@vibe-commit/capture 0.1.0

package/dist/post.js

@@ -0,0 +1,384 @@
+/**
+ * The ingest request — the ONE place the credential's plaintext is used.
+ *
+ * `send()` still makes exactly one attempt and decides nothing; `deliver()`, at
+ * the bottom of this file, is `CR-018`'s application of the failure policy around
+ * it. The classification itself is data in `policy.ts` and the ledger is in
+ * `state.ts`, so what lives here is only the wiring between them and the wire.
+ *
+ * `X-Repo-Slug` is derived in `git.ts` (`CR-019d`) and arrives here already
+ * resolved. It is REQUIRED on the wire: the merged server 400s a request without
+ * it, deliberately, because a NULL `repository_id` is fail-closed-INVISIBLE
+ * rather than merely wrong (D57 §OV1).
+ *
+ * Wire shape retyped from the plan and from reading the closed-source server. No
+ * code is imported or copied from `vibecommit-mcp` (D60 §D1a): this package is
+ * MIT, and lifting closed code into it relicenses that code by accident.
+ *
+ * @provenance vibecommit-mcp src/conversation/ingest_session.ts — wire shape, retyped
+ */
+import { createHash } from "node:crypto";
+import { agentForTranscript } from "./agents/registry.js";
+import { UNKNOWN_AGENT_ID } from "./agents/types.js";
+import { classify, markDelivered, markHeld, markSkipped, nextSpan, resolveCaps, } from "./policy.js";
+import { fileState, isStopped, loadSessionState, saveSessionState, withFileState, } from "./state.js";
+import { dropRewrites, dropSpooled } from "./spool.js";
+import { CLIENT_VERSION, CLIENT_VERSION_HEADER } from "./version.js";
+/** Production data plane. Overridable for tests and for a self-hosted server. */
+export const DEFAULT_INGEST_URL = "https://api.vibecommit.ai/ingest/v1/session";
+/**
+ * Loopback hosts, the only place a plaintext ingest URL is tolerated.
+ * The contract test needs `http://127.0.0.1:<port>`; nothing else does.
+ */
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+/**
+ * `/cso` finding 2 (2026-08-09), MEDIUM. The override used to be passed to
+ * `fetch` unexamined, so `http://` put `Authorization: Bearer vcik_…` on the
+ * wire in cleartext — and the ingest credential is long-lived with no rotation
+ * by design, so one interception is a durable compromise rather than a
+ * 15-minute one.
+ */
+export function isAllowedIngestUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === "https:")
+        return true;
+    return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+}
+/** The ingest URL, or null when the override is one we refuse to send to. */
+export function ingestUrl(env) {
+    const override = env.VIBECOMMIT_INGEST_URL;
+    if (override === undefined || override.trim() === "")
+        return DEFAULT_INGEST_URL;
+    const candidate = override.trim();
+    return isAllowedIngestUrl(candidate) ? candidate : null;
+}
+/**
+ * Build the request headers.
+ *
+ * `expose()` is called here and in no other module. That is the point of the
+ * opaque wrapper: the single call site is greppable, reviewable, and sits at the
+ * boundary where the secret has to be plaintext anyway.
+ *
+ * ## ⛔ SHAs ON THE WIRE, NEVER COMMIT METADATA (`CR-170` §4)
+ *
+ * No message, no author, no dates. MEASURED over the last 20 commits per repo:
+ * **9/20 schema, 8/20 web and 5/20 capture exceed 4096 bytes, largest 12,112** —
+ * so a quarter of real commits would land PERMANENTLY TRUNCATED in a header, and
+ * `capture_commits` rows cannot be retracted. Metadata is backfillable from a
+ * sha by anyone holding the repository; the observation that a commit happened
+ * at all is not. So the wire carries the irreplaceable half.
+ */
+export function buildIngestHeaders(credential, delta) {
+    const headers = {
+        authorization: `Bearer ${credential.expose()}`,
+        "content-type": "application/x-ndjson",
+        "content-encoding": "zstd",
+        "x-session-id": delta.sessionId,
+        "x-seq": String(delta.seq),
+        "x-byte-offset": String(delta.byteOffset),
+        "x-file": delta.fileKey,
+        "x-repo-slug": delta.repoSlug,
+        [CLIENT_VERSION_HEADER.toLowerCase()]: CLIENT_VERSION,
+    };
+    // ⛔ OMITTED ON `unknown`, AND THE OMISSION IS THE POINT — not a tidier way of
+    // saying the same thing.
+    //
+    // The server keeps ABSENT and `unknown` apart deliberately, and its own
+    // comment says the header's parsed type is nullable *because* of this guard:
+    // an absent header leaves a stream's pinned agent alone, while a PRESENT
+    // header resolves and is compared — and `unknown` resolves to `unknown`, which
+    // disagrees with any non-`unknown` pin. That disagreement is not a rejection;
+    // it drops the stream's buffered `tail_records` and re-pins, which SHEDS THE
+    // IN-FLIGHT TURN (D164 §4's mismatch-as-rewind).
+    //
+    // ⛔ So sending `unknown` would manufacture exactly the disagreement the
+    // nullable type exists to prevent. A stream that resolves cleanly on delta 1
+    // and becomes ambiguous later — a second root appearing, an env var set in one
+    // shell and not the next, a symlink flipped — would shed a turn on every flip.
+    // Omitting cannot: it says nothing, and nothing cannot disagree.
+    //
+    // ⚠ **NOT "silently", and the correction is worth its line**: the server
+    // ECHOES `agent_rewind` in the ingest 200 body (D169 §1), so the RE-PIN is
+    // reported. What is NOT reported is the shed itself. ⚠ And nothing on this
+    // side reads either — `send()` parses a body only on a non-2xx. So the case
+    // against sending rests on the turn being LOST, not on the loss being
+    // invisible; a designed, reported rewind (D164 §4) is survivable, and this
+    // client would simply be causing them for no gain.
+    //
+    // ⚠ On a genuinely ambiguous FIRST delta the two are indistinguishable — the
+    // bind writes `unknown` either way. There is no case where sending wins, and
+    // one class where it loses, so the header is conditional.
+    //
+    // This is also this function's existing idiom, four lines below: OMITTED,
+    // never sent empty; an absent header is unambiguously "nothing to say".
+    if (delta.agent !== UNKNOWN_AGENT_ID)
+        headers["x-agent"] = delta.agent;
+    // ⚠ OMITTED, never sent empty. A blank header is a value the server has to
+    // have an opinion about; an absent one is unambiguously "nothing to say", and
+    // an empty repository genuinely has nothing to say here.
+    if (delta.head != null) {
+        headers["x-head-sha"] = delta.head.sha;
+        if (delta.head.branch !== null)
+            headers["x-head-branch"] = delta.head.branch;
+    }
+    // ⛔⛔ THE WIRE CONTRACT, AND EVERY WAY OF GETTING IT WRONG IS SILENT IN BOTH
+    // DIRECTIONS (`D190`). Three header names and two separators, agreed between
+    // two repositories with NO COMPILER, NO SCHEMA AND NO SHARED TYPE spanning the
+    // seam. Name it `x-commit-attribution` (singular), join with `;`, or emit the
+    // pairs as `ancestor,successor`, and you get a green client suite, a green
+    // server suite, a 200 response, and ZERO EDGES FOREVER. Nothing goes red
+    // anywhere. `test/wire-attribution.test.ts` types these literals a second time
+    // rather than importing them, because a cell that round-trips this code's own
+    // constant proves only that it equals itself.
+    //
+    // ⛔ THE TWO LISTS ARE SENT TOGETHER OR NOT AT ALL, AND THEY ARE THE SAME
+    // LENGTH. `parseObservedCommits` returns `[]` — the ENTIRE BATCH, not the odd
+    // entry — when `rungs.length !== shas.length`. `capSpool` builds them in one
+    // loop so they cannot disagree; this line refuses to send them if they somehow
+    // do, because a batch dropped server-side is invisible and a batch not sent is
+    // retried by the next hook.
+    //
+    // ⚠ NO RUNG, NO EDGE (`D190 §2`) is why the guard is a REFUSAL rather than a
+    // fallback to `x-commits` alone: the server treats a commit with no attribution
+    // as a PRE-LADDER client's mtime guess and writes nothing, so sending the shas
+    // bare would be a slower road to the same zero, with a spool truncated on the
+    // 2xx as though it had worked.
+    const observed = delta.commits;
+    if (observed !== undefined && observed.shas.length > 0) {
+        if (observed.shas.length === observed.attributions.length) {
+            headers["x-commits"] = observed.shas.join(",");
+            headers["x-commit-attributions"] = observed.attributions.join(",");
+        }
+    }
+    // ⚠ Same idiom as every other conditional header here: OMITTED, never sent
+    // empty. `parseRewritePairs` drops silently on a wrong separator, a third
+    // colon-field, a bad sha or a self-pair, so the spelling is fixed by
+    // `capSuccessors` and asserted literally by the wire cell.
+    if (delta.rewrites !== undefined && delta.rewrites.length > 0) {
+        headers["x-rewrites"] = delta.rewrites.join(",");
+    }
+    return headers;
+}
+/**
+ * The wire's error code for org-approval-pending — `CR-128`, D81.
+ *
+ * ⚠ A CROSS-REPO CONTRACT, not a local string. The server emits it as
+ * `403 { error: "capture_not_approved", owners_notified }` and pins the body
+ * shape in its own suite. **`repository_forbidden` is ALSO a 403** and carries
+ * no `owners_notified` at all — deliberately, because it is a different
+ * condition where no owner was or could have been notified. That is why every
+ * consumer here branches on THIS CODE and never on the status.
+ */
+export const CAPTURE_NOT_APPROVED = "capture_not_approved";
+/**
+ * An error body is a handful of bytes by contract. Anything larger is not one
+ * this client parses — a cap so a misconfigured or hostile endpoint cannot make
+ * a hook buffer an arbitrary response into memory.
+ */
+const MAX_ERROR_BODY_BYTES = 64 * 1024;
+/**
+ * Parse an error body, or return null. **NEVER THROWS, on any input.**
+ *
+ * That is a hard requirement rather than defensive habit: `deliver()` is the
+ * HOOK's path, `post.ts` states that an exception there is the contract
+ * breaking, and `JSON.parse` on a response body is an exception waiting for a
+ * bad day. Every failure — a non-JSON body, an empty body, an array, a body
+ * whose `error` is not a string — resolves to `null`, and `null` sends the
+ * caller to the branch that asserts nothing. That is the honest default,
+ * because `null` already means *not determinable*.
+ *
+ * ⚠ Read ONLY on a non-2xx. A 2xx body is not read, not awaited, and not
+ * parsed, so the hook's hot path is untouched.
+ */
+async function readErrorDetail(res) {
+    if (res.ok)
+        return null;
+    // The declared length, when there is one. The abort signal already bounds the
+    // read in TIME; this bounds it in BYTES for a fast, huge response.
+    const declared = Number(res.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_ERROR_BODY_BYTES)
+        return null;
+    let body;
+    try {
+        const text = await res.text();
+        if (text.length > MAX_ERROR_BODY_BYTES)
+            return null;
+        body = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return null;
+    const { error, owners_notified: owners } = body;
+    if (typeof error !== "string" || error === "")
+        return null;
+    // The key is absent (`undefined`) on bodies that do not carry it, `null` when
+    // it is present and not determinable. Both are preserved; neither is coerced
+    // into a number, because a count invented here is a claim invented here.
+    const ownersNotified = owners === null ? null : typeof owners === "number" && Number.isFinite(owners) ? owners : undefined;
+    return { code: error, ownersNotified };
+}
+/**
+ * One attempt. No retry, no backoff, no classification — `CR-018` owns all three.
+ *
+ * The timeout is mandatory rather than optional: a hook has a wall-clock budget
+ * it must not exceed (DESIGN.md §13.7), and `fetch` without a signal waits on the
+ * platform default, which is far longer than any hook timeout.
+ *
+ * Never throws. A hook that takes an exception from the network has already
+ * broken the contract; returning `unreachable` keeps the decision with the
+ * caller.
+ */
+export async function send(url, headers, body, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            method: "POST",
+            headers,
+            body,
+            signal: controller.signal,
+            // `/cso` finding 2. undici strips Authorization on a cross-origin
+            // redirect, so following one is not a live hole — but a POST carrying a
+            // bearer token has no business chasing a hop the operator did not
+            // configure, and an ingest endpoint has no reason to issue one.
+            redirect: "error",
+        });
+        // The body read happens INSIDE the try and BEFORE the timer is cleared, so
+        // the same `AbortController` that bounds the request also bounds the read.
+        // A slow body cannot outlive the hook's wall-clock budget.
+        return { kind: "response", status: res.status, detail: await readErrorDetail(res) };
+    }
+    catch {
+        return { kind: "unreachable" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ---------------------------------------------------------------------------
+// CR-018 — one attempt, classified, with the matching action applied.
+// ---------------------------------------------------------------------------
+/**
+ * A one-way digest of the credential, for the `fatal` stop's key.
+ *
+ * The second and last call to `expose()` in the package, kept in this module for
+ * the same reason as the first: the plaintext's exits are greppable in one file.
+ * What is stored is 16 hex characters of a SHA-256 over a high-entropy opaque
+ * token — enough to tell one credential from another, and not a preimage of
+ * anything. No copy path and no header ever carries it.
+ */
+export function credentialFingerprint(credential) {
+    return createHash("sha256").update(credential.expose()).digest("hex").slice(0, 16);
+}
+/**
+ * Send the undelivered span of one transcript file and apply the failure policy.
+ *
+ * **Exactly one attempt, ever.** `later` does not retry here; it leaves the
+ * offset where it is so the hook that fires on the NEXT turn picks the same
+ * bytes up. A loop in this function would reopen D56 plan §D8, the founder
+ * override that says a hook must never block or slow a developer's turn.
+ *
+ * Never throws: the caller is a hook, and an exception on this path is the
+ * contract breaking. Every failure resolves to a `Delivery`.
+ *
+ * `readBody` is supplied by the caller rather than read here, because the caller
+ * is the one that has confined `transcript_path` to the Claude Code root
+ * (`/cso` finding 1). This module never opens a file.
+ */
+export async function deliver(ctx, eof, readBody) {
+    // `CR-017d`. The consent gate already refuses a `cwd` outside a work tree, so
+    // the hook cannot reach this — but the ledger's isolation must not rest on a
+    // check in another module, the same discipline `consent.ts` states about its
+    // own error paths. No repo, no send: a delta whose progress cannot be recorded
+    // against a repo is one whose progress would be recorded against all of them.
+    const key = { repoKey: ctx.repoKey, sessionId: ctx.sessionId };
+    if (key.repoKey === "")
+        return { kind: "no-repo" };
+    const session = loadSessionState(ctx.home, key);
+    if (isStopped(session, credentialFingerprint(ctx.credential)))
+        return { kind: "stopped" };
+    const current = fileState(session, ctx.fileKey);
+    const span = nextSpan(current, eof);
+    if (span === null)
+        return { kind: "nothing-to-send" };
+    const body = readBody(span.from, span.to);
+    if (body === null)
+        return { kind: "nothing-to-send" };
+    // `seq` is claimed BEFORE the attempt and persisted regardless of outcome, so
+    // it is monotonic per session across retries. A seq reused after a failure
+    // would read server-side as a replay of a delta that is not the same bytes.
+    const seq = session.seq + 1;
+    const outcome = await send(ctx.url, buildIngestHeaders(ctx.credential, {
+        sessionId: ctx.sessionId,
+        seq,
+        byteOffset: span.from,
+        fileKey: ctx.fileKey,
+        repoSlug: ctx.repoSlug,
+        // ⛔ THE ONE PLACE THE WIRE AGENT IS DECIDED — from the containing
+        // registry root, never from the flag (D177 §7). Per delivery rather than
+        // per hook: a delegated stream is a file in its own right, and the root
+        // that contains it is what names its producer.
+        agent: agentForTranscript(ctx.home, ctx.env, ctx.transcriptPath),
+        head: ctx.head,
+        commits: ctx.commits,
+        rewrites: ctx.rewrites,
+    }), body, ctx.timeoutMs);
+    const disposition = classify(outcome);
+    const caps = resolveCaps(ctx.env);
+    let next = { ...session, seq };
+    switch (disposition) {
+        case "ok":
+            next = withFileState(next, ctx.fileKey, markDelivered(current, span.to, ctx.nowMs));
+            // ⛔ TRUNCATE HERE AND NOWHERE ELSE. The spool is append-then-drop-on-2xx,
+            // so a commit survives a 500, a timeout and a `later` and is retried by
+            // the next hook. Dropping on READ would lose it permanently to one bad
+            // response, and `capture_commits` rows can never be retracted (D105/D108).
+            //
+            // ⛔ `count`, NEVER `shas.length`. `dropSpooled` drops the FIRST N LINES,
+            // and a HELD line is consumed without being sent — so truncating by the
+            // number of shas on the wire would delete the held line at the head and
+            // leave the delivered commit to be re-sent on every hook, forever.
+            if (ctx.commits !== undefined && ctx.commits.count > 0) {
+                dropSpooled(ctx.home, key, ctx.commits.count);
+            }
+            // The rewrite spool is its own file with its own cap, so its own drop.
+            if (ctx.rewrites !== undefined && ctx.rewrites.length > 0) {
+                dropRewrites(ctx.home, key, ctx.rewrites.length);
+            }
+            break;
+        case "later":
+            next = withFileState(next, ctx.fileKey, markHeld(current, span, ctx.nowMs, caps));
+            break;
+        case "never":
+            next = withFileState(next, ctx.fileKey, markSkipped(current, span.from, span.to));
+            break;
+        case "fatal":
+            // Credential-level, not payload-level: the offset does NOT advance, because
+            // these bytes are fine and a reconnected user should still get them.
+            next = {
+                ...withFileState(next, ctx.fileKey, markHeld(current, span, ctx.nowMs, caps)),
+                stop: {
+                    at: new Date(ctx.nowMs).toISOString(),
+                    fingerprint: credentialFingerprint(ctx.credential),
+                },
+            };
+            break;
+    }
+    saveSessionState(ctx.home, key, next);
+    // `outcome.detail` is null on every path except a non-2xx with a parseable
+    // error body, so this is a pass-through and not a second decision.
+    return {
+        kind: "attempted",
+        disposition,
+        detail: outcome.kind === "response" ? outcome.detail : null,
+    };
+}
+//# sourceMappingURL=post.js.map

package/dist/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../src/post.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAwB,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EACL,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,GAEd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErE,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAEhF;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,GAAsB;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,kBAAkB,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAoFD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA4B,EAC5B,KAAkB;IAElB,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,EAAE;QAC9C,cAAc,EAAE,sBAAsB;QACtC,kBAAkB,EAAE,MAAM;QAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAC1B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,EAAE,cAAc;KACtD,CAAC;IACF,8EAA8E;IAC9E,yBAAyB;IACzB,EAAE;IACF,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,iEAAiE;IACjE,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,mDAAmD;IACnD,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,KAAK,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/E,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,+EAA+E;IAC/E,8EAA8E;IAC9E,8CAA8C;IAC9C,EAAE;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,4BAA4B;IAC5B,EAAE;IACF,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YAC1D,OAAO,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,CAAC,uBAAuB,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,2DAA2D;IAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAwC3D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAAC,GAAa;IAC1C,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACxB,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAE9E,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,oBAAoB;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElF,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,IAG1C,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE3D,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,cAAc,GAClB,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAW,EACX,OAA+B,EAC/B,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,kEAAkE;YAClE,wEAAwE;YACxE,kEAAkE;YAClE,gEAAgE;YAChE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA4B;IAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AA6ED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAoB,EACpB,GAAW,EACX,QAAyD;IAEzD,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IAC/D,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAE1F,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAEtD,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,CAAC,GAAG,EACP,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG;QACH,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,+CAA+C;QAC/C,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC;QAChE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,EACF,IAAI,EACJ,GAAG,CAAC,SAAS,CACd,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,GAAiB,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC;IAE7C,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,IAAI;YACP,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACpF,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,2EAA2E;YAC3E,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACvD,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YACD,uEAAuE;YACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1D,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;YACD,MAAM;QACR,KAAK,OAAO;YACV,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YAClF,MAAM;QACR,KAAK,OAAO;YACV,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM;QACR,KAAK,OAAO;YACV,4EAA4E;YAC5E,qEAAqE;YACrE,IAAI,GAAG;gBACL,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC7E,IAAI,EAAE;oBACJ,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;oBACrC,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;iBACnD;aACF,CAAC;YACF,MAAM;IACV,CAAC;IAED,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,2EAA2E;IAC3E,mEAAmE;IACnE,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,WAAW;QACX,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACJ,CAAC"}

package/dist/project.d.ts

@@ -0,0 +1,99 @@
+/**
+ * What "this repository" means — ⛔ **TWO answers, and D184 splits them.**
+ *
+ * One value served four roles until `D184`. It still serves three of them; the
+ * fourth — **the consent key** — moves, and `resolveProjectKeys` is where the two
+ * surviving answers are produced together so a caller cannot take the wrong one
+ * by accident:
+ *
+ * ```
+ *  resolveProjectKeys(cwd) ──┬──> consent gate     = canonicalised git COMMON DIR   [MOVES]
+ *                            ├──> session bucket   = worktree TOPLEVEL   (D58/CR-017d)
+ *                            ├──> repoSlug input   = worktree TOPLEVEL
+ *                            └──> redaction root   = NOT FROM HERE. A SET, and the
+ *                                                    common dir is never in it (D184 §3).
+ * ```
+ *
+ * ⛔ **The redaction confinement root is NOT one of the values this module
+ * returns**, and that omission is the decision. `D184 §3`: if the confinement
+ * root follows the consent key to the common dir, every file of an external
+ * worktree is judged outside the main clone and `isInside` fail-closes each one
+ * into a redaction marker. Capture succeeds, turn counts look right, the content
+ * is gone. Widening it is `T2`'s work in `redact.ts`, against a root SET.
+ *
+ * ## ⛔ Why the consent key had to move at all
+ *
+ * Consent was keyed on `--show-toplevel`, which **differs per worktree**, with no
+ * wildcards and absence-means-no. So an agent session inside a `git worktree`
+ * captured **nothing** — no conversation, no commit, no notice — and `D19` makes
+ * worktree-per-builder the house convention. `M2`: `rev-parse --git-path hooks`
+ * in a linked worktree returns the MAIN clone's `.git/hooks`, so one install
+ * already covers every worktree. The common dir is the identity the install
+ * already had.
+ *
+ * ⚠ Deliberately NOT `src/git.ts`. `CR-019` owns that file (deriving the repo slug
+ * for `X-Repo-Slug`) and would collide. This module holds only what the consent
+ * gate needs; `CR-019` may fold it in when it lands.
+ */
+/**
+ * The git toplevel for `dir`, or null when it is not inside a work tree.
+ *
+ * ⚠ **The timeout DERIVES from the hook's remaining budget** (`TODOS[87]`).
+ * `execFileSync` blocks the event loop, so the watchdog cannot fire while this
+ * call is outstanding — a fixed 5s ceiling here is 5s the watchdog provably
+ * cannot cover, and it is one of four such ceilings that summed to 20s against a
+ * 5s budget. `null` means the budget is spent, and the answer is the one this
+ * function already gives when git cannot tell us: no toplevel, so no consent,
+ * so the hook does nothing. Silent by contract and correct by default.
+ *
+ * ⛔ **The answer is validated by CONTENT: `--show-toplevel` is absolute, always.**
+ * Without that gate a `git` on `PATH` that echoed a 40-hex string back would have
+ * it `resolve`d against `process.cwd()` and returned as a toplevel — accepted
+ * because it arrived where an answer was expected. Fail closed instead.
+ */
+export declare function gitToplevel(dir: string): string | null;
+/** The two keys `D184` splits apart. Never one value doing both jobs. */
+export interface ProjectKeys {
+    /**
+     * The worktree TOPLEVEL. ⛔ **UNCHANGED role** — the session-state bucket
+     * (`D58`/`CR-017d` keeps per-worktree isolation deliberately) and the
+     * `resolveRepoSlug` input.
+     */
+    readonly worktree: string;
+    /**
+     * The canonicalised git COMMON DIR. ⛔ **The consent key, and nothing else.**
+     * Shared by a main clone and every worktree linked to it, which is the whole
+     * point; never a redaction confinement root (`D184 §3`).
+     */
+    readonly consent: string;
+}
+/**
+ * Both keys for a directory, or **null** — ⛔ **fail closed, never a fallback.**
+ *
+ * If either spawn fails or either answer fails its content check, there is no
+ * partial answer: a guessed consent key grants capture on a repository the user
+ * never approved, and a guessed worktree key files a session under the wrong
+ * repository permanently.
+ *
+ * ⚠ **NO MIGRATION PATH FOR EXISTING `projects.json` ENTRIES, deliberately.**
+ * The allow list is keyed by string and the key changes shape, so a pre-existing
+ * grant at a toplevel stops matching. Pre-launch there are zero users and zero
+ * rows (`project_pre_launch_no_data`), so the migration is a no-op with nothing
+ * to migrate — writing one would be speculative code guarding a case that cannot
+ * occur. The observable cost if that assumption were ever wrong is one re-run of
+ * `vibecommit connect`, not a silent grant.
+ */
+export declare function resolveProjectKeys(dir: string): ProjectKeys | null;
+/**
+ * The worktree toplevel for a directory: the session bucket and slug input.
+ *
+ * ⛔ **NO LONGER THE CONSENT KEY — `D184` moved that to
+ * `resolveProjectKeys(dir).consent`.** The name is kept because the three roles
+ * it still serves are unchanged and every caller of it wants the toplevel; a
+ * rename would be churn across files this change has no other reason to touch.
+ *
+ * Falls back to NOTHING. A directory outside a work tree has no project identity,
+ * and inventing one from `cwd` would file a session under a key the user cannot
+ * see in `vibecommit status`.
+ */
+export declare function resolveProjectKey(dir: string): string | null;