@vibe-commit/capture 0.7.0 → 0.9.0

package/dist/grants_verb.js

@@ -0,0 +1,121 @@
+/**
+ * What a CLI verb does with the account's grants (slice 2, S4): `status` and `off` sync at the start or the end, and read what
+ * the last sync recorded. `connect` (the picker's "on your account" group, the joining-machine prompt, `g`) comes in a later PR.
+ *
+ * ```
+ *   syncForVerb(ctx, …)      one bounded sync, silent on failure         (a verb's, never a hook's)
+ *   accountView(…)           the account rows' data, read from the files (no network)
+ * ```
+ *
+ * ## The first sync says what it saves, or it waits
+ *
+ * The first sync uploads what this machine already named — its owners and repos, and the slug of every per-clone consent
+ * made under 0.6.x/0.7.0 — to the user's account (R3-21). That is a disclosure the user must be able to read, so it runs
+ * only on a verb that can print it: a terminal, and not `--json`. Anywhere else it WAITS (nothing is sent, `pending` is
+ * untouched), and the next verb that can say so does it. The line names slugs, never paths.
+ *
+ * ## Nothing here is a hook
+ *
+ * Hooks never sync (`grants_sync.ts`). A verb reads the response with the 1 MiB cap a verb may use (`GRANTS_VERB_BODY_BYTES`).
+ */
+import { accountNotHere, ownerName } from "./account_not_here.js";
+import { normalizeSlug, readAccountState, readGrants, EMPTY_GRANTS } from "./consent.js";
+import { loadCredential } from "./credential.js";
+import { GRANTS_VERB_BODY_BYTES, planSync, syncGrants } from "./grants_sync.js";
+import { readPerClone } from "./machine_state.js";
+import { countPendingRevokes } from "./pending_revoke_file.js";
+import { ingestUrl } from "./post.js";
+import { STATUS } from "./copy/index.js";
+import { wrap } from "./term.js";
+import { writeLines } from "./commands/context.js";
+/** The slugs of every per-clone consent, normalized — what `planSync` calls `consentedSlugs`. */
+function consentedSlugs(home) {
+    const out = [];
+    for (const clone of readPerClone(home)) {
+        if (clone.slug === null)
+            continue;
+        const slug = normalizeSlug(clone.slug);
+        if (slug !== "" && !out.includes(slug))
+            out.push(slug);
+    }
+    return out;
+}
+/** `owner/` for an owner, the slug for a repo — the way every account row and the first-sync line name them (`account_not_here.ts`). */
+export { ownerName };
+/**
+ * One sync for a verb. `json` is true for `--json`, which can print no line and so never does a FIRST sync.
+ *
+ * Prints, to stdout, only the first-sync line (and its full list past three names) and a blank line after it. Never throws.
+ */
+export async function syncForVerb(ctx, json, deps, 
+/** A verb that syncs more than once (`connect`: at its start and after its writes) says what the first sync saves only once. */
+options = {}) {
+    try {
+        const load = loadCredential({ env: ctx.env, home: ctx.home });
+        if (load.kind !== "ok")
+            return { kind: "skipped" };
+        const url = ingestUrl(ctx.env);
+        if (url === null)
+            return { kind: "skipped" };
+        const read = readGrants(ctx.home);
+        if (read.kind === "unreadable")
+            return { kind: "skipped" };
+        const grants = read.kind === "ok" ? read.grants : EMPTY_GRANTS;
+        const consented = consentedSlugs(ctx.home);
+        const first = grants.synced_at === null;
+        let disclosed = false;
+        if (first) {
+            // ⛔ A first sync that cannot say what it is saving waits.
+            if (!ctx.stdinIsTty || json)
+                return { kind: "skipped" };
+            const plan = planSync(grants, consented, true);
+            const names = [
+                ...plan.named.owners.map(ownerName),
+                ...plan.named.repos,
+            ];
+            if (names.length > 0 && options.quietFirst !== true) {
+                const lines = [...wrap(STATUS.accountSaving(names.join("\n")), 2)];
+                if (names.length > 3)
+                    lines.push(...names.map((name) => `    ${name}`));
+                writeLines(ctx.stdout, [...lines, ""]);
+                disclosed = true;
+            }
+        }
+        const result = await syncGrants(url, load.credential, consented, {
+            fetch: deps.fetch,
+            home: ctx.home,
+            now: ctx.now,
+            timeoutMs: deps.timeoutMs,
+            maxBodyBytes: GRANTS_VERB_BODY_BYTES,
+        });
+        // One line per verb run, never one per op (VQ's ruling (ii)); the `pending` row is what the user sees.
+        if (result.kind === "rejected" && ctx.env.VIBECOMMIT_DEBUG !== undefined && ctx.env.VIBECOMMIT_DEBUG !== "") {
+            ctx.stderr.write(`grants sync rejected (400): ${result.pendingRejected} queued change(s) not accepted\n`);
+        }
+        return { kind: "ran", result, disclosed };
+    }
+    catch {
+        return { kind: "skipped" };
+    }
+}
+/**
+ * ⛔ "Not on this machine" is what THIS machine has not named: not in its owners, its repos, or a per-clone consent, and not
+ * turned off here or on the account. A repo under an owner the account grants is covered by that owner's row, not listed
+ * again. An owner or repo the user turned off is a choice, not a gap.
+ */
+export function accountView(grants, account, perCloneSlugs, sync, pendingRevokes = 0) {
+    const pendingRejected = sync.kind === "ran" && sync.result.kind === "rejected" ? sync.result.pendingRejected : 0;
+    // A revoke of a credential `g` dropped is a change not yet sent to the account like any queued op (R3-11).
+    const queued = grants.pending.length + pendingRevokes;
+    if (account === null)
+        return { account, notHere: [], pending: queued, pendingRejected };
+    return { account, notHere: accountNotHere(grants, account, perCloneSlugs), pending: queued, pendingRejected };
+}
+/** The account state and grants for a view, read fresh from disk. `null` when `grants.json` is unreadable. */
+export function readAccountView(home, perCloneSlugs, sync) {
+    const read = readGrants(home);
+    if (read.kind === "unreadable")
+        return null;
+    return accountView(read.kind === "ok" ? read.grants : EMPTY_GRANTS, readAccountState(home).account, perCloneSlugs, sync, countPendingRevokes(home));
+}
+//# sourceMappingURL=grants_verb.js.map

package/dist/grants_verb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants_verb.js","sourceRoot":"","sources":["../src/grants_verb.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAmC,MAAM,cAAc,CAAC;AAE1H,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAkBnD,iGAAiG;AACjG,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wIAAwI;AACxI,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAmB,EACnB,IAAa,EACb,IAAkB;AAClB,gIAAgI;AAChI,UAA6C,EAAE;IAE/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACvE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;QACxC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,0DAA0D;YAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG;gBACZ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;gBACnC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK;aACpB,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBACvC,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;YAC/D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,sBAAsB;SACrC,CAAC,CAAC;QACH,uGAAuG;QACvG,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;YAC5G,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,eAAe,kCAAkC,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,OAA6B,EAC7B,aAAgC,EAChC,IAAc,EACd,cAAc,GAAG,CAAC;IAElB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,2GAA2G;IAC3G,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAChH,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,aAAgC,EAAE,IAAc;IAC5F,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,WAAW,CAChB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,EAC/C,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAC9B,aAAa,EACb,IAAI,EACJ,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC;AACJ,CAAC"}

package/dist/hooks/entry.d.ts

@@ -36,9 +36,10 @@
 import { type IngestCredential } from "../credential.js";
 import { type Delivery, type FileKey } from "../post.js";
 import { type RecordCutter } from "../policy.js";
+import { type Isolation } from "../session_targets.js";
 import type { HookEventName } from "../agents/types.js";
 import { type SessionKey } from "../paths.js";
-import { type ProjectKeys } from "../project.js";
+export { confinementRoots } from "../project.js";
 import { turnStart, type TurnStart } from "../pending_bound.js";
 /**
  * Default wall-clock budget. `CR-028` sets the real per-event `timeout` in
@@ -268,6 +269,20 @@ export declare function deliverSubagents(opts: {
     sendBudget: number;
     /** ⛔ REQUIRED. A hook's deliveries stamp `liveAt`; `vibecommit finalize`'s must not (see `DeliveryContext.byHook`). */
     byHook: boolean;
+    /**
+     * A FOLDER target's per-stream ceiling: the offset the resolver SCANNED for each file key (A-T3, P1 (b)). A delegated stream
+     * delivers only up to it and a file key the scan never reached delivers nothing: bytes the resolver has not read for repo
+     * evidence are not sent under the folder's name. The returned `files` carry the CAPPED size, so `stampGaps` never writes off
+     * bytes this target was never allowed to send. Absent for a repo target: it sends to each file's end, as it always did.
+     */
+    sizeCap?: Readonly<Record<string, number>>;
+    /** A-T4: what the delegated streams may contain (R17 / R6). Default: a repo target's own `redactionRoots`. */
+    isolation?: Isolation;
+    /**
+     * C25: the caller's session-lock heartbeat (`finalize`, `backfill`). Called before each delegated file and before every request
+     * inside it; `false` means the lock is gone, and the loop stops with nothing more written. A hook passes none.
+     */
+    heartbeat?: () => boolean;
 }): Promise<DelegatedDeliveries>;
 /**
  * What `deliverSubagents` found, and whether any of its sends was HELD.
@@ -289,53 +304,6 @@ export interface DelegatedDeliveries {
 }
 /** Size in bytes, or null if it cannot be read. */
 export declare function fileSize(path: string): number | null;
-/**
- * ⛔ **The redaction confinement ROOT SET — `D184 §3`.**
- *
- * ```
- * isInsideAny([worktree, mainToplevel], candidate)
- * ```
- *
- * ## Why it is a set, and why the common dir is not in it
- *
- * `D184` moved the consent key to the git common dir so that a session inside a
- * `git worktree` is admitted at all. ⛔ **The confinement root MUST NOT follow
- * it there.** `isInside` realpaths both sides and fail-closes anything it cannot
- * place to *outside* — which here means REDACT — so a root at `<main>/.git`
- * would judge every file of an external worktree to be outside the main clone
- * and replace its `content`, `oldString`, `newString` and `structuredPatch` with
- * markers. **The capture still succeeds. The turn counts still look right. The
- * content is gone**, and a test asserting *"worktree sessions capture now"*
- * passes on an empty payload.
- *
- * Two roots, because both are genuinely the user's own tree: the worktree the
- * session is running in, and the main clone it was cut from — a builder in a
- * worktree reads the main clone's files constantly.
- *
- * ## ⛔ The `paths.ts:487-489` prohibition, answered — `D184 §5`
- *
- * > *"`roots` comes from the REGISTRY. It must never be derived from input."*
- *
- * **That prohibition is about PROVENANCE, and both members have the right one.**
- * The named hazard is *anything on hook stdin* — attacker-supplied. Neither of
- * these is: `keys` can only be produced by `resolveProjectKeys`, which is git's
- * own answer about the directory the session runs in; `mainToplevel` is git's
- * answer about the repository **the consent gate already approved**, and it is
- * content-validated by `mainWorkTree` above. The worktree root has exactly the
- * same provenance and has been used this way since `CR-024d`.
- *
- * ⚠ **Provenance is the whole argument, so this code preserves it:** nothing
- * here is read from stdin, the derivation is validated by content, and a failure
- * yields no second root rather than a fallback. An empty set would refuse
- * everything (`paths.ts:491-492`), which is the correct direction — but this
- * function cannot return one, because `keys.worktree` is always a member.
- *
- * ⚠ The dedup is cosmetic. `isInsideAny` over a repeated root is a union with
- * itself; it is dropped so that a main-clone session reads as the single root it
- * has always had, and so a cell asserting "no second root" is asserting
- * something.
- */
-export declare function confinementRoots(keys: ProjectKeys): readonly string[];
 /**
  * Read `[from, to)` of the transcript, REDACT it, and compress it.
  *
@@ -377,12 +345,25 @@ export declare function confinementRoots(keys: ProjectKeys): readonly string[];
  * set is the ordinary main-clone case and behaves exactly as the old parameter
  * did.
  *
+ * ## ⛔ `isolation` — what a TARGET's stream may contain beyond the path rule (any-folder capture)
+ *
+ * R6 · R17. A session that worked in N granted repos uploads N copies, so the chokepoint also knows WHOSE copy it is cutting.
+ * For a REPO target, a record whose `cwd` resolves inside a work tree other than the target's is withheld (length-preserving, the
+ * same markers): another repo's commands and output must not reach this repo's readers. For a FOLDER target, anything inside a
+ * git work tree nested in the folder is withheld (exclusion roots). Records run from the launch folder are kept in every copy;
+ * that residual (prompts and prose from the parent folder) is stated in the README and the claims register. Absent: the
+ * structured-path rule alone, exactly as before.
+ *
  * EXPORTED for `connect`'s test capture (`CR-025`), which reads a transcript on
  * a path the hook never takes. It reuses this rather than opening one itself,
  * because a second reader would bypass both the confinement and the redaction —
  * exactly what the chokepoint note above warns about.
  */
-export declare function readSpan(path: string, from: number, to: number, projectRoots: readonly string[], home: string, env: NodeJS.ProcessEnv): Uint8Array | null;
+export declare function readSpan(path: string, from: number, to: number, projectRoots: readonly string[], home: string, env: NodeJS.ProcessEnv, 
+/** A-T4: the target's isolation (R17 record isolation for a repo, R6 exclusion roots for a folder). Absent: structured-path redaction only. */
+isolation?: Isolation, 
+/** The stream this file is. Default: derived from the path (Claude's `subagents/agent-<id>.jsonl`); a Codex delegated file is announced, not found by directory, so its caller says. */
+streamKey?: string): Uint8Array | null;
 /**
  * PR 4a — where a transcript's records end, for `deliver()` to cut a delta on.
  *
@@ -400,4 +381,3 @@ export declare function recordCutter(path: string): RecordCutter;
  * when the session has no pending line — the usual case on every Stop — so the scan is skipped then. `scan` is a test seam.
  */
 export declare function promotionBound(home: string, key: SessionKey, transcriptPath: string, nowMs: number, scan?: typeof turnStart): TurnStart;
-export {};