@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/task-log.js

@@ -0,0 +1,279 @@
+import { log } from "./logger.js";
+import { podman } from "./podman.js";
+import { workItemContainerPrefix, phaseLabel } from "./git.js";
+import { redact } from "./redact.js";
+// Shared container-log helpers. `parseLogLines`/`formatLogBody` turn opencode's
+// NDJSON stdout (one event object per line, see types/opencode.ts) into readable
+// lines while passing non-JSON lines (init scripts, git, stderr) through
+// verbatim, prefixing each line with a server-local `HH:MM:SS` clock when one
+// can be derived. `fetchRunLogs` snapshots the running opencode container's logs
+// on demand via `podman logs --timestamps`; the container is short-lived and
+// `--rm`, so logs exist only while the run is in flight.
+const MAX_LOG_CHARS = 200_000;
+const TAIL_LINES = 500;
+// Per-field caps for verbose tool rendering. A single huge tool input/output
+// must not crowd every other event out under the whole-body cap. Applied to the
+// rendered string (after JSON pretty-compaction), independently per field.
+const MAX_TOOL_INPUT_CHARS = 1000;
+const MAX_TOOL_OUTPUT_CHARS = 1000;
+const MAX_UNKNOWN_PART_CHARS = 2000;
+function capField(s, max) {
+    return s.length > max ? s.slice(0, max) + "…[truncated]" : s;
+}
+function compactJson(value, max) {
+    let s;
+    if (typeof value === "string") {
+        s = value;
+    }
+    else {
+        try {
+            s = JSON.stringify(value);
+        }
+        catch {
+            s = String(value);
+        }
+        if (s === undefined)
+            s = "";
+    }
+    return capField(s, max);
+}
+// Indent every line of a multi-line block by `pad` spaces.
+function indentLines(s, pad) {
+    return s.split("\n").map((line) => pad + line).join("\n");
+}
+// podman `logs --timestamps` prefixes each line with an RFC3339 timestamp
+// (e.g. `2026-09-13T21:26:11.628901234Z `). Split it from the log body.
+const PODMAN_TS_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2}))\s+([\s\S]*)$/;
+function truncate(s, max) {
+    if (s.length <= max)
+        return { text: s, truncated: false };
+    return { text: s.slice(0, max) + "\n…[truncated]", truncated: true };
+}
+function pad2(n) {
+    return n < 10 ? `0${n}` : String(n);
+}
+// Parse an RFC3339/ISO timestamp to a server-local `HH:MM:SS` clock. Returns
+// null when the value isn't a valid date so the caller can skip the prefix.
+export function formatClock(iso) {
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime()))
+        return null;
+    return `${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`;
+}
+// Pull opencode's top-level event `timestamp` off a JSON line. Used as a
+// fallback when the line carries no podman timestamp (e.g. persisted error-log
+// bodies captured from container stdout, which has no podman prefix). Accepts
+// an ISO string or epoch-ms number; returns null when neither is present.
+function eventClock(trimmed) {
+    let ev;
+    try {
+        ev = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (typeof ev !== "object" || ev === null)
+        return null;
+    const ts = ev.timestamp;
+    if (typeof ts === "string")
+        return formatClock(ts);
+    if (typeof ts === "number" && Number.isFinite(ts))
+        return formatClock(new Date(ts).toISOString());
+    return null;
+}
+// Format one NDJSON line. Unknown/corrupt JSON or non-JSON is returned verbatim.
+function formatLine(trimmed) {
+    let ev;
+    try {
+        ev = JSON.parse(trimmed);
+    }
+    catch {
+        return trimmed;
+    }
+    if (typeof ev !== "object" || ev === null)
+        return trimmed;
+    const e = ev;
+    if (e.type === "error") {
+        const err = e.error;
+        const msg = err?.data?.message ?? err?.message;
+        return msg ? `[error] ${msg}` : "[error]";
+    }
+    const part = e.part;
+    if (!part || typeof part.type !== "string")
+        return trimmed;
+    const ptype = part.type;
+    switch (ptype) {
+        case "text":
+            return `[text] ${typeof part.text === "string" ? part.text : ""}`;
+        case "reasoning":
+            return `[reasoning] ${typeof part.text === "string" ? part.text : ""}`;
+        case "tool": {
+            const st = part.state;
+            const tool = typeof part.tool === "string" ? part.tool : "tool";
+            const title = typeof st?.title === "string" && st.title ? `: ${st.title}` : "";
+            const lines = [`[tool] ${tool}${st?.status ? ` ${st.status}` : ""}${title}`];
+            if (st?.input !== undefined) {
+                lines.push(`  input: ${compactJson(st.input, MAX_TOOL_INPUT_CHARS)}`);
+            }
+            if (st?.error) {
+                lines.push(`  error: ${capField(st.error, MAX_TOOL_OUTPUT_CHARS)}`);
+            }
+            else if (st?.output) {
+                const out = capField(st.output, MAX_TOOL_OUTPUT_CHARS);
+                lines.push("  output:");
+                lines.push(indentLines(out, "    "));
+            }
+            return lines.join("\n");
+        }
+        case "step-start":
+            return "[step] start";
+        case "step-finish": {
+            const reason = typeof part.reason === "string" ? ` (${part.reason})` : "";
+            const tokens = part.tokens;
+            const parts = [];
+            if (tokens && (tokens.input !== undefined || tokens.output !== undefined || tokens.reasoning !== undefined)) {
+                const t = [];
+                if (tokens.input !== undefined)
+                    t.push(`in=${tokens.input}`);
+                if (tokens.output !== undefined)
+                    t.push(`out=${tokens.output}`);
+                if (tokens.reasoning !== undefined)
+                    t.push(`reasoning=${tokens.reasoning}`);
+                parts.push(`tokens ${t.join(" ")}`);
+            }
+            if (typeof part.cost === "number")
+                parts.push(`cost=${part.cost}`);
+            return `[step] finish${reason}${parts.length ? ` ${parts.join(" ")}` : ""}`;
+        }
+        case "file": {
+            const mime = typeof part.mime === "string" ? ` (${part.mime})` : "";
+            const url = typeof part.url === "string" && part.url ? ` ${part.url}` : "";
+            return `[file] ${typeof part.filename === "string" ? part.filename : ""}${mime}${url}`;
+        }
+        case "subtask": {
+            const agent = typeof part.agent === "string" ? part.agent : "";
+            const desc = typeof part.description === "string" && part.description ? `: ${part.description}` : "";
+            return `[subtask] ${agent}${desc}`;
+        }
+        case "agent":
+            return `[agent] ${typeof part.name === "string" ? part.name : ""}`;
+        case "retry": {
+            const attempt = typeof part.attempt === "number" ? part.attempt : "?";
+            const err = part.error;
+            const msg = typeof err?.message === "string" && err.message ? `: ${err.message}` : "";
+            return `[retry] attempt ${attempt}${msg}`;
+        }
+        default:
+            // Unknown part type: dump the body so no event is silently dropped.
+            return `[${ptype}] ${capField(JSON.stringify(part), MAX_UNKNOWN_PART_CHARS)}`;
+    }
+}
+// Render a log body to readable lines, prefixing each with a server-local
+// `HH:MM:SS` clock when one can be derived. Resolution per line:
+//   1. podman `--timestamps` RFC3339 prefix (live logs) — every line carries it;
+//   2. the opencode event's top-level `timestamp` (JSON lines without a prefix,
+//      e.g. persisted error-log bodies captured from container stdout);
+//   3. none — the line passes through unprefixed (shell-only clone/push output).
+// No truncate/redact here: `parseLogLines` applies those on top, while the
+// error-log route formats an already-redacted, already-capped stored body.
+export function formatLogBody(raw) {
+    const out = [];
+    for (const line of raw.split("\n")) {
+        const prefixed = PODMAN_TS_RE.exec(line);
+        let body = line;
+        let clock = null;
+        if (prefixed) {
+            clock = formatClock(prefixed[1]);
+            body = prefixed[2];
+        }
+        const trimmed = body.trim();
+        if (!trimmed)
+            continue;
+        if (!clock)
+            clock = eventClock(trimmed);
+        const rendered = formatLine(trimmed);
+        out.push(clock ? `${clock} ${rendered}` : rendered);
+    }
+    return out.join("\n");
+}
+export function parseLogLines(raw) {
+    return truncate(redact(formatLogBody(raw)), MAX_LOG_CHARS);
+}
+// Phase containers are short-lived and named `devbot-wi-<id>-<phase>`. When
+// several run at once (the agent's `-run` plus an MCP-triggered `-peersync` or
+// `-attachread`/`-attachdl`), prefer the primary run phase so the viewer keeps
+// showing the agent transcript rather than flickering to a momentary side
+// operation.
+const PHASE_PRIORITY = [
+    "run",
+    "conflictcheck",
+    "resolve",
+    "tip",
+    "peersync",
+    "peerinit",
+    "attachread",
+    "attachdl",
+    "gitexclude",
+    "auth",
+    "podman-init",
+    "sync",
+    "clone",
+    "detect",
+    "push",
+    "forcepush",
+];
+// List the work item's running phase containers via one `podman ps`. The name
+// filter is a substring match; startsWith re-checks so `devbot-wi-5-` can never
+// pick up `devbot-wi-50-…`.
+async function listRunningPhases(workItemId) {
+    const prefix = workItemContainerPrefix(workItemId);
+    const r = await podman(["ps", "--filter", `name=${prefix}`, "--format", "{{.Names}}"]);
+    if (r.code !== 0)
+        return [];
+    const found = [];
+    for (const line of r.stdout.split("\n")) {
+        const name = line.trim();
+        if (!name.startsWith(prefix))
+            continue;
+        const phase = name.slice(prefix.length);
+        if (phase)
+            found.push({ phase, name });
+    }
+    return found;
+}
+// Pick the phase container to stream: the primary `run` phase when present,
+// else the highest-priority phase by lifecycle order.
+function pickPhase(containers) {
+    if (containers.length === 0)
+        return null;
+    for (const phase of PHASE_PRIORITY) {
+        const hit = containers.find((c) => c.phase === phase);
+        if (hit)
+            return hit;
+    }
+    return containers[0];
+}
+// Snapshot the currently-active phase container's logs. The active phase is
+// discovered from the running containers (not just `-run`) so clone/sync/auth/
+// push output is visible too. A non-zero podman exit (container gone: `--rm`
+// after completion, or not yet started) returns available:false.
+export async function fetchTaskLogs(workItemId) {
+    const active = pickPhase(await listRunningPhases(workItemId));
+    if (!active) {
+        log.debug("task logs: no active phase container", { workItemId });
+        return { available: false, text: "", truncated: false, phase: null, phaseLabel: "" };
+    }
+    const label = phaseLabel(active.phase);
+    // --timestamps prefixes every line (NDJSON and non-JSON) with an RFC3339
+    // time so the viewer can show a clock per line.
+    const r = await podman(["logs", "--timestamps", "--tail", String(TAIL_LINES), active.name]);
+    if (r.code !== 0) {
+        log.debug("task logs unavailable", { workItemId, container: active.name, code: r.code });
+        return { available: false, text: "", truncated: false, phase: active.phase, phaseLabel: label };
+    }
+    // podman multiplexes stdout/stderr; combine so init/git errors aren't lost.
+    const combined = r.stdout + (r.stderr ? `\n${r.stderr}` : "");
+    const { text, truncated } = parseLogLines(combined);
+    return { available: true, text, truncated, phase: active.phase, phaseLabel: label };
+}
+//# sourceMappingURL=task-log.js.map

package/dist/task-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-log.js","sourceRoot":"","sources":["../src/task-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,yDAAyD;AAEzD,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,GAAW;IAC9C,IAAI,CAAS,CAAC;IACd,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,CAAC,GAAG,KAAK,CAAC;IACZ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,KAAK,SAAS;YAAE,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,2DAA2D;AAC3D,SAAS,WAAW,CAAC,CAAS,EAAE,GAAW;IACzC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,YAAY,GAAG,oFAAoF,CAAC;AAO1G,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,yEAAyE;AACzE,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,EAAE,GAAI,EAA8B,CAAC,SAAS,CAAC;IACrD,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1D,MAAM,CAAC,GAAG,EAA6B,CAAC;IAExC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAsE,CAAC;QACrF,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,CAAC;QAC/C,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,IAA2C,CAAC;IAC3D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM;YACT,OAAO,UAAU,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpE,KAAK,WAAW;YACd,OAAO,eAAe,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzE,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,GAAG,IAAI,CAAC,KAEH,CAAC;YACd,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,EAAE,EAAE,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7E,IAAI,EAAE,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,YAAY,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,YAAY;YACf,OAAO,cAAc,CAAC;QACxB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAEP,CAAC;YACd,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC5G,MAAM,CAAC,GAAa,EAAE,CAAC;gBACvB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;oBAAE,CAAC,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;oBAAE,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5E,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO,gBAAgB,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,UAAU,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QACzF,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,OAAO,aAAa,KAAK,GAAG,IAAI,EAAE,CAAC;QACrC,CAAC;QACD,KAAK,OAAO;YACV,OAAO,WAAW,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACrE,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAyC,CAAC;YAC3D,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO,mBAAmB,OAAO,GAAG,GAAG,EAAE,CAAC;QAC5C,CAAC;QACD;YACE,oEAAoE;YACpE,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,iEAAiE;AACjE,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,iFAAiF;AACjF,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;YAClC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC;AAaD,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,aAAa;AACb,MAAM,cAAc,GAAG;IACrB,KAAK;IACL,eAAe;IACf,SAAS;IACT,KAAK;IACL,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,MAAM;IACN,aAAa;IACb,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,WAAW;CACZ,CAAC;AAOF,8EAA8E;AAC9E,gFAAgF;AAChF,4BAA4B;AAC5B,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,MAAM,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,sDAAsD;AACtD,SAAS,SAAS,CAAC,UAA4B;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACtD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACtF,CAAC"}

package/dist/task-view.js

@@ -0,0 +1,62 @@
+function asNumber(v, fallback = 0) {
+    return typeof v === "number" && Number.isFinite(v) ? v : fallback;
+}
+function asString(v) {
+    return typeof v === "string" ? v : "";
+}
+// Shape the in-memory gate depth + configured cap into the header's quota
+// object. Pure so it is unit-testable without a DB or config side effects.
+export function buildTaskQuota(depth, max) {
+    return { active: depth.active, max, waiting: depth.waiting };
+}
+// `resolveProjectPath(projectId)` returns the managed project's path or "".
+// `resolveMode(projectId, mode)` returns the resolved model + variant for the
+// row's plan/build mode (defaults to empty, so store-free callers/tests stay
+// valid). `resolveWorkItemUrl(projectId, number)` builds the browser link to
+// the work item (defaults to empty for store-free callers/tests). All three
+// are passed in (rather than imported) so this module stays free of DB/config
+// side effects and is cheap to unit test.
+//
+// `resolveWaitingPosition(seq)` returns the task's live global-gate position
+// (1-based) when it is claimed but blocked on the concurrency gate, else null.
+// A DB-`running` row that is gate-blocked is surfaced as status `waiting` with
+// that position; a running row holding a slot stays `running` with position
+// null. `queued` rows keep their 0-based DB backlog rank (a distinct ordering:
+// backlog rank vs admission position). Defaults to null (store-free callers).
+export function buildTaskViews(rows, resolveProjectPath, resolveMode = () => ({ model: "", variant: "" }), resolveWorkItemUrl = () => "", resolveWaitingPosition = () => null) {
+    return rows.map((r) => {
+        let payload = {};
+        try {
+            payload = JSON.parse(r.payload);
+        }
+        catch {
+            payload = {};
+        }
+        const projectId = asNumber(payload.projectId);
+        const mode = asString(payload.mode);
+        const workItemIid = asNumber(payload.workItemNumber ?? payload.workItemIid);
+        const resolved = resolveMode(projectId, mode);
+        // A claimed row that is blocked on the global gate is logically "waiting",
+        // not running: prefer the gate position over the raw DB status.
+        const waitingPosition = r.status === "running" ? resolveWaitingPosition(r.seq) : null;
+        return {
+            seq: r.seq,
+            projectId,
+            projectPath: resolveProjectPath(projectId),
+            workItemIid,
+            workItemId: r.work_item_id,
+            workItemUrl: resolveWorkItemUrl(projectId, workItemIid),
+            title: asString(payload.workItemTitle),
+            mode,
+            model: resolved.model,
+            variant: resolved.variant,
+            status: waitingPosition !== null ? "waiting" : r.status,
+            enqueuedAt: r.enqueued_at,
+            claimedAt: r.claimed_at,
+            attempts: r.attempts,
+            lastError: r.last_error,
+            position: waitingPosition !== null ? waitingPosition : r.position,
+        };
+    });
+}
+//# sourceMappingURL=task-view.js.map

package/dist/task-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-view.js","sourceRoot":"","sources":["../src/task-view.ts"],"names":[],"mappings":"AAyDA,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAQ,GAAG,CAAC;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAAuB,EAAE,GAAW;IACjE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,0CAA0C;AAC1C,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAC5B,IAAoB,EACpB,kBAAiD,EACjD,cAAiE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EACnG,qBAAoE,GAAG,EAAE,CAAC,EAAE,EAC5E,yBAAyD,GAAG,EAAE,CAAC,IAAI;IAEnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,IAAI,OAAO,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAgB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,OAAO;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS;YACT,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC;YAC1C,WAAW;YACX,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,WAAW,EAAE,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YACvD,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;YACtC,IAAI;YACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;YACvD,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/token-store.js

@@ -0,0 +1,68 @@
+import { db } from "./db.js";
+import { encrypt, decryptOrPlaintext } from "./crypto-util.js";
+export function initDb() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS project_tokens (
+      project_id   INTEGER PRIMARY KEY,
+      project_path TEXT NOT NULL,
+      signing_token TEXT NOT NULL,
+      webhook_id   INTEGER NOT NULL,
+      created_at   INTEGER NOT NULL
+    )
+  `);
+}
+export function upsertToken(input) {
+    db.prepare(`
+    INSERT OR REPLACE INTO project_tokens
+      (project_id, project_path, signing_token, webhook_id, created_at)
+    VALUES (?, ?, ?, ?, ?)
+  `).run(input.projectId, input.projectPath, encrypt(input.signingToken), input.webhookId, Math.floor(Date.now() / 1000));
+}
+export function getToken(projectId) {
+    const row = db.prepare("SELECT signing_token FROM project_tokens WHERE project_id = ?").get(projectId);
+    return row ? { signingToken: decryptOrPlaintext(row.signing_token) } : null;
+}
+// `limit === undefined` returns every row (used by callers that need the full
+// list); the WebUI pager passes limit/offset. `q` is an optional
+// case-insensitive substring of the project path (work item #88).
+export function listTokens(limit, offset, q) {
+    const where = q !== undefined && q.length > 0 ? " WHERE project_path LIKE ? ESCAPE '\\'" : "";
+    const params = where ? [`%${q.replace(/[\\%_]/g, (ch) => `\\${ch}`)}%`] : [];
+    const sql = `SELECT project_id, project_path, webhook_id, created_at FROM project_tokens${where} ORDER BY created_at DESC` +
+        (limit === undefined ? "" : " LIMIT ? OFFSET ?");
+    const args = limit === undefined ? params : [...params, limit, offset ?? 0];
+    const rows = db.prepare(sql).all(...args);
+    return rows.map((r) => ({
+        projectId: r.project_id,
+        projectPath: r.project_path,
+        webhookId: r.webhook_id,
+        createdAt: r.created_at,
+    }));
+}
+export function countTokens(q) {
+    const where = q !== undefined && q.length > 0 ? " WHERE project_path LIKE ? ESCAPE '\\'" : "";
+    const params = where ? [`%${q.replace(/[\\%_]/g, (ch) => `\\${ch}`)}%`] : [];
+    const row = db.prepare(`SELECT COUNT(*) AS c FROM project_tokens${where}`).get(...params);
+    return row.c;
+}
+export function getProject(projectId) {
+    const row = db
+        .prepare("SELECT project_id, project_path, webhook_id FROM project_tokens WHERE project_id = ?")
+        .get(projectId);
+    return row
+        ? { projectId: row.project_id, projectPath: row.project_path, webhookId: row.webhook_id }
+        : null;
+}
+// Update the stored forge path after a rename/transfer. Returns true when a row
+// actually changed. Signing token, webhook id and created_at are untouched, so
+// reconciliation can never reset an onboarded project.
+export function updateProjectPath(projectId, projectPath) {
+    const r = db
+        .prepare("UPDATE project_tokens SET project_path = ? WHERE project_id = ? AND project_path <> ?")
+        .run(projectPath, projectId, projectPath);
+    return r.changes > 0;
+}
+export function deleteToken(projectId) {
+    db.prepare("DELETE FROM project_tokens WHERE project_id = ?").run(projectId);
+}
+//# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,MAAM,UAAU,MAAM;IACpB,EAAE,CAAC,IAAI,CAAC;;;;;;;;GAQP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAK3B;IACC,EAAE,CAAC,OAAO,CAAC;;;;GAIV,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,SAAS,CAExF,CAAC;IACd,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,MAAe,EAAE,CAAU;IACpE,MAAM,KAAK,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAwB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,GAAG,GACP,8EAA8E,KAAK,2BAA2B;QAC9G,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAKtC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,MAAM,KAAK,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAwB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAkB,CAAC;IAC3G,OAAO,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,sFAAsF,CAAC;SAC/F,GAAG,CAAC,SAAS,CAEH,CAAC;IACd,OAAO,GAAG;QACR,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE;QACzF,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,WAAmB;IACtE,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CAAC,uFAAuF,CAAC;SAChG,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC/E,CAAC"}

package/dist/types/access.js

@@ -0,0 +1,74 @@
+import { z } from "zod";
+// Trigger policy and per-project access rules.
+//
+// The baseline trigger policy has two configurable gates, resolved
+// project -> global -> default:
+//
+//   1. requireAuthorOrAssignee (default true) — the actor must be the work
+//      item's author or assignee.
+//   2. minRole (default "write") — the actor's normalized project permission
+//      must be at least this role (none < read < write < admin < owner).
+//
+// Both are global settings, each overridable per project. Setting
+// requireAuthorOrAssignee=false and minRole="none" allows any project member to
+// trigger.
+//
+// A per-project access rule refines the SECOND (role) gate for one subject: a
+// normalized project role or a specific forge user (numeric id). It runs after
+// the author/assignee gate and replaces the role gate for that subject, so it
+// can broaden (e.g. allow a Reporter to run plans) or narrow (e.g. deny a
+// specific user). It cannot bypass the author/assignee gate. Levels:
+//
+//   full    — plan and build runs.
+//   plan    — plan mode only; a build mention is ignored silently.
+//   denied  — ignored silently (no reply, no run).
+//
+// Precedence: an exact username rule beats a role rule; the configured role
+// gate applies when neither matches.
+export const ACCESS_LEVELS = ["full", "plan", "denied"];
+// Normalized project permission (the Platform port's Permission).
+export const ACCESS_ROLES = ["none", "read", "write", "admin", "owner"];
+// Ordered least -> most privileged, for the configurable minimum-role gate.
+const ROLE_ORDER = ["none", "read", "write", "admin", "owner"];
+// True when `permission` is at least `minRole` in the normalized role order.
+export function permissionAtLeast(permission, minRole) {
+    return ROLE_ORDER.indexOf(permission) >= ROLE_ORDER.indexOf(minRole);
+}
+// Human-facing role label for the denial note.
+export function roleLabel(role) {
+    switch (role) {
+        case "none":
+            return "a project member";
+        case "read":
+            return "Reporter";
+        case "write":
+            return "Developer";
+        case "admin":
+            return "Maintainer";
+        case "owner":
+            return "Owner";
+    }
+}
+// Global setting: required, parsed with a default so older rows stay valid.
+export const globalMinRoleField = z.enum(ACCESS_ROLES).default("write");
+export const globalRequireAuthorOrAssigneeField = z.boolean().default(true);
+// Project setting: "" = inherit the global value; otherwise an explicit
+// override. Booleans are stored as text to keep the ""-means-inherit convention.
+export const projectMinRoleField = z.union([z.enum(ACCESS_ROLES), z.literal("")]).default("");
+export const InheritableBoolSchema = z.union([z.literal(""), z.literal("true"), z.literal("false")]).default("");
+export const USERNAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+export const USERNAME_MAX = 255;
+const levelField = z.enum(ACCESS_LEVELS);
+// Body for POST /api/projects/:id/access-rules. A role rule carries `role`; a
+// user rule carries a `username` that the server resolves to a stable id.
+export const AccessRuleAddSchema = z.discriminatedUnion("subjectType", [
+    z.object({ subjectType: z.literal("role"), role: z.enum(ACCESS_ROLES), level: levelField }).strict(),
+    z
+        .object({
+        subjectType: z.literal("user"),
+        username: z.string().min(1).max(USERNAME_MAX).transform((v) => v.trim()),
+        level: levelField,
+    })
+        .strict(),
+]);
+//# sourceMappingURL=access.js.map

package/dist/types/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/types/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+CAA+C;AAC/C,EAAE;AACF,mEAAmE;AACnE,gCAAgC;AAChC,EAAE;AACF,2EAA2E;AAC3E,kCAAkC;AAClC,6EAA6E;AAC7E,yEAAyE;AACzE,EAAE;AACF,kEAAkE;AAClE,gFAAgF;AAChF,WAAW;AACX,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,qEAAqE;AACrE,EAAE;AACF,mCAAmC;AACnC,mEAAmE;AACnE,mDAAmD;AACnD,EAAE;AACF,4EAA4E;AAC5E,qCAAqC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAGjE,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAGjF,4EAA4E;AAC5E,MAAM,UAAU,GAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEtF,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,UAAsB,EAAE,OAAmB;IAC3E,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,kBAAkB,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,WAAW,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,YAAY,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5E,wEAAwE;AACxE,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAGjH,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEhC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAEzC,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,aAAa,EAAE;IACrE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACpG,CAAC;SACE,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,KAAK,EAAE,UAAU;KAClB,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC"}

package/dist/types/custom-repos.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+// Admin-registered git repositories of opencode skills and/or subagents. Two
+// kinds share one table/store; `project_id = 0` is the global scope (same
+// sentinel as MCP servers). Tokens are optional (public repos) and encrypted at
+// rest by the store.
+export const CUSTOM_REPO_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+export const CUSTOM_REPO_NAME_MAX = 64;
+export const CUSTOM_REPO_URL_MAX = 2048;
+export const CUSTOM_REPO_TOKEN_MAX = 4096;
+export const CUSTOM_REPO_KINDS = ["skills", "agents"];
+const urlField = z
+    .string()
+    .max(CUSTOM_REPO_URL_MAX)
+    .refine((v) => /^https?:\/\/\S+$/.test(v), { message: "must be an http(s) URL" });
+export const CustomRepoBodySchema = z
+    .object({
+    url: urlField,
+    token: z.string().max(CUSTOM_REPO_TOKEN_MAX).optional(),
+    enabled: z.boolean(),
+})
+    .strict();
+export function isValidCustomRepoName(name) {
+    return name.length >= 1 && name.length <= CUSTOM_REPO_NAME_MAX && CUSTOM_REPO_NAME_RE.test(name);
+}
+export function isCustomRepoKind(kind) {
+    return CUSTOM_REPO_KINDS.includes(kind);
+}
+//# sourceMappingURL=custom-repos.js.map

package/dist/types/custom-repos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-repos.js","sourceRoot":"","sources":["../../src/types/custom-repos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,qBAAqB;AAErB,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG/D,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,mBAAmB,CAAC;KACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAWZ,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAoB,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC"}

package/dist/types/env-config.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+// One per-project environment variable. Values are secrets (API keys, DB
+//   passwords, etc.) — encrypted at rest in the store, never returned to the
+//   browser (only the summary shape below). The runner injects each enabled
+//   var into every builder container via `--env NAME=VALUE`.
+export const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
+export const ENV_NAME_MAX = 64;
+export const ENV_VALUE_MAX = 4096;
+export const EnvVarSchema = z
+    .object({
+    name: z.string().regex(ENV_NAME_RE).max(ENV_NAME_MAX),
+    value: z.string().max(ENV_VALUE_MAX),
+    enabled: z.boolean(),
+})
+    .strict();
+// Body for PUT /api/projects/:id/env/:name — name comes from the URL param,
+//   so the body only carries value + enabled. An empty value on edit means
+//   "leave unchanged" (the store keeps the existing encrypted value).
+export const EnvVarBodySchema = z
+    .object({
+    value: z.string().max(ENV_VALUE_MAX),
+    enabled: z.boolean(),
+})
+    .strict();
+//# sourceMappingURL=env-config.js.map

package/dist/types/env-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../../src/types/env-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,6DAA6D;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAElC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,MAAM,EAAE,CAAC"}