@tokenfactory/acc-runner 0.42.0 → 0.44.0

package/dist/git-auth/installation-token.d.ts

@@ -0,0 +1,95 @@
+/** One minted installation token plus the metadata needed to cache/refresh it. */
+export interface InstallationTokenResult {
+    token: string;
+    /** ISO-8601 expiry timestamp (GitHub installation tokens live ~1h). */
+    expiresAt: string;
+    /** The repos this token is ACTUALLY scoped to, as returned by the mint. */
+    repos: string[];
+}
+/** Injectable seam. Production wires this via `makeHttpInstallationTokenFetcher`; tests pass a stub. */
+export type InstallationTokenFetcher = (repos: string[], runnerId: string) => Promise<InstallationTokenResult>;
+/**
+ * Thrown when a mint hands back a token scoped to repos beyond what the
+ * runner requested. This is the client-side half of "token scope limited to
+ * the repos the runner serves" (AC3): even a server that returns an
+ * over-broad grant cannot make this runner USE the excess scope, because the
+ * provider refuses the token outright rather than caching/serving it.
+ */
+export declare class InstallationTokenScopeError extends Error {
+    readonly requested: string[];
+    readonly granted: string[];
+    constructor(requested: string[], granted: string[]);
+}
+/**
+ * True when `granted` is a NON-EMPTY set and every entry is present in
+ * `requested` (case-insensitive).
+ *
+ * AC5: an empty grant is NOT treated as in-scope. A mint that hands back zero
+ * repos proves nothing about what it actually scoped the token to — vacuously
+ * satisfying a subset check would let a malformed or field-less response
+ * through as if it were a valid (if narrow) grant. Fail closed instead: no
+ * verifiable scope means the token is rejected, same as an over-broad one.
+ */
+export declare function isWithinRequestedScope(requested: string[], granted: string[]): boolean;
+export interface InstallationTokenProviderOptions {
+    /**
+     * The repo(s) ("owner/name") this container is configured to serve.
+     * Required and non-empty — a provider with no configured repos can never
+     * mint a token, closing off the "one credential, every repo" shape a
+     * shared PAT had.
+     */
+    repos: string[];
+    fetcher: InstallationTokenFetcher;
+    runnerId: string;
+    /** Refresh this many ms before the cached token's stated expiry. Default 5 min. */
+    refreshMarginMs?: number;
+}
+/**
+ * Runner-side cache/refresh for a single installation token, scoped to the
+ * repo(s) this container serves. In-memory only — like `EnvTokenProvider`
+ * (token-provider.ts), an ephemeral container must never write a credential
+ * to its writable layer.
+ */
+export declare class InstallationTokenProvider {
+    private readonly repos;
+    private readonly fetcher;
+    private readonly runnerId;
+    private readonly refreshMarginMs;
+    private cached;
+    private inflight;
+    constructor(opts: InstallationTokenProviderOptions);
+    /** Repos this provider is configured to serve (defensive copy). */
+    reposServed(): string[];
+    /** True when the cached token is still fresh past the refresh margin. */
+    private fresh;
+    /**
+     * Return a valid installation token, minting or refreshing as needed.
+     * Concurrent callers share one in-flight mint (mirrors the server-side
+     * single-flight in `api/_lib/github-app.ts`) so a burst of git operations
+     * at container boot doesn't fire N redundant mints. A rejected mint clears
+     * the in-flight slot so the NEXT call retries rather than replaying the
+     * same rejection forever.
+     */
+    getToken(): Promise<string>;
+    private mint;
+    /** Diagnostics-safe snapshot — NEVER includes the token itself. */
+    snapshot(): {
+        hasToken: boolean;
+        expiresAt: string | null;
+        repos: string[];
+    };
+}
+/**
+ * Build an HTTP-backed `InstallationTokenFetcher` against the (not-yet-shipped)
+ * `/api/runner/github-installation-token` endpoint. Mirrors
+ * `secrets/inject.ts`'s `makeHttpSecretFetcher`: the runner authenticates
+ * with its own bearer JWT, the server does the privileged GitHub App
+ * JWT-sign + installation-token exchange (`api/_lib/github-app.ts`), and only
+ * the resulting short-lived, repo-scoped token crosses the wire back.
+ */
+export declare function makeHttpInstallationTokenFetcher(opts: {
+    publicUrl: string;
+    jwt: string;
+    fetchImpl?: typeof fetch;
+}): InstallationTokenFetcher;
+//# sourceMappingURL=installation-token.d.ts.map

package/dist/git-auth/installation-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-token.d.ts","sourceRoot":"","sources":["../../src/git-auth/installation-token.ts"],"names":[],"mappings":"AAqCA,kFAAkF;AAClF,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wGAAwG;AACxG,MAAM,MAAM,wBAAwB,GAAG,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEtC;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAEf,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;CAUnD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAItF;AAKD,MAAM,WAAW,gCAAgC;IAC/C;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,wBAAwB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,QAAQ,CAAiD;gBAErD,IAAI,EAAE,gCAAgC;IAclD,mEAAmE;IACnE,WAAW,IAAI,MAAM,EAAE;IAIvB,yEAAyE;IACzE,OAAO,CAAC,KAAK;IAKb;;;;;;;OAOG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAWnB,IAAI;IASlB,mEAAmE;IACnE,QAAQ,IAAI;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE;CAO7E;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,wBAAwB,CA4C3B"}

package/dist/git-auth/installation-token.js

@@ -0,0 +1,192 @@
+/**
+ * NS-RUN-3: per-container GitHub App installation tokens.
+ *
+ * Headless/container runners have historically shared one long-lived GH_TOKEN
+ * PAT across every node in the fleet (see docs/acc/RUNNER_AUTOSCALE.md §2,
+ * `ACC_AUTOSCALE_RUNNER_ENV_JSON`) — a single credential whose blast radius is
+ * the whole fleet's repo access, that never expires until an operator rotates
+ * it by hand, and that cannot be scoped tighter than whatever repos the PAT
+ * itself carries.
+ *
+ * This module is the RUNNER-SIDE client for replacing that PAT with
+ * short-lived (~1h) GitHub App installation tokens, scoped to only the
+ * repo(s) a given container is configured to serve. The privileged half of
+ * the mint — signing a JWT with the GitHub App's private key and exchanging
+ * it for an installation access token — already exists server-side in
+ * `api/_lib/github-app.ts` (`getInstallationTokenForRepo`); this module never
+ * holds that private key, only the short-lived bearer it fetches over HTTPS
+ * using the runner's OWN control-plane JWT — the same "runner authenticates,
+ * server does the privileged work" shape `secrets/inject.ts`'s
+ * `{{secret:NAME}}` broker already uses for tool-call secrets.
+ *
+ * Scope enforcement is defense-in-depth on BOTH sides: the request always
+ * names the exact repos this runner serves (never "all installs"), and this
+ * client additionally REFUSES to use a minted token whose granted repos
+ * exceed what it asked for (`InstallationTokenScopeError`) — a
+ * misconfigured or compromised server response cannot hand this container a
+ * broader credential than it was provisioned for.
+ *
+ * Wiring note (tracked as a follow-up, out of this module's file scope): the
+ * HTTP endpoint this fetcher targets (`/api/runner/github-installation-token`)
+ * does not exist yet, and neither `packages/acc-runner/docker/entrypoint.sh`
+ * nor `api/scheduled/runner-autoscale.ts` have been pointed at this provider
+ * in place of a shared `GH_TOKEN`. This module is the tested client primitive
+ * that follow-up work wires in.
+ */
+import { maskGitCredentials } from "./probe.js";
+/**
+ * Thrown when a mint hands back a token scoped to repos beyond what the
+ * runner requested. This is the client-side half of "token scope limited to
+ * the repos the runner serves" (AC3): even a server that returns an
+ * over-broad grant cannot make this runner USE the excess scope, because the
+ * provider refuses the token outright rather than caching/serving it.
+ */
+export class InstallationTokenScopeError extends Error {
+    requested;
+    granted;
+    constructor(requested, granted) {
+        super(`installation token scope exceeds request: requested [${requested.join(", ")}], granted [${granted.join(", ")}]`);
+        this.name = "InstallationTokenScopeError";
+        this.requested = requested;
+        this.granted = granted;
+    }
+}
+function normaliseRepo(repo) {
+    return repo.trim().toLowerCase();
+}
+/**
+ * True when `granted` is a NON-EMPTY set and every entry is present in
+ * `requested` (case-insensitive).
+ *
+ * AC5: an empty grant is NOT treated as in-scope. A mint that hands back zero
+ * repos proves nothing about what it actually scoped the token to — vacuously
+ * satisfying a subset check would let a malformed or field-less response
+ * through as if it were a valid (if narrow) grant. Fail closed instead: no
+ * verifiable scope means the token is rejected, same as an over-broad one.
+ */
+export function isWithinRequestedScope(requested, granted) {
+    if (granted.length === 0)
+        return false;
+    const allowed = new Set(requested.map(normaliseRepo));
+    return granted.every((r) => allowed.has(normaliseRepo(r)));
+}
+/** Default refresh margin: mint a new token once the cached one is this close to expiry. Mirrors api/_lib/github-app.ts's server-side cache. */
+const DEFAULT_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+/**
+ * Runner-side cache/refresh for a single installation token, scoped to the
+ * repo(s) this container serves. In-memory only — like `EnvTokenProvider`
+ * (token-provider.ts), an ephemeral container must never write a credential
+ * to its writable layer.
+ */
+export class InstallationTokenProvider {
+    repos;
+    fetcher;
+    runnerId;
+    refreshMarginMs;
+    cached = null;
+    inflight = null;
+    constructor(opts) {
+        const repos = (opts.repos ?? []).map((r) => r.trim()).filter(Boolean);
+        if (repos.length === 0) {
+            throw new Error("InstallationTokenProvider requires at least one repo — a container must be " +
+                "scoped to the repo(s) it serves, never minted a token for every install");
+        }
+        this.repos = repos;
+        this.fetcher = opts.fetcher;
+        this.runnerId = opts.runnerId;
+        this.refreshMarginMs = Math.max(0, opts.refreshMarginMs ?? DEFAULT_REFRESH_MARGIN_MS);
+    }
+    /** Repos this provider is configured to serve (defensive copy). */
+    reposServed() {
+        return [...this.repos];
+    }
+    /** True when the cached token is still fresh past the refresh margin. */
+    fresh() {
+        if (!this.cached)
+            return false;
+        return new Date(this.cached.expiresAt).getTime() - Date.now() > this.refreshMarginMs;
+    }
+    /**
+     * Return a valid installation token, minting or refreshing as needed.
+     * Concurrent callers share one in-flight mint (mirrors the server-side
+     * single-flight in `api/_lib/github-app.ts`) so a burst of git operations
+     * at container boot doesn't fire N redundant mints. A rejected mint clears
+     * the in-flight slot so the NEXT call retries rather than replaying the
+     * same rejection forever.
+     */
+    async getToken() {
+        if (this.fresh())
+            return this.cached.token;
+        if (this.inflight)
+            return (await this.inflight).token;
+        const mint = this.mint().finally(() => {
+            this.inflight = null;
+        });
+        this.inflight = mint;
+        return (await mint).token;
+    }
+    async mint() {
+        const result = await this.fetcher(this.repos, this.runnerId);
+        if (!isWithinRequestedScope(this.repos, result.repos)) {
+            throw new InstallationTokenScopeError(this.repos, result.repos);
+        }
+        this.cached = result;
+        return result;
+    }
+    /** Diagnostics-safe snapshot — NEVER includes the token itself. */
+    snapshot() {
+        return {
+            hasToken: this.cached !== null,
+            expiresAt: this.cached?.expiresAt ?? null,
+            repos: this.repos,
+        };
+    }
+}
+/**
+ * Build an HTTP-backed `InstallationTokenFetcher` against the (not-yet-shipped)
+ * `/api/runner/github-installation-token` endpoint. Mirrors
+ * `secrets/inject.ts`'s `makeHttpSecretFetcher`: the runner authenticates
+ * with its own bearer JWT, the server does the privileged GitHub App
+ * JWT-sign + installation-token exchange (`api/_lib/github-app.ts`), and only
+ * the resulting short-lived, repo-scoped token crosses the wire back.
+ */
+export function makeHttpInstallationTokenFetcher(opts) {
+    const f = opts.fetchImpl ?? fetch;
+    const endpoint = `${opts.publicUrl.replace(/\/$/, "")}/api/runner/github-installation-token`;
+    return async (repos, runnerId) => {
+        const res = await f(endpoint, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${opts.jwt}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ repos, runner_id: runnerId }),
+        });
+        if (!res.ok) {
+            // Masked defensively: the endpoint contract is that the body never
+            // carries token material, but a broken/aliased endpoint could echo
+            // request state back — never trust an error body unmasked.
+            const text = await res.text().catch(() => "");
+            throw new Error(`github-installation-token HTTP ${res.status}: ${maskGitCredentials(text || res.statusText)}`);
+        }
+        const data = (await res.json());
+        if (typeof data.token !== "string" || typeof data.expires_at !== "string") {
+            throw new Error("github-installation-token response missing token/expires_at");
+        }
+        // AC5: a field-less or empty `repos` is rejected here, not silently
+        // trusted back to whatever we asked for — an over-broad or malformed
+        // server response must never be papered over by re-stating the request
+        // as if it were the grant. isWithinRequestedScope() in the caller
+        // additionally refuses an empty grant, so this is defense-in-depth: the
+        // fetcher itself never fabricates a scope the server didn't state.
+        if (!Array.isArray(data.repos) || data.repos.length === 0) {
+            throw new Error("github-installation-token response missing/empty repos (no fallback to the requested repos)");
+        }
+        const grantedRepos = data.repos.filter((r) => typeof r === "string");
+        if (grantedRepos.length !== data.repos.length) {
+            throw new Error("github-installation-token response repos contains a non-string entry");
+        }
+        return { token: data.token, expiresAt: data.expires_at, repos: grantedRepos };
+    };
+}
+//# sourceMappingURL=installation-token.js.map

package/dist/git-auth/installation-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-token.js","sourceRoot":"","sources":["../../src/git-auth/installation-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiBhD;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,SAAS,CAAW;IACpB,OAAO,CAAW;IAE3B,YAAY,SAAmB,EAAE,OAAiB;QAChD,KAAK,CACH,wDAAwD,SAAS,CAAC,IAAI,CACpE,IAAI,CACL,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAmB,EAAE,OAAiB;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,gJAAgJ;AAChJ,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBhD;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,CAAW;IAChB,OAAO,CAA2B;IAClC,QAAQ,CAAS;IACjB,eAAe,CAAS;IACjC,MAAM,GAAmC,IAAI,CAAC;IAC9C,QAAQ,GAA4C,IAAI,CAAC;IAEjE,YAAY,IAAsC;QAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAC;IACxF,CAAC;IAED,mEAAmE;IACnE,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;IACvF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,QAAQ;QACN,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAIhD;IACC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uCAAuC,CAAC;IAC7F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,mEAAmE;YACnE,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAClF,IAAI,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC"}

package/dist/local-repo/command.d.ts

@@ -0,0 +1,28 @@
+import { type LocalRepoProbe } from "./index.js";
+export interface AddLocalRepoOptions {
+    /** Override the repo name (defaults to the directory name). */
+    name?: string;
+    /** Attach the repo to this project slug as part of the registration. */
+    project?: string;
+    /** Test seam. */
+    out?: (line: string) => void;
+}
+/**
+ * Probe a candidate directory. Every question is answered from the filesystem or
+ * a single read-only `git` call, and a failing `git` is an answer ("no origin"),
+ * never an exception — planLocalRepoRegistration decides what is fatal.
+ */
+export declare function probeLocalRepo(rawPath: string, nameOverride?: string | null): LocalRepoProbe;
+export declare function addLocalRepoCommand(repoPath: string, opts?: AddLocalRepoOptions): Promise<void>;
+export interface ListLocalReposOptions {
+    json?: boolean;
+    out?: (line: string) => void;
+}
+/**
+ * What this machine believes it serves locally, and whether the server agrees.
+ * The two can disagree in both directions — a config entry whose grant was
+ * revoked, or a grant registered from another machine — and an operator
+ * debugging "why is my task not running" needs to see which side is missing.
+ */
+export declare function listLocalReposCommand(opts?: ListLocalReposOptions): Promise<void>;
+//# sourceMappingURL=command.d.ts.map

package/dist/local-repo/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/local-repo/command.ts"],"names":[],"mappings":"AAoCA,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAUD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CA0B5F;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAyDf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/local-repo/command.js

@@ -0,0 +1,178 @@
+/**
+ * LOCAL-REPO-CLI — `acc repo add-local <path>` and `acc repo list-local`.
+ *
+ * The plumbing around ./index.ts's pure rules: probe the directory, call
+ * acc.register_local_repo under the operator's OWN session, and write the
+ * resulting slug→path pair into this machine's config.json.
+ *
+ * WHY THE PERSON LANE AND NOT THE RUNNER LANE
+ * ----------------------------------------------------------------------------
+ * The runner session is an ACC-signed JWT that impersonates a machine's owner.
+ * It would authenticate fine, and using it would be wrong: the row being written
+ * is "THIS human grants THEMSELVES access to a repo on their disk", and the
+ * server refuses a null auth.uid() on that path for exactly that reason. So this
+ * command runs on the generalized device flow's person credential (`acc login`),
+ * the same one `acc chat` and `acc task list` use, and the machine identity is
+ * computed locally rather than taken from a session — a person may register a
+ * repo before they have ever enrolled this host as a runner.
+ *
+ * ORDER MATTERS: the server write happens FIRST, the local config write second.
+ * A local map entry pointing at a repo the server does not know is a silently
+ * dead directory reference; a server registration whose local path failed to
+ * save is a legible error the operator can fix by re-running (both writes are
+ * idempotent upserts).
+ */
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import chalk from "chalk";
+import { loadLocalReposFromConfigFile, userConfigFilePath, writeLocalRepoToConfigFile, } from "../config.js";
+import { machineIdentity } from "../login.js";
+import { userClient } from "../user-cli/client.js";
+import { isMigrationPending, localRepoDisplayName, planLocalRepoRegistration, } from "./index.js";
+/** `~/code/app` → `/Users/me/code/app`. Absolute paths pass through. */
+function expandHome(p) {
+    const trimmed = p.trim();
+    if (trimmed === "~")
+        return os.homedir();
+    if (trimmed.startsWith("~/"))
+        return path.resolve(os.homedir(), trimmed.slice(2));
+    return path.resolve(trimmed);
+}
+/**
+ * Probe a candidate directory. Every question is answered from the filesystem or
+ * a single read-only `git` call, and a failing `git` is an answer ("no origin"),
+ * never an exception — planLocalRepoRegistration decides what is fatal.
+ */
+export function probeLocalRepo(rawPath, nameOverride) {
+    const abs = expandHome(rawPath);
+    let isDirectory = false;
+    try {
+        isDirectory = fs.statSync(abs).isDirectory();
+    }
+    catch {
+        isDirectory = false;
+    }
+    // A `.git` FILE (not directory) is a worktree or submodule — still a git repo,
+    // so existsSync rather than an isDirectory check.
+    const isGitRepo = isDirectory && fs.existsSync(path.join(abs, ".git"));
+    let originUrl = null;
+    if (isGitRepo) {
+        try {
+            const out = execFileSync("git", ["-C", abs, "remote", "get-url", "origin"], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            });
+            originUrl = out.trim() || null;
+        }
+        catch {
+            originUrl = null;
+        }
+    }
+    return { path: abs, isDirectory, isGitRepo, originUrl, nameOverride: nameOverride ?? null };
+}
+export async function addLocalRepoCommand(repoPath, opts = {}) {
+    const out = opts.out ?? ((line) => console.log(line));
+    const plan = planLocalRepoRegistration(probeLocalRepo(repoPath, opts.name));
+    const machine = machineIdentity();
+    const sb = await userClient();
+    const { data, error } = await sb.rpc("register_local_repo", {
+        p_name: plan.name,
+        p_machine: machine,
+        p_project_slug: opts.project?.trim() || null,
+    });
+    if (error) {
+        if (isMigrationPending(error)) {
+            throw new Error("local repos are unavailable — migration 0318 has not been applied to this " +
+                "environment yet. Until it is, attach repos through the GitHub App path.");
+        }
+        throw new Error(`could not register ${plan.name}: ${error.message}`);
+    }
+    const result = data;
+    if (!result?.repo) {
+        throw new Error("register_local_repo returned no repo slug — nothing was recorded locally");
+    }
+    const written = writeLocalRepoToConfigFile(result.repo, plan.path);
+    out(chalk.green(`✓ registered ${result.repo}`));
+    out(`  path     ${plan.path}   ${chalk.dim("(this machine only)")}`);
+    out(`  machine  ${machine}`);
+    out(`  access   ${result.level} · source ${result.source} · you only`);
+    if (result.project_slug) {
+        out(`  project  ${result.project_slug}`);
+    }
+    out(chalk.dim(`  recorded in ${written.path}`));
+    for (const warning of plan.warnings) {
+        out(chalk.yellow(`  ! ${warning}`));
+    }
+    if (written.addedToServedRepos) {
+        out(chalk.yellow("  ! Added the slug to this machine's served-repo scope. Restart `acc watch` " +
+            "so it re-advertises its capabilities."));
+    }
+    out("");
+    out("Next: run `acc watch` on this machine to execute tasks for this repo.");
+    if (!result.project_slug) {
+        out(chalk.dim("It is now selectable in the project-create repo step, or attach it to an " +
+            "existing project with --project <slug>."));
+    }
+}
+/**
+ * What this machine believes it serves locally, and whether the server agrees.
+ * The two can disagree in both directions — a config entry whose grant was
+ * revoked, or a grant registered from another machine — and an operator
+ * debugging "why is my task not running" needs to see which side is missing.
+ */
+export async function listLocalReposCommand(opts = {}) {
+    const out = opts.out ?? ((line) => console.log(line));
+    const local = loadLocalReposFromConfigFile();
+    let granted = [];
+    let grantError = null;
+    try {
+        const sb = await userClient();
+        // RLS scopes acc.user_repo_access to auth.uid(), so no user predicate is
+        // needed — and none should be added: the caller's own rows are the answer.
+        const { data, error } = await sb
+            .from("user_repo_access")
+            .select("repo, level, source")
+            .eq("source", "cli");
+        if (error)
+            throw new Error(error.message);
+        granted = (data ?? [])
+            .map((r) => r.repo)
+            .filter((r) => typeof r === "string");
+    }
+    catch (err) {
+        // Offline / signed out is not a reason to refuse to print the local half.
+        grantError = err.message;
+    }
+    if (opts.json) {
+        out(JSON.stringify({
+            config_path: userConfigFilePath(),
+            local_repos: local,
+            granted_repos: granted,
+            grant_error: grantError,
+        }, null, 2));
+        return;
+    }
+    const slugs = [...new Set([...Object.keys(local), ...granted.map((r) => r.toLowerCase())])].sort();
+    if (slugs.length === 0) {
+        out("No local repos registered on this machine.");
+        out(chalk.dim("Add one with `acc repo add-local <path>`."));
+        return;
+    }
+    for (const slug of slugs) {
+        const dir = local[slug];
+        const isGranted = granted.some((r) => r.toLowerCase() === slug);
+        const state = !dir
+            ? chalk.yellow("registered on another machine — no local path here")
+            : !isGranted && !grantError
+                ? chalk.yellow("no server grant — re-run `acc repo add-local`")
+                : chalk.dim(dir);
+        out(`  ${localRepoDisplayName(slug).padEnd(24)} ${slug}`);
+        out(`  ${" ".repeat(24)} ${state}`);
+    }
+    if (grantError) {
+        out(chalk.yellow(`! could not read your server grants: ${grantError}`));
+    }
+}
+//# sourceMappingURL=command.js.map

package/dist/local-repo/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/local-repo/command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,GAG1B,MAAM,YAAY,CAAC;AAWpB,wEAAwE;AACxE,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,YAA4B;IAC1E,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,+EAA+E;IAC/E,kDAAkD;IAClD,MAAM,SAAS,GAAG,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAEvE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBAC1E,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC;YACH,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9D,MAAM,IAAI,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,EAAE;QAC1D,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI;KAC7C,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,IAAiD,CAAC;IACjE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACrE,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,cAAc,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,cAAc,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,GAAG,CACD,KAAK,CAAC,MAAM,CACV,8EAA8E;YAC5E,uCAAuC,CAC1C,CACF,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,uEAAuE,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,GAAG,CACD,KAAK,CAAC,GAAG,CACP,2EAA2E;YACzE,yCAAyC,CAC5C,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;IAE7C,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC9B,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE;aAC7B,IAAI,CAAC,kBAAkB,CAAC;aACxB,MAAM,CAAC,qBAAqB,CAAC;aAC7B,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwB,CAAC,IAAI,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,UAAU,GAAI,GAAa,CAAC,OAAO,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CACD,IAAI,CAAC,SAAS,CACZ;YACE,WAAW,EAAE,kBAAkB,EAAE;YACjC,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,UAAU;SACxB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,CAAC,GAAG;YAChB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,oDAAoD,CAAC;YACpE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,+CAA+C,CAAC;gBAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,wCAAwC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/local-repo/index.d.ts

@@ -0,0 +1,119 @@
+/**
+ * LOCAL-REPO-CLI — the decidable half of `acc repo add-local`.
+ *
+ * Everything here is pure: given a path on disk and a few probe results, decide
+ * what to register, what to refuse, and what to warn about. The plumbing that
+ * needs a keychain, a network and a filesystem lives in ./command.ts, the same
+ * split serve-scope uses — so every rule below is unit-testable without either.
+ *
+ * WHAT A "LOCAL REPO" IS, AND WHAT IT IS NOT
+ * ----------------------------------------------------------------------------
+ * It is a git working copy on THIS machine that ACC may run tasks in, attached
+ * to a project without the GitHub App being installed anywhere. That is the
+ * whole of it. In particular it is NOT:
+ *
+ *   * a mirror of a GitHub repo ACC will keep in sync — nothing here clones,
+ *     fetches or pushes on the server's behalf;
+ *   * a repo other people on the team can work. The grant the server records is
+ *     scoped to the registering user, and the path is known only to this
+ *     machine, so a teammate's runner has neither the right nor the directory;
+ *   * a way to skip a GitHub write grant on a repo that IS on GitHub. The
+ *     server derives the slug from the caller's user id into a reserved
+ *     `local.…` namespace precisely so this cannot be that.
+ *
+ * WHY THE PATH NEVER LEAVES THE MACHINE
+ * ----------------------------------------------------------------------------
+ * The server needs to know "machine M serves repo R" to route a task; it does
+ * not need to know that R is at /Users/priya/code/side-project. Sending the path
+ * would put a filesystem layout — usernames, project names, directory
+ * structure — into a shared database for no routing benefit, so the path stays
+ * in this machine's own config.json (`local-repos`) and the runner resolves it
+ * at task time. See docs/acc/LOCAL_REPO_CLI_SETUP.md.
+ */
+/** The reserved namespace the server mints local slugs into (acc.local_repo_slug). */
+export declare const LOCAL_REPO_PREFIX = "local.";
+/**
+ * Is this slug in the reserved local/CLI namespace? Mirrors
+ * acc.is_local_repo_slug (migration 0318) and src/lib/local-repo.ts. A GitHub
+ * owner segment can never contain a '.', so the two namespaces cannot collide.
+ */
+export declare function isLocalRepoSlug(repo: string | null | undefined): boolean;
+/**
+ * The human-facing name of a local repo — the part after the '/', without the
+ * per-user hash fragment that makes the slug unique. `local.9f2c1a/my-app` reads
+ * as "my-app (local)" in a list; the full slug is still what gets matched.
+ */
+export declare function localRepoDisplayName(repo: string): string;
+/**
+ * Slugify a repo NAME the way acc.local_repo_slug does server-side, so the CLI
+ * can predict (and preview) the slug it is about to be handed. Kept in sync
+ * deliberately — the server is authoritative and the CLI stores whatever comes
+ * back, so a drift here is a cosmetic preview bug, never a wrong write.
+ */
+export declare function sanitizeLocalRepoName(raw: string): string;
+/** What ./command.ts probed about the directory the operator pointed at. */
+export interface LocalRepoProbe {
+    /** The resolved absolute path. */
+    path: string;
+    /** Does the path exist and is it a directory? */
+    isDirectory: boolean;
+    /** Is it a git repository (a `.git` entry at the root)? */
+    isGitRepo: boolean;
+    /**
+     * `git remote get-url origin`, or null when there is no origin. Not a
+     * requirement — it only decides which warning the operator gets.
+     */
+    originUrl: string | null;
+    /** Explicit `--name`, when the operator overrode the directory name. */
+    nameOverride?: string | null;
+}
+export interface LocalRepoPlan {
+    /** The name to send; the server derives the slug from it. */
+    name: string;
+    /** The absolute path to record in config.json. */
+    path: string;
+    /** The slug the server is expected to mint, for the pre-flight preview. */
+    previewSlug: string;
+    /**
+     * Advisory notes to print before the write. A plan always registers — these
+     * are the things an operator would rather learn now than at task time.
+     */
+    warnings: string[];
+}
+/**
+ * Decide what to register for a probed directory, or throw with the reason it
+ * cannot be registered.
+ *
+ * Refusals are limited to the two facts that make registration meaningless: the
+ * path is not a directory, or it is not a git repository (the runner's whole
+ * task loop is `git` — branch, commit, diff — so a plain folder would fail at
+ * the first step rather than at a legible place).
+ *
+ * A missing `origin` is NOT a refusal. Running tasks in a local working copy is
+ * useful on its own; it is opening a PR at the end that needs a remote, and the
+ * warning says exactly that instead of pre-emptively blocking the register.
+ */
+export declare function planLocalRepoRegistration(probe: LocalRepoProbe): LocalRepoPlan;
+/** The shape acc.register_local_repo returns (migration 0318 §7). */
+export interface RegisterLocalRepoResult {
+    repo: string;
+    machine: string;
+    org_id: string;
+    assignment_id: string | null;
+    project_id: string | null;
+    project_slug: string | null;
+    level: string;
+    source: string;
+}
+/**
+ * Is this error the "migration 0318 has not been applied here yet" shape?
+ * HALT-before-apply means every environment has a window where this command
+ * ships and the RPC does not exist; "run psql" and "something is broken" have
+ * different remedies, so the command says which. Mirrors serve-scope's
+ * isMigrationPending.
+ */
+export declare function isMigrationPending(err: {
+    message?: string;
+    code?: string;
+} | null): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/local-repo/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/local-repo/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAKxE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,WAAW,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAuC9E;AAYD,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,OAAO,CAY3F"}