create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/remote-machine-proxy.js

@@ -0,0 +1,520 @@
+'use strict';
+
+// WP-4 (docs/remote-machine-hub-sessions-2026-10-22.html §6.5, §7, §8 AC-4a/AC-4c, §9 S-9/S-10):
+// hub-side proxy for the four picker/create routes, plus the same-repo match helper.
+//
+// The picker asks the HUB for projects/suggestions/status, but when a machine is selected the
+// answers must come from the BOX — the box's filesystem is the truth about where a session on the
+// box can start. So each of the four routes gains one optional routing parameter:
+//
+//   ?machine=<instance_id>   or   X-CTM-Machine: <instance_id>
+//
+// Routing never reads the body: a POST that is not machine-routed reaches the local handler with
+// its request stream untouched.
+//
+// The single entry point is `maybeProxyMachineRequest(req, res, url, { route })`. It returns
+//   true   — it fully answered the request (proxied, or a machine_unknown / machine_unreachable /
+//            peer_credential_missing / machine_source_mixed refusal)
+//   false  — nothing was decided here; the caller MUST fall through to the local handler
+//
+// The rules that drive the shape:
+//   AC-4a  an unknown machine is a 404 `machine_unknown`; an unreachable one is a 502
+//          `machine_unreachable` whose body NAMES the machine (`machineName`), because the copy
+//          the picker renders is the only thing the user sees.
+//   D-7    the ONLY credential is the peer bearer (`buildPeerControlHeaders`, imported from
+//          lib/remote-machine-create.js). No new env var, no new secret, no new token mint.
+//   D-1/D-2  the bearer is mandatory on EVERY leg, including a loopback/LAN or SSH-forwarded box:
+//          no call is ever sent bare, and a credential the hub does not have is a 503
+//          `peer_credential_missing` (never `machine_unreachable`) whose copy names the env var
+//          and the machine. Loopback position is not a credential.
+//   local  `machine` absent, or `machine` == this instance's own minted id, is BIT-IDENTICAL to
+//          today: the hook returns false without touching req or res and the local handler
+//          answers. No client/public change is involved (WP-5 owns the UI).
+//
+// Dependency note: this module must NOT require lib/hosted-sync-worker.js (dependency-cycle lint —
+// machine-registry's header explains it). The peer credential comes from
+// lib/remote-machine-create.js, which builds it from env itself; the machine list comes from
+// lib/machine-registry.js through the same db-owner Proxy lib/api/machines.js uses.
+
+const { normalizeGitRemote } = require('../../shared/git-remote-key');
+
+const MACHINE_HEADER = 'x-ctm-machine';
+const MACHINE_QUERY_PARAM = 'machine';
+const DEFAULT_TIMEOUT_MS = 10_000;
+const BODY_LIMIT_BYTES = 1024 * 1024;
+
+// The four routes this WP proxies (§9 S-9/S-10). Keyed `METHOD /pathname`, the same spelling the
+// lead passes as `{ route }`.
+const PROXIED_ROUTES = Object.freeze([
+  'GET /api/projects',
+  'GET /api/path-suggest',
+  'POST /api/path-status',
+  'POST /api/worktrees/create',
+  // WP-5 amendment: the async create's progress poll + cancel live on the box that owns the job.
+  // The wrapper (lib/api/worktrees.js) names these templated keys; the REAL path is forwarded.
+  'GET /api/worktrees/create-jobs/:id',
+  'POST /api/worktrees/create-jobs/:id/cancel',
+  // WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1 / S-5): host stats are read
+  // per machine by the picker/dashboard, over the same ?machine= + peer-bearer leg as the rows
+  // above. The box's response is self-describing (`instanceId`), so nothing hub-specific is added.
+  'GET /api/host/stats',
+  // WP-2a (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.2, D-4 rev 2): the machine's
+  // OWN settings (display name / favorite / hidden). A user on any primary edits a remote member
+  // through the existing ?machine= + peer-bearer leg, exactly like the routes above — the member
+  // sees the pool principal. Both verbs are proxied (D-13: GET read + POST admin, peerControl).
+  'GET /api/machine-self',
+  'POST /api/machine-self',
+  // WP-3 (remote-agent-sign-in-from-hub-browser-2026-10-25.html §5 D-7/D-9, §6, S-11..S-14): the
+  // coding-agent OAuth sign-in trio, so a hub page (desktop or phone) can read a BOX's sign-in
+  // truth and start/complete a sign-in ON that box without opening the box's own URL. The two
+  // POSTs are admin + remote step-up + peerControl (lib/auth-rules.js); the GET is the plain read
+  // it already was. The templated POST keys use the same `:id` spelling as the create-job rows.
+  'GET /api/providers/login-state',
+  'POST /api/providers/:id/login',
+  'POST /api/providers/:id/login/code',
+]);
+
+// S-10 mixed-request refusal: a create that names a REMOTE machine must carry the BOX-owned source
+// repo in `cwd`. These are the hub-local worktree identities (WP-5's picker would have produced
+// them locally) — present alongside a remote machine they disagree about WHERE the worktree lives.
+const LOCAL_SOURCE_FIELDS = Object.freeze(['localWorktreePath', 'localPath', 'hubCwd', 'sourceMachine']);
+
+// AC-4c recency: the /api/projects row fields that order two checkouts of the SAME repo. Today's
+// rows carry none of them (server.js apiGetProjects returns {id, path, exists}); the list is here
+// so a row that gains one is preferred without touching this module again, and the array-order
+// fallback (first row wins) is what a keyless row set gets.
+const RECENCY_FIELDS = Object.freeze([
+  'lastUsedAt', 'lastActivityAt', 'updatedAt', 'mtimeMs', 'mtime', 'lastSeenAt', 'createdAt',
+]);
+
+let _injected = null;
+
+/** Test/host seam: override any production dependency (registry, db, env, fetch, headers, …). */
+function configure(deps) {
+  _injected = deps && typeof deps === 'object' ? deps : null;
+}
+
+function _string(value, max = 1000) {
+  return String(value == null ? '' : value).trim().slice(0, max);
+}
+
+function _trimUrl(url) {
+  return _string(url, 1000).replace(/\/+$/, '');
+}
+
+/**
+ * WP-1 (D-2): the missing-credential verdict for both lanes this module owns. The code and the
+ * copy live in lib/remote-machine-create.js — the ONE module that owns the peer credential — and
+ * are required lazily for the same reason the header builder is (this module must never pull
+ * lib/hosted-sync-worker.js into its graph; see the dependency note at the top).
+ *
+ * @returns {{code: string, error: string}}
+ */
+function _peerCredentialMissing(machineName) {
+  const mod = require('./remote-machine-create');
+  return { code: mod.PEER_CREDENTIAL_MISSING, error: mod.peerCredentialMissingMessage(machineName) };
+}
+
+// Lazy: the pure helpers (matchBoxProject, normalizeGitRemote) and the unit test must never load
+// db.js / the owner client. Mirrors lib/remote-machine-create.js's seam.
+function _productionDeps() {
+  return {
+    env: process.env,
+    // The same handle server.js hands lib/api/machines.js: the DB-owner Proxy, so the machine
+    // list read here is the one the routes read.
+    db: require('../db-owner-client'),
+    registry: require('./machine-registry'),
+  };
+}
+
+function _deps(overrides) {
+  return Object.assign({}, _productionDeps(), _injected || {}, overrides || {});
+}
+
+// ---------------------------------------------------------------------------------------------
+// Pure helpers (exported — AC-4c's unit cases live with the normalization table)
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * AC-4c: the box path whose checkout is the SAME repo as a hub project.
+ *
+ * Exact key match on `gitRemoteKey`, never a prefix/substring match (two different repos under
+ * one owner must not collide). Several checkouts of one repo are legal — the picker then opens
+ * the most recently used one, per RECENCY_FIELDS, falling back to array order so the result is
+ * deterministic for a row set that carries no timestamps at all.
+ *
+ * @param {string} localProjectKey  normalizeGitRemote(...) of the hub-side project
+ * @param {Array<{gitRemoteKey?: string, path?: string}>} boxProjects  the BOX's /api/projects rows
+ * @returns {{path: string, project: object}|null}
+ */
+function matchBoxProject(localProjectKey, boxProjects) {
+  const key = _string(localProjectKey, 1000);
+  if (!key || !Array.isArray(boxProjects)) return null;
+  let best = null;
+  let bestScore = null;
+  for (let index = 0; index < boxProjects.length; index += 1) {
+    const row = boxProjects[index];
+    if (!row || typeof row !== 'object') continue;
+    if (_string(row.gitRemoteKey, 1000) !== key) continue;
+    const score = _recencyScore(row, index);
+    if (!best || score > bestScore) {
+      best = row;
+      bestScore = score;
+    }
+  }
+  if (!best) return null;
+  return { path: _string(best.path, 4000), project: best };
+}
+
+function _recencyScore(row, index) {
+  for (const field of RECENCY_FIELDS) {
+    const raw = row[field];
+    if (raw == null || raw === '') continue;
+    const numeric = typeof raw === 'number' ? raw : Date.parse(String(raw));
+    if (Number.isFinite(numeric)) return numeric;
+  }
+  // No timestamp anywhere: the earliest row wins, so the same input always yields the same path.
+  // (`index ? -index : 0` rather than `-index`: -0 is never what a score should compare as.)
+  return index ? -index : 0;
+}
+
+/**
+ * The routing machine id, or '' when this request is not machine-routed at all.
+ * Query/header are consulted first so the common GET path never touches the request body.
+ */
+function _machineFromRequest(req, url) {
+  let fromQuery = '';
+  try { fromQuery = _string(url && url.searchParams ? url.searchParams.get(MACHINE_QUERY_PARAM) : '', 160); } catch { /* expected: a url-like without searchParams */ }
+  if (fromQuery) return fromQuery;
+  const headers = (req && req.headers) || {};
+  return _string(headers[MACHINE_HEADER] || headers['X-CTM-Machine'] || '', 160);
+}
+
+// The process's own MINTED instance id (D-3: never hostname, env tag or URL) — the same source
+// lib/remote-machine-create.js uses for its local-vs-remote decision.
+/** Synchronous pre-check for route wiring: does this request name a machine at all? */
+function isMachineRouted(req, url) {
+  return !!_machineFromRequest(req, _resolveUrl(req, url));
+}
+
+function _localInstanceId(deps) {
+  if (typeof deps.localInstanceId === 'string') return _string(deps.localInstanceId, 160);
+  try {
+    const identity = require('./instance-identity-access').getInstanceIdentity({ required: false });
+    return _string(identity && identity.instanceId, 160);
+  } catch {
+    return ''; /* expected: identity not minted yet; an unknown local id never matches a box row */
+  }
+}
+
+function _resolveUrl(req, url) {
+  if (url && typeof url.searchParams !== 'undefined') return url;
+  try { return new URL((req && req.url) || '/', 'http://localhost'); } catch { return new URL('/', 'http://localhost'); }
+}
+
+function _routeKey(req, url, options) {
+  if (options && options.route) return String(options.route);
+  const method = String((req && req.method) || 'GET').toUpperCase();
+  return `${method} ${url.pathname}`;
+}
+
+function _sendJson(res, status, payload) {
+  const body = JSON.stringify(payload);
+  if (res.headersSent) return true;
+  res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
+  res.end(body);
+  return true;
+}
+
+// ---------------------------------------------------------------------------------------------
+// Request-body handling
+// ---------------------------------------------------------------------------------------------
+
+/** Read the whole request body (only ever called once the request is known to be machine-routed). */
+function _readRawBody(req) {
+  return new Promise((resolve, reject) => {
+    let raw = '';
+    let size = 0;
+    let done = false;
+    req.on('data', (chunk) => {
+      if (done) return;
+      size += chunk.length;
+      if (size > BODY_LIMIT_BYTES) {
+        done = true;
+        reject(new Error('request_body_too_large'));
+        return;
+      }
+      raw += chunk;
+    });
+    req.on('end', () => { if (!done) { done = true; resolve(raw); } });
+    req.on('error', (error) => { if (!done) { done = true; reject(error); } });
+  });
+}
+
+// ---------------------------------------------------------------------------------------------
+// The hook
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * §6.5 entry point. Answers the request itself when it names a machine; otherwise defers.
+ *
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {URL|null} url  parsed request url; derived from req.url when null/omitted
+ * @param {{route?: string}} [options]  `'METHOD /pathname'`; derived from req when omitted
+ * @returns {Promise<boolean>} true = answered (do NOT run the local handler)
+ */
+async function maybeProxyMachineRequest(req, res, url, options = {}) {
+  const deps = _deps(options.deps);
+  const parsed = _resolveUrl(req, url);
+  const route = _routeKey(req, parsed, options);
+  if (!PROXIED_ROUTES.includes(route)) return false;
+
+  const isPost = route.startsWith('POST ');
+  const machine = _machineFromRequest(req, parsed);
+  if (!machine) return false;
+  let rawBody = null;
+  let parsedBody = null;
+
+  // This instance IS the named machine (§6.5) -> the local handler is the box handler. Checked
+  // BEFORE the registry lookup because a hub does not list ITSELF among its boxes: `machine=<my own
+  // id>` is the "I am the box" spelling, not an unknown machine.
+  const localId = _localInstanceId(deps);
+  if (localId && machine === localId) return false;
+
+  // P-3 (rev 2) one-hop guard. Every member-to-member request carries X-CTM-Forwarded-By. A request
+  // that carries it AND names a machine that is NOT this instance is asking us to forward an
+  // already-forwarded request to a third machine — the A→B→C chain / A→B→A loop P-3 forbids.
+  // Nothing is dialled. A request naming no machine, or naming THIS instance, is unchanged above:
+  // the browser's own direct request (no header) and a member's request to run locally both pass.
+  const forwardedBy = require('./remote-machine-create').forwardedByOf(req);
+  if (forwardedBy) {
+    return _sendJson(res, 400, {
+      ok: false,
+      code: 'machine_forward_loop',
+      error: `This request was already forwarded by ${forwardedBy}; a forwarded request is never forwarded again`,
+      machine,
+      forwardedBy,
+    });
+  }
+
+  const registry = deps.registry || require('./machine-registry');
+  const { machines } = registry.listMachines({ db: deps.db });
+  const target = (machines || []).find((row) => row.instanceId === machine);
+  if (!target) {
+    return _sendJson(res, 404, { ok: false, code: 'machine_unknown', error: `Unknown machine: ${machine}`, machine });
+  }
+
+  const machineName = _string(target.displayName, 200) || machine;
+  const unreachable = (extra = {}) => _sendJson(res, 502, {
+    ok: false,
+    code: 'machine_unreachable',
+    error: `Machine ${machineName} is unreachable`,
+    machine,
+    machineName,
+    ...extra,
+  });
+
+  // S-10: a create that mixes a hub-local worktree source with a remote machine is refused rather
+  // than silently creating a worktree on the hub (whose path the caller would then hand to the box).
+  if (route === 'POST /api/worktrees/create') {
+    if (parsedBody == null) {
+      if (rawBody == null) {
+        try { rawBody = await _readRawBody(req); } catch { rawBody = ''; }
+      }
+      try { parsedBody = rawBody.trim() ? JSON.parse(rawBody) : {}; } catch { parsedBody = null; }
+    }
+    if (!parsedBody || typeof parsedBody !== 'object') {
+      return _sendJson(res, 400, { ok: false, code: 'invalid_json', error: 'Invalid JSON body' });
+    }
+    const mixed = LOCAL_SOURCE_FIELDS.filter((field) => {
+      const value = parsedBody[field];
+      if (value == null || value === '' || value === false) return false;
+      if (field === 'sourceMachine') return _string(value, 160) !== machine;
+      return true;
+    });
+    if (mixed.length) {
+      return _sendJson(res, 400, {
+        ok: false,
+        code: 'machine_source_mixed',
+        error: `Worktree create names machine ${machineName} and a local worktree source (${mixed.join(', ')}); a remote worktree must be created on the machine`,
+        machine,
+        machineName,
+        mixedFields: mixed,
+      });
+    }
+  }
+
+  const baseUrl = _trimUrl(target.url);
+  if (!baseUrl) return unreachable({ error: `Machine ${machineName} has no URL` });
+
+  const buildHeaders = deps.buildPeerControlHeaders
+    || require('./remote-machine-create').buildPeerControlHeaders;
+  // P-8: the bearer is chosen per TARGET — `machine` is the box this request is being proxied to,
+  // so a legacy env-token box that never joined this hub's pool is dialled with the env bearer.
+  const peerHeaders = buildHeaders(deps.env || process.env, { instanceId: machine });
+  // WP-1 (D-1/D-2): the bearer is mandatory on every leg, so a missing one is answered HERE, with
+  // its own code and status, and no request is ever sent bare. `unreachable` keeps meaning exactly
+  // what it says: the box was dialled and did not answer.
+  if (!peerHeaders) {
+    const missing = _peerCredentialMissing(machineName);
+    return _sendJson(res, 503, {
+      ok: false,
+      code: missing.code,
+      error: missing.error,
+      machine,
+      machineName,
+    });
+  }
+
+  // Strip the routing field from what the box sees: `machine` is the hub's protocol, not the
+  // box's, and the box's own handlers must stay byte-identical to the pre-WP-4 ones.
+  const forwardUrl = new URL(parsed.toString());
+  forwardUrl.searchParams.delete(MACHINE_QUERY_PARAM);
+  const forwardTarget = `${baseUrl}${forwardUrl.pathname}${forwardUrl.search}`;
+
+  const fetchImpl = deps.fetchImpl || deps.fetch || globalThis.fetch;
+  if (typeof fetchImpl !== 'function') return unreachable({ error: 'fetch_unavailable' });
+
+  const timeoutMs = Number(deps.timeoutMs || DEFAULT_TIMEOUT_MS) || DEFAULT_TIMEOUT_MS;
+  const timeoutFn = typeof deps.setTimeoutFn === 'function' ? deps.setTimeoutFn : setTimeout;
+  const clearFn = typeof deps.clearTimeoutFn === 'function' ? deps.clearTimeoutFn : clearTimeout;
+  const controller = typeof AbortController === 'function' ? new AbortController() : null;
+  let timer = null;
+  const timeout = new Promise((resolve) => {
+    timer = timeoutFn(() => {
+      try { if (controller) controller.abort(); } catch { /* expected: abort on a settled fetch */ }
+      resolve({ __timeout: true });
+    }, timeoutMs);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+  });
+
+  let payload;
+  if (isPost) {
+    if (rawBody == null) {
+      try { rawBody = await _readRawBody(req); } catch { rawBody = ''; }
+    }
+    let outBody = {};
+    try { outBody = rawBody.trim() ? JSON.parse(rawBody) : {}; } catch { outBody = {}; }
+    if (outBody && typeof outBody === 'object') delete outBody.machine;
+    payload = JSON.stringify(outBody);
+  }
+
+  const requestOptions = {
+    method: String(req.method || 'GET').toUpperCase(),
+    headers: {
+      ...peerHeaders,
+      ...(isPost ? { 'Content-Type': 'application/json' } : {}),
+    },
+    ...(isPost ? { body: payload } : {}),
+    ...(controller ? { signal: controller.signal } : {}),
+    redirect: 'manual',
+  };
+
+  let response;
+  try {
+    response = await Promise.race([Promise.resolve(fetchImpl(forwardTarget, requestOptions)), timeout]);
+  } catch (error) {
+    if (timer) clearFn(timer);
+    return unreachable({ detail: _string(error && error.message, 300) });
+  }
+  if (timer) clearFn(timer);
+  if (!response || response.__timeout) return unreachable({ detail: 'timeout' });
+
+  let text = '';
+  try {
+    text = await response.text();
+  } catch (error) {
+    return unreachable({ detail: _string(error && error.message, 300) });
+  }
+  if (res.headersSent) return true;
+  // The box's status and body are returned VERBATIM (§6.5): the picker parses the box's own
+  // payload shape, and a hub that re-shaped it would drift from the local case.
+  res.writeHead(Number(response.status) || 502, {
+    'Content-Type': _string(response.headers && response.headers.get && response.headers.get('content-type'), 200)
+      || 'application/json',
+  });
+  res.end(text);
+  return true;
+}
+
+/**
+ * WP-6 (§7 ownership routing, AC-6b): send ONE request to a box over the SAME credential and with
+ * the SAME verbatim-response contract `maybeProxyMachineRequest` uses for the picker routes — the
+ * caller (`lib/remote-machine-catalog.js`) is what decides that the id belongs to the box, and what
+ * its own refusal looks like when the box cannot be reached.
+ *
+ * @param {{machine: object, pathname: string, search?: string, method?: string, body?: string}} request
+ * @returns {Promise<{ok: true, status: number, contentType: string, text: string}|{ok: false, code: string, error: string}>}
+ */
+async function forwardMachineHttp({ machine, pathname, search = '', method = 'POST', body = '', deps = {} } = {}) {
+  const d = _deps(deps);
+  const baseUrl = _trimUrl(machine && machine.url);
+  if (!baseUrl) return { ok: false, code: 'machine_unreachable', error: 'machine_url_missing' };
+  const buildHeaders = d.buildPeerControlHeaders || require('./remote-machine-create').buildPeerControlHeaders;
+  // P-8: same per-target choice as maybeProxyMachineRequest — the catalog knows which box this is.
+  const peerHeaders = buildHeaders(d.env || process.env, { instanceId: _string(machine && machine.instanceId, 160) });
+  // WP-1 (D-2): the caller (lib/remote-machine-catalog.js) turns this code into a 503 with the
+  // same body; keeping `machine_unreachable` out of it is what makes the config error greppable.
+  if (!peerHeaders) {
+    const missing = _peerCredentialMissing(_string(machine && machine.displayName, 200));
+    return { ok: false, code: missing.code, error: missing.error };
+  }
+  const fetchImpl = d.fetchImpl || d.fetch || globalThis.fetch;
+  if (typeof fetchImpl !== 'function') return { ok: false, code: 'machine_unreachable', error: 'fetch_unavailable' };
+  const timeoutMs = Number(d.timeoutMs || DEFAULT_TIMEOUT_MS) || DEFAULT_TIMEOUT_MS;
+  const timeoutFn = typeof d.setTimeoutFn === 'function' ? d.setTimeoutFn : setTimeout;
+  const clearFn = typeof d.clearTimeoutFn === 'function' ? d.clearTimeoutFn : clearTimeout;
+  const controller = typeof AbortController === 'function' ? new AbortController() : null;
+  let timer = null;
+  const timeout = new Promise((resolve) => {
+    timer = timeoutFn(() => {
+      try { if (controller) controller.abort(); } catch { /* expected: abort on a settled fetch */ }
+      resolve({ __timeout: true });
+    }, timeoutMs);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+  });
+  const verb = String(method || 'POST').toUpperCase();
+  const hasBody = verb !== 'GET' && verb !== 'HEAD';
+  let response;
+  try {
+    response = await Promise.race([Promise.resolve(fetchImpl(`${baseUrl}${pathname}${search}`, {
+      method: verb,
+      headers: { ...peerHeaders, ...(hasBody ? { 'Content-Type': 'application/json' } : {}) },
+      ...(hasBody ? { body: body || '' } : {}),
+      ...(controller ? { signal: controller.signal } : {}),
+      redirect: 'manual',
+    })), timeout]);
+  } catch (error) {
+    if (timer) clearFn(timer);
+    return { ok: false, code: 'machine_unreachable', error: _string(error && error.message, 300) };
+  }
+  if (timer) clearFn(timer);
+  if (!response || response.__timeout) return { ok: false, code: 'machine_unreachable', error: 'timeout' };
+  let text = '';
+  try {
+    text = await response.text();
+  } catch (error) {
+    return { ok: false, code: 'machine_unreachable', error: _string(error && error.message, 300) };
+  }
+  return {
+    ok: true,
+    status: Number(response.status) || 502,
+    contentType: _string(response.headers && response.headers.get && response.headers.get('content-type'), 200) || 'application/json',
+    text,
+  };
+}
+
+module.exports = {
+  MACHINE_HEADER,
+  MACHINE_QUERY_PARAM,
+  DEFAULT_TIMEOUT_MS,
+  PROXIED_ROUTES,
+  configure,
+  isMachineRouted,
+  maybeProxyMachineRequest,
+  forwardMachineHttp,
+  matchBoxProject,
+  normalizeGitRemote,
+  _recencyScore,
+};