opencode-swarm 7.161.1 → 7.162.1

package/dist/cli/pr-review-reentry-authorization-ttctn8xv.js

@@ -1,301 +0,0 @@
-// @bun
-import {
-  prWorkflowSessionFileStem,
-  readPrReviewReentryBindingContext
-} from "./index-cs9w1hfs.js";
-import"./index-s33ee2w3.js";
-import"./index-29f9te70.js";
-import"./index-bn78ywnb.js";
-import"./index-7d79mj06.js";
-import"./index-dq41vsf9.js";
-import"./index-txdagbh7.js";
-import"./index-134d35c1.js";
-import"./index-3146wmgv.js";
-import"./index-yhadrxka.js";
-import"./index-zhdfqz89.js";
-import"./index-88wb0z9r.js";
-import"./index-70ha9e09.js";
-import"./index-c8s9a3zh.js";
-import"./index-9ss2m4rs.js";
-import"./index-y14mwbk8.js";
-import"./index-zsrtt42s.js";
-import"./index-qd9mrd7e.js";
-import"./index-3f7hqtgg.js";
-import"./index-awjx0wgk.js";
-import"./index-nm0cpfrv.js";
-import"./index-f5axf6vq.js";
-import"./index-rtry5xyf.js";
-import"./index-32avgbyq.js";
-import"./index-c1geyan9.js";
-import {
-  PrReviewRunIdSchema
-} from "./index-za42r41w.js";
-import"./index-ddszzne4.js";
-import"./index-4p6x3xxy.js";
-import"./index-hq57ytm5.js";
-import"./index-7619tk9a.js";
-import"./index-556ja8an.js";
-import"./index-4fwbbad3.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-cbcfpgz9.js";
-import"./index-hvfsz7e3.js";
-import"./index-jm21vbyp.js";
-import"./index-zg9d392c.js";
-import"./index-n832052r.js";
-import {
-  validateSwarmPath
-} from "./index-dtn0pne5.js";
-import"./index-z6xqpmqg.js";
-import"./index-r3mvsbtq.js";
-import"./index-epjvntnm.js";
-import"./index-rracnf2y.js";
-import"./index-9e6fdz2h.js";
-import"./index-4rhhvd1a.js";
-import"./index-k55td019.js";
-import"./index-9xd073d4.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-c6zyqgpq.js";
-import"./index-d8st72j7.js";
-import"./index-bk5tah7q.js";
-import"./index-nqbqkx4c.js";
-import"./index-dh5q6z7y.js";
-import"./index-ed5ykebp.js";
-import"./index-fx3em0dr.js";
-import {
-  require_proper_lockfile
-} from "./index-7g4c7s5r.js";
-import {
-  exports_external,
-  init_zod
-} from "./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
-import {
-  __toESM
-} from "./index-a76rekgs.js";
-
-// src/hooks/pr-review-reentry-authorization.ts
-init_zod();
-var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { randomUUID } from "crypto";
-import * as fsp from "fs/promises";
-import * as path from "path";
-var AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
-var MAX_ACTIVE_AUTHORIZATIONS = 8;
-var MAX_PERSISTED_AUTHORIZATIONS = 32;
-var REENTRY_AUTHORIZATIONS_MAX_BYTES = 64 * 1024;
-var PrReviewReentryAuthorizationRecordSchema = exports_external.object({
-  schemaVersion: exports_external.literal(1),
-  authorizationId: exports_external.string().min(1).max(64),
-  sessionId: exports_external.string().min(1).max(256),
-  workflowInstanceId: exports_external.string().min(1).max(128).optional(),
-  runId: PrReviewRunIdSchema.optional(),
-  prHeadSha: exports_external.string().regex(/^[0-9a-f]{6,64}$/i),
-  revisionDigest: exports_external.string().min(1).max(256),
-  role: exports_external.enum(["reviewer", "test_engineer"]),
-  generation: exports_external.number().int().nonnegative(),
-  createdAt: exports_external.string().datetime(),
-  expiresAt: exports_external.string().datetime(),
-  consumedAt: exports_external.string().datetime().optional(),
-  consumedCallId: exports_external.string().min(1).max(128).optional()
-}).strict();
-var AuthorizationFileSchema = exports_external.object({
-  schemaVersion: exports_external.literal(1),
-  sessionId: exports_external.string().min(1).max(256),
-  authorizations: exports_external.array(PrReviewReentryAuthorizationRecordSchema).max(MAX_PERSISTED_AUTHORIZATIONS)
-}).strict();
-function reentryAuthorizationFilePath(directory, sessionID) {
-  const relative = path.join("pr-review", "reentry-authorizations", `${prWorkflowSessionFileStem(sessionID)}.json`);
-  return validateSwarmPath(directory, relative);
-}
-async function readAuthorizationFile(filePath) {
-  let raw;
-  try {
-    const stat2 = await fsp.stat(filePath);
-    if (!stat2.isFile() || stat2.size > REENTRY_AUTHORIZATIONS_MAX_BYTES) {
-      throw new Error("reentry authorization store is not a bounded regular file");
-    }
-    raw = await fsp.readFile(filePath, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw error;
-  }
-  const decoded = JSON.parse(raw);
-  const parsed = AuthorizationFileSchema.safeParse(decoded);
-  if (!parsed.success) {
-    throw new Error(`reentry authorization store is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
-  }
-  return parsed.data;
-}
-var RENAME_RETRY_DELAYS_MS = [10, 25, 50, 100, 200];
-var RETRYABLE_RENAME_CODES = new Set(["EPERM", "EBUSY", "EACCES", "EEXIST"]);
-async function renameWithRetryAsync(tempPath, targetPath) {
-  let lastError;
-  for (let attempt = 0;attempt <= _internals.renameRetryDelaysMs.length; attempt++) {
-    try {
-      await _internals.renameImpl(tempPath, targetPath);
-      return;
-    } catch (err) {
-      lastError = err;
-      const code = err?.code;
-      if (!code || !RETRYABLE_RENAME_CODES.has(code))
-        throw err;
-      if (attempt < _internals.renameRetryDelaysMs.length) {
-        await new Promise((resolve) => setTimeout(resolve, _internals.renameRetryDelaysMs[attempt]));
-      }
-    }
-  }
-  throw lastError;
-}
-async function writeAuthorizationFile(filePath, file) {
-  const serialized = `${JSON.stringify(file, null, 2)}
-`;
-  if (Buffer.byteLength(serialized, "utf8") > REENTRY_AUTHORIZATIONS_MAX_BYTES) {
-    throw new Error("reentry authorization store exceeds its write bound");
-  }
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  const tempPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${randomUUID()}.tmp`);
-  try {
-    await fsp.writeFile(tempPath, serialized, { encoding: "utf8", flag: "wx" });
-    await renameWithRetryAsync(tempPath, filePath);
-  } finally {
-    await fsp.rm(tempPath, { force: true }).catch(() => {
-      return;
-    });
-  }
-}
-function pruneAuthorizations(records, nowMs) {
-  const kept = [];
-  for (const record of [...records].sort((left, right) => right.createdAt.localeCompare(left.createdAt)).slice(0, MAX_PERSISTED_AUTHORIZATIONS)) {
-    if (record.consumedAt)
-      continue;
-    if (Date.parse(record.expiresAt) <= nowMs)
-      continue;
-    kept.push(record);
-  }
-  return kept;
-}
-var lf = import_proper_lockfile.default;
-async function withAuthorizationLock(filePath, write) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  const release = await lf.lock(path.dirname(filePath), {
-    lockfilePath: `${filePath}.lock`,
-    retries: { retries: 8, minTimeout: 10, maxTimeout: 100 },
-    stale: 1e4,
-    update: 1000,
-    realpath: false
-  });
-  try {
-    return await write();
-  } finally {
-    await release().catch(() => {
-      return;
-    });
-  }
-}
-async function issuePrReviewReentryAuthorization(directory, sessionID, request) {
-  const trimmedSession = sessionID.trim();
-  if (!trimmedSession) {
-    throw new Error("BLOCKED: re-entry authorization requires an active sessionID");
-  }
-  const binding = await readPrReviewReentryBindingContext(directory, trimmedSession);
-  if (!binding || binding.prHeadSha !== request.prHeadSha.toLowerCase()) {
-    throw new Error(`BLOCKED: re-entry authorization requires an active PR_REVIEW workflow bound to the declared head (active: ${binding?.prHeadSha ?? "(none)"})`);
-  }
-  if (request.runId && binding.runId && request.runId !== binding.runId) {
-    throw new Error("BLOCKED: re-entry authorization run does not match the active PR-review run");
-  }
-  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
-  return withAuthorizationLock(filePath, async () => {
-    const existing = await readAuthorizationFile(filePath);
-    const nowMs = Date.now();
-    const now = new Date(nowMs).toISOString();
-    const records = pruneAuthorizations(existing?.authorizations ?? [], nowMs);
-    const active = records.filter((record2) => !record2.consumedAt && record2.role === request.role && record2.generation === binding.generation);
-    if (active.length > 0) {
-      throw new Error(`BLOCKED: an unconsumed re-entry authorization for role "${request.role}" at generation ${binding.generation} already exists; use it (one immediate Task dispatch) before issuing another`);
-    }
-    if (records.length >= MAX_ACTIVE_AUTHORIZATIONS) {
-      throw new Error(`BLOCKED: re-entry authorization store is at its bound of ${MAX_ACTIVE_AUTHORIZATIONS} active authorizations`);
-    }
-    const record = {
-      schemaVersion: 1,
-      authorizationId: randomUUID(),
-      sessionId: trimmedSession,
-      ...binding.workflowInstanceId ? { workflowInstanceId: binding.workflowInstanceId } : {},
-      ...binding.runId ? { runId: binding.runId } : {},
-      prHeadSha: binding.prHeadSha,
-      revisionDigest: binding.revisionDigest,
-      role: request.role,
-      generation: binding.generation,
-      createdAt: now,
-      expiresAt: new Date(nowMs + AUTHORIZATION_TTL_MS).toISOString()
-    };
-    await writeAuthorizationFile(filePath, {
-      schemaVersion: 1,
-      sessionId: trimmedSession,
-      authorizations: [record, ...records]
-    });
-    return record;
-  });
-}
-async function consumePrReviewReentryAuthorization(directory, sessionID, request) {
-  const trimmedSession = sessionID.trim();
-  if (!trimmedSession)
-    return null;
-  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
-  try {
-    return await withAuthorizationLock(filePath, async () => {
-      const existing = await readAuthorizationFile(filePath);
-      if (!existing)
-        return null;
-      const nowMs = Date.now();
-      const records = pruneAuthorizations(existing.authorizations, nowMs);
-      const index = records.findIndex((record) => !record.consumedAt && record.role === request.role && record.sessionId === trimmedSession && Date.parse(record.expiresAt) > nowMs);
-      if (index < 0) {
-        if (records.length !== existing.authorizations.length) {
-          await writeAuthorizationFile(filePath, {
-            ...existing,
-            authorizations: records
-          });
-        }
-        return null;
-      }
-      const binding = await readPrReviewReentryBindingContext(directory, trimmedSession);
-      const candidate = records[index];
-      if (!binding || binding.prHeadSha !== candidate.prHeadSha || binding.revisionDigest !== candidate.revisionDigest || binding.generation !== candidate.generation || candidate.workflowInstanceId !== undefined && binding.workflowInstanceId !== candidate.workflowInstanceId || candidate.workflowInstanceId === undefined && binding.workflowInstanceId !== undefined) {
-        return null;
-      }
-      const consumed = {
-        ...candidate,
-        consumedAt: new Date(nowMs).toISOString(),
-        consumedCallId: request.callID
-      };
-      records[index] = consumed;
-      await writeAuthorizationFile(filePath, {
-        ...existing,
-        authorizations: records
-      });
-      return consumed;
-    });
-  } catch {
-    return null;
-  }
-}
-var _internals = {
-  AUTHORIZATION_TTL_MS,
-  MAX_ACTIVE_AUTHORIZATIONS,
-  reentryAuthorizationFilePath,
-  pruneAuthorizations,
-  renameImpl: (from, to) => fsp.rename(from, to),
-  renameRetryDelaysMs: RENAME_RETRY_DELAYS_MS,
-  renameWithRetryAsync,
-  writeAuthorizationFile
-};
-export {
-  issuePrReviewReentryAuthorization,
-  consumePrReviewReentryAuthorization,
-  _internals
-};