managed-deepagents 0.5.0-dev.89 → 0.5.0-dev.90

package/dist/connectors/github/sandbox.d.ts

@@ -1,54 +0,0 @@
-/**
- * Provision GitHub connector state inside a managed sandbox.
- *
- * On first create: optionally install `gh`, inject credentials, and clone
- * declared repositories. When a thread starts against a reused sandbox, refresh
- * credentials and apply each checkout's `onReuse` policy (default `fetch`).
- */
-import type { SandboxBackendProtocolV2 } from "deepagents";
-import type { GitHubConnector } from "./index.js";
-import type { IdentityDefinition } from "../../identity/index.js";
-import type { ManagedRunConfig } from "../../runtime/types.js";
-/** Absolute paths used for GitHub provisioning artifacts inside the sandbox. */
-export declare const GITHUB_TOKEN_REMOTE_PATH = "/tmp/mda-gh-token";
-export declare const GITHUB_PROVISION_REMOTE_PATH = "/tmp/mda-github-provision.sh";
-/** Backend surface required for GitHub sandbox provisioning. */
-export type GitHubSandboxBackend = Pick<SandboxBackendProtocolV2, "execute"> & Partial<Pick<SandboxBackendProtocolV2, "uploadFiles">>;
-/** Options for {@link provisionGitHubSandbox}. */
-export interface ProvisionGitHubSandboxOptions {
-    /**
-     * `"create"` installs/clones; `"reuse"` refreshes credentials + onReuse;
-     * `"credentials"` only re-injects the token / gh wrapper (same thread).
-     */
-    mode: "create" | "reuse" | "credentials";
-    /** Per-run LangGraph config (identity + thread scoping). */
-    config?: ManagedRunConfig;
-    /** Root identity declaration, when the project opts into managed identity. */
-    identity?: IdentityDefinition;
-}
-/**
- * Apply GitHub connector provisioning to a sandbox backend.
- *
- * Safe to call repeatedly: create installs/clones once; reuse refreshes
- * credentials and pulls declared refs when a thread starts.
- */
-export declare function provisionGitHubSandbox(backend: GitHubSandboxBackend, connector: GitHubConnector, options: ProvisionGitHubSandboxOptions): Promise<void>;
-/** Build the shell script that installs `gh`, wires credentials, and syncs repos. */
-export declare function buildGitHubProvisionScript(connector: GitHubConnector, options: {
-    mode: "create" | "reuse" | "credentials";
-    hasToken: boolean;
-}): string;
-/** Resolve a GitHub token for sandbox injection (actor → read → env). */
-export declare function resolveSandboxGitHubToken(connector: GitHubConnector, options: Pick<ProvisionGitHubSandboxOptions, "config" | "identity">): Promise<string | undefined>;
-/** Marker file written when a static checkout cannot be cloned. */
-export declare const CLONE_FAILED_MARKDOWN = "CLONE_FAILED.md";
-/**
- * Resolve an authoring-relative checkout path to the absolute sandbox location.
- *
- * Authoring forbids absolute paths; deepagents filesystem tools require them.
- * `workspace/...` maps to `/workspace/...` to match fixture/setup conventions.
- */
-export declare function absoluteCheckoutPath(relativePath: string): string;
-/** True when provision failed for a recoverable git checkout reason. */
-export declare function isBenignCheckoutFailure(output: string): boolean;
-//# sourceMappingURL=sandbox.d.ts.map

package/dist/connectors/github/sandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAmB,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,EAAE,SAAS,CAAC,GAC1E,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzD,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACvE,MAAM,CAuDR;AAED,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,QAAQ,GAAG,UAAU,CAAC,GAClE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqD7B;AAuMD,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAiGvD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMjE;AA0DD,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAI/D"}

package/dist/connectors/github/sandbox.js

@@ -1,532 +0,0 @@
-/**
- * Provision GitHub connector state inside a managed sandbox.
- *
- * On first create: optionally install `gh`, inject credentials, and clone
- * declared repositories. When a thread starts against a reused sandbox, refresh
- * credentials and apply each checkout's `onReuse` policy (default `fetch`).
- */
-import { defaultResolveUserToken } from "../../identity/github/credentials.js";
-import { createCredentialsProvider } from "../../runtime/credentials.js";
-import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "../../runtime/identity-runtime.js";
-import { assertSetupSucceeded } from "../../runtime/setup-script.js";
-import { executeWithStreamRetry } from "../../runtime/sandbox-stream-retry.js";
-/** Absolute paths used for GitHub provisioning artifacts inside the sandbox. */
-export const GITHUB_TOKEN_REMOTE_PATH = "/tmp/mda-gh-token";
-export const GITHUB_PROVISION_REMOTE_PATH = "/tmp/mda-github-provision.sh";
-/**
- * Apply GitHub connector provisioning to a sandbox backend.
- *
- * Safe to call repeatedly: create installs/clones once; reuse refreshes
- * credentials and pulls declared refs when a thread starts.
- */
-export async function provisionGitHubSandbox(backend, connector, options) {
-    const token = connector.injectCredentials
-        ? await resolveSandboxGitHubToken(connector, options)
-        : undefined;
-    if (options.mode === "credentials") {
-        if (!connector.injectCredentials) {
-            return;
-        }
-        // Fail closed when this actor has no token: clear any prior injection so a
-        // different Slack user in the same thread-scoped sandbox cannot reuse it.
-        if (!token) {
-            await uploadAndRun(backend, connector, buildGitHubProvisionScript(connector, {
-                mode: "credentials",
-                hasToken: false,
-            }));
-            return;
-        }
-        const script = buildGitHubProvisionScript(connector, {
-            mode: "credentials",
-            hasToken: true,
-        });
-        await uploadAndRun(backend, connector, script, [
-            [GITHUB_TOKEN_REMOTE_PATH, new TextEncoder().encode(token)],
-        ]);
-        return;
-    }
-    const needsStaticClone = options.mode === "create" &&
-        connector.repositories.some((repo) => Boolean(repo.repo));
-    if (needsStaticClone && !token) {
-        const configurable = resolveRuntimeConfigurable({
-            configurable: options.config?.configurable,
-        });
-        const actorId = buildRuntimeIdentity(configurable)?.user.id;
-        const slackHint = typeof actorId === "string" && actorId.startsWith("slack:")
-            ? " Slack is running as an unlinked Slack actor — Connect Slack in the app UI while signed in, then Connect GitHub on that same account."
-            : " Connect GitHub for this actor in the app UI (same account Slack is linked to), or set GITHUB_TOKEN.";
-        throw new Error("connectors.github(...): cannot clone repositories without GitHub credentials" +
-            ` (actor=${actorId ?? "none"}).${slackHint}`);
-    }
-    const script = buildGitHubProvisionScript(connector, {
-        mode: options.mode,
-        hasToken: Boolean(token),
-    });
-    if (token) {
-        await uploadAndRun(backend, connector, script, [
-            [GITHUB_TOKEN_REMOTE_PATH, new TextEncoder().encode(token)],
-        ]);
-        return;
-    }
-    await uploadAndRun(backend, connector, script);
-}
-/** Build the shell script that installs `gh`, wires credentials, and syncs repos. */
-export function buildGitHubProvisionScript(connector, options) {
-    const lines = [
-        "set -euo pipefail",
-        'export PATH="/usr/local/bin:${HOME:-/root}/.local/bin:${PATH:-/usr/bin:/bin}"',
-    ];
-    if (options.mode === "credentials") {
-        // Same-thread refresh: rewrite token + gh wrapper only. Skip apt/git
-        // install and `gh api user` identity probes so we don't add latency (or
-        // another sandbox round-trip that can 502) on every message.
-        if (connector.injectCredentials) {
-            lines.push(...(options.hasToken
-                ? injectCredentialsScriptLines({ light: true })
-                : clearInjectedCredentialsScriptLines()));
-        }
-        return `${lines.join("\n")}\n`;
-    }
-    if (options.mode === "create" && connector.installCLI) {
-        lines.push(...installCLIScriptLines());
-    }
-    const needsGit = (connector.injectCredentials && options.hasToken) ||
-        connector.repositories.some((repo) => Boolean(repo.repo));
-    if (needsGit) {
-        lines.push(...ensureGitScriptLines());
-    }
-    // Fail closed on every mode: a sandbox reused by a new thread can still hold
-    // the previous actor's token, so an actor without one must clear it before
-    // any checkout sync runs.
-    if (connector.injectCredentials) {
-        lines.push(...(options.hasToken
-            ? injectCredentialsScriptLines()
-            : clearInjectedCredentialsScriptLines()));
-    }
-    for (const repo of connector.repositories) {
-        if (!repo.repo) {
-            // Dynamic event.repository bindings wait for channel ingress.
-            continue;
-        }
-        if (options.mode === "create") {
-            lines.push(...cloneRepositoryScriptLines(repo));
-        }
-        else {
-            lines.push(...reuseRepositoryScriptLines(repo));
-        }
-    }
-    return `${lines.join("\n")}\n`;
-}
-/** Resolve a GitHub token for sandbox injection (actor → read → env). */
-export async function resolveSandboxGitHubToken(connector, options) {
-    const identityConfig = options.identity?.config;
-    // Prefer the live run's auth user (ambient LangGraph configurable) when the
-    // factory-closed config lacks `langgraph_auth_user` — same seam as actor memory.
-    const configurable = resolveRuntimeConfigurable({
-        configurable: options.config?.configurable,
-    });
-    const runtimeIdentity = buildRuntimeIdentity(configurable);
-    const repoHint = firstStaticRepo(connector);
-    if (identityConfig?.scope.credentials === "custom" &&
-        identityConfig.credentials &&
-        runtimeIdentity) {
-        // Connect-with-GitHub vault first — same path tools use for write: ["actor"].
-        // Do this before provider.for so a missing PAT / installation source cannot
-        // mask a vault hit, and vault/store errors surface instead of being swallowed.
-        try {
-            const vaultToken = await defaultResolveUserToken({
-                identity: runtimeIdentity,
-                scopes: ["repo"],
-            });
-            if (vaultToken)
-                return vaultToken;
-        }
-        catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            throw new Error(`connectors.github(...): failed to read Connect-with-GitHub credentials` +
-                ` (actor=${runtimeIdentity.user.id}): ${detail}`);
-        }
-        const provider = createCredentialsProvider(identityConfig, runtimeIdentity);
-        if (provider) {
-            for (const intent of ["write", "read"]) {
-                try {
-                    const credential = await provider.for({
-                        kind: "connection",
-                        name: "github",
-                        intent,
-                        ...(repoHint ? { metadata: { repo: repoHint } } : {}),
-                    });
-                    const token = tokenFromCredential(credential);
-                    if (token)
-                        return token;
-                }
-                catch {
-                    // Actor vault already tried; fall through to the other intent / env.
-                }
-            }
-        }
-    }
-    return stringEnv("GITHUB_TOKEN") ?? stringEnv("GITHUB_PAT");
-}
-function firstStaticRepo(connector) {
-    for (const repo of connector.repositories) {
-        if (repo.repo)
-            return repo.repo;
-    }
-    return undefined;
-}
-function tokenFromCredential(credential) {
-    const auth = credential.headers?.Authorization ?? credential.headers?.authorization;
-    if (typeof auth === "string") {
-        const match = /^Bearer\s+(.+)$/i.exec(auth.trim());
-        if (match?.[1])
-            return match[1].trim();
-    }
-    return undefined;
-}
-function stringEnv(name) {
-    const value = process.env[name];
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed.length > 0 ? trimmed : undefined;
-}
-function installCLIScriptLines() {
-    // Prefer a direct GitHub release binary — faster and more reliable in
-    // sandboxes than apt repo setup. Fall back to apt/brew when curl/tar fail.
-    return [
-        "if ! command -v gh >/dev/null 2>&1; then",
-        "  GH_VERSION=2.74.2",
-        '  ARCH="$(uname -m)"',
-        '  case "$ARCH" in',
-        "    x86_64|amd64) GH_ARCH=amd64 ;;",
-        "    aarch64|arm64) GH_ARCH=arm64 ;;",
-        '    *) GH_ARCH="" ;;',
-        "  esac",
-        '  if [ -n "$GH_ARCH" ] && command -v curl >/dev/null 2>&1 && command -v tar >/dev/null 2>&1; then',
-        '    TMP_GH="$(mktemp -d)"',
-        '    curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${GH_ARCH}.tar.gz" -o "$TMP_GH/gh.tgz"',
-        '    tar -xzf "$TMP_GH/gh.tgz" -C "$TMP_GH"',
-        '    if install -m 0755 "$TMP_GH/gh_${GH_VERSION}_linux_${GH_ARCH}/bin/gh" /usr/local/bin/gh 2>/dev/null; then',
-        "      :",
-        "    else",
-        '      mkdir -p "$HOME/.local/bin"',
-        '      install -m 0755 "$TMP_GH/gh_${GH_VERSION}_linux_${GH_ARCH}/bin/gh" "$HOME/.local/bin/gh"',
-        "    fi",
-        '    export PATH="/usr/local/bin:$HOME/.local/bin:$PATH"',
-        '    rm -rf "$TMP_GH"',
-        "  fi",
-        "fi",
-        "if ! command -v gh >/dev/null 2>&1; then",
-        "  if command -v apt-get >/dev/null 2>&1; then",
-        "    export DEBIAN_FRONTEND=noninteractive",
-        '    SUDO=""',
-        '    if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi',
-        "    $SUDO apt-get update -qq",
-        "    $SUDO apt-get install -y -qq curl ca-certificates gnupg >/dev/null",
-        "    $SUDO install -d -m 0755 /etc/apt/keyrings",
-        "    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /tmp/githubcli-archive-keyring.gpg",
-        "    $SUDO mv /tmp/githubcli-archive-keyring.gpg /etc/apt/keyrings/githubcli-archive-keyring.gpg",
-        "    $SUDO chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg",
-        '    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | $SUDO tee /etc/apt/sources.list.d/github-cli.list >/dev/null',
-        "    $SUDO apt-get update -qq",
-        "    $SUDO apt-get install -y -qq gh >/dev/null",
-        "  elif command -v brew >/dev/null 2>&1; then",
-        "    brew install gh",
-        "  else",
-        '    echo "connectors.github(...): unable to install gh CLI" >&2',
-        "    exit 1",
-        "  fi",
-        "fi",
-        "command -v gh >/dev/null 2>&1",
-    ];
-}
-function ensureGitScriptLines() {
-    return [
-        "if ! command -v git >/dev/null 2>&1; then",
-        "  if command -v apt-get >/dev/null 2>&1; then",
-        "    export DEBIAN_FRONTEND=noninteractive",
-        '    SUDO=""',
-        '    if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi',
-        "    $SUDO apt-get update -qq",
-        "    $SUDO apt-get install -y -qq git ca-certificates >/dev/null",
-        "  elif command -v brew >/dev/null 2>&1; then",
-        "    brew install git",
-        "  else",
-        '    echo "connectors.github(...): git is required to checkout repositories" >&2',
-        "    exit 1",
-        "  fi",
-        "fi",
-    ];
-}
-/**
- * Remove previously injected GitHub credentials from a reused sandbox.
- *
- * Thread-scoped sandboxes are shared across Slack users in the same thread, and
- * agent-scoped sandboxes are shared across every thread and actor; when the
- * current actor has no token we must clear any prior actor's token file / gh
- * auth / git helpers before returning.
- */
-function clearInjectedCredentialsScriptLines() {
-    return [
-        'HOME="${HOME:-/root}"',
-        'rm -f "$HOME/.config/mda/github_token"',
-        'rm -f "$HOME/.config/mda/git-credential-mda.sh"',
-        "unset GH_TOKEN GITHUB_TOKEN || true",
-        "if command -v gh >/dev/null 2>&1; then",
-        "  gh auth logout --hostname github.com >/dev/null 2>&1 || true",
-        "fi",
-        "git config --global --unset-all credential.https://github.com.helper 2>/dev/null || true",
-        // We also set the global helper to our file-based script on inject.
-        "git config --global --unset-all credential.helper 2>/dev/null || true",
-        "export GIT_TERMINAL_PROMPT=0",
-    ];
-}
-function injectCredentialsScriptLines(options) {
-    const lines = [
-        'HOME="${HOME:-/root}"',
-        "test -f /tmp/mda-gh-token",
-        "umask 077",
-        'mkdir -p "$HOME/.config/mda"',
-        'mv /tmp/mda-gh-token "$HOME/.config/mda/github_token"',
-        'chmod 600 "$HOME/.config/mda/github_token"',
-        'export GH_TOKEN="$(cat "$HOME/.config/mda/github_token")"',
-        'export GITHUB_TOKEN="$GH_TOKEN"',
-        // File-based git credential helper (works without GH_TOKEN in execute env).
-        "cat > \"$HOME/.config/mda/git-credential-mda.sh\" <<'EOF'",
-        "#!/bin/sh",
-        'TOKEN_FILE="${HOME}/.config/mda/github_token"',
-        'if [ "$1" = "get" ] && [ -f "$TOKEN_FILE" ]; then',
-        '  echo "protocol=https"',
-        '  echo "host=github.com"',
-        '  echo "username=x-access-token"',
-        '  echo "password=$(cat "$TOKEN_FILE")"',
-        "fi",
-        "EOF",
-        'chmod 700 "$HOME/.config/mda/git-credential-mda.sh"',
-        // Wrap `gh` so every later `execute` injects GH_TOKEN from the token file.
-        // `gh auth login` / profile.d do not survive non-interactive sandbox shells.
-        "if command -v gh >/dev/null 2>&1; then",
-        '  REAL_GH="$(command -v gh)"',
-        '  REAL_DIR="$(CDPATH= cd -- "$(dirname -- "$REAL_GH")" && pwd)"',
-        '  REAL_BASE="$(basename -- "$REAL_GH")"',
-        '  REAL_MOVED="$REAL_DIR/${REAL_BASE}.mda-real"',
-        '  TOKEN_ABS="$HOME/.config/mda/github_token"',
-        '  if [ -x "$REAL_GH" ] && [ -w "$REAL_DIR" ] && ! grep -q MDA_GH_WRAPPER "$REAL_GH" 2>/dev/null; then',
-        '    mv "$REAL_GH" "$REAL_MOVED"',
-        "    {",
-        "      echo '#!/bin/sh'",
-        "      echo '# MDA_GH_WRAPPER'",
-        "      echo \"TOKEN_FILE='$TOKEN_ABS'\"",
-        "      echo 'if [ -f \"$TOKEN_FILE\" ]; then'",
-        '      echo \'  export GH_TOKEN="$(cat "$TOKEN_FILE")"\'',
-        "      echo '  export GITHUB_TOKEN=\"$GH_TOKEN\"'",
-        "      echo 'fi'",
-        '      echo "exec \'$REAL_MOVED\' \\"\\$@\\""',
-        '    } > "$REAL_GH"',
-        '    chmod 755 "$REAL_GH"',
-        "  fi",
-        '  gh auth login --hostname github.com --with-token < "$TOKEN_ABS" >/dev/null 2>&1 || true',
-        "  gh auth setup-git >/dev/null 2>&1 || true",
-        "fi",
-        // `gh auth setup-git` clears github.com helpers — re-force the file helper.
-        "git config --global --unset-all credential.https://github.com.helper 2>/dev/null || true",
-        'git config --global credential.https://github.com.helper "$HOME/.config/mda/git-credential-mda.sh"',
-        'git config --global credential.helper "$HOME/.config/mda/git-credential-mda.sh"',
-        "export GIT_TERMINAL_PROMPT=0",
-    ];
-    if (options?.light) {
-        return lines;
-    }
-    return [
-        ...lines,
-        // Commit as the connected GitHub user when possible (create/reuse only).
-        "if command -v gh >/dev/null 2>&1; then",
-        '  GH_LOGIN="$(gh api user -q .login 2>/dev/null || true)"',
-        '  GH_EMAIL="$(gh api user -q .email 2>/dev/null || true)"',
-        '  if [ -z "$GH_EMAIL" ] || [ "$GH_EMAIL" = "null" ]; then',
-        '    GH_EMAIL="${GH_LOGIN}@users.noreply.github.com"',
-        "  fi",
-        '  if [ -n "$GH_LOGIN" ] && [ "$GH_LOGIN" != "null" ]; then',
-        '    git config --global user.name "$GH_LOGIN"',
-        '    git config --global user.email "$GH_EMAIL"',
-        "  fi",
-        "fi",
-        'if [ -z "$(git config --global --get user.email 2>/dev/null || true)" ]; then',
-        '  git config --global user.name "Managed Deep Agent"',
-        '  git config --global user.email "agent@users.noreply.github.com"',
-        "fi",
-    ];
-}
-/** Marker file written when a static checkout cannot be cloned. */
-export const CLONE_FAILED_MARKDOWN = "CLONE_FAILED.md";
-function cloneRepositoryScriptLines(repo) {
-    const absPath = absoluteCheckoutPath(repo.path);
-    const path = shellSingleQuote(absPath);
-    const noticePath = shellSingleQuote(`${absPath}/${CLONE_FAILED_MARKDOWN}`);
-    const remote = shellSingleQuote(`https://github.com/${repo.repo}.git`);
-    const repoLabel = repo.repo ?? "unknown";
-    const ref = repo.ref && !repo.ref.startsWith("event.") ? repo.ref : undefined;
-    const depth = typeof repo.depth === "number" && repo.depth >= 1 ? String(repo.depth) : "";
-    const lines = [
-        `mkdir -p "$(dirname -- ${path})"`,
-        `if [ ! -d ${path}/.git ]; then`,
-        `  CLONE_ARGS=()`,
-    ];
-    if (ref) {
-        lines.push(`  CLONE_ARGS+=(--branch ${shellSingleQuote(ref)})`);
-    }
-    if (depth) {
-        lines.push(`  CLONE_ARGS+=(--depth ${shellSingleQuote(depth)})`);
-    }
-    if (repo.sparsePaths && repo.sparsePaths.length > 0) {
-        lines.push(`  CLONE_ARGS+=(--filter=blob:none --sparse)`);
-    }
-    // Clone failures must not abort provisioning — leave a notice for the agent.
-    // Use `if ! clone; then …; else …; fi` so the failure branch is valid even
-    // when there is no post-clone work (empty `then` before `else` is a syntax error).
-    lines.push(`  if ! git clone "\${CLONE_ARGS[@]}" ${remote} ${path}; then`);
-    lines.push(`    rm -rf ${path}`, `    mkdir -p ${path}`, `    cat > ${noticePath} <<'MDA_CLONE_FAILED_EOF'`, "# Repository clone failed", "", `MDA could not clone ${repoLabel} into this directory.`, "", "Common causes:", "- the branch/ref does not exist on the remote (omit ref to use the default branch)", "- the repository is private and Connect-with-GitHub / GITHUB_TOKEN cannot access it", "- the repository name is wrong or was renamed", "- network / GitHub availability issues", "", "The agent run continued without this checkout. Fix access (or set", "MDA_GITHUB_CHECKOUT_REPO to a repo you can read), then start a new thread", "so the sandbox is reprovisioned.", "MDA_CLONE_FAILED_EOF", `    echo "connectors.github(...): clone failed for ${repoLabel}; wrote ${CLONE_FAILED_MARKDOWN}" >&2`);
-    if ((repo.sparsePaths && repo.sparsePaths.length > 0) || repo.submodules) {
-        lines.push("  else");
-        if (repo.sparsePaths && repo.sparsePaths.length > 0) {
-            lines.push(`    git -C ${path} sparse-checkout set ${repo.sparsePaths
-                .map((p) => shellSingleQuote(p))
-                .join(" ")}`);
-        }
-        if (repo.submodules) {
-            lines.push(`    git -C ${path} submodule update --init --recursive`);
-        }
-    }
-    lines.push("  fi", "fi");
-    return lines;
-}
-function reuseRepositoryScriptLines(repo) {
-    const onReuse = repo.onReuse ?? "fetch";
-    if (onReuse === "keep") {
-        return [];
-    }
-    const path = shellSingleQuote(absoluteCheckoutPath(repo.path));
-    const ref = repo.ref && !repo.ref.startsWith("event.") ? repo.ref : "HEAD";
-    const quotedRef = shellSingleQuote(ref);
-    const lines = [
-        `if [ -d ${path}/.git ]; then`,
-        // Soft-fail refresh so a stale remote cannot abort the run.
-        `  git -C ${path} fetch --prune origin ${quotedRef} || echo "connectors.github(...): fetch failed for ${path}" >&2`,
-    ];
-    if (onReuse === "reset") {
-        lines.push(`  git -C ${path} checkout -f ${quotedRef} || true`, `  git -C ${path} reset --hard FETCH_HEAD || true`);
-    }
-    else {
-        lines.push(`  git -C ${path} checkout ${quotedRef} || true`, `  git -C ${path} pull --ff-only origin ${quotedRef} || git -C ${path} merge --ff-only FETCH_HEAD || true`);
-    }
-    if (repo.submodules) {
-        lines.push(`  git -C ${path} submodule update --init --recursive || true`);
-    }
-    lines.push("fi");
-    return lines;
-}
-/**
- * Resolve an authoring-relative checkout path to the absolute sandbox location.
- *
- * Authoring forbids absolute paths; deepagents filesystem tools require them.
- * `workspace/...` maps to `/workspace/...` to match fixture/setup conventions.
- */
-export function absoluteCheckoutPath(relativePath) {
-    const stripped = relativePath.replace(/^\.?\//, "");
-    if (stripped === "workspace" || stripped.startsWith("workspace/")) {
-        return `/${stripped}`;
-    }
-    return `/workspace/${stripped}`;
-}
-async function uploadAndRun(backend, connector, script, extraFiles = []) {
-    const files = [
-        ...extraFiles,
-        [GITHUB_PROVISION_REMOTE_PATH, new TextEncoder().encode(script)],
-    ];
-    const sandboxId = "id" in backend && typeof backend.id === "string"
-        ? backend.id
-        : null;
-    let result;
-    if (typeof backend.uploadFiles === "function") {
-        console.info(`[mda] github sandbox provision: uploading ${files.length} file(s) ` +
-            `sandbox_id=${JSON.stringify(sandboxId)} path=${GITHUB_PROVISION_REMOTE_PATH}`);
-        await backend.uploadFiles(files);
-        console.info(`[mda] github sandbox provision: starting execute ` +
-            `sandbox_id=${JSON.stringify(sandboxId)} ` +
-            `cmd=${JSON.stringify(`bash ${GITHUB_PROVISION_REMOTE_PATH}`)}`);
-        // Fresh sandboxes often reject the first websocket execute; retry in place.
-        result = (await executeWithStreamRetry((command) => backend.execute(command), `bash ${GITHUB_PROVISION_REMOTE_PATH}`, { label: "github-provision" }));
-    }
-    else {
-        console.info(`[mda] github sandbox provision: starting inline execute ` +
-            `sandbox_id=${JSON.stringify(sandboxId)}`);
-        result = (await executeWithStreamRetry((command) => backend.execute(command), script, { label: "github-provision (inline)" }));
-    }
-    if (typeof result.exitCode === "number" && result.exitCode !== 0) {
-        // Clone/ref failures must not abort the agent run. Leave notice files and
-        // continue — the in-script soft-fail is the primary path; this is a belt
-        // for shells/`set -e` edge cases and older provision scripts.
-        if (isBenignCheckoutFailure(result.output ?? "")) {
-            await writeCloneFailedNotices(backend, connector, result.output ?? "");
-            return;
-        }
-        assertSetupSucceeded(result);
-    }
-}
-/** True when provision failed for a recoverable git checkout reason. */
-export function isBenignCheckoutFailure(output) {
-    return /Cloning into|git clone|CLONE_FAILED|Remote branch .+ not found|Repository not found|could not read Username|Authentication failed/i.test(output);
-}
-function cloneFailedMarkdown(repo, detail) {
-    const trimmed = detail.trim();
-    return [
-        "# Repository clone failed",
-        "",
-        `MDA could not clone \`${repo}\` into this directory.`,
-        "",
-        "Common causes:",
-        "- the branch/ref does not exist on the remote (omit `ref` to use the default branch)",
-        "- the repository is private and Connect-with-GitHub / `GITHUB_TOKEN` cannot access it",
-        "- the repository name is wrong or was renamed",
-        "",
-        "The agent run continued without this checkout. Fix the connector config",
-        "and start a new thread so the sandbox is reprovisioned.",
-        ...(trimmed
-            ? ["", "## git output", "", "```", trimmed.slice(0, 2000), "```"]
-            : []),
-        "",
-    ].join("\n");
-}
-async function writeCloneFailedNotices(backend, connector, detail) {
-    const notices = [];
-    for (const repo of connector.repositories) {
-        if (!repo.repo)
-            continue;
-        const abs = absoluteCheckoutPath(repo.path);
-        notices.push([
-            `${abs}/${CLONE_FAILED_MARKDOWN}`,
-            new TextEncoder().encode(cloneFailedMarkdown(repo.repo, detail)),
-        ]);
-    }
-    if (notices.length === 0)
-        return;
-    if (typeof backend.uploadFiles === "function") {
-        // Ensure parent dirs exist before upload when the backend requires it.
-        for (const [remotePath] of notices) {
-            const dir = remotePath.slice(0, remotePath.lastIndexOf("/"));
-            await backend.execute(`mkdir -p ${shellSingleQuote(dir)}`);
-        }
-        await backend.uploadFiles(notices);
-        return;
-    }
-    for (const [remotePath, bytes] of notices) {
-        const dir = remotePath.slice(0, remotePath.lastIndexOf("/"));
-        const content = new TextDecoder().decode(bytes);
-        await backend.execute(`mkdir -p ${shellSingleQuote(dir)} && cat > ${shellSingleQuote(remotePath)} <<'MDA_CLONE_FAILED_EOF'\n${content}MDA_CLONE_FAILED_EOF`);
-    }
-}
-function shellSingleQuote(value) {
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-//# sourceMappingURL=sandbox.js.map

package/dist/connectors/github/sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/connectors/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAK/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAC5D,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAmB3E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA6B,EAC7B,SAA0B,EAC1B,OAAsC;IAEtC,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB;QACvC,CAAC,CAAC,MAAM,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,YAAY,CAChB,OAAO,EACP,SAAS,EACT,0BAA0B,CAAC,SAAS,EAAE;gBACpC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;aAChB,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,EAAE;YACnD,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YAC7C,CAAC,wBAAwB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GACpB,OAAO,CAAC,IAAI,KAAK,QAAQ;QACzB,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,0BAA0B,CAAC;YAC9C,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAEjB;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YACzD,CAAC,CAAC,uIAAuI;YACzI,CAAC,CAAC,sGAAsG,CAAC;QAC7G,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,WAAW,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,EAAE;QACnD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YAC7C,CAAC,wBAAwB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CACxC,SAA0B,EAC1B,OAAwE;IAExE,MAAM,KAAK,GAAG;QACZ,mBAAmB;QACnB,+EAA+E;KAChF,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,qEAAqE;QACrE,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC/C,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAC3C,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GACZ,CAAC,SAAS,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC;QACjD,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,0BAA0B;IAC1B,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,OAAO,CAAC,QAAQ;YAClB,CAAC,CAAC,4BAA4B,EAAE;YAChC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,8DAA8D;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA0B,EAC1B,OAAmE;IAEnE,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;IAChD,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,YAAY,GAAG,0BAA0B,CAAC;QAC9C,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAEjB;KACd,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IACE,cAAc,EAAE,KAAK,CAAC,WAAW,KAAK,QAAQ;QAC9C,cAAc,CAAC,WAAW;QAC1B,eAAe,EACf,CAAC;QACD,8EAA8E;QAC9E,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC;gBAC/C,QAAQ,EAAE,eAAe;gBACzB,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,WAAW,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,MAAM,EAAE,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAU,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC;wBACpC,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,QAAQ;wBACd,MAAM;wBACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtD,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;oBAC9C,IAAI,KAAK;wBAAE,OAAO,KAAK,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,SAA0B;IACjD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAA8B;IAE9B,MAAM,IAAI,GACR,UAAU,CAAC,OAAO,EAAE,aAAa,IAAI,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;IACzE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB;IAC5B,sEAAsE;IACtE,2EAA2E;IAC3E,OAAO;QACL,0CAA0C;QAC1C,qBAAqB;QACrB,sBAAsB;QACtB,mBAAmB;QACnB,oCAAoC;QACpC,qCAAqC;QACrC,sBAAsB;QACtB,QAAQ;QACR,mGAAmG;QACnG,2BAA2B;QAC3B,2IAA2I;QAC3I,4CAA4C;QAC5C,+GAA+G;QAC/G,SAAS;QACT,UAAU;QACV,mCAAmC;QACnC,gGAAgG;QAChG,QAAQ;QACR,yDAAyD;QACzD,sBAAsB;QACtB,MAAM;QACN,IAAI;QACJ,0CAA0C;QAC1C,+CAA+C;QAC/C,2CAA2C;QAC3C,aAAa;QACb,sFAAsF;QACtF,8BAA8B;QAC9B,wEAAwE;QACxE,gDAAgD;QAChD,oHAAoH;QACpH,iGAAiG;QACjG,sEAAsE;QACtE,yNAAyN;QACzN,8BAA8B;QAC9B,gDAAgD;QAChD,8CAA8C;QAC9C,qBAAqB;QACrB,QAAQ;QACR,iEAAiE;QACjE,YAAY;QACZ,MAAM;QACN,IAAI;QACJ,+BAA+B;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO;QACL,2CAA2C;QAC3C,+CAA+C;QAC/C,2CAA2C;QAC3C,aAAa;QACb,sFAAsF;QACtF,8BAA8B;QAC9B,iEAAiE;QACjE,8CAA8C;QAC9C,sBAAsB;QACtB,QAAQ;QACR,iFAAiF;QACjF,YAAY;QACZ,MAAM;QACN,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mCAAmC;IAC1C,OAAO;QACL,uBAAuB;QACvB,wCAAwC;QACxC,iDAAiD;QACjD,qCAAqC;QACrC,wCAAwC;QACxC,gEAAgE;QAChE,IAAI;QACJ,0FAA0F;QAC1F,oEAAoE;QACpE,uEAAuE;QACvE,8BAA8B;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAA6B;IACjE,MAAM,KAAK,GAAG;QACZ,uBAAuB;QACvB,2BAA2B;QAC3B,WAAW;QACX,8BAA8B;QAC9B,uDAAuD;QACvD,4CAA4C;QAC5C,2DAA2D;QAC3D,iCAAiC;QACjC,4EAA4E;QAC5E,2DAA2D;QAC3D,WAAW;QACX,+CAA+C;QAC/C,mDAAmD;QACnD,yBAAyB;QACzB,0BAA0B;QAC1B,kCAAkC;QAClC,wCAAwC;QACxC,IAAI;QACJ,KAAK;QACL,qDAAqD;QACrD,2EAA2E;QAC3E,6EAA6E;QAC7E,wCAAwC;QACxC,8BAA8B;QAC9B,iEAAiE;QACjE,yCAAyC;QACzC,gDAAgD;QAChD,8CAA8C;QAC9C,uGAAuG;QACvG,iCAAiC;QACjC,OAAO;QACP,wBAAwB;QACxB,+BAA+B;QAC/B,wCAAwC;QACxC,8CAA8C;QAC9C,yDAAyD;QACzD,kDAAkD;QAClD,iBAAiB;QACjB,8CAA8C;QAC9C,oBAAoB;QACpB,0BAA0B;QAC1B,MAAM;QACN,2FAA2F;QAC3F,6CAA6C;QAC7C,IAAI;QACJ,4EAA4E;QAC5E,0FAA0F;QAC1F,oGAAoG;QACpG,iFAAiF;QACjF,8BAA8B;KAC/B,CAAC;IACF,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO;QACL,GAAG,KAAK;QACR,yEAAyE;QACzE,wCAAwC;QACxC,2DAA2D;QAC3D,2DAA2D;QAC3D,2DAA2D;QAC3D,qDAAqD;QACrD,MAAM;QACN,4DAA4D;QAC5D,+CAA+C;QAC/C,gDAAgD;QAChD,MAAM;QACN,IAAI;QACJ,+EAA+E;QAC/E,sDAAsD;QACtD,mEAAmE;QACnE,IAAI;KACL,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,SAAS,0BAA0B,CAAC,IAA8B;IAChE,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,OAAO,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,gBAAgB,CAAC,sBAAsB,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG;QACZ,0BAA0B,IAAI,IAAI;QAClC,aAAa,IAAI,eAAe;QAChC,iBAAiB;KAClB,CAAC;IACF,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,CAAC,IAAI,CAAC,2BAA2B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC5D,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,mFAAmF;IACnF,KAAK,CAAC,IAAI,CAAC,wCAAwC,MAAM,IAAI,IAAI,QAAQ,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CACR,cAAc,IAAI,EAAE,EACpB,gBAAgB,IAAI,EAAE,EACtB,aAAa,UAAU,2BAA2B,EAClD,2BAA2B,EAC3B,EAAE,EACF,uBAAuB,SAAS,uBAAuB,EACvD,EAAE,EACF,gBAAgB,EAChB,oFAAoF,EACpF,qFAAqF,EACrF,+CAA+C,EAC/C,wCAAwC,EACxC,EAAE,EACF,mEAAmE,EACnE,2EAA2E,EAC3E,kCAAkC,EAClC,sBAAsB,EACtB,sDAAsD,SAAS,WAAW,qBAAqB,OAAO,CACvG,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CACR,cAAc,IAAI,wBAAwB,IAAI,CAAC,WAAW;iBACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;iBAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CACf,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,sCAAsC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,IAA8B;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG;QACZ,WAAW,IAAI,eAAe;QAC9B,4DAA4D;QAC5D,YAAY,IAAI,yBAAyB,SAAS,sDAAsD,IAAI,OAAO;KACpH,CAAC;IACF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,YAAY,IAAI,gBAAgB,SAAS,UAAU,EACnD,YAAY,IAAI,kCAAkC,CACnD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,YAAY,IAAI,aAAa,SAAS,UAAU,EAChD,YAAY,IAAI,0BAA0B,SAAS,cAAc,IAAI,qCAAqC,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,8CAA8C,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,QAAQ,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,cAAc,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAA6B,EAC7B,SAA0B,EAC1B,MAAc,EACd,UAAU,GAAgC,EAAE;IAE5C,MAAM,KAAK,GAAgC;QACzC,GAAG,UAAU;QACb,CAAC,4BAA4B,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KACjE,CAAC;IACF,MAAM,SAAS,GACb,IAAI,IAAI,OAAO,IAAI,OAAQ,OAA4B,CAAC,EAAE,KAAK,QAAQ;QACrE,CAAC,CAAE,OAA0B,CAAC,EAAE;QAChC,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,MAAuB,CAAC;IAC5B,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CACV,6CAA6C,KAAK,CAAC,MAAM,WAAW;YAClE,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,4BAA4B,EAAE,CACjF,CAAC;QACF,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,mDAAmD;YACjD,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;YAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,4BAA4B,EAAE,CAAC,EAAE,CAClE,CAAC;QACF,4EAA4E;QAC5E,MAAM,GAAG,CAAC,MAAM,sBAAsB,CACpC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EACrC,QAAQ,4BAA4B,EAAE,EACtC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAC9B,CAAoB,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,0DAA0D;YACxD,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5C,CAAC;QACF,MAAM,GAAG,CAAC,MAAM,sBAAsB,CACpC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EACrC,MAAM,EACN,EAAE,KAAK,EAAE,2BAA2B,EAAE,CACvC,CAAoB,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjE,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,oIAAoI,CAAC,IAAI,CAC9I,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAc;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,2BAA2B;QAC3B,EAAE;QACF,yBAAyB,IAAI,yBAAyB;QACtD,EAAE;QACF,gBAAgB;QAChB,sFAAsF;QACtF,uFAAuF;QACvF,+CAA+C;QAC/C,EAAE;QACF,yEAAyE;QACzE,yDAAyD;QACzD,GAAG,CAAC,OAAO;YACT,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAA6B,EAC7B,SAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,GAAG,IAAI,qBAAqB,EAAE;YACjC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,uEAAuE;QACvE,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,OAAO,CACnB,YAAY,gBAAgB,CAAC,GAAG,CAAC,aAAa,gBAAgB,CAAC,UAAU,CAAC,8BAA8B,OAAO,sBAAsB,CACtI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC"}

package/dist/connectors/github/source-thread.d.ts

@@ -1,24 +0,0 @@
-/**
- * Stable GitHub source-thread keys for trusted channel ingress.
- *
- * Prefer issue/PR scoped keys when a number is known:
- *   `github:<installationId>:<owner>/<repo>#<number>`
- * Otherwise fall back to delivery-scoped keys:
- *   `github:<installationId>:<owner>/<repo>:delivery:<deliveryId>`
- *   `github:<installationId>:delivery:<deliveryId>`
- */
-export declare function encodeGitHubSourceThreadKey(input: {
-    installationId: string;
-    owner?: string;
-    repo?: string;
-    number?: number;
-    deliveryId?: string;
-}): string;
-export declare function decodeGitHubSourceThreadKey(key: string): {
-    installationId: string;
-    owner?: string;
-    repo?: string;
-    number?: number;
-    deliveryId?: string;
-} | null;
-//# sourceMappingURL=source-thread.d.ts.map

package/dist/connectors/github/source-thread.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"source-thread.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/source-thread.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAiBT;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CA6BP"}