@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/idempotency.js

@@ -0,0 +1,50 @@
+// Webhook idempotency — dedupes webhook-id values within the same TTL window
+// as the signature replay guard (300s). Closes the in-process idempotency gap
+// where a restart mid-run + a forge webhook retry double-runs the same work.
+// ponytail: in-process table, not a distributed store — fine for single-host
+//   deploy. Upgrade path: a shared Redis SETNX if HA lands.
+import { db } from "./db.js";
+const TTL_SEC = 300; // match the replay guard in webhook-signature.ts
+export function initIdempotencyTable() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS seen_webhook_ids (
+      webhook_id TEXT PRIMARY KEY,
+      seen_at    INTEGER NOT NULL
+    )
+  `);
+}
+// Returns true if this webhook-id was already processed within the TTL window.
+// Otherwise records the id and returns false.
+// Atomic: uses INSERT OR IGNORE then checks changes to avoid the read-then-write
+// race where two concurrent webhooks both pass the SELECT before either writes.
+export function isDuplicateWebhook(webhookId) {
+    const now = Math.floor(Date.now() / 1000);
+    // First, check if a fresh row exists (within TTL).
+    const row = db
+        .prepare("SELECT seen_at FROM seen_webhook_ids WHERE webhook_id = ?")
+        .get(webhookId);
+    if (row && now - row.seen_at < TTL_SEC)
+        return true;
+    // No fresh row — try to insert. INSERT OR IGNORE avoids the race: if another
+    // concurrent call inserted the same id between our SELECT and INSERT, this
+    // returns changes=0 and we treat it as a duplicate.
+    const r = db.prepare("INSERT OR IGNORE INTO seen_webhook_ids (webhook_id, seen_at) VALUES (?, ?)").run(webhookId, now);
+    if (r.changes === 0) {
+        // Row already exists (another concurrent call won the race). Check if it's
+        // fresh — if so, duplicate. If expired, refresh it.
+        const existing = db.prepare("SELECT seen_at FROM seen_webhook_ids WHERE webhook_id = ?").get(webhookId);
+        if (existing && now - existing.seen_at < TTL_SEC)
+            return true;
+        // Expired — refresh.
+        db.prepare("UPDATE seen_webhook_ids SET seen_at = ? WHERE webhook_id = ?").run(now, webhookId);
+        return false;
+    }
+    return false;
+}
+// Best-effort purge of expired rows. Called on startup so the table doesn't
+// grow unbounded across long uptimes.
+export function purgeExpiredWebhookIds() {
+    const cutoff = Math.floor(Date.now() / 1000) - TTL_SEC;
+    db.prepare("DELETE FROM seen_webhook_ids WHERE seen_at < ?").run(cutoff);
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,4DAA4D;AAC5D,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAE7B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,iDAAiD;AAEtE,MAAM,UAAU,oBAAoB;IAClC,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,8CAA8C;AAC9C,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,mDAAmD;IACnD,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,2DAA2D,CAAC;SACpE,GAAG,CAAC,SAAS,CAAoC,CAAC;IACrD,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,OAAO;QAAE,OAAO,IAAI,CAAC;IACpD,6EAA6E;IAC7E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvH,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACpB,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,SAAS,CAAoC,CAAC;QAC3I,IAAI,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9D,qBAAqB;QACrB,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,sCAAsC;AACtC,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACvD,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC"}

package/dist/lifecycle.js

@@ -0,0 +1,234 @@
+import { chmodSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { config } from "./config.js";
+import { log } from "./logger.js";
+import { closeDb } from "./db.js";
+import { migrate } from "./migrate.js";
+import { initDb } from "./token-store.js";
+import { initMcpTables, purgeExpiredMcpTokens } from "./mcp/auth.js";
+import { initMcpConfigTables } from "./mcp-config-store.js";
+import { initMcpAuthTables } from "./mcp-auth-store.js";
+import { initEnvVarsTables } from "./env-config-store.js";
+import { initProjectSettingsTables } from "./settings-store.js";
+import { initGlobalSettingsTables, hasUsableConfig } from "./global-settings-store.js";
+import { initCustomReposTables } from "./custom-repos-store.js";
+import { initQueueTables, resetOrphanedRunning, purgeStale, workItemsWithQueued, listPending, purgeAllPending, purgeCancelled } from "./queue-store.js";
+import { initRunHistoryTables } from "./run-history-store.js";
+import { purgeRunLogs } from "./run-log.js";
+import { initErrorLogTables, purgeErrorLogsOlderThan } from "./error-log-store.js";
+import { initIdempotencyTable, purgeExpiredWebhookIds } from "./idempotency.js";
+import { initVolumeTables } from "./volume-store.js";
+import { purgeInactiveVolumes, reconcileVolumes } from "./volume-gc.js";
+import { refreshManagedProjectPaths } from "./project-sync.js";
+import { initBaseBranchTable } from "./base-branch-store.js";
+import { initWorkItemBranchTable } from "./work-item-branch-store.js";
+import { initWorkItemAutoTable } from "./work-item-auto-store.js";
+import { initChangeRequestTable } from "./change-request-store.js";
+import { initAccessGrantTables } from "./access-grant-store.js";
+import { initAccessRuleTables } from "./access-rule-store.js";
+import { initOutboundWebhookTables, purgeDeliveriesOlderThan } from "./outbound-webhook-store.js";
+import { startWebhookWorker } from "./outbound-webhook.js";
+import { dispatch } from "./webhook.js";
+import { syncActiveFromDb } from "./global-queue.js";
+import { applyRuntimeSettings } from "./runtime-apply.js";
+import { runtime } from "./runtime-state.js";
+import { MCP_REFRESH_HORIZON_MS } from "./sweeps.js";
+import { refreshDueMcpAuth } from "./mcp/oauth-refresh.js";
+// ponytail: kill leaked devbot-wi-* containers on process exit. Containers
+//   are started with --rm, but if devbot dies mid-run the podman client dies
+//   while conmon keeps the container alive → orphans. Filter by name prefix,
+//   podman rm -f stops+removes in one call. Volumes preserved (WIP). Sync
+//   spawnSync because signal handlers can't await.
+function killDevbotContainers() {
+    try {
+        const prefix = config.INSTANCE_ID ? `${config.INSTANCE_ID}-devbot-wi-` : "devbot-wi-";
+        const list = spawnSync("podman", ["ps", "-a", "--filter", `name=${prefix}`, "--format", "{{.Names}}"], { encoding: "utf8" });
+        if (list.status !== 0)
+            return;
+        const names = list.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+        if (names.length === 0)
+            return;
+        spawnSync("podman", ["rm", "-f", ...names], { encoding: "utf8" });
+        log.info("cleanup killed devbot containers", { count: names.length, names });
+    }
+    catch {
+        // best-effort; never throw from a shutdown handler
+    }
+}
+let cleaningUp = false;
+function shutdown(sig) {
+    if (cleaningUp)
+        return;
+    cleaningUp = true;
+    log.info("shutting down", { sig });
+    killDevbotContainers();
+    closeDb();
+    process.exit(0);
+}
+// Called from server.ts after all routes are mounted. Handles DB init, startup
+// replay, chmod, signal handlers, and app.listen.
+export function bootstrap(app, mcpApp) {
+    // Migrations first — authoritative schema authority. Creates all tables via
+    // 0001 (baseline) and applies 0002 (queue status columns) if pending.
+    migrate();
+    // Belt-and-braces idempotent inits (harmless if migrate already created the
+    // tables; covers test DBs that skip migrate).
+    initDb();
+    initMcpTables();
+    initMcpConfigTables();
+    initMcpAuthTables();
+    initEnvVarsTables();
+    initProjectSettingsTables();
+    initGlobalSettingsTables();
+    initCustomReposTables();
+    initQueueTables();
+    initErrorLogTables();
+    initRunHistoryTables();
+    initIdempotencyTable();
+    initVolumeTables();
+    initBaseBranchTable();
+    initWorkItemBranchTable();
+    initWorkItemAutoTable();
+    initAccessGrantTables();
+    initAccessRuleTables();
+    initOutboundWebhookTables();
+    initChangeRequestTable();
+    purgeExpiredMcpTokens();
+    purgeExpiredWebhookIds();
+    // Publish the effective runtime settings (WebUI override -> env -> default)
+    // before anything reads them, and arm the periodic sweeps. The settings PUT
+    // re-runs both live.
+    applyRuntimeSettings();
+    if (!hasUsableConfig()) {
+        log.warn("bot not configured; mention runs will be blocked until global settings are set");
+    }
+    // MCP token refresh: when enabled, run one sweep at startup so a token that
+    //   expired (or is about to) while the bot was down is renewed without waiting
+    //   for the first interval. Gated on the runtime toggle — no sweep when off.
+    //   Best-effort and fire-and-forget.
+    if (runtime().mcpRefreshEnabled) {
+        void refreshDueMcpAuth(MCP_REFRESH_HORIZON_MS).catch((e) => log.warn("startup mcp token refresh failed", { err: e }));
+    }
+    // Volume GC: reconcile pre-existing podman volumes into the ledger (orphan
+    //   placeholders, silent purge), then run an immediate sweep. Both are
+    //   best-effort and fire-and-forget so a slow podman doesn't block listen.
+    //   The periodic sweep is armed by applyRuntimeSettings above.
+    void reconcileVolumes().catch((e) => log.warn("volume reconcile failed", { err: e }));
+    void purgeInactiveVolumes().catch((e) => log.warn("startup volume purge failed", { err: e }));
+    // Project-path reconciliation: heal stored project paths after a forge-side
+    // rename/transfer. Immediate fire-and-forget sweep, then a periodic one (the
+    // timer is armed by applyRuntimeSettings above). Best-effort — never blocks
+    // listen.
+    if (runtime().projectSyncEnabled) {
+        void refreshManagedProjectPaths().catch((e) => log.warn("project path sync failed", { err: e }));
+    }
+    // Startup replay: the table IS the queue now. Reset orphaned running rows
+    // (crash mid-run left them running) back to queued so they re-enter the FIFO.
+    // Re-derive the in-memory `active` counter from the DB. Then re-dispatch each
+    // orphaned row by calling dispatch() (which appends a fresh row + enqueues a
+    // worker). This preserves the old replay semantics: orphans get re-processed.
+    const orphaned = resetOrphanedRunning();
+    if (orphaned > 0) {
+        log.info("replaying orphaned running tasks from prior run", { count: orphaned });
+    }
+    // Drop tasks that were stopped but never replayed cleanly (crash between the
+    // stop and the runner unwinding). purgeCancelled runs after the orphan reset
+    // so a stopped running row (now 'queued' with the flag set) is deleted here,
+    // never replayed below.
+    const purgedCancelled = purgeCancelled();
+    if (purgedCancelled > 0) {
+        log.info("purged cancelled tasks not replayed", { count: purgedCancelled });
+    }
+    syncActiveFromDb();
+    // Re-dispatch: for each work item that has queued rows, call dispatch() with
+    // the row's payload. dispatch appends a fresh row + enqueues a worker. But
+    // the rows are already in the DB (they survived the crash). We don't need to
+    // re-append — we just need to spawn workers for them. The simplest way: list
+    // work items with queued rows and spawn workers by calling enqueue with a
+    // no-op handler... but that would double-enqueue. Instead, we use the
+    // listPending + dispatch path: read each queued row, delete it, and re-dispatch
+    // (which re-appends + enqueues). This matches the old purgeAllPending + replay.
+    // Actually, simpler: the rows are already queued. We just need to spawn
+    // workers. queue.ts doesn't export a "spawn worker" function, but dispatch()
+    // does appendPending + enqueue. So: read each queued row, delete it, call
+    // dispatch with its payload. This re-appends (new seq) + enqueues. Same as old.
+    if (orphaned > 0 || workItemsWithQueued().length > 0) {
+        const pending = listPending();
+        if (pending.length > 0) {
+            log.info("replaying queued tasks from prior run", { count: pending.length });
+            purgeAllPending();
+            for (const p of pending) {
+                try {
+                    const input = JSON.parse(p.payload);
+                    dispatch(input);
+                }
+                catch (e) {
+                    log.warn("pending task replay failed, dropping", { seq: p.seq, err: e instanceof Error ? e.message : String(e) });
+                }
+            }
+        }
+    }
+    // Housekeeping: purge stale rows older than 7 days so the table doesn't grow
+    // forever. Done rows are deleted on completion; this catches crash leftovers.
+    const purged = purgeStale(7 * 24 * 3600);
+    if (purged > 0)
+        log.debug("purged stale queue rows", { count: purged });
+    // Error-log retention: purge rows older than ERROR_LOG_RETENTION_DAYS at
+    // startup (0 disables purging). The daily sweep is armed by applyRuntimeSettings.
+    if (runtime().errorLogRetentionDays > 0) {
+        const purgedLogs = purgeErrorLogsOlderThan(runtime().errorLogRetentionDays);
+        if (purgedLogs > 0)
+            log.info("purged expired error logs", { count: purgedLogs, days: runtime().errorLogRetentionDays });
+    }
+    // Run-log file retention (work item #61): unlink files older than
+    // RUN_LOG_TTL_HOURS at startup; the history rows survive with log_file
+    // cleared. 0 = keep forever. The hourly sweep is armed by applyRuntimeSettings.
+    if (runtime().runLogTtlHours > 0) {
+        const purgedRunLogs = purgeRunLogs(runtime().runLogTtlHours);
+        if (purgedRunLogs > 0)
+            log.info("purged expired run logs", { count: purgedRunLogs, hours: runtime().runLogTtlHours });
+    }
+    // Outbound-webhook delivery retention: purge old delivery rows at startup
+    // (0 disables purging). The delivery worker is started below.
+    if (config.WEBHOOK_RETENTION_DAYS > 0) {
+        const purgedDeliveries = purgeDeliveriesOlderThan(config.WEBHOOK_RETENTION_DAYS);
+        if (purgedDeliveries > 0) {
+            log.info("purged expired outbound deliveries", { count: purgedDeliveries, days: config.WEBHOOK_RETENTION_DAYS });
+        }
+    }
+    // ponytail: tighten DB file perms to 0600 so signing tokens aren't
+    //   world-readable on shared hosts. Container single-user model already
+    //   covers this; belt-and-braces for bare metal.
+    try {
+        chmodSync("devbot.db", 0o600);
+    }
+    catch {
+        // file may not exist on first run before initDb creates it; ignore
+    }
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    app.listen(config.PORT, () => {
+        log.info("devbot listening", { port: config.PORT, dryRun: config.DRY_RUN });
+    });
+    mcpApp.listen(config.MCP_PORT, config.MCP_HOST, () => {
+        log.info("mcp listening", { port: config.MCP_PORT, host: config.MCP_HOST });
+    });
+    // Outbound-webhook delivery worker (+ crash recovery for rows left
+    // 'delivering'). Timer is .unref()'d like the sweeps above.
+    startWebhookWorker();
+    // Periodic outbound-delivery retention sweep (daily).
+    if (config.WEBHOOK_RETENTION_DAYS > 0) {
+        setInterval(() => {
+            try {
+                const n = purgeDeliveriesOlderThan(config.WEBHOOK_RETENTION_DAYS);
+                if (n > 0)
+                    log.info("outbound delivery sweep purged", { count: n, days: config.WEBHOOK_RETENTION_DAYS });
+            }
+            catch (e) {
+                log.warn("outbound delivery sweep failed", { err: e });
+            }
+        }, 24 * 60 * 60_000).unref();
+        log.info("outbound delivery retention scheduled", { days: config.WEBHOOK_RETENTION_DAYS });
+    }
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxJ,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAsB,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,mDAAmD;AACnD,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;QACtF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,MAAM,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7H,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC;AAED,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,oBAAoB,EAAE,CAAC;IACvB,OAAO,EAAE,CAAC;IACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,MAAuB;IACrE,4EAA4E;IAC5E,sEAAsE;IACtE,OAAO,EAAE,CAAC;IAEV,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,EAAE,CAAC;IACT,aAAa,EAAE,CAAC;IAChB,mBAAmB,EAAE,CAAC;IACtB,iBAAiB,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;IACpB,yBAAyB,EAAE,CAAC;IAC5B,wBAAwB,EAAE,CAAC;IAC3B,qBAAqB,EAAE,CAAC;IACxB,eAAe,EAAE,CAAC;IAClB,kBAAkB,EAAE,CAAC;IACrB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,CAAC;IACvB,gBAAgB,EAAE,CAAC;IACnB,mBAAmB,EAAE,CAAC;IACtB,uBAAuB,EAAE,CAAC;IAC1B,qBAAqB,EAAE,CAAC;IACxB,qBAAqB,EAAE,CAAC;IACxB,oBAAoB,EAAE,CAAC;IACvB,yBAAyB,EAAE,CAAC;IAC5B,sBAAsB,EAAE,CAAC;IACzB,qBAAqB,EAAE,CAAC;IACxB,sBAAsB,EAAE,CAAC;IAEzB,4EAA4E;IAC5E,4EAA4E;IAC5E,qBAAqB;IACrB,oBAAoB,EAAE,CAAC;IAEvB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC7F,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAChC,KAAK,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC;IACjI,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC;IAC/F,KAAK,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC;IAEvG,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,UAAU;IACV,IAAI,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjC,KAAK,0BAA0B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;IACzC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,gBAAgB,EAAE,CAAC;IAEnB,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,gFAAgF;IAChF,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,QAAQ,GAAG,CAAC,IAAI,mBAAmB,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,eAAe,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAkB,CAAC;oBACrD,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAExE,yEAAyE;IACzE,kFAAkF;IAClF,IAAI,OAAO,EAAE,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAC5E,IAAI,UAAU,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,gFAAgF;IAChF,IAAI,OAAO,EAAE,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,aAAa,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACjF,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,iDAAiD;IACjD,IAAI,CAAC;QACH,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnD,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,4DAA4D;IAC5D,kBAAkB,EAAE,CAAC;IAErB,sDAAsD;IACtD,IAAI,MAAM,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,GAAG,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBAClE,IAAI,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC;YAC3G,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/logger.js

@@ -0,0 +1,33 @@
+const RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+const MIN = RANK[process.env.LOG_LEVEL ?? "info"] ?? RANK.info;
+function ts() {
+    return new Date().toISOString();
+}
+// ponytail: JSON.stringify(new Error(...)) yields "{}" (no own enumerable
+//   props), which silently eats API failures logged via log.error("x", e).
+//   Surface message + stack so postNote/etc. failures are debuggable.
+function serialize(extra) {
+    if (typeof extra === "string")
+        return extra;
+    if (extra instanceof Error)
+        return JSON.stringify({ message: extra.message, stack: extra.stack });
+    return JSON.stringify(extra);
+}
+function emit(level, msg, extra) {
+    if (RANK[level] < MIN)
+        return;
+    const line = `[${ts()}] ${level.toUpperCase()} ${msg}`;
+    if (extra !== undefined) {
+        console[level === "debug" ? "log" : level](line, serialize(extra));
+    }
+    else {
+        console[level === "debug" ? "log" : level](line);
+    }
+}
+export const log = {
+    debug: (msg, extra) => emit("debug", msg, extra),
+    info: (msg, extra) => emit("info", msg, extra),
+    warn: (msg, extra) => emit("warn", msg, extra),
+    error: (msg, extra) => emit("error", msg, extra),
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA,MAAM,IAAI,GAA0B,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACjF,MAAM,GAAG,GAAG,IAAI,CAAE,OAAO,CAAC,GAAG,CAAC,SAAmB,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;AAE1E,SAAS,EAAE;IACT,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AACtE,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CAAC,KAAY,EAAE,GAAW,EAAE,KAAe;IACtD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,KAAK,EAAE,CAAC,GAAW,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;IAClE,IAAI,EAAE,CAAC,GAAW,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC;IAChE,IAAI,EAAE,CAAC,GAAW,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC;IAChE,KAAK,EAAE,CAAC,GAAW,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;CACnE,CAAC"}

package/dist/lsp-servers.js

@@ -0,0 +1,81 @@
+import { LSP_SERVER_META } from "./types/lsp-servers.js";
+// Pure id list shared by the settings schema, the browser UI, and the runner.
+// Keep this module free of node:fs/node:logger imports: the WebUI bundle pulls
+// it in through the provider-registry types. scripts/check-opencode-lsp.ts
+// proves this table matches the enabled ids declared in the shipped
+// opencode-config/opencode.json.
+export const LSP_SERVER_IDS = LSP_SERVER_META.map((server) => server.id);
+export const DEFAULT_LSP_SERVERS = [...LSP_SERVER_IDS];
+export function isLspServerId(id) {
+    return LSP_SERVER_IDS.includes(id);
+}
+export function splitLspServerList(raw) {
+    return raw
+        .split(",")
+        .map((id) => id.trim())
+        .filter(Boolean);
+}
+// The subtractive project list accepts commas and/or whitespace. Match known
+// ids greedily first so the space in "php intelephense" does not split it;
+// unknown tokens are still returned so validation can reject them.
+export function splitLspDisabledList(raw) {
+    const known = [...LSP_SERVER_IDS].sort((a, b) => b.length - a.length);
+    const out = [];
+    let rest = raw.trim();
+    while (rest) {
+        rest = rest.replace(/^[\s,]+/, "");
+        if (!rest)
+            break;
+        const match = known.find((id) => {
+            if (!rest.startsWith(id))
+                return false;
+            const next = rest[id.length];
+            return next === undefined || /[\s,]/.test(next);
+        });
+        if (match) {
+            out.push(match);
+            rest = rest.slice(match.length);
+            continue;
+        }
+        const token = /^[^\s,]+/.exec(rest);
+        if (!token) {
+            rest = rest.slice(1);
+            continue;
+        }
+        out.push(token[0]);
+        rest = rest.slice(token[0].length);
+    }
+    return out;
+}
+export function isLspDisabledListValid(raw) {
+    return splitLspDisabledList(raw).every(isLspServerId);
+}
+// Deduplicate and return the canonical shipped order.
+export function normalizeLspServers(ids) {
+    const selected = new Set(ids);
+    return LSP_SERVER_IDS.filter((id) => selected.has(id));
+}
+// Resolve the project override first, then the global list, then subtract the
+// project's disabled ids. Disabled ids that are not in the resolved list are a
+// no-op (the global default may change later).
+export function resolveLspServerList(projectList, globalList, disabled) {
+    const base = projectList
+        ? normalizeLspServers(splitLspServerList(projectList))
+        : normalizeLspServers(globalList);
+    const removed = new Set(splitLspDisabledList(disabled));
+    return base.filter((id) => !removed.has(id));
+}
+// A missing/blank blob means "use the default list". A JSON array is passed
+// through so the zod schema can reject unknown ids rather than silently
+// dropping an operator's typo.
+export function lspServersFromStoredJson(raw) {
+    if (typeof raw !== "string" || raw.trim() === "")
+        return [...DEFAULT_LSP_SERVERS];
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return [...DEFAULT_LSP_SERVERS];
+    }
+}
+//# sourceMappingURL=lsp-servers.js.map

package/dist/lsp-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-servers.js","sourceRoot":"","sources":["../src/lsp-servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,oEAAoE;AACpE,iCAAiC;AAEjC,MAAM,CAAC,MAAM,cAAc,GAAsB,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE5F,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,GAAG,cAAc,CAAC,CAAC;AAE1E,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;SACtB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,MAAM;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AACxD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,+CAA+C;AAC/C,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,UAA6B,EAC7B,QAAgB;IAEhB,MAAM,IAAI,GAAG,WAAW;QACtB,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,+BAA+B;AAC/B,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/mcp/auth.js

@@ -0,0 +1,62 @@
+import { randomBytes } from "node:crypto";
+import { db } from "../db.js";
+import { log } from "../logger.js";
+// Per-thread MCP bearer tokens. Separate table from project_tokens (which are
+// webhook HMAC signing keys — different lifecycle, different lookup key) but
+// same DB file (devbot.db) so one chmod 0600 covers both.
+//
+// Scope: each row carries the project_id + work_item_id the token is good for.
+// The MCP auth layer reads project_id from the row and injects it into the
+// tool-call context; tools never accept a project_id argument from the client.
+// This is the scope enforcement — a token minted for project A cannot read
+// project B's issues even if the forge bot token itself is global.
+export function initMcpTables() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS mcp_thread_tokens (
+      token        TEXT PRIMARY KEY,
+      project_id   INTEGER NOT NULL,
+      work_item_id INTEGER NOT NULL,
+      created_at   INTEGER NOT NULL,
+      exp_at       INTEGER NOT NULL
+    )
+  `);
+    // Belt-and-braces for test DBs that skip migrate(); migration 0017 is the
+    // authoritative source. 0 = "number unknown" (never a valid work-item number).
+    try {
+        db.exec("ALTER TABLE mcp_thread_tokens ADD COLUMN work_item_number INTEGER NOT NULL DEFAULT 0");
+    }
+    catch { /* exists */ }
+}
+export function mintMcpToken(input) {
+    const token = randomBytes(32).toString("hex");
+    const now = Date.now();
+    const expAt = now + input.ttlMs;
+    db.prepare(`INSERT OR REPLACE INTO mcp_thread_tokens
+       (token, project_id, work_item_id, work_item_number, created_at, exp_at)
+     VALUES (?, ?, ?, ?, ?, ?)`).run(token, input.projectId, input.workItemId, input.workItemNumber, Math.floor(now / 1000), Math.floor(expAt / 1000));
+    return { token, expAt };
+}
+export function verifyMcpToken(token) {
+    const row = db
+        .prepare("SELECT project_id, work_item_id, work_item_number, exp_at FROM mcp_thread_tokens WHERE token = ?")
+        .get(token);
+    if (!row)
+        return null;
+    if (row.exp_at * 1000 < Date.now())
+        return null;
+    return { projectId: row.project_id, workItemId: row.work_item_id, workItemNumber: row.work_item_number };
+}
+export function deleteMcpToken(token) {
+    db.prepare("DELETE FROM mcp_thread_tokens WHERE token = ?").run(token);
+}
+// Best-effort purge of expired rows. Called on devbot startup so the table
+// doesn't grow unbounded across restarts. ponytail: not a periodic sweep —
+// per-run delete in the runner's finally block covers the steady state; this
+// only catches tokens left behind by a crash mid-run.
+export function purgeExpiredMcpTokens() {
+    const now = Math.floor(Date.now() / 1000);
+    const r = db.prepare("DELETE FROM mcp_thread_tokens WHERE exp_at < ?").run(now);
+    if (r.changes > 0)
+        log.debug("mcp token purge", { expired: r.changes });
+}
+//# sourceMappingURL=auth.js.map

package/dist/mcp/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,8EAA8E;AAC9E,6EAA6E;AAC7E,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAEnE,MAAM,UAAU,aAAa;IAC3B,EAAE,CAAC,IAAI,CAAC;;;;;;;;GAQP,CAAC,CAAC;IACH,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AACjI,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC;IAChC,EAAE,CAAC,OAAO,CACR;;+BAE2B,CAC5B,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACxH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,kGAAkG,CAAC;SAC3G,GAAG,CAAC,KAAK,CAEC,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/mcp/effective-mcp.js

@@ -0,0 +1,42 @@
+import { listMcpServers, listGlobalMcpServers } from "../mcp-config-store.js";
+// The full effective picture (for the WebUI): every global server (including
+// ones shadowed by a project, flagged), then every project server. Runtime
+// precedence is applied by mergedMcpServers.
+export function effectiveMcpServers(projectId) {
+    const project = listMcpServers(projectId);
+    const projectNames = new Set(project.map((s) => s.name));
+    const out = [];
+    for (const s of listGlobalMcpServers()) {
+        out.push({
+            name: s.name,
+            config: s.config,
+            origin: "global",
+            overriddenByProject: projectNames.has(s.name),
+            overridesGlobal: false,
+            enabled: s.config.enabled !== false,
+        });
+    }
+    for (const s of project) {
+        out.push({
+            name: s.name,
+            config: s.config,
+            origin: "project",
+            overriddenByProject: false,
+            overridesGlobal: listGlobalMcpServers().some((g) => g.name === s.name),
+            enabled: s.config.enabled !== false,
+        });
+    }
+    return out;
+}
+// The name -> config map a run passes to buildOpencodeConfig. Global first then
+// project (project wins on a name collision). Disabled entries are kept (with
+// enabled:false) so the run config records the operator's intent, matching the
+// prior `[...global, ...project]` spread in prepareMcpRun.
+export function mergedMcpServers(projectId) {
+    const out = {};
+    const scoped = [...listGlobalMcpServers(), ...listMcpServers(projectId)];
+    for (const s of scoped)
+        out[s.name] = s.config;
+    return out;
+}
+//# sourceMappingURL=effective-mcp.js.map

package/dist/mcp/effective-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-mcp.js","sourceRoot":"","sources":["../../src/mcp/effective-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAwB,MAAM,wBAAwB,CAAC;AAuBpG,6EAA6E;AAC7E,2EAA2E;AAC3E,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,mBAAmB,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,eAAe,EAAE,KAAK;YACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK;SACpC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,SAAS;YACjB,mBAAmB,EAAE,KAAK;YAC1B,eAAe,EAAE,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;YACtE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK;SACpC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,GAAG,GAAoC,EAAE,CAAC;IAChD,MAAM,MAAM,GAAsB,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC"}