engineering-memory 1.11.26 → 1.11.28

package/runtime/dist/src/providers/gitlab.js

@@ -0,0 +1,417 @@
+import { isIP } from 'node:net';
+import { join } from 'node:path';
+import * as z from 'zod/v4';
+import { principalFingerprint } from '../runtime/principal-state.js';
+import { readJson, removeFile, writeJson } from '../utilities/files.js';
+import { sha256 } from '../utilities/hash.js';
+export function gitLabRemote(remote) {
+    const trimmed = remote.trim();
+    const scpLike = /^(?:[^@/:]+@)?([^/:]+):(.+)$/.exec(trimmed);
+    let scheme = 'ssh';
+    let hostname;
+    let port = '';
+    let path;
+    if (scpLike &&
+        !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) &&
+        !/^[A-Za-z]:[\\/]/.test(trimmed)) {
+        hostname = scpLike[1].toLowerCase();
+        path = scpLike[2];
+    }
+    else if (URL.canParse(trimmed)) {
+        const url = new URL(trimmed);
+        scheme = url.protocol.slice(0, -1).toLowerCase();
+        hostname = url.hostname.toLowerCase();
+        port = url.port;
+        path = url.pathname;
+    }
+    else
+        return { refusal: 'local' };
+    if (!hostname || scheme === 'file')
+        return { refusal: 'local' };
+    if (isIP(hostname.replace(/^\[|\]$/g, '')))
+        return { refusal: 'ip' };
+    if (hostname === 'github.com' || hostname.endsWith('.github.com'))
+        return { refusal: 'github' };
+    const segments = path
+        .replace(/^\/+|\/+$/g, '')
+        .replace(/\.git$/i, '')
+        .split('/');
+    if (segments.length < 2 || !segments.every(pathSegment))
+        return { refusal: 'unsupported' };
+    if (scheme === 'https' || scheme === 'http') {
+        const host = port ? `${hostname}:${port}` : hostname;
+        return {
+            host,
+            address: scheme === 'http' && !loopback(hostname) ? `https://${hostname}` : `${scheme}://${host}`,
+            path: segments.join('/'),
+        };
+    }
+    if (['ssh', 'git+ssh', 'ssh+git', 'git'].includes(scheme))
+        return { host: hostname, address: `https://${hostname}`, path: segments.join('/') };
+    return { refusal: 'unsupported' };
+}
+export function gitLabAddress(value) {
+    const trimmed = value.trim();
+    if (trimmed.length > 300 || !URL.canParse(trimmed))
+        return null;
+    const url = new URL(trimmed);
+    const hostname = url.hostname.toLowerCase();
+    const path = url.pathname.replace(/\/+$/, '');
+    if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback(hostname))) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        isIP(hostname.replace(/^\[|\]$/g, '')) ||
+        hostname === 'github.com' ||
+        hostname.endsWith('.github.com') ||
+        !path.split('/').slice(1).every(pathSegment))
+        return null;
+    return `${url.protocol}//${url.host.toLowerCase()}${path}`;
+}
+export function projectPath(address, path) {
+    const prefix = new URL(address).pathname.replace(/^\/+|\/+$/g, '');
+    return prefix && path.startsWith(prefix + '/') ? path.slice(prefix.length + 1) : path;
+}
+function pathSegment(segment) {
+    return /^[\w.-]+$/.test(segment) && segment !== '.' && segment !== '..';
+}
+function loopback(hostname) {
+    return hostname === 'localhost' || hostname.endsWith('.localhost');
+}
+export class GitLabError extends Error {
+    failure;
+    address;
+    status;
+    detail;
+    constructor(failure, address, status, detail) {
+        super(`GitLab at ${address}: ${failure}${status ? ` (${status})` : ''}${detail ? `: ${detail}` : ''}`);
+        this.failure = failure;
+        this.address = address;
+        this.status = status;
+        this.detail = detail;
+        this.name = 'GitLabError';
+    }
+}
+const certificateCodes = new Set([
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'CERT_HAS_EXPIRED',
+    'CERT_NOT_YET_VALID',
+    'CERT_UNTRUSTED',
+    'CERT_SIGNATURE_FAILURE',
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+]);
+const connectCodes = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNREFUSED',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EADDRNOTAVAIL',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+function networkCode(error) {
+    let current = error;
+    for (let depth = 0; depth < 5 && current && typeof current === 'object'; depth++) {
+        const code = current.code;
+        if (typeof code === 'string')
+            return code;
+        const tried = current.errors;
+        current = current.cause ?? (Array.isArray(tried) ? tried[0] : null);
+    }
+    return null;
+}
+function gitLabMessage(body) {
+    if (!body)
+        return null;
+    let message = body;
+    try {
+        const parsed = JSON.parse(body);
+        message = parsed.message ?? parsed.error ?? null;
+    }
+    catch {
+        return null;
+    }
+    const text = typeof message === 'string' ? message : message ? JSON.stringify(message) : '';
+    return text.replace(/[\u0000-\u001f\u007f]+/g, ' ').slice(0, 200) || null;
+}
+export const mergeRequestSchema = z.object({
+    iid: z.number().int().positive(),
+    web_url: z.string().min(1).max(500),
+    state: z.string(),
+    draft: z.boolean().optional(),
+    work_in_progress: z.boolean().optional(),
+    sha: z.string().nullish(),
+    source_branch: z.string(),
+    target_branch: z.string(),
+    project_id: z.number().optional(),
+    source_project_id: z.number().optional(),
+});
+export function reviewState(request) {
+    if (request.state === 'merged')
+        return 'merged';
+    if (request.state === 'closed')
+        return 'closed';
+    return request.draft || request.work_in_progress ? 'draft' : 'ready';
+}
+export class GitLabClient {
+    timeoutMs;
+    constructor(timeoutMs) {
+        this.timeoutMs = timeoutMs;
+    }
+    async user(address, token) {
+        await this.call(address, token, 'GET', '/user');
+    }
+    async scopes(address, token) {
+        try {
+            const self = z
+                .object({ scopes: z.array(z.string()) })
+                .safeParse(await this.call(address, token, 'GET', '/personal_access_tokens/self'));
+            return self.success ? self.data.scopes : null;
+        }
+        catch (error) {
+            if (error instanceof GitLabError &&
+                ['not_found', 'not_allowed', 'invalid_request'].includes(error.failure))
+                return null;
+            throw error;
+        }
+    }
+    async project(address, token, project) {
+        return await this.found(async () => this.shape(address, z.object({ id: z.number() }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}`)));
+    }
+    async branch(address, token, project, branch) {
+        const found = await this.found(async () => this.shape(address, z.object({ commit: z.object({ id: z.string(), title: z.string().nullish() }) }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/repository/branches/${encodeURIComponent(branch)}`)));
+        return found ? { commit: found.commit.id, title: found.commit.title ?? '' } : null;
+    }
+    async contains(address, token, project, branch, commit) {
+        const query = new URLSearchParams([
+            ['refs[]', commit],
+            ['refs[]', branch],
+        ]);
+        try {
+            const base = this.shape(address, z.object({ id: z.string() }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/repository/merge_base?${query}`));
+            return base.id === commit;
+        }
+        catch (error) {
+            if (error instanceof GitLabError &&
+                (error.failure === 'not_found' || error.failure === 'invalid_request'))
+                return false;
+            throw error;
+        }
+    }
+    async mergeRequests(address, token, project, branch, state) {
+        const query = new URLSearchParams({
+            source_branch: branch,
+            order_by: 'created_at',
+            sort: 'desc',
+            per_page: '20',
+            ...(state ? { state } : {}),
+        });
+        const listed = this.shape(address, z.array(mergeRequestSchema), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project.path)}/merge_requests?${query}`));
+        return listed.filter((request) => request.source_branch === branch &&
+            (request.source_project_id === undefined || request.source_project_id === project.id));
+    }
+    async mergeRequest(address, token, project, number) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/merge_requests/${number}`));
+    }
+    async createMergeRequest(address, token, project, request) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'POST', `/projects/${encodeURIComponent(project)}/merge_requests`, {
+            source_branch: request.source,
+            target_branch: request.target,
+            title: request.title,
+            ...(request.description ? { description: request.description } : {}),
+        }));
+    }
+    async found(read) {
+        try {
+            return await read();
+        }
+        catch (error) {
+            if (error instanceof GitLabError && error.failure === 'not_found')
+                return null;
+            throw error;
+        }
+    }
+    shape(address, schema, value) {
+        const parsed = schema.safeParse(value);
+        if (!parsed.success)
+            throw new GitLabError('unexpected_answer', address, null, null);
+        return parsed.data;
+    }
+    async call(address, token, method, path, body) {
+        let status;
+        let text;
+        try {
+            const response = await fetch(`${address}/api/v4${path}`, {
+                method,
+                redirect: 'manual',
+                headers: {
+                    'PRIVATE-TOKEN': token,
+                    Accept: 'application/json',
+                    ...(body ? { 'Content-Type': 'application/json' } : {}),
+                },
+                ...(body ? { body: JSON.stringify(body) } : {}),
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+            status = response.status;
+            text = await response.text();
+        }
+        catch (error) {
+            const code = networkCode(error);
+            if (code && certificateCodes.has(code))
+                throw new GitLabError('untrusted_certificate', address, null, code);
+            if ((code && connectCodes.has(code)) || method === 'GET')
+                throw new GitLabError('unreachable', address, null, code);
+            throw new GitLabError('unknown_outcome', address, null, code);
+        }
+        if (status >= 200 && status < 300) {
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                throw new GitLabError('unexpected_answer', address, status, null);
+            }
+        }
+        const failure = status >= 300 && status < 400
+            ? 'redirected'
+            : status === 401
+                ? 'token_rejected'
+                : status === 403
+                    ? 'not_allowed'
+                    : status === 404
+                        ? 'not_found'
+                        : status === 409
+                            ? 'conflict'
+                            : status === 429
+                                ? 'rate_limited'
+                                : status >= 500
+                                    ? 'server_error'
+                                    : 'invalid_request';
+        throw new GitLabError(failure, address, status, gitLabMessage(text));
+    }
+}
+const savedAddresses = z.object({
+    schemaVersion: z.literal(1),
+    principalHash: z.string().min(1),
+    addresses: z.array(z.object({ host: z.string().min(1), address: z.string().min(1) })),
+});
+export class GitLabTokens {
+    stateRoot;
+    credentials;
+    path;
+    queue = Promise.resolve();
+    constructor(stateRoot, credentials) {
+        this.stateRoot = stateRoot;
+        this.credentials = credentials;
+        this.path = join(stateRoot, 'gitlab-addresses.json');
+    }
+    async address(host) {
+        return (await this.current())?.addresses.find((entry) => entry.host === host)?.address ?? null;
+    }
+    async forLink(host, repository) {
+        const addresses = [...new Set((await this.current())?.addresses.map((entry) => entry.address))]
+            .filter((address) => {
+            const url = new URL(address);
+            const prefix = url.pathname.replace(/^\/+/, '');
+            return url.host === host && (!prefix || repository.startsWith(prefix + '/'));
+        })
+            .sort((left, right) => right.length - left.length);
+        return addresses[0]
+            ? { address: addresses[0], project: projectPath(addresses[0], repository) }
+            : null;
+    }
+    async token(address) {
+        const principal = await this.principal();
+        return principal ? await this.credentials.get(tokenName(principal, address)) : null;
+    }
+    async any() {
+        return Boolean((await this.current())?.addresses.length);
+    }
+    async save(host, address, token) {
+        await this.exclusive(async () => {
+            const principal = await this.principal();
+            if (!principal)
+                throw new Error('Sign in to Engineering Memory before saving a GitLab token.');
+            let saved = await this.read();
+            if (saved && saved.principalHash !== principal) {
+                await this.deleteTokens(saved);
+                saved = null;
+            }
+            const previous = saved?.addresses.find((entry) => entry.host === host)?.address;
+            await this.credentials.set(tokenName(principal, address), token);
+            const addresses = [
+                ...(saved?.addresses ?? []).filter((entry) => entry.host !== host),
+                { host, address },
+            ];
+            await writeJson(this.path, { schemaVersion: 1, principalHash: principal, addresses }, this.stateRoot);
+            if (previous && !addresses.some((entry) => entry.address === previous))
+                await this.credentials.delete(tokenName(principal, previous));
+        });
+    }
+    async remove(address) {
+        await this.exclusive(async () => {
+            const principal = await this.principal();
+            if (!principal)
+                return;
+            await this.credentials.delete(tokenName(principal, address));
+            const saved = await this.read();
+            if (saved?.principalHash !== principal)
+                return;
+            await writeJson(this.path, { ...saved, addresses: saved.addresses.filter((entry) => entry.address !== address) }, this.stateRoot);
+        });
+    }
+    async clear() {
+        await this.exclusive(async () => {
+            const saved = await this.read();
+            if (saved)
+                await this.deleteTokens(saved);
+            await removeFile(this.path, this.stateRoot);
+        });
+    }
+    async deleteTokens(saved) {
+        for (const address of new Set(saved.addresses.map((entry) => entry.address)))
+            await this.credentials.delete(tokenName(saved.principalHash, address));
+    }
+    async current() {
+        const principal = await this.principal();
+        const saved = principal ? await this.read() : null;
+        return saved?.principalHash === principal ? saved : null;
+    }
+    async read() {
+        const parsed = savedAddresses.safeParse(await readJson(this.path, this.stateRoot));
+        return parsed.success ? parsed.data : null;
+    }
+    async principal() {
+        const accessToken = await this.credentials.get('access-token');
+        if (!accessToken)
+            return null;
+        try {
+            return principalFingerprint(accessToken);
+        }
+        catch {
+            return null;
+        }
+    }
+    async exclusive(action) {
+        const previous = this.queue;
+        let release = () => undefined;
+        this.queue = new Promise((resolvePromise) => {
+            release = resolvePromise;
+        });
+        await previous;
+        try {
+            await action();
+        }
+        finally {
+            release();
+        }
+    }
+}
+function tokenName(principal, address) {
+    return `gitlab-token-${sha256(`${principal}\n${address}`).slice(0, 32)}`;
+}
+//# sourceMappingURL=gitlab.js.map

package/runtime/dist/src/runtime/active-context-store.js

@@ -122,7 +122,7 @@ export class ActiveContextStore {
             }
         }
     }
-    async setChangeBaseline(repoFingerprint, sessionId, manifest, leasePaths, taskSnapshot) {
+    async setChangeBaseline(repoFingerprint, sessionId, manifest, leasePaths, taskSnapshot, selfReviewRequired) {
         const pointer = taskSnapshot
             ? await this.loadForTask(repoFingerprint, taskSnapshot.taskId)
             : await this.loadForSession(repoFingerprint, sessionId);
@@ -140,13 +140,12 @@ export class ActiveContextStore {
                     lastSequence: taskSnapshot.lastSequence,
                 }
                 : {}),
-            changeBaseline: pointer.changeBaseline
-                ? { ...pointer.changeBaseline, leasePaths }
-                : {
-                    diffHash: manifest.diffHash,
-                    changedPaths: manifest.changedPaths,
-                    leasePaths,
-                },
+            changeBaseline: {
+                diffHash: pointer.changeBaseline?.diffHash ?? manifest.diffHash,
+                changedPaths: pointer.changeBaseline?.changedPaths ?? manifest.changedPaths,
+                leasePaths,
+                ...(selfReviewRequired ? { selfReviewRequired } : {}),
+            },
         });
     }
     async setVerificationIntent(repoFingerprint, input) {
@@ -399,7 +398,11 @@ export class ActiveContextStore {
                 pointer.changeBaseline.changedPaths.some((entry) => !isChangedPath(entry)) ||
                 !Array.isArray(pointer.changeBaseline.leasePaths) ||
                 pointer.changeBaseline.leasePaths.some((path) => !isRepositoryRelative(path)) ||
-                new Set(pointer.changeBaseline.leasePaths).size !== pointer.changeBaseline.leasePaths.length) {
+                new Set(pointer.changeBaseline.leasePaths).size !==
+                    pointer.changeBaseline.leasePaths.length ||
+                (pointer.changeBaseline.selfReviewRequired !== undefined &&
+                    (!Array.isArray(pointer.changeBaseline.selfReviewRequired) ||
+                        !pointer.changeBaseline.selfReviewRequired.every(isSelfReviewRecord)))) {
                 throw new Error('Active Engineering Memory change baseline is invalid');
             }
         }
@@ -429,6 +432,13 @@ function isDurableIntent(value) {
         typeof value.createdAt === 'string' &&
         Number.isFinite(Date.parse(value.createdAt)));
 }
+function isSelfReviewRecord(value) {
+    return (typeof value?.resourceId === 'string' &&
+        typeof value.resourceKey === 'string' &&
+        typeof value.title === 'string' &&
+        Array.isArray(value.paths) &&
+        value.paths.every((path) => typeof path === 'string'));
+}
 function isChangedPath(value) {
     return (typeof value.path === 'string' &&
         isRepositoryRelative(value.path) &&

package/runtime/dist/src/runtime/api-client.js

@@ -51,6 +51,7 @@ export const backendRecoveryOperationNames = [
     'task.branch',
     'task.resolve_pending_delivery',
     'task.delivery',
+    'task.review_request',
 ];
 const backendRecoveryOperations = new Set(backendRecoveryOperationNames);
 const browserSigninRecovery = 'auth.signin_browser';