codekin 0.6.3 → 0.6.5

package/server/dist/version-check.js

@@ -7,6 +7,7 @@
  */
 import { readFileSync } from 'fs';
 import { join } from 'path';
+import { jsonParse } from './json-parse.js';
 /** How long to cache the npm lookup result (6 hours). */
 const CACHE_TTL_MS = 6 * 60 * 60 * 1000;
 /** npm registry endpoint for the package. */
@@ -21,8 +22,8 @@ const state = {
 function getCurrentVersion() {
     if (!state.currentVersion) {
         const pkgPath = join(import.meta.dirname, '..', 'package.json');
-        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
-        state.currentVersion = pkg.version;
+        const pkg = jsonParse(readFileSync(pkgPath, 'utf-8'));
+        state.currentVersion = String(pkg.version);
     }
     return state.currentVersion;
 }

package/server/dist/version-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../version-check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,yDAAyD;AACzD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvC,6CAA6C;AAC7C,MAAM,YAAY,GAAG,2CAA2C,CAAA;AAShE,MAAM,KAAK,GAAiB;IAC1B,cAAc,EAAE,EAAE;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,KAAK;IACtB,SAAS,EAAE,CAAC;CACb,CAAA;AAED,yDAAyD;AACzD,SAAS,iBAAiB;IACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;QACtD,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,OAAO,CAAA;IACpC,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAA;AAC7B,CAAC;AAED,uDAAuD;AACvD,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,YAAY,CAAC,OAAO,CAAC,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA0B,CAAA;QACrD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAA;IACzC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAE5B,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,aAAa,GAAG,MAAM,CAAA;QAC5B,KAAK,CAAC,eAAe,GAAG,IAAI,CAAA;QAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,2BAA2B,OAAO,GAAG,CAAC,CAAA;IAC9E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,aAAa,GAAG,MAAM,CAAA;QAC5B,KAAK,CAAC,eAAe,GAAG,KAAK,CAAA;QAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,gBAAgB,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAChD,MAAM,eAAe,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,OAAO,YAAY,KAAK,CAAC,aAAa,4BAA4B,KAAK,CAAC,cAAc,qCAAqC,CAAA;IAC7H,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../version-check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,yDAAyD;AACzD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvC,6CAA6C;AAC7C,MAAM,YAAY,GAAG,2CAA2C,CAAA;AAShE,MAAM,KAAK,GAAiB;IAC1B,cAAc,EAAE,EAAE;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,KAAK;IACtB,SAAS,EAAE,CAAC;CACb,CAAA;AAED,yDAAyD;AACzD,SAAS,iBAAiB;IACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAA4B,CAAA;QAChF,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAA;AAC7B,CAAC;AAED,uDAAuD;AACvD,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,YAAY,CAAC,OAAO,CAAC,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA0B,CAAA;QACrD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAA;IACzC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAE5B,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,aAAa,GAAG,MAAM,CAAA;QAC5B,KAAK,CAAC,eAAe,GAAG,IAAI,CAAA;QAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,2BAA2B,OAAO,GAAG,CAAC,CAAA;IAC9E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,aAAa,GAAG,MAAM,CAAA;QAC5B,KAAK,CAAC,eAAe,GAAG,KAAK,CAAA;QAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,gBAAgB,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAChD,MAAM,eAAe,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,OAAO,YAAY,KAAK,CAAC,aAAa,4BAA4B,KAAK,CAAC,cAAc,qCAAqC,CAAA;IAC7H,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/server/dist/webhook-rate-limiter.js

@@ -1,3 +1,4 @@
+import { jsonParse } from './json-parse.js';
 /**
  * Creates a per-key sliding window rate limiter for webhook requests.
  *
@@ -27,6 +28,8 @@
 export function createWebhookRateLimiter(maxPerMinute = 30, 
 /** Extract a rate-limit key from the parsed body.  Return `undefined` to skip limiting. */
 keyExtractor = (body) => body?.repository?.full_name) {
+    /** Maximum number of tracked keys to prevent unbounded memory growth. */
+    const WEBHOOK_RATE_MAP_MAX_SIZE = 10_000;
     const keyTimestamps = new Map();
     // Periodic cleanup: every 5 minutes, remove keys with no recent timestamps
     const cleanupInterval = setInterval(() => {
@@ -50,7 +53,7 @@ keyExtractor = (body) => body?.repository?.full_name) {
         try {
             const body = req.body;
             if (Buffer.isBuffer(body)) {
-                const parsed = JSON.parse(body.toString('utf-8'));
+                const parsed = jsonParse(body.toString('utf-8'));
                 key = keyExtractor(parsed);
             }
         }
@@ -70,6 +73,11 @@ keyExtractor = (body) => body?.repository?.full_name) {
             res.status(429).json({ error: 'Too Many Requests', repo: key, retryAfter: 60 });
             return;
         }
+        // Reject new keys if the map has grown too large (DoS protection)
+        if (recent.length === 0 && keyTimestamps.size >= WEBHOOK_RATE_MAP_MAX_SIZE) {
+            res.status(429).json({ error: 'Too Many Requests', retryAfter: 60 });
+            return;
+        }
         recent.push(now);
         keyTimestamps.set(key, recent);
         next();

package/server/dist/webhook-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-rate-limiter.js","sourceRoot":"","sources":["../webhook-rate-limiter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAY,GAAG,EAAE;AACjB,2FAA2F;AAC3F,eAAsD,CAAC,IAAI,EAAE,EAAE,CAC5D,IAA4D,EAAE,UAAU,EAAE,SAAS;IAEtF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAA;IAEjD,2EAA2E;IAC3E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEjB,6DAA6D;IAC7D,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,GAAuB,CAAA;QAE3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;YACrB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;gBACjD,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAE/C,yCAAyC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAEvD,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;YAC/E,OAAM;QACR,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChB,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC9B,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"webhook-rate-limiter.js","sourceRoot":"","sources":["../webhook-rate-limiter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAY,GAAG,EAAE;AACjB,2FAA2F;AAC3F,eAAsD,CAAC,IAAI,EAAE,EAAE,CAC5D,IAA4D,EAAE,UAAU,EAAE,SAAS;IAEtF,yEAAyE;IACzE,MAAM,yBAAyB,GAAG,MAAM,CAAA;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAA;IAEjD,2EAA2E;IAC3E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEjB,6DAA6D;IAC7D,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,GAAuB,CAAA;QAE3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAA;YAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAY,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;gBACzD,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAE/C,yCAAyC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAEvD,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;YAC/E,OAAM;QACR,CAAC;QAED,kEAAkE;QAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChB,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC9B,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC"}

package/server/dist/webhook-workspace.d.ts

@@ -10,6 +10,18 @@
  * @returns The absolute path to the created workspace directory.
  */
 export declare function createWorkspace(sessionId: string, repo: string, cloneUrl: string, branch: string, headSha: string): Promise<string>;
+/**
+ * Scan a workspace for report files under `.codekin/reports/` and commit them
+ * to the `codekin/reports` branch of origin.
+ *
+ * Uses the same worktree-based approach as the MD workflow engine's save_report
+ * step so that reports from both systems end up in the same place.  This must
+ * be called BEFORE cleanupWorkspace() so the workspace still exists.
+ *
+ * @param sessionId    - Session ID (used for log context and temp worktree naming).
+ * @param commitPrefix - Commit message prefix (e.g. "chore: code review").
+ */
+export declare function commitReportsFromWorkspace(sessionId: string, commitPrefix: string): void;
 /**
  * Remove a workspace directory when a session closes.
  *

package/server/dist/webhook-workspace.js

@@ -1,7 +1,7 @@
-import { execFile } from 'child_process';
-import { existsSync, mkdirSync, rmSync } from 'fs';
+import { execFile, execFileSync } from 'child_process';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
-import { join, resolve } from 'path';
+import { dirname, join, resolve } from 'path';
 import { promisify } from 'util';
 const execFileAsync = promisify(execFile);
 const GIT_TIMEOUT_MS = 120_000;
@@ -158,6 +158,129 @@ export async function createWorkspace(sessionId, repo, cloneUrl, branch, headSha
         }
     }
 }
+/**
+ * Scan a workspace for report files under `.codekin/reports/` and commit them
+ * to the `codekin/reports` branch of origin.
+ *
+ * Uses the same worktree-based approach as the MD workflow engine's save_report
+ * step so that reports from both systems end up in the same place.  This must
+ * be called BEFORE cleanupWorkspace() so the workspace still exists.
+ *
+ * @param sessionId    - Session ID (used for log context and temp worktree naming).
+ * @param commitPrefix - Commit message prefix (e.g. "chore: code review").
+ */
+export function commitReportsFromWorkspace(sessionId, commitPrefix) {
+    const workspacePath = join(WORKSPACES_DIR, sessionId);
+    const reportsDir = join(workspacePath, '.codekin', 'reports');
+    if (!existsSync(reportsDir))
+        return;
+    // Collect all .md report files
+    const reportFiles = [];
+    try {
+        for (const category of readdirSync(reportsDir)) {
+            const categoryDir = join(reportsDir, category);
+            let entries;
+            try {
+                entries = readdirSync(categoryDir);
+            }
+            catch {
+                continue;
+            }
+            for (const file of entries) {
+                if (!file.endsWith('.md'))
+                    continue;
+                const fullPath = join(categoryDir, file);
+                reportFiles.push({
+                    relativePath: `.codekin/reports/${category}/${file}`,
+                    content: readFileSync(fullPath, 'utf-8'),
+                });
+            }
+        }
+    }
+    catch (err) {
+        console.warn(`[webhook-workspace] Failed to scan reports in ${workspacePath}:`, err);
+        return;
+    }
+    if (reportFiles.length === 0)
+        return;
+    const REPORTS_BRANCH = 'codekin/reports';
+    const dateStr = new Date().toISOString().slice(0, 10);
+    try {
+        // Ensure the reports branch exists on origin (create from HEAD if needed)
+        try {
+            execFileSync('git', ['rev-parse', '--verify', `origin/${REPORTS_BRANCH}`], {
+                cwd: workspacePath, timeout: 5_000, stdio: 'pipe',
+            });
+        }
+        catch {
+            // Remote branch doesn't exist — create it locally first
+            try {
+                execFileSync('git', ['branch', REPORTS_BRANCH], {
+                    cwd: workspacePath, timeout: 5_000,
+                });
+            }
+            catch {
+                // May already exist locally
+            }
+        }
+        // Fetch the reports branch so we have the latest
+        try {
+            execFileSync('git', ['fetch', 'origin', `${REPORTS_BRANCH}:${REPORTS_BRANCH}`], { cwd: workspacePath, timeout: 30_000, stdio: 'pipe', env: GIT_AUTH_ENV });
+        }
+        catch {
+            // Branch may not exist on remote yet — that's OK
+        }
+        // Create a temporary worktree on the reports branch
+        const wtDir = join(WORKSPACES_DIR, `.report-wt-${sessionId.slice(0, 12)}`);
+        try {
+            execFileSync('git', ['worktree', 'add', wtDir, REPORTS_BRANCH], {
+                cwd: workspacePath, timeout: 10_000,
+            });
+            // Copy each report file into the worktree
+            for (const report of reportFiles) {
+                const destPath = join(wtDir, report.relativePath);
+                const destDir = dirname(destPath);
+                if (!existsSync(destDir))
+                    mkdirSync(destDir, { recursive: true });
+                writeFileSync(destPath, report.content, 'utf-8');
+            }
+            // Stage and check if there's anything to commit
+            execFileSync('git', ['add', '.codekin/reports'], { cwd: wtDir, timeout: 10_000 });
+            try {
+                execFileSync('git', ['diff', '--cached', '--quiet'], { cwd: wtDir, timeout: 5_000 });
+                // Exit code 0 means no staged changes — nothing to commit
+                console.log(`[webhook-workspace] Reports already up to date on ${REPORTS_BRANCH}, skipping commit`);
+                return;
+            }
+            catch {
+                // Exit code 1 means there are staged changes — proceed with commit
+            }
+            // Set git identity in the worktree to avoid "Author identity unknown"
+            execFileSync('git', ['config', 'user.name', 'Codekin Workflow'], { cwd: wtDir, timeout: 5_000 });
+            execFileSync('git', ['config', 'user.email', 'workflow@codekin.local'], { cwd: wtDir, timeout: 5_000 });
+            execFileSync('git', ['commit', '-m', `${commitPrefix} ${dateStr}`], { cwd: wtDir, timeout: 15_000 });
+            console.log(`[webhook-workspace] Committed ${reportFiles.length} report(s) on ${REPORTS_BRANCH}`);
+            try {
+                execFileSync('git', ['push', 'origin', REPORTS_BRANCH], { cwd: wtDir, timeout: 30_000, stdio: 'pipe', env: GIT_AUTH_ENV });
+                console.log(`[webhook-workspace] Pushed ${REPORTS_BRANCH} to origin`);
+            }
+            catch (pushErr) {
+                console.warn(`[webhook-workspace] Could not push ${REPORTS_BRANCH}: ${pushErr}`);
+            }
+        }
+        finally {
+            try {
+                execFileSync('git', ['worktree', 'remove', '--force', wtDir], {
+                    cwd: workspacePath, timeout: 10_000,
+                });
+            }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+    catch (err) {
+        console.warn(`[webhook-workspace] Could not commit reports from workspace ${sessionId}: ${err}`);
+    }
+}
 /**
  * Remove a workspace directory when a session closes.
  *

package/server/dist/webhook-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-workspace.js","sourceRoot":"","sources":["../webhook-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEhC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AACzC,MAAM,cAAc,GAAG,OAAO,CAAA;AAE9B;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG;IACnB,GAAG,OAAO,CAAC,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,sCAAsC;IACxD,kBAAkB,EAAE,kCAAkC;CACvD,CAAA;AAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;AAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;AAEnD,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEtD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACtD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,qBAAqB,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;gBACxD,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,cAAc;gBACvB,GAAG,EAAE,YAAY;aAClB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,mDAAmD,IAAI,GAAG,EAAE,GAAG,CAAC,CAAA;YAC7E,0DAA0D;QAC5D,CAAC;QACD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,qBAAqB;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzC,aAAa;IACb,OAAO,CAAC,GAAG,CAAC,gDAAgD,IAAI,KAAK,CAAC,CAAA;IACtE,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;QAC7E,OAAO,EAAE,cAAc;KACxB,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE/C,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACrD,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,0BAA0B;QAC1B,OAAO,CAAC,GAAG,CAAC,qDAAqD,SAAS,KAAK,CAAC,CAAA;QAChF,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE;YAC/D,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,mDAAmD;QACnD,IAAI,CAAC,qDAAqD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,qDAAqD;QACrD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACpE,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,+DAA+D;QAC/D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;QACjD,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,CACjB,KAAK,EACL,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,MAAM,wBAAwB,MAAM,EAAE,CAAC,EAC1E,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,CACnE,CAAA;QAED,+EAA+E;QAC/E,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAA;QAChE,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC,EAAE;YACzE,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,6EAA6E;QAC7E,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3E,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACvD,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,qCAAqC;QACrC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,kBAAkB,CAAC,EAAE;YACtE,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QACF,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,8BAA8B,CAAC,EAAE;YACnF,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,oDAAoD;QACpD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kCAAkC,CAAC,EAAE;YAC9F,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,aAAa,GAAG,IAAI,CAAA;QACpB,OAAO,aAAa,CAAA;IACtB,CAAC;YAAS,CAAC;QACT,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvD,OAAO,CAAC,IAAI,CAAC,gEAAgE,SAAS,sBAAsB,CAAC,CAAA;YAC/G,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,4DAA4D,aAAa,GAAG,EAAE,UAAU,CAAC,CAAA;YACxG,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACrD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,OAAO,CAAC,GAAG,CAAC,wDAAwD,SAAS,EAAE,CAAC,CAAA;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,oDAAoD,SAAS,GAAG,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhook-workspace.js","sourceRoot":"","sources":["../webhook-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEhC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AACzC,MAAM,cAAc,GAAG,OAAO,CAAA;AAE9B;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG;IACnB,GAAG,OAAO,CAAC,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,sCAAsC;IACxD,kBAAkB,EAAE,kCAAkC;CACvD,CAAA;AAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;AAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;AAEnD,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEtD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACtD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,qBAAqB,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;gBACxD,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,cAAc;gBACvB,GAAG,EAAE,YAAY;aAClB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,mDAAmD,IAAI,GAAG,EAAE,GAAG,CAAC,CAAA;YAC7E,0DAA0D;QAC5D,CAAC;QACD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,qBAAqB;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzC,aAAa;IACb,OAAO,CAAC,GAAG,CAAC,gDAAgD,IAAI,KAAK,CAAC,CAAA;IACtE,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;QAC7E,OAAO,EAAE,cAAc;KACxB,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE/C,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACrD,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,0BAA0B;QAC1B,OAAO,CAAC,GAAG,CAAC,qDAAqD,SAAS,KAAK,CAAC,CAAA;QAChF,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE;YAC/D,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,mDAAmD;QACnD,IAAI,CAAC,qDAAqD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,qDAAqD;QACrD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACpE,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,+DAA+D;QAC/D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;QACjD,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,CACjB,KAAK,EACL,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,MAAM,wBAAwB,MAAM,EAAE,CAAC,EAC1E,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,CACnE,CAAA;QAED,+EAA+E;QAC/E,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAA;QAChE,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC,EAAE;YACzE,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,6EAA6E;QAC7E,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3E,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACvD,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,qCAAqC;QACrC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,kBAAkB,CAAC,EAAE;YACtE,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QACF,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,8BAA8B,CAAC,EAAE;YACnF,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,oDAAoD;QACpD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kCAAkC,CAAC,EAAE;YAC9F,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,aAAa,GAAG,IAAI,CAAA;QACpB,OAAO,aAAa,CAAA;IACtB,CAAC;YAAS,CAAC;QACT,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvD,OAAO,CAAC,IAAI,CAAC,gEAAgE,SAAS,sBAAsB,CAAC,CAAA;YAC/G,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,4DAA4D,aAAa,GAAG,EAAE,UAAU,CAAC,CAAA;YACxG,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,YAAoB;IAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAM;IAEnC,+BAA+B;IAC/B,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,IAAI,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAC9C,IAAI,OAAiB,CAAA;YACrB,IAAI,CAAC;gBAAC,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAC7D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAQ;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;gBACxC,WAAW,CAAC,IAAI,CAAC;oBACf,YAAY,EAAE,oBAAoB,QAAQ,IAAI,IAAI,EAAE;oBACpD,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;iBACzC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,iDAAiD,aAAa,GAAG,EAAE,GAAG,CAAC,CAAA;QACpF,OAAM;IACR,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEpC,MAAM,cAAc,GAAG,iBAAiB,CAAA;IACxC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC;QACH,0EAA0E;QAC1E,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,cAAc,EAAE,CAAC,EAAE;gBACzE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;aAClD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;YACxD,IAAI,CAAC;gBACH,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE;oBAC9C,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK;iBACnC,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC;YACH,YAAY,CACV,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,IAAI,cAAc,EAAE,CAAC,EACjE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,CAC1E,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QAED,oDAAoD;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1E,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE;gBAC9D,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;aACpC,CAAC,CAAA;YAEF,0CAA0C;YAC1C,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;gBACjD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjE,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAClD,CAAC;YAED,gDAAgD;YAChD,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;YACjF,IAAI,CAAC;gBACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpF,0DAA0D;gBAC1D,OAAO,CAAC,GAAG,CAAC,qDAAqD,cAAc,mBAAmB,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;YAED,sEAAsE;YACtE,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAChG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAEvG,YAAY,CACV,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE,CAAC,EACrD,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAChC,CAAA;YACD,OAAO,CAAC,GAAG,CAAC,iCAAiC,WAAW,CAAC,MAAM,iBAAiB,cAAc,EAAE,CAAC,CAAA;YAEjG,IAAI,CAAC;gBACH,YAAY,CACV,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,EACzC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,CAClE,CAAA;gBACD,OAAO,CAAC,GAAG,CAAC,8BAA8B,cAAc,YAAY,CAAC,CAAA;YACvE,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,sCAAsC,cAAc,KAAK,OAAO,EAAE,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;oBAC5D,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;iBACpC,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+DAA+D,SAAS,KAAK,GAAG,EAAE,CAAC,CAAA;IAClG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACrD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,OAAO,CAAC,GAAG,CAAC,wDAAwD,SAAS,EAAE,CAAC,CAAA;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,oDAAoD,SAAS,GAAG,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/server/dist/workflow-engine.d.ts

@@ -23,6 +23,18 @@ export type RunStatus = 'queued' | 'running' | 'succeeded' | 'failed' | 'cancele
 export declare class WorkflowSkipped extends Error {
     constructor(message: string);
 }
+/**
+ * Thrown when a step references a session that no longer exists in the session manager —
+ * either because it was deleted, expired, or never persisted across a server restart.
+ * Carries enough context (run id, step key, session id, last heartbeat) for diagnostics.
+ */
+export declare class SessionGoneError extends Error {
+    readonly runId: string;
+    readonly stepKey: string;
+    readonly sessionId: string;
+    readonly lastSeen: string | null;
+    constructor(runId: string, stepKey: string, sessionId: string, lastSeen: string | null);
+}
 /**
  * Lifecycle status of an individual workflow step.
  * - `pending`   — not yet reached by the executor
@@ -52,6 +64,12 @@ export interface WorkflowRun {
     startedAt: string | null;
     /** ISO timestamp when execution finished (success, failure, or skip). */
     completedAt: string | null;
+    /** Codekin session id owned by this run, recorded by `create_session`. Null until that step records it. */
+    sessionId?: string | null;
+    /** ISO timestamp updated whenever a step starts; serves as a liveness heartbeat for resume. */
+    lastStepAt?: string | null;
+    /** Key of the step that was most recently marked running. Used to resume from the right place. */
+    currentStepKey?: string | null;
 }
 /** A single step within a workflow run. Insertion order (rowid) preserves definition order. */
 export interface WorkflowStep {
@@ -111,15 +129,33 @@ export interface WorkflowEvent {
 /**
  * Step handler function — receives step input + run context, returns step output.
  * @param input  Merged output of all preceding steps (plus the run's original input).
- * @param context.runId       UUID of the current run.
- * @param context.run         Full WorkflowRun object (mutable — reflects current status).
- * @param context.abortSignal Fires when `cancelRun()` is called; handlers should check or listen on it.
+ * @param context.runId            UUID of the current run.
+ * @param context.run              Full WorkflowRun object (mutable — reflects current status).
+ * @param context.abortSignal      Fires when `cancelRun()` is called; handlers should check or listen on it.
+ * @param context.resumed          True when this step is being re-executed after a server restart.
+ *                                  Handlers can use this to skip side effects already performed
+ *                                  (e.g. don't re-send a Claude prompt — just await the result).
+ * @param context.recordSessionId  Persist the session id atomically with `create_session`, so that
+ *                                  a later `resumeInterrupted()` scan can reattach to the session
+ *                                  even if the server crashed before the step's output row was written.
  */
 export type StepHandler = (input: Record<string, unknown>, context: {
     runId: string;
     run: WorkflowRun;
     abortSignal: AbortSignal;
+    resumed?: boolean;
+    recordSessionId?: (sessionId: string) => void;
 }) => Promise<Record<string, unknown>>;
+/**
+ * Result of resolving a workflow's session at resume time.
+ * `null` means the session is gone (deleted, expired, never persisted) and the run cannot resume.
+ */
+export interface SessionLiveness {
+    /** ISO timestamp of the most recent activity on the session, if known. */
+    lastActivityAt?: string | null;
+}
+/** Lookup function used by `resumeInterrupted()` to decide whether a session is still resumable. */
+export type SessionResolver = (sessionId: string) => SessionLiveness | null;
 interface StepDefinition {
     key: string;
     handler: StepHandler;
@@ -130,13 +166,29 @@ interface WorkflowDefinition {
     /** Called after run completes (success or failure) for cleanup. */
     afterRun?: (run: WorkflowRun) => Promise<void>;
 }
+export declare function cronMatchesDate(expression: string, date: Date): boolean;
 export declare class WorkflowEngine extends EventEmitter {
     private db;
     private workflows;
     private activeAbortControllers;
     private cronTimer;
+    private sessionResolver;
     constructor(dbPath?: string);
     private createTables;
+    /**
+     * Apply additive (backwards-compatible) schema migrations.
+     * Each ALTER TABLE is wrapped in try/catch so a re-run on a migrated DB is a no-op
+     * (SQLite has no `ADD COLUMN IF NOT EXISTS`). New columns are nullable so older rows
+     * keep working without backfill.
+     */
+    private migrateSchema;
+    /**
+     * Register a callback used by `resumeInterrupted()` to decide whether a workflow's
+     * session is still alive. Pass `null` to clear. Without a resolver, all interrupted
+     * runs whose session_id is set are conservatively treated as resumable — but the
+     * step handler will still surface a typed error if the session has actually gone.
+     */
+    setSessionResolver(resolver: SessionResolver | null): void;
     /** Register a workflow kind with its step definitions. Must be called before `startRun()`. */
     registerWorkflow(definition: WorkflowDefinition): void;
     /** Check whether a workflow kind has been registered. */
@@ -155,10 +207,21 @@ export declare class WorkflowEngine extends EventEmitter {
      *
      * Cancellation: `cancelRun()` calls controller.abort(); the AbortSignal is
      * passed to each handler so long-running async work can exit cooperatively.
+     *
+     * Resume: when `opts.resumeFromKey` is set, steps before that key are skipped
+     * (their outputs come from `opts.priorOutput`) and the resumed step receives
+     * `resumed: true` in its context so the handler can avoid double side effects.
      */
     private executeRun;
     /** Signal an active run to abort. Returns true if the run was in-flight and the signal was sent. */
     cancelRun(runId: string): boolean;
+    /**
+     * Persist a session id on a run so that `resumeInterrupted()` can locate the
+     * still-alive session even if the server crashes before the `create_session`
+     * step's output row is committed. Called from inside the step handler via
+     * `ctx.recordSessionId(...)`.
+     */
+    recordSessionId(runId: string, sessionId: string): void;
     /** Fetch a single run with all its steps (ordered by definition order). Returns `null` if not found. */
     getRun(runId: string): (WorkflowRun & {
         steps: WorkflowStep[];
@@ -185,12 +248,23 @@ export declare class WorkflowEngine extends EventEmitter {
     /** Stop the cron polling loop. Safe to call multiple times. */
     stopCronScheduler(): void;
     /**
-     * Mark any runs that were in-flight when the server last shut down as failed.
-     * Called once at startup — a run left in 'running' state means the Node process
-     * died mid-execution and the AbortController / step callbacks are gone, so there
-     * is no safe way to resume; failing fast is cleaner than leaving them stuck.
+     * Resume runs that were in-flight when the server last shut down.
+     *
+     * Strategy:
+     *   1. Find all runs still marked `running` (no graceful completion happened).
+     *   2. For each, look at `session_id` + `current_step_key` — captured before the crash.
+     *   3. If the session is still alive (per `sessionResolver`) and the step is one we know how
+     *      to resume (`run_prompt`, `save_report`), re-execute from there with `resumed: true`.
+     *   4. Otherwise mark the run failed with a clear, typed reason. We do NOT silently mark
+     *      remaining steps `skipped` — the failure surface is loud so reports don't go missing.
+     *
+     * Earlier steps (`validate_repo`, `create_session`) are not resumed: by the time they were
+     * running, the workflow had no usable session yet, and re-creating one mid-way would risk
+     * spawning duplicate sessions or sending the prompt twice.
      */
     resumeInterrupted(): Promise<void>;
+    /** Mark a run as failed during the resume scan (no AbortController, no in-memory run object). */
+    private failInterrupted;
     private emitEvent;
     /** Gracefully shut down: stop cron, cancel active runs, close the database. */
     shutdown(): void;