@zibby/core 2.0.4 → 2.0.5

package/dist/utils/repo-clone.js

@@ -1 +1 @@
-import{execSync as v}from"node:child_process";import{existsSync as A,mkdirSync as N}from"node:fs";import{join as C}from"node:path";function y(t,e,r,o,s="clone"){try{t(`git -C "${e}" remote set-url origin "${r}"`,{stdio:"pipe"})}catch(c){let i=String(c&&c.message||c);o&&(i=i.split(o).join("***")),console.error(`[${s}] WARNING: failed to strip token from .git/config: ${i}`)}}import{existsSync as L,readFileSync as j}from"node:fs";import{homedir as P}from"node:os";import{join as K}from"node:path";var Z=Object.freeze(["github.com","gitlab.com"]);function u(t){try{return new URL(t).hostname.toLowerCase()}catch{return""}}function E(t){if(typeof t!="string"||t===""||/[\\\x00-\x20\x7f]/.test(t))return"";let e;try{e=new URL(t)}catch{return""}return e.protocol!=="https:"?"":e.hostname.toLowerCase()}function x(t=process.env){let e=t&&(t.GITLAB_URL||t.GITLAB_INSTANCE_URL)||"";return u(e)}function m(t={}){if(t.gitlabHost){let e=String(t.gitlabHost).trim().toLowerCase();return e?e.includes("://")?u(e):e.replace(/:\d+$/,""):""}return x()}function O(t,e={}){if(t==="github.com")return"github";if(t==="gitlab.com")return"gitlab";let r=m(e);return r&&t===r?"gitlab":null}function b(t={},e={}){let r=t&&(t.cloneUrl||t.url)||"",o=u(r);if(!o)return null;let s=t.provider==="github"||t.provider==="gitlab"?t.provider:null,c=$(t,e),i=O(o,c?{gitlabHost:c}:{});return i?s&&s!==i?null:i:s==="gitlab"?"gitlab":null}function $(t,e={}){let r=m(e);return r||(t&&t.provider==="gitlab"?E(t.cloneUrl||t.url||""):"")}function T(t={},e="",r={}){let o=t&&(t.cloneUrl||t.url)||"";if(!o||!e||!b(t,r))return o;let s=$(t,r);return k(o,e,s?{gitlabHost:s}:{})}function k(t,e,r={}){if(!t||!e)return t;let o=E(t);if(!o)return t;if(o==="github.com")return t.replace(/^https:\/\/(?:[^@/]+@)?github\.com(?=[:/]|$)/i,`https://x-access-token:${e}@github.com`);if(o==="gitlab.com")return t.replace(/^https:\/\/(?:[^@/]+@)?gitlab\.com(?=[:/]|$)/i,`https://oauth2:${e}@gitlab.com`);let s=m(r);if(s&&o===s){let c=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),i=new RegExp(`^https:\\/\\/(?:[^@/]+@)?${c}(?=[:/]|$)`,"i");return t.replace(i,`https://oauth2:${e}@${s}`)}return t}async function Q(t={}){let{baseDir:e="/workspace/repos",repos:r=null,depth:o=1,branch:s=null}=t,c=process.env.REPOS;if(!c)throw new Error("REPOS environment variable not set. Are you running in a Zibby workflow container?");let i;try{i=JSON.parse(c)}catch(n){throw new Error(`Failed to parse REPOS env var: ${n.message}`,{cause:n})}if(!Array.isArray(i)||i.length===0)throw new Error("No repositories configured for this project");let w=r?i.filter(n=>r.includes(n.name)):i;if(w.length===0)throw new Error(`No matching repositories found. Available: ${i.map(n=>n.name).join(", ")}`);A(e)||N(e,{recursive:!0});let l={};return await Promise.all(w.map(async n=>{let a=n.cloneUrl||n.url;if(!a){console.error(`Repository "${n.name}" has no clone URL`),l[n.name]=null;return}let f=b(n);if(!f){console.error(`Refusing to clone ${n.name}: '${u(a)||a}' is not a recognized VCS host (expected github.com, gitlab.com, or the self-hosted GitLab named by GITLAB_URL/GITLAB_INSTANCE_URL${n.provider?`; the repo declares provider='${n.provider}'`:""}). No token was sent.`),l[n.name]=null;return}let p=f==="gitlab"?process.env.GITLAB_TOKEN:process.env.GITHUB_TOKEN;if(!p){console.error(`${f.toUpperCase()}_TOKEN not set, skipping ${n.name}`),l[n.name]=null;return}let _=n.name.replace(/\//g,"-"),h=C(e,_),g=T({...n,cloneUrl:a},p);if(g===a){console.error(`Refusing to clone ${n.name}: could not safely attach credentials to '${a}' (an https:// URL on an exact trusted host is required). No token was sent.`),l[n.name]=null;return}let d=["clone"];o>0&&d.push("--depth",o.toString()),s&&d.push("--branch",s),d.push(g,h);let R=`git ${d.join(" ")}`;console.log(`Cloning ${n.name} (${f}) to ${h}...`);try{v(R,{stdio:"pipe",env:{...process.env,GIT_TERMINAL_PROMPT:"0"}}),y(v,h,a,p,`cloneRepo:${n.name}`),console.log(`Repository ${n.name} cloned successfully`),l[n.name]=h}catch(I){let S=I.message.replace(p,"***").replace(g,a);console.error(`Failed to clone ${n.name}: ${S}`),l[n.name]=null}})),l}export{Q as cloneRepo};
+import{execSync as $}from"node:child_process";import{existsSync as k,mkdirSync as x}from"node:fs";import{join as U}from"node:path";function T(t,e,r,o,s="clone"){try{t(`git -C "${e}" remote set-url origin "${r}"`,{stdio:"pipe"})}catch(c){let i=String(c&&c.message||c);o&&(i=i.split(o).join("***")),console.error(`[${s}] WARNING: failed to strip token from .git/config: ${i}`)}}import{existsSync as L,readFileSync as P}from"node:fs";import{homedir as H}from"node:os";import{join as M}from"node:path";var D=Object.freeze(["github.com","gitlab.com"]);function u(t){try{return new URL(t).hostname.toLowerCase()}catch{return""}}function E(t){if(typeof t!="string"||t===""||/[\\\x00-\x20\x7f]/.test(t))return"";let e;try{e=new URL(t)}catch{return""}return e.protocol!=="https:"?"":e.hostname.toLowerCase()}function R(t=process.env){let e=t&&(t.GITLAB_URL||t.GITLAB_INSTANCE_URL)||"";return u(e)}function m(t={}){if(t.gitlabHost){let e=String(t.gitlabHost).trim().toLowerCase();return e?e.includes("://")?u(e):e.replace(/:\d+$/,""):""}return R()}function S(t,e={}){if(t==="github.com")return"github";if(t==="gitlab.com")return"gitlab";let r=m(e);return r&&t===r?"gitlab":null}function b(t={},e={}){let r=t&&(t.cloneUrl||t.url)||"",o=u(r);if(!o)return null;let s=t.provider==="github"||t.provider==="gitlab"?t.provider:null,c=_(t,e),i=S(o,c?{gitlabHost:c}:{});return i?s&&s!==i?null:i:s==="gitlab"?"gitlab":null}function _(t,e={}){let r=m(e);return r||(t&&t.provider==="gitlab"?E(t.cloneUrl||t.url||""):"")}function y(t={},e="",r={}){let o=t&&(t.cloneUrl||t.url)||"";if(!o||!e||!b(t,r))return o;let s=_(t,r);return N(o,e,s?{gitlabHost:s}:{})}function N(t,e,r={}){if(!t||!e)return t;let o=E(t);if(!o)return t;if(o==="github.com")return t.replace(/^https:\/\/(?:[^@/]+@)?github\.com(?=[:/]|$)/i,`https://x-access-token:${e}@github.com`);if(o==="gitlab.com")return t.replace(/^https:\/\/(?:[^@/]+@)?gitlab\.com(?=[:/]|$)/i,`https://oauth2:${e}@gitlab.com`);let s=m(r);if(s&&o===s){let c=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),i=new RegExp(`^https:\\/\\/(?:[^@/]+@)?${c}(?=[:/]|$)`,"i");return t.replace(i,`https://oauth2:${e}@${s}`)}return t}async function Q(t={}){let{baseDir:e="/workspace/repos",repos:r=null,depth:o=1,branch:s=null}=t,c=process.env.REPOS;if(!c)throw new Error("REPOS environment variable not set. Are you running in a Zibby workflow container?");let i;try{i=JSON.parse(c)}catch(n){throw new Error(`Failed to parse REPOS env var: ${n.message}`,{cause:n})}if(!Array.isArray(i)||i.length===0)throw new Error("No repositories configured for this project");let w=r?i.filter(n=>r.includes(n.name)):i;if(w.length===0)throw new Error(`No matching repositories found. Available: ${i.map(n=>n.name).join(", ")}`);k(e)||x(e,{recursive:!0});let l={};return await Promise.all(w.map(async n=>{let a=n.cloneUrl||n.url;if(!a){console.error(`Repository "${n.name}" has no clone URL`),l[n.name]=null;return}let f=b(n);if(!f){console.error(`Refusing to clone ${n.name}: '${u(a)||a}' is not a recognized VCS host (expected github.com, gitlab.com, or the self-hosted GitLab named by GITLAB_URL/GITLAB_INSTANCE_URL${n.provider?`; the repo declares provider='${n.provider}'`:""}). No token was sent.`),l[n.name]=null;return}let p=f==="gitlab"?process.env.GITLAB_TOKEN:process.env.GITHUB_TOKEN;if(!p){console.error(`${f.toUpperCase()}_TOKEN not set, skipping ${n.name}`),l[n.name]=null;return}let I=n.name.replace(/\//g,"-"),h=U(e,I),d=y({...n,cloneUrl:a},p);if(d===a){console.error(`Refusing to clone ${n.name}: could not safely attach credentials to '${a}' (an https:// URL on an exact trusted host is required). No token was sent.`),l[n.name]=null;return}let g=["clone"];o>0&&g.push("--depth",o.toString()),s&&g.push("--branch",s),g.push(d,h);let v=`git ${g.join(" ")}`;console.log(`Cloning ${n.name} (${f}) to ${h}...`);try{$(v,{stdio:"pipe",env:{...process.env,GIT_TERMINAL_PROMPT:"0"}}),T($,h,a,p,`cloneRepo:${n.name}`),console.log(`Repository ${n.name} cloned successfully`),l[n.name]=h}catch(O){let A=O.message.replace(p,"***").replace(d,a);console.error(`Failed to clone ${n.name}: ${A}`),l[n.name]=null}})),l}export{Q as cloneRepo};

package/dist/utils/repos.js

@@ -1,2 +1,2 @@
-import{execSync as y}from"node:child_process";import{existsSync as _,mkdirSync as x}from"node:fs";import{join as T,resolve as I}from"node:path";function b(t,e,o,n,s="clone"){try{t(`git -C "${e}" remote set-url origin "${o}"`,{stdio:"pipe"})}catch(r){let i=String(r&&r.message||r);n&&(i=i.split(n).join("***")),console.error(`[${s}] WARNING: failed to strip token from .git/config: ${i}`)}}import{existsSync as L,readFileSync as P}from"node:fs";import{homedir as H}from"node:os";import{join as K}from"node:path";var Y=Object.freeze(["github.com","gitlab.com"]);function a(t){try{return new URL(t).hostname.toLowerCase()}catch{return""}}function m(t){if(typeof t!="string"||t===""||/[\\\x00-\x20\x7f]/.test(t))return"";let e;try{e=new URL(t)}catch{return""}return e.protocol!=="https:"?"":e.hostname.toLowerCase()}function R(t=process.env){let e=t&&(t.GITLAB_URL||t.GITLAB_INSTANCE_URL)||"";return a(e)}function h(t={}){if(t.gitlabHost){let e=String(t.gitlabHost).trim().toLowerCase();return e?e.includes("://")?a(e):e.replace(/:\d+$/,""):""}return R()}function A(t,e={}){if(t==="github.com")return"github";if(t==="gitlab.com")return"gitlab";let o=h(e);return o&&t===o?"gitlab":null}function d(t={},e={}){let o=t&&(t.cloneUrl||t.url)||"",n=a(o);if(!n)return null;let s=t.provider==="github"||t.provider==="gitlab"?t.provider:null,r=w(t,e),i=A(n,r?{gitlabHost:r}:{});return i?s&&s!==i?null:i:s==="gitlab"?"gitlab":null}function w(t,e={}){let o=h(e);return o||(t&&t.provider==="gitlab"?m(t.cloneUrl||t.url||""):"")}function E(t={},e="",o={}){let n=t&&(t.cloneUrl||t.url)||"";if(!n||!e||!d(t,o))return n;let s=w(t,o);return k(n,e,s?{gitlabHost:s}:{})}function k(t,e,o={}){if(!t||!e)return t;let n=m(t);if(!n)return t;if(n==="github.com")return t.replace(/^https:\/\/(?:[^@/]+@)?github\.com(?=[:/]|$)/i,`https://x-access-token:${e}@github.com`);if(n==="gitlab.com")return t.replace(/^https:\/\/(?:[^@/]+@)?gitlab\.com(?=[:/]|$)/i,`https://oauth2:${e}@gitlab.com`);let s=h(o);if(s&&n===s){let r=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),i=new RegExp(`^https:\\/\\/(?:[^@/]+@)?${r}(?=[:/]|$)`,"i");return t.replace(i,`https://oauth2:${e}@${s}`)}return t}var S="/workspace/repos",O=".zibby/repos";function $(){return process.env.REPOS?S:I(process.cwd(),O)}function C(t){return String(t).replace(/\//g,"-")}function N(){let t=process.env.REPOS;if(!t)return[];try{let e=JSON.parse(t);return Array.isArray(e)?e:[]}catch{return[]}}function g(t={}){let e=t.baseDir||$();return N().map((n,s)=>{let r=T(e,C(n.name));return{name:n.name,url:n.cloneUrl||n.url||null,branch:n.branch||null,provider:n.provider||"github",localPath:r,isCheckedOut:_(T(r,".git")),primary:s===0}})}function v(t,e={}){let o=g(e);return o.length===0?null:t?o.find(n=>n.name===t)||null:o[0]}function Q(t,e={}){let o=v(t,e);return o?o.localPath:null}async function X(t,e={}){let{branch:o=null,depth:n=1,baseDir:s=$()}=e,r=v(t,{baseDir:s});if(!r){let c=g({baseDir:s}).map(f=>f.name).join(", ")||"(none)";throw new Error(`No repo "${t||"primary"}" configured for this workflow. Available: ${c}. Configure repos under project integrations, or set the REPOS env var.`)}if(r.isCheckedOut)return r.localPath;if(!r.url)throw new Error(`Repo "${r.name}" has no clone URL configured.`);let i=d(r);if(!i)throw new Error(`Cannot clone ${r.name}: '${a(r.url)||r.url}' is not a recognized VCS host (expected github.com, gitlab.com, or the self-hosted GitLab named by GITLAB_URL/GITLAB_INSTANCE_URL${r.provider?`; the repo declares provider='${r.provider}'`:""}). No token was sent.`);let u=i==="gitlab"?process.env.GITLAB_TOKEN:process.env.GITHUB_TOKEN;if(!u)throw new Error(`${i==="gitlab"?"GITLAB_TOKEN":"GITHUB_TOKEN"} not set \u2014 cannot clone ${r.name}. Connect the integration under project settings.`);_(s)||x(s,{recursive:!0});let p=E(r,u);if(p===r.url)throw new Error(`Cannot clone ${r.name}: could not safely attach credentials to '${r.url}' (an https:// URL on an exact trusted host is required). No token was sent.`);let l=["clone"];n>0&&l.push("--depth",String(n)),(o||r.branch)&&l.push("--branch",o||r.branch),l.push(p,r.localPath);try{y(`git ${l.join(" ")}`,{stdio:"pipe",env:{...process.env,GIT_TERMINAL_PROMPT:"0"}})}catch(c){let f=String(c.message||c).replace(u,"***").replace(p,r.url);throw new Error(`Failed to clone ${r.name}: ${f}`,{cause:c})}return b(y,r.localPath,r.url,u,`ensureRepo:${r.name}`),r.localPath}function tt(t={}){let e=g(t);if(e.length===0)return null;let o=["## Available repositories",""];for(let n of e){let s=n.isCheckedOut?"already checked out at":"will be checked out to",r=n.primary?" (primary)":"";o.push(`- \`${n.name}\`${r} \u2014 ${s} \`${n.localPath}\``)}return o.push(""),o.push(`To materialize a repo: call the \`git_checkout\` skill with the repo name (e.g. \`git_checkout({ url: "${e[0].name}" })\`). In code, \`import { ensureRepo } from "@zibby/core"\` and \`await ensureRepo()\` returns the local path (clones on first call, no-op after).`),o.join(`
-`)}export{tt as buildRepoContextHint,X as ensureRepo,v as getRepo,g as listRepos,Q as repoPath};
+import{execSync as E}from"node:child_process";import{existsSync as y,mkdirSync as R}from"node:fs";import{join as _,resolve as k}from"node:path";function m(t,e,o,r,s="clone"){try{t(`git -C "${e}" remote set-url origin "${o}"`,{stdio:"pipe"})}catch(n){let i=String(n&&n.message||n);r&&(i=i.split(r).join("***")),console.error(`[${s}] WARNING: failed to strip token from .git/config: ${i}`)}}import{existsSync as L,readFileSync as P}from"node:fs";import{homedir as G}from"node:os";import{join as K}from"node:path";var D=Object.freeze(["github.com","gitlab.com"]);function a(t){try{return new URL(t).hostname.toLowerCase()}catch{return""}}function b(t){if(typeof t!="string"||t===""||/[\\\x00-\x20\x7f]/.test(t))return"";let e;try{e=new URL(t)}catch{return""}return e.protocol!=="https:"?"":e.hostname.toLowerCase()}function A(t=process.env){let e=t&&(t.GITLAB_URL||t.GITLAB_INSTANCE_URL)||"";return a(e)}function h(t={}){if(t.gitlabHost){let e=String(t.gitlabHost).trim().toLowerCase();return e?e.includes("://")?a(e):e.replace(/:\d+$/,""):""}return A()}function O(t,e={}){if(t==="github.com")return"github";if(t==="gitlab.com")return"gitlab";let o=h(e);return o&&t===o?"gitlab":null}function d(t={},e={}){let o=t&&(t.cloneUrl||t.url)||"",r=a(o);if(!r)return null;let s=t.provider==="github"||t.provider==="gitlab"?t.provider:null,n=w(t,e),i=O(r,n?{gitlabHost:n}:{});return i?s&&s!==i?null:i:s==="gitlab"?"gitlab":null}function w(t,e={}){let o=h(e);return o||(t&&t.provider==="gitlab"?b(t.cloneUrl||t.url||""):"")}function T(t={},e="",o={}){let r=t&&(t.cloneUrl||t.url)||"";if(!r||!e||!d(t,o))return r;let s=w(t,o);return v(r,e,s?{gitlabHost:s}:{})}function v(t,e,o={}){if(!t||!e)return t;let r=b(t);if(!r)return t;if(r==="github.com")return t.replace(/^https:\/\/(?:[^@/]+@)?github\.com(?=[:/]|$)/i,`https://x-access-token:${e}@github.com`);if(r==="gitlab.com")return t.replace(/^https:\/\/(?:[^@/]+@)?gitlab\.com(?=[:/]|$)/i,`https://oauth2:${e}@gitlab.com`);let s=h(o);if(s&&r===s){let n=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),i=new RegExp(`^https:\\/\\/(?:[^@/]+@)?${n}(?=[:/]|$)`,"i");return t.replace(i,`https://oauth2:${e}@${s}`)}return t}var S="/workspace/repos",x=".zibby/repos";function $(){return process.env.REPOS?S:k(process.cwd(),x)}function N(t){return String(t).replace(/\//g,"-")}function C(){let t=process.env.REPOS;if(!t)return[];try{let e=JSON.parse(t);return Array.isArray(e)?e:[]}catch{return[]}}function g(t={}){let e=t.baseDir||$();return C().map((r,s)=>{let n=_(e,N(r.name));return{name:r.name,url:r.cloneUrl||r.url||null,branch:r.branch||null,provider:r.provider||"github",localPath:n,isCheckedOut:y(_(n,".git")),primary:s===0}})}function I(t,e={}){let o=g(e);return o.length===0?null:t?o.find(r=>r.name===t)||null:o[0]}function Q(t,e={}){let o=I(t,e);return o?o.localPath:null}async function X(t,e={}){let{branch:o=null,depth:r=1,baseDir:s=$()}=e,n=I(t,{baseDir:s});if(!n){let c=g({baseDir:s}).map(p=>p.name).join(", ")||"(none)";throw new Error(`No repo "${t||"primary"}" configured for this workflow. Available: ${c}. Configure repos under project integrations, or set the REPOS env var.`)}if(n.isCheckedOut)return n.localPath;if(!n.url)throw new Error(`Repo "${n.name}" has no clone URL configured.`);let i=d(n);if(!i)throw new Error(`Cannot clone ${n.name}: '${a(n.url)||n.url}' is not a recognized VCS host (expected github.com, gitlab.com, or the self-hosted GitLab named by GITLAB_URL/GITLAB_INSTANCE_URL${n.provider?`; the repo declares provider='${n.provider}'`:""}). No token was sent.`);let u=i==="gitlab"?process.env.GITLAB_TOKEN:process.env.GITHUB_TOKEN;if(!u)throw new Error(`${i==="gitlab"?"GITLAB_TOKEN":"GITHUB_TOKEN"} not set \u2014 cannot clone ${n.name}. Connect the integration under project settings.`);y(s)||R(s,{recursive:!0});let f=T(n,u);if(f===n.url)throw new Error(`Cannot clone ${n.name}: could not safely attach credentials to '${n.url}' (an https:// URL on an exact trusted host is required). No token was sent.`);let l=["clone"];r>0&&l.push("--depth",String(r)),(o||n.branch)&&l.push("--branch",o||n.branch),l.push(f,n.localPath);try{E(`git ${l.join(" ")}`,{stdio:"pipe",env:{...process.env,GIT_TERMINAL_PROMPT:"0"}})}catch(c){let p=String(c.message||c).replace(u,"***").replace(f,n.url);throw new Error(`Failed to clone ${n.name}: ${p}`,{cause:c})}return m(E,n.localPath,n.url,u,`ensureRepo:${n.name}`),n.localPath}function tt(t={}){let e=g(t);if(e.length===0)return null;let o=["## Available repositories",""];for(let r of e){let s=r.isCheckedOut?"already checked out at":"will be checked out to",n=r.primary?" (primary)":"";o.push(`- \`${r.name}\`${n} \u2014 ${s} \`${r.localPath}\``)}return o.push(""),o.push(`To materialize a repo: call the \`git_checkout\` skill with the repo name (e.g. \`git_checkout({ url: "${e[0].name}" })\`). In code, \`import { ensureRepo } from "@zibby/core"\` and \`await ensureRepo()\` returns the local path (clones on first call, no-op after).`),o.join(`
+`)}export{tt as buildRepoContextHint,X as ensureRepo,I as getRepo,g as listRepos,Q as repoPath};

package/dist/utils/secure-git.js

@@ -1 +1 @@
-import{existsSync as v,readFileSync as x}from"node:fs";import{homedir as I}from"node:os";import{join as k}from"node:path";var w=new Map,O={github:"GITHUB_TOKEN",gitlab:"GITLAB_TOKEN",sentry:"SENTRY_AUTH_TOKEN",slack:"SLACK_BOT_TOKEN"};function $(){let t=process.env.ZIBBY_SELF_HOST;return t!=null&&t!==""&&t!=="0"&&t.toLowerCase()!=="false"}function A(){if(process.env.PROJECT_API_TOKEN)return process.env.PROJECT_API_TOKEN;if(process.env.ZIBBY_USER_TOKEN)return process.env.ZIBBY_USER_TOKEN;try{let t=k(I(),".zibby","config.json");return v(t)&&JSON.parse(x(t,"utf-8")).sessionToken||null}catch{return null}}function S(){return process.env.ZIBBY_ACCOUNT_API_URL?process.env.ZIBBY_ACCOUNT_API_URL.replace(/\/$/,""):(process.env.ZIBBY_ENV||"prod")==="local"?"http://localhost:3001":process.env.ZIBBY_PROD_ACCOUNT_API_URL||"https://api-prod.zibby.app"}async function m(t){if($()){let c=O[t];if(c&&process.env[c])return{token:process.env[c]}}let e=Date.now(),n=w.get(t);if(n&&n.expiresAt>e)return n.data;let r=A();if(!r)throw new Error("Missing session credential: neither PROJECT_API_TOKEN nor ZIBBY_USER_TOKEN is set in this process env (and no ~/.zibby/config.json session). If this is an MCP skill child, the spawning skill must forward them \u2014 check the skill's envKeys / resolve() env (see @zibby/skills backend-session-env-contract). Interactive CLI: run `zibby login`.");let s=`${S()}/integrations/token/${t}`,i=await fetch(s,{method:"GET",headers:{Authorization:`Bearer ${r}`}});if(!i.ok){let c=await i.text().catch(()=>"");if(i.status===404){let u="";try{u=String(JSON.parse(c)?.error||"").trim()}catch{}throw new Error(u||`${t} is not connected. Connect it at https://studio.zibby.dev/integrations`)}throw i.status===401||i.status===403?new Error("Session expired. Run `zibby login` to re-authenticate."):new Error(`Failed to resolve ${t} token (${i.status}): ${c}`)}let o=await i.json();if(!o||typeof o!="object")throw new Error(`Invalid response from ${t} token endpoint: expected object, got ${typeof o}`);if(t==="jira"){if(!o.token||typeof o.token!="string")throw new Error(`Invalid jira token response: token is ${typeof o.token}, expected string`);if(!o.cloudId&&!o.instanceUrl&&!o.baseUrl)throw new Error("Invalid jira token response: carries neither cloudId (OAuth connection) nor instanceUrl (API-token connection) \u2014 reconnect Jira.")}else if(t==="github"&&(!o.token||typeof o.token!="string"))throw new Error(`Invalid github token response: token is ${typeof o.token}, expected string`);let f=((o.expiresInSec||3e3)-120)*1e3;return w.set(t,{data:o,expiresAt:e+f}),o}var z=Object.freeze(["github.com","gitlab.com"]);function b(t){try{return new URL(t).hostname.toLowerCase()}catch{return""}}function g(t){if(typeof t!="string"||t===""||/[\\\x00-\x20\x7f]/.test(t))return"";let e;try{e=new URL(t)}catch{return""}return e.protocol!=="https:"?"":e.hostname.toLowerCase()}function C(t=process.env){let e=t&&(t.GITLAB_URL||t.GITLAB_INSTANCE_URL)||"";return b(e)}function h(t={}){if(t.gitlabHost){let e=String(t.gitlabHost).trim().toLowerCase();return e?e.includes("://")?b(e):e.replace(/:\d+$/,""):""}return C()}function B(t,e={}){let n=g(t);if(!n)return!1;if(n==="github.com"||n==="gitlab.com")return!0;let r=h(e);return!!(r&&n===r)}function E(t,e={}){if(t==="github.com")return"github";if(t==="gitlab.com")return"gitlab";let n=h(e);return n&&t===n?"gitlab":null}function R(t={},e={}){let n=t&&(t.cloneUrl||t.url)||"",r=b(n);if(!r)return null;let s=t.provider==="github"||t.provider==="gitlab"?t.provider:null,i=T(t,e),o=E(r,i?{gitlabHost:i}:{});return o?s&&s!==o?null:o:s==="gitlab"?"gitlab":null}function T(t,e={}){let n=h(e);return n||(t&&t.provider==="gitlab"?g(t.cloneUrl||t.url||""):"")}function G(t={},e="",n={}){let r=t&&(t.cloneUrl||t.url)||"";if(!r||!e||!R(t,n))return r;let s=T(t,n);return _(r,e,s?{gitlabHost:s}:{})}function _(t,e,n={}){if(!t||!e)return t;let r=g(t);if(!r)return t;if(r==="github.com")return t.replace(/^https:\/\/(?:[^@/]+@)?github\.com(?=[:/]|$)/i,`https://x-access-token:${e}@github.com`);if(r==="gitlab.com")return t.replace(/^https:\/\/(?:[^@/]+@)?gitlab\.com(?=[:/]|$)/i,`https://oauth2:${e}@gitlab.com`);let s=h(n);if(s&&r===s){let i=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),o=new RegExp(`^https:\\/\\/(?:[^@/]+@)?${i}(?=[:/]|$)`,"i");return t.replace(o,`https://oauth2:${e}@${s}`)}return t}function U(t){return t&&String(t).replace(/^(https:\/\/)[^@/]+@/i,"$1")}function N(t,e){let n=t==null?"":String(t);return e&&(n=n.split(e).join("***")),n=n.replace(/(https?:\/\/)(?:x-access-token|oauth2):[^@\s/]+@/gi,"$1"),n=n.replace(/(https?:\/\/)[^@\s/:]+:[^@\s/]+@/gi,"$1"),n}async function F(t,e,n){try{await t("git",["remote","set-url","origin",U(n)],e)}catch(r){console.warn(`\u26A0\uFE0F  could not scrub token from origin remote (continuing): ${r?.message||r}`)}}async function Y({run:t,repoPath:e,repoUrl:n,branch:r,token:s,resolveToken:i=m,gitlabHost:o}={}){if(typeof t!="function")throw new Error("securePush: `run` (a spawn wrapper resolving {code,stdout,stderr}) is required");if(!r)throw new Error("securePush: `branch` is required");let f=h({gitlabHost:o}),c=g(n),u=B(n,{gitlabHost:f}),l=s||"";if(!l&&u&&typeof i=="function"){let p=E(c,{gitlabHost:f});if(p)try{l=(await i(p))?.token||""}catch{}}else!l&&!u&&console.warn(`\u26A0\uFE0F push target host '${c||"(unparseable)"}' is not a trusted VCS host \u2014 refusing to mint a token`);let d=l&&u,y=d?_(n,l,{gitlabHost:f}):"origin",a=await t("git",["push",y,r],e);if(!a||a.code!==0){let p=N(a&&a.stderr||"",l);throw new Error(`git push failed (exit ${a?a.code:"?"}): ${String(p).slice(-500)}`)}return{code:a.code,stdout:a.stdout,stderr:a.stderr,pushedAuthed:!!d,target:d?"<authed>":"origin"}}export{z as TRUSTED_VCS_HOSTS,_ as authedUrl,G as authedUrlForRepo,b as hostnameOf,B as isTrustedVcsHost,E as providerForHost,R as providerForRepo,N as redactGitSecrets,g as safeVcsHostname,F as scrubRemoteToTokenless,Y as securePush,C as selfHostGitlabHost,U as tokenlessUrl};
+import{existsSync as O,readFileSync as A}from"node:fs";import{homedir as x}from"node:os";import{join as $}from"node:path";var T=new Map,k={github:"GITHUB_TOKEN",gitlab:"GITLAB_TOKEN",sentry:"SENTRY_AUTH_TOKEN",slack:"SLACK_BOT_TOKEN"};function v(){let t=process.env.ZIBBY_SELF_HOST;return t!=null&&t!==""&&t!=="0"&&t.toLowerCase()!=="false"}function S(){if(process.env.PROJECT_API_TOKEN)return process.env.PROJECT_API_TOKEN;if(process.env.ZIBBY_USER_TOKEN)return process.env.ZIBBY_USER_TOKEN;try{let t=$(x(),".zibby","config.json");return O(t)&&JSON.parse(A(t,"utf-8")).sessionToken||null}catch{return null}}function N(){return process.env.ZIBBY_ACCOUNT_API_URL?process.env.ZIBBY_ACCOUNT_API_URL.replace(/\/$/,""):(process.env.ZIBBY_ENV||"prod")==="local"?"http://localhost:3001":process.env.ZIBBY_PROD_ACCOUNT_API_URL||"https://api-prod.zibby.app"}var U=2e4;function R(t=process.env){let e=Number(t.INTEGRATION_API_TIMEOUT_MS);return Number.isFinite(e)&&e>0?Math.min(12e4,Math.max(1e3,Math.floor(e))):U}function C(){let t=R();return{signal:AbortSignal.timeout(t),label:`after ${t}ms (INTEGRATION_API_TIMEOUT_MS)`}}function B(t){return t?.name==="TimeoutError"||t?.name==="AbortError"}function w(t,e,n){if(!B(t))return t;let r=new Error(`${n} TIMED OUT ${e.label}`);return r.timedOut=!0,r.cause=t,r}async function m(t){if(v()){let c=k[t];if(c&&process.env[c])return{token:process.env[c]}}let e=Date.now(),n=T.get(t);if(n&&n.expiresAt>e)return n.data;let r=S();if(!r)throw new Error("Missing session credential: neither PROJECT_API_TOKEN nor ZIBBY_USER_TOKEN is set in this process env (and no ~/.zibby/config.json session). If this is an MCP skill child, the spawning skill must forward them \u2014 check the skill's envKeys / resolve() env (see @zibby/skills backend-session-env-contract). Interactive CLI: run `zibby login`.");let i=`${N()}/integrations/token/${t}`,a=C(),s;try{s=await fetch(i,{method:"GET",headers:{Authorization:`Bearer ${r}`},signal:a.signal})}catch(c){throw w(c,a,`${t} token lookup`)}if(!s.ok){let c=await s.text().catch(()=>"");if(s.status===404){let u="";try{u=String(JSON.parse(c)?.error||"").trim()}catch{}throw new Error(u||`${t} is not connected. Connect it at https://studio.zibby.dev/integrations`)}throw s.status===401||s.status===403?new Error("Session expired. Run `zibby login` to re-authenticate."):new Error(`Failed to resolve ${t} token (${s.status}): ${c}`)}let o;try{o=await s.json()}catch(c){throw w(c,a,`${t} token body read`)}if(!o||typeof o!="object")throw new Error(`Invalid response from ${t} token endpoint: expected object, got ${typeof o}`);if(t==="jira"){if(!o.token||typeof o.token!="string")throw new Error(`Invalid jira token response: token is ${typeof o.token}, expected string`);if(!o.cloudId&&!o.instanceUrl&&!o.baseUrl)throw new Error("Invalid jira token response: carries neither cloudId (OAuth connection) nor instanceUrl (API-token connection) \u2014 reconnect Jira.")}else if(t==="github"&&(!o.token||typeof o.token!="string"))throw new Error(`Invalid github token response: token is ${typeof o.token}, expected string`);let h=((o.expiresInSec||3e3)-120)*1e3;return T.set(t,{data:o,expiresAt:e+h}),o}var Z=Object.freeze(["github.com","gitlab.com"]);function b(t){try{return new URL(t).hostname.toLowerCase()}catch{return""}}function g(t){if(typeof t!="string"||t===""||/[\\\x00-\x20\x7f]/.test(t))return"";let e;try{e=new URL(t)}catch{return""}return e.protocol!=="https:"?"":e.hostname.toLowerCase()}function H(t=process.env){let e=t&&(t.GITLAB_URL||t.GITLAB_INSTANCE_URL)||"";return b(e)}function f(t={}){if(t.gitlabHost){let e=String(t.gitlabHost).trim().toLowerCase();return e?e.includes("://")?b(e):e.replace(/:\d+$/,""):""}return H()}function L(t,e={}){let n=g(t);if(!n)return!1;if(n==="github.com"||n==="gitlab.com")return!0;let r=f(e);return!!(r&&n===r)}function E(t,e={}){if(t==="github.com")return"github";if(t==="gitlab.com")return"gitlab";let n=f(e);return n&&t===n?"gitlab":null}function P(t={},e={}){let n=t&&(t.cloneUrl||t.url)||"",r=b(n);if(!r)return null;let i=t.provider==="github"||t.provider==="gitlab"?t.provider:null,a=_(t,e),s=E(r,a?{gitlabHost:a}:{});return s?i&&i!==s?null:s:i==="gitlab"?"gitlab":null}function _(t,e={}){let n=f(e);return n||(t&&t.provider==="gitlab"?g(t.cloneUrl||t.url||""):"")}function D(t={},e="",n={}){let r=t&&(t.cloneUrl||t.url)||"";if(!r||!e||!P(t,n))return r;let i=_(t,n);return I(r,e,i?{gitlabHost:i}:{})}function I(t,e,n={}){if(!t||!e)return t;let r=g(t);if(!r)return t;if(r==="github.com")return t.replace(/^https:\/\/(?:[^@/]+@)?github\.com(?=[:/]|$)/i,`https://x-access-token:${e}@github.com`);if(r==="gitlab.com")return t.replace(/^https:\/\/(?:[^@/]+@)?gitlab\.com(?=[:/]|$)/i,`https://oauth2:${e}@gitlab.com`);let i=f(n);if(i&&r===i){let a=i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),s=new RegExp(`^https:\\/\\/(?:[^@/]+@)?${a}(?=[:/]|$)`,"i");return t.replace(s,`https://oauth2:${e}@${i}`)}return t}function j(t){return t&&String(t).replace(/^(https:\/\/)[^@/]+@/i,"$1")}function M(t,e){let n=t==null?"":String(t);return e&&(n=n.split(e).join("***")),n=n.replace(/(https?:\/\/)(?:x-access-token|oauth2):[^@\s/]+@/gi,"$1"),n=n.replace(/(https?:\/\/)[^@\s/:]+:[^@\s/]+@/gi,"$1"),n}async function J(t,e,n){try{await t("git",["remote","set-url","origin",j(n)],e)}catch(r){console.warn(`\u26A0\uFE0F  could not scrub token from origin remote (continuing): ${r?.message||r}`)}}async function V({run:t,repoPath:e,repoUrl:n,branch:r,token:i,resolveToken:a=m,gitlabHost:s}={}){if(typeof t!="function")throw new Error("securePush: `run` (a spawn wrapper resolving {code,stdout,stderr}) is required");if(!r)throw new Error("securePush: `branch` is required");let o=f({gitlabHost:s}),h=g(n),c=L(n,{gitlabHost:o}),u=i||"";if(!u&&c&&typeof a=="function"){let p=E(h,{gitlabHost:o});if(p)try{u=(await a(p))?.token||""}catch{}}else!u&&!c&&console.warn(`\u26A0\uFE0F push target host '${h||"(unparseable)"}' is not a trusted VCS host \u2014 refusing to mint a token`);let d=u&&c,y=d?I(n,u,{gitlabHost:o}):"origin",l=await t("git",["push",y,r],e);if(!l||l.code!==0){let p=M(l&&l.stderr||"",u);throw new Error(`git push failed (exit ${l?l.code:"?"}): ${String(p).slice(-500)}`)}return{code:l.code,stdout:l.stdout,stderr:l.stderr,pushedAuthed:!!d,target:d?"<authed>":"origin"}}export{Z as TRUSTED_VCS_HOSTS,I as authedUrl,D as authedUrlForRepo,b as hostnameOf,L as isTrustedVcsHost,E as providerForHost,P as providerForRepo,M as redactGitSecrets,g as safeVcsHostname,J as scrubRemoteToTokenless,V as securePush,H as selfHostGitlabHost,j as tokenlessUrl};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zibby/core",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "description": "Core test automation engine with multi-agent and multi-MCP support",
   "type": "module",
   "main": "dist/index.js",
@@ -69,9 +69,9 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openai/codex-sdk": "^0.143.0",
     "@playwright/mcp": "^0.0.70",
-    "@zibby/agent-workflow": "2.0.4",
-    "@zibby/mcp-browser": "2.0.4",
-    "@zibby/skill-ids": "2.0.4",
+    "@zibby/agent-workflow": "2.0.5",
+    "@zibby/mcp-browser": "2.0.5",
+    "@zibby/skill-ids": "2.0.5",
     "acorn": "^8.15.0",
     "acorn-walk": "^8.3.5",
     "axios": "^1.15.0",