orizu 0.5.37 → 0.5.39

package/dist/app-publish-workspace.js

@@ -0,0 +1,175 @@
+/** ORI-2280 (2280-B2): in a hosted session, an app is published from git. The
+ * CLI writes the app into its folder in the workspace, commits those three files
+ * alone, and pushes the session copy; the web app then merges that commit into
+ * the team copy before it records the version. Written with Effect: git, the
+ * files and the web app are services, and each way this can stop is a tagged
+ * failure. It holds no key (the clone's credential helper asks for one per git
+ * command) and makes no temporary folder, so it has nothing to scope. */
+import { spawn } from 'node:child_process';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Context, Data, Effect, Layer } from 'effect';
+import { isValidCloudflareArtifactsGitRemote } from './cloudflare-artifacts-git-remote.js';
+import { AppPublishFailure } from './app-publish-failure.js';
+import { inspectAppDestination } from './app-publish-paths.js';
+import { resolveAttachedWorkspaceId } from './git-credential.js';
+import { authedFetch, getBaseUrl } from './http.js';
+/** The session copy's branch, which the publish merge reads (ORI-2279). */
+const SESSION_BRANCH_REF = 'refs/heads/main';
+const TEAM_REMOTE_NAME = 'orizu-team';
+const PROJECT_SLUG = /^[a-z0-9][a-z0-9-]{0,99}$/;
+const APP_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Where an app lives in the team repository. */
+function appFolder(projectSlug, appId) {
+    if (!PROJECT_SLUG.test(projectSlug))
+        throw new Error(`Invalid project slug for the app folder: ${projectSlug}`);
+    if (!APP_ID.test(appId))
+        throw new Error(`Invalid app id for the app folder: ${appId}`);
+    return `projects/${projectSlug}/apps/${appId}`;
+}
+// -- Failures --------------------------------------------------------------------
+class PushRejected extends Data.TaggedError('PushRejected') {
+}
+class GitFailed extends Data.TaggedError('GitFailed') {
+}
+class TeamRemoteUnavailable extends Data.TaggedError('TeamRemoteUnavailable') {
+}
+class WorkspaceGit extends Context.Service()('WorkspaceGit') {
+}
+class WorkspaceFiles extends Context.Service()('WorkspaceFiles') {
+}
+class PublishApi extends Context.Service()('PublishApi') {
+}
+function liveLayer(root, attempt) {
+    const serverOrigin = getBaseUrl();
+    const teamRemoteHelper = `!orizu --server '${serverOrigin.replace(/'/g, "'\\''")}' git-credential --purpose=team_read`;
+    const git = WorkspaceGit.of({
+        run: (args) => Effect.callback((resume) => {
+            const child = spawn('git', args, { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', (chunk) => (stdout += chunk));
+            child.stderr.on('data', (chunk) => (stderr += chunk));
+            child.on('error', (error) => resume(Effect.succeed({ code: 127, stdout, stderr: error.message })));
+            child.on('close', (code) => resume(Effect.succeed({ code: code ?? 1, stdout, stderr })));
+        }),
+    });
+    const files = WorkspaceFiles.of({
+        write: (files) => Effect.try({
+            try: () => {
+                for (const file of files)
+                    inspectAppDestination(root, file.path);
+                for (const file of files) {
+                    mkdirSync(join(root, file.path, '..'), { recursive: true });
+                    writeFileSync(join(root, file.path), file.content);
+                }
+                if (attempt)
+                    attempt.filesMaterialized = true;
+            },
+            catch: (error) => new GitFailed({ step: 'write the app files', detail: String(error) }),
+        }),
+    });
+    const api = PublishApi.of({
+        teamRemoteHelper,
+        teamReadRemote: (workspaceId) => Effect.tryPromise({
+            try: async (signal) => {
+                const response = await authedFetch(`/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ purpose: 'team_read', sessionId: process.env.ORIZU_SESSION_ID?.trim() }),
+                    signal,
+                });
+                if (!response.ok)
+                    throw new Error(`the repository key service answered ${response.status}`);
+                const remote = (await response.json()).remote;
+                if (!isValidCloudflareArtifactsGitRemote(remote))
+                    throw new Error('the repository key service named no team copy');
+                return remote;
+            },
+            catch: (error) => new TeamRemoteUnavailable({ reason: error instanceof Error ? error.message : String(error) }),
+        }),
+    });
+    return Layer.mergeAll(Layer.succeed(WorkspaceGit, git), Layer.succeed(WorkspaceFiles, files), Layer.succeed(PublishApi, api));
+}
+const gitOrFail = (step, args) => Effect.flatMap(WorkspaceGit, (git) => git.run(args)).pipe(Effect.filterOrFail((result) => result.code === 0, (result) => new GitFailed({ step, detail: (result.stderr || result.stdout).trim() })));
+// -- Commit and push -------------------------------------------------------------
+/** Writes the app into its folder, commits those three files alone (other work in
+ * the workspace stays as it is), and pushes the session copy. Answers the
+ * commit the web app should publish: the new one, or HEAD if nothing changed. */
+const commitAndPush = (folder, files, appId) => Effect.gen(function* () {
+    const workspaceFiles = yield* WorkspaceFiles;
+    yield* workspaceFiles.write([
+        { path: `${folder}/App.tsx`, content: files.sourceCode },
+        { path: `${folder}/input.schema.json`, content: files.inputSchema },
+        { path: `${folder}/output.schema.json`, content: files.outputSchema },
+    ]);
+    const paths = ['App.tsx', 'input.schema.json', 'output.schema.json'].map(filename => `${folder}/${filename}`);
+    yield* gitOrFail('stage the app files', ['add', '--', ...paths]);
+    const git = yield* WorkspaceGit;
+    // Exit 1: the three app files differ from HEAD.
+    const changed = yield* git.run(['diff', '--cached', '--quiet', 'HEAD', '--', ...paths]);
+    if (changed.code === 1) {
+        yield* gitOrFail('commit the app files', ['commit', '-q', '-m', `Publish app ${appId}`, '--', ...paths]);
+    }
+    else if (changed.code !== 0) {
+        return yield* new GitFailed({ step: 'compare the app folder', detail: changed.stderr.trim() });
+    }
+    const sha = (yield* gitOrFail('read the commit', ['rev-parse', 'HEAD'])).stdout.trim();
+    const pushed = yield* git.run(['push', '-q', 'origin', `HEAD:${SESSION_BRANCH_REF}`]);
+    if (pushed.code !== 0) {
+        if (/\[rejected\]|non-fast-forward|fetch first/.test(pushed.stderr))
+            return yield* new PushRejected();
+        return yield* new GitFailed({ step: 'push the session copy', detail: pushed.stderr.trim() });
+    }
+    return sha;
+});
+/** Commits and pushes the app, answering the commit to publish. Throws the
+ * message the agent should act on. */
+export async function pushAppToSessionCopy(root, input) {
+    const program = commitAndPush(appFolder(input.projectSlug, input.appId), input.files, input.appId).pipe(Effect.catchTags({
+        PushRejected: () => Effect.fail(new Error('Publish stopped: your session copy has commits this workspace does not. Run "git pull --no-rebase --no-edit" in the workspace, then run this command again.')),
+        GitFailed: (failure) => Effect.fail(new Error(`Publish stopped before anything was sent: could not ${failure.step} (${failure.detail}).`)),
+    }));
+    const attempt = { filesMaterialized: false };
+    try {
+        return await Effect.runPromise(Effect.provide(program, liveLayer(root, attempt)));
+    }
+    catch (error) {
+        throw new AppPublishFailure(error instanceof Error ? error.message : String(error), attempt.filesMaterialized);
+    }
+}
+// -- The team copy, after a conflict ---------------------------------------------
+/** Adds the `orizu-team` remote so the agent can pull the team copy and fix a
+ * conflict. It reads with its own team_read key: an empty helper entry first
+ * stops the session copy's helper from answering for it. Refreshes the URL and
+ * helper each time so interrupted recovery or an old remote is repaired. */
+const addTeamRemote = (workspaceId) => Effect.gen(function* () {
+    const git = yield* WorkspaceGit;
+    const hasRemote = (yield* git.run(['remote', 'get-url', TEAM_REMOTE_NAME])).code === 0;
+    if (!workspaceId)
+        return yield* new TeamRemoteUnavailable({ reason: 'this workspace names no Orizu workspace id' });
+    const api = yield* PublishApi;
+    const remote = yield* api.teamReadRemote(workspaceId);
+    const failed = (step) => (failure) => new TeamRemoteUnavailable({ reason: `${step}: ${failure.detail}` });
+    const remoteAction = hasRemote ? 'set-url' : 'add';
+    yield* gitOrFail(remoteAction, ['remote', remoteAction, TEAM_REMOTE_NAME, remote]).pipe(Effect.mapError(failed(`git remote ${remoteAction}`)));
+    const cleared = yield* git.run(['config', '--unset-all', `credential.${remote}.helper`]);
+    // Git exits 5 when there was no matching key, which is normal on first use.
+    if (cleared.code !== 0 && cleared.code !== 5) {
+        return yield* new TeamRemoteUnavailable({ reason: `git config: ${(cleared.stderr || cleared.stdout).trim()}` });
+    }
+    for (const [operation, key, value] of [
+        ['--add', `credential.${remote}.helper`, ''],
+        ['--add', `credential.${remote}.helper`, api.teamRemoteHelper],
+        ['--replace-all', `credential.${remote}.useHttpPath`, 'true'],
+    ]) {
+        yield* gitOrFail('config', ['config', operation, key, value]).pipe(Effect.mapError(failed('git config')));
+    }
+});
+/** Adds the team copy remote; answers a sentence to add to the conflict
+ * message when it could not, else null. */
+export function addTeamCopyRemote(root) {
+    const workspaceId = process.env.ORIZU_WORKSPACE_ID?.trim() || resolveAttachedWorkspaceId(root);
+    const program = addTeamRemote(workspaceId).pipe(Effect.as(null), Effect.catchTag('TeamRemoteUnavailable', (failure) => Effect.succeed(`The ${TEAM_REMOTE_NAME} remote could not be added (${failure.reason}); add it with "git remote add ${TEAM_REMOTE_NAME} <team copy>".`)));
+    return Effect.runPromise(Effect.provide(program, liveLayer(root)));
+}

package/dist/artifacts-git-runtime.d.ts

@@ -28,6 +28,11 @@ export declare function createEphemeralAskPass(root: string): Promise<{
 }>;
 export declare function buildGitAuthEnvironment(auth: GitAuth, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export declare function assertSafeGitInvocation(args: readonly string[], secrets?: readonly string[]): void;
+/** Runs one git command. With auth, the key goes in a 0600 file inside a
+ * fresh 0700 folder, named to that git process only by ORIZU_GIT_KEY_FILE.
+ * Askpass reads it from there. The folder is removed when the command
+ * settles, however it ends: success, failure, timeout or cancel; and if this
+ * process ends first, on its way out (see liveKeyDirs). */
 export declare const defaultGitRunner: GitRunner;
 export declare function gitOk(runGit: GitRunner, args: string[], options: GitRunOptions, operation: string): Promise<string>;
 export declare function revParse(runGit: GitRunner, cwd: string, ref: string): Promise<string>;

package/dist/artifacts-git-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts-git-runtime.d.ts","sourceRoot":"","sources":["../src/artifacts-git-runtime.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACrD;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE7F,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CASvF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBrE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAS3F;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,CAK7F;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAsBzD;AAUD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAkBnB;AAgBD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,IAAI,CAYN;AAWD,eAAO,MAAM,gBAAgB,EAAE,SAoI3B,CAAA;AAEJ,wBAAsB,KAAK,CACzB,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3F"}
+{"version":3,"file":"artifacts-git-runtime.d.ts","sourceRoot":"","sources":["../src/artifacts-git-runtime.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACrD;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE7F,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CASvF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBrE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAS3F;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,CAK7F;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAuBzD;AAUD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAkBnB;AAgBD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,IAAI,CAYN;AAiDD;;;;2DAI2D;AAC3D,eAAO,MAAM,gBAAgB,EAAE,SAc9B,CAAA;AAmHD,wBAAsB,KAAK,CACzB,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3F"}

package/dist/artifacts-git-runtime.js

@@ -1,11 +1,15 @@
 import { spawn } from 'node:child_process';
-import { chmod, mkdir, rm, writeFile } from 'node:fs/promises';
+import { rmSync } from 'node:fs';
+import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 const ARTIFACT_TOKEN_BODY = /^[^\s\u0000-\u001f\u007f]{16,1024}$/;
 const ARTIFACT_TOKEN_ADVISORY_SUFFIX = '?expires=';
 const ARTIFACT_TOKEN_BARE_BODY = /art_v1_[0-9a-fA-F]{40}/;
 const DEFAULT_GIT_TIMEOUT_MS = 30_000;
 const GIT_TERMINATION_GRACE_MS = 1_000;
+/** Names the one-use key file, set on the git process that needs it and nowhere else. */
+const GIT_KEY_FILE_ENV = 'ORIZU_GIT_KEY_FILE';
 const GIT_CONTEXT_ENV_KEYS = [
     'GIT_DIR',
     'GIT_WORK_TREE',
@@ -85,7 +89,8 @@ export async function createEphemeralAskPass(root) {
 case "$1" in
   *sername*) printf '%s\\n' x ;;
   *assword*)
-    IFS= read -r password <&3 || exit 1
+    [ -n "$${GIT_KEY_FILE_ENV}" ] || exit 1
+    IFS= read -r password < "$${GIT_KEY_FILE_ENV}" || exit 1
     [ -n "$password" ] || exit 1
     printf '%s\\n' "$password"
     ;;
@@ -165,7 +170,67 @@ function signalGitProcess(child, signal) {
         // The process may have exited between the state check and the signal.
     }
 }
-export const defaultGitRunner = (args, { cwd, auth, env: suppliedEnv, commitIdentityEnv, timeoutMs = DEFAULT_GIT_TIMEOUT_MS, signal }) => new Promise((resolve, reject) => {
+/** Key folders this process holds right now. An abrupt end of the process
+ * skips the runner's own cleanup, so they are also removed, best effort, on
+ * exit, and on a termination signal that ends the process. A script that
+ * handles the signal itself keeps its keys: its running command may still need
+ * them, and the exit listener covers it later. SIGKILL cannot be caught: a
+ * folder it leaves behind holds a key that still expires on its own. */
+const liveKeyDirs = new Set();
+let isExitCleanupInstalled = false;
+// SIGHUP and SIGQUIT run no exit handlers either; operator scripts run over SSH.
+const TERMINATION_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'];
+function removeLiveKeyDirs() {
+    for (const dir of liveKeyDirs) {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            // Best effort: the process is ending.
+        }
+    }
+    liveKeyDirs.clear();
+}
+function handleTerminationSignal(signal) {
+    // Another listener decides whether the process ends; leave the keys to it.
+    if (process.listenerCount(signal) !== 1)
+        return;
+    removeLiveKeyDirs();
+    // End the way the signal would have without this listener.
+    process.off(signal, handleTerminationSignal);
+    process.kill(process.pid, signal);
+}
+function installExitCleanup() {
+    if (isExitCleanupInstalled)
+        return;
+    isExitCleanupInstalled = true;
+    process.on('exit', removeLiveKeyDirs);
+    for (const signal of TERMINATION_SIGNALS)
+        process.on(signal, handleTerminationSignal);
+}
+/** Runs one git command. With auth, the key goes in a 0600 file inside a
+ * fresh 0700 folder, named to that git process only by ORIZU_GIT_KEY_FILE.
+ * Askpass reads it from there. The folder is removed when the command
+ * settles, however it ends: success, failure, timeout or cancel; and if this
+ * process ends first, on its way out (see liveKeyDirs). */
+export const defaultGitRunner = async (args, options) => {
+    if (!options.auth)
+        return runGitProcess(args, options, null);
+    installExitCleanup();
+    const keyDir = await mkdtemp(join(tmpdir(), 'orizu-git-key-'));
+    liveKeyDirs.add(keyDir);
+    try {
+        await chmod(keyDir, 0o700);
+        const keyFile = join(keyDir, 'key');
+        await writeFile(keyFile, `${options.auth.token}\n`, { mode: 0o600, flag: 'wx' });
+        return await runGitProcess(args, options, keyFile);
+    }
+    finally {
+        await rm(keyDir, { recursive: true, force: true });
+        liveKeyDirs.delete(keyDir);
+    }
+};
+const runGitProcess = (args, { cwd, auth, env: suppliedEnv, commitIdentityEnv, timeoutMs = DEFAULT_GIT_TIMEOUT_MS, signal }, keyFile) => new Promise((resolve, reject) => {
     if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
         reject(new Error('Git timeout must be a positive integer'));
         return;
@@ -182,7 +247,7 @@ export const defaultGitRunner = (args, { cwd, auth, env: suppliedEnv, commitIden
         return;
     }
     const baseEnv = auth
-        ? buildGitAuthEnvironment(auth, suppliedEnv)
+        ? { ...buildGitAuthEnvironment(auth, suppliedEnv), ...(keyFile ? { [GIT_KEY_FILE_ENV]: keyFile } : {}) }
         : buildUnauthenticatedGitEnvironment(suppliedEnv);
     let env = baseEnv;
     if (commitIdentityEnv) {
@@ -194,7 +259,7 @@ export const defaultGitRunner = (args, { cwd, auth, env: suppliedEnv, commitIden
         cwd,
         env,
         detached: process.platform !== 'win32',
-        stdio: auth ? ['ignore', 'pipe', 'pipe', 'pipe'] : ['ignore', 'pipe', 'pipe'],
+        stdio: ['ignore', 'pipe', 'pipe'],
     });
     let stdout = '';
     let stderr = '';
@@ -273,26 +338,6 @@ export const defaultGitRunner = (args, { cwd, auth, env: suppliedEnv, commitIden
     child.on('close', (code) => {
         finish(termination === 'timeout' ? 124 : termination === 'cancelled' ? 130 : (code ?? 1));
     });
-    if (auth) {
-        const credentialPipe = child.stdio[3];
-        if (!credentialPipe) {
-            fail(new Error('Could not establish one-use Git credential pipe'));
-            return;
-        }
-        credentialPipe.on('error', () => {
-            /* EPIPE if Git fails before auth. */
-        });
-        if (termination) {
-            credentialPipe.destroy();
-            return;
-        }
-        try {
-            credentialPipe.end(`${auth.token}\n`);
-        }
-        catch (error) {
-            fail(error instanceof Error ? error : new Error('Could not write the one-use Git credential'));
-        }
-    }
 });
 export async function gitOk(runGit, args, options, operation) {
     const result = await runGit(args, options);

package/dist/artifacts-session-merge.d.ts

@@ -0,0 +1,62 @@
+import { type GitAuth, type GitRunner } from './artifacts-git-runtime.js';
+interface SessionMergeEndpoint {
+    readonly remote: string;
+    /** Read access. Omitted only for local remotes in tests. */
+    readonly auth?: GitAuth;
+}
+interface PreparedSessionMerge {
+    readonly previousCanonicalSha: string;
+    readonly sourceSha: string;
+    readonly mergeSha: string;
+    readonly attempt: number;
+    /** The merge folder: both copies' fetched objects plus the merge commit. */
+    readonly worktree: string;
+}
+type SessionMergePushResult = 'pushed' | 'stale';
+export interface PublishSessionMergeInput {
+    /** A writable folder; each attempt merges in its own temporary subfolder. */
+    readonly root: string;
+    readonly canonical: SessionMergeEndpoint;
+    readonly source: SessionMergeEndpoint;
+    readonly canonicalRef: string;
+    readonly sourceRef: string;
+    /** The session head the publish was approved for. */
+    readonly expectedSourceSha: string;
+    readonly commitMessage: string;
+    readonly commitIdentityEnv: Readonly<Record<string, string>>;
+    /** The final permission check, asked after every merge and before any write. */
+    readonly authorize: (merge: PreparedSessionMerge) => Promise<boolean>;
+    /**
+     * Mints the one-time team-copy write key, runs `push` once with it, then
+     * revokes it. `undefined` is allowed only for local remotes in tests.
+     */
+    readonly withCanonicalWrite: (push: (auth: GitAuth | undefined) => Promise<SessionMergePushResult>) => Promise<SessionMergePushResult>;
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+    readonly runGit?: GitRunner;
+}
+export type PublishSessionMergeResult = {
+    readonly kind: 'merged';
+    readonly previousCanonicalSha: string;
+    readonly sourceSha: string;
+    readonly mergeSha: string;
+    readonly attempts: number;
+} | {
+    /** The session head is already in the team copy: nothing to push. */
+    readonly kind: 'already_merged';
+    readonly canonicalSha: string;
+    readonly sourceSha: string;
+} | {
+    readonly kind: 'conflict';
+    readonly files: readonly string[];
+    readonly canonicalSha: string;
+    readonly sourceSha: string;
+} | {
+    readonly kind: 'denied';
+} | {
+    readonly kind: 'race_lost';
+    readonly attempts: number;
+};
+export declare function publishSessionMerge(input: PublishSessionMergeInput): Promise<PublishSessionMergeResult>;
+export {};
+//# sourceMappingURL=artifacts-session-merge.d.ts.map

package/dist/artifacts-session-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts-session-merge.d.ts","sourceRoot":"","sources":["../src/artifacts-session-merge.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,SAAS,EACf,MAAM,4BAA4B,CAAA;AAiBnC,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,KAAK,sBAAsB,GAAG,QAAQ,GAAG,OAAO,CAAA;AAEhD,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,KAAK,OAAO,CAAC,sBAAsB,CAAC,KACjE,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAC5B;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B,GACD;IACE,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAM7D,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAyBpC"}

package/dist/artifacts-session-merge.js

@@ -0,0 +1,123 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { defaultGitRunner, gitOk, redactSecrets, revParse, } from './artifacts-git-runtime.js';
+/**
+ * The publisher's git step (ORI-2279): merge a session copy into the team
+ * copy, ask for permission, then push with compare-and-swap and read back.
+ *
+ * Runs in a server-owned process with `git` on PATH (the coordinator's merge
+ * job), never in an agent's sandbox. It reads no environment and no
+ * database: the caller's callbacks carry the permission answer and the
+ * one-time team-copy write key.
+ */
+const SESSION_MERGE_MAX_ATTEMPTS = 3;
+const CANONICAL_TRACKING_REF = 'refs/remotes/orizu-canonical/head';
+const SOURCE_TRACKING_REF = 'refs/remotes/orizu-source/head';
+export async function publishSessionMerge(input) {
+    const runGit = input.runGit ?? defaultGitRunner;
+    for (let attempt = 1; attempt <= SESSION_MERGE_MAX_ATTEMPTS; attempt += 1) {
+        const worktree = await mkdtemp(join(input.root, 'session-merge-'));
+        try {
+            const prepared = await prepareMerge(input, runGit, worktree, attempt);
+            if (prepared.kind !== 'merge')
+                return prepared;
+            if (!(await input.authorize(prepared.merge)))
+                return { kind: 'denied' };
+            const pushed = await input.withCanonicalWrite((auth) => pushMerge(input, runGit, worktree, prepared.merge, auth));
+            if (pushed === 'stale')
+                continue;
+            await readBack(input, runGit, worktree, prepared.merge.mergeSha);
+            return {
+                kind: 'merged',
+                previousCanonicalSha: prepared.merge.previousCanonicalSha,
+                sourceSha: prepared.merge.sourceSha,
+                mergeSha: prepared.merge.mergeSha,
+                attempts: attempt,
+            };
+        }
+        finally {
+            await rm(worktree, { recursive: true, force: true });
+        }
+    }
+    return { kind: 'race_lost', attempts: SESSION_MERGE_MAX_ATTEMPTS };
+}
+async function prepareMerge(input, runGit, worktree, attempt) {
+    await gitOk(runGit, ['init', '-q'], { cwd: worktree }, 'initialise merge folder');
+    await fetchInto(input, runGit, worktree, input.canonical, input.canonicalRef, CANONICAL_TRACKING_REF);
+    await fetchInto(input, runGit, worktree, input.source, input.sourceRef, SOURCE_TRACKING_REF);
+    const canonicalSha = await revParse(runGit, worktree, CANONICAL_TRACKING_REF);
+    const sourceSha = await revParse(runGit, worktree, SOURCE_TRACKING_REF);
+    if (sourceSha !== input.expectedSourceSha) {
+        throw new Error('Session copy moved since the publish was approved');
+    }
+    if (await isAncestor(runGit, worktree, sourceSha, canonicalSha)) {
+        return { kind: 'already_merged', canonicalSha, sourceSha };
+    }
+    await gitOk(runGit, ['checkout', '-q', '--detach', canonicalSha], { cwd: worktree }, 'check out the team copy head');
+    const merge = await runGit(['merge', '--no-ff', '--no-edit', '-m', input.commitMessage, sourceSha], {
+        cwd: worktree,
+        commitIdentityEnv: input.commitIdentityEnv,
+    });
+    if (merge.exitCode === 1) {
+        const unmerged = await gitOk(runGit, ['diff', '--name-only', '--diff-filter=U', '-z'], { cwd: worktree }, 'list conflicted files');
+        const files = unmerged.split('\u0000').filter(Boolean);
+        if (files.length > 0)
+            return { kind: 'conflict', files, canonicalSha, sourceSha };
+    }
+    if (merge.exitCode !== 0) {
+        throw new Error(`merge session into team copy failed: ${(merge.stderr || merge.stdout).trim()}`);
+    }
+    const mergeSha = await revParse(runGit, worktree, 'HEAD');
+    const parents = (await gitOk(runGit, ['rev-list', '--parents', '-n', '1', mergeSha], { cwd: worktree }, 'inspect merge parents'))
+        .split(/\s+/)
+        .slice(1);
+    if (parents.length !== 2 || parents[0] !== canonicalSha || parents[1] !== sourceSha) {
+        throw new Error('Merge did not keep the team head and session head as its parents');
+    }
+    return { kind: 'merge', merge: { previousCanonicalSha: canonicalSha, sourceSha, mergeSha, attempt, worktree } };
+}
+async function pushMerge(input, runGit, worktree, merge, auth) {
+    // The lease is the team head this merge was built on, not whatever the
+    // remote holds now: if another publish landed after our fetch, the push is
+    // refused ("stale info") and the caller merges again on the new head.
+    const result = await runGit([
+        'push',
+        '--porcelain',
+        `--force-with-lease=${input.canonicalRef}:${merge.previousCanonicalSha}`,
+        input.canonical.remote,
+        `${merge.mergeSha}:${input.canonicalRef}`,
+    ], { cwd: worktree, auth, timeoutMs: input.timeoutMs, signal: input.signal });
+    if (result.exitCode === 0)
+        return 'pushed';
+    const output = `${result.stdout}\n${result.stderr}`;
+    if (!result.timedOut && !result.cancelled && /\(stale info\)/.test(output))
+        return 'stale';
+    const detail = redactSecrets(output.trim(), auth ? [auth.token] : []);
+    throw new Error(`push merge to team copy failed: ${detail}`);
+}
+/** Proves the push landed: the team head is the merge, or a later commit containing it. */
+async function readBack(input, runGit, worktree, mergeSha) {
+    const listed = await gitOk(runGit, ['ls-remote', '--refs', input.canonical.remote, input.canonicalRef], { cwd: worktree, auth: input.canonical.auth, timeoutMs: input.timeoutMs, signal: input.signal }, 'read back the team copy head');
+    const [head, ref] = listed.split(/\s+/);
+    if (ref !== input.canonicalRef || !/^[0-9a-f]{40}$/.test(head ?? '')) {
+        throw new Error('Team copy read-back returned an unexpected answer');
+    }
+    if (head === mergeSha)
+        return;
+    await fetchInto(input, runGit, worktree, input.canonical, input.canonicalRef, CANONICAL_TRACKING_REF);
+    const fetched = await revParse(runGit, worktree, CANONICAL_TRACKING_REF);
+    if (!(await isAncestor(runGit, worktree, mergeSha, fetched))) {
+        throw new Error('Team copy read-back does not contain the pushed merge');
+    }
+}
+async function fetchInto(input, runGit, worktree, endpoint, ref, trackingRef) {
+    await gitOk(runGit, ['fetch', '-q', '--no-tags', endpoint.remote, `+${ref}:${trackingRef}`], { cwd: worktree, auth: endpoint.auth, timeoutMs: input.timeoutMs, signal: input.signal }, `fetch ${ref}`);
+}
+async function isAncestor(runGit, cwd, ancestor, descendant) {
+    const result = await runGit(['merge-base', '--is-ancestor', ancestor, descendant], { cwd });
+    if (result.exitCode === 0)
+        return true;
+    if (result.exitCode === 1)
+        return false;
+    throw new Error(`check ancestry failed: ${result.stderr.trim()}`);
+}

package/dist/dataset-append-workflow.d.ts

@@ -0,0 +1,12 @@
+export interface DatasetAppendInput {
+    datasetId: string;
+    file: string;
+}
+interface AppendIo {
+    json: boolean;
+    print: (message: string) => void;
+}
+/** Owns standalone append's source, admitted writes, progress and recovery. */
+export declare function appendDatasetWorkflow(resolveInput: () => Promise<DatasetAppendInput>, io: AppendIo): Promise<number>;
+export {};
+//# sourceMappingURL=dataset-append-workflow.d.ts.map

package/dist/dataset-append-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-append-workflow.d.ts","sourceRoot":"","sources":["../src/dataset-append-workflow.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACb;AACD,UAAU,QAAQ;IAChB,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAmJD,+EAA+E;AAC/E,wBAAsB,qBAAqB,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAqC1H"}