halfcycle 0.3.36 → 0.3.37

package/dist/bin.js

@@ -230,6 +230,10 @@ function looksLikeSecret(text) {
   return false;
 }
 
+// ../core/dist/mcp-registration.js
+var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_SERVER_KEY = "halfcycle";
+
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
@@ -1220,7 +1224,19 @@ var ciTokenExchangeResponseSchema = z10.object({
   expiresAt: utcIso8601,
   engagementId: z10.string()
 }).strict();
+var NO_CREDENTIAL_PLACEHOLDER = "halfcycle:no-credential";
+var NOT_THIS_ACCOUNT_PLACEHOLDER = "halfcycle:not-this-account";
+var UPDATE_CLAUDE_CODE_PLACEHOLDER = "halfcycle:update-claude-code";
 var SWITCH_ACCOUNT_ANSWER = 'answer "s" when asked';
+var NO_CREDENTIAL_SENTENCE = 'Halfcycle is not connected: this machine has no working Halfcycle credential for this project. Run "npx halfcycle" in the project folder to sign in again.';
+var NOT_THIS_ACCOUNT_SENTENCE = `Halfcycle is not connected: this project belongs to another Halfcycle account. To switch, run "npx halfcycle" in this project and ${SWITCH_ACCOUNT_ANSWER}.`;
+var UPDATE_CLAUDE_CODE_SENTENCE = "Halfcycle is not connected: this Claude Code version does not name the server it connects to, so no credential was sent. Update Claude Code, then reopen.";
+var NO_NODE_SENTENCE = "Halfcycle is not connected: Node is not installed, or not on the path this session uses, so nothing here is checked. Install Node, then reopen.";
+var PLACEHOLDER_SENTENCES = Object.freeze({
+  [NO_CREDENTIAL_PLACEHOLDER]: NO_CREDENTIAL_SENTENCE,
+  [NOT_THIS_ACCOUNT_PLACEHOLDER]: NOT_THIS_ACCOUNT_SENTENCE,
+  [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
+});
 
 // ../events/dist/phase-record.js
 import { z as z11 } from "zod";
@@ -2001,7 +2017,7 @@ var WRITE_ALLOWLIST = [
   ".halfcycle/bin",
   "docs/build-records",
   "test/fixtures/captured",
-  ".mcp.json",
+  MCP_REGISTRATION_REL,
   ".gitattributes",
   ZONE_B_DIR
 ];
@@ -2374,6 +2390,20 @@ exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
 }
 var GENERATED_SESSION_START_HEADER = "# Session-start marker \u2014 generated by";
 var SESSION_ID_FROM_HOOK_INPUT_SH = `SESSION_ID="$(printf '%s' "$INPUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);process.stdout.write(typeof j.session_id==="string"?j.session_id:"")}catch{process.stdout.write("")}})' 2>/dev/null || true)"`;
+var REPO_HASH_FROM_ROOT_SH = `HASH="$(printf '%s' "$REPO_ROOT" | node -e 'const c=[];process.stdin.on("data",d=>c.push(d)).on("end",()=>{process.stdout.write(require("node:crypto").createHash("sha256").update(Buffer.concat(c)).digest("hex").slice(0,12))})' 2>/dev/null || true)"`;
+function noNodeReplyShell() {
+  const reply = JSON.stringify({
+    systemMessage: NO_NODE_SENTENCE,
+    hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: NO_NODE_SENTENCE }
+  });
+  if (reply.includes("'")) {
+    throw new Error("[bundle install] the no-Node notice cannot be single-quoted; refusing to write the session-start script.");
+  }
+  return `if ! command -v node >/dev/null 2>&1; then
+  printf '%s\\n' '${reply}'
+  exit 0
+fi`;
+}
 function generateSessionStartMarker() {
   return `#!/usr/bin/env bash
 ${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
@@ -2382,10 +2412,15 @@ ${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
 # it began instead of only against the latest commit. The session id comes in on
 # stdin with the hook input; without one, the older session-less name is written
 # and the stop-time check compares against the latest commit as it used to.
+#
+# Without Node nothing Halfcycle installs here can run, so this says so once and
+# writes no marker.
+${noNodeReplyShell()}
 INPUT="$(cat 2>/dev/null || true)"
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${REPO_HASH_FROM_ROOT_SH}
+if [ -z "$HASH" ]; then exit 0; fi
 ${SESSION_ID_FROM_HOOK_INPUT_SH}
 MARKER_DIR="\${TMPDIR:-/tmp}"
 MARKER_DIR="\${MARKER_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
@@ -2395,64 +2430,6 @@ else
   MARKER_FILE="\${MARKER_DIR}/halfcycle-session-\${HASH}.ref"
 fi
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
-
-# ---------------------------------------------------------------------------
-# STANDING GUARD-COVERAGE STATEMENT (T-27; two arms since T-02b).
-#
-# A repository with no credential on this machine is UNGUARDED: the PostToolUse
-# hook will find nothing to evaluate with, and it says so once per edit, after
-# the edit. This says it once, up front, before anything is written \u2014 which is
-# the one thing a session-start hook can do that nothing else can.
-#
-# TWO REASONS TO HAVE NO CREDENTIAL, TWO DIFFERENT THINGS TO SAY (T-02b,
-# solo-project-ownership \u2014 outcome B). "You have not signed in here yet" is
-# fixed by re-running the installer; "this is not your project" is permanent,
-# and the same remedy would send the reader in a circle forever. The two are
-# told apart by HALFCYCLE_ENV_NOT_THIS_ACCOUNT, set by \`halfcycle_env_file\`
-# below from a machine-level marker beside the credential store.
-#
-# Everything below runs in a SUBSHELL: it sources a credential store, and a
-# session-start hook must not leak an engagement's variables into whatever the
-# editor runs next. Any failure inside it is swallowed; this script's exit
-# status is 0 either way, and the marker above has already been written.
-# ---------------------------------------------------------------------------
-${engagementResolutionShell()}
-
-(
-  if halfcycle_env_file "$REPO_ROOT"; then
-    set -a
-    . "$HALFCYCLE_ENV_FILE"
-    set +a
-  fi
-  if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
-    # OUTCOME B (T-02b, solo-project-ownership). This is not the missing-keys
-    # case below wearing different words: there is nothing to fix, and the loop
-    # that follows is skipped entirely rather than run and then overridden \u2014 a
-    # repository whose credential is absent for THIS reason must never be told
-    # to re-run the installer, which can never obtain one for it.
-    echo "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked."
-    echo "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is"
-    echo "[halfcycle] evaluated, and nothing you do is reported as having passed."
-    echo "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming."
-    echo "[halfcycle] Ask the project's owner for view access."
-    echo "[halfcycle] If this account is wrong, sign in as the one that owns the project and run"
-    echo "[halfcycle] \\"npx halfcycle\\" again."
-  else
-    hc_missing=""
-    for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
-      eval "hc_value=\\\${$hc_key:-}"
-      if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
-    done
-    if [ -n "$hc_missing" ]; then
-      echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
-      echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
-      echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
-      echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
-      echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
-      echo "[halfcycle] and needs nothing configured first."
-    fi
-  fi
-) 2>/dev/null || true
 exit 0
 `;
 }
@@ -2468,7 +2445,8 @@ INPUT="$(cat 2>/dev/null || true)"
 
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${REPO_HASH_FROM_ROOT_SH}
+if [ -z "$HASH" ]; then exit 0; fi
 
 # The session id arrives on stdin as part of the hook payload. Empty when absent.
 ${SESSION_ID_FROM_HOOK_INPUT_SH}
@@ -2588,8 +2566,6 @@ function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeade
   }
   return "removed";
 }
-var MCP_REGISTRATION_REL = ".mcp.json";
-var MCP_SERVER_KEY = "halfcycle";
 var MCP_HEADERS_HELPER_COMMAND = `node -e "${[
   `const p=require('path'),f=require('fs'),c=require('child_process');`,
   `let d=process.cwd();`,
@@ -3180,6 +3156,7 @@ async function bindLoopback(env = process.env, engagementId) {
   const state = randomBytes(32).toString("hex");
   let pending = null;
   let deliver = null;
+  let abandon = null;
   const server = createServer(createCallbackHandler(state, (callback) => {
     if (deliver)
       deliver(callback);
@@ -3221,12 +3198,18 @@ async function bindLoopback(env = process.env, engagementId) {
           clearInterval(ticker);
         clearTimeout(timer);
         deliver = null;
+        abandon = null;
         resolve4(value);
       };
       const timer = setTimeout(() => finish(null), Math.max(0, timeoutMs));
       deliver = finish;
+      abandon = () => finish(null);
     }),
-    close: () => closeServer(server)
+    close: () => {
+      if (abandon !== null)
+        abandon();
+      return closeServer(server);
+    }
   };
 }
 function closeServer(server) {
@@ -3260,8 +3243,13 @@ function defaultSleep(ms) {
 function browserOpenCommand(os, url) {
   if (os === "darwin")
     return { command: "open", args: [url] };
-  if (os === "win32")
-    return { command: "cmd", args: ["/c", "start", "", url] };
+  if (os === "win32") {
+    return {
+      command: "cmd.exe",
+      args: ["/d", "/s", "/c", `"start "" "${url}""`],
+      windowsVerbatimArguments: true
+    };
+  }
   return { command: "xdg-open", args: [url] };
 }
 function isOpenableUrl(url) {
@@ -3272,19 +3260,35 @@ function isOpenableUrl(url) {
     return false;
   }
 }
+function hasWin32UnsafeOpenerChars(url) {
+  if (url.includes('"') || url.includes("%"))
+    return true;
+  for (let i = 0; i < url.length; i++) {
+    const code = url.charCodeAt(i);
+    if (code <= 31 || code === 127)
+      return true;
+  }
+  return false;
+}
 var BROWSER_OPEN_GRACE_MS = 3e3;
-async function openBrowser(url, env = process.env) {
+async function openBrowser(url, env = process.env, os = platform3(), spawnImpl = spawn) {
   if ((env["HALFCYCLE_NO_BROWSER"] ?? "").trim() !== "") {
     return { opened: false, reason: "HALFCYCLE_NO_BROWSER is set in this environment" };
   }
   if (!isOpenableUrl(url)) {
     return { opened: false, reason: "the sign-in address is not an http(s) URL this CLI will open" };
   }
-  const { command, args: args2 } = browserOpenCommand(platform3(), url);
+  if (os === "win32" && hasWin32UnsafeOpenerChars(url)) {
+    return {
+      opened: false,
+      reason: 'the sign-in address holds a " or %, or a control character, this opener will not pass to cmd.exe on Windows'
+    };
+  }
+  const { command, args: args2, windowsVerbatimArguments } = browserOpenCommand(os, url);
   return new Promise((resolve4) => {
     let child;
     try {
-      child = spawn(command, args2, { stdio: "ignore", env });
+      child = spawnImpl(command, args2, { stdio: "ignore", env, windowsVerbatimArguments });
     } catch (err) {
       resolve4({
         opened: false,
@@ -3356,82 +3360,107 @@ function tryRefusal(body) {
   }
   return { status: candidate.status, message: candidate.message };
 }
+async function askControlOnce(tokenUrl, started) {
+  let body;
+  try {
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ deviceCode: started.deviceCode })
+    });
+    body = await res.json().catch(() => null);
+  } catch {
+    return null;
+  }
+  const parsed = devicePollResponseSchema.safeParse(body);
+  return parsed.success ? parsed.data : null;
+}
+function tokenUrlFor(serviceUrl) {
+  return `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
+}
+function localDeadline(started) {
+  return new Date(started.expiresAt).getTime() + started.pollIntervalMs * DEADLINE_SLACK_INTERVALS;
+}
 async function pollForCredential(serviceUrl, started, deps = {}) {
   const write = deps.write ?? defaultWrite;
   const sleep = deps.sleep ?? defaultSleep;
   const now = deps.now ?? Date.now;
-  const url = `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
+  const url = tokenUrlFor(serviceUrl);
   const interval = started.pollIntervalMs;
-  const deadline = new Date(started.expiresAt).getTime() + interval * DEADLINE_SLACK_INTERVALS;
+  const deadline = localDeadline(started);
   const startedAt = now();
   let announcedAt = startedAt;
   for (; ; ) {
-    let body;
-    let reachable = true;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: started.deviceCode })
-      });
-      body = await res.json().catch(() => null);
-    } catch {
-      reachable = false;
-    }
-    if (reachable) {
-      const parsed = devicePollResponseSchema.safeParse(body);
-      if (parsed.success) {
-        const answer = parsed.data;
-        if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
-          return answer;
-        if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
-          throw new SignInRefused(answer.status, answer.message);
-        }
+    const answer = await askControlOnce(url, started);
+    if (answer !== null) {
+      if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
+        return answer;
+      if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
+        throw new SignInRefused(answer.status, answer.message);
       }
     }
     if (now() >= deadline) {
       throw new SignInRefused(SIGN_IN_TIMED_OUT, SIGN_IN_TIMEOUT_MESSAGE);
     }
-    if (now() - announcedAt >= STILL_WAITING_MS) {
+    if (now() - announcedAt >= (deps.stillWaitingMs ?? STILL_WAITING_MS)) {
       announcedAt = now();
-      write(`[halfcycle] Still waiting for the browser (${Math.round((announcedAt - startedAt) / 1e3)}s). Code: ${started.userCode}
-`);
+      write(stillWaitingLine(announcedAt - startedAt, started));
     }
     await sleep(interval);
   }
 }
+function stillWaitingLine(elapsedMs, started) {
+  return `[halfcycle] Still waiting for the browser (${Math.round(elapsedMs / 1e3)}s). Code: ${started.userCode}
+`;
+}
 var LOOPBACK_TIMEOUT_MESSAGE = "Sign-in timed out: the browser never came back to this terminal. Nothing was created. Run the command again \u2014 or, if this machine cannot hand the browser back (a remote session, a container), run it with HALFCYCLE_NO_BROWSER=1 to use the code-based sign-in instead.";
-var LOOPBACK_COLLECT_ATTEMPTS = 3;
-async function collectDecidedCredential(serviceUrl, started, deps) {
-  const sleep = deps.sleep ?? defaultSleep;
-  const url = `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
-  let lastProblem = LOOPBACK_TIMEOUT_MESSAGE;
-  for (let attempt = 0; attempt < LOOPBACK_COLLECT_ATTEMPTS; attempt++) {
-    if (attempt > 0)
-      await sleep(started.pollIntervalMs);
-    let body;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: started.deviceCode })
-      });
-      body = await res.json().catch(() => null);
-    } catch (err) {
-      lastProblem = `The browser finished signing you in, but this terminal could not reach the Halfcycle service to collect the credential: ${err instanceof Error ? err.message : String(err)}. Run the command again.`;
-      continue;
+async function pollBesideLoopback(serviceUrl, started, wake, deps) {
+  const sleep = deps.sleep;
+  const now = deps.now ?? Date.now;
+  const url = tokenUrlFor(serviceUrl);
+  const deadline = localDeadline(started);
+  let arrived = false;
+  let spent = false;
+  let interrupt = null;
+  void wake.then(() => {
+    arrived = true;
+    if (interrupt !== null)
+      interrupt();
+  });
+  for (; ; ) {
+    const answer = await askControlOnce(url, started);
+    if (answer !== null) {
+      if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
+        return answer;
+      if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
+        throw new SignInRefused(answer.status, answer.message);
+      }
+    }
+    if (now() >= deadline) {
+      throw new SignInRefused(SIGN_IN_TIMED_OUT, LOOPBACK_TIMEOUT_MESSAGE);
     }
-    const parsed = devicePollResponseSchema.safeParse(body);
-    if (!parsed.success)
+    if (arrived && !spent) {
+      spent = true;
       continue;
-    const answer = parsed.data;
-    if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
-      return answer;
-    if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
-      throw new SignInRefused(answer.status, answer.message);
     }
+    if (sleep === void 0) {
+      await new Promise((resolve4) => {
+        const timer = setTimeout(resolve4, started.pollIntervalMs);
+        interrupt = () => {
+          clearTimeout(timer);
+          resolve4();
+        };
+      });
+    } else {
+      await new Promise((resolve4) => {
+        interrupt = resolve4;
+        void sleep(started.pollIntervalMs).then(resolve4);
+      });
+    }
+    interrupt = null;
+    if (arrived)
+      spent = true;
   }
-  throw new SignInRefused(SIGN_IN_TIMED_OUT, lastProblem);
 }
 async function signIn(serviceUrl, deps = {}) {
   const write = deps.write ?? defaultWrite;
@@ -3456,24 +3485,16 @@ async function signIn(serviceUrl, deps = {}) {
       const url = loopbackVerificationUrl(started.verificationUrl, bind.target);
       const attempt = await openBrowser(url, env);
       if (attempt.opened) {
-        write(`[halfcycle] Opened your browser to finish signing in. This terminal is waiting.
+        write(`[halfcycle] Opened your browser to finish signing in. Code: ${started.userCode}. This terminal is waiting.
 `);
-        const deadline = new Date(started.expiresAt).getTime() + started.pollIntervalMs * DEADLINE_SLACK_INTERVALS;
-        const callback = await bind.waitForCallback({
-          timeoutMs: deadline - now(),
-          onStillWaiting: (elapsed) => (
-            // NO CODE IN THIS LINE. The device-code path prints the code here
-            // because a human is comparing it; on this path there is nothing to
-            // compare and criterion 1 is that none is displayed AT ALL.
-            write(`[halfcycle] Still waiting for the browser (${Math.round(elapsed / 1e3)}s).
-`)
-          )
+        const startedAt = now();
+        const redirect = bind.waitForCallback({
+          timeoutMs: localDeadline(started) - startedAt,
+          onStillWaiting: (elapsed) => write(stillWaitingLine(elapsed, started)),
+          stillWaitingMs: deps.stillWaitingMs ?? STILL_WAITING_MS
         });
+        const approved = await pollBesideLoopback(serviceUrl, started, redirect.then(() => void 0), deps);
         await closeListener();
-        if (callback === null) {
-          throw new SignInRefused(SIGN_IN_TIMED_OUT, LOOPBACK_TIMEOUT_MESSAGE);
-        }
-        const approved = await collectDecidedCredential(serviceUrl, started, deps);
         write(`[halfcycle] Signed in as account ${approved.accountId} \u2014 continuing.
 `);
         return {
@@ -6209,10 +6230,13 @@ ${USAGE}`);
       if (result.notShared)
         process.stdout.write(`${renderNotShared(result.notShared)}
 `);
+      if (credential) {
+        process.stdout.write("[halfcycle] Commit the files Halfcycle set up here, so every copy of this project runs the same checks.\n");
+      }
       if (credential) {
         process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
-        process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
+        process.stdout.write(`[halfcycle] Claude Code will then ask whether to use a new MCP server. The cursor starts on "Continue without using this MCP server" \u2014 choose to use it instead; without it Halfcycle will not connect.
 `);
       }
       if (credential) {