codebase-onboarder 0.7.0 → 1.0.0

package/cli/agent/config.js

@@ -0,0 +1,98 @@
+import { promises as fs } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import { runProcess } from './process.js';
+export const HERMES_SOURCE = 'https://github.com/NousResearch/hermes-agent.git';
+export const HERMES_REVISION = 'eb7e8620324b32424c06218f6a28094df2e921f8';
+export function agentHome(env = process.env) {
+    return path.resolve(env.ONBOARDER_AGENT_HOME || path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'onboarder', 'agent'));
+}
+export function hermesBinary(env = process.env) {
+    return env.ONBOARDER_HERMES_BIN || 'hermes';
+}
+export function runtimePaths(home = agentHome(), env = process.env) {
+    const native = process.platform === 'win32' ? path.join(env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'hermes') : path.join(os.homedir(), '.hermes');
+    const configured = env.HERMES_HOME ? (path.basename(path.dirname(env.HERMES_HOME)) === 'profiles' ? path.dirname(path.dirname(env.HERMES_HOME)) : env.HERMES_HOME) : native;
+    // Named profiles share the installation's Python store, but not its config,
+    // credentials, sessions, memory, or MCP server selection.
+    const name = 'onboarder-' + createHash('sha256').update(path.resolve(home)).digest('hex').slice(0, 12);
+    return { home, profile: path.join(configured, 'profiles', name), runs: path.join(home, 'runs'), workspaces: path.join(home, 'workspaces'), server: fileURLToPath(new URL('./stdio.js', import.meta.url)) };
+}
+export function hermesEnvironment(home = agentHome(), env = process.env) {
+    return { ...env, HERMES_HOME: runtimePaths(home, env).profile, OPENAI_API_KEY: env.ONBOARDER_AI_API_KEY || env.OPENAI_API_KEY,
+        PATH: [path.join(os.homedir(), '.local', 'bin'), env.PATH || ''].join(path.delimiter) };
+}
+export async function setupAgent(home = agentHome(), env = process.env) {
+    const paths = runtimePaths(home, env);
+    for (const dir of [paths.profile, paths.runs, paths.workspaces])
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    const file = path.join(paths.profile, 'config.yaml');
+    const base = env.ONBOARDER_AI_BASE_URL || env.OPENAI_BASE_URL;
+    const model = env.ONBOARDER_AI_MODEL || env.OPENAI_MODEL;
+    // JSON is a YAML subset. Hermes can subsequently maintain this file with its own model wizard.
+    const config = {
+        ...(base && model ? { model: { provider: 'custom', base_url: base, default: model } } : {}),
+        agent: { max_turns: 24 }, memory: { memory_enabled: false, user_profile_enabled: false },
+        tools: { tool_search: { enabled: 'off' } },
+        mcp_servers: { onboarder: { command: process.execPath, args: [paths.server],
+                env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },
+                tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 } },
+    };
+    let created = false;
+    try {
+        await fs.writeFile(file, JSON.stringify(config, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+        created = true;
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    return { ...paths, configFile: file, created };
+}
+/** Refresh only harness-owned settings; retain the model wizard's provider/auth choices. */
+export async function prepareAgentProfile(home = agentHome(), env = process.env, signal) {
+    const setup = await setupAgent(home, env);
+    if (setup.created)
+        return setup;
+    const server = { command: process.execPath, args: [setup.server],
+        env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },
+        tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 };
+    const source = await fs.readFile(setup.configFile, 'utf8');
+    let config = null;
+    try {
+        const value = JSON.parse(source);
+        if (value && typeof value === 'object' && !Array.isArray(value))
+            config = value;
+    }
+    catch { /* Hermes' model wizard writes native YAML. */ }
+    if (config) {
+        config.mcp_servers = { ...(config.mcp_servers || {}), onboarder: server };
+        config.tools = { ...(config.tools || {}), tool_search: { ...(config.tools?.tool_search || {}), enabled: 'off' } };
+        config.memory = { ...(config.memory || {}), memory_enabled: false, user_profile_enabled: false };
+        const next = JSON.stringify(config, null, 2) + '\n';
+        if (source !== next) {
+            const temporary = setup.configFile + '-' + randomUUID();
+            try {
+                await fs.writeFile(temporary, next, { flag: 'wx', mode: 0o600 });
+                await fs.rename(temporary, setup.configFile);
+            }
+            finally {
+                await fs.rm(temporary, { force: true });
+            }
+        }
+    }
+    else {
+        // Let Hermes parse/preserve its own YAML rather than adding a Node dependency
+        // or hand-editing the model wizard's configuration.
+        for (const [key, value] of [['mcp_servers.onboarder', JSON.stringify(server)], ['tools.tool_search.enabled', 'off'], ['memory.memory_enabled', 'false'], ['memory.user_profile_enabled', 'false']]) {
+            const result = await runProcess(hermesBinary(env), ['config', 'set', key, value], { env: hermesEnvironment(home, env), signal, timeoutMs: 30_000, maxBytes: 128000 });
+            if (result.code)
+                throw new Error(`Could not refresh the dedicated Hermes profile: ${result.stderr.slice(-1500) || result.stdout.slice(-1500)}`);
+        }
+    }
+    return setup;
+}
+//# sourceMappingURL=config.js.map

package/cli/agent/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/agent/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9I,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,OAAO,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACxK,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5K,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7M,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACxF,OAAO,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,cAAc;QAC3H,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5F,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,eAAe,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,YAAY,CAAC;IACzD,+FAA+F;IAC/F,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE;QACxF,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,WAAW,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzE,GAAG,EAAE,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAChH,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;KACrF,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtH,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,MAAoB;IACtH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9D,GAAG,EAAE,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;QAChH,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;IACnL,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC1E,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAClH,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,UAAU,EAAE,CAAC;YACxD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;oBAC/G,CAAC;gBAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8EAA8E;QAC9E,oDAAoD;QACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,2BAA2B,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,EAAE,OAAO,CAAC,EAAE,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACnM,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACtK,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { fileURLToPath } from 'node:url';\nimport { randomUUID } from 'node:crypto';\nimport { runProcess } from './process.js';\n\nexport const HERMES_SOURCE = 'https://github.com/NousResearch/hermes-agent.git';\nexport const HERMES_REVISION = 'eb7e8620324b32424c06218f6a28094df2e921f8';\nexport function agentHome(env: NodeJS.ProcessEnv = process.env): string {\n  return path.resolve(env.ONBOARDER_AGENT_HOME || path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'onboarder', 'agent'));\n}\nexport function hermesBinary(env: NodeJS.ProcessEnv = process.env): string {\n  return env.ONBOARDER_HERMES_BIN || 'hermes';\n}\nexport function runtimePaths(home = agentHome(), env: NodeJS.ProcessEnv = process.env) {\n  const native = process.platform === 'win32' ? path.join(env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'hermes') : path.join(os.homedir(), '.hermes');\n  const configured = env.HERMES_HOME ? (path.basename(path.dirname(env.HERMES_HOME)) === 'profiles' ? path.dirname(path.dirname(env.HERMES_HOME)) : env.HERMES_HOME) : native;\n  // Named profiles share the installation's Python store, but not its config,\n  // credentials, sessions, memory, or MCP server selection.\n  const name = 'onboarder-' + createHash('sha256').update(path.resolve(home)).digest('hex').slice(0, 12);\n  return { home, profile: path.join(configured, 'profiles', name), runs: path.join(home, 'runs'), workspaces: path.join(home, 'workspaces'), server: fileURLToPath(new URL('./stdio.js', import.meta.url)) };\n}\nexport function hermesEnvironment(home = agentHome(), env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {\n  return { ...env, HERMES_HOME: runtimePaths(home, env).profile, OPENAI_API_KEY: env.ONBOARDER_AI_API_KEY || env.OPENAI_API_KEY,\n    PATH: [path.join(os.homedir(), '.local', 'bin'), env.PATH || ''].join(path.delimiter) };\n}\nexport async function setupAgent(home = agentHome(), env: NodeJS.ProcessEnv = process.env) {\n  const paths = runtimePaths(home, env);\n  for (const dir of [paths.profile, paths.runs, paths.workspaces]) await fs.mkdir(dir, { recursive: true, mode: 0o700 });\n  const file = path.join(paths.profile, 'config.yaml');\n  const base = env.ONBOARDER_AI_BASE_URL || env.OPENAI_BASE_URL;\n  const model = env.ONBOARDER_AI_MODEL || env.OPENAI_MODEL;\n  // JSON is a YAML subset. Hermes can subsequently maintain this file with its own model wizard.\n  const config = {\n    ...(base && model ? { model: { provider: 'custom', base_url: base, default: model } } : {}),\n    agent: { max_turns: 24 }, memory: { memory_enabled: false, user_profile_enabled: false },\n    tools: { tool_search: { enabled: 'off' } },\n    mcp_servers: { onboarder: { command: process.execPath, args: [paths.server],\n      env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },\n      tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 } },\n  };\n  let created = false;\n  try { await fs.writeFile(file, JSON.stringify(config, null, 2) + '\\n', { mode: 0o600, flag: 'wx' }); created = true; }\n  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error; }\n  return { ...paths, configFile: file, created };\n}\n\n/** Refresh only harness-owned settings; retain the model wizard's provider/auth choices. */\nexport async function prepareAgentProfile(home = agentHome(), env: NodeJS.ProcessEnv = process.env, signal?: AbortSignal) {\n  const setup = await setupAgent(home, env);\n  if (setup.created) return setup;\n  const server = { command: process.execPath, args: [setup.server],\n    env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },\n    tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 };\n  const source = await fs.readFile(setup.configFile, 'utf8');\n  let config: Record<string, any> | null = null;\n  try { const value = JSON.parse(source); if (value && typeof value === 'object' && !Array.isArray(value)) config = value; } catch { /* Hermes' model wizard writes native YAML. */ }\n  if (config) {\n    config.mcp_servers = { ...(config.mcp_servers || {}), onboarder: server };\n    config.tools = { ...(config.tools || {}), tool_search: { ...(config.tools?.tool_search || {}), enabled: 'off' } };\n    config.memory = { ...(config.memory || {}), memory_enabled: false, user_profile_enabled: false };\n    const next = JSON.stringify(config, null, 2) + '\\n';\n    if (source !== next) {\n      const temporary = setup.configFile + '-' + randomUUID();\n      try { await fs.writeFile(temporary, next, { flag: 'wx', mode: 0o600 }); await fs.rename(temporary, setup.configFile); }\n      finally { await fs.rm(temporary, { force: true }); }\n    }\n  } else {\n    // Let Hermes parse/preserve its own YAML rather than adding a Node dependency\n    // or hand-editing the model wizard's configuration.\n    for (const [key, value] of [['mcp_servers.onboarder', JSON.stringify(server)], ['tools.tool_search.enabled', 'off'], ['memory.memory_enabled', 'false'], ['memory.user_profile_enabled', 'false']]) {\n      const result = await runProcess(hermesBinary(env), ['config', 'set', key, value], { env: hermesEnvironment(home, env), signal, timeoutMs: 30_000, maxBytes: 128000 });\n      if (result.code) throw new Error(`Could not refresh the dedicated Hermes profile: ${result.stderr.slice(-1500) || result.stdout.slice(-1500)}`);\n    }\n  }\n  return setup;\n}\n"]}

package/cli/agent/contracts.d.ts

@@ -0,0 +1,77 @@
+export declare const AGENT_MODES: readonly ['ask', 'review', 'triage', 'implement', 'pr', 'github'];
+export type AgentMode = typeof AGENT_MODES[number];
+export interface AgentRequest {
+    mode: AgentMode;
+    root: string;
+    task: string;
+    pr?: number;
+    issue?: number;
+    maxTurns?: number;
+    timeoutSeconds?: number;
+    allowChecks?: boolean;
+    allowGithubWrites?: boolean;
+    dryRun?: boolean;
+    model?: string;
+    provider?: string;
+    resume?: string;
+    base?: string;
+}
+export interface RunManifest {
+    schemaVersion: 1;
+    id: string;
+    mode: AgentMode;
+    sourceRoot: string;
+    root: string;
+    repository: string | null;
+    remote: string | null;
+    branch: string | null;
+    baseBranch: string | null;
+    task: string;
+    pr?: number;
+    issue?: number;
+    permissions: {
+        files: boolean;
+        checks: boolean;
+        github: boolean;
+    };
+    startedAt: string;
+    timeoutSeconds: number;
+    maxTurns: number;
+    auditFile: string;
+}
+export interface AgentEvent {
+    type: 'system' | 'text' | 'tool_use' | 'tool_result' | 'result';
+    subtype?: string;
+    name?: string;
+    text?: string;
+    session_id?: string;
+    exit_code?: number;
+    error?: string;
+    is_error?: boolean;
+    tokens?: Record<string, number>;
+    duration_ms?: number;
+}
+export interface AgentResult {
+    id: string;
+    status: 'completed' | 'failed' | 'cancelled';
+    mode: AgentMode;
+    answer: string;
+    sessionId: string | null;
+    workspace: string;
+    branch: string | null;
+    repository: string | null;
+    auditFile: string;
+    completedAt: string;
+    tokens?: Record<string, number>;
+}
+export interface AgentTool {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: 'object';
+        properties: Record<string, unknown>;
+        required?: string[];
+        additionalProperties?: boolean;
+    };
+    run: (args: Record<string, unknown>) => Promise<unknown>;
+}

package/cli/agent/contracts.js

@@ -0,0 +1,2 @@
+export const AGENT_MODES = ['ask', 'review', 'triage', 'implement', 'pr', 'github'];
+//# sourceMappingURL=contracts.js.map

package/cli/agent/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/cli/agent/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC","sourcesContent":["export const AGENT_MODES = ['ask', 'review', 'triage', 'implement', 'pr', 'github'] as const;\nexport type AgentMode = typeof AGENT_MODES[number];\nexport interface AgentRequest {\n  mode: AgentMode;\n  root: string;\n  task: string;\n  pr?: number;\n  issue?: number;\n  maxTurns?: number;\n  timeoutSeconds?: number;\n  allowChecks?: boolean;\n  allowGithubWrites?: boolean;\n  dryRun?: boolean;\n  model?: string;\n  provider?: string;\n  resume?: string;\n  base?: string;\n}\nexport interface RunManifest {\n  schemaVersion: 1;\n  id: string;\n  mode: AgentMode;\n  sourceRoot: string;\n  root: string;\n  repository: string | null;\n  remote: string | null;\n  branch: string | null;\n  baseBranch: string | null;\n  task: string;\n  pr?: number;\n  issue?: number;\n  permissions: { files: boolean; checks: boolean; github: boolean };\n  startedAt: string;\n  timeoutSeconds: number;\n  maxTurns: number;\n  auditFile: string;\n}\nexport interface AgentEvent {\n  type: 'system' | 'text' | 'tool_use' | 'tool_result' | 'result';\n  subtype?: string;\n  name?: string;\n  text?: string;\n  session_id?: string;\n  exit_code?: number;\n  error?: string;\n  is_error?: boolean;\n  tokens?: Record<string, number>;\n  duration_ms?: number;\n}\nexport interface AgentResult {\n  id: string;\n  status: 'completed' | 'failed' | 'cancelled';\n  mode: AgentMode;\n  answer: string;\n  sessionId: string | null;\n  workspace: string;\n  branch: string | null;\n  repository: string | null;\n  auditFile: string;\n  completedAt: string;\n  tokens?: Record<string, number>;\n}\nexport interface AgentTool {\n  name: string;\n  description: string;\n  inputSchema: { type: 'object'; properties: Record<string, unknown>; required?: string[]; additionalProperties?: boolean };\n  run: (args: Record<string, unknown>) => Promise<unknown>;\n}\n"]}

package/cli/agent/files.d.ts

@@ -0,0 +1,19 @@
+export declare const FILE_LIMIT: number;
+export declare const hashText: (text: string) => string;
+export declare function safeRelative(file: string): string;
+export declare function scopedFile(root: string, file: string, createParents?: boolean): Promise<string>;
+export declare function readAgentFile(root: string, file: string): Promise<{
+    file: string;
+    content: string;
+    sha256: string;
+    lines: number;
+}>;
+export declare function writeAgentFile(root: string, file: string, content: string, expected: string): Promise<{
+    file: string;
+    sha256: string;
+    bytes: number;
+}>;
+export declare function deleteAgentFile(root: string, file: string, expected: string): Promise<{
+    file: string;
+    deleted: boolean;
+}>;

package/cli/agent/files.js

@@ -0,0 +1,109 @@
+import { promises as fs, constants } from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+export const FILE_LIMIT = 128 * 1024;
+export const hashText = (text) => createHash('sha256').update(text).digest('hex');
+export function safeRelative(file) {
+    if (!file || file.length > 500 || path.isAbsolute(file) || file.includes('\\') || /[\x00-\x1f]/.test(file))
+        throw new Error('Use a relative repository file path.');
+    const parts = file.split('/');
+    if (parts.some(p => !p || p === '..' || p === '.' || ['.git', 'node_modules', '.ssh', '.aws', '.npmrc', '.pypirc', '.netrc', '.git-credentials'].includes(p) || /^\.env(?:\.|$)/.test(p) || /^(?:id_rsa|id_ed25519)$|\.(?:pem|key)$/i.test(p)))
+        throw new Error('This path is outside the agent source-file scope.');
+    return file;
+}
+export async function scopedFile(root, file, createParents = false) {
+    safeRelative(file);
+    const canonical = await fs.realpath(root);
+    const parts = file.split('/');
+    let current = canonical;
+    for (let i = 0; i < parts.length; i++) {
+        current = path.join(current, parts[i]);
+        let stat;
+        try {
+            stat = await fs.lstat(current);
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+            if (createParents && i < parts.length - 1)
+                await fs.mkdir(current);
+            else if (i < parts.length - 1)
+                throw new Error('The parent directory does not exist.');
+            continue;
+        }
+        if (stat.isSymbolicLink())
+            throw new Error('Agent file tools do not follow symbolic links.');
+        if (i < parts.length - 1 && !stat.isDirectory())
+            throw new Error('The parent path is not a directory.');
+        if (i === parts.length - 1 && !stat.isFile())
+            throw new Error('The path is not a regular file.');
+    }
+    return current;
+}
+async function readBounded(file) {
+    const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > FILE_LIMIT)
+            throw new Error(`File must be text and at most ${FILE_LIMIT} bytes.`);
+        const buffer = Buffer.alloc(FILE_LIMIT + 1);
+        let bytesRead = 0;
+        while (bytesRead < buffer.length) {
+            const read = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
+            if (!read.bytesRead)
+                break;
+            bytesRead += read.bytesRead;
+        }
+        if (bytesRead > FILE_LIMIT || buffer.subarray(0, bytesRead).includes(0))
+            throw new Error('File exceeds the text-file limit or contains binary data.');
+        return buffer.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readAgentFile(root, file) {
+    const content = await readBounded(await scopedFile(root, file));
+    return { file, content, sha256: hashText(content), lines: content.split('\n').length };
+}
+export async function writeAgentFile(root, file, content, expected) {
+    if (Buffer.byteLength(content) > FILE_LIMIT || content.includes('\0'))
+        throw new Error('New content exceeds the text-file limit.');
+    const target = await scopedFile(root, file, true);
+    const check = async () => {
+        try {
+            const current = await readBounded(target);
+            if (expected === 'new' || hashText(current) !== expected)
+                throw new Error('The file changed. Read it again before writing.');
+        }
+        catch (e) {
+            if (e.code === 'ENOENT' && expected === 'new')
+                return;
+            throw e;
+        }
+    };
+    await check();
+    const mode = await fs.stat(target).then(s => s.mode & 0o777).catch(() => 0o644);
+    const temporary = path.join(path.dirname(target), `.onboarder-${randomUUID()}.tmp`);
+    try {
+        await fs.writeFile(temporary, content, { mode, flag: 'wx' });
+        await check();
+        if (expected === 'new')
+            await fs.link(temporary, target);
+        else
+            await fs.rename(temporary, target);
+    }
+    finally {
+        await fs.unlink(temporary).catch(() => { });
+    }
+    return { file, sha256: hashText(content), bytes: Buffer.byteLength(content) };
+}
+export async function deleteAgentFile(root, file, expected) {
+    const target = await scopedFile(root, file);
+    const current = await readBounded(target);
+    if (hashText(current) !== expected)
+        throw new Error('The file changed. Read it again before deleting.');
+    await fs.unlink(target);
+    return { file, deleted: true };
+}
+//# sourceMappingURL=files.js.map

package/cli/agent/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/cli/agent/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpK,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrT,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,aAAa,GAAG,KAAK;IAChF,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACvC,OAAO,CAAC,EAAE,CAAC;YACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,aAAa,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;iBAC9D,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7F,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,SAAS,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM;YAC3B,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,SAAS,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACtJ,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe,EAAE,QAAgB;IAChG,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnI,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/H,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK;gBAAE,OAAO;YACjF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc,UAAU,EAAE,MAAM,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,EAAE,CAAC;QACd,IAAI,QAAQ,KAAK,KAAK;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;;YACpD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AAChF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,QAAgB;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { promises as fs, constants } from 'node:fs';\nimport path from 'node:path';\nimport { createHash, randomUUID } from 'node:crypto';\n\nexport const FILE_LIMIT = 128 * 1024;\nexport const hashText = (text: string) => createHash('sha256').update(text).digest('hex');\nexport function safeRelative(file: string): string {\n  if (!file || file.length > 500 || path.isAbsolute(file) || file.includes('\\\\') || /[\\x00-\\x1f]/.test(file)) throw new Error('Use a relative repository file path.');\n  const parts = file.split('/');\n  if (parts.some(p => !p || p === '..' || p === '.' || ['.git', 'node_modules', '.ssh', '.aws', '.npmrc', '.pypirc', '.netrc', '.git-credentials'].includes(p) || /^\\.env(?:\\.|$)/.test(p) || /^(?:id_rsa|id_ed25519)$|\\.(?:pem|key)$/i.test(p))) throw new Error('This path is outside the agent source-file scope.');\n  return file;\n}\nexport async function scopedFile(root: string, file: string, createParents = false): Promise<string> {\n  safeRelative(file);\n  const canonical = await fs.realpath(root);\n  const parts = file.split('/');\n  let current = canonical;\n  for (let i = 0; i < parts.length; i++) {\n    current = path.join(current, parts[i]);\n    let stat;\n    try { stat = await fs.lstat(current); }\n    catch (e) {\n      if ((e as NodeJS.ErrnoException).code !== 'ENOENT') throw e;\n      if (createParents && i < parts.length - 1) await fs.mkdir(current);\n      else if (i < parts.length - 1) throw new Error('The parent directory does not exist.');\n      continue;\n    }\n    if (stat.isSymbolicLink()) throw new Error('Agent file tools do not follow symbolic links.');\n    if (i < parts.length - 1 && !stat.isDirectory()) throw new Error('The parent path is not a directory.');\n    if (i === parts.length - 1 && !stat.isFile()) throw new Error('The path is not a regular file.');\n  }\n  return current;\n}\nasync function readBounded(file: string): Promise<string> {\n  const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));\n  try {\n    const stat = await handle.stat();\n    if (!stat.isFile() || stat.size > FILE_LIMIT) throw new Error(`File must be text and at most ${FILE_LIMIT} bytes.`);\n    const buffer = Buffer.alloc(FILE_LIMIT + 1);\n    let bytesRead = 0;\n    while (bytesRead < buffer.length) {\n      const read = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);\n      if (!read.bytesRead) break;\n      bytesRead += read.bytesRead;\n    }\n    if (bytesRead > FILE_LIMIT || buffer.subarray(0, bytesRead).includes(0)) throw new Error('File exceeds the text-file limit or contains binary data.');\n    return buffer.subarray(0, bytesRead).toString('utf8');\n  } finally { await handle.close(); }\n}\nexport async function readAgentFile(root: string, file: string) {\n  const content = await readBounded(await scopedFile(root, file));\n  return { file, content, sha256: hashText(content), lines: content.split('\\n').length };\n}\nexport async function writeAgentFile(root: string, file: string, content: string, expected: string) {\n  if (Buffer.byteLength(content) > FILE_LIMIT || content.includes('\\0')) throw new Error('New content exceeds the text-file limit.');\n  const target = await scopedFile(root, file, true);\n  const check = async () => {\n    try {\n      const current = await readBounded(target);\n      if (expected === 'new' || hashText(current) !== expected) throw new Error('The file changed. Read it again before writing.');\n    } catch (e) {\n      if ((e as NodeJS.ErrnoException).code === 'ENOENT' && expected === 'new') return;\n      throw e;\n    }\n  };\n  await check();\n  const mode = await fs.stat(target).then(s => s.mode & 0o777).catch(() => 0o644);\n  const temporary = path.join(path.dirname(target), `.onboarder-${randomUUID()}.tmp`);\n  try {\n    await fs.writeFile(temporary, content, { mode, flag: 'wx' });\n    await check();\n    if (expected === 'new') await fs.link(temporary, target);\n    else await fs.rename(temporary, target);\n  } finally { await fs.unlink(temporary).catch(() => {}); }\n  return { file, sha256: hashText(content), bytes: Buffer.byteLength(content) };\n}\nexport async function deleteAgentFile(root: string, file: string, expected: string) {\n  const target = await scopedFile(root, file);\n  const current = await readBounded(target);\n  if (hashText(current) !== expected) throw new Error('The file changed. Read it again before deleting.');\n  await fs.unlink(target);\n  return { file, deleted: true };\n}\n"]}

package/cli/agent/gitSource.d.ts

@@ -0,0 +1,18 @@
+import { GithubClient } from './github.js';
+/** Resolve immutable Git objects, checking modes before reading any blob. The
+ * contents API can dereference symlinks, so it cannot enforce our file scope. */
+export declare class GithubSourceReader {
+    private client;
+    private roots;
+    private trees;
+    constructor(client: GithubClient);
+    read(file: string, sha: string): Promise<{
+        repository: string;
+        file: string;
+        commitSha: string;
+        blobSha: string;
+        content: string;
+        sha256: string;
+        bytes: number;
+    }>;
+}

package/cli/agent/gitSource.js

@@ -0,0 +1,69 @@
+import { GithubClient } from './github.js';
+import { safeRelative, FILE_LIMIT, hashText } from './files.js';
+const validSha = (sha) => typeof sha === 'string' && /^[a-f\d]{40,64}$/i.test(sha);
+/** Resolve immutable Git objects, checking modes before reading any blob. The
+ * contents API can dereference symlinks, so it cannot enforce our file scope. */
+export class GithubSourceReader {
+    client;
+    roots = new Map();
+    trees = new Map();
+    constructor(client) {
+        this.client = client;
+    }
+    async read(file, sha) {
+        safeRelative(file);
+        if (!validSha(sha))
+            throw new Error('Use an exact commit SHA from the PR or GitHub run.');
+        const parts = file.split('/');
+        if (parts.length > 20)
+            throw new Error('The source path exceeds the directory-depth limit.');
+        let tree = this.roots.get(sha);
+        if (!tree) {
+            const commit = (await this.client.request(`/git/commits/${sha}`)).data;
+            tree = commit?.tree?.sha;
+            if (!validSha(tree))
+                throw new Error('GitHub returned no valid commit tree.');
+            if (this.roots.size >= 64)
+                this.roots.clear();
+            this.roots.set(sha, tree);
+        }
+        let entry;
+        for (let i = 0; i < parts.length; i++) {
+            let entries = this.trees.get(tree);
+            if (!entries) {
+                const response = (await this.client.request(`/git/trees/${tree}`)).data;
+                if (!response || !Array.isArray(response.tree) || response.truncated)
+                    throw new Error('GitHub tree coverage is incomplete.');
+                entries = response.tree;
+                if (this.trees.size >= 32)
+                    this.trees.clear();
+                this.trees.set(tree, entries);
+            }
+            entry = entries.find(e => e.path === parts[i]);
+            if (!entry || !validSha(entry.sha))
+                throw new Error('Source file is not present at that commit.');
+            if (i < parts.length - 1) {
+                if (entry.type !== 'tree' || entry.mode !== '040000')
+                    throw new Error('Source paths cannot traverse symlinks or submodules.');
+                tree = entry.sha;
+            }
+        }
+        if (!entry || entry.type !== 'blob' || !['100644', '100755'].includes(entry.mode) || !Number.isSafeInteger(entry.size) || entry.size < 0 || entry.size > FILE_LIMIT)
+            throw new Error('Source must be a regular text file, not a symlink or submodule, at most 128 KiB.');
+        const response = (await this.client.request(`/git/blobs/${entry.sha}`)).data;
+        if (!response || response.encoding !== 'base64' || typeof response.content !== 'string' || response.size !== entry.size)
+            throw new Error('GitHub returned an invalid source blob.');
+        const buffer = Buffer.from(response.content, 'base64');
+        if (buffer.length !== entry.size || buffer.length > FILE_LIMIT || buffer.includes(0))
+            throw new Error('GitHub file exceeds the text limit or contains binary data.');
+        let content;
+        try {
+            content = new TextDecoder('utf-8', { fatal: true }).decode(buffer);
+        }
+        catch {
+            throw new Error('GitHub file is not UTF-8 source text.');
+        }
+        return { repository: this.client.repository, file, commitSha: sha, blobSha: entry.sha, content, sha256: hashText(content), bytes: buffer.length };
+    }
+}
+//# sourceMappingURL=gitSource.js.map

package/cli/agent/gitSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitSource.js","sourceRoot":"","sources":["../../src/cli/agent/gitSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGhE,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3G;iFACiF;AACjF,MAAM,OAAO,kBAAkB;IAGT,MAAM;IAFlB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,YAAoB,MAAoB;sBAApB,MAAM;IAAiB,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,GAAW;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC7F,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC,IAA0C,CAAC;YAC7G,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAwB,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAsD,CAAC;gBAC1H,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC7H,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE;oBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/E,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAClG,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC9H,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAK,GAAG,CAAC,IAAI,KAAK,CAAC,IAAK,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAC3Q,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAqE,CAAC;QAC9I,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACpL,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrK,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAAC,CAAC;QAC/I,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACpJ,CAAC;CACF","sourcesContent":["import { GithubClient } from './github.js';\nimport { safeRelative, FILE_LIMIT, hashText } from './files.js';\n\ntype Entry = { path: string; mode: string; type: string; sha: string; size?: number };\nconst validSha = (sha: unknown): sha is string => typeof sha === 'string' && /^[a-f\\d]{40,64}$/i.test(sha);\n/** Resolve immutable Git objects, checking modes before reading any blob. The\n * contents API can dereference symlinks, so it cannot enforce our file scope. */\nexport class GithubSourceReader {\n  private roots = new Map<string, string>();\n  private trees = new Map<string, Entry[]>();\n  constructor(private client: GithubClient) {}\n  async read(file: string, sha: string) {\n    safeRelative(file);\n    if (!validSha(sha)) throw new Error('Use an exact commit SHA from the PR or GitHub run.');\n    const parts = file.split('/');\n    if (parts.length > 20) throw new Error('The source path exceeds the directory-depth limit.');\n    let tree = this.roots.get(sha);\n    if (!tree) {\n      const commit = (await this.client.request(`/git/commits/${sha}`)).data as { tree?: { sha?: string } } | null;\n      tree = commit?.tree?.sha;\n      if (!validSha(tree)) throw new Error('GitHub returned no valid commit tree.');\n      if (this.roots.size >= 64) this.roots.clear(); this.roots.set(sha, tree);\n    }\n    let entry: Entry | undefined;\n    for (let i = 0; i < parts.length; i++) {\n      let entries = this.trees.get(tree);\n      if (!entries) {\n        const response = (await this.client.request(`/git/trees/${tree}`)).data as { tree?: Entry[]; truncated?: boolean } | null;\n        if (!response || !Array.isArray(response.tree) || response.truncated) throw new Error('GitHub tree coverage is incomplete.');\n        entries = response.tree;\n        if (this.trees.size >= 32) this.trees.clear(); this.trees.set(tree, entries);\n      }\n      entry = entries.find(e => e.path === parts[i]);\n      if (!entry || !validSha(entry.sha)) throw new Error('Source file is not present at that commit.');\n      if (i < parts.length - 1) {\n        if (entry.type !== 'tree' || entry.mode !== '040000') throw new Error('Source paths cannot traverse symlinks or submodules.');\n        tree = entry.sha;\n      }\n    }\n    if (!entry || entry.type !== 'blob' || !['100644', '100755'].includes(entry.mode) || !Number.isSafeInteger(entry.size) || entry.size! < 0 || entry.size! > FILE_LIMIT) throw new Error('Source must be a regular text file, not a symlink or submodule, at most 128 KiB.');\n    const response = (await this.client.request(`/git/blobs/${entry.sha}`)).data as { encoding?: string; content?: string; size?: number } | null;\n    if (!response || response.encoding !== 'base64' || typeof response.content !== 'string' || response.size !== entry.size) throw new Error('GitHub returned an invalid source blob.');\n    const buffer = Buffer.from(response.content, 'base64');\n    if (buffer.length !== entry.size || buffer.length > FILE_LIMIT || buffer.includes(0)) throw new Error('GitHub file exceeds the text limit or contains binary data.');\n    let content: string;\n    try { content = new TextDecoder('utf-8', { fatal: true }).decode(buffer); } catch { throw new Error('GitHub file is not UTF-8 source text.'); }\n    return { repository: this.client.repository, file, commitSha: sha, blobSha: entry.sha, content, sha256: hashText(content), bytes: buffer.length };\n  }\n}\n"]}

package/cli/agent/github.d.ts

@@ -0,0 +1,21 @@
+export interface GithubOptions {
+    token?: string;
+    fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
+}
+export declare function githubToken(env?: NodeJS.ProcessEnv): string;
+export declare function repositoryFromRemote(remote: string): string | null;
+export declare function positiveId(value: unknown, label: string): number;
+export declare class GithubClient {
+    readonly repository: string;
+    private options;
+    constructor(repository: string, options?: GithubOptions);
+    request(route: string, method?: string, body?: unknown): Promise<{
+        data: unknown;
+        more: boolean;
+    }>;
+    list(route: string, pages?: number): Promise<{
+        items: unknown[];
+        truncated: boolean;
+    }>;
+}

package/cli/agent/github.js

@@ -0,0 +1,94 @@
+export function githubToken(env = process.env) {
+    return [env.GITHUB_TOKEN, env.GH_TOKEN].map(t => (t || '').trim()).find(t => t && !t.startsWith('${')) || '';
+}
+export function repositoryFromRemote(remote) {
+    const match = remote.match(/^(?:https:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/?$/i);
+    return match && validRepository(`${match[1]}/${match[2]}`) ? `${match[1]}/${match[2]}` : null;
+}
+function validRepository(value) {
+    const [owner, name, extra] = value.split('/');
+    return !extra && /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(owner || '') && /^[A-Za-z0-9_.-]{1,100}$/.test(name || '') && name !== '.' && name !== '..';
+}
+export function positiveId(value, label) {
+    if (typeof value !== 'number' && (typeof value !== 'string' || !/^\d+$/.test(value)))
+        throw new Error(`${label} must be a positive integer.`);
+    const id = typeof value === 'number' ? value : Number(value);
+    if (!Number.isSafeInteger(id) || id < 1 || id > 2147483647)
+        throw new Error(`${label} must be a positive integer.`);
+    return id;
+}
+export class GithubClient {
+    repository;
+    options;
+    constructor(repository, options = {}) {
+        this.repository = repository;
+        this.options = options;
+        if (!validRepository(repository))
+            throw new Error('Use a GitHub repository in owner/name form.');
+    }
+    async request(route, method = 'GET', body) {
+        if ((route !== '' && !route.startsWith('/')) || route.includes('..') || route.includes('#') || route.includes('\\') || /%(?:2e|2f|5c)/i.test(route.split('?')[0]))
+            throw new Error('Invalid GitHub route.');
+        const headers = { accept: 'application/vnd.github+json', 'x-github-api-version': '2022-11-28', 'user-agent': 'onboarder-hermes' };
+        const token = this.options.token ?? githubToken();
+        if (token)
+            headers.authorization = `Bearer ${token}`;
+        if (body !== undefined)
+            headers['content-type'] = 'application/json';
+        const signal = this.options.signal ? AbortSignal.any([this.options.signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000);
+        const res = await (this.options.fetchImpl || fetch)(`https://api.github.com/repos/${this.repository}${route}`, {
+            method, headers, signal, redirect: 'error', ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+        if (!res.ok) {
+            const reasons = { 401: 'GitHub authentication failed. Set GITHUB_TOKEN or GH_TOKEN.', 403: 'GitHub denied the request or its rate limit was reached.', 404: 'GitHub could not find this repository or resource; private repositories require a token.', 422: 'GitHub rejected the request. Check the issue, branch, or pull-request fields.' };
+            throw new Error(reasons[res.status] || `GitHub returned ${res.status}.`);
+        }
+        if (Number(res.headers.get('content-length')) > 2 * 1024 * 1024)
+            throw new Error('GitHub response exceeds the size limit.');
+        if (res.status === 204)
+            return { data: null, more: false };
+        const reader = res.body?.getReader();
+        let bytes = 0, text = '';
+        const decoder = new TextDecoder();
+        if (reader) {
+            try {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    bytes += value.byteLength;
+                    if (bytes > 2 * 1024 * 1024)
+                        throw new Error('GitHub response exceeds the size limit.');
+                    text += decoder.decode(value, { stream: true });
+                }
+                text += decoder.decode();
+            }
+            finally {
+                await reader.cancel().catch(() => { });
+            }
+        }
+        let data;
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            throw new Error('GitHub returned an unreadable response.');
+        }
+        return { data, more: /rel="next"/.test(res.headers.get('link') || '') };
+    }
+    async list(route, pages = 2) {
+        const items = [];
+        let more = false;
+        for (let page = 1; page <= pages; page++) {
+            const response = await this.request(`${route}${route.includes('?') ? '&' : '?'}per_page=100&page=${page}`);
+            if (!Array.isArray(response.data))
+                throw new Error('GitHub returned an unreadable list.');
+            items.push(...response.data);
+            more = response.more;
+            if (!more)
+                break;
+        }
+        return { items, truncated: more };
+    }
+}
+//# sourceMappingURL=github.js.map

package/cli/agent/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/cli/agent/github.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,WAAW,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC9D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/G,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6HAA6H,CAAC,CAAC;IAC1J,OAAO,KAAK,IAAI,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC;AACD,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;AACtJ,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC9I,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACpH,OAAO,EAAE,CAAC;AACZ,CAAC;AACD,MAAM,OAAO,YAAY;IACF,UAAU;IAAkB,OAAO;IAAxD,YAAqB,UAAkB,EAAU,OAAO,GAAkB,EAAE;0BAAvD,UAAU;uBAAkB,OAAO;QACtD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc;QACzD,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC5M,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;QAC1J,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QACrD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvI,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,gCAAgC,IAAI,CAAC,UAAU,GAAG,KAAK,EAAE,EAAE;YAC7G,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1G,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAA2B,EAAE,GAAG,EAAE,6DAA6D,EAAE,GAAG,EAAE,0DAA0D,EAAE,GAAG,EAAE,0FAA0F,EAAE,GAAG,EAAE,+EAA+E,EAAE,CAAC;YACvW,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5H,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBAAC,SAAS,CAAC;oBAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,IAAI,IAAI;wBAAE,MAAM;oBAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;oBACvG,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;oBAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;oBACjK,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAAC,CAAC;QACtG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,KAAK,GAAG,CAAC;QACjC,MAAM,KAAK,GAAc,EAAE,CAAC;QAAC,IAAI,IAAI,GAAG,KAAK,CAAC;QAC9C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI;gBAAE,MAAM;QACvE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;CACF","sourcesContent":["export interface GithubOptions { token?: string; fetchImpl?: typeof fetch; signal?: AbortSignal }\nexport function githubToken(env: NodeJS.ProcessEnv = process.env): string {\n  return [env.GITHUB_TOKEN, env.GH_TOKEN].map(t => (t || '').trim()).find(t => t && !t.startsWith('${')) || '';\n}\nexport function repositoryFromRemote(remote: string): string | null {\n  const match = remote.match(/^(?:https:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)([A-Za-z0-9_.-]+)\\/([A-Za-z0-9_.-]+?)(?:\\.git)?\\/?$/i);\n  return match && validRepository(`${match[1]}/${match[2]}`) ? `${match[1]}/${match[2]}` : null;\n}\nfunction validRepository(value: string): boolean {\n  const [owner, name, extra] = value.split('/');\n  return !extra && /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(owner || '') && /^[A-Za-z0-9_.-]{1,100}$/.test(name || '') && name !== '.' && name !== '..';\n}\nexport function positiveId(value: unknown, label: string): number {\n  if (typeof value !== 'number' && (typeof value !== 'string' || !/^\\d+$/.test(value))) throw new Error(`${label} must be a positive integer.`);\n  const id = typeof value === 'number' ? value : Number(value);\n  if (!Number.isSafeInteger(id) || id < 1 || id > 2147483647) throw new Error(`${label} must be a positive integer.`);\n  return id;\n}\nexport class GithubClient {\n  constructor(readonly repository: string, private options: GithubOptions = {}) {\n    if (!validRepository(repository)) throw new Error('Use a GitHub repository in owner/name form.');\n  }\n  async request(route: string, method = 'GET', body?: unknown): Promise<{ data: unknown; more: boolean }> {\n    if ((route !== '' && !route.startsWith('/')) || route.includes('..') || route.includes('#') || route.includes('\\\\') || /%(?:2e|2f|5c)/i.test(route.split('?')[0])) throw new Error('Invalid GitHub route.');\n    const headers: Record<string, string> = { accept: 'application/vnd.github+json', 'x-github-api-version': '2022-11-28', 'user-agent': 'onboarder-hermes' };\n    const token = this.options.token ?? githubToken();\n    if (token) headers.authorization = `Bearer ${token}`;\n    if (body !== undefined) headers['content-type'] = 'application/json';\n    const signal = this.options.signal ? AbortSignal.any([this.options.signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000);\n    const res = await (this.options.fetchImpl || fetch)(`https://api.github.com/repos/${this.repository}${route}`, {\n      method, headers, signal, redirect: 'error', ...(body !== undefined ? { body: JSON.stringify(body) } : {}),\n    });\n    if (!res.ok) {\n      const reasons: Record<number, string> = { 401: 'GitHub authentication failed. Set GITHUB_TOKEN or GH_TOKEN.', 403: 'GitHub denied the request or its rate limit was reached.', 404: 'GitHub could not find this repository or resource; private repositories require a token.', 422: 'GitHub rejected the request. Check the issue, branch, or pull-request fields.' };\n      throw new Error(reasons[res.status] || `GitHub returned ${res.status}.`);\n    }\n    if (Number(res.headers.get('content-length')) > 2 * 1024 * 1024) throw new Error('GitHub response exceeds the size limit.');\n    if (res.status === 204) return { data: null, more: false };\n    const reader = res.body?.getReader();\n    let bytes = 0, text = '';\n    const decoder = new TextDecoder();\n    if (reader) {\n      try { for (;;) { const { done, value } = await reader.read(); if (done) break; bytes += value.byteLength;\n        if (bytes > 2 * 1024 * 1024) throw new Error('GitHub response exceeds the size limit.'); text += decoder.decode(value, { stream: true }); } text += decoder.decode(); }\n      finally { await reader.cancel().catch(() => {}); }\n    }\n    let data: unknown;\n    try { data = JSON.parse(text); } catch { throw new Error('GitHub returned an unreadable response.'); }\n    return { data, more: /rel=\"next\"/.test(res.headers.get('link') || '') };\n  }\n  async list(route: string, pages = 2): Promise<{ items: unknown[]; truncated: boolean }> {\n    const items: unknown[] = []; let more = false;\n    for (let page = 1; page <= pages; page++) {\n      const response = await this.request(`${route}${route.includes('?') ? '&' : '?'}per_page=100&page=${page}`);\n      if (!Array.isArray(response.data)) throw new Error('GitHub returned an unreadable list.');\n      items.push(...response.data); more = response.more; if (!more) break;\n    }\n    return { items, truncated: more };\n  }\n}\n"]}

package/cli/agent/mcp.d.ts

@@ -0,0 +1,15 @@
+import { createAgentTools } from './tools.js';
+import type { AgentTool, RunManifest } from './contracts.js';
+export declare function scopedTools(manifest: RunManifest, options?: Parameters<typeof createAgentTools>[1]): AgentTool[];
+export declare function createAgentDispatcher(manifest: RunManifest, options?: Parameters<typeof createAgentTools>[1]): (msg: any) => Promise<{
+    jsonrpc: string;
+    id: any;
+    error: {
+        code: number;
+        message: string;
+    };
+} | {
+    jsonrpc: string;
+    id: any;
+    result: unknown;
+}>;