heyio 0.21.4 → 0.23.0

package/dist/api/server.js

@@ -20,27 +20,6 @@ import { runScheduleNow } from "../copilot/scheduler.js";
 import { runIoScheduleNow } from "../copilot/io-scheduler.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const WEB_DIST = path.resolve(__dirname, "../../web-dist");
-let releasesCache = null;
-function loadReleases() {
-    if (releasesCache)
-        return releasesCache;
-    // Check both dev (src/api/ → src/) and production (dist/api/ → src/) paths
-    const candidates = [
-        path.join(__dirname, "../releases.json"), // dist/api/ → dist/releases.json
-        path.join(__dirname, "../../src/releases.json"), // dist/api/ → src/releases.json
-    ];
-    for (const candidate of candidates) {
-        try {
-            if (!existsSync(candidate))
-                continue;
-            const raw = readFileSync(candidate, "utf-8");
-            releasesCache = JSON.parse(raw);
-            return releasesCache;
-        }
-        catch { /* try next */ }
-    }
-    return [];
-}
 let messageHandler;
 const sseConnections = new Set();
 export function setMessageHandler(handler) {
@@ -173,10 +152,6 @@ export async function startApiServer() {
     api.get("/status", (_req, res) => {
         res.json({ version: IO_VERSION, uptime: process.uptime() });
     });
-    // Releases endpoint — serves build-time bundled GitHub release notes
-    api.get("/releases", (_req, res) => {
-        res.json({ releases: loadReleases() });
-    });
     // SSE events endpoint
     api.get("/events", (req, res) => {
         res.setHeader("Content-Type", "text/event-stream");

package/dist/auth/session-logic.js

@@ -0,0 +1,79 @@
+/**
+ * Pure session-handling logic extracted from web/src/stores/auth.ts.
+ *
+ * These functions contain the core behavioral decisions made across four
+ * consecutive auth patches (#189→#192→#194→#196) that fixed undocumented
+ * Supabase JS v2 side-effects. They are expressed as framework-agnostic
+ * functions so they can be unit-tested with the Node test runner without
+ * requiring Vue or Pinia.
+ *
+ * The authoritative implementation lives in web/src/stores/auth.ts.
+ * Any change to the auth store's session logic MUST be reflected here and
+ * all tests in session-logic.test.ts must continue to pass.
+ */
+/**
+ * Mirrors the onAuthStateChange handler in web/src/stores/auth.ts.
+ *
+ * Decision: only SIGNED_OUT clears the cached session. All other events that
+ * fire with a null session (TOKEN_REFRESHED failure, lock timeout, internal
+ * reconciliation) are intentionally ignored to prevent cache poisoning.
+ *
+ * See squad decision 2026-05-16 03:17:52 and issue #193.
+ */
+export function handleAuthStateChange(cachedSession, event, newSession) {
+    if (newSession) {
+        // Accept any valid session regardless of event type
+        return newSession;
+    }
+    if (event === "SIGNED_OUT") {
+        // Only explicit sign-out clears the cache
+        return null;
+    }
+    // All other null-session events: leave the existing cache untouched
+    return cachedSession;
+}
+/**
+ * Mirrors getAccessToken() in web/src/stores/auth.ts.
+ *
+ * Decisions:
+ * - Reads from cached session — NEVER calls getSession() (Supabase JS v2
+ *   side-effect: can fire onAuthStateChange(null) during reconciliation).
+ * - Proactively refreshes when within 30 seconds of expiry.
+ * - Falls back to refreshSession() if cache is null and auth is enabled.
+ * - Returns null when auth is disabled.
+ *
+ * See squad decisions 2026-05-16 02:23:38, 2026-05-16 03:16:46 and issues
+ * #191, #193.
+ */
+export async function getAccessToken(cachedSession, authEnabled, refresh, now = Date.now) {
+    if (cachedSession?.access_token) {
+        // Proactively refresh when within 30 seconds of expiry
+        if (cachedSession.expires_at !== undefined &&
+            cachedSession.expires_at * 1000 - now() < 30_000) {
+            try {
+                const fresh = await refresh();
+                if (fresh)
+                    return fresh.access_token;
+            }
+            catch {
+                // fall through to cached token
+            }
+        }
+        return cachedSession.access_token;
+    }
+    // No cached session — attempt recovery if auth is enabled.
+    // Handles the edge case where the cache was spuriously cleared but a
+    // valid refresh token still exists in storage.
+    if (authEnabled) {
+        try {
+            const fresh = await refresh();
+            if (fresh)
+                return fresh.access_token;
+        }
+        catch {
+            // fall through to null
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=session-logic.js.map

package/dist/auth/session-logic.test.js

@@ -0,0 +1,201 @@
+/**
+ * Auth session handling regression tests — Supabase JS v2 integration decisions.
+ *
+ * These tests guard the behavioral decisions made across four consecutive auth
+ * patches (#189→#192→#194→#196) that fixed undocumented Supabase JS v2 side-
+ * effects. They test the logic extracted into src/auth/session-logic.ts, which
+ * mirrors the implementation in web/src/stores/auth.ts.
+ *
+ * If auth store logic changes, update session-logic.ts to match AND verify
+ * these tests still pass.
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { handleAuthStateChange, getAccessToken, } from "./session-logic.js";
+// ── Helpers ───────────────────────────────────────────────────────────────────
+function makeSession(overrides = {}) {
+    return {
+        access_token: "tok-abc",
+        expires_at: Math.floor(Date.now() / 1000) + 3600, // 1 hour from now
+        user: { id: "user-1" },
+        ...overrides,
+    };
+}
+const neverCalled = async () => {
+    throw new Error("refresh should not have been called");
+};
+// Use a fixed epoch (multiple of 1000ms) for deterministic boundary tests.
+// T = 1_000_000_000_000ms (epoch seconds = 1_000_000_000)
+const FIXED_NOW_MS = 1_000_000_000_000;
+const FIXED_NOW_S = FIXED_NOW_MS / 1000; // 1_000_000_000
+// ── onAuthStateChange session caching ────────────────────────────────────────
+describe("handleAuthStateChange — onAuthStateChange caching rules", () => {
+    it("accepts a valid session on SIGNED_IN", () => {
+        const s = makeSession();
+        const result = handleAuthStateChange(null, "SIGNED_IN", s);
+        assert.deepEqual(result, s);
+    });
+    it("accepts a valid session on INITIAL_SESSION", () => {
+        const s = makeSession();
+        const result = handleAuthStateChange(null, "INITIAL_SESSION", s);
+        assert.deepEqual(result, s);
+    });
+    it("accepts a valid session on TOKEN_REFRESHED", () => {
+        const old = makeSession({ access_token: "tok-old" });
+        const fresh = makeSession({ access_token: "tok-new" });
+        const result = handleAuthStateChange(old, "TOKEN_REFRESHED", fresh);
+        assert.equal(result?.access_token, "tok-new");
+    });
+    // Critical regression: SIGNED_OUT is the ONLY event that clears the cache.
+    it("clears session on SIGNED_OUT with null session", () => {
+        const s = makeSession();
+        const result = handleAuthStateChange(s, "SIGNED_OUT", null);
+        assert.equal(result, null);
+    });
+    // Critical regression: internal null-session events must NOT poison the cache.
+    it("does NOT clear session on TOKEN_REFRESHED with null — keeps existing cache", () => {
+        const cached = makeSession({ access_token: "tok-valid" });
+        const result = handleAuthStateChange(cached, "TOKEN_REFRESHED", null);
+        assert.equal(result?.access_token, "tok-valid");
+    });
+    it("does NOT clear session on INITIAL_SESSION with null — keeps existing cache", () => {
+        const cached = makeSession({ access_token: "tok-valid" });
+        const result = handleAuthStateChange(cached, "INITIAL_SESSION", null);
+        assert.equal(result?.access_token, "tok-valid");
+    });
+    it("does NOT clear session on USER_UPDATED with null — keeps existing cache", () => {
+        const cached = makeSession({ access_token: "tok-valid" });
+        const result = handleAuthStateChange(cached, "USER_UPDATED", null);
+        assert.equal(result?.access_token, "tok-valid");
+    });
+    it("returns null when cache is already null and null-session event fires", () => {
+        const result = handleAuthStateChange(null, "TOKEN_REFRESHED", null);
+        assert.equal(result, null);
+    });
+    it("null-session SIGNED_OUT with no prior cache stays null", () => {
+        const result = handleAuthStateChange(null, "SIGNED_OUT", null);
+        assert.equal(result, null);
+    });
+});
+// ── getAccessToken — cached session path ─────────────────────────────────────
+describe("getAccessToken — reads from cached session", () => {
+    it("returns cached access token when session is valid and not near expiry", async () => {
+        const session = makeSession({ access_token: "tok-valid" });
+        const token = await getAccessToken(session, true, neverCalled);
+        assert.equal(token, "tok-valid");
+    });
+    it("returns null when auth is disabled and cache is null", async () => {
+        const token = await getAccessToken(null, false, neverCalled);
+        assert.equal(token, null);
+    });
+});
+// ── getAccessToken — proactive refresh near expiry ───────────────────────────
+describe("getAccessToken — proactive refresh within 30s of expiry", () => {
+    it("calls refresh and returns new token when within 30s of expiry", async () => {
+        // Session expires in 25 seconds (within 30s threshold)
+        const session = makeSession({
+            access_token: "tok-expiring",
+            expires_at: Math.floor(Date.now() / 1000) + 25,
+        });
+        const freshSession = makeSession({ access_token: "tok-fresh" });
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return freshSession; };
+        const token = await getAccessToken(session, true, refresh);
+        assert.equal(refreshCalled, true);
+        assert.equal(token, "tok-fresh");
+    });
+    it("does NOT call refresh when expiry is more than 30s away", async () => {
+        const session = makeSession({
+            access_token: "tok-valid",
+            expires_at: Math.floor(Date.now() / 1000) + 60, // 60s away
+        });
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return null; };
+        const token = await getAccessToken(session, true, refresh);
+        assert.equal(refreshCalled, false);
+        assert.equal(token, "tok-valid");
+    });
+    it("falls back to cached token if refresh throws near expiry", async () => {
+        const session = makeSession({
+            access_token: "tok-expiring",
+            expires_at: Math.floor(Date.now() / 1000) + 10,
+        });
+        const refresh = async () => { throw new Error("network error"); };
+        const token = await getAccessToken(session, true, refresh);
+        assert.equal(token, "tok-expiring");
+    });
+    it("falls back to cached token if refresh returns null near expiry", async () => {
+        const session = makeSession({
+            access_token: "tok-expiring",
+            expires_at: Math.floor(Date.now() / 1000) + 10,
+        });
+        const refresh = async () => null;
+        const token = await getAccessToken(session, true, refresh);
+        assert.equal(token, "tok-expiring");
+    });
+    // Boundary: expires_at * 1000 - now == 30_000 is NOT < 30_000, so no refresh.
+    // Use FIXED_NOW_MS (exact multiple of 1000) to avoid floor-truncation artifacts.
+    it("does NOT refresh when exactly 30s remain (boundary is exclusive)", async () => {
+        const session = makeSession({
+            access_token: "tok-boundary",
+            expires_at: FIXED_NOW_S + 30, // exactly 30_000ms away from FIXED_NOW_MS
+        });
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return null; };
+        const token = await getAccessToken(session, true, refresh, () => FIXED_NOW_MS);
+        assert.equal(refreshCalled, false);
+        assert.equal(token, "tok-boundary");
+    });
+    // Boundary: expires_at * 1000 - now == 29_000 is < 30_000, so refresh fires.
+    it("refreshes when 29s remain (1s inside the 30s window)", async () => {
+        const freshSession = makeSession({ access_token: "tok-refreshed" });
+        const session = makeSession({
+            access_token: "tok-boundary",
+            expires_at: FIXED_NOW_S + 29, // 29_000ms away — within threshold
+        });
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return freshSession; };
+        const token = await getAccessToken(session, true, refresh, () => FIXED_NOW_MS);
+        assert.equal(refreshCalled, true);
+        assert.equal(token, "tok-refreshed");
+    });
+});
+// ── getAccessToken — recovery fallback when cache is null ────────────────────
+describe("getAccessToken — recovery fallback when cache is null", () => {
+    it("attempts refreshSession() when cache is null and auth is enabled", async () => {
+        const freshSession = makeSession({ access_token: "tok-recovered" });
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return freshSession; };
+        const token = await getAccessToken(null, true, refresh);
+        assert.equal(refreshCalled, true);
+        assert.equal(token, "tok-recovered");
+    });
+    it("returns null when auth is enabled but refreshSession() returns null", async () => {
+        const token = await getAccessToken(null, true, async () => null);
+        assert.equal(token, null);
+    });
+    it("returns null when auth is enabled but refreshSession() throws", async () => {
+        const refresh = async () => { throw new Error("refresh failed"); };
+        const token = await getAccessToken(null, true, refresh);
+        assert.equal(token, null);
+    });
+    it("does NOT call refreshSession() when auth is disabled", async () => {
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return null; };
+        const token = await getAccessToken(null, false, refresh);
+        assert.equal(refreshCalled, false);
+        assert.equal(token, null);
+    });
+});
+// ── getAccessToken — session without expires_at ───────────────────────────────
+describe("getAccessToken — session without expires_at", () => {
+    it("returns cached token without attempting refresh if expires_at is undefined", async () => {
+        const session = { access_token: "tok-no-expiry" };
+        let refreshCalled = false;
+        const refresh = async () => { refreshCalled = true; return null; };
+        const token = await getAccessToken(session, true, refresh);
+        assert.equal(refreshCalled, false);
+        assert.equal(token, "tok-no-expiry");
+    });
+});
+//# sourceMappingURL=session-logic.test.js.map

package/dist/copilot/system-message.js

@@ -100,6 +100,14 @@ When an agent finishes a task, the other squad members automatically review the
 - When all QA approvals pass (or no QA agents exist) and the task result contains a GitHub PR URL, the PR is automatically promoted from draft to ready via \`gh pr ready\`.
 - Use \`squad_task_reviews\` to inspect the reviews on any completed task.
 
+#### GitHub Self-Review Limitation
+All squad agents share the repo owner's \`gh\` CLI identity. **GitHub blocks self-review** — \`gh pr review <number> --approve\` silently produces no review record when the same account authored the PR. This affects all squad-authored PRs.
+
+**Workaround — review comments as audit trail:**
+- Veto-capable reviewers must use \`gh pr review <number> --comment --body "LGTM — approved by <agent name>. <review summary>"\` instead of \`--approve\`. This creates a visible PR comment even though it is not a formal GitHub approval.
+- For formal GitHub approval (required by branch protection rules if enabled), Michael must approve the PR himself or a separate bot/collaborator account must be configured.
+- **Merge criteria:** all veto-capable members have posted an approving review comment, AND CI passes (\`gh pr checks <number> --watch\`), AND no merge conflicts. The team lead verifies all comments are present before merging.
+
 ### Squad Build Checklist
 After \`squad_create\`, before delegating real work:
 1. Add domain-specialist agents with \`squad_add_agent\` (use roles tailored to the project's stack).

package/dist/copilot/tools.js

@@ -1,10 +1,10 @@
 import { defineTool } from "@github/copilot-sdk";
 import { z } from "zod";
-import { execSync } from "child_process";
+import { execSync, execFileSync } from "child_process";
 import { readFileSync, writeFileSync, readdirSync, statSync, existsSync, mkdirSync } from "fs";
 import { join, dirname, resolve } from "path";
 import { homedir } from "os";
-import { UNIVERSES } from "./universes.js";
+import { UNIVERSES, getOrCreateUniverse } from "./universes.js";
 import { createFeedEntry } from "../store/feed.js";
 import { validateCron, nextRun } from "./cron.js";
 import { createIoSchedule, deleteIoSchedule, getIoSchedule, listIoSchedules, setIoScheduleEnabled, updateIoScheduleNextRun, } from "../store/io-schedules.js";
@@ -294,15 +294,15 @@ export function createTools(deps) {
             name: z.string().describe("Display name (e.g., 'IO Assistant')"),
             project_path: z.string().describe("Path to the project directory"),
             universe: z
-                .enum(UNIVERSES.map((u) => u.id))
+                .string()
                 .optional()
-                .describe("80s universe theme. Options: a-team, transformers, thundercats, gi-joe, aliens, ghostbusters. Random if omitted."),
+                .describe("Universe theme for agent characters. Built-in: a-team, transformers, thundercats, gi-joe, aliens, ghostbusters, tmnt, star-wars, star-trek, lord-of-the-rings, the-office, parks-and-rec. Or provide any custom name. Random if omitted."),
         }),
         handler: async ({ slug, name, project_path, universe }) => {
             try {
                 deps.createSquad(slug, name, project_path, universe);
                 const squad = deps.getSquad(slug);
-                const universeName = UNIVERSES.find((u) => u.id === squad?.universe)?.name ?? squad?.universe;
+                const universeName = squad?.universe ? getOrCreateUniverse(squad.universe).name : "random";
                 return `Squad "${name}" created for ${project_path}\nUniverse: ${universeName}\n\nNext steps:\n1. Use \`squad_analyze\` to examine the project\n2. Use \`squad_add_agent\` to add specialists based on the analysis`;
             }
             catch (err) {
@@ -1123,11 +1123,11 @@ export function createTools(deps) {
         handler: async ({ pattern, path: searchPath, include }) => {
             console.error(`[io] grep tool called: ${pattern} in ${searchPath || "."}`);
             try {
-                let cmd = `grep -rn "${pattern.replace(/"/g, '\\"')}"`;
+                const args = ["-rn", pattern];
                 if (include)
-                    cmd += ` --include="${include}"`;
-                cmd += ` ${searchPath || "."}`;
-                const result = execSync(cmd, {
+                    args.push(`--include=${include}`);
+                args.push(searchPath || ".");
+                const result = execFileSync("grep", args, {
                     encoding: "utf-8",
                     timeout: 30_000,
                     maxBuffer: 1024 * 1024,
@@ -1245,31 +1245,30 @@ export function createTools(deps) {
         handler: async ({ action, repo, title, body, labels, assignees, number, base, head, state, limit, review_action }) => {
             console.error(`[io] github tool called: ${action} on ${repo}`);
             try {
-                let cmd;
-                const r = `--repo ${repo}`;
+                let args;
                 switch (action) {
                     case "create_issue": {
                         if (!title)
                             return "Error: title is required for create_issue";
-                        cmd = `gh issue create ${r} --title "${title.replace(/"/g, '\\"')}"`;
+                        args = ["issue", "create", "--repo", repo, "--title", title];
                         if (body)
-                            cmd += ` --body "${body.replace(/"/g, '\\"')}"`;
+                            args.push("--body", body);
                         if (labels?.length)
-                            cmd += ` --label "${labels.join(",")}"`;
+                            args.push("--label", labels.join(","));
                         if (assignees?.length)
-                            cmd += ` --assignee "${assignees.join(",")}"`;
+                            args.push("--assignee", assignees.join(","));
                         break;
                     }
                     case "list_issues": {
-                        cmd = `gh issue list ${r} --limit ${limit ?? 10}`;
+                        args = ["issue", "list", "--repo", repo, "--limit", String(limit ?? 10)];
                         if (state)
-                            cmd += ` --state ${state}`;
+                            args.push("--state", state);
                         break;
                     }
                     case "view_issue": {
                         if (!number)
                             return "Error: number is required for view_issue";
-                        cmd = `gh issue view ${number} ${r}`;
+                        args = ["issue", "view", String(number), "--repo", repo];
                         break;
                     }
                     case "comment_issue": {
@@ -1277,37 +1276,37 @@ export function createTools(deps) {
                             return "Error: number is required for comment_issue";
                         if (!body)
                             return "Error: body is required for comment_issue";
-                        cmd = `gh issue comment ${number} ${r} --body "${body.replace(/"/g, '\\"')}"`;
+                        args = ["issue", "comment", String(number), "--repo", repo, "--body", body];
                         break;
                     }
                     case "close_issue": {
                         if (!number)
                             return "Error: number is required for close_issue";
-                        cmd = `gh issue close ${number} ${r}`;
+                        args = ["issue", "close", String(number), "--repo", repo];
                         break;
                     }
                     case "create_pr": {
                         if (!title)
                             return "Error: title is required for create_pr";
-                        cmd = `gh pr create ${r} --title "${title.replace(/"/g, '\\"')}"`;
+                        args = ["pr", "create", "--repo", repo, "--title", title];
                         if (body)
-                            cmd += ` --body "${body.replace(/"/g, '\\"')}"`;
+                            args.push("--body", body);
                         if (base)
-                            cmd += ` --base ${base}`;
+                            args.push("--base", base);
                         if (head)
-                            cmd += ` --head ${head}`;
+                            args.push("--head", head);
                         break;
                     }
                     case "list_prs": {
-                        cmd = `gh pr list ${r} --limit ${limit ?? 10}`;
+                        args = ["pr", "list", "--repo", repo, "--limit", String(limit ?? 10)];
                         if (state)
-                            cmd += ` --state ${state}`;
+                            args.push("--state", state);
                         break;
                     }
                     case "view_pr": {
                         if (!number)
                             return "Error: number is required for view_pr";
-                        cmd = `gh pr view ${number} ${r}`;
+                        args = ["pr", "view", String(number), "--repo", repo];
                         break;
                     }
                     case "comment_pr": {
@@ -1315,7 +1314,7 @@ export function createTools(deps) {
                             return "Error: number is required for comment_pr";
                         if (!body)
                             return "Error: body is required for comment_pr";
-                        cmd = `gh pr comment ${number} ${r} --body "${body.replace(/"/g, '\\"')}"`;
+                        args = ["pr", "comment", String(number), "--repo", repo, "--body", body];
                         break;
                     }
                     case "review_pr": {
@@ -1323,16 +1322,16 @@ export function createTools(deps) {
                             return "Error: number is required for review_pr";
                         if (!review_action)
                             return "Error: review_action is required for review_pr (approve, request-changes, or comment)";
-                        cmd = `gh pr review ${number} ${r} --${review_action}`;
+                        args = ["pr", "review", String(number), "--repo", repo, `--${review_action}`];
                         if (body && (review_action === "request-changes" || review_action === "comment")) {
-                            cmd += ` --body "${body.replace(/"/g, '\\"')}"`;
+                            args.push("--body", body);
                         }
                         break;
                     }
                     default:
                         return `Unknown action: ${action}`;
                 }
-                const result = execSync(cmd, {
+                const result = execFileSync("gh", args, {
                     encoding: "utf-8",
                     timeout: 30_000,
                     maxBuffer: 1024 * 1024,