npm - mango-cms - Versions diffs - 0.3.33 → 0.3.35 - Mend

mango-cms 0.3.33 → 0.3.35

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (34) hide show

package/cli.js +57 -0
package/default/infra/vibe/README.md +43 -0
package/default/infra/vibe/cloudflare.ini.template +26 -0
package/default/infra/vibe/ecosystem.vibe.config.cjs +44 -0
package/default/infra/vibe/nginx-vibe-orchestrator.conf.template +50 -0
package/default/infra/vibe/nginx-vibe-staging.conf.template +73 -0
package/default/infra/vibe/vibe-gateway.service +38 -0
package/default/infra/vibe/vibe-orchestrator.service +44 -0
package/default/infra/vibe/vibe.env.template +24 -0
package/default/mango/config/settings.json +35 -1
package/default/vite.config.js +46 -0
package/lib/devProxyGateway.js +173 -0
package/lib/staging-gateway.js +23 -1
package/lib/vibe-orchestrator/README.md +76 -0
package/lib/vibe-orchestrator/scripts/fake-claude.mjs +35 -0
package/lib/vibe-orchestrator/scripts/path-guard-hook.mjs +70 -0
package/lib/vibe-orchestrator/scripts/vibe-recover.sh +63 -0
package/lib/vibe-orchestrator/server.js +344 -0
package/lib/vibe-orchestrator/src/attachments.js +98 -0
package/lib/vibe-orchestrator/src/claudeRunner.js +233 -0
package/lib/vibe-orchestrator/src/config.js +227 -0
package/lib/vibe-orchestrator/src/costMirror.js +64 -0
package/lib/vibe-orchestrator/src/costStore.js +209 -0
package/lib/vibe-orchestrator/src/ownerToken.js +113 -0
package/lib/vibe-orchestrator/src/pathGuard.js +114 -0
package/lib/vibe-orchestrator/src/preamble.js +139 -0
package/lib/vibe-orchestrator/src/publisher.js +376 -0
package/lib/vibe-orchestrator/src/recovery.js +199 -0
package/lib/vibe-orchestrator/src/screenshot.js +38 -0
package/lib/vibe-orchestrator/src/sessionManager.js +291 -0
package/lib/vibe-orchestrator/src/streamParser.js +188 -0
package/lib/vibe-orchestrator/src/tokenMeter.js +64 -0
package/package.json +1 -1
package/readme.md +6 -0

package/lib/devProxyGateway.js CHANGED Viewed

@@ -391,6 +391,107 @@ export function createHttpResolver({
     }
 }
+/**
+ * Build a single-shot TCP readiness probe from node's `net` module (HAP-1215).
+ *
+ * Returns `probe(port) -> Promise<boolean>` that resolves `true` iff a TCP
+ * connection to 127.0.0.1:<port> succeeds within `connectTimeoutMs`, else
+ * `false` (never rejects). A per-branch `mango dev` binds its port only once
+ * Vite has finished booting, so "can I open a socket" is the cheapest accurate
+ * signal that the workspace is ready to be proxied to. `net` is injected so the
+ * module stays import-free and unit-testable with a plain fake.
+ */
+export function createTcpReadinessProbe(net, { connectTimeoutMs = 1000 } = {}) {
+    if (!net || typeof net.connect !== 'function') {
+        throw new Error('createTcpReadinessProbe: net module with connect() is required')
+    }
+    return function probe(port) {
+        return new Promise((resolve) => {
+            let done = false
+            const finish = (ready, sock) => {
+                if (done) return
+                done = true
+                try { sock && sock.destroy() } catch { /* noop */ }
+                resolve(ready)
+            }
+            let sock
+            try {
+                sock = net.connect({ host: '127.0.0.1', port })
+            } catch {
+                return resolve(false)
+            }
+            sock.setTimeout(connectTimeoutMs, () => finish(false, sock))
+            sock.once('connect', () => finish(true, sock))
+            sock.once('error', () => finish(false, sock))
+        })
+    }
+}
+/**
+ * Branded "your branch preview is starting" interstitial (HAP-1215).
+ *
+ * Served (HTTP 503 + Retry-After) when a request resolved to a real per-branch
+ * workspace but that workspace's dev server has not bound its port within the
+ * bounded readiness window — a genuinely cold `mango dev` start on the 1vcpu
+ * droplet. This REPLACES the raw "Bad gateway: ECONNREFUSED" 502 the proxy would
+ * otherwise emit, so the owner sees a clear, self-refreshing status instead of an
+ * unbounded white/coffee screen. The page auto-reloads, and each reload re-probes
+ * with the same bounded budget — so the user converges to the live preview the
+ * instant the server is up, or keeps seeing a clear, actionable error if it never
+ * comes up. Never an indefinite hang.
+ */
+export function renderBootingPage({ branch = '', retryAfterSeconds = 5 } = {}) {
+    const safeBranch = String(branch).replace(/[<>&"]/g, (c) => (
+        { '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;' }[c]
+    ))
+    const branchLine = safeBranch
+        ? `<p class="branch">branch <code>${safeBranch}</code></p>`
+        : ''
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="refresh" content="${retryAfterSeconds}">
+<title>Starting your preview…</title>
+<style>
+  :root { color-scheme: light dark; }
+  html, body { height: 100%; margin: 0; }
+  body {
+    display: flex; align-items: center; justify-content: center;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    background: #0f1115; color: #e8eaed;
+  }
+  .card { max-width: 28rem; padding: 2.5rem 2rem; text-align: center; }
+  .spinner {
+    width: 38px; height: 38px; margin: 0 auto 1.5rem;
+    border: 3px solid rgba(255,255,255,0.18); border-top-color: #7aa2f7;
+    border-radius: 50%; animation: spin 0.9s linear infinite;
+  }
+  @keyframes spin { to { transform: rotate(360deg); } }
+  h1 { font-size: 1.25rem; font-weight: 600; margin: 0 0 0.5rem; }
+  p { margin: 0.35rem 0; color: #9aa0ac; font-size: 0.95rem; line-height: 1.5; }
+  .branch code { color: #c0caf5; background: rgba(122,162,247,0.12); padding: 0.1rem 0.4rem; border-radius: 4px; }
+  button {
+    margin-top: 1.5rem; padding: 0.6rem 1.4rem; font-size: 0.95rem; cursor: pointer;
+    color: #0f1115; background: #7aa2f7; border: 0; border-radius: 8px; font-weight: 600;
+  }
+  button:hover { background: #93b4ff; }
+</style>
+</head>
+<body>
+  <main class="card">
+    <div class="spinner" role="status" aria-label="Loading"></div>
+    <h1>Your preview is starting…</h1>
+    <p>The branch server is booting. This usually takes a few seconds on first load.</p>
+    ${branchLine}
+    <p>This page refreshes automatically. If it doesn't load shortly, the branch may have failed to start — retry below.</p>
+    <button type="button" onclick="location.reload()">Retry now</button>
+  </main>
+</body>
+</html>`
+}
 /**
  * Standalone staging-gateway server factory (HAP-1165).
  *
@@ -409,6 +510,9 @@ export function createHttpResolver({
  *   - Non-staging host → 404 with a clear message (no misroute).
  *   - Resolver errors (403/404/502) → surfaced as the resolver's HTTP status.
  *   - Upgrade-time resolver failure → socket destroyed (Vite retries the WS).
+ *   - Cold workspace not yet listening (HAP-1215) → bounded readiness poll, then a
+ *     branded self-refreshing "starting" page (503) instead of a raw ECONNREFUSED
+ *     502. Opt-in via `readinessProbe` (off → proxy immediately, legacy behavior).
  *
  * Page-load auth (HAP-1175, supersedes HAP-1173): a top-level browser navigation
  * MUST never 401, regardless of what cookies it carries. Real browsers attach
@@ -435,6 +539,13 @@ export function createStagingGatewayServer({
     timeoutMs,
     fallbackPort,
     onError,
+    // HAP-1215 cold-boot bounded-readiness (all optional — gating is OFF unless a
+    // probe is supplied, so existing callers/tests are unaffected):
+    readinessProbe,             // (port) => Promise<boolean readyNow>; e.g. createTcpReadinessProbe(net)
+    readinessTimeoutMs = 25000, // total bounded wait for a cold workspace to bind its port
+    readinessIntervalMs = 500,  // delay between probe attempts
+    renderBootPage = renderBootingPage, // injectable for tests
+    setTimeoutFn = setTimeout,  // injectable for deterministic tests
 } = {}) {
     if (!http || typeof http.createServer !== 'function') {
         throw new Error('createStagingGatewayServer: http module with createServer() is required')
@@ -448,6 +559,9 @@ export function createStagingGatewayServer({
     if (fallbackPort != null && (!Number.isInteger(fallbackPort) || fallbackPort <= 0 || fallbackPort > 65535)) {
         throw new Error('createStagingGatewayServer: fallbackPort, if set, must be an integer in 1..65535')
     }
+    if (readinessProbe != null && typeof readinessProbe !== 'function') {
+        throw new Error('createStagingGatewayServer: readinessProbe, if set, must be a function')
+    }
     const resolve = createHttpResolver({ backendPort, resolverPath, timeoutMs, http })
     const proxy = httpProxy.createProxyServer({ ws: true, xfwd: true })
@@ -457,6 +571,54 @@ export function createStagingGatewayServer({
         if (typeof onError === 'function') onError(where, err, req)
     }
+    // HAP-1215: a genuinely cold per-branch `mango dev` can take ~10–60s to bind
+    // its port on the 1vcpu droplet. Without this, the first request after resolve
+    // hits a not-yet-listening port and the proxy emits a raw ECONNREFUSED 502 (an
+    // unbounded "coffee screen" as the browser/owner keep retrying into 502s). This
+    // polls the resolved port for a bounded window; the caller serves the live
+    // proxy the instant it's up, or a clear branded error if the budget elapses.
+    // Returns true if the port became connectable within the window, false on timeout.
+    async function waitForReady(port) {
+        if (typeof readinessProbe !== 'function') return true // gating disabled
+        const maxAttempts = Math.max(1, Math.ceil(readinessTimeoutMs / Math.max(1, readinessIntervalMs)))
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            let ready = false
+            try {
+                ready = await readinessProbe(port)
+            } catch {
+                ready = false
+            }
+            if (ready) return true
+            if (attempt < maxAttempts - 1) {
+                await new Promise((r) => setTimeoutFn(r, readinessIntervalMs))
+            }
+        }
+        return false
+    }
+    function sendBootingPage(req, res, branch) {
+        if (!res || res.headersSent) return
+        const wantsHtml = /\btext\/html\b/.test(String(req?.headers?.accept || ''))
+        const retryAfter = Math.max(1, Math.round(readinessIntervalMs / 1000) || 3)
+        if (wantsHtml) {
+            const html = renderBootPage({ branch, retryAfterSeconds: retryAfter })
+            res.writeHead(503, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Retry-After': String(retryAfter),
+                'Cache-Control': 'no-store',
+            })
+            res.end(html)
+        } else {
+            // Non-navigation (asset/XHR): a short, bounded 503 the client can retry.
+            res.writeHead(503, {
+                'Content-Type': 'text/plain; charset=utf-8',
+                'Retry-After': String(retryAfter),
+                'Cache-Control': 'no-store',
+            })
+            res.end('Vibe staging: branch preview is starting — retry shortly')
+        }
+    }
     proxy.on('error', (err, req, res) => {
         log('proxy', err, req)
         if (res && typeof res.writeHead === 'function' && !res.headersSent) {
@@ -513,6 +675,17 @@ export function createStagingGatewayServer({
             sendError(res, outcome.status || 502, outcome.message || outcome.error)
             return
         }
+        // HAP-1215: the resolve succeeded, but a cold per-branch dev server may not
+        // have bound its port yet. Briefly poll (bounded) before proxying; on
+        // timeout serve a branded self-refreshing "starting" page instead of the
+        // raw ECONNREFUSED 502 the proxy would otherwise emit. Gating is a no-op
+        // (returns true immediately) when no readinessProbe is configured.
+        const ready = await waitForReady(outcome.port)
+        if (!ready) {
+            log('readiness', new Error(`workspace port ${outcome.port} not ready within ${readinessTimeoutMs}ms`), req)
+            sendBootingPage(req, res, hostBranch || parseBranchFromReq(req))
+            return
+        }
         proxy.web(req, res, { target: outcome.target })
     }

package/lib/staging-gateway.js CHANGED Viewed

@@ -25,6 +25,13 @@
  *                                        request whose resolution fails. The
  *                                        shared front (HAP-1175). Set to 0 to
  *                                        disable and 401 those requests instead.
+ *   READINESS_TIMEOUT_MS (default 25000, int)  HAP-1215: after a successful
+ *                                        per-branch resolve, poll the workspace
+ *                                        port for up to this long before proxying,
+ *                                        so a cold `mango dev` boot shows a branded
+ *                                        "starting" page instead of a raw 502.
+ *                                        Set to 0 to disable readiness gating.
+ *   READINESS_INTERVAL_MS (default 500, int)   Delay between readiness probes.
  *
  * Usage (typical droplet pm2):
  *   BACKEND_PORT=7122 LISTEN_PORT=7123 \
@@ -33,8 +40,9 @@
  */
 import http from 'http'
+import net from 'net'
 import httpProxy from 'http-proxy'
-import { createStagingGatewayServer } from './devProxyGateway.js'
+import { createStagingGatewayServer, createTcpReadinessProbe } from './devProxyGateway.js'
 function intEnv(name, fallback) {
     const raw = process.env[name]
@@ -73,6 +81,11 @@ const STAGING_HOST_PREFIX = process.env.STAGING_HOST_PREFIX || undefined
 const RESOLVER_PATH = process.env.RESOLVER_PATH || undefined
 const RESOLVER_TIMEOUT_MS = intEnv('RESOLVER_TIMEOUT_MS', 2000)
 const FALLBACK_PORT = fallbackPortEnv()
+// HAP-1215: READINESS_TIMEOUT_MS=0 (or empty) disables cold-boot readiness gating.
+const READINESS_TIMEOUT_MS = (process.env.READINESS_TIMEOUT_MS === '0' || process.env.READINESS_TIMEOUT_MS === '')
+    ? 0
+    : intEnv('READINESS_TIMEOUT_MS', 25000)
+const READINESS_INTERVAL_MS = intEnv('READINESS_INTERVAL_MS', 500)
 const { server, close } = createStagingGatewayServer({
     http,
@@ -83,6 +96,10 @@ const { server, close } = createStagingGatewayServer({
     resolverPath: RESOLVER_PATH,
     timeoutMs: RESOLVER_TIMEOUT_MS,
     fallbackPort: FALLBACK_PORT,
+    // HAP-1215: only enable readiness gating when the window is > 0.
+    readinessProbe: READINESS_TIMEOUT_MS > 0 ? createTcpReadinessProbe(net) : undefined,
+    readinessTimeoutMs: READINESS_TIMEOUT_MS,
+    readinessIntervalMs: READINESS_INTERVAL_MS,
     onError: (where, err) => {
         console.error(`[staging-gateway] ${where} error: ${err?.message || err}`)
     },
@@ -97,6 +114,11 @@ server.listen(LISTEN_PORT, LISTEN_HOST, () => {
     } else {
         console.log('[staging-gateway]   fallback disabled (no branch signal → 401, failed resolve → resolver status)')
     }
+    if (READINESS_TIMEOUT_MS > 0) {
+        console.log(`[staging-gateway]   cold-boot readiness: poll workspace port ≤${READINESS_TIMEOUT_MS}ms (every ${READINESS_INTERVAL_MS}ms) → branded "starting" page on timeout`)
+    } else {
+        console.log('[staging-gateway]   cold-boot readiness gating disabled (proxy immediately; cold boots may 502)')
+    }
 })
 function shutdown(signal) {

package/lib/vibe-orchestrator/README.md ADDED Viewed

@@ -0,0 +1,76 @@
+# Vibe Orchestrator (bundled with Mango · HAP-1253)
+The **vibe-orchestrator** ships inside the `mango-cms` package so a Mango project
+can run it **straight from the installed dependency — no copied source**. It turns
+a ⌘K chat prompt into live edits on a branch worktree by driving **Claude Code
+headless** (no Anthropic API key), streams normalized progress back to the drawer
+over SSE, and verifies the owner token that Mango mints.
+It is dependency-free (`node:http` only), so it runs in-process from the Mango CLI.
+## Running it
+From a Mango project root (preferred — picks up `siteName` from `mango/config/settings.json`):
+```bash
+mango vibe-orchestrator                 # listens on 127.0.0.1:7130
+mango vibe-orchestrator --port 7130     # explicit port
+```
+Or directly from the installed package (e.g. under a process manager / nginx vhost):
+```bash
+node node_modules/mango-cms/lib/vibe-orchestrator/server.js
+```
+The orchestrator listens on **loopback only**; front it with the staging/site
+nginx vhost (or the Mango staging gateway) for browser access.
+## Environment contract
+| Var | Required | Default | Purpose |
+| --- | --- | --- | --- |
+| `VIBE_ORCH_TOKEN_SECRET` | **yes** | – | HMAC secret **shared with Mango**, which mints per-owner tokens from an authenticated admin session. **Unset ⇒ fails closed**: every gated endpoint returns `503`. |
+| `VIBE_STAGING_ROOT` | recommended | `/root/Staging` | Root dir under which each `<site>` is a clone the orchestrator edits. |
+| `VIBE_ALLOWED_SITES` | recommended | project `siteName` (via `mango vibe-orchestrator`), else `generations-vibe` | Comma-separated allow-list of site slugs. |
+| `CLAUDE_CODE_OAUTH_TOKEN` | one of these | – | Claude OAuth token. If unset, the orchestrator falls back to the Claude CLI's own login at… |
+| `VIBE_CLAUDE_CREDENTIALS` | – | `~/.claude/.credentials.json` | …this auto-refreshing credentials file. One of the two must be present for **live** runs (`/health` reports `canRunLive`). |
+| `VIBE_CLAUDE_BIN` | – | `claude` | Path to the `claude` CLI binary. Point at `scripts/fake-claude.mjs` for a token-free pipeline smoke test. |
+| `VIBE_ORCH_PORT` | – | `7130` | Loopback listen port (`--port` overrides). |
+| `VIBE_MODEL` | – | CLI default | Optional model override (e.g. `claude-opus-4-8`). |
+| `VIBE_TOKEN_CAP` | – | `2000000` | Per-session cumulative token safety cap (`0` = unlimited). |
+| `VIBE_PERMISSION_MODE` | – | `acceptEdits` | Headless permission mode (deliberately **not** `bypassPermissions`). |
+| `VIBE_ALLOWED_ORIGINS` | – | staging/prod site + `localhost:7121` | Browser origins allowed to call cross-origin (CORS). |
+| `VIBE_PUBLISH_*`, `VIBE_PATH_GUARD*`, `VIBE_AUTO_COMMIT`, `VIBE_COST_*`, `VIBE_SESSION_IDLE_MS` | – | see `src/config.js` | Publish, self-protection, cost-mirror and reaper tuning. |
+The owner token is HMAC-verified against `VIBE_ORCH_TOKEN_SECRET` — Mango mints it
+(`POST /endpoints/vibe/token`) and the orchestrator verifies it (`src/ownerToken.js`).
+Client-side role flags are never trusted; the Claude credentials are never exposed
+by any endpoint.
+## Endpoints
+`GET /health` (public liveness, leaks no config) · `GET /health/details` ·
+`GET /sessions` · `POST /prompt` (SSE) · `POST /abort` · `POST /reset` ·
+`GET /publish/diff` · `POST /publish` · `GET /costs` · `GET /costs/rollup` ·
+`GET /recovery/status` · `POST /recovery/revert-last` · `POST /recovery/reset-baseline`.
+Every route except `GET /health` requires `Authorization: Bearer <owner-token>`.
+## Smoke test (no Claude token)
+```bash
+VIBE_ORCH_TOKEN_SECRET=dev-secret \
+VIBE_STAGING_ROOT=/path/to/clones VIBE_ALLOWED_SITES=mysite \
+VIBE_CLAUDE_BIN="$PWD/node_modules/mango-cms/lib/vibe-orchestrator/scripts/fake-claude.mjs" \
+CLAUDE_CODE_OAUTH_TOKEN=dummy \
+mango vibe-orchestrator --port 7130
+# then POST /prompt with a minted bearer token and watch accepted → progress* → end
+```
+## Source of truth
+The runtime here (`server.js`, `src/`, `scripts/`) is the distributed copy. The
+canonical development tree (with the full test suite) lives in the
+`generations-vibe` repo under `orchestrator/`; this bundle is kept byte-identical
+on release. See `docs/RELEASING.md`.

package/lib/vibe-orchestrator/scripts/fake-claude.mjs ADDED Viewed

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+// fake-claude.mjs
+//
+// A stand-in for the real `claude` binary that emits a realistic stream-json
+// sequence. Use it to validate the orchestrator's spawn → parse → SSE pipeline
+// end-to-end WITHOUT a Claude OAuth token (so the live-token dependency does not
+// block integration testing):
+//
+//   VIBE_CLAUDE_BIN="$PWD/scripts/fake-claude.mjs" \
+//   CLAUDE_CODE_OAUTH_TOKEN=dummy node server.js
+//
+// then POST /prompt and watch the SSE events stream back.
+const args = process.argv.slice(2)
+const pIdx = args.indexOf('-p')
+const prompt = pIdx >= 0 ? args[pIdx + 1] : '(no prompt)'
+const resumeIdx = args.indexOf('--resume')
+const sessionId = resumeIdx >= 0 ? args[resumeIdx + 1] : 'fake-sess-0001'
+const lines = [
+  { type: 'system', subtype: 'init', session_id: sessionId, model: 'fake-model', tools: ['Read', 'Edit', 'Bash'], cwd: process.cwd() },
+  { type: 'assistant', message: { content: [{ type: 'text', text: `Working on: ${prompt}` }], usage: { input_tokens: 1200, output_tokens: 40 } } },
+  { type: 'assistant', message: { content: [{ type: 'tool_use', id: 'tu1', name: 'Edit', input: { file_path: 'src/App.vue' } }], usage: { input_tokens: 1300, output_tokens: 90 } } },
+  { type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: 'tu1', is_error: false, content: 'edited' }] } },
+  { type: 'assistant', message: { content: [{ type: 'text', text: 'Done. The hero heading is now blue.' }], usage: { input_tokens: 1400, output_tokens: 130 } } },
+  { type: 'result', subtype: 'success', session_id: sessionId, total_cost_usd: 0.018, duration_ms: 5200, num_turns: 3, usage: { input_tokens: 1400, output_tokens: 130 }, result: 'Done. The hero heading is now blue.' },
+]
+let i = 0
+const tick = () => {
+  if (i >= lines.length) return process.exit(0)
+  process.stdout.write(JSON.stringify(lines[i++]) + '\n')
+  setTimeout(tick, 250)
+}
+tick()

package/lib/vibe-orchestrator/scripts/path-guard-hook.mjs ADDED Viewed

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+// path-guard-hook.mjs
+//
+// PreToolUse hook (HAP-1124, protection #1). Wired into every headless claude
+// run via `--settings` (see claudeRunner.js) so it is enforced SERVER-SIDE,
+// independent of the prompt. Claude invokes this before each Edit/Write/
+// MultiEdit/NotebookEdit with a JSON payload on stdin:
+//
+//   { cwd, tool_name, tool_input: { file_path | notebook_path, ... } }
+//
+// We resolve the target to a repo-root-relative path and, if it hits the
+// protected denylist (or escapes the staging clone), block the tool by exiting
+// with code 2 — the documented PreToolUse "deny" signal: the tool call is
+// stopped and stderr is fed back to Claude as the reason, which it relays to the
+// owner in the drawer. Anything else exits 0 (allow). The hook is fail-safe:
+// any internal error allows the edit rather than wedging the agent, because the
+// post-run git auto-commit + rollback (protection #2) is the backstop.
+import path from 'node:path'
+import { isProtectedPath, PROTECTED_MESSAGE } from '../src/pathGuard.js'
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = ''
+    process.stdin.setEncoding('utf8')
+    process.stdin.on('data', (c) => { raw += c })
+    process.stdin.on('end', () => resolve(raw))
+    process.stdin.on('error', () => resolve(raw))
+  })
+}
+/** Collect every filesystem path a tool_input may target. */
+function targetPaths(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return []
+  const out = []
+  for (const key of ['file_path', 'notebook_path', 'path']) {
+    if (typeof toolInput[key] === 'string' && toolInput[key]) out.push(toolInput[key])
+  }
+  return out
+}
+/** Map an absolute-or-relative tool path to a clone-root-relative POSIX path. */
+function toRel(cwd, p) {
+  const abs = path.isAbsolute(p) ? p : path.resolve(cwd || process.cwd(), p)
+  return path.relative(cwd || process.cwd(), abs)
+}
+async function main() {
+  let payload = {}
+  try { payload = JSON.parse((await readStdin()) || '{}') } catch { payload = {} }
+  const cwd = payload.cwd || process.cwd()
+  const toolInput = payload.tool_input || payload.toolInput || {}
+  for (const raw of targetPaths(toolInput)) {
+    const rel = toRel(cwd, raw)
+    // An edit that resolves outside the staging clone is never legitimate.
+    const escapes = rel.startsWith('..') || path.isAbsolute(rel)
+    if (escapes || isProtectedPath(rel)) {
+      process.stderr.write(
+        `${PROTECTED_MESSAGE} (${escapes ? 'outside the staging clone' : rel})`,
+      )
+      process.exit(2) // PreToolUse: block the tool, reason → Claude
+    }
+  }
+  process.exit(0) // allow
+}
+main().catch(() => process.exit(0)) // fail-open: rollback is the backstop

package/lib/vibe-orchestrator/scripts/vibe-recover.sh ADDED Viewed

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# vibe-recover.sh — one-command rollback for the Vibe staging clone (HAP-1124).
+#
+# A recovery path usable WITHOUT an engineer. Operates directly on the staging
+# clone's git, so it works even if the orchestrator process is down.
+#
+#   vibe-recover.sh status            # show baseline + recent vibe edits
+#   vibe-recover.sh revert-last       # undo the most recent vibe edit (git revert)
+#   vibe-recover.sh reset-baseline    # hard-reset to the known-good baseline
+#
+# Env (override as needed):
+#   VIBE_STAGING_ROOT  (default /root/Staging)
+#   VIBE_SITE          (default generations-vibe)
+#   VIBE_BASELINE_TAG  (default vibe-baseline)
+set -euo pipefail
+ROOT="${VIBE_STAGING_ROOT:-/root/Staging}"
+SITE="${VIBE_SITE:-generations-vibe}"
+TAG="${VIBE_BASELINE_TAG:-vibe-baseline}"
+SETTINGS="mango/config/settings.json"
+DIR="$ROOT/$SITE"
+CMD="${1:-status}"
+cd "$DIR" || { echo "staging clone not found: $DIR" >&2; exit 1; }
+case "$CMD" in
+  status)
+    echo "site:     $SITE ($DIR)"
+    echo "HEAD:     $(git rev-parse --short HEAD 2>/dev/null || echo '(none)')"
+    if git rev-parse --verify --quiet "${TAG}^{commit}" >/dev/null; then
+      echo "baseline: $TAG -> $(git rev-parse --short "$TAG")"
+    else
+      echo "baseline: (none yet — created on first vibe edit)"
+    fi
+    echo "recent vibe edits:"
+    git log -n 10 --pretty=format:'  %h  %cs  %s' | grep -E '  vibe:' || echo "  (none)"
+    echo
+    ;;
+  revert-last)
+    last_msg="$(git log -1 --pretty=format:'%s')"
+    case "$last_msg" in
+      vibe:*) ;;
+      *) echo "the most recent commit is not a vibe edit — nothing to revert" >&2; exit 1 ;;
+    esac
+    git revert --no-edit HEAD
+    echo "reverted last vibe edit; HEAD is now $(git rev-parse --short HEAD)"
+    ;;
+  reset-baseline)
+    if ! git rev-parse --verify --quiet "${TAG}^{commit}" >/dev/null; then
+      echo "no baseline tag ($TAG) to reset to" >&2; exit 1
+    fi
+    git reset --hard "$TAG"
+    git clean -fd -e "$SETTINGS"
+    echo "reset clone to baseline $TAG ($(git rev-parse --short "$TAG"))"
+    ;;
+  *)
+    echo "usage: vibe-recover.sh {status|revert-last|reset-baseline}" >&2
+    exit 2
+    ;;
+esac