@wenrwa/marketplace-cli 0.8.7 → 0.8.9

package/dist/__tests__/bridge-session-anchor-no-identity.test.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * A session anchor must not need a git identity.
+ *
+ * Production 2026-10-19 (owner: "the Changes button doesn't seem to work"):
+ * a hosted box has NO git identity — no user.name/user.email in any config;
+ * the agent's identity rides only in the PTY env (GIT_AUTHOR_*). The bridge's
+ * own `git commit-tree` therefore died with "Author identity unknown" (exit
+ * 128, probed on the live machine), no refs/wenrwa/session-* ref was ever
+ * created, and no session-scoped Changes report has ever been persisted (zero
+ * `scope = 'session'` rows in terminal_changes).
+ *
+ * This runs REAL git with `user.useConfigOnly = true` and no identity, which
+ * is the container's situation made deterministic (a laptop would otherwise
+ * auto-detect user@host and hide the bug).
+ */
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const child_process_1 = require("child_process");
+const sessionAnchor_1 = require("../bridge/sessionAnchor");
+const changesReporter_1 = require("../bridge/changesReporter");
+// Jest's sandboxed process.env does not reach child_process on its own, so
+// every git call here passes the (identity-less) env explicitly — the same
+// merge execGit does in production.
+const sandboxEnv = () => ({ ...process.env });
+const run = (cmd, args, opts) => (0, changesReporter_1.execGit)(cmd, args, { env: { ...sandboxEnv(), ...(opts?.env ?? {}) } });
+const git = (args) => (0, child_process_1.execFileSync)('git', args, { env: sandboxEnv(), stdio: 'pipe' }).toString().trim();
+const IDENTITY_KEYS = ['GIT_AUTHOR_NAME', 'GIT_AUTHOR_EMAIL', 'GIT_COMMITTER_NAME', 'GIT_COMMITTER_EMAIL', 'EMAIL'];
+describe('createSessionAnchor on a box with no git identity', () => {
+    let dir;
+    let repo;
+    const saved = {};
+    beforeEach(() => {
+        dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'anchor-noid-'));
+        repo = (0, path_1.join)(dir, 'repo');
+        const globalCfg = (0, path_1.join)(dir, 'gitconfig');
+        (0, fs_1.writeFileSync)(globalCfg, '[user]\n\tuseConfigOnly = true\n');
+        for (const k of [...IDENTITY_KEYS, 'GIT_CONFIG_GLOBAL', 'GIT_CONFIG_NOSYSTEM', 'HOME'])
+            saved[k] = process.env[k];
+        for (const k of IDENTITY_KEYS)
+            delete process.env[k];
+        process.env.GIT_CONFIG_GLOBAL = globalCfg;
+        process.env.GIT_CONFIG_NOSYSTEM = '1';
+        process.env.HOME = dir;
+        git(['init', '-q', repo]);
+        (0, fs_1.writeFileSync)((0, path_1.join)(repo, 'a.txt'), 'hello\n');
+    });
+    afterEach(() => {
+        for (const [k, v] of Object.entries(saved)) {
+            if (v === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = v;
+        }
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    });
+    it('git itself refuses a commit here (the precondition is real)', () => {
+        const tree = git(['-C', repo, 'write-tree']);
+        expect(() => git(['-C', repo, 'commit-tree', tree, '-m', 'x'])).toThrow(/identity unknown|auto-detection is disabled/i);
+    });
+    it('still creates the anchor commit and its ref', async () => {
+        const res = await (0, sessionAnchor_1.createSessionAnchor)(repo, 'sess-noid', { run });
+        expect(res.ok).toBe(true);
+        if (!res.ok)
+            return;
+        const refSha = git(['-C', repo, 'rev-parse', (0, sessionAnchor_1.anchorRefName)('sess-noid')]);
+        expect(refSha).toBe(res.sha);
+        // The anchor snapshots the untracked file, so a later diff is relative to it.
+        const files = git(['-C', repo, 'ls-tree', '--name-only', res.sha]);
+        expect(files).toBe('a.txt');
+    });
+});

package/dist/__tests__/bridge-session-anchor.test.js

@@ -68,9 +68,17 @@ describe('createSessionAnchor', () => {
         expect(calls[1].args).toEqual(['-C', CWD, 'write-tree']);
         expect(calls[1].opts?.env?.GIT_INDEX_FILE).toBe(indexFile);
         // 3. commit-tree — no parent (a fresh anchor, not a chain), no index
-        //    involved at all (commit-tree never reads one) — no env override.
+        //    involved at all (commit-tree never reads one). Its only env is a
+        //    fixed identity: a hosted box has none (see
+        //    bridge-session-anchor-no-identity.test.ts).
         expect(calls[2].args).toEqual(['-C', CWD, 'commit-tree', 'treesha0000', '-m', 'wenrwa session anchor']);
-        expect(calls[2].opts?.env).toBeUndefined();
+        expect(calls[2].opts?.env).toEqual({
+            GIT_AUTHOR_NAME: 'HiveOp',
+            GIT_AUTHOR_EMAIL: 'session-anchor@hiveop.local',
+            GIT_COMMITTER_NAME: 'HiveOp',
+            GIT_COMMITTER_EMAIL: 'session-anchor@hiveop.local',
+        });
+        expect(calls[2].opts?.env?.GIT_INDEX_FILE).toBeUndefined();
         // 4. update-ref — points the session's ref at the new commit, no env.
         expect(calls[3].args).toEqual(['-C', CWD, 'update-ref', 'refs/wenrwa/session-sess-1', 'commitsha1111']);
         expect(calls[3].opts?.env).toBeUndefined();

package/dist/bridge/envNames.d.ts

@@ -0,0 +1,26 @@
+import { type RepoEnvDeps } from './repoEnv';
+export declare const ENV_NAMES_CAPABILITY = "env-names";
+/** More than this is not a hand-kept key file; the list is capped, never a value leak. */
+export declare const MAX_ENV_NAMES = 500;
+export type EnvNamesRefusal = 'no-folder' | 'not-a-file' | 'too-large' | 'unreadable';
+export type EnvNamesResult = {
+    ok: true;
+    names: string[];
+} | {
+    ok: false;
+    reason: EnvNamesRefusal;
+};
+/**
+ * Names in `<root>/.env`, sorted, deduplicated. `{ok:true, names:[]}` when
+ * there is no `.env` (nothing saved yet). A symlinked `.env` is not followed.
+ */
+export declare function readEnvNames(root: string | null | undefined, deps?: RepoEnvDeps): EnvNamesResult;
+/**
+ * The relay's `env-names` frame → its `env-names-result` reply. `requestId`
+ * is echoed so the backend can match concurrent reads. The reply is built
+ * from the names array alone, so no value can ride along.
+ */
+export declare function handleEnvNamesFrame(frame: {
+    requestId?: unknown;
+    workspaceId?: unknown;
+}, resolveRoot: (workspaceId: string) => string | null | undefined, deps?: RepoEnvDeps): Record<string, unknown>;

package/dist/bridge/envNames.js

@@ -0,0 +1,114 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_ENV_NAMES = exports.ENV_NAMES_CAPABILITY = void 0;
+exports.readEnvNames = readEnvNames;
+exports.handleEnvNamesFrame = handleEnvNamesFrame;
+/**
+ * tp-02 (docs/prd/team-preview.md story 39) — the NAMES in a workspace's
+ * `.env`, never the values.
+ *
+ * Workspace settings shows a "Keys" list so a person can check what they have
+ * saved on their own machine. Values never leave the machine: the file is
+ * parsed here with the SAME parser terminals load it with (repoEnv.ts), the
+ * values are dropped on the spot, and only the names go into any reply.
+ *
+ * Both lanes share this module so they cannot drift:
+ *   - hosted: the relay's `env-names` frame (relayClient.ts) → `env-names-result`
+ *   - local:  GET /local-env-names/:workspaceId on the loopback bridge (server.ts)
+ *
+ * tp-14 reuses the same reply to warn the owner about browser-visible names
+ * (NEXT_PUBLIC_* etc.) before sharing a preview.
+ *
+ * Never logs. Never throws.
+ */
+const path = __importStar(require("path"));
+const repoEnv_1 = require("./repoEnv");
+exports.ENV_NAMES_CAPABILITY = 'env-names';
+/** More than this is not a hand-kept key file; the list is capped, never a value leak. */
+exports.MAX_ENV_NAMES = 500;
+/**
+ * Names in `<root>/.env`, sorted, deduplicated. `{ok:true, names:[]}` when
+ * there is no `.env` (nothing saved yet). A symlinked `.env` is not followed.
+ */
+function readEnvNames(root, deps = repoEnv_1.realRepoEnvDeps) {
+    if (!root)
+        return { ok: false, reason: 'no-folder' };
+    const p = path.join(root, repoEnv_1.DOTENV_FILENAME);
+    let text;
+    try {
+        const st = deps.lstat(p);
+        if (!st)
+            return { ok: true, names: [] };
+        if (!st.isFile())
+            return { ok: false, reason: 'not-a-file' };
+        if (st.size > repoEnv_1.MAX_DOTENV_BYTES)
+            return { ok: false, reason: 'too-large' };
+        text = deps.readFile(p);
+    }
+    catch {
+        return { ok: false, reason: 'unreadable' };
+    }
+    // The values are parsed here and go out of scope with this function.
+    const names = Object.keys((0, repoEnv_1.parseDotenv)(text)).sort().slice(0, exports.MAX_ENV_NAMES);
+    return { ok: true, names };
+}
+/**
+ * The relay's `env-names` frame → its `env-names-result` reply. `requestId`
+ * is echoed so the backend can match concurrent reads. The reply is built
+ * from the names array alone, so no value can ride along.
+ */
+function handleEnvNamesFrame(frame, resolveRoot, deps = repoEnv_1.realRepoEnvDeps) {
+    const requestId = typeof frame.requestId === 'string' ? frame.requestId : undefined;
+    const workspaceId = typeof frame.workspaceId === 'string' ? frame.workspaceId : undefined;
+    const head = {
+        t: 'env-names-result',
+        ...(requestId !== undefined ? { requestId } : {}),
+        ...(workspaceId !== undefined ? { workspaceId } : {}),
+    };
+    if (!workspaceId)
+        return { ...head, ok: false, reason: 'no-folder' };
+    let root;
+    try {
+        root = resolveRoot(workspaceId);
+    }
+    catch {
+        root = null;
+    }
+    const result = readEnvNames(root, deps);
+    return result.ok
+        ? { ...head, ok: true, names: [...result.names] }
+        : { ...head, ok: false, reason: result.reason };
+}

package/dist/bridge/previewCheckout.d.ts

@@ -0,0 +1,136 @@
+export type PreviewMode = 'built' | 'dev';
+export type PreviewStatus = 'stopped'
+/** An update is fetching / installing / building right now. */
+ | 'building' | 'running'
+/** The newest sha failed to install or build. The last good one (if any) still serves. */
+ | 'build_failed'
+/** The newest sha built but never answered on the port. The last good one (if any) still serves. */
+ | 'start_failed'
+/** Nothing could be attempted (see `reason`). */
+ | 'failed';
+export type PreviewFailReason = 'busy_other_workspace' | 'no_repo_url' | 'git_failed' | 'no_package_json' | 'no_start_script' | 'port_in_use'
+/** The app listened beyond 127.0.0.1 and could not be forced to loopback. */
+ | 'unsupported_bind';
+export interface PreviewResult {
+    workspaceId: string;
+    status: PreviewStatus;
+    mode: PreviewMode;
+    /** The sha this request tried to bring up (absent when it never got that far). */
+    sha?: string;
+    /** The sha serving on the preview port right now. */
+    runningSha?: string;
+    /** The newest sha that built successfully. */
+    builtSha?: string;
+    reason?: PreviewFailReason;
+    /** One short, masked sentence for the owner. Never a log dump. */
+    message?: string;
+}
+export interface PreviewGitCredential {
+    token: string;
+    repoFullName?: string;
+}
+export interface PreviewRequest {
+    workspaceId: string;
+    repoUrl?: string;
+    gitCredential?: PreviewGitCredential;
+    mode?: PreviewMode;
+}
+export interface PreviewRunnerOpts {
+    /** Root holding every workspace's preview slots, e.g. /data/previews. */
+    previewsBaseDir: string;
+    /** The owner's working copy for a workspace — read for its `.env` ONLY. */
+    workingCopyDir: (workspaceId: string) => string;
+    /** The one fixed preview port (tp-06's forwarder targets it). */
+    port: number;
+    /** The bridge's env; only PASSTHROUGH_ENV names are taken from it. Default process.env. */
+    baseEnv?: Record<string, string | undefined>;
+    /** How long a started server gets to answer on the port. */
+    readyTimeoutMs?: {
+        built: number;
+        dev: number;
+    };
+    probeIntervalMs?: number;
+    /** Bound on each install / build step. */
+    stepTimeoutMs?: number;
+    /** SIGTERM → SIGKILL grace when stopping a process group. */
+    killGraceMs?: number;
+    /** This machine's non-loopback addresses (the bind check). Default: os.networkInterfaces(). */
+    externalAddresses?: () => string[];
+}
+/** The only names a preview process takes from the bridge's own env. */
+/** The only address a preview app may listen on. */
+export declare const PREVIEW_BIND_HOST = "127.0.0.1";
+export declare const PREVIEW_PASSTHROUGH_ENV: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TZ", "TMPDIR", "SHELL"];
+/**
+ * The preview env: allowlisted process names < the owner's repo `.env`
+ * (reserved names already removed by loadRepoEnv) < the fixed PORT.
+ * Pure, so the "bridge secrets never reach the preview" rule is testable.
+ */
+export declare function buildPreviewEnv(baseEnv: Record<string, string | undefined>, repoEnv: Record<string, string>, port: number): Record<string, string>;
+/**
+ * Extra args that pin a known framework's server to loopback, appended after
+ * `--` to `npm run <script>`. Only for scripts whose command IS that
+ * framework's server — appending flags to an arbitrary script could break it.
+ * Anything else relies on HOST/HOSTNAME and the runtime bind check.
+ */
+export declare function loopbackArgs(scriptCommand: string): string[];
+/** Non-loopback addresses of this machine (IPv4 + IPv6, link-local scoped). */
+export declare function machineExternalAddresses(): string[];
+/** True when ANY non-loopback address answers on the port, i.e. the app is exposed. */
+export declare function listensBeyondLoopback(port: number, addresses: string[], timeoutMs?: number): Promise<boolean>;
+/** `ref: refs/heads/main\tHEAD` → `main`; null when the remote names no HEAD. */
+export declare function parseSymrefHead(lsRemoteOutput: string): string | null;
+/** Which install command a checkout wants, by lockfile. */
+export declare function installCommand(files: (name: string) => boolean): [string, string[]];
+export declare class PreviewRunner {
+    private readonly opts;
+    private readonly states;
+    /** One port, so one operation at a time across the whole box. */
+    private chain;
+    private orphanSwept;
+    constructor(opts: PreviewRunnerOpts);
+    /** Bring the preview up. Already serving this workspace in this mode → answered as-is. */
+    start(req: PreviewRequest): Promise<PreviewResult>;
+    /** Fetch the default branch again and, when it moved, rebuild and swap. */
+    update(req: PreviewRequest): Promise<PreviewResult>;
+    stop(req: {
+        workspaceId: string;
+    }): Promise<PreviewResult>;
+    /** The masked tail of this workspace's preview log. Owner-scoped by the caller. */
+    logs(req: {
+        workspaceId: string;
+    }): {
+        log: string;
+        truncated: boolean;
+    };
+    status(workspaceId: string): PreviewResult;
+    /** Stop every preview this runner started (bridge shutdown). Exact PIDs only. */
+    shutdown(): Promise<void>;
+    private serialize;
+    private snapshot;
+    private wsDir;
+    private logPath;
+    private pidfilePath;
+    private clearPidfile;
+    /**
+     * A bridge restart loses `states` but not the detached server it started,
+     * which would keep the port. Stop it by the exact PID this module recorded —
+     * only if that PID still leads a process group we would have created.
+     */
+    private sweepOrphans;
+    private otherServingWorkspace;
+    private deploy;
+    /** Bring the previous slot back after a failed swap, if there was one. */
+    private restoreSlot;
+    /** The request's own verdict, plus what is actually serving now. */
+    private withServing;
+    private fail;
+    private syncSlot;
+    private runStep;
+    private spawnServer;
+    private waitReady;
+    /** Stop the process GROUP this module spawned — by its exact leader PID. */
+    private killChild;
+}
+/** Any HTTP answer on 127.0.0.1:port counts as "up". */
+export declare function probeOnce(port: number, timeoutMs?: number): Promise<boolean>;