copyrun 0.0.0-stage → 0.2.0

package/dist/receipt.js

@@ -0,0 +1,349 @@
+#!/usr/bin/env node
+
+// src/receipt-hook.ts
+import { spawn, spawnSync } from "child_process";
+import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync2, renameSync, statSync, writeFileSync } from "fs";
+import { dirname, join as join3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/config.ts
+import { randomUUID } from "crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/managed.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var GATED_CAPABILITIES = ["shell", "install", "network", "settings"];
+var SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/;
+var HANDLE = /^[a-z0-9][a-z0-9-]{0,38}$/;
+function parseManaged(v) {
+  const problems = [];
+  const config = {};
+  if (!v || typeof v !== "object" || Array.isArray(v)) return { config, problems: ["not a JSON object"] };
+  const o = v;
+  const bool = (k) => {
+    if (o[k] === void 0) return;
+    if (typeof o[k] !== "boolean") problems.push(`${k} must be true or false`);
+    else config[k] = o[k];
+  };
+  if (o.apiHost !== void 0) {
+    try {
+      const u = new URL(String(o.apiHost));
+      const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+      if (u.protocol !== "https:" && !(local && u.protocol === "http:")) problems.push("apiHost must be an https URL");
+      else config.apiHost = u.origin;
+    } catch {
+      problems.push("apiHost must be a URL");
+    }
+  }
+  if (o.org !== void 0) {
+    const s = typeof o.org === "string" ? o.org.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("org must be an org slug");
+    else config.org = s;
+  }
+  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableReceipts", "disableAutopilot", "copyLink", "disableAsk", "disableMission", "disableCopy"]) bool(k);
+  if (o.autopilotOrg !== void 0) {
+    const s = typeof o.autopilotOrg === "string" ? o.autopilotOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("autopilotOrg must be an org slug");
+    else config.autopilotOrg = s;
+  }
+  if (o.autopilotContent !== void 0) {
+    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions" && o.autopilotContent !== "commands") problems.push('autopilotContent must be "full", "actions" or "commands"');
+    else config.autopilotContent = o.autopilotContent;
+  }
+  if (o.allowedCloneSources !== void 0) {
+    const a = o.allowedCloneSources;
+    if (a === "any" || a === "org-playbook") config.allowedCloneSources = a;
+    else if (Array.isArray(a) && a.every((x) => typeof x === "string" && HANDLE.test(x.trim().replace(/^@/, "").toLowerCase())))
+      config.allowedCloneSources = [...new Set(a.map((x) => x.trim().replace(/^@/, "").toLowerCase()))];
+    else problems.push('allowedCloneSources must be "any", "org-playbook" or a list of handles and org slugs');
+  }
+  if (o.extraRedactTerms !== void 0) {
+    if (!Array.isArray(o.extraRedactTerms) || !o.extraRedactTerms.every((t) => typeof t === "string")) problems.push("extraRedactTerms must be a list of strings");
+    else config.extraRedactTerms = [...new Set(o.extraRedactTerms.map((t) => t.trim()).filter((t) => t.length >= 2 && t.length <= 100))].slice(0, 200);
+  }
+  if (o.profile !== void 0) {
+    if (o.profile !== "finance" && o.profile !== "hipaa") problems.push('profile must be "finance" or "hipaa"');
+    else config.profile = o.profile;
+  }
+  if (o.archive !== void 0) {
+    const a = o.archive;
+    const org = a && typeof a.org === "string" ? a.org.trim().toLowerCase() : "";
+    if (!a || typeof a !== "object" || !SLUG.test(org) || a.required !== void 0 && typeof a.required !== "boolean") problems.push("archive must be { org: <slug>, required: true|false }");
+    else config.archive = { org, required: a.required === true };
+  }
+  if (o.restrictOrgs !== void 0) {
+    const list = typeof o.restrictOrgs === "string" ? o.restrictOrgs.split(",") : o.restrictOrgs;
+    if (!Array.isArray(list) || !list.every((x) => typeof x === "string" && SLUG.test(x.trim().toLowerCase()))) problems.push("restrictOrgs must be a list of org slugs");
+    else config.restrictOrgs = [...new Set(list.map((x) => x.trim().toLowerCase()))];
+  }
+  if (o.restrictMode !== void 0) {
+    if (o.restrictMode !== "block-all-uploads") problems.push('restrictMode must be "block-all-uploads"');
+    else config.restrictMode = o.restrictMode;
+  }
+  if (o.askBefore !== void 0) {
+    if (!Array.isArray(o.askBefore) || !o.askBefore.every((t) => typeof t === "string")) problems.push("askBefore must be a list of change areas and path patterns");
+    else config.askBefore = [...new Set(o.askBefore.map((t) => t.trim()).filter((t) => t && t.length <= 200))].slice(0, 50);
+  }
+  if (o.askTimeoutMinutes !== void 0) {
+    const n = o.askTimeoutMinutes;
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 1 || n > 15) problems.push("askTimeoutMinutes must be a number from 1 to 15");
+    else config.askTimeoutMinutes = Math.round(n);
+  }
+  if (o.askOrg !== void 0) {
+    const s = typeof o.askOrg === "string" ? o.askOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("askOrg must be an org slug");
+    else config.askOrg = s;
+  }
+  if (o.allowCloneYesWith !== void 0) {
+    const l = o.allowCloneYesWith;
+    if (!Array.isArray(l) || !l.every((x) => GATED_CAPABILITIES.includes(x))) problems.push('allowCloneYesWith must list only "shell", "install", "network" and/or "settings"');
+    else config.allowCloneYesWith = [...new Set(l)];
+  }
+  return { config, problems };
+}
+function systemManagedPaths(platform = process.platform, env = process.env) {
+  if (platform === "darwin")
+    return [
+      { path: "/Library/Application Support/copyrun/managed.json", kind: "json" },
+      // a configuration profile (Jamf, Kandji, Intune for Mac) lands here; it wins over the file
+      { path: "/Library/Managed Preferences/ai.copyrun.cli.plist", kind: "plist" }
+    ];
+  if (platform === "win32") return [{ path: join(env.ProgramData || env.PROGRAMDATA || "C:\\ProgramData", "copyrun", "managed.json"), kind: "json" }];
+  return [{ path: "/etc/copyrun/managed.json", kind: "json" }];
+}
+function plutil(p) {
+  try {
+    return execFileSync("/usr/bin/plutil", ["-convert", "json", "-o", "-", p], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+  } catch {
+    return void 0;
+  }
+}
+function loadManaged(deps = {}) {
+  const env = deps.env ?? process.env;
+  const exists = deps.exists ?? existsSync;
+  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
+  const plist = deps.plistToJson ?? plutil;
+  const system = systemManagedPaths(deps.platform ?? process.platform, env).filter((f) => exists(f.path));
+  const files = system.length ? system : env.COPYRUN_MANAGED_CONFIG ? [{ path: env.COPYRUN_MANAGED_CONFIG, kind: "json" }] : [];
+  const state = { config: {}, sources: [], errors: [] };
+  for (const f of files) {
+    let text;
+    try {
+      text = f.kind === "plist" ? plist(f.path) : read(f.path);
+    } catch (e) {
+      state.errors.push(`${f.path}: can't be read (${e.message})`);
+      continue;
+    }
+    if (text === void 0) {
+      if (f.kind === "plist" && files.some((x) => x.kind === "json")) continue;
+      state.errors.push(`${f.path}: can't be read (plutil unavailable)`);
+      continue;
+    }
+    let json;
+    try {
+      json = JSON.parse(text);
+    } catch {
+      state.errors.push(`${f.path}: not valid JSON`);
+      continue;
+    }
+    const { config, problems } = parseManaged(json);
+    if (problems.length) state.errors.push(`${f.path}: ${problems.join("; ")}`);
+    state.config = { ...state.config, ...config };
+    state.sources.push(f.path);
+  }
+  if (state.config.allowedCloneSources === "org-playbook" && !state.config.org) state.errors.push('allowedCloneSources "org-playbook" needs org');
+  if (state.config.autopilotOrg && state.config.org && state.config.autopilotOrg !== state.config.org) state.errors.push("autopilotOrg must be the same org as org");
+  if (state.config.askOrg && state.config.org && state.config.askOrg !== state.config.org) state.errors.push("askOrg must be the same org as org");
+  return state;
+}
+var cached;
+function managed() {
+  return cached ??= loadManaged();
+}
+
+// src/config.ts
+var VERSION = "0.2.0";
+var DIR = process.env.COPYRUN_HOME ?? join2(homedir(), ".copyrun");
+
+// src/receipt-logic.ts
+var RECEIPT_STATE_FILE = "receipts.json";
+var RECEIPT_LOG_FILE = "receipts.log";
+var PUSH_RESHARE_MS = 10 * 6e4;
+var MAX_SESSIONS = 200;
+var PR_URL = /https:\/\/github\.com\/([\w.-]{1,100})\/([\w.-]{1,100})\/pull\/(\d{1,9})\b/g;
+function commandText(input) {
+  const c = input.tool_input?.command;
+  if (typeof c === "string") return c.slice(0, 2e4);
+  if (Array.isArray(c) && c.every((x) => typeof x === "string")) return c.join(" ").slice(0, 2e4);
+  return void 0;
+}
+function responseText(resp) {
+  if (typeof resp === "string") return resp.slice(-2e4);
+  if (resp && typeof resp === "object") {
+    const r = resp;
+    return [r.stdout, r.stderr, r.output].filter((x) => typeof x === "string").join("\n").slice(-2e4);
+  }
+  return "";
+}
+var failed = (resp) => !!resp && typeof resp === "object" && (resp.interrupted === true || resp.is_error === true);
+function segments(cmd) {
+  return cmd.split(/&&|\|\||[;|\n]/).map((s) => s.trim().replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+){0,10}/, "")).filter(Boolean);
+}
+function prEventOf(input) {
+  if (input.hook_event_name && input.hook_event_name !== "PostToolUse") return void 0;
+  const cmd = commandText(input);
+  if (!cmd || failed(input.tool_response)) return void 0;
+  const segs = segments(cmd);
+  const create = segs.some((s) => /^gh\s+pr\s+create\b/.test(s) && !/\s--(?:dry-run|web|help)\b|\s-w\b|\s-h\b/.test(s));
+  if (create) {
+    const urls = [...responseText(input.tool_response).matchAll(PR_URL)];
+    const last = urls.at(-1);
+    if (last) return { kind: "created", prUrl: `https://github.com/${last[1]}/${last[2]}/pull/${last[3]}` };
+    return void 0;
+  }
+  const push = segs.some((s) => /^git\s+(?:-C\s+\S+\s+)?push\b/.test(s) && !/\s--(?:dry-run|delete|tags|help)\b|\s-[nd]\b/.test(s));
+  if (push && !/\b(?:rejected|error:|fatal:)/.test(responseText(input.tool_response))) return { kind: "pushed" };
+  return void 0;
+}
+function decideAttach(state, sessionId, ev, now, size, cwd) {
+  if (ev.kind === "created") return { prUrl: ev.prUrl };
+  const s = state.sessions?.[sessionId];
+  if (!s || cwd && s.cwd && s.cwd !== cwd) return void 0;
+  if (size <= s.size || now - s.at < PUSH_RESHARE_MS) return void 0;
+  return { prUrl: s.prUrl };
+}
+function recordAttach(state, sessionId, s) {
+  const sessions = { ...state.sessions ?? {}, [sessionId]: { ...state.sessions?.[sessionId] ?? {}, ...s } };
+  const ids = Object.keys(sessions).sort((a, b) => sessions[b].at - sessions[a].at);
+  for (const id of ids.slice(MAX_SESSIONS)) delete sessions[id];
+  return { ...state, sessions };
+}
+function repoOfPr(url) {
+  const m = [...url.matchAll(PR_URL)][0];
+  return m ? `${m[1]}/${m[2]}` : void 0;
+}
+function receiptShareArgs(transcript, repoPublic2) {
+  return ["share", transcript, ...repoPublic2 ? ["--pr"] : ["--private"], "--yes", "--confidential", "remove", "--no-recipe", "--json"];
+}
+var attachingMessage = (prUrl) => `\u{1F9FE} copyrun is attaching this session to ${prUrl} in the background, redacted like \`copyrun share --yes\` (npx copyrun receipts status \xB7 receipts off stops it)`;
+function attachOutcome(stdout, stderr, status) {
+  let body;
+  for (const line of stdout.trim().split("\n").reverse()) {
+    try {
+      const v = JSON.parse(line);
+      if (v && typeof v === "object") {
+        body = v;
+        break;
+      }
+    } catch {
+    }
+  }
+  const plain = stderr.replace(/\x1b\[[0-9;]*m/g, "");
+  const runId = body?.ok === true && typeof body.id === "string" ? body.id : void 0;
+  const attached = /Added the run to https:\/\/github\.com\//.test(plain);
+  const error = runId ? void 0 : String(body?.message ?? body?.error ?? plain.trim().split("\n").filter(Boolean).pop() ?? `exit ${status}`).slice(0, 200);
+  return { ...runId ? { runId } : {}, ...typeof body?.visibility === "string" ? { visibility: body.visibility } : {}, attached, ...error ? { error } : {} };
+}
+
+// src/receipt-hook.ts
+var DIR2 = process.env.COPYRUN_HOME ?? dirname(fileURLToPath(import.meta.url));
+var SELF = fileURLToPath(import.meta.url);
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeState(state) {
+  const path = join3(DIR2, RECEIPT_STATE_FILE);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state), { mode: 384 });
+  renameSync(tmp, path);
+}
+function log(line) {
+  try {
+    appendFileSync(join3(DIR2, RECEIPT_LOG_FILE), `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`, { mode: 384 });
+  } catch {
+  }
+}
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = "";
+    const t = setTimeout(() => resolve(data), 1500);
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (d) => {
+      data += d;
+      if (data.length > 2e6) process.stdin.destroy();
+    });
+    process.stdin.on("end", () => (clearTimeout(t), resolve(data)));
+    process.stdin.on("error", () => (clearTimeout(t), resolve(data)));
+  });
+}
+function cliCommand(config) {
+  const local = process.env.COPYRUN_CLI ?? (typeof config?.receipts?.cli === "string" && existsSync2(config.receipts.cli) ? config.receipts.cli : void 0);
+  return local ? [process.execPath, [local]] : [process.platform === "win32" ? "npx.cmd" : "npx", ["-y", `copyrun@${VERSION}`]];
+}
+function repoPublic(repo, cwd) {
+  const gh = process.env.COPYRUN_GH ?? "gh";
+  const r = spawnSync(gh, ["api", `repos/${repo}`, "--jq", ".private"], { cwd, encoding: "utf8", timeout: 2e4, stdio: ["ignore", "pipe", "ignore"] });
+  return r.status === 0 && (r.stdout ?? "").trim() === "false";
+}
+function attach(cwd, transcript, sessionId, prUrl) {
+  const config = readJson(join3(DIR2, "config.json"));
+  const repo = repoOfPr(prUrl);
+  if (!repo || !existsSync2(transcript)) return;
+  const pub = repoPublic(repo, cwd);
+  const [cmd, pre] = cliCommand(config);
+  const r = spawnSync(cmd, [...pre, ...receiptShareArgs(transcript, pub)], { cwd, encoding: "utf8", timeout: 15 * 6e4, env: { ...process.env, COPYRUN_HOME: DIR2, COPYRUN_RECEIPT: "1" }, stdio: ["ignore", "pipe", "pipe"] });
+  const out = attachOutcome(r.stdout ?? "", r.stderr ?? "", r.status);
+  const state = readJson(join3(DIR2, RECEIPT_STATE_FILE)) ?? {};
+  const s = state.sessions?.[sessionId];
+  if (s) {
+    s.runId = out.runId ?? s.runId;
+    if (out.visibility) s.visibility = out.visibility;
+    if (out.error) s.error = out.error;
+    else delete s.error;
+    try {
+      writeState(state);
+    } catch {
+    }
+  }
+  if (!out.runId) log(`${prUrl}: not attached (${out.error})`);
+  else if (pub) log(`${prUrl}: ${out.attached ? "attached" : "shared, but the PR wasn't edited"} run ${out.runId} (${out.visibility ?? "unlisted"})`);
+  else log(`${prUrl}: filed run ${out.runId} privately (the repo isn't public, or gh couldn't say); on a paying team's or Pro workspace's own private repo the copyrun App links it to the PR by commit`);
+}
+async function main() {
+  if (process.argv[2] === "--attach") return attach(process.argv[3], process.argv[4], process.argv[5], process.argv[6]);
+  const config = readJson(join3(DIR2, "config.json"));
+  if (config?.receipts?.on !== true || managed().config.disableReceipts || process.env.COPYRUN_REPLAY) return;
+  const input = JSON.parse(await readStdin());
+  if (!input.session_id || !input.transcript_path || !input.cwd) return;
+  const ev = prEventOf(input);
+  if (!ev) return;
+  const state = readJson(join3(DIR2, RECEIPT_STATE_FILE)) ?? {};
+  let size = 0;
+  try {
+    size = statSync(input.transcript_path).size;
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  const go = decideAttach(state, input.session_id, ev, now, size, input.cwd);
+  if (!go) return;
+  writeState(recordAttach(state, input.session_id, { prUrl: go.prUrl, cwd: input.cwd, at: now, size }));
+  const child = spawn(process.execPath, [SELF, "--attach", input.cwd, input.transcript_path, input.session_id, go.prUrl], { detached: true, stdio: "ignore", windowsHide: true, cwd: input.cwd });
+  child.on("error", () => {
+  });
+  child.unref();
+  if (ev.kind === "created") process.stdout.write(JSON.stringify({ systemMessage: attachingMessage(go.prUrl) }) + "\n");
+}
+main().catch(() => {
+}).finally(() => {
+  if (process.argv[2] !== "--attach") process.exit(0);
+});

package/dist/seal-worker.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+// src/seal-worker.ts
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+
+// src/session-seal.ts
+import { createHash, createPrivateKey, sign } from "crypto";
+import { closeSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { join } from "path";
+var SEAL_QUEUE_DIR = "seal-queue";
+var SEAL_LOG_FILE = "session-seals.json";
+var HOOK_MAX_BYTES = 64 * 1024 * 1024;
+var SEAL_SPAWN_THROTTLE_MS = 5 * 60 * 1e3;
+var MAX_LOG = 5e3;
+var MAX_ATTEMPTS = 30;
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeJsonAtomic(path, value) {
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(value), { mode: 384 });
+  renameSync(tmp, path);
+}
+function deviceOf(dir) {
+  const d = readJson(join(dir, "config.json"))?.device;
+  return d && typeof d.privateKey === "string" && typeof d.token === "string" && typeof d.api === "string" ? d : void 0;
+}
+function readSealLog(dir) {
+  const v = readJson(join(dir, SEAL_LOG_FILE));
+  return Array.isArray(v) ? v.filter((e) => e && typeof e.sha256 === "string") : [];
+}
+function appendSealLog(dir, e) {
+  const all = readSealLog(dir).filter((x) => !(x.sha256 === e.sha256 && x.kind === e.kind && x.api === e.api));
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeJsonAtomic(join(dir, SEAL_LOG_FILE), [...all, e].slice(-MAX_LOG));
+}
+function listSealQueue(dir) {
+  const qdir = join(dir, SEAL_QUEUE_DIR);
+  let names;
+  try {
+    names = readdirSync(qdir).filter((n) => n.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const n of names) {
+    const req = readJson(join(qdir, n));
+    if (req && req.v === 1 && typeof req.sha256 === "string") out.push({ path: join(qdir, n), req });
+  }
+  return out.sort((a, b) => a.req.createdAt.localeCompare(b.req.createdAt));
+}
+async function flushSealQueue(dir, o = {}) {
+  const now = o.now ?? Date.now();
+  const doFetch = o.fetch ?? globalThis.fetch;
+  const res = { sealed: [], waiting: 0, dropped: [] };
+  const device = deviceOf(dir);
+  for (const { path, req } of listSealQueue(dir)) {
+    if (!o.ignoreBackoff && Date.parse(req.nextAttemptAt) > now) {
+      res.waiting++;
+      continue;
+    }
+    const drop = (reason) => {
+      try {
+        unlinkSync(path);
+      } catch {
+      }
+      res.dropped.push({ sha256: req.sha256, reason });
+    };
+    if (!device || device.api !== req.api || device.publicKey !== req.publicKey) {
+      if (!device) res.waiting++;
+      else drop("signed by a different device key");
+      continue;
+    }
+    let status = 0;
+    let body = {};
+    try {
+      const r = await doFetch(`${req.api}/api/v1/seal`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${device.token}` },
+        body: JSON.stringify({ kind: req.kind, sha256: req.sha256, signature: req.signature, publicKey: req.publicKey, ...req.sessionSha256 ? { sessionSha256: req.sessionSha256 } : {}, ...o.org ? { org: o.org } : {} }),
+        signal: AbortSignal.timeout(o.timeoutMs ?? 1e4)
+      });
+      status = r.status;
+      body = await r.json().catch(() => ({})) ?? {};
+    } catch {
+      status = 0;
+    }
+    const seal = body.seal;
+    if ((status === 200 || status === 201) && seal && typeof seal.sealedAt === "string" && typeof seal.serverSignature === "string") {
+      const entry = {
+        kind: req.kind,
+        sha256: req.sha256,
+        ...req.bytes !== void 0 ? { bytes: req.bytes } : {},
+        ...req.sessionId ? { sessionId: req.sessionId } : {},
+        ...req.sessionSha256 ? { sessionSha256: req.sessionSha256 } : {},
+        sealedAt: seal.sealedAt,
+        serverSignature: seal.serverSignature,
+        serverKeyId: String(seal.serverKeyId ?? ""),
+        api: req.api,
+        ...typeof seal.handle === "string" ? { handle: seal.handle } : {}
+      };
+      try {
+        appendSealLog(dir, entry);
+        unlinkSync(path);
+      } catch {
+      }
+      res.sealed.push(entry);
+      continue;
+    }
+    if (status === 400 || status === 403 || status === 422 || req.attempts + 1 >= MAX_ATTEMPTS) {
+      drop(typeof body.code === "string" ? body.code : `http_${status}`);
+      continue;
+    }
+    const attempts = req.attempts + 1;
+    const wait = Math.min(6 * 60 * 60 * 1e3, 6e4 * 2 ** Math.min(attempts - 1, 12));
+    try {
+      writeJsonAtomic(path, { ...req, attempts, nextAttemptAt: new Date(now + wait).toISOString(), lastError: typeof body.code === "string" && body.code ? body.code : status ? `http_${status}` : "network" });
+    } catch {
+    }
+    res.waiting++;
+  }
+  return res;
+}
+
+// src/seal-worker.ts
+flushSealQueue(dirname(fileURLToPath(import.meta.url))).catch(() => {
+}).finally(() => process.exit(0));

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "copyrun",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "A copy of you that runs your agents: every agent acting as you on one board, asks before risky steps answered from any browser, a copy of your judgment that answers the way you would where it has earned it, and a check of what your agent claimed against what actually ran.",
+  "keywords": [
+    "ai",
+    "coding-agent",
+    "claude-code",
+    "codex",
+    "cursor",
+    "agents",
+    "human-in-the-loop",
+    "pull-request",
+    "provenance",
+    "cli"
+  ],
+  "homepage": "https://copyrun.ai/docs",
+  "bugs": {
+    "url": "https://copyrun.ai/community",
+    "email": "hello@copyrun.ai"
+  },
+  "license": "MIT",
+  "author": "Copyrun, Inc. <hello@copyrun.ai>",
+  "type": "module",
+  "bin": {
+    "copyrun": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "skills"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "build:plugin": "tsup && cp dist/autopilot.js ../plugin/scripts/autopilot.mjs && cp dist/autopilot-worker.js ../plugin/scripts/autopilot-worker.mjs"
+  },
+  "devDependencies": {
+    "@copyrun/core": "workspace:*",
+    "tsup": "8.5.1",
+    "@copyrun/extract": "workspace:*",
+    "@copyrun/datapacks": "workspace:*"
+  }
+}

package/skills/copyrun/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: copyrun
+description: Share the current coding-agent session as a public copyrun page (redacted locally first), clone someone else's copyrun run into this agent, or search copyrun for a run that already did what the user is trying to do. Use when the user says "share this session", "share this run", "copyrun this", pastes a copyrun.ai/r/... link, asks "has anyone done X", or is stuck on a task someone else has likely solved with an agent.
+---
+
+# copyrun
+
+copyrun turns a Claude Code, Codex or Cursor session into a page anyone can read and clone. Everything is redacted on this machine before upload.
+
+## Sharing the current session
+
+1. Preview first. Never upload without showing the user what will be removed:
+
+   ```bash
+   npx -y copyrun@latest share --dry-run --json
+   ```
+
+   The JSON has `title`, `counts` (redactions per rule) and `findings` (each with a masked `before` and the `after`).
+
+2. Propose a title. The automatic one comes from the first prompt and is often vague. You know what this session accomplished, so suggest a specific, outcome-first title under 80 characters, written like a headline a developer would click: what was done, to what, and how if it's interesting. For example, "Migrated 47 Jest test files to Vitest in one pass", not "help with tests". Leave out client or company names.
+
+3. Show the user your proposed title and a short summary of the redactions: how many secrets, which rules, and any emails. Ask whether to publish, whether the title works, whether they want it unlisted, and whether to remove extra strings (company or client names, internal hostnames).
+
+4. Only after the user says yes:
+
+   ```bash
+   npx -y copyrun@latest share --yes --json --title "<agreed title>" [--unlisted] [--redact "Acme,internal.acme.dev"]
+   ```
+
+   The dry run's `suspects` are things the rules can't know are sensitive (company names, hosts, tickets, people). Offer to add them to `--redact`. If any have kind `confidential` (a sentence saying the work isn't public), ask the user whether to remove those sentences (`--confidential remove`), share them as they are (`--confidential share`), or not share at all; the share refuses without one of these.
+
+   If the output says `termsRequired: true`, this machine hasn't agreed to the Terms yet. Show the user the Terms link and what they confirm (they own the work or may share it; it isn't an employer's or client's confidential code or data). Only if they agree, re-run with `--accept-terms`. Never add it on your own.
+
+   If the repo's remote isn't public, copyrun shares unlisted by default and refuses `--public` with `--yes` unless `--public-ok` is passed: only pass it when the user explicitly asks for a public share. Policy refusals (`policyBlocked: true`) come from the user's org or the repo's `.copyrun-policy`: tell the user the message; don't work around it.
+
+5. The output includes a `recipe`: the reusable skill copyrun built from this run, with `title`, `inputs`, `steps`, `ungeneralized` (things to check) and `scan` (security review: `status`, `summary`, `findings`). It's saved as a draft. Summarize it for the user in a few lines: what it will do for someone who clones it, its inputs, the scan result, and anything in `ungeneralized`. If `canPublish` is true, ask whether to publish it, and only after a yes:
+
+   ```bash
+   npx -y copyrun@latest recipe <id> --publish --json
+   ```
+
+   If the scan failed, say why (from `findings`) and that it can't be published. The author can edit it at the run's `/recipe` page after claiming the run.
+
+6. Reply with the `url` and the `claimUrl` (opening it attaches the run to their GitHub account). Tell the user the `deleteUrl` is saved in `~/.copyrun/shares.json` and that they can run `npx copyrun shares` to see it.
+
+7. Offer to help them post it. The output's `kitUrl` has ready-made posts for X, Reddit, LinkedIn, YouTube and Show HN, and `clipUrl` makes a short video of the run. If they're on a branch with an open pull request, offer to add the run to the PR description, and only after a yes:
+
+   ```bash
+   npx -y copyrun@latest pr <id>
+   ```
+
+   It edits the PR through the GitHub CLI (`gh`) and replaces its own block if run again.
+
+If the output says `blocked: true`, the session contains a private key and cannot be shared. Tell the user. Do not try to work around it.
+
+## Asking for a run ("copyrun it")
+
+When the user shares a link to a post (X, YouTube, Reddit, HN, LinkedIn) where someone shows off what their AI agent did, and they want to see how it was done, point them to `https://copyrun.ai/want?url=<the post's URL, URL-encoded>`. That page collects everyone who wants the run behind the post and notifies them when the author shares it.
+
+## Finding a run that already did it
+
+When the user asks whether anyone has done something, or is starting a task that is common (migrations, CI setup, framework upgrades, test fixes), search copyrun before building from scratch:
+
+```bash
+npx -y copyrun@latest search "<what they're trying to do>" --json
+```
+
+Each result has a `clone` command and a `markdown` URL. Show the user the top two or three with titles and the agent used. If one fits, offer to install it (`clone`) or read it (`fetch the markdown URL`) before starting. Don't search for things that are trivial or specific to this codebase.
+
+Any copyrun run link can be read as markdown by appending `.md` to it.
+
+## Cloning a run
+
+When the user pastes a copyrun link or id:
+
+```bash
+npx -y copyrun@latest clone <id-or-url> --print
+```
+
+Read the printed SKILL.md and summarize it for the user. If the run has a published recipe, the output also shows its security scan; mention the result. Flag anything risky yourself too (destructive commands, network calls, credential access). Install only after they agree:
+
+```bash
+npx -y copyrun@latest clone <id-or-url> --yes
+```
+
+It installs into this project (`.claude/skills/` at the repo root, recorded in `.copyrun/skills.lock`), not for every project; `--global` installs into the user's home folder instead, only if they ask. The output lists what the run used (skills, MCP servers) and what's missing here; pass that on.
+
+Then tell the user to use it in this session, or to try it right away in a terminal with `npx copyrun clone <id> --replay` (it launches their agent, shows a plan first, and records whether it worked). `--replay` needs an interactive terminal, so don't run it yourself.
+
+## Verified shares
+
+If the share output has no `author`, the run is anonymous and shows as unverified. Mention once that running `npx copyrun login` in a terminal (it opens the browser to approve this machine) makes future shares verified and puts them straight on the user's profile, with no claim step. Don't run `login` yourself.
+
+## Rules
+
+- Never pass `--yes` to `share` before the user has seen the dry-run summary.
+- Never edit the transcript files under `~/.claude`, `~/.codex` or `~/.cursor`.