@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/conflict-fix.js

@@ -0,0 +1,178 @@
+import { shq } from "./redact.js";
+// Pure conflict-fix helpers (work item #56): the git shell-script builders,
+//   their result parsers, the resolver prompt/result parser, and the note
+//   formatters. Deliberately dependency-light (no config/podman) so the contract
+//   is unit-testable without a container. The podman wrappers live in git.ts,
+//   which imports these one-way; this module must never import git.ts.
+// ---- Conflict check --------------------------------------------------------
+// Host-side conflict check. Order is load-bearing:
+//   1. abort any half-finished rebase/merge a prior killed resolver left behind
+//      (a /stop or timeout mid-rebase); `|| true` so a clean tree is a no-op.
+//   2. fetch origin so the target ref is current.
+//   3. record the remote branch tip (TIP:<sha>) so the publish can pin its
+//      force-with-lease to the exact commit this run started from.
+//   4. verify origin/<target> exists (a deleted target is an actionable failure,
+//      not an empty merge-tree success).
+//   5. merge-tree --write-tree --name-only origin/<target> HEAD: exit 0 = clean,
+//      exit 1 = conflicts printed on stdout after the tree OID line.
+export function conflictCheckScript(target, branch, extraHeader) {
+    return [
+        "cd /workspace",
+        "git rebase --abort 2>/dev/null || true",
+        "git merge --abort 2>/dev/null || true",
+        `${extraHeader} fetch origin`,
+        `echo "TIP:$(git rev-parse origin/${shq(branch)} 2>/dev/null || true)"`,
+        `git rev-parse --verify --quiet origin/${shq(target)} >/dev/null || { echo "CHECK_FAILED:missing-target"; exit 8; }`,
+        `git merge-tree --write-tree --name-only origin/${shq(target)} ${shq(branch)}`,
+    ].join(" && ");
+}
+// Parse a conflict-check result. exit 0 = clean. exit 1 = merge-tree reported
+//   conflicts: stdout is the tree OID, then one path per line, then a blank line
+//   and human messages. Any other exit (8 missing target, fetch failure) → null.
+export function parseConflictCheckResult(code, stdout) {
+    if (code === 0)
+        return { conflictFree: true, files: [] };
+    if (code !== 1)
+        return null;
+    // Strip the `TIP:` line the script prints before merge-tree, then skip the
+    // first remaining non-empty line (the merged-tree OID) and read paths up to
+    // the blank separator.
+    const lines = stdout.split("\n").filter((l) => !l.startsWith("TIP:"));
+    const files = [];
+    let sawOid = false;
+    for (const line of lines) {
+        if (line === "")
+            break;
+        if (!sawOid) {
+            sawOid = true;
+            continue;
+        }
+        if (line.trim() !== "")
+            files.push(line.trim());
+    }
+    return { conflictFree: false, files };
+}
+// ---- Rewrite-aware publish -------------------------------------------------
+// Compose the host-side publish script. Order is load-bearing:
+//   1. HEAD guard (exit 7 WRONG_HEAD).
+//   2. fallback commit for uncommitted agent work — but refuse if the staged
+//      diff carries conflict markers (exit 10 CONFLICT_MARKERS), so a killed
+//      resolver can't commit `<<<<<<<` into the branch.
+//   3. fetch origin.
+//   4. decide:
+//        unborn remote        → plain push.
+//        origin is ancestor   → ahead ? plain push : NO_COMMITS.
+//        origin == preRunTip  → --force-with-lease pinned to preRunTip
+//                               (we only rewrote our own earlier commits).
+//        else (remote moved)  → REMOTE_MOVED, exit 9 (fail closed, no clobber).
+//   `force` (/force-push) short-circuits to an unconditional leased push.
+export function publishScript(workItemNumber, branch, extraHeader, preRunTip, force = false) {
+    const b = shq(branch);
+    const lease = `--force-with-lease=refs/heads/${branch}:${preRunTip}`;
+    const markerCheck = `if git diff --cached -U0 | grep -qE '^\\+.*(<<<<<<<|=======|>>>>>>>)'; then echo "CONFLICT_MARKERS"; exit 10; fi`;
+    const decide = force
+        ? `if ! git rev-parse --verify --quiet origin/${b} >/dev/null; then ${extraHeader} push origin ${b} && echo PUSHED; else ${extraHeader} push origin ${b} --force-with-lease && echo FORCE_PUSHED; fi`
+        : [
+            `if ! git rev-parse --verify --quiet origin/${b} >/dev/null; then`,
+            `  ${extraHeader} push origin ${b} && echo PUSHED;`,
+            `elif git merge-base --is-ancestor origin/${b} HEAD; then`,
+            `  if test -n "$(git log --format=%H origin/${b}..HEAD)"; then ${extraHeader} push origin ${b} && echo PUSHED; else echo NO_COMMITS; fi;`,
+            `elif test "$(git rev-parse origin/${b})" = ${shq(preRunTip)}; then`,
+            `  ${extraHeader} push origin ${b} ${lease} && echo FORCE_PUSHED;`,
+            `else echo REMOTE_MOVED; exit 9; fi`,
+        ].join("\n");
+    return [
+        "cd /workspace",
+        `test "$(git rev-parse --abbrev-ref HEAD)" = ${b} || { echo "WRONG_HEAD:$(git rev-parse --abbrev-ref HEAD)"; exit 7; }`,
+        `if test -n "$(git status --porcelain)"; then git add -A && { ${markerCheck}; } && git commit -m "chore: fallback commit for uncommitted agent work (#${workItemNumber})" --no-verify && echo FALLBACK_COMMITTED; fi`,
+        `${extraHeader} fetch origin`,
+        decide,
+    ].join(" && ");
+}
+export function parsePublishResult(stdout) {
+    return {
+        pushed: stdout.includes("PUSHED") || stdout.includes("FORCE_PUSHED"),
+        forced: stdout.includes("FORCE_PUSHED"),
+        noCommits: stdout.includes("NO_COMMITS"),
+        fallbackCommitted: stdout.includes("FALLBACK_COMMITTED"),
+        remoteMoved: stdout.includes("REMOTE_MOVED"),
+        rewritten: stdout.includes("REWRITTEN"),
+    };
+}
+// ---- Resolver --------------------------------------------------------------
+// The direct resolver prompt. Rebase-first, merge fallback; never push or switch
+//   branches (DevBot owns the push); print a machine-readable terminal marker.
+export function resolverPrompt(branch, target) {
+    return [
+        `The branch \`${branch}\` conflicts with its merge target \`origin/${target}\`.`,
+        "",
+        "Resolve the conflict so the branch merges cleanly. Do exactly this:",
+        "",
+        `1. DevBot has already fetched origin for this run, so \`origin/${target}\` is current — do not fetch yourself.`,
+        `2. Rebase the work branch onto the target: \`git rebase origin/${target}\`.`,
+        "3. Resolve every conflict, stage the files, and let the rebase finish.",
+        `4. If a clean rebase is not viable (e.g. an irresolvable or binary conflict), run \`git rebase --abort\`, then \`git merge origin/${target}\`, resolve and commit the merge.`,
+        "5. Keep the resolved tree building where you reasonably can, but do not run long builds.",
+        "",
+        "Hard rules:",
+        `- Work only on \`${branch}\` — never switch branches.`,
+        "- **Do not push or fetch**; DevBot does both host-side. DevBot pushes after you finish.",
+        "- Do not amend or rewrite commits beyond what rebase requires.",
+        "",
+        "When done, end your reply with exactly one marker:",
+        `- \`RESOLVED:rebase\` or \`RESOLVED:merge\` on success, or`,
+        `- \`UNRESOLVED: <comma-separated file paths>\` if you could not resolve it.`,
+    ].join("\n");
+}
+export function parseResolverResult(text) {
+    const resolved = text.match(/RESOLVED:(rebase|merge)/);
+    if (resolved)
+        return { resolved: true, strategy: resolved[1], files: [] };
+    const unresolved = text.match(/UNRESOLVED:\s*(.*)/);
+    const files = unresolved && unresolved[1]
+        ? [...new Set(unresolved[1].split(",").map((s) => s.trim()).filter(Boolean))]
+        : [];
+    return { resolved: false, strategy: "", files };
+}
+// ---- Notes -----------------------------------------------------------------
+// Sanitize a repo-controlled path before wrapping it in an inline-code span: a
+//   stray backtick would break the Markdown and could inject a mention.
+function sanitizePath(p) {
+    return p.replace(/[`\r\n]/g, "").trim();
+}
+export const CONFLICT_FILES_CAP = 10;
+export function formatConflictFixNote(target, strategy) {
+    return `🔧 Auto-resolved merge conflicts with \`${target}\` (${strategy}).`;
+}
+export function formatUnresolvedNote(target, files) {
+    const shown = files.slice(0, CONFLICT_FILES_CAP).map((f) => `\`${sanitizePath(f)}\``);
+    const overflow = files.length - shown.length;
+    const list = shown.length > 0
+        ? shown.join(", ") + (overflow > 0 ? ` and ${overflow} more` : "")
+        : "the target branch";
+    return (`⚠️ Could not auto-resolve conflicts with \`${target}\`: ${list}. ` +
+        `The branch was pushed without the merge request. Resolve the conflicts manually and re-run \`/mr\`, ` +
+        `or disable conflict auto-fix in the project settings.`);
+}
+// Fix-only note for the standalone /fix-conflicts task: no publish happened, so
+//   the branch is untouched when resolution fails. Never mentions an MR step.
+export function formatFixOnlyUnresolvedNote(target, files) {
+    const shown = files.slice(0, CONFLICT_FILES_CAP).map((f) => `\`${sanitizePath(f)}\``);
+    const overflow = files.length - shown.length;
+    const list = shown.length > 0
+        ? shown.join(", ") + (overflow > 0 ? ` and ${overflow} more` : "")
+        : "the target branch";
+    return (`⚠️ Could not fix conflicts with \`${target}\`: ${list}. ` +
+        `The branch was left unchanged. Resolve the conflicts manually, then re-run \`/fix-conflicts\`.`);
+}
+// Fix-only note when the branch already merges cleanly — nothing to do.
+export function formatNoConflictsNote(target) {
+    return `ℹ️ No merge conflicts with \`${target}\` — nothing to fix.`;
+}
+// Extract the `TIP:<sha>` line a script echoes. null when the ref is unborn or
+//   the marker is absent (the publish then treats the remote as unborn).
+export function parseBranchTip(stdout) {
+    const m = stdout.match(/TIP:([0-9a-f]{7,40})/);
+    return m ? m[1] : null;
+}
+//# sourceMappingURL=conflict-fix.js.map

package/dist/conflict-fix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conflict-fix.js","sourceRoot":"","sources":["../src/conflict-fix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,4EAA4E;AAC5E,0EAA0E;AAC1E,iFAAiF;AACjF,8EAA8E;AAC9E,uEAAuE;AAEvE,+EAA+E;AAE/E,mDAAmD;AACnD,gFAAgF;AAChF,8EAA8E;AAC9E,kDAAkD;AAClD,2EAA2E;AAC3E,mEAAmE;AACnE,iFAAiF;AACjF,yCAAyC;AACzC,iFAAiF;AACjF,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,MAAc,EAAE,WAAmB;IACrF,OAAO;QACL,eAAe;QACf,wCAAwC;QACxC,uCAAuC;QACvC,GAAG,WAAW,eAAe;QAC7B,oCAAoC,GAAG,CAAC,MAAM,CAAC,wBAAwB;QACvE,yCAAyC,GAAG,CAAC,MAAM,CAAC,gEAAgE;QACpH,kDAAkD,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE;KAC/E,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAOD,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc;IACnE,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzD,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,4EAA4E;IAC5E,uBAAuB;IACvB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,+EAA+E;AAE/E,+DAA+D;AAC/D,uCAAuC;AACvC,6EAA6E;AAC7E,6EAA6E;AAC7E,wDAAwD;AACxD,qBAAqB;AACrB,eAAe;AACf,4CAA4C;AAC5C,iEAAiE;AACjE,uEAAuE;AACvE,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,cAAsB,EAAE,MAAc,EAAE,WAAmB,EAAE,SAAiB,EAAE,KAAK,GAAG,KAAK;IACzH,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,iCAAiC,MAAM,IAAI,SAAS,EAAE,CAAC;IACrE,MAAM,WAAW,GACf,kHAAkH,CAAC;IACrH,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,8CAA8C,CAAC,qBAAqB,WAAW,gBAAgB,CAAC,yBAAyB,WAAW,gBAAgB,CAAC,8CAA8C;QACrM,CAAC,CAAC;YACE,8CAA8C,CAAC,mBAAmB;YAClE,KAAK,WAAW,gBAAgB,CAAC,kBAAkB;YACnD,4CAA4C,CAAC,aAAa;YAC1D,8CAA8C,CAAC,kBAAkB,WAAW,gBAAgB,CAAC,4CAA4C;YACzI,qCAAqC,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,QAAQ;YACpE,KAAK,WAAW,gBAAgB,CAAC,IAAI,KAAK,wBAAwB;YAClE,oCAAoC;SACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO;QACL,eAAe;QACf,+CAA+C,CAAC,uEAAuE;QACvH,gEAAgE,WAAW,6EAA6E,cAAc,+CAA+C;QACrN,GAAG,WAAW,eAAe;QAC7B,MAAM;KACP,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAWD,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACxD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,OAAO;QACL,gBAAgB,MAAM,+CAA+C,MAAM,KAAK;QAChF,EAAE;QACF,qEAAqE;QACrE,EAAE;QACF,kEAAkE,MAAM,wCAAwC;QAChH,kEAAkE,MAAM,KAAK;QAC7E,wEAAwE;QACxE,qIAAqI,MAAM,mCAAmC;QAC9K,0FAA0F;QAC1F,EAAE;QACF,aAAa;QACb,oBAAoB,MAAM,6BAA6B;QACvD,yFAAyF;QACzF,gEAAgE;QAChE,EAAE;QACF,oDAAoD;QACpD,4DAA4D;QAC5D,6EAA6E;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,+EAA+E;AAE/E,+EAA+E;AAC/E,wEAAwE;AACxE,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,QAAgB;IACpE,OAAO,2CAA2C,MAAM,OAAO,QAAQ,IAAI,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,KAAe;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC,CAAC,mBAAmB,CAAC;IACxB,OAAO,CACL,8CAA8C,MAAM,OAAO,IAAI,IAAI;QACnE,sGAAsG;QACtG,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,KAAe;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC,CAAC,mBAAmB,CAAC;IACxB,OAAO,CACL,qCAAqC,MAAM,OAAO,IAAI,IAAI;QAC1D,gGAAgG,CACjG,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,gCAAgC,MAAM,sBAAsB,CAAC;AACtE,CAAC;AAED,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC"}

package/dist/cookie.js

@@ -0,0 +1,70 @@
+import { createCipheriv, createDecipheriv, scryptSync, randomBytes } from "node:crypto";
+import { config } from "./config.js";
+// ponytail: fixed scrypt salt. Fine for this single-instance bot — the key
+//   derivation is deterministic so cookies survive a restart. Upgrade path:
+//   per-deployment random salt stored alongside the db, if multi-instance.
+const KEY = scryptSync(config.SESSION_KEY, "devbot-session-salt", 32);
+const ALGO = "aes-256-gcm";
+export function signCookie(payload) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGO, KEY, iv);
+    const plaintext = Buffer.from(JSON.stringify(payload), "utf8");
+    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString("base64");
+}
+export function readCookieWithReason(value) {
+    if (!value)
+        return { payload: null, reason: "missing" };
+    let buf;
+    try {
+        buf = Buffer.from(value, "base64");
+    }
+    catch {
+        return { payload: null, reason: "base64" };
+    }
+    if (buf.length < 12 + 16)
+        return { payload: null, reason: "too-short" };
+    const iv = buf.subarray(0, 12);
+    const tag = buf.subarray(12, 28);
+    const enc = buf.subarray(28);
+    try {
+        const decipher = createDecipheriv(ALGO, KEY, iv);
+        decipher.setAuthTag(tag);
+        const dec = Buffer.concat([decipher.update(enc), decipher.final()]);
+        let payload;
+        try {
+            const obj = JSON.parse(dec.toString("utf8"));
+            if (typeof obj !== "object" || obj === null ||
+                typeof obj.accessToken !== "string" ||
+                typeof obj.userId !== "number" ||
+                typeof obj.username !== "string" ||
+                typeof obj.exp !== "number") {
+                return { payload: null, reason: "json" };
+            }
+            payload = obj;
+        }
+        catch {
+            return { payload: null, reason: "json" };
+        }
+        if (payload.exp < Math.floor(Date.now() / 1000))
+            return { payload: null, reason: "expired" };
+        return { payload, reason: "ok" };
+    }
+    catch {
+        return { payload: null, reason: "decrypt" };
+    }
+}
+export const SESSION_COOKIE = "devbot_session";
+export const STATE_COOKIE = "devbot_oauth_state";
+export function cookieOptions(maxAge) {
+    return {
+        httpOnly: true,
+        secure: config.PUBLIC_URL.startsWith("https:"),
+        sameSite: "lax",
+        path: "/",
+        // ponytail: Express/cookie use ms; call sites pass seconds. Multiply here.
+        maxAge: maxAge * 1000,
+    };
+}
+//# sourceMappingURL=cookie.js.map

package/dist/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACtE,MAAM,IAAI,GAAG,aAAa,CAAC;AAS3B,MAAM,UAAU,UAAU,CAAC,OAAuB;IAChD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAI5D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;YACxD,IACE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBACvC,OAAQ,GAA+B,CAAC,WAAW,KAAK,QAAQ;gBAChE,OAAQ,GAA+B,CAAC,MAAM,KAAK,QAAQ;gBAC3D,OAAQ,GAA+B,CAAC,QAAQ,KAAK,QAAQ;gBAC7D,OAAQ,GAA+B,CAAC,GAAG,KAAK,QAAQ,EACxD,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YACD,OAAO,GAAG,GAAqB,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAEjD,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC9C,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;QACT,2EAA2E;QAC3E,MAAM,EAAE,MAAM,GAAG,IAAI;KACtB,CAAC;AACJ,CAAC"}

package/dist/crypto-util.js

@@ -0,0 +1,40 @@
+import { createCipheriv, createDecipheriv, scryptSync, randomBytes } from "node:crypto";
+import { config } from "./config.js";
+// ponytail: fixed scrypt salt — same posture as cookie.ts. The key is derived
+//   from SESSION_KEY (same env var, different salt → different key). Fine for
+//   single-instance; upgrade path: per-deployment random salt if multi-instance.
+const KEY = scryptSync(config.SESSION_KEY, "devbot-db-encryption-salt", 32);
+const ALGO = "aes-256-gcm";
+export function encrypt(plaintext) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGO, KEY, iv);
+    const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return JSON.stringify({ iv: iv.toString("base64"), tag: tag.toString("base64"), data: enc.toString("base64") });
+}
+export function decrypt(blob) {
+    let parsed;
+    try {
+        parsed = JSON.parse(blob);
+    }
+    catch {
+        return null; // not an encrypted blob
+    }
+    try {
+        const decipher = createDecipheriv(ALGO, KEY, Buffer.from(parsed.iv, "base64"));
+        decipher.setAuthTag(Buffer.from(parsed.tag, "base64"));
+        const dec = Buffer.concat([decipher.update(Buffer.from(parsed.data, "base64")), decipher.final()]);
+        return dec.toString("utf8");
+    }
+    catch {
+        return null; // tampered or wrong key
+    }
+}
+// Try decrypt first; if it fails, treat as plaintext (transparent migration
+// from pre-encryption rows). ponytail: an attacker who writes plaintext to
+// the DB bypasses encryption — acceptable since the DB is 0600 single-operator.
+export function decryptOrPlaintext(blob) {
+    const dec = decrypt(blob);
+    return dec !== null ? dec : blob;
+}
+//# sourceMappingURL=crypto-util.js.map

package/dist/crypto-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-util.js","sourceRoot":"","sources":["../src/crypto-util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC;AAC5E,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,MAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/E,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACvC,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC"}

package/dist/custom-repos-store.js

@@ -0,0 +1,90 @@
+import { db } from "./db.js";
+import { encrypt, decryptOrPlaintext } from "./crypto-util.js";
+import { CustomRepoBodySchema, } from "./types/custom-repos.js";
+export function initCustomReposTables() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS custom_repos (
+      project_id INTEGER NOT NULL,
+      kind       TEXT    NOT NULL,
+      name       TEXT    NOT NULL,
+      url        TEXT    NOT NULL,
+      token      TEXT,
+      enabled    INTEGER NOT NULL DEFAULT 1,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (project_id, kind, name)
+    )
+  `);
+}
+function rowToRepo(row) {
+    return {
+        name: String(row.name),
+        url: String(row.url),
+        token: decryptOrPlaintext(String(row.token ?? "")),
+        enabled: row.enabled === 1,
+    };
+}
+export function listCustomRepoSummaries(projectId, kind) {
+    const rows = db
+        .prepare("SELECT name, url, token, enabled FROM custom_repos WHERE project_id = ? AND kind = ? ORDER BY name")
+        .all(projectId, kind);
+    return rows.map((r) => {
+        const repo = rowToRepo(r);
+        return { name: repo.name, url: repo.url, enabled: repo.enabled, hasToken: repo.token.length > 0 };
+    });
+}
+export function upsertCustomRepo(projectId, kind, name, body) {
+    const v = CustomRepoBodySchema.parse(body);
+    const existing = db
+        .prepare("SELECT token FROM custom_repos WHERE project_id = ? AND kind = ? AND name = ?")
+        .get(projectId, kind, name);
+    // Empty/absent token on edit keeps the stored value; a new public repo stores
+    // an empty token (encrypt("")).
+    const tokenBlob = v.token ? encrypt(v.token) : String(existing?.token ?? "");
+    const now = Math.floor(Date.now() / 1000);
+    db.prepare(`INSERT OR REPLACE INTO custom_repos
+       (project_id, kind, name, url, token, enabled, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, COALESCE((SELECT created_at FROM custom_repos WHERE project_id = ? AND kind = ? AND name = ?), ?), ?)`).run(projectId, kind, name, v.url, tokenBlob, v.enabled ? 1 : 0, projectId, kind, name, now, now);
+}
+export function deleteCustomRepo(projectId, kind, name) {
+    const r = db.prepare("DELETE FROM custom_repos WHERE project_id = ? AND kind = ? AND name = ?").run(projectId, kind, name);
+    return r.changes > 0;
+}
+export function deleteAllCustomRepos(projectId) {
+    try {
+        db.prepare("DELETE FROM custom_repos WHERE project_id = ?").run(projectId);
+    }
+    catch {
+        // Table may not exist in focused unit tests that skip init.
+    }
+}
+// Resolve the repos a run should sync: global first, then project overrides by
+// name. A disabled project repo removes a global repo of the same name; disabled
+// global repos are excluded. Deterministic name order.
+export function resolveCustomRepos(projectId, kind) {
+    const load = (pid) => {
+        let rows;
+        try {
+            rows = db
+                .prepare("SELECT name, url, token, enabled FROM custom_repos WHERE project_id = ? AND kind = ? ORDER BY name")
+                .all(pid, kind);
+        }
+        catch {
+            // Table may not exist in focused unit tests that skip init.
+            return [];
+        }
+        return rows.map(rowToRepo);
+    };
+    const merged = new Map();
+    for (const r of load(0))
+        if (r.enabled)
+            merged.set(r.name, r);
+    for (const r of load(projectId)) {
+        if (r.enabled)
+            merged.set(r.name, r);
+        else
+            merged.delete(r.name);
+    }
+    return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+//# sourceMappingURL=custom-repos-store.js.map

package/dist/custom-repos-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-repos-store.js","sourceRoot":"","sources":["../src/custom-repos-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,oBAAoB,GAIrB,MAAM,yBAAyB,CAAC;AAejC,MAAM,UAAU,qBAAqB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;GAYP,CAAC,CAAC;AACL,CAAC;AAID,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACpB,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,IAAoB;IAC7E,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,oGAAoG,CAAC;SAC7G,GAAG,CAAC,SAAS,EAAE,IAAI,CAAc,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAoB,EAAE,IAAY,EAAE,IAAoB;IAC1G,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,EAAE;SAChB,OAAO,CAAC,+EAA+E,CAAC;SACxF,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAyC,CAAC;IACtE,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,EAAE,CAAC,OAAO,CACR;;qIAEiI,CAClI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAoB,EAAE,IAAY;IACpF,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3H,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,IAAoB;IACxE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAgB,EAAE;QACzC,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE;iBACN,OAAO,CAAC,oGAAoG,CAAC;iBAC7G,GAAG,CAAC,GAAG,EAAE,IAAI,CAAc,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;;YAChC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/custom-repos-sync.js

@@ -0,0 +1,118 @@
+import { config } from "./config.js";
+import { log } from "./logger.js";
+import { redact } from "./redact.js";
+import { podman } from "./podman.js";
+import { volumeName, xdgVolumeName, envArgs, logDriverArgs } from "./git.js";
+import { gitExtraHeaderFor } from "./platform/git-auth.js";
+// Sync admin-registered skills/subagent repositories into a work item's
+// volumes. Modeled on src/mcp/peer-sync.ts:
+//
+//   - Skills land in /workspace/.devbot-skills/<name>/ (inside the repo tree but
+//     git-excluded) so the agent's read/glob/grep and the skill tool can reach a
+//     skill's reference files. The xdg volume is masked from the agent, so skills
+//     cannot live there.
+//   - Agents are cloned into an xdg staging dir, then every *.md is flattened
+//     into the opencode-scanned config agents dir. opencode derives an agent's
+//     name from its path under the config dir, so cloning straight into
+//     agents/<repo>/ would leak the repo's folder layout into the /agent name.
+//
+// Auth is a host-scoped git extraHeader (src/platform/git-auth.ts), so no
+// platform branching leaks here and a private repo's token is only sent to its
+// own host. Public repos omit the header entirely.
+//
+// Every repo is best-effort: a failure emits a marker line and the script still
+// exits 0, so one bad repo never blocks a run.
+export const SKILLS_DIR = ".devbot-skills";
+export const SKILLS_ROOT = `/workspace/${SKILLS_DIR}`;
+export const XDG_HOME = "/home/devbot/.xdg";
+export const AGENT_STAGING_ROOT = `${XDG_HOME}/custom-repos/agents`;
+export const AGENT_CONFIG_DIR = `${XDG_HOME}/config/opencode/agents`;
+export const OK_MARKER = "DEVBOT_CUSTOM_REPO_OK";
+export const FAIL_MARKER = "DEVBOT_CUSTOM_REPO_FAIL";
+// The opencode `skills.paths` entries for a set of skill repos. Emits both the
+// repo root and its `skills/` subdir so either layout is discovered. Pure.
+export function skillsPathsFor(repos) {
+    return repos.flatMap((r) => [`${SKILLS_ROOT}/${r.name}`, `${SKILLS_ROOT}/${r.name}/skills`]);
+}
+function shellQuote(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+// Pure shell-script builder. `headerFor(url)` returns a trailing-spaced git
+// prefix (or "") for the repo's URL. Exported so scripts/check-custom-repos.ts
+// can pin clone-vs-fetch, destinations, prune, and auth scoping without podman.
+export function customReposSyncScript(kind, repos, headerFor) {
+    const base = kind === "skills" ? SKILLS_ROOT : AGENT_STAGING_ROOT;
+    const lines = [`mkdir -p ${base}`];
+    if (kind === "skills") {
+        // Drop skill dirs no longer configured. The configured names are embedded
+        // as a space-delimited set; each existing dir is kept only if present.
+        const known = repos.map((r) => r.name).join(" ");
+        lines.push(`for d in ${SKILLS_ROOT}/*/; do [ -d "$d" ] || continue; n=$(basename "$d"); ` +
+            `case " ${known} " in *" $n "*) ;; *) rm -rf "$d" ;; esac; done`);
+    }
+    for (const r of repos) {
+        const dir = `${base}/${r.name}`;
+        const header = headerFor(r.url);
+        const clone = `${header}git clone --depth 1 ${shellQuote(r.url)} ${shellQuote(dir)}`;
+        const fetch = `(cd ${shellQuote(dir)} && ${header}git fetch --depth 1 origin && git reset --hard FETCH_HEAD)`;
+        lines.push(`if [ -d ${shellQuote(dir)}/.git ]; then ` +
+            `{ ${fetch} && echo "${OK_MARKER}:${r.name}"; } || echo "${FAIL_MARKER}:${r.name}"; ` +
+            `else { ${clone} && echo "${OK_MARKER}:${r.name}"; } || echo "${FAIL_MARKER}:${r.name}"; fi`);
+    }
+    if (kind === "agents")
+        lines.push(flattenAgentScript());
+    return lines.join("\n");
+}
+// Clear the scanned agents dir and flatten every markdown file from the staging
+// tree into it. Prints the resulting basenames (one per line) so the caller can
+// learn the installed agent names.
+export function flattenAgentScript() {
+    return (`rm -rf ${AGENT_CONFIG_DIR} && mkdir -p ${AGENT_CONFIG_DIR} && ` +
+        `find ${AGENT_STAGING_ROOT} -name '*.md' -type f -print0 2>/dev/null | ` +
+        `while IFS= read -r -d '' f; do cp "$f" "${AGENT_CONFIG_DIR}/$(basename "$f")"; done && ` +
+        `ls ${AGENT_CONFIG_DIR} 2>/dev/null`);
+}
+export async function syncCustomRepos(input) {
+    const enabled = input.repos.filter((r) => r.enabled);
+    if (enabled.length === 0)
+        return { synced: [], failed: [], agents: [] };
+    const tokenByUrl = new Map(enabled.map((r) => [r.url, r.token]));
+    const script = customReposSyncScript(input.kind, enabled, (url) => {
+        const token = tokenByUrl.get(url) ?? "";
+        return token ? `${gitExtraHeaderFor(token, "git", url)} ` : "";
+    });
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-${input.kind}sync`,
+        "-v", `${volumeName(input.workItemId)}:/workspace:Z`,
+        "-v", `${xdgVolumeName(input.workItemId)}:${XDG_HOME}:Z`,
+        ...envArgs(input.envVars ?? []),
+        input.builderImage ?? config.BUILDER_IMAGE,
+        "sh", "-c", script,
+    ], { timeoutMs: input.timeoutMs ?? 120_000 });
+    const synced = [];
+    const failed = [];
+    for (const repo of enabled) {
+        if (r.stdout.includes(`${OK_MARKER}:${repo.name}`))
+            synced.push(repo.name);
+        else
+            failed.push(repo.name);
+    }
+    if (failed.length > 0) {
+        log.warn("custom repo sync failed", {
+            kind: input.kind,
+            workItemId: input.workItemId,
+            failed,
+            code: r.code,
+            stderr: redact(r.stderr.slice(-256)),
+        });
+    }
+    const agents = input.kind === "agents"
+        ? r.stdout
+            .split("\n")
+            .map((s) => s.trim())
+            .filter((s) => s.endsWith(".md"))
+            .map((s) => s.replace(/\.md$/, ""))
+        : [];
+    return { synced, failed, agents };
+}
+//# sourceMappingURL=custom-repos-sync.js.map

package/dist/custom-repos-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-repos-sync.js","sourceRoot":"","sources":["../src/custom-repos-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3D,wEAAwE;AACxE,4CAA4C;AAC5C,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,yBAAyB;AACzB,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,mDAAmD;AACnD,EAAE;AACF,gFAAgF;AAChF,+CAA+C;AAE/C,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,UAAU,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,QAAQ,sBAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,QAAQ,yBAAyB,CAAC;AAErE,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAA8B;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,IAAoB,EACpB,KAA0D,EAC1D,SAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAClE,MAAM,KAAK,GAAa,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE7C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CACR,YAAY,WAAW,uDAAuD;YAC5E,UAAU,KAAK,iDAAiD,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,MAAM,uBAAuB,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,KAAK,GACT,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,MAAM,4DAA4D,CAAC;QAClG,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,gBAAgB;YACxC,KAAK,KAAK,aAAa,SAAS,IAAI,CAAC,CAAC,IAAI,iBAAiB,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK;YACrF,UAAU,KAAK,aAAa,SAAS,IAAI,CAAC,CAAC,IAAI,iBAAiB,WAAW,IAAI,CAAC,CAAC,IAAI,OAAO,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,mCAAmC;AACnC,MAAM,UAAU,kBAAkB;IAChC,OAAO,CACL,UAAU,gBAAgB,gBAAgB,gBAAgB,MAAM;QAChE,QAAQ,kBAAkB,8CAA8C;QACxE,2CAA2C,gBAAgB,8BAA8B;QACzF,MAAM,gBAAgB,cAAc,CACrC,CAAC;AACJ,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAOrC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB;QACE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,EAAE,QAAQ,EAAE,aAAa,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,MAAM;QAC9F,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe;QACpD,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,QAAQ,IAAI;QACxD,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa;QAC1C,IAAI,EAAE,IAAI,EAAE,MAAM;KACnB,EACD,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,EAAE,CAC1C,CAAC;IAEF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACtE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM;YACN,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,QAAQ;QACrB,CAAC,CAAC,CAAC,CAAC,MAAM;aACL,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/db.js

@@ -0,0 +1,12 @@
+import { DatabaseSync } from "node:sqlite";
+// Shared DB handle. All stores import this `db` instead of opening their own
+// DatabaseSync — one handle, one WAL pragma, one busy_timeout, one close.
+// ponytail: DEVBOT_DB_PATH override exists for tests; production uses devbot.db.
+const DB_PATH = process.env.DEVBOT_DB_PATH ?? "devbot.db";
+export const db = new DatabaseSync(DB_PATH);
+db.exec("PRAGMA journal_mode = WAL");
+db.exec("PRAGMA busy_timeout = 5000");
+export function closeDb() {
+    db.close();
+}
+//# sourceMappingURL=db.js.map

package/dist/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,6EAA6E;AAC7E,0EAA0E;AAC1E,iFAAiF;AACjF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC;AAE1D,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5C,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;AACrC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;AAEtC,MAAM,UAAU,OAAO;IACrB,EAAE,CAAC,KAAK,EAAE,CAAC;AACb,CAAC"}

package/dist/devbot-scripts.js

@@ -0,0 +1,18 @@
+// `.devbot/` scripts the runner executes inside the builder container.
+// Today only `init.sh` exists (post-clone, first run only). Future scripts
+// (e.g. `.devbot/post-sync.sh`, `.devbot/pre-run.sh`) slot in here without
+// touching git.ts or runner.ts — add a phase function and call it from the
+// appropriate runner step.
+//
+// All scripts are invoked via `sh` (not requiring the executable bit — common
+// Windows-clone perms issue). A non-zero exit aborts the run with an
+// actionable error note (see git.ts first-run branch).
+// Shell snippet appended to the first-run clone command. Runs `.devbot/init.sh`
+// if it exists (after clone, before opencode). The env vars configured per-
+// project are already exported into the container via `--env NAME=VALUE` on
+// the podman args, so init.sh sees them naturally. Exit 8 + DEVBOT_INIT_FAILED
+// marker in stdout lets git.ts map to an actionable error reason.
+export function buildPostCloneScript() {
+    return "if [ -f .devbot/init.sh ]; then sh .devbot/init.sh || { echo \"DEVBOT_INIT_FAILED:$?\"; exit 8; }; fi";
+}
+//# sourceMappingURL=devbot-scripts.js.map

package/dist/devbot-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devbot-scripts.js","sourceRoot":"","sources":["../src/devbot-scripts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,2BAA2B;AAC3B,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,uDAAuD;AAEvD,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,kEAAkE;AAClE,MAAM,UAAU,oBAAoB;IAClC,OAAO,uGAAuG,CAAC;AACjH,CAAC"}