opencode-ship 0.9.0 → 0.10.0-rc.17

package/dist/core.js

@@ -1,4 +1,4 @@
-// opencode-ship/core v0.9.0
+// opencode-ship/core v0.10.0-rc.17
 
 // src/adapter.js
 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";
@@ -325,87 +325,169 @@ function mustRerunVerifier(previousSha, currentSha) {
 }
 
 // src/state/manifest-store.js
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, readdir, unlink } from "node:fs/promises";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+import { readFile as readFile3, readdir as readdir2, unlink as unlink2 } from "node:fs/promises";
+import { join as join4, resolve as resolve4 } from "node:path";
+
+// src/state/git-common-dir.js
 import { spawn } from "node:child_process";
-async function runGitCommonDir(repoRoot) {
-  return new Promise((res, rej) => {
+import { resolve as resolve2, join as join2 } from "node:path";
+async function resolveGitCommonDir(repoRoot) {
+  if (typeof repoRoot !== "string" || repoRoot.length === 0) {
+    throw new Error("resolveGitCommonDir: repoRoot must be a non-empty string");
+  }
+  return new Promise((resolveP, reject) => {
     const proc = spawn(
       "git",
-      ["rev-parse", "--path-format=absolute", "--git-common-dir"],
-      { cwd: repoRoot, stdio: ["ignore", "pipe", "pipe"], shell: false }
+      ["-C", repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"],
+      { stdio: ["ignore", "pipe", "pipe"], shell: false }
     );
     let out = "";
-    proc.stdout.on("data", (d) => out += d.toString());
-    proc.on("error", rej);
+    let err = "";
+    proc.stdout.on("data", (d) => {
+      out += d.toString("utf8");
+    });
+    proc.stderr.on("data", (d) => {
+      err += d.toString("utf8");
+    });
+    proc.on("error", reject);
     proc.on("close", (code) => {
       if (code !== 0) {
-        rej(new Error(`git rev-parse --git-common-dir failed with ${code}`));
+        reject(new Error(
+          `git rev-parse --git-common-dir failed (exit ${code}): ${err.trim() || "unknown error"}`
+        ));
         return;
       }
       const trimmed = out.trim();
       if (!trimmed) {
-        rej(new Error("git rev-parse returned an empty path"));
+        reject(new Error("git rev-parse --git-common-dir returned an empty path"));
         return;
       }
-      res(resolve2(repoRoot, trimmed));
+      resolveP(resolve2(repoRoot, trimmed));
     });
   });
 }
-function manifestPath(commonDir, taskId) {
-  return join2(commonDir, "opencode-delivery", "manifests", `${taskId}.json`);
+
+// src/state/durable-store.js
+import {
+  open as fsOpen,
+  writeFile as writeFile2,
+  readFile as readFile2,
+  rename as rename2,
+  link,
+  mkdir as mkdir2,
+  readdir,
+  unlink,
+  stat
+} from "node:fs/promises";
+import { dirname as dirname2, join as join3, resolve as resolve3 } from "node:path";
+import { createHash as createHash2, randomBytes } from "node:crypto";
+var STALE_LOCK_MS = 120 * 1e3;
+function randomToken() {
+  return randomBytes(8).toString("hex");
+}
+function ensureString(value) {
+  return JSON.stringify(value, null, 2) + "\n";
+}
+async function fsyncDir(path) {
+  try {
+    const handle = await fsOpen(path, "r");
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  } catch {
+  }
 }
-async function writeManifest(repoRoot, manifest) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const path = manifestPath(commonDir, manifest.taskId);
-  await mkdir2(dirname2(path), { recursive: true });
-  const tmp = `${path}.tmp`;
-  await writeFile2(tmp, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-  await rename2(tmp, path);
-  return resolve2(path);
+async function atomicReplaceJson(path, value) {
+  if (typeof path !== "string" || path.length === 0) {
+    throw new Error("atomicReplaceJson: path must be a non-empty string");
+  }
+  const target = resolve3(path);
+  const parent = dirname2(target);
+  await mkdir2(parent, { recursive: true });
+  const tmp = `${target}.${randomToken()}.tmp`;
+  const handle = await fsOpen(tmp, "w", 384);
+  try {
+    await handle.writeFile(ensureString(value), "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename2(tmp, target);
+  await fsyncDir(parent);
 }
-async function readManifest(repoRoot, taskId) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const path = manifestPath(commonDir, taskId);
+
+// src/state/manifest-store.js
+var SHIP_DIRNAME = "opencode-ship";
+var LEGACY_DIRNAME = "opencode-delivery";
+function canonicalManifestPath(commonDir, taskId) {
+  return join4(commonDir, SHIP_DIRNAME, "delivery", "manifests", `${taskId}.json`);
+}
+function legacyManifestPath(commonDir, taskId) {
+  return join4(commonDir, LEGACY_DIRNAME, "manifests", `${taskId}.json`);
+}
+async function commonDirFromRepoRoot(repoRoot) {
+  return resolveGitCommonDir(repoRoot);
+}
+async function readJsonOrNull(path) {
   try {
-    const raw = await readFile2(path, "utf8");
+    const raw = await readFile3(path, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
+async function writeManifest(repoRoot, manifest) {
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const path = canonicalManifestPath(commonDir, manifest.taskId);
+  await atomicReplaceJson(path, manifest);
+  return resolve4(path);
+}
+async function readManifest(repoRoot, taskId) {
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const canonical = await readJsonOrNull(canonicalManifestPath(commonDir, taskId));
+  if (canonical !== null) return canonical;
+  const legacy = await readJsonOrNull(legacyManifestPath(commonDir, taskId));
+  if (legacy !== null) return legacy;
+  return null;
+}
 async function listManifests(repoRoot) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const dir = join2(commonDir, "opencode-delivery", "manifests");
-  let names;
-  try {
-    names = await readdir(dir);
-  } catch {
-    return [];
-  }
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const canonicalDir = join4(commonDir, SHIP_DIRNAME, "delivery", "manifests");
+  const legacyDir = join4(commonDir, LEGACY_DIRNAME, "manifests");
   const out = [];
-  for (const name of names) {
-    if (!name.endsWith(".json")) continue;
+  const seen = /* @__PURE__ */ new Set();
+  for (const dir of [canonicalDir, legacyDir]) {
+    let names;
     try {
-      const raw = await readFile2(join2(dir, name), "utf8");
-      out.push(JSON.parse(raw));
+      names = await readdir2(dir);
     } catch {
+      continue;
+    }
+    for (const name of names) {
+      if (!name.endsWith(".json")) continue;
+      if (seen.has(name)) continue;
+      const parsed = await readJsonOrNull(join4(dir, name));
+      if (parsed !== null) {
+        seen.add(name);
+        out.push(parsed);
+      }
     }
   }
   return out;
 }
 async function deleteManifest(repoRoot, taskId) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const path = manifestPath(commonDir, taskId);
-  try {
-    await unlink(path);
-  } catch {
-  }
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const canonical = canonicalManifestPath(commonDir, taskId);
+  const legacy = legacyManifestPath(commonDir, taskId);
+  await unlink2(canonical).catch(() => null);
+  await unlink2(legacy).catch(() => null);
 }
 
 // src/drivers/git.js
 import { spawnSync } from "node:child_process";
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
 var WorktreeRecord = {
   path: "",
@@ -460,8 +542,8 @@ function isWorktreeClean(cwd) {
 function isRebaseInProgress(cwd) {
   const merge = runGit(["rev-parse", "--git-path", "rebase-merge"], cwd);
   const apply = runGit(["rev-parse", "--git-path", "rebase-apply"], cwd);
-  const mergeExists = merge.status === 0 && safeExists(resolve3(cwd, merge.stdout.trim()));
-  const applyExists = apply.status === 0 && safeExists(resolve3(cwd, apply.stdout.trim()));
+  const mergeExists = merge.status === 0 && safeExists(resolve5(cwd, merge.stdout.trim()));
+  const applyExists = apply.status === 0 && safeExists(resolve5(cwd, apply.stdout.trim()));
   return mergeExists || applyExists;
 }
 function safeExists(p) {
@@ -551,9 +633,62 @@ function parseRepoSlug(slug) {
   return { owner: slug.slice(0, slash), name: slug.slice(slash + 1) };
 }
 
+// src/drivers/github-command-policy.js
+var ALLOWED_VERBS = /* @__PURE__ */ new Set([
+  "issue list",
+  "issue view",
+  "issue create",
+  "issue comment",
+  "issue edit",
+  "issue close",
+  "pr list",
+  "pr view",
+  "pr create",
+  "pr edit",
+  "pr checks",
+  "pr ready",
+  "pr merge"
+]);
+var FORBIDDEN_FLAGS = /* @__PURE__ */ new Set([
+  "--web",
+  "--body-file",
+  "--template"
+]);
+function validateGhArgv(argv) {
+  if (!Array.isArray(argv) || argv.length < 2) {
+    return { ok: false, reason: "argv must be a non-empty array starting with the binary" };
+  }
+  const [bin, ...rest] = argv;
+  if (bin !== "gh") {
+    return { ok: false, reason: `expected 'gh' binary, got ${JSON.stringify(bin)}` };
+  }
+  if (rest.length === 0) {
+    return { ok: false, reason: "no gh subcommand" };
+  }
+  const verb = rest.slice(0, 2).join(" ");
+  if (verb.includes("api")) {
+    return { ok: false, reason: "gh api is not allowed (use typed Ship tools instead)" };
+  }
+  if (!ALLOWED_VERBS.has(verb)) {
+    return { ok: false, reason: `gh subcommand not in the allowlist: ${verb}` };
+  }
+  for (const arg of rest.slice(2)) {
+    if (FORBIDDEN_FLAGS.has(arg)) {
+      return { ok: false, reason: `gh flag ${arg} is forbidden (use Ship's typed body argument instead)` };
+    }
+    if (typeof arg !== "string" || arg.length === 0) {
+      return { ok: false, reason: "gh argv must contain only non-empty strings" };
+    }
+  }
+  return { ok: true, verb: (
+    /** @type {any} */
+    verb
+  ) };
+}
+
 // src/drivers/gh-cli.js
 function defaultRunner(cwd, env) {
-  return (args) => new Promise((resolve7, reject) => {
+  return (args) => new Promise((resolve9, reject) => {
     const proc = spawn2("gh", args, {
       cwd,
       env,
@@ -565,7 +700,7 @@ function defaultRunner(cwd, env) {
     proc.stdout.on("data", (d) => stdout += d.toString());
     proc.stderr.on("data", (d) => stderr += d.toString());
     proc.on("error", reject);
-    proc.on("close", (status) => resolve7({ status: status ?? -1, stdout, stderr }));
+    proc.on("close", (status) => resolve9({ status: status ?? -1, stdout, stderr }));
   });
 }
 function viewFields() {
@@ -801,6 +936,20 @@ Closes #${issueNumber}`;
         "headRefOid"
       ]);
       return fields.headRefOid;
+    },
+    async runCommand(argv) {
+      if (!Array.isArray(argv) || argv.length === 0) {
+        throw new Error("runCommand: argv must be a non-empty array");
+      }
+      if (typeof argv[0] !== "string" || argv[0].length === 0) {
+        throw new Error("runCommand: argv[0] must be a non-empty string");
+      }
+      const policy = validateGhArgv(argv);
+      if (!policy.ok) {
+        throw new Error(`runCommand: rejected by policy: ${policy.reason}`);
+      }
+      const r = await run(argv);
+      return r;
     }
   };
 }
@@ -864,7 +1013,7 @@ function recoverManifestAfterCrash(manifest) {
 
 // src/doctor.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 function runVersion(argv) {
   const r = spawnSync2(argv[0], argv.slice(1), { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   if (r.status !== 0) return null;
@@ -912,7 +1061,7 @@ async function doctor(repoRoot, packageVersion) {
     contractVersion: 1,
     adapterPath: adapter.ok ? adapter.path : null,
     adapterSha256: adapter.ok ? adapter.sha256 : null,
-    lockPath: lock ? resolve4(repoRoot, ".opencode", "delivery.lock.json") : null,
+    lockPath: lock ? resolve6(repoRoot, ".opencode", "delivery.lock.json") : null,
     lockSha256: lock ? lock.adapterSha256 : null,
     packageVersion,
     nodeVersion: process.version,
@@ -1098,7 +1247,7 @@ function createIssueTool(deps) {
 }
 
 // src/tools/delivery-worktree.js
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function runBootstrap(args, cwd) {
   return new Promise((resolveP, rejectP) => {
@@ -1121,8 +1270,8 @@ function runBootstrap(args, cwd) {
   });
 }
 function isPathContained(repoRoot, worktreeRoot, candidatePath) {
-  const rootAbs = resolve5(repoRoot, worktreeRoot);
-  const normalized = resolve5(candidatePath);
+  const rootAbs = resolve7(repoRoot, worktreeRoot);
+  const normalized = resolve7(candidatePath);
   if (normalized !== rootAbs && !normalized.startsWith(rootAbs + "/")) {
     return false;
   }
@@ -1158,12 +1307,12 @@ function createWorktreeTool(deps) {
       return { kind: "missing-input", field: "worktreeRelativePath" };
     }
     const worktreeRoot = deps.adapter?.worktree?.root ?? ".worktrees";
-    const worktreePath = resolve5(deps.repoRoot, input.worktreeRelativePath);
+    const worktreePath = resolve7(deps.repoRoot, input.worktreeRelativePath);
     if (!isPathContained(deps.repoRoot, worktreeRoot, worktreePath)) {
       return {
         kind: "path-escape",
         resolvedPath: worktreePath,
-        expectedRoot: resolve5(deps.repoRoot, worktreeRoot)
+        expectedRoot: resolve7(deps.repoRoot, worktreeRoot)
       };
     }
     const remote = deps.remote ?? "origin";
@@ -1334,7 +1483,7 @@ function createVerifyTool(deps) {
       ],
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const manifestPath2 = await writeManifest(deps.repoRoot, next);
+    const manifestPath = await writeManifest(deps.repoRoot, next);
     return {
       contractVersion: 1,
       commandId: cmd.id,
@@ -1342,7 +1491,7 @@ function createVerifyTool(deps) {
       stdoutTail,
       stderrTail,
       headSha: head,
-      manifestPath: manifestPath2
+      manifestPath
     };
   };
 }
@@ -1625,7 +1774,7 @@ function createMergeTool(deps) {
 }
 
 // src/tools/delivery-cleanup.js
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function safeRemoveWorktree(repoRoot, path) {
   const r = spawnSync3("git", ["worktree", "remove", path], {
@@ -1686,8 +1835,8 @@ function createCleanupTool(deps) {
       return { kind: "manifest-state", state: m.state };
     }
     if (!m.worktreePath) return { kind: "missing-worktree-path" };
-    const wtPath = resolve6(m.worktreePath);
-    const mainCwd = resolve6(deps.repoRoot);
+    const wtPath = resolve8(m.worktreePath);
+    const mainCwd = resolve8(deps.repoRoot);
     if (wtPath === mainCwd) return { kind: "current-checkout", worktreePath: wtPath };
     if (!isWorktreeClean(wtPath)) return { kind: "dirty-worktree" };
     if (isRebaseInProgress(wtPath)) return { kind: "rebase-in-progress" };