@wular/coder 0.5.0 → 0.5.1

package/dist/{tools-DNgEptor.js → tools-Ck-ZWtmB.js}

@@ -1 +1 @@
-import{d as e}from"./args-CJsHYWbt.js";import{command as t}from"./cli.js";const n=t({name:`tools`,description:`serve a task's tools over stdio`,access:`write`,args:{tools:e(`the tools to serve: review, reply, react, history`)},globalFlags:{json:!1,cwd:!1},cli:{positional:[`tools`]},mcp:!1,async run({args:e}){let{taskApp:t,taskTools:n}=await import(`./tools-oQvFAnh5.js`).then(e=>e.i),{serve:r}=await import(`./serve-DoYbHm_k.js`),i=e.flat(),a=i.find(e=>!t.commands?.some(t=>t.name===e));if(a)throw Error(`Unknown task tool "${a}"`);await(await r(n(i),`stdio`)).done}});export{n as commandTools};
+import{d as e}from"./args-CJsHYWbt.js";import{command as t}from"./cli.js";const n=t({name:`tools`,description:`serve a task's tools over stdio`,access:`write`,args:{tools:e(`the tools to serve: review, reply, react, history`)},globalFlags:{json:!1,cwd:!1},cli:{positional:[`tools`]},mcp:!1,async run({args:e}){let{taskApp:t,taskTools:n}=await import(`./tools-DVtBtED6.js`).then(e=>e.i),{serve:r}=await import(`./serve-DoYbHm_k.js`),i=e.flat(),a=i.find(e=>!t.commands?.some(t=>t.name===e));if(a)throw Error(`Unknown task tool "${a}"`);await(await r(n(i),`stdio`)).done}});export{n as commandTools};

package/dist/{tools-oQvFAnh5.js → tools-DVtBtED6.js}

@@ -1 +1 @@
-import{C as e,Ea as t,T as n,ba as r,d as i,h as a,j as o,t as s,u as c,va as l}from"./args-CJsHYWbt.js";import{a as u}from"./state-Br-Fuaxg.js";import{E as d}from"./dispatch-BaW2X6Sc.js";import{g as f}from"./approvals-CRwkc9vB.js";import{f as p}from"./view-D-rbQ1Kz.js";import{a as m}from"./async-CNhQ4wyZ.js";import h from"node:path";import g from"node:process";import{randomUUID as _}from"node:crypto";import v from"node:fs/promises";async function y(e,t,n=fetch){let r=g.env.CODER_REPLY_URL,i=g.env.CODER_REPLY_TOKEN;if(!r||!i)throw Error(`This task has no conversation to post to`);let a=JSON.stringify({id:_(),...t});for(let t=0;;t++){let o;try{o=await n(`${r}/${e}`,{method:`POST`,headers:{authorization:`Bearer ${i}`,"content-type":`application/json`},body:a,signal:AbortSignal.timeout(6e4)})}catch(e){if(t<2)continue;throw e}let s=await o.json().catch(()=>void 0);if(!o.ok)throw Error(s?.error??`The conversation ${e} failed (${o.status})`);return{ok:!0}}}async function b(){let e=g.env.CODER_HISTORY_TASK;if(!e)throw Error(`CODER_HISTORY_TASK is not set`);return{file:e,task:JSON.parse(await v.readFile(e,`utf8`))}}const x=[r({name:`reply`,description:`Post a reply now, such as before longer work. Never repeat text you already posted or will put in your final message.`,args:{text:s(o(),`Markdown to post.`)},access:`write`,run:async({text:e},t)=>{let{file:n,task:r}=await b();if(!r.conversation)throw Error(`Only conversation tasks can reply`);if(typeof e!=`string`||!e.trim())throw Error(`Reply text is required`);let i=await y(`reply`,{text:e.trim()},t.fetch);return u(h.dirname(n),{kind:`reply`,message:e.trim()}),i}}),r({name:`react`,description:`React to a message in this conversation with an emoji, by default the one that started your turn.`,args:{emoji:s(o(),`An emoji name such as thumbsup, or the emoji itself.`),message:c(`A message id from the conversation.`)},access:`write`,run:async({emoji:e,message:t},n)=>{let{task:r}=await b();if(!r.conversation)throw Error(`Only conversation tasks can react`);if(typeof e!=`string`||!e.trim())throw Error(`Emoji is required`);if(t!==void 0&&(typeof t!=`string`||!t.trim()))throw Error(`Message id must be a non-empty string`);let i=p(r.currentPrompt??r.prompt??``,!0)?.[0],a=t??i?.message?.id??i?.messages?.[0]?.id;if(i&&!a)throw Error(`This turn has no message to react to; give a message id`);return y(`react`,{emoji:e.trim(),...a?{message:a}:{}},n.fetch)}}),r({name:`history`,description:[`Search or read your own earlier turns in this task, including anything compacted out of your context, oldest first.`,"With query, the messages containing that exact text; without, the messages from `from` on.",`An event's message.index counts from 0; when your history starts later, read earlier messages with the platform's tools when they matter.`,`Messages from bots never arrive as turns; the platform's tools read the thread itself, theirs included.`].join(` `),args:{query:c(`Exact text to find, case-insensitive, 1 to 500 characters: a word or phrase from the message, not a question.`),from:s(n(e()),`Message index to start at; default the oldest, or after the last match.`),limit:s(n(e()),`Messages to return, 1 to 20; default 10.`),role:s(n(a([`all`,`conversation`])),`conversation: only platform messages and your replies; all (default): tool calls and results too.`)},access:`read`,run:async e=>d((await b()).task,e)})];var S=t({asyncTools:()=>w,taskApp:()=>D,taskTools:()=>O});const C={name:`review`,flow:`review`,limit:5,platform:`github`,args:(e,t,n)=>({...e.pr===void 0?{base:e.base??`HEAD`}:{pr:e.pr,post:!0,...n?{author:n}:{}},...e.path?.length?{path:e.path}:{},...e.exclude?.length?{exclude:e.exclude}:{},...e.depth?{depth:e.depth}:{},cwd:t}),render:async(e,t)=>{let{renderReviewMarkdown:n}=await import(`./flow/builtin/review/index.js`);return n({...e,runId:t})}},w=[C],T=[...w.map(e=>e.name),`escalate`];function E(){let e=g.env.CODER_HISTORY_TASK;if(!e)throw Error(`CODER_HISTORY_TASK is not set`);return h.dirname(e)}const D=l({name:`task`,description:`This task's own tools.`,commands:[r({name:`escalate`,description:[`Ask a human to approve actions your environment refused.`,`Actions outside the sandbox are reviewed and may be refused; then take another way.`,`If the task truly needs refused actions, escalate them all in one call with the exact commands, then continue or end your turn.`,`The decision arrives as a message, in this turn while it runs, else in a new one.`,`Approved actions stay approved for the rest of the task; run them outside the sandbox directly.`].join(` `),args:{reason:c(`One short sentence: what the actions are for.`),actions:i(`Each action is exactly the command you will run once approved, nothing added; notes go in reason.`)},access:`read`,run:({reason:e,actions:t})=>{let n=(t??[]).map(e=>e.trim()).filter(Boolean);if(!e?.trim()||!n.length)throw Error(`reason and actions are required`);let r=E();return{approvalId:f(g.cwd(),h.basename(r),r,{reason:e.trim(),actions:n}).id,status:`pending`}}}),r({name:`review`,description:`Review your changes with a separate read-only reviewer that checks each finding against the repository. One review at a time, ${C.limit} per turn.`,args:{pr:s(n(e()),`A pull request to review and post the review on.`),base:c(`The ref to compare with; default HEAD, so only uncommitted changes.`),path:i(`Review only these paths, relative to the task directory.`),exclude:i(`Leave these paths out.`),depth:s(n(a([`low`,`medium`,`high`])),`What to report: low only critical and major defects, high nits too; medium by default.`),timeout:s(n(e()),`Stop the review after this many seconds.`)},access:`read`,run:async({timeout:e,...t})=>({runId:await m(E(),C,t,e),status:`started`})}),...x]});function O(e){let t=e.filter(e=>T.includes(e));return{...D,...t.length?{instructions:[`${t.join(` and `)} ${t.length>1?`return`:`returns`} at once;`,`the result arrives later as a message, in a new turn if yours has ended.`].join(` `)}:{},commands:D.commands.filter(t=>e.includes(t.name))}}export{S as i,D as n,O as r,w as t};
+import{C as e,Ea as t,T as n,ba as r,d as i,h as a,j as o,t as s,u as c,va as l}from"./args-CJsHYWbt.js";import{a as u}from"./state-CxAUec80.js";import{E as d}from"./dispatch-BkoIU4GU.js";import{g as f}from"./approvals-C8XV7CK2.js";import{f as p}from"./view-D-rbQ1Kz.js";import{a as m}from"./async-BS9tyhva.js";import h from"node:path";import g from"node:process";import{randomUUID as _}from"node:crypto";import v from"node:fs/promises";async function y(e,t,n=fetch){let r=g.env.CODER_REPLY_URL,i=g.env.CODER_REPLY_TOKEN;if(!r||!i)throw Error(`This task has no conversation to post to`);let a=JSON.stringify({id:_(),...t});for(let t=0;;t++){let o;try{o=await n(`${r}/${e}`,{method:`POST`,headers:{authorization:`Bearer ${i}`,"content-type":`application/json`},body:a,signal:AbortSignal.timeout(6e4)})}catch(e){if(t<2)continue;throw e}let s=await o.json().catch(()=>void 0);if(!o.ok)throw Error(s?.error??`The conversation ${e} failed (${o.status})`);return{ok:!0}}}async function b(){let e=g.env.CODER_HISTORY_TASK;if(!e)throw Error(`CODER_HISTORY_TASK is not set`);return{file:e,task:JSON.parse(await v.readFile(e,`utf8`))}}const x=[r({name:`reply`,description:`Post a reply now, such as before longer work. Never repeat text you already posted or will put in your final message.`,args:{text:s(o(),`Markdown to post.`)},access:`write`,run:async({text:e},t)=>{let{file:n,task:r}=await b();if(!r.conversation)throw Error(`Only conversation tasks can reply`);if(typeof e!=`string`||!e.trim())throw Error(`Reply text is required`);let i=await y(`reply`,{text:e.trim()},t.fetch);return u(h.dirname(n),{kind:`reply`,message:e.trim()}),i}}),r({name:`react`,description:`React to a message in this conversation with an emoji, by default the one that started your turn.`,args:{emoji:s(o(),`An emoji name such as thumbsup, or the emoji itself.`),message:c(`A message id from the conversation.`)},access:`write`,run:async({emoji:e,message:t},n)=>{let{task:r}=await b();if(!r.conversation)throw Error(`Only conversation tasks can react`);if(typeof e!=`string`||!e.trim())throw Error(`Emoji is required`);if(t!==void 0&&(typeof t!=`string`||!t.trim()))throw Error(`Message id must be a non-empty string`);let i=p(r.currentPrompt??r.prompt??``,!0)?.[0],a=t??i?.message?.id??i?.messages?.[0]?.id;if(i&&!a)throw Error(`This turn has no message to react to; give a message id`);return y(`react`,{emoji:e.trim(),...a?{message:a}:{}},n.fetch)}}),r({name:`history`,description:[`Search or read your own earlier turns in this task, including anything compacted out of your context, oldest first.`,"With query, the messages containing that exact text; without, the messages from `from` on.",`An event's message.index counts from 0; when your history starts later, read earlier messages with the platform's tools when they matter.`,`Messages from bots never arrive as turns; the platform's tools read the thread itself, theirs included.`].join(` `),args:{query:c(`Exact text to find, case-insensitive, 1 to 500 characters: a word or phrase from the message, not a question.`),from:s(n(e()),`Message index to start at; default the oldest, or after the last match.`),limit:s(n(e()),`Messages to return, 1 to 20; default 10.`),role:s(n(a([`all`,`conversation`])),`conversation: only platform messages and your replies; all (default): tool calls and results too.`)},access:`read`,run:async e=>d((await b()).task,e)})];var S=t({asyncTools:()=>w,taskApp:()=>D,taskTools:()=>O});const C={name:`review`,flow:`review`,limit:5,platform:`github`,args:(e,t,n)=>({...e.pr===void 0?{base:e.base??`HEAD`}:{pr:e.pr,...n?{post:!0,author:n}:{}},...e.path?.length?{path:e.path}:{},...e.exclude?.length?{exclude:e.exclude}:{},...e.depth?{depth:e.depth}:{},cwd:t}),render:async(e,t)=>{let{renderReviewMarkdown:n}=await import(`./flow/builtin/review/index.js`),r=e,i=n({...r,runId:t});return r.summary.url?`${i}\nThe review is on the pull request, so a reply repeating it adds nothing. Still answer anything else asked.\n`:r.pr?`${i}\nNot posted. To post it on the pull request as the user, escalate \`coder review --post --run ${t}\`.\n`:i}},w=[C],T=[...w.map(e=>e.name),`escalate`];function E(){let e=g.env.CODER_HISTORY_TASK;if(!e)throw Error(`CODER_HISTORY_TASK is not set`);return h.dirname(e)}const D=l({name:`task`,description:`This task's own tools.`,commands:[r({name:`escalate`,description:[`Ask a human to approve actions your environment refused.`,`Actions outside the sandbox are reviewed and may be refused; then take another way.`,`If the task truly needs refused actions, escalate them all in one call with the exact commands, then continue or end your turn.`,`The decision arrives as a message, in this turn while it runs, else in a new one.`,`Approved actions stay approved for the rest of the task; run them outside the sandbox directly.`].join(` `),args:{reason:c(`One short sentence: what the actions are for.`),actions:i(`Each action is exactly the command you will run once approved, nothing added; notes go in reason.`)},access:`read`,run:({reason:e,actions:t})=>{let n=(t??[]).map(e=>e.trim()).filter(Boolean);if(!e?.trim()||!n.length)throw Error(`reason and actions are required`);let r=E();return{approvalId:f(g.cwd(),h.basename(r),r,{reason:e.trim(),actions:n}).id,status:`pending`}}}),r({name:`review`,description:`Review changes with a read-only reviewer. One at a time, ${C.limit} per turn.`,args:{pr:s(n(e()),`A pull request to review. Posts the review (summary + findings) and a check, so do not announce or repeat them.`),base:c(`The ref to compare with; default HEAD, so only uncommitted changes.`),path:i(`Review only these paths, relative to the task directory.`),exclude:i(`Leave these paths out.`),depth:s(n(a([`low`,`medium`,`high`])),`What to report: low only critical and major defects, high nits too; medium by default.`),timeout:s(n(e()),`Stop the review after this many seconds.`)},access:`read`,run:async({timeout:e,...t})=>({runId:await m(E(),C,t,e),status:`started`})}),...x]});function O(e){let t=e.filter(e=>T.includes(e));return{...D,...t.length?{instructions:[`${t.join(` and `)} ${t.length>1?`return`:`returns`} at once;`,`the result arrives later as a message, in a new turn if yours has ended.`].join(` `)}:{},commands:D.commands.filter(t=>e.includes(t.name))}}export{S as i,D as n,O as r,w as t};

package/dist/{tools-search-D1zArRyJ.js → tools-search-BNDea9vZ.js}

@@ -1 +1 @@
-import{command as e}from"./cli.js";const t=e({name:`tools-search`,description:`serve a turn's tool search over stdio`,access:`write`,globalFlags:{json:!1,cwd:!1},mcp:!1,async run(){let{serveToolSearch:e}=await import(`./tool-search-BkdgVolu.js`).then(e=>e.r),{serverCredential:t}=await import(`./mcp-BGam3G_B.js`);await e({credential:e=>t(e),localCredential:async(e,t)=>{let{localConnectionToken:n}=await import(`./connections-Cswv7r8Z.js`).then(e=>e.m);return n(e.connection??e.name,t)}})}});export{t as commandToolsSearch};
+import{command as e}from"./cli.js";const t=e({name:`tools-search`,description:`serve a turn's tool search over stdio`,access:`write`,globalFlags:{json:!1,cwd:!1},mcp:!1,async run(){let{serveToolSearch:e}=await import(`./tool-search-C9Ty3hhL.js`).then(e=>e.r),{serverCredential:t}=await import(`./mcp-Caq72REF.js`);await e({credential:e=>t(e),localCredential:async(e,t)=>{let{localConnectionToken:n}=await import(`./connections-B90TemYf.js`).then(e=>e.m);return n(e.connection??e.name,t)}})}});export{t as commandToolsSearch};

package/dist/{turn-Cc-v-eSy.js → turn-eI4iRPsq.js}

@@ -1,3 +1,3 @@
-import{Sa as e,_a as t,ya as n}from"./args-CJsHYWbt.js";import{d as r}from"./approvals-CRwkc9vB.js";function i(e){let t=e.chat?.message;if(!t)return{text:e.text,author:{id:e.actor.id,...e.actor.login?{handle:e.actor.login}:{}}};let{author:n,metadata:r}=t;return{id:t.id,thread:e.chat.thread.id,...e.conversation?.index===void 0?{}:{index:e.conversation.index},text:e.text,...t.isMention?{mention:!0}:{},author:{id:n.userId,handle:n.userName,name:n.fullName,...n.isBot?{bot:!0}:{}},sentAt:r.dateSent,...r.edited?{edited:!0}:{},...t.attachments.length?{attachments:t.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}:{},...t.links?.length?{links:t.links.map(({url:e,title:t})=>({url:e,...t?{title:t}:{}}))}:{}}}function a(e,t){let n=e.at(-1),r=n.chat?.thread,a=e.some(e=>e.mustReply),o=new Set(e.flatMap(e=>e.chat?.message?.id??[])),s=e.flatMap(e=>e.conversation?.since??[]).filter(({id:e,...t})=>{let n=e??JSON.stringify(t);return!o.has(n)&&!!o.add(n)}),c=s.slice(0,50),l=e.reduce((e,t)=>e+(t.conversation?.more??0),0)+s.length-c.length;return{handle:n.integration,event:n.type,...n.mustReply===void 0&&e.length===1?{}:{mustReply:a},...n.repo?{repository:`${n.repo.owner}/${n.repo.name}`}:{},...r?{conversation:{id:r.id,dm:r.isDM,...r.channelVisibility?{visibility:r.channelVisibility}:{}}}:{},...e.length===1?{message:i(n)}:{messages:e.map(i)},...c.length?{since:c}:{},...l?{more:l}:{},...t?{requester:{name:t.name}}:{}}}function o(r,i){return n(e(`event`,{children:e(t,{children:JSON.stringify(a(r,i))})}))}function s(r,i){let{message:o,...s}=a([r]),c={...s,event:`reactions`,mustReply:!1,reactions:i};return n(e(`event`,{children:e(t,{children:JSON.stringify(c)})}))}function c(e,t,n){if(!t)return e;let r=n===void 0?``:`\n**Pull request:** ${t.owner}/${t.name}#${n}`;return`**Repo:** ${t.owner}/${t.name}${r}\n\n${e}`}function l(r,i){return r.length?`${n(e(`history`,{children:e(t,{children:r.map(e=>`${e.user}: ${e.text}`).join(`
+import{Sa as e,_a as t,ya as n}from"./args-CJsHYWbt.js";import{d as r}from"./approvals-C8XV7CK2.js";function i(e){let t=e.chat?.message;if(!t)return{text:e.text,author:{id:e.actor.id,...e.actor.login?{handle:e.actor.login}:{}}};let{author:n,metadata:r}=t;return{id:t.id,thread:e.chat.thread.id,...e.conversation?.index===void 0?{}:{index:e.conversation.index},text:e.text,...t.isMention?{mention:!0}:{},author:{id:n.userId,handle:n.userName,name:n.fullName,...n.isBot?{bot:!0}:{}},sentAt:r.dateSent,...r.edited?{edited:!0}:{},...t.attachments.length?{attachments:t.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}:{},...t.links?.length?{links:t.links.map(({url:e,title:t})=>({url:e,...t?{title:t}:{}}))}:{}}}function a(e,t){let n=e.at(-1),r=n.chat?.thread,a=e.some(e=>e.mustReply),o=new Set(e.flatMap(e=>e.chat?.message?.id??[])),s=e.flatMap(e=>e.conversation?.since??[]).filter(({id:e,...t})=>{let n=e??JSON.stringify(t);return!o.has(n)&&!!o.add(n)}),c=s.slice(0,50),l=e.reduce((e,t)=>e+(t.conversation?.more??0),0)+s.length-c.length;return{handle:n.integration,event:n.type,...n.mustReply===void 0&&e.length===1?{}:{mustReply:a},...n.repo?{repository:`${n.repo.owner}/${n.repo.name}`}:{},...r?{conversation:{id:r.id,dm:r.isDM,...r.channelVisibility?{visibility:r.channelVisibility}:{}}}:{},...e.length===1?{message:i(n)}:{messages:e.map(i)},...c.length?{since:c}:{},...l?{more:l}:{},...t?{requester:{name:t.name}}:{}}}function o(r,i){return n(e(`event`,{children:e(t,{children:JSON.stringify(a(r,i))})}))}function s(r,i){let{message:o,...s}=a([r]),c={...s,event:`reactions`,mustReply:!1,reactions:i};return n(e(`event`,{children:e(t,{children:JSON.stringify(c)})}))}function c(e,t,n){if(!t)return e;let r=n===void 0?``:`\n**Pull request:** ${t.owner}/${t.name}#${n}`;return`**Repo:** ${t.owner}/${t.name}${r}\n\n${e}`}function l(r,i){return r.length?`${n(e(`history`,{children:e(t,{children:r.map(e=>`${e.user}: ${e.text}`).join(`
 `)})}))}\n\n${i}`:i}function u(i,a){let o=i?.turns??[],s=o.at(-2)?.finishedAt??0,c=(i?.approvals??[]).filter(e=>e.change&&o.length>0&&(e.response?.decision===`accept`||e.response?.decision===`decline`)&&Date.parse(e.response.answeredAt??``)>=s);return c.length?`${n(e(`decisions`,{children:e(t,{children:c.map(r).join(`
 `)})}))}\n\n${a}`:a}export{c as a,s as i,o as n,l as r,u as t};

package/dist/{update-check-UyRob3yy.js → update-check-Bap3dwaj.js}

@@ -1 +1 @@
-import{Ea as e}from"./args-CJsHYWbt.js";import{f as t}from"./state-Br-Fuaxg.js";import n from"node:process";import r from"node:fs";import{spawn as i}from"node:child_process";var a=e({PM_COMMANDS:()=>c,clearUpdateCache:()=>p,compareVersions:()=>u,detectPackageManager:()=>g,newerVersion:()=>m,refreshUpdateCache:()=>h});const o=`@wular/coder`,s=`https://registry.npmjs.org/${o}/latest`,c={npm:[`npm`,`install`,`-g`,`${o}@latest`],pnpm:[`pnpm`,`add`,`-g`,`${o}@latest`],yarn:[`yarn`,`global`,`add`,`${o}@latest`],bun:[`bun`,`add`,`-g`,`${o}@latest`]};function l(){return t(`update-check.json`)}function u(e,t){let n=String(e).split(`.`).map(e=>parseInt(e,10)||0),r=String(t).split(`.`).map(e=>parseInt(e,10)||0);for(let e=0;e<3;e+=1){if((n[e]??0)>(r[e]??0))return 1;if((n[e]??0)<(r[e]??0))return-1}return 0}function d(){try{return JSON.parse(r.readFileSync(l(),`utf8`))}catch{return null}}function f(e){try{r.mkdirSync(t(),{recursive:!0}),r.writeFileSync(l(),JSON.stringify(e))}catch{}}function p(){try{r.rmSync(l(),{force:!0})}catch{}}function m(e,t){if(n.env.CODER_NO_UPDATE_CHECK||n.env.CI)return;let r=d();if(!r?.checkedAt||Date.now()-r.checkedAt>864e5)try{i(n.execPath,[t,`upgrade`,`refresh`],{detached:!0,stdio:`ignore`}).unref()}catch{}return r?.latest&&u(r.latest,e)>0?r.latest:void 0}async function h(e){let t=d()?.latest??null;try{let e=await fetch(s,{signal:AbortSignal.timeout(3e3),headers:{accept:`application/json`}});if(e.ok){let n=await e.json();n?.version&&(t=n.version)}}catch{}f({checkedAt:Date.now(),latest:t,current:e})}function g(e){let t=e;try{t=r.realpathSync(e)}catch{}let n=t.replace(/\\/g,`/`);return/\/\.bun\//.test(n)?{pm:`bun`,command:c.bun}:/\/\.pnpm\//.test(n)||/\/pnpm(-global)?\//i.test(n)||/\/Library\/pnpm\//.test(n)?{pm:`pnpm`,command:c.pnpm}:/\/\.config\/yarn\/global\//.test(n)||/\/yarn\/global\//.test(n)||/\/Yarn\/Data\/global\//.test(n)?{pm:`yarn`,command:c.yarn}:{pm:`npm`,command:c.npm}}export{h as a,g as i,p as n,a as o,u as r,c as t};
+import{Ea as e}from"./args-CJsHYWbt.js";import{f as t}from"./state-CxAUec80.js";import n from"node:process";import r from"node:fs";import{spawn as i}from"node:child_process";var a=e({PM_COMMANDS:()=>c,clearUpdateCache:()=>p,compareVersions:()=>u,detectPackageManager:()=>g,newerVersion:()=>m,refreshUpdateCache:()=>h});const o=`@wular/coder`,s=`https://registry.npmjs.org/${o}/latest`,c={npm:[`npm`,`install`,`-g`,`${o}@latest`],pnpm:[`pnpm`,`add`,`-g`,`${o}@latest`],yarn:[`yarn`,`global`,`add`,`${o}@latest`],bun:[`bun`,`add`,`-g`,`${o}@latest`]};function l(){return t(`update-check.json`)}function u(e,t){let n=String(e).split(`.`).map(e=>parseInt(e,10)||0),r=String(t).split(`.`).map(e=>parseInt(e,10)||0);for(let e=0;e<3;e+=1){if((n[e]??0)>(r[e]??0))return 1;if((n[e]??0)<(r[e]??0))return-1}return 0}function d(){try{return JSON.parse(r.readFileSync(l(),`utf8`))}catch{return null}}function f(e){try{r.mkdirSync(t(),{recursive:!0}),r.writeFileSync(l(),JSON.stringify(e))}catch{}}function p(){try{r.rmSync(l(),{force:!0})}catch{}}function m(e,t){if(n.env.CODER_NO_UPDATE_CHECK||n.env.CI)return;let r=d();if(!r?.checkedAt||Date.now()-r.checkedAt>864e5)try{i(n.execPath,[t,`upgrade`,`refresh`],{detached:!0,stdio:`ignore`}).unref()}catch{}return r?.latest&&u(r.latest,e)>0?r.latest:void 0}async function h(e){let t=d()?.latest??null;try{let e=await fetch(s,{signal:AbortSignal.timeout(3e3),headers:{accept:`application/json`}});if(e.ok){let n=await e.json();n?.version&&(t=n.version)}}catch{}f({checkedAt:Date.now(),latest:t,current:e})}function g(e){let t=e;try{t=r.realpathSync(e)}catch{}let n=t.replace(/\\/g,`/`);return/\/\.bun\//.test(n)?{pm:`bun`,command:c.bun}:/\/\.pnpm\//.test(n)||/\/pnpm(-global)?\//i.test(n)||/\/Library\/pnpm\//.test(n)?{pm:`pnpm`,command:c.pnpm}:/\/\.config\/yarn\/global\//.test(n)||/\/yarn\/global\//.test(n)||/\/Yarn\/Data\/global\//.test(n)?{pm:`yarn`,command:c.yarn}:{pm:`npm`,command:c.npm}}export{h as a,g as i,p as n,a as o,u as r,c as t};

package/dist/{views-3TxH367C.js → views-Bxm_5J6T.js}

@@ -1,2 +1,2 @@
-import{T as e,j as t,w as n}from"./args-CJsHYWbt.js";import{a as r,i,o as a,s as o}from"./integrations-BVmsk64f.js";const s=e=>({type:`mrkdwn`,text:e}),c=e=>({type:`plain_text`,text:e}),l=e=>({type:`section`,text:s(e.length>3e3?`${e.slice(0,2999)}…`:e)}),u=e=>e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`),d=({id:e,url:t,label:n,primary:r})=>({type:`button`,action_id:`${a}${e}`,text:{type:`plain_text`,text:n},url:t,...r?{style:`primary`}:{}}),f=(e,t)=>l([`*${u(e)}*`,t&&u(t)].filter(Boolean).join(`
+import{T as e,j as t,w as n}from"./args-CJsHYWbt.js";import{a as r,i,o as a,s as o}from"./integrations-DSZSa8Rc.js";const s=e=>({type:`mrkdwn`,text:e}),c=e=>({type:`plain_text`,text:e}),l=e=>({type:`section`,text:s(e.length>3e3?`${e.slice(0,2999)}…`:e)}),u=e=>e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`),d=({id:e,url:t,label:n,primary:r})=>({type:`button`,action_id:`${a}${e}`,text:{type:`plain_text`,text:n},url:t,...r?{style:`primary`}:{}}),f=(e,t)=>l([`*${u(e)}*`,t&&u(t)].filter(Boolean).join(`
 `));function p({title:e,text:t,sections:n,links:r},i){return[f(e,t),...n.map(e=>({...f(e.title,e.text),...e.link?{accessory:d(e.link)}:{}})),...i?[{type:`divider`}]:[],{type:`actions`,elements:r.map(d)}]}async function m(e,t){let n=await e.home?.(t);!n||!e.installationId||await o(`views.publish`,{user_id:t,view:{type:`home`,blocks:p(n,!0)}},await e.token(e.installationId),e.fetch)}async function h(e,t,n){e.installationId&&await o(`chat.postMessage`,{channel:t,text:n.title,blocks:p(n),unfurl_links:!1,unfurl_media:!1},await e.token(e.installationId),e.fetch)}function g(e){let[,t=``,n=``]=/^slack:([^:]+):?(.*)$/.exec(e)??[];return{channel:t,...n?{thread_ts:n}:{}}}function _(e){return u(e).replace(/\*\*([^*\n]+)\*\*/g,`*$1*`).replace(/\[([^\]]+)\]\((https?:[^)\s]+)\)/g,`<$2|$1>`)}const v=e=>e.length>200?`${e.slice(0,199)}…`:e;function y({markdown:e,card:t,collapsed:n,buttons:a=[],hint:o,link:u}){let f=[...a.map((e,t)=>({type:`button`,action_id:`${e.ask?i:r}${t}`,text:{type:`plain_text`,text:e.label},value:e.ask?JSON.stringify({value:e.value,label:e.label,ask:e.ask}):e.value,...e.style?{style:e.style}:{},...e.confirm?{confirm:{title:{type:`plain_text`,text:`${e.label}?`},text:{type:`plain_text`,text:e.confirm.slice(0,300)},confirm:{type:`plain_text`,text:e.label},deny:{type:`plain_text`,text:`Cancel`}}}:{}})),...u?[d({id:`open`,...u})]:[]],p=n?.items&&n.items.length<=50?n.items:void 0,m=t?.outcome?{success:`complete`,failure:`error`}[t.outcome]:`pending`;return[t?{type:`card`,title:c(t.title),body:c(v(t.body)),...t.status?{subtext:s(v(_(t.status)))}:{},...f.length?{actions:f}:{}}:l(_(e)),...n?[p?{type:`plan`,block_id:`plan-${crypto.randomUUID()}`,title:n.summary,tasks:p.map((e,t)=>({task_id:`task-${t+1}`,title:e,status:m}))}:{...l(_(`**${n.summary}**\n${n.markdown}`)),expand:!1}]:[],...f.length&&!t?[{type:`actions`,elements:f}]:[],...o?[{type:`context`,elements:[s(_(o))]}]:[]]}const b=n({value:t(),label:t(),ask:n({label:t(),placeholder:e(t())})});async function x(e,t,n,r){let i=b.parse(JSON.parse(r));e.installationId&&await o(`views.open`,{trigger_id:t,view:{type:`modal`,callback_id:`ask`,title:c(i.label.slice(0,24)),submit:c(i.label.slice(0,24)),close:c(`Cancel`),private_metadata:JSON.stringify({...n,value:i.value}),blocks:[{type:`input`,block_id:`ask`,optional:!0,label:c(i.ask.label),element:{type:`plain_text_input`,action_id:`ask`,multiline:!0,focus_on_load:!0,...i.ask.placeholder?{placeholder:c(i.ask.placeholder)}:{}}}]}},await e.token(e.installationId),e.fetch)}async function S({ctx:e,thread:t},n){return(await o(`chat.postMessage`,{...g(t.id),text:n.markdown,blocks:y(n),unfurl_links:!1,unfurl_media:!1},await e.token(e.installationId),e.fetch)).ts}async function C({ctx:e,thread:t},n,r){await o(`chat.update`,{channel:g(t.id).channel,ts:n,text:r.markdown,blocks:y(r)},await e.token(e.installationId),e.fetch)}export{h as directMessage,C as editMessage,x as openAsk,S as postMessage,m as publishHome};

package/dist/{worker-BMuKKiIa.js → worker-DJANNSCT.js}

@@ -1 +1 @@
-import{u as e}from"./args-CJsHYWbt.js";import{i as t}from"./output-BKeyLbvt.js";import{command as n}from"./cli.js";import{T as r}from"./state-Br-Fuaxg.js";const i=n({name:`worker`,description:`run a task's turns, detached`,access:`write`,args:{"task-id":e()},globalFlags:{json:!1},cli:{positional:[`task-id`]},mcp:!1,async run({args:[e],cwd:n}){let{runWorker:i}=await import(`./worker-CIHY9L42.js`),a=r(n,e);a||t(`Worker: task ${e} not found.`),await i(n,a),process.exit(0)}});export{i as commandWorker};
+import{u as e}from"./args-CJsHYWbt.js";import{i as t}from"./output-BKeyLbvt.js";import{command as n}from"./cli.js";import{T as r}from"./state-CxAUec80.js";const i=n({name:`worker`,description:`run a task's turns, detached`,access:`write`,args:{"task-id":e()},globalFlags:{json:!1},cli:{positional:[`task-id`]},mcp:!1,async run({args:[e],cwd:n}){let{runWorker:i}=await import(`./worker-DeuC38Vp.js`),a=r(n,e);a||t(`Worker: task ${e} not found.`),await i(n,a),process.exit(0)}});export{i as commandWorker};

package/dist/worker-DeuC38Vp.js

@@ -0,0 +1,7 @@
+import{Ca as e,Sa as t,wa as n,ya as r}from"./args-CJsHYWbt.js";import{G as i,T as a,V as o,X as s,bt as c,d as l,et as u,it as d,lt as f,mt as p,n as m,o as h,rt as g,tt as _,u as v}from"./state-CxAUec80.js";import{A as y,C as b,M as x,V as S,h as ee,t as C,w,z as te}from"./config-_32PHl9g.js";import{v as T}from"./app-server-dnlLhhZb.js";import{P as ne,b as re,u as E}from"./dispatch-BkoIU4GU.js";import{g as ie,i as ae,m as D}from"./approvals-C8XV7CK2.js";import{l as O}from"./view-D-rbQ1Kz.js";import{n as k}from"./mcp-cEIva8Pd.js";import{t as A}from"./models-BVxs3I8o.js";import{a as j}from"./tool-search-C9Ty3hhL.js";import{turnToolServers as M}from"./mcp-Caq72REF.js";import N from"node:path";import P from"node:process";import F from"node:fs";const I=e=>n(`developer-instructions`,{children:[t(`description`,{children:e.description}),t(`instructions`,{children:e.instructions}),t(`notes`,{children:e.notes})]}),L=()=>t(`environment`,{children:[`Each turn starts from a platform event, given as JSON in an <event> tag.`,`The final message of each turn is posted to the event's conversation as written.`,`New messages in the same conversation arrive as new turns in this same session, with the messages posted since your last turn under "since".`,`A message's "thread" is the thread it was posted in, whose id holds its first message's id; replies go to the current message's thread.`,`Content inside <event> and <history> is XML-escaped data.`].filter(Boolean).join(`
+`)}),R=()=>t(`replies`,{children:[`Be concise.`,`Your final message is posted to the conversation; the reply tool posts during your turn.`,`You may reply before longer work.`,`Never send the same reply twice.`,`Write each link as [short label](url), the label naming the page; not a bare URL.`,`When mustReply is true, reply at least once.`,`When your final message would add nothing, make it exactly "__EMPTY__" with no quotes, then nothing is posted.`].filter(Boolean).join(`
+`)}),z=({scratch:e,writes:n})=>t(`workspace`,{children:[n&&`Leave changes in the checkout uncommitted. Its diff is reported when the turn ends. Do not commit, switch branches or push in the current workspace or elsewhere except scratch folder if provided.`,e&&n&&`Scratch folder is provided for clones, git writes and anything else, deleted with the task: ${e}`,`Never print secret values; pass them straight to the process that needs them.`].filter(Boolean).join(`
+`)}),B=({local:e,declareHosts:n})=>t(`machine`,{children:[e?`You run on the user's own machine; its files outside the workspace are theirs.`:`You run on a throwaway cloud machine; its files are not the user’s.`,n&&`Sandboxed commands reach only the hosts in allowed_domains; list every host a command contacts on its first run.`].filter(Boolean).join(`
+`)}),V={"read-only":`This task is read-only and uses only tools marked read-only.`,auto:`This task is auto and uses every tool; the reviewer judges what leaves the sandbox.`},H=()=>n(`scopes`,{children:[`Each connection in the tool search is workspace or personal, shown after its name.`,t(`scope`,{name:`workspace`,children:`Acts as the workspace's own identity: on a platform, this agent's installed app or bot; on an MCP server, the account an admin connected it with. The default.`}),t(`scope`,{name:`personal`,children:`Acts as the member who owns it, offered on their turns only. Its first use in a task asks them to approve.`}),`Use a personal server only to act as the person or for what only their account reaches, such as Slack search. With none for that platform, never use the workspace server as them; give them the connection/add link. More: load_skill connections.`]}),U=({conversation:e,local:n,writes:r})=>t(`runtime`,{children:[!e&&r&&(n?`Do the work yourself; do not load the coder skill or dispatch Coder tasks.`:`Do the work yourself; do not dispatch Coder tasks.`),`Your turn ends with your final message; verify your work before it.${e?``:` ${f}`}`,e&&n&&`Do not load the coder skill.`].filter(Boolean).join(`
+`)}),oe=r=>n(e,{children:[t(L,{}),t(R,{}),r.platform&&t(`platform`,{name:r.platform.name,children:r.platform.prompt})]}),W=r=>n(e,{children:[t(z,{...r}),!r.structured&&t(`result`,{children:`When finished, give a concise summary of what you did and found, naming the files or folders you changed.`}),t(`task-instructions`,{children:r.appendSystem})]}),G=r=>n(e,{children:[t(I,{...r.developer}),t(U,{...r}),t(B,{...r}),t(`access`,{children:r.access&&V[r.access]}),r.connections&&t(H,{}),r.conversation?t(oe,{...r}):t(W,{...r})]}),K=e=>r(t(G,{...e})),q={claude:{CLAUDE_CODE_DISABLE_AUTO_MEMORY:`1`},codex:{"features.memories":!1}};async function J(e,t,n,r={}){let i=e=>n({kind:`warning`,phase:`starting`,message:e}),a=te(t.access,t.promptParts?.access),s=await M(t,o(e,t.id),E(t.mcp,P.env,void 0,{onWarning:i}),{access:a});s.listed.length&&n({kind:`status`,phase:`starting`,message:`This turn's servers are ${s.listed.map(e=>e.name).join(`, `)}.`});let c=t.promptParts?K({...t.promptParts,...r,access:a,connections:s.listed.some(e=>j(e))}):t.systemPrompt;return{...s,systemPrompt:c}}function Y(e){P.connected&&P.send?.(e,void 0,void 0,e=>{e&&e.code!==`EPIPE`&&P.stderr.write(`coder worker: ${e.message}\n`)})}function X(e){return e.currentPrompt??e.prompt??``}async function se(e,t,n){_(e,t.id,{status:`running`,steerEndpoint:null,turnId:null,turnUsage:t.turnUsage??[]});let r=o(e,t.id),i=N.join(r,`log.jsonl`),s=p(i,F.existsSync(i)?F.statSync(i).size:0),l,u=n=>{let r=s().flatMap(e=>{let t=O(e);return t?[t]:[]}),i=r.flatMap(e=>e.message?.startsWith(`Steer accepted live:
+`)?[e.message.slice(m.length)]:[]),a=r.filter(e=>e.kind===`reply`).at(-1)?.message;return T(`worker.record.start`,{taskId:t.id,finalized:!1}),ue(e,t,n,{steers:i,lastReply:a})},f=await n(t,{onResult:e=>{!l&&e.status===0&&!e.error&&(l=u(e))}}),h=[...t.previousThreadIds??[]];f.status===0&&t.threadId&&f.threadId&&t.threadId!==f.threadId&&!h.includes(t.threadId)&&h.push(t.threadId);let g=new Date().toISOString();return T(`worker.engine.closed`,{taskId:t.id}),l??=u(f),c(N.join(r,`result.json`),JSON.parse(d(f))),T(`worker.record.start`,{taskId:t.id,finalized:!0}),_(e,t.id,{turnUsage:[...a(e,t.id)?.turnUsage??[],{at:l,tokens:f.tokens,model:f.model}],status:f.status===0?`completed`:`failed`,completedAt:g,threadId:f.threadId,resumeThreadId:f.threadId,previousThreadIds:h,steerEndpoint:null,turnId:f.turnId??null}),T(`worker.result.recorded`,{taskId:t.id,finalized:!0}),f}function Z(e,t){let n=0;return()=>{Date.now()-n>=1e4&&(n=Date.now(),s(e,t))}}function Q(e,t,{echo:n}){let r=r=>{let i=JSON.parse(d(typeof r==`string`?{message:r}:r));h(e,t,i),n&&i.message&&P.stderr.write(`[coder] ${i.message}\n`)};for(let e of Object.keys(g()))P.env[e]!==void 0&&r({kind:`warning`,message:`${e} is temporarily unavailable; skipped for this task.`});return r}async function ce(e,t,{echo:n,env:r={},onResult:a}){let o=w(e),s=Q(e,t.id,{echo:n}),c=t.model?o.models?.[t.model]:void 0,l=c&&b(c)?c:void 0;if(l&&!l.wireApi&&t.model){let n=await A(l);n&&(l={...l,...n},o.models[t.model]=l,y(e,t.model,n),h(e,t.id,{kind:`info`,message:`detected wire api for ${t.model}: ${n.wireApi} @ ${l.baseUrl}`}))}let u=C[t.access??`auto`]??C.auto,d=u.approvalMode===`auto`,f=S(t.access??`auto`,o.network),p=ee(t.access??`auto`,f),m={approvalPolicy:u.approvalPolicy,approvalsReviewer:u.approvalsReviewer,...d?{onApprovalRequest:D(e=>s(e))}:{}},g=await J(e,t,s);try{return await ne(e,{availabilityChecked:P.env.CODER_ENGINE_CHECKED===`1`,prompt:X(t),developerInstructions:g.systemPrompt,outputSchema:t.outputSchema,model:x(t.model),...l&&t.model?{customModel:{alias:t.model,entry:l}}:{},configOverrides:{...Object.keys(r).length?{"shell_environment_policy.set":r}:{},...t.agentId?q.codex:{},...p.configOverrides},effort:t.effort,sandbox:u.sandbox,...m,networkAccess:p.networkAccess,mcpServers:g.servers,nativeMcp:t.nativeMcp??!1,writableRoots:u.sandbox===`read-only`?[]:[...t.addDirs??[],i(t.id)],onHeartbeat:Z(e,t.id),onResult:a,resumeThreadId:t.resumeThreadId??null,onControlReady:(n,r,i)=>{_(e,t.id,{status:`running`,steerEndpoint:n,threadId:r,turnId:i})},onProgress:n=>{s(n);let r=typeof n==`object`?n.threadId:null,i=typeof n==`object`?n.turnId:null;(r||i)&&_(e,t.id,{status:`running`,...r?{threadId:r}:{},...i?{turnId:i}:{}})}})}finally{_(e,t.id,{steerEndpoint:null})}}async function le(e,t,{echo:n,env:r={},onResult:a}){let s=o(e,t.id),c=w(e),l=Q(e,t.id,{echo:n}),u=await J(e,t,l,{declareHosts:(C[t.access??`auto`]??C.auto).approvalMode===`auto`});try{return await re(e,{env:{...r,...t.agentId?q.claude:{}},prompt:X(t),systemPrompt:u.systemPrompt,excludeDynamicSections:t.conversation,settingSources:t.agentId&&t.source&&![`cli`,`dashboard`,`schedule`].includes(t.source)?`project,local`:void 0,outputSchema:t.outputSchema,model:t.model,effort:t.effort,access:t.access,approvalTaskId:t.id,allowedNetworkHosts:S(t.access??`auto`,c.network),additionalDirectories:t.addDirs,scratch:i(t.id),local:t.promptParts?.local??!0,mcpServers:u.servers,nativeMcp:t.nativeMcp??!1,promptCacheTtl:t.conversation&&(r.ANTHROPIC_API_KEY||P.env.ANTHROPIC_API_KEY)?`1h`:void 0,taskRoot:s,resumeSessionId:t.resumeThreadId??null,onHeartbeat:Z(e,t.id),onResult:a,onSteerReady:n=>{_(e,t.id,{status:`running`,steerEndpoint:n})},onProgress:n=>{l(n),n.threadId&&_(e,t.id,{status:`running`,threadId:n.threadId})}})}finally{_(e,t.id,{steerEndpoint:null})}}function ue(e,t,n,r={}){let{steers:i=[],lastReply:a}=r,s=t.turnUsage?.at(-1)?.at,l=o(e,t.id);c(N.join(l,`result.json`),JSON.parse(d(n)));let u={at:new Date(Math.max(Date.now(),s?Date.parse(s)+1:0)).toISOString(),prompt:t.currentPrompt??t.prompt??null,...i.length?{steers:i}:{},...a?{lastReply:a}:{},...n};return F.appendFileSync(N.join(l,`results.jsonl`),`${d(u)}\n`,`utf8`),T(`worker.result.recorded`,{taskId:t.id,finalized:!1}),Y(`result`),u.at}function $(e){return async(e,t,n)=>{let r=await k(E(t.mcp,P.env,void 0,{onWarning:()=>{}})),i=t.access!==`read-only`,a={...r.env,...i?de(t):{}};try{let r=t.engine===`claude`?le:ce;return await se(e,t,(t,i)=>r(e,t,{...n,...i,env:a}))}finally{await r.close()}}}function de(e){let t=i(e.id);return{TMPDIR:t,BUN_TMPDIR:t,BUN_INSTALL_CACHE_DIR:N.join(t,`.bun-cache`),npm_config_cache:N.join(t,`.npm-cache`),PIP_CACHE_DIR:N.join(t,`.pip-cache`),UV_CACHE_DIR:N.join(t,`.uv-cache`),CARGO_HOME:N.join(t,`.cargo`),GOPATH:N.join(t,`go`),GOCACHE:N.join(t,`.go-cache`),...e.engine===`claude`?{CLAUDE_CODE_TMPDIR:t}:{}}}async function fe(e){if(P.env.CODER_MCP_MODE!==`cloud`||!e.name?.startsWith(`agent:`))return{};let[{liveConnections:t},{turnServers:n}]=await Promise.all([import(`./task-DN4assR8.js`).then(e=>e.l),import(`./actions-DO8MvHwc.js`).then(e=>e.t)]),r=await t(e)(e.connections??[]);for(let e of Object.keys(P.env))e.startsWith(`CODER_CONNECTION_`)&&delete P.env[e];Object.assign(P.env,r.env);let{selected:i,bindings:a}=n(e,r.mcp);return{mcp:i.mcp,mcpBindings:a}}async function pe(e,t){for(;;){let n=await u(e,t,()=>{let n=a(e,t);if(!n)return[];let r=n.status===`failed`||n.status===`cancelled`?[]:v(e,t);return r.length||(l(e,t),_(e,t,{steerClosed:!0,steerEndpoint:null}),Y(`settled`)),r});if(!n.length)return;for(let r of n)try{let n=a(e,t),i=_(e,t,{status:`running`,currentPrompt:r,resumedAt:new Date().toISOString(),error:void 0,resumeThreadId:n?.threadId??null,...n?await fe(n):{}});h(e,t,{message:`Running steered follow-up.`}),await $(i)(e,i,{echo:!1})}catch(n){let r=n instanceof Error?n.message:String(n);_(e,t,{status:`failed`,error:r,completedAt:new Date().toISOString()}),h(e,t,{kind:`error`,message:r});return}}}async function me(e,t){if(t.dispatchId&&!t.resumedAt)try{F.writeFileSync(N.join(o(e,t.id),`start-${t.dispatchId}`),``,{flag:`wx`})}catch(e){if(e.code===`EEXIST`)return;throw e}_(e,t.id,{status:`running`,pid:P.pid,steerClosed:!1});let n;try{if(t.name?.startsWith(`agent:`)){let{startInboxControl:r,applyTaskMessage:i}=await import(`./task-DN4assR8.js`).then(e=>e.l);n=r(o(e,t.id),t.name.slice(6),n=>i(e,a(e,t.id)??t,n))}P.env.CODER_SIMULATE_APPROVAL===`1`&&!t.resumedAt&&ie(e,t.id,o(e,t.id),{reason:`A dev hook (${ae}) raised this escalation at the start of the task.`,actions:[`echo simulated`]}),await $(t)(e,t,{echo:!1}),await pe(e,t.id)}catch(n){let r=n instanceof Error?n.message:String(n);throw _(e,t.id,{status:`failed`,error:r}),h(e,t.id,{kind:`error`,message:r}),n}finally{await u(e,t.id,()=>{a(e,t.id)?.pid===P.pid&&(_(e,t.id,{steerClosed:!0,steerEndpoint:null}),Y(`settled`))}),await n?.close()}}export{me as runWorker};

package/docs/agents/coder.md

@@ -8,7 +8,7 @@ The built-in agent. On the hosted service it has an install link per platform; s
 
 ## On GitHub
 
-- A pull request opening, updating, or becoming ready gets a read-only [review](../review.md), posted as inline comments with a sticky summary. Reruns update the summary and never repeat a finding, and a new push replaces a review that has not started yet.
+- A pull request opening, updating, or becoming ready gets a read-only [review](../review.md) through the agent's `review` tool, posted as one GitHub review with inline comments. Reruns never repeat a finding.
 - A review request for the agent does the same.
 - A mention (`@<app>` from a repository owner or member), in the conversation or in a finding's thread, answers from the diff and the repository, or makes the requested change on a branch and links the pull request.
 - An issue opening or edit reads the issue and the repository, then answers, makes the change and links the pull request, or asks one clarifying question.

package/docs/cli/index.md

@@ -14,7 +14,7 @@ Coder turns any model into an agent you own: tasks on this machine, from your co
 - [model](model.md): manage models: built-ins, aliases, custom endpoints
 - [connection](connection.md): platform accounts and MCP servers tasks use
 
-## `review [--base <base>] [--head <head>] [--pr <pr>] [--since <since>] [--path <path>] [--exclude <exclude>] [--post] [--md] [--model <model>] [--depth <depth>] [--json] [--cwd <cwd>]`
+## `review [--base <base>] [--head <head>] [--pr <pr>] [--since <since>] [--path <path>] [--exclude <exclude>] [--post] [--run <run>] [--md] [--model <model>] [--depth <depth>] [--json] [--cwd <cwd>]`
 
 review changed code with a built-in flow
 
@@ -22,7 +22,7 @@ Review changed code with a read-only agent. Every reported finding is checked
 against the repository. Runs the built-in `review` flow. A local review covers
 everything since the merge-base with the origin default branch, including
 uncommitted and untracked files. Changed submodules are reviewed file by file.
-PR reviews can post deduplicated inline comments.
+PR reviews can post one review with inline comments, never repeating a finding.
 
 Related: `coder flow watch`, `coder docs review`.
 
@@ -32,7 +32,8 @@ Related: `coder flow watch`, `coder docs review`.
 - `--since <since>` keep only PR files and hunks changed since this commit
 - `--path <path>` review only this path, relative to cwd (repeatable)
 - `--exclude <exclude>` leave this path out, relative to cwd (repeatable)
-- `--post` post deduplicated inline comments and sticky PR summary
+- `--post` post the review on the pull request, as the signed-in gh user
+- `--run <run>` with --post, post this finished review run instead of reviewing again
 - `--md` markdown output (the default)
 - `--model <model>` model name[/effort] or engine/model[/effort] (sol/low, claude/opus, codex/gpt-6.1-sol/high) for the review task (default: reviewModel)
 - `--depth <depth>` what to report: low only critical and major, high nits too (default: medium)
@@ -45,6 +46,7 @@ coder review --base main  # review everything since main locally
 coder review --path src --exclude src/gen  # review src without generated code
 coder review --pr 42 --post  # review and post to pull request 42
 coder review --depth high  # report nits too
+coder review --post --run <id>  # post a finished review run
 ```
 
 ## `config [action] [key] [value] [--workspace] [--json] [--cwd <cwd>]`

package/docs/connections.md

@@ -17,7 +17,7 @@ For workspace Acme, agent Coder, and member Ada:
 | | Workspace | Ada's personal |
 |---|---|---|
 | Slack | `slack`: Coder's bot. Reads the channels it's in, can't search, posts as Coder. | `slack-user`: Ada's account. Searches everything Ada can see; acts as Ada. |
-| GitHub | `github-acme`: the app's installation on `acme`. Comments as `coder-cloud-ai[bot]`. | `github-user`: Ada's sign-in. A pull request shows Ada as its author. |
+| GitHub | `github-acme`: the app's installation on `acme`. Comments, commits and pushes as `coder-cloud-ai[bot]`. | `github-user`: Ada's sign-in. Once Ada approves the act-as request, the turn commits and pushes as Ada, and a pull request lists Ada as its author. |
 | Linear | `linear-acme`: the app. "My issues" are the app's. | `linear-user`: Ada's sign-in. "My issues" are hers. |
 | Notion (MCP) | `notion`: a Notion MCP token from Acme's workspace owner. | `notion-user`: Ada's own Notion sign-in. |
 

package/docs/flows.md

@@ -63,7 +63,7 @@ So a crash resumes where it stopped, and an edit to step 3 re-runs from step 3.
 2. `~/.coder/flows/`, in every workspace.
 3. Built-in flows, which a repo flow of the same name overrides.
 
-A path runs that file directly. `coder flow discover` lists what's runnable here. The built-in `review` is the `coder review` code review. It takes `pr`, `post`, `base`, `head`, `since`, `model` and `depth` and returns `{ findings, summary }`.
+A path runs that file directly. `coder flow discover` lists what's runnable here. The built-in `review` is the `coder review` code review. It takes `pr`, `post`, `base`, `head`, `since`, `model` and `depth` and returns `{ note, body, findings, summary, pr? }`. Posting happens inside the flow; server tasks use the `review` tool instead of running this flow by name.
 
 ## Running
 

package/docs/review.md

@@ -4,7 +4,7 @@ description: coder review, a read-only review of local changes or a pull request
 
 # Review
 
-`coder review`, or `/review <pr>` in the dashboard's **# Tasks → [New task]**, runs one read-only review task over local changes or a pull request, checks every finding against the repository, and prints the ones that hold. With `--post` it comments inline on the pull request and keeps one sticky summary; a posted finding is never posted again, even after its line moves. A local review covers everything since the merge-base with the origin default branch, committed or not, and never touches the index or working tree.
+`coder review` runs one read-only review task over local changes or a pull request, checks every finding against the repository, and prints the ones that hold. With `--post` it posts one review on the pull request: the reviewer's one-line title and markdown body, followed by a list and footer built by code, and an inline comment for each new finding. A posted finding is never posted again, even after its line moves. A local review covers everything since the merge-base with the origin default branch, committed or not, and never touches the index or working tree.
 
 ```sh
 coder review                         # local changes since the default branch
@@ -19,12 +19,13 @@ coder review --pr 42 --post          # pull request 42, posted as comments
 | `--base <ref>` | Older side of a local diff | Merge-base of `HEAD` and the origin default branch |
 | `--head <ref>` | Newer side of a local diff, commits only | The working tree |
 | `--pr <n \| url>` | Pull request number in the origin repo, or a GitHub pull request URL | Local diff |
-| `--since <sha>` | Keep only pull request hunks changed after this commit | Head in the previous sticky summary |
-| `--path <p>` | Review only this pathspec; repeatable | Everything |
-| `--exclude <p>` | Leave this pathspec out; repeatable | Nothing |
-| `--post` | Post inline comments and update the sticky summary; needs `--pr` | Print only |
+| `--since <sha>` | Keep only pull request hunks changed after this commit | Head of the last posted review |
+| `--path <p>` | Review only this pathspec, repeatable | Everything |
+| `--exclude <p>` | Leave this pathspec out, repeatable | Nothing |
+| `--post` | Post the review on the pull request as the signed-in `gh` user. Needs `--pr` | Print only |
+| `--run <id>` | With `--post`, post a finished review run instead of reviewing again | Review now |
 | `--md` | Print Markdown | Enabled unless `--json` is used |
-| `--json` | Print `{ findings, summary, runId }` | Disabled |
+| `--json` | Print `{ title, body, findings, summary, pr?, runId }` | Disabled |
 | `--model <spec>` | [Model spec](models.md#pick-a-model) for the review task | The workspace's `reviewModel` |
 | `--depth <low\|medium\|high>` | What to report: `low` critical and major defects, `medium` any defect a maintainer would act on, `high` also minor issues | `medium` |
 | `--cwd <dir>` | Checkout to review | Current directory |
@@ -37,12 +38,39 @@ The reviewer reads `AGENTS.md`, `CLAUDE.md`, and an optional `.coder/review.md`
 
 ## Submodules
 
-Changed submodules are reviewed file by file under their path. Uninitialized ones, ones missing a needed commit, and nested repositories that are not submodules are skipped with a warning, and submodule findings are never posted inline.
+Changed submodules are reviewed file by file under their path. Uninitialized ones, ones missing a needed commit, and nested repositories that are not submodules are skipped with a warning. Submodule findings are listed in the posted review with their full path, never inline.
 
 ## Exit codes
 
 The command exits `0` when the review completes, even with findings, `1` when the diff, review, or posting fails, `3` when no engine starts, and `4` while a task awaits approval.
 
+## Posted review
+
+One GitHub review per run: the reviewer's title and body, then the findings list headed `Reviewed b34340e: 3 issues` (the compare range on a rerun), each title linked to its inline thread at `file:12` or `file:12-20`. Basic output uses bold severity words and a small Markdown footer linking coder cloud (or coder cli) and the task when present. Inline comments put the bold severity between the title and failure. The CLI and self-hosted servers use basic output, with no images. With nothing found, `Nothing to report.`
+
+Reviews post plain Markdown: bold severity words and a `Posted by` line. A server with `REVIEW_ASSETS` set ([Self-host](self-host.md)) shows themed severity pills and buttons from that path or URL instead. coder.wular.ai sets it to the SVGs its site serves.
+
+- A rerun reviews only commits since the last posted review, and never posts a finding twice. After a force-push it says so.
+- The reviewer sees up to 100 earlier findings on the pull request with their state, never reply text. Only a resolved thread settles one.
+- Posting stops if the pull request moved since it was read: `The pull request moved to <sha7> since this review. Review again.`
+- Model text cannot ping, add HTML, images or links.
+- On a Coder server the review also runs a `Coder review` check on the head commit:
+  - `success`: clean, with no unresolved earlier findings.
+  - `neutral`: findings, earlier findings still unresolved (`no new issues, N unresolved`), or the review itself failed.
+  - `skipped`: the head moved. `cancelled`: stopped or timed out.
+
+  Findings never fail the check. Red means the change is broken, not that Coder had an opinion or an outage. Resolve a thread on GitHub to clear it. Any event on a pull request gets the check. It uses a separate checks-only token, and agent tokens never carry Checks. An installation that has not accepted the Checks permission yet gets reviews without the check. The CLI and local reviews post no check.
+
+## Who posts
+
+- A pull request event or any task on a repository on a Coder server: the agent's `review` tool. The runner drives it with the agent's app token and the review posts as the app. A task started elsewhere, such as from Slack, gets its findings unposted. A `read-only` task posts only on its own event's pull request. The reviewer itself never gets the token.
+- The `review` tool of a task on this machine: the findings come back unposted. Posting them as you takes your approval of `coder review --post --run <id>`.
+- `coder review --pr <n> --post`: posts as the `gh` user signed in here.
+
+A repository's own `.coder/flows/review.ts` replaces the built-in flow but gets neither the app's token nor the checks token, so it cannot post or set checks as the app.
+
+A reviewer runs as the same OS user as its task, so a read-only sandbox stops writes, not reads: files the task's turn holds, including its git credential, are reachable. Only a machine sandbox or a separate user isolates them.
+
 ## From a task
 
-Every task has a `review` tool. It reviews the task's uncommitted changes in the background, or those since `base`, and sends the findings to the task as a message. One review runs at a time, at most 5 per turn.
+Every task has a `review` tool. It reviews the task's uncommitted changes in the background, or those since `base`, or a pull request, and sends the findings to the task as a message. One review runs at a time, at most 5 per turn.

package/docs/self-host.md

@@ -27,6 +27,7 @@ Required variables carry a *.
 | `CODER_CACHE_HOME` | path | OS cache directory for `wular-coder` | Archived tasks, flows and usage |
 | `WORK_DIR` | path | `~/.coder/state/global/server-tasks` | Where the local runner keeps each task's work folder: its working directory, or its checkout with a repository. The folder stays across turns and goes with `task delete` |
 | `SERVER_NAME` | string | `Coder` | What the dashboard calls this server, in its sidebar server menu |
+| `REVIEW_ASSETS` | path or URL | unset | Themed images for posted pull request reviews (`sev-*` and `btn-*` SVGs, dark and light); a path resolves against `PUBLIC_URL`. Unset posts plain Markdown reviews |
 | `ISSUES_URL` | URL | `https://github.com/muzam1l/coder/issues/new` | Where the dashboard sends bug reports from its Report issue button |
 | `SERVER_LIMITS` | JSON | `{}` | Request rates and task slots ([Limits and monitoring](#limits-and-monitoring)) |
 | `CLAUDE_SUBSCRIPTIONS` | `1` | off | Offer **[Sign in with Claude]** for personal credentials |
@@ -98,7 +99,7 @@ Installs start from the dashboard. **[Connect GitHub]** adds the shared GitHub a
 
 Operators set up the shared apps in the dashboard's Operator area at `/dash/<workspace>/operator`, one per platform, named `SERVER_NAME` or Wular unless they pick a name, and every operator action lands in its audit log. Entering it asks for a fresh Wular Auth sign-in and lasts an hour, or 15 minutes without activity; on local and memory servers the admin token holder is the operator.
 
-Each task gets the narrowest platform token: on GitHub an installation token for the event's repository with only the permissions its tools need, on Slack the install's bot token.
+Each task gets the narrowest platform token: on GitHub an installation token for the event's repository with only the permissions its tools need, on Slack the install's bot token. Each turn's git pushes with the installation covering the repository and commits as the app's bot. A member who approves acting as them on their GitHub connection gets the turn's pushes and commits under their own GitHub account instead. A GitHub App also asks for Checks: Read and write, for review checks; existing apps list it under **[Update on GitHub]**, and each installation accepts it once.
 
 ## Credentials
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wular/coder",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "The runtime for agents, your rules, any model, everywhere.",
   "type": "module",
   "main": "./dist/sdk.js",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coder",
-  "version": "0.4.13",
+  "version": "0.5.1",
   "description": "Delegate coding tasks to supervised Coder subagents running on Codex, Claude, or any OpenAI-compatible model. Your main context stays clean.",
   "author": {
     "name": "muzam1l"

package/plugins/cursor/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "coder",
   "displayName": "Coder",
-  "version": "0.4.13",
+  "version": "0.5.1",
   "description": "Delegate coding tasks to supervised Coder subagents running on Codex, Claude, or any OpenAI-compatible model. Your main context stays clean.",
   "author": {
     "name": "muzam1l"