+        });
+    },
+    async isClean(repoPath) {
+        const { stdout } = await run(repoPath, ["status", "--porcelain"]);
+        return stdout.trim().length === 0;
+    },
+    async firstCommit(repoPath, baseRef, branch) {
+        // `--reverse` lists oldest→newest so the first line is the earliest
+        // commit on `branch` not reachable from `baseRef`. %H = full sha,
+        // %cI = committer date in strict ISO-8601. A tab separator survives
+        // both fields cleanly (commit dates never contain tabs).
+        const { stdout } = await run(repoPath, [
+            "log",
+            "--reverse",
+            "--format=%H%x09%cI",
+            `${baseRef}..${branch}`,
+        ]);
+        const firstLine = stdout.split(/\r?\n/).find((l) => l.trim().length > 0);
+        if (!firstLine)
+            return null;
+        const [sha, ts] = firstLine.split("\t");
+        if (!sha)
+            return null;
+        return { sha: sha.trim(), ts: (ts ?? "").trim() };
+    },
+};
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAA2C,MAAM,OAAO,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAEtE,MAAM,UAAU,WAAW,CAAC,IAA+B;IACzD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AA0BD,KAAK,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAc;IACjD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,CAAC,GAAG,GAAoE,CAAC;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAEvD,iEAAiE;IACjE,+BAA+B;IAC/B,MAAM,gBAAgB,GAAG;QACvB,uBAAuB;QACvB,mBAAmB;QACnB,oBAAoB;QACpB,yBAAyB;QACzB,yBAAyB;QACzB,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,eAAe;QACf,iDAAiD;KAClD,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC;IAE1E,uEAAuE;IACvE,uEAAuE;IACvE,cAAc;IACd,OAAO,WAAW,CAAC;AACrB,CAAC;AAUD,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE1D,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,UAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAE5C,IAAI,SAAS,GAAY,IAAI,CAAC;IAC9B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,UAAU;gBAAE,MAAM,GAAG,CAAC;YACnC,IAAI,OAAO,KAAK,QAAQ;gBAAE,MAAM;YAChC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YACtE,IAAI,IAAI,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,SAAkB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAc;IAC5B,KAAK,CAAC,KAAK,CAAC,QAAQ;QAClB,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM;QAC7B,qEAAqE;QACrE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM;QACzB,MAAM,aAAa,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAQ;QACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM;QACzC,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE;YACrC,KAAK;YACL,WAAW;YACX,oBAAoB;YACpB,GAAG,OAAO,KAAK,MAAM,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACpD,CAAC;CACF,CAAC"}

package/dist/github-client.d.ts

@@ -0,0 +1,133 @@
+/**
+ * v0.53 T-53-4 — runner-side, budget-aware GitHub REST client.
+ *
+ * A port of the api/ side's `api/_lib/github-client.ts` (T-52-4) into the
+ * runner package. The runner CANNOT import api/ code (separate build, no
+ * shared module graph), so the pattern is reproduced here. The three
+ * behaviours match the server client 1:1:
+ *
+ *   1. Quota tracking — x-ratelimit-remaining / x-ratelimit-reset per
+ *      resource (core, search, graphql, …) from every response, surfaced
+ *      via getQuotaSnapshot() for `acc-runner doctor`.
+ *
+ *   2. Secondary-limit backoff — a 429, or a 403 carrying retry-after /
+ *      x-ratelimit-remaining: 0, is a rate-limit response, not an answer.
+ *      The client sleeps once (retry-after if given, else an exponential
+ *      base, both jittered, capped at MAX_BACKOFF_MS) and retries once. A
+ *      second rate-limit response — or a retry-after beyond the cap —
+ *      surfaces as a typed RateLimitedError.
+ *
+ *   3. Per-task-execution soft budget — runTask arms a budget at the top
+ *      of a task (startTaskGithubBudget) and disarms it in its finally
+ *      (endTaskGithubBudget). Once the budget is spent, every further
+ *      githubFetch throws GithubBudgetExceededError WITHOUT hitting the
+ *      network. The caller treats this as a CLEAN, RETRYABLE infra failure
+ *      — NOT a code failure: it never reaches classifyClaudeExit, so the
+ *      runner is never quarantined for exhausting its GitHub budget.
+ *
+ * ── Coverage note (READ THIS) ──────────────────────────────────────────
+ * As of v0.53 the runner makes ALL of its GitHub calls through the `gh`
+ * CLI (see gh.ts, runtime/conflict-resolver.ts, runtime/rework.ts,
+ * runtime/reviewer.ts). Those `gh`/`gh api` invocations are SEPARATE
+ * processes with their own rate-limit handling and are out of scope for
+ * this client — they remain UNCOVERED by the budget/backoff here. This
+ * module is the sanctioned wrapper for any future *direct* REST call the
+ * runner adds (`fetch` against api.github.com); routing such calls through
+ * githubFetch is what keeps them budget- and rate-limit-aware.
+ *
+ * Reference: api/_lib/github-client.ts, planning/ACC_WORKFLOW_GAP_ANALYSIS.md §G13.
+ */
+/** Soft per-task-execution call budget. */
+export declare const DEFAULT_TASK_GITHUB_BUDGET = 50;
+/**
+ * Longest single backoff sleep. A secondary-limit retry-after can be 60s+;
+ * sleeping that long inside a task run wastes wall-clock the operator is
+ * paying for, so anything above the cap skips the retry and throws
+ * RateLimitedError instead.
+ */
+export declare const MAX_BACKOFF_MS = 15000;
+/** Base for the exponential backoff when GitHub sends no retry-after. */
+export declare const BASE_BACKOFF_MS = 2000;
+/**
+ * Typed rate-limit failure: GitHub said "back off" twice in a row (or
+ * asked for a longer wait than we can afford). A rate-limit storm is then
+ * diagnosable instead of looking like random github_http_403 noise. This
+ * is a RETRYABLE INFRA failure — see isRetryableGithubError.
+ */
+export declare class RateLimitedError extends Error {
+    readonly status: number;
+    readonly resource: string | null;
+    /** ISO timestamp the quota window resets at, when GitHub said. */
+    readonly reset_at: string | null;
+    readonly retry_after_s: number | null;
+    constructor(opts: {
+        status: number;
+        resource: string | null;
+        reset_at: string | null;
+        retry_after_s: number | null;
+    });
+}
+/**
+ * Soft-budget exhaustion. NOT a code failure: the task simply did as much
+ * direct GitHub work as one task execution is allowed. The caller should
+ * surface it as a clean, RETRYABLE infra failure and NEVER feed it to the
+ * claude-exit classifier (which would quarantine the runner).
+ */
+export declare class GithubBudgetExceededError extends Error {
+    readonly used: number;
+    readonly budget: number;
+    constructor(used: number, budget: number);
+}
+/**
+ * v0.53 T-53-4: both client failure modes are retryable infra conditions,
+ * not task/code failures. The contract the runner relies on: an error for
+ * which this returns true must surface as `phase: "github"` / retryable and
+ * MUST NOT set `quarantine_cause` — i.e. it is classifier-neutral and never
+ * benches the runner.
+ */
+export declare function isRetryableGithubError(err: unknown): boolean;
+interface ResourceQuota {
+    remaining: number | null;
+    /** ISO timestamp. */
+    reset_at: string | null;
+}
+export interface GithubQuotaSnapshot {
+    /** Lowest remaining across observed resources (the binding constraint). */
+    remaining: number | null;
+    /** Reset time of that lowest-remaining resource. */
+    reset_at: string | null;
+    /** Direct REST calls made since the last startTaskGithubBudget(). */
+    used_this_task: number;
+    /** Per-resource view (core, search, …) as reported by GitHub headers. */
+    resources: Record<string, ResourceQuota>;
+}
+/**
+ * Begin a budgeted task execution: resets the per-task counter and arms the
+ * soft budget. runTask calls this at the top of a task; the explicit reset
+ * also re-baselines a long-lived watch process between tasks.
+ */
+export declare function startTaskGithubBudget(budget?: number): void;
+/**
+ * End a budgeted task execution: disarms the soft budget so any direct REST
+ * call made OUTSIDE a task run (e.g. doctor) is unbudgeted. Idempotent.
+ */
+export declare function endTaskGithubBudget(): void;
+export declare function getQuotaSnapshot(): GithubQuotaSnapshot;
+/** Test seam: wipe quota/budget state between unit tests. */
+export declare function resetGithubClientStateForTests(): void;
+/** Injection seams for unit tests; production callers never pass this. */
+export interface GithubFetchDeps {
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    /** Returns [0, 1); defaults to Math.random. Drives backoff jitter. */
+    random?: () => number;
+}
+/**
+ * Authenticated GitHub REST fetch. The caller supplies whatever token is
+ * appropriate (the runner uses the operator's own gh/git credentials for
+ * CLI calls; a direct REST consumer would pass a token it already holds).
+ * An empty token sends an anonymous request rather than `Bearer <empty>`.
+ */
+export declare function githubFetch(url: string, token: string, init?: RequestInit, deps?: GithubFetchDeps): Promise<Response>;
+export {};
+//# sourceMappingURL=github-client.d.ts.map

package/dist/github-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../src/github-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,2CAA2C;AAC3C,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,yEAAyE;AACzE,eAAO,MAAM,eAAe,OAAQ,CAAC;AAErC;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE1B,IAAI,EAAE;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B;CAYF;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMzC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED,UAAU,aAAa;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qBAAqB;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAOD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,MAAmC,GAAG,IAAI,CAGvF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,wBAAgB,gBAAgB,IAAI,mBAAmB,CAkBtD;AAED,6DAA6D;AAC7D,wBAAgB,8BAA8B,IAAI,IAAI,CAIrD;AA6CD,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAMD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,EACtB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAwCnB"}

package/dist/github-client.js

@@ -0,0 +1,234 @@
+/**
+ * v0.53 T-53-4 — runner-side, budget-aware GitHub REST client.
+ *
+ * A port of the api/ side's `api/_lib/github-client.ts` (T-52-4) into the
+ * runner package. The runner CANNOT import api/ code (separate build, no
+ * shared module graph), so the pattern is reproduced here. The three
+ * behaviours match the server client 1:1:
+ *
+ *   1. Quota tracking — x-ratelimit-remaining / x-ratelimit-reset per
+ *      resource (core, search, graphql, …) from every response, surfaced
+ *      via getQuotaSnapshot() for `acc-runner doctor`.
+ *
+ *   2. Secondary-limit backoff — a 429, or a 403 carrying retry-after /
+ *      x-ratelimit-remaining: 0, is a rate-limit response, not an answer.
+ *      The client sleeps once (retry-after if given, else an exponential
+ *      base, both jittered, capped at MAX_BACKOFF_MS) and retries once. A
+ *      second rate-limit response — or a retry-after beyond the cap —
+ *      surfaces as a typed RateLimitedError.
+ *
+ *   3. Per-task-execution soft budget — runTask arms a budget at the top
+ *      of a task (startTaskGithubBudget) and disarms it in its finally
+ *      (endTaskGithubBudget). Once the budget is spent, every further
+ *      githubFetch throws GithubBudgetExceededError WITHOUT hitting the
+ *      network. The caller treats this as a CLEAN, RETRYABLE infra failure
+ *      — NOT a code failure: it never reaches classifyClaudeExit, so the
+ *      runner is never quarantined for exhausting its GitHub budget.
+ *
+ * ── Coverage note (READ THIS) ──────────────────────────────────────────
+ * As of v0.53 the runner makes ALL of its GitHub calls through the `gh`
+ * CLI (see gh.ts, runtime/conflict-resolver.ts, runtime/rework.ts,
+ * runtime/reviewer.ts). Those `gh`/`gh api` invocations are SEPARATE
+ * processes with their own rate-limit handling and are out of scope for
+ * this client — they remain UNCOVERED by the budget/backoff here. This
+ * module is the sanctioned wrapper for any future *direct* REST call the
+ * runner adds (`fetch` against api.github.com); routing such calls through
+ * githubFetch is what keeps them budget- and rate-limit-aware.
+ *
+ * Reference: api/_lib/github-client.ts, planning/ACC_WORKFLOW_GAP_ANALYSIS.md §G13.
+ */
+/** Soft per-task-execution call budget. */
+export const DEFAULT_TASK_GITHUB_BUDGET = 50;
+/**
+ * Longest single backoff sleep. A secondary-limit retry-after can be 60s+;
+ * sleeping that long inside a task run wastes wall-clock the operator is
+ * paying for, so anything above the cap skips the retry and throws
+ * RateLimitedError instead.
+ */
+export const MAX_BACKOFF_MS = 15_000;
+/** Base for the exponential backoff when GitHub sends no retry-after. */
+export const BASE_BACKOFF_MS = 2_000;
+/**
+ * Typed rate-limit failure: GitHub said "back off" twice in a row (or
+ * asked for a longer wait than we can afford). A rate-limit storm is then
+ * diagnosable instead of looking like random github_http_403 noise. This
+ * is a RETRYABLE INFRA failure — see isRetryableGithubError.
+ */
+export class RateLimitedError extends Error {
+    status;
+    resource;
+    /** ISO timestamp the quota window resets at, when GitHub said. */
+    reset_at;
+    retry_after_s;
+    constructor(opts) {
+        super(`github rate limited (${opts.status})` +
+            (opts.resource ? ` on ${opts.resource}` : "") +
+            (opts.reset_at ? `, resets ${opts.reset_at}` : ""));
+        this.name = "RateLimitedError";
+        this.status = opts.status;
+        this.resource = opts.resource;
+        this.reset_at = opts.reset_at;
+        this.retry_after_s = opts.retry_after_s;
+    }
+}
+/**
+ * Soft-budget exhaustion. NOT a code failure: the task simply did as much
+ * direct GitHub work as one task execution is allowed. The caller should
+ * surface it as a clean, RETRYABLE infra failure and NEVER feed it to the
+ * claude-exit classifier (which would quarantine the runner).
+ */
+export class GithubBudgetExceededError extends Error {
+    used;
+    budget;
+    constructor(used, budget) {
+        super(`github task budget exhausted (${used}/${budget} calls)`);
+        this.name = "GithubBudgetExceededError";
+        this.used = used;
+        this.budget = budget;
+    }
+}
+/**
+ * v0.53 T-53-4: both client failure modes are retryable infra conditions,
+ * not task/code failures. The contract the runner relies on: an error for
+ * which this returns true must surface as `phase: "github"` / retryable and
+ * MUST NOT set `quarantine_cause` — i.e. it is classifier-neutral and never
+ * benches the runner.
+ */
+export function isRetryableGithubError(err) {
+    return err instanceof RateLimitedError || err instanceof GithubBudgetExceededError;
+}
+// ── Module state (per process) ───────────────────────────────────────────────
+const quotaByResource = new Map();
+let usedThisTask = 0;
+let taskBudget = null;
+/**
+ * Begin a budgeted task execution: resets the per-task counter and arms the
+ * soft budget. runTask calls this at the top of a task; the explicit reset
+ * also re-baselines a long-lived watch process between tasks.
+ */
+export function startTaskGithubBudget(budget = DEFAULT_TASK_GITHUB_BUDGET) {
+    usedThisTask = 0;
+    taskBudget = budget;
+}
+/**
+ * End a budgeted task execution: disarms the soft budget so any direct REST
+ * call made OUTSIDE a task run (e.g. doctor) is unbudgeted. Idempotent.
+ */
+export function endTaskGithubBudget() {
+    taskBudget = null;
+}
+export function getQuotaSnapshot() {
+    let min = null;
+    const resources = {};
+    for (const [name, q] of quotaByResource) {
+        resources[name] = { ...q };
+        if (q.remaining !== null &&
+            (min === null || min.remaining === null || q.remaining < min.remaining)) {
+            min = q;
+        }
+    }
+    return {
+        remaining: min?.remaining ?? null,
+        reset_at: min?.reset_at ?? null,
+        used_this_task: usedThisTask,
+        resources,
+    };
+}
+/** Test seam: wipe quota/budget state between unit tests. */
+export function resetGithubClientStateForTests() {
+    quotaByResource.clear();
+    usedThisTask = 0;
+    taskBudget = null;
+}
+function recordRateLimitHeaders(res) {
+    const remainingRaw = res.headers.get("x-ratelimit-remaining");
+    const resetRaw = res.headers.get("x-ratelimit-reset");
+    if (remainingRaw === null && resetRaw === null)
+        return;
+    const resource = res.headers.get("x-ratelimit-resource") ?? "core";
+    const remaining = remainingRaw !== null && remainingRaw !== "" ? Number(remainingRaw) : NaN;
+    const resetEpochS = resetRaw !== null && resetRaw !== "" ? Number(resetRaw) : NaN;
+    quotaByResource.set(resource, {
+        remaining: Number.isFinite(remaining) ? remaining : null,
+        reset_at: Number.isFinite(resetEpochS)
+            ? new Date(resetEpochS * 1000).toISOString()
+            : null,
+    });
+}
+/**
+ * A 429 is always "back off". A 403 is only a rate limit when it carries
+ * retry-after (secondary limit) or x-ratelimit-remaining: 0 (primary limit
+ * exhausted) — a plain 403 is a permissions error and passes through.
+ */
+function isRateLimitResponse(res) {
+    if (res.status === 429)
+        return true;
+    if (res.status !== 403)
+        return false;
+    if (res.headers.get("retry-after") !== null)
+        return true;
+    return res.headers.get("x-ratelimit-remaining") === "0";
+}
+function toRateLimitedError(res) {
+    const retryAfterRaw = res.headers.get("retry-after");
+    const retryAfter = retryAfterRaw !== null ? Number(retryAfterRaw) : NaN;
+    const resetRaw = res.headers.get("x-ratelimit-reset");
+    const resetEpochS = resetRaw !== null ? Number(resetRaw) : NaN;
+    return new RateLimitedError({
+        status: res.status,
+        resource: res.headers.get("x-ratelimit-resource"),
+        reset_at: Number.isFinite(resetEpochS)
+            ? new Date(resetEpochS * 1000).toISOString()
+            : null,
+        retry_after_s: Number.isFinite(retryAfter) ? retryAfter : null,
+    });
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Authenticated GitHub REST fetch. The caller supplies whatever token is
+ * appropriate (the runner uses the operator's own gh/git credentials for
+ * CLI calls; a direct REST consumer would pass a token it already holds).
+ * An empty token sends an anonymous request rather than `Bearer <empty>`.
+ */
+export async function githubFetch(url, token, init = {}, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const sleep = deps.sleep ?? defaultSleep;
+    const random = deps.random ?? Math.random;
+    const headers = new Headers(init.headers);
+    if (token)
+        headers.set("Authorization", `Bearer ${token}`);
+    if (!headers.has("Accept")) {
+        headers.set("Accept", "application/vnd.github+json");
+    }
+    headers.set("X-GitHub-Api-Version", "2022-11-28");
+    headers.set("User-Agent", "acc-runner");
+    const doFetch = async () => {
+        if (taskBudget !== null && usedThisTask >= taskBudget) {
+            throw new GithubBudgetExceededError(usedThisTask, taskBudget);
+        }
+        usedThisTask++;
+        const res = await fetchImpl(url, { ...init, headers });
+        recordRateLimitHeaders(res);
+        return res;
+    };
+    const first = await doFetch();
+    if (!isRateLimitResponse(first))
+        return first;
+    // Rate limited: sleep jittered-exponential once, retry once.
+    const retryAfterRaw = first.headers.get("retry-after");
+    const retryAfterS = retryAfterRaw !== null ? Number(retryAfterRaw) : NaN;
+    const baseMs = Number.isFinite(retryAfterS) ? retryAfterS * 1000 : BASE_BACKOFF_MS;
+    if (baseMs > MAX_BACKOFF_MS) {
+        // GitHub asked for a longer pause than we want to burn mid-task —
+        // surface the typed error now instead of sleeping into the run.
+        throw toRateLimitedError(first);
+    }
+    await sleep(Math.round(baseMs * (1 + random() * 0.5)));
+    const second = await doFetch();
+    if (!isRateLimitResponse(second))
+        return second;
+    throw toRateLimitedError(second);
+}
+//# sourceMappingURL=github-client.js.map

package/dist/github-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../src/github-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,CAAS;IACf,QAAQ,CAAgB;IACjC,kEAAkE;IACzD,QAAQ,CAAgB;IACxB,aAAa,CAAgB;IAEtC,YAAY,IAKX;QACC,KAAK,CACH,wBAAwB,IAAI,CAAC,MAAM,GAAG;YACpC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAAS;IACb,MAAM,CAAS;IAExB,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,iCAAiC,IAAI,IAAI,MAAM,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,GAAG,YAAY,gBAAgB,IAAI,GAAG,YAAY,yBAAyB,CAAC;AACrF,CAAC;AAmBD,gFAAgF;AAChF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;AACzD,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,0BAA0B;IAC/E,YAAY,GAAG,CAAC,CAAC;IACjB,UAAU,GAAG,MAAM,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,GAAG,GAAyB,IAAI,CAAC;IACrC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3B,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,EACvE,CAAC;YACD,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;QACjC,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;QAC/B,cAAc,EAAE,YAAY;QAC5B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B;IAC5C,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,YAAY,GAAG,CAAC,CAAC;IACjB,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAa;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,YAAY,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC;IACnE,MAAM,SAAS,GACb,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClF,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,IAAI;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAa;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAa;IACvC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,OAAO,IAAI,gBAAgB,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,IAAI;QACR,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC,CAAC;AACL,CAAC;AAUD,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,KAAa,EACb,OAAoB,EAAE,EACtB,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE;QAC5C,IAAI,UAAU,KAAK,IAAI,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;IACnF,IAAI,MAAM,GAAG,cAAc,EAAE,CAAC;QAC5B,kEAAkE;QAClE,gEAAgE;QAChE,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/keychain.d.ts

@@ -0,0 +1,21 @@
+/**
+ * OS-keychain wrapper around `keytar`. The CLI never persists a JWT to
+ * disk in plaintext — keychain is the only writable surface.
+ *
+ * keytar is a native module; we lazy-import so commands that don't need
+ * credentials (`--version`, `--help`) still work on systems where the
+ * binding has not built (`linux` headless CI without libsecret, etc).
+ */
+import { type StoredSession } from "./types.js";
+type KeytarLike = {
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    getPassword(service: string, account: string): Promise<string | null>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+};
+export declare function saveSession(session: StoredSession): Promise<void>;
+export declare function loadSession(): Promise<StoredSession | null>;
+export declare function clearSession(): Promise<boolean>;
+/** Test-only seam used by the keychain test (overrides the lazy import). */
+export declare function __setKeytar(impl: KeytarLike | null): void;
+export {};
+//# sourceMappingURL=keychain.d.ts.map

package/dist/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAIzE,KAAK,UAAU,GAAG;IAChB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE,CAAC;AAYF,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAUjE;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAGrD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAEzD"}

package/dist/keychain.js

@@ -0,0 +1,45 @@
+/**
+ * OS-keychain wrapper around `keytar`. The CLI never persists a JWT to
+ * disk in plaintext — keychain is the only writable surface.
+ *
+ * keytar is a native module; we lazy-import so commands that don't need
+ * credentials (`--version`, `--help`) still work on systems where the
+ * binding has not built (`linux` headless CI without libsecret, etc).
+ */
+import { RUNNER_KEYCHAIN_SERVICE } from "./types.js";
+const ACCOUNT = "default";
+let cached = null;
+async function getKeytar() {
+    if (cached)
+        return cached;
+    // Dynamic import keeps native-binding failures out of the cold path.
+    const mod = (await import("keytar"));
+    cached = (mod.default ?? mod);
+    return cached;
+}
+export async function saveSession(session) {
+    const k = await getKeytar();
+    await k.setPassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT, JSON.stringify(session));
+}
+export async function loadSession() {
+    const k = await getKeytar();
+    const raw = await k.getPassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT);
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        // Corrupted entry — treat as "not logged in" rather than crashing.
+        return null;
+    }
+}
+export async function clearSession() {
+    const k = await getKeytar();
+    return k.deletePassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT);
+}
+/** Test-only seam used by the keychain test (overrides the lazy import). */
+export function __setKeytar(impl) {
+    cached = impl;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAsB,MAAM,YAAY,CAAC;AAEzE,MAAM,OAAO,GAAG,SAAkB,CAAC;AAQnC,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAqD,CAAC;IACzF,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAe,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}