patchwork-os 0.2.0-beta.1 → 0.2.0-beta.10.canary.100

package/dist/commands/auditEnv.js

@@ -0,0 +1,202 @@
+/**
+ * auditEnv — statically scan a recipe YAML for {{env.FOO}} references
+ * and verify those vars exist in process.env (or an optional .env file).
+ *
+ * Fills a gap that `recipe preflight` does NOT cover: preflight checks
+ * lint/tools/write-steps but silently produces empty string at runtime
+ * for missing {{env.FOO}} references. auditEnv catches that statically.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { resolveFilePath } from "../tools/utils.js";
+// ── Pattern ──────────────────────────────────────────────────────────────────
+/** Matches {{env.FOO}} and {{env.foo}} references in template strings. */
+const ENV_REF_RE = /\{\{env\.([A-Za-z_][A-Za-z0-9_]*)\}\}/g;
+/**
+ * Walk every string value in an arbitrary JSON/YAML-parsed object and collect
+ * all unique env var names referenced via {{env.NAME}}.
+ */
+function collectEnvRefs(value, seen = new Set()) {
+    if (typeof value === "string") {
+        for (const m of value.matchAll(ENV_REF_RE)) {
+            // m[1] is always defined — the regex has exactly one capture group
+            seen.add(m[1]);
+        }
+    }
+    else if (Array.isArray(value)) {
+        for (const item of value) {
+            collectEnvRefs(item, seen);
+        }
+    }
+    else if (value !== null && typeof value === "object") {
+        for (const v of Object.values(value)) {
+            collectEnvRefs(v, seen);
+        }
+    }
+    return seen;
+}
+// ── .env file parser ──────────────────────────────────────────────────────────
+/**
+ * Parse a simple KEY=VALUE .env file.  Lines starting with # and blank lines
+ * are ignored.  Values may be optionally quoted with ' or ".  Does NOT expand
+ * variable references — only static values are relevant for presence checks.
+ */
+function parseDotEnv(content) {
+    const map = new Map();
+    for (const rawLine of content.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const eqIdx = line.indexOf("=");
+        if (eqIdx === -1)
+            continue;
+        const key = line.slice(0, eqIdx).trim();
+        if (!key)
+            continue;
+        let val = line.slice(eqIdx + 1).trim();
+        // Strip surrounding quotes if present
+        if ((val.startsWith('"') && val.endsWith('"')) ||
+            (val.startsWith("'") && val.endsWith("'"))) {
+            val = val.slice(1, -1);
+        }
+        map.set(key, val);
+    }
+    return map;
+}
+// ── Placeholder heuristic ─────────────────────────────────────────────────────
+/** Values that look like placeholders rather than real secrets. */
+const PLACEHOLDER_RE = /^(changeme|replace[-_]?me|todo|fixme|<[^>]+>|\[.*\]|your[-_]?.*here|placeholder|example|xxx+|dummy|fake|test)$/i;
+function looksLikePlaceholder(val) {
+    return PLACEHOLDER_RE.test(val.trim());
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Scan `recipeRef` (file path or installed recipe name) for {{env.FOO}}
+ * references and report which env vars are present / missing.
+ *
+ * `recipeRef` is resolved exactly like `recipe lint` — absolute/relative file
+ * paths are used directly; bare names are looked up under the default recipes
+ * dir.  We intentionally do NOT re-import the heavy `resolveRecipePath` helper
+ * from recipe.ts (would pull in the entire 2 400-line module).  Instead we do
+ * a minimal two-step: try direct path first, then give a clear error.
+ */
+export async function runAuditEnv(recipeRef, options = {}) {
+    // ── 1. Resolve recipe path ─────────────────────────────────────────────────
+    const directPath = resolve(recipeRef);
+    let recipePath;
+    if (existsSync(directPath) && statSync(directPath).isFile()) {
+        recipePath = directPath;
+    }
+    else {
+        return {
+            ok: false,
+            recipe: recipeRef,
+            missing: [],
+            present: [],
+            warnings: [`Recipe file not found: ${recipeRef}`],
+        };
+    }
+    // ── 2. Load + parse YAML ───────────────────────────────────────────────────
+    let raw;
+    try {
+        const text = readFileSync(recipePath, "utf-8");
+        raw = parseYaml(text);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            ok: false,
+            recipe: recipeRef,
+            missing: [],
+            present: [],
+            warnings: [`Failed to parse recipe YAML: ${msg}`],
+        };
+    }
+    // Prefer recipe.name for display; fall back to path.
+    const recipeName = raw !== null &&
+        typeof raw === "object" &&
+        typeof raw.name === "string"
+        ? raw.name
+        : recipeRef;
+    // ── 3. Collect {{env.FOO}} references ─────────────────────────────────────
+    const refs = collectEnvRefs(raw);
+    if (refs.size === 0) {
+        return {
+            ok: true,
+            recipe: recipeName,
+            missing: [],
+            present: [],
+            warnings: [],
+        };
+    }
+    // ── 4. Build env lookup map ────────────────────────────────────────────────
+    // Start with process.env as baseline.
+    let envMap = new Map(Object.entries(process.env));
+    if (options.envFile) {
+        // Security: envFile must stay within workspace.
+        if (!options.workspace) {
+            return {
+                ok: false,
+                recipe: recipeName,
+                missing: [],
+                present: [],
+                warnings: [
+                    "envFile provided but workspace is required for path validation",
+                ],
+            };
+        }
+        try {
+            resolveFilePath(options.envFile, options.workspace);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+                ok: false,
+                recipe: recipeName,
+                missing: [],
+                present: [],
+                warnings: [`envFile path rejected: ${msg}`],
+            };
+        }
+        const envFilePath = resolve(options.workspace, options.envFile);
+        if (!existsSync(envFilePath)) {
+            return {
+                ok: false,
+                recipe: recipeName,
+                missing: [],
+                present: [],
+                warnings: [`envFile not found: ${options.envFile}`],
+            };
+        }
+        const dotEnvContent = readFileSync(envFilePath, "utf-8");
+        const dotEnvMap = parseDotEnv(dotEnvContent);
+        // envFile entries supplement (and override) process.env entries.
+        envMap = new Map([...envMap, ...dotEnvMap]);
+    }
+    // ── 5. Split refs into present / missing ──────────────────────────────────
+    const missing = [];
+    const present = [];
+    const warnings = [];
+    for (const name of Array.from(refs).sort()) {
+        const val = envMap.get(name);
+        if (val === undefined || val === null) {
+            missing.push(name);
+        }
+        else {
+            present.push(name);
+            // Warn if the value looks like an unfilled placeholder.
+            if (looksLikePlaceholder(val)) {
+                warnings.push(`${name} is set but value looks like a placeholder ("${val}")`);
+            }
+        }
+    }
+    return {
+        ok: missing.length === 0,
+        recipe: recipeName,
+        missing,
+        present,
+        warnings,
+    };
+}
+//# sourceMappingURL=auditEnv.js.map

package/dist/commands/auditEnv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditEnv.js","sourceRoot":"","sources":["../../src/commands/auditEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAqBpD,gFAAgF;AAEhF,0EAA0E;AAC1E,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAE5D;;;GAGG;AACH,SAAS,cAAc,CACrB,KAAc,EACd,OAAoB,IAAI,GAAG,EAAE;IAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,mEAAmE;YACnE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YAChE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,sCAAsC;QACtC,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC1C,CAAC;YACD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AAEjF,mEAAmE;AACnE,MAAM,cAAc,GAClB,iHAAiH,CAAC;AAEpH,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,UAA2B,EAAE;IAE7B,8EAA8E;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,UAAkB,CAAC;IAEvB,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5D,UAAU,GAAG,UAAU,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,CAAC,0BAA0B,SAAS,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,CAAC,gCAAgC,GAAG,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,MAAM,UAAU,GACd,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAQ,GAA+B,CAAC,IAAI,KAAK,QAAQ;QACvD,CAAC,CAAG,GAA+B,CAAC,IAAe;QACnD,CAAC,CAAC,SAAS,CAAC;IAEhB,6EAA6E;IAC7E,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,sCAAsC;IACtC,IAAI,MAAM,GAAoC,IAAI,GAAG,CACnD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAC5B,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,gDAAgD;QAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE;oBACR,gEAAgE;iBACjE;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,CAAC,0BAA0B,GAAG,EAAE,CAAC;aAC5C,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,CAAC,sBAAsB,OAAO,CAAC,OAAO,EAAE,CAAC;aACpD,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;QAC7C,iEAAiE;QACjE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,wDAAwD;YACxD,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,gDAAgD,GAAG,IAAI,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,EAAE,UAAU;QAClB,OAAO;QACP,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/commands/connect.d.ts

@@ -0,0 +1,47 @@
+/**
+ * `patchwork connect` — the connector front-door.
+ *
+ * A thin CLI→HTTP shim over the bridge's already-built `/connections/*`
+ * routes (see src/connectorRoutes.ts). 23 connector error messages already
+ * tell users to "Run: patchwork connect <vendor>"; this is that command.
+ *
+ * NO new bridge or connector logic lives here — every verb maps to one
+ * existing HTTP route:
+ *   - list       → GET    /connections                (Bearer)
+ *   - <vendor>   → GET    /connections/<id>/auth       (OAuth, 302 Location)
+ *              or  POST   /connections/<id>/connect    (PAT, {token})
+ *   - test       → POST   /connections/<id>/test       (health probe)
+ *   - disconnect → DELETE /connections/<id>            (revoke)
+ *
+ * Bridge discovery + Bearer auth mirror src/commands/task.ts. All side
+ * effects (lock discovery, fetch, stdout/stderr, exit) are injectable so
+ * the command is unit-testable without a live bridge.
+ */
+import { type ConnectorDescriptor } from "../connectors/connectorRegistry.js";
+interface LockInfo {
+    port: number;
+    authToken: string;
+}
+export interface ConnectDeps {
+    /** Resolve a running bridge. `port` selects a specific lock. */
+    findBridgeLock: (port?: number) => LockInfo | null;
+    /** HTTP transport (defaults to global fetch). */
+    fetchFn: typeof fetch;
+    /** Connector roster (defaults to the shared registry). */
+    connectors: readonly ConnectorDescriptor[];
+    /** stdout sink. */
+    write: (s: string) => void;
+    /** stderr sink. */
+    writeErr: (s: string) => void;
+    /** Process exit (capture-only in tests). */
+    exit: (code: number) => void;
+}
+/**
+ * `patchwork connect ...` dispatcher.
+ *
+ * `deps` is fully injectable for tests. In production, callers pass
+ * `findBridgeLock` (from src/commands/task.ts's lock helper) plus any
+ * overrides; everything else defaults to real process I/O.
+ */
+export declare function runConnect(argv: string[], deps: Partial<ConnectDeps> & Pick<ConnectDeps, "findBridgeLock">): Promise<void>;
+export {};

package/dist/commands/connect.js

@@ -0,0 +1,419 @@
+/**
+ * `patchwork connect` — the connector front-door.
+ *
+ * A thin CLI→HTTP shim over the bridge's already-built `/connections/*`
+ * routes (see src/connectorRoutes.ts). 23 connector error messages already
+ * tell users to "Run: patchwork connect <vendor>"; this is that command.
+ *
+ * NO new bridge or connector logic lives here — every verb maps to one
+ * existing HTTP route:
+ *   - list       → GET    /connections                (Bearer)
+ *   - <vendor>   → GET    /connections/<id>/auth       (OAuth, 302 Location)
+ *              or  POST   /connections/<id>/connect    (PAT, {token})
+ *   - test       → POST   /connections/<id>/test       (health probe)
+ *   - disconnect → DELETE /connections/<id>            (revoke)
+ *
+ * Bridge discovery + Bearer auth mirror src/commands/task.ts. All side
+ * effects (lock discovery, fetch, stdout/stderr, exit) are injectable so
+ * the command is unit-testable without a live bridge.
+ */
+import { CONNECTORS, } from "../connectors/connectorRegistry.js";
+const TIMEOUT_MS = 10_000;
+function parseArgs(argv) {
+    const out = {
+        positional: [],
+        json: false,
+        urlOnly: false,
+        help: false,
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === undefined)
+            continue;
+        if (a === "--json")
+            out.json = true;
+        else if (a === "--url-only")
+            out.urlOnly = true;
+        else if (a === "--help" || a === "-h")
+            out.help = true;
+        else if (a === "--token") {
+            const next = argv[++i];
+            if (next !== undefined)
+                out.token = next;
+        }
+        else if (a === "--port") {
+            const next = argv[++i];
+            if (next !== undefined)
+                out.port = Number(next);
+        }
+        else if (!a.startsWith("-")) {
+            out.positional.push(a);
+        }
+    }
+    return out;
+}
+// ── helpers ──────────────────────────────────────────────────────────────────
+function bearer(lock) {
+    return { Authorization: `Bearer ${lock.authToken}` };
+}
+function statusGlyph(status) {
+    if (status === "connected")
+        return "✓ connected";
+    if (status === "needs_reauth")
+        return "⚠ needs reauth";
+    return "✗ not connected";
+}
+function normalizeStatus(raw) {
+    if (raw === "connected" || raw === "needs_reauth")
+        return raw;
+    return "disconnected";
+}
+/** Levenshtein distance for "did you mean" suggestions. */
+function editDistance(a, b) {
+    const m = a.length;
+    const n = b.length;
+    const prev = Array.from({ length: n + 1 }, (_, j) => j);
+    const curr = new Array(n + 1).fill(0);
+    for (let i = 1; i <= m; i++) {
+        curr[0] = i;
+        for (let j = 1; j <= n; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            const del = (prev[j] ?? 0) + 1;
+            const ins = (curr[j - 1] ?? 0) + 1;
+            const sub = (prev[j - 1] ?? 0) + cost;
+            curr[j] = Math.min(del, ins, sub);
+        }
+        for (let j = 0; j <= n; j++)
+            prev[j] = curr[j] ?? 0;
+    }
+    return prev[n] ?? 0;
+}
+function suggestVendor(input, connectors) {
+    let best;
+    for (const c of connectors) {
+        const dist = editDistance(input, c.id);
+        if (!best || dist < best.dist)
+            best = { id: c.id, dist };
+    }
+    // Only suggest when reasonably close.
+    return best && best.dist <= 3 ? best.id : undefined;
+}
+function resolveLock(deps, port) {
+    const lock = deps.findBridgeLock(port);
+    if (!lock) {
+        deps.writeErr("No running bridge — start it with: patchwork start\n" +
+            (port !== undefined
+                ? `(checked port ${port}; lock missing, IDE-owned, or dead)\n`
+                : ""));
+        deps.exit(1);
+        return null;
+    }
+    return lock;
+}
+async function readJson(res) {
+    const text = await res.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function networkError(deps, err, json) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (json) {
+        deps.write(`${JSON.stringify({ ok: false, error: msg })}\n`);
+    }
+    deps.writeErr(`Error contacting bridge: ${msg}\n`);
+    deps.exit(1);
+}
+// ── verbs ────────────────────────────────────────────────────────────────────
+async function runList(deps, args) {
+    const lock = resolveLock(deps, args.port);
+    if (!lock)
+        return;
+    let live;
+    try {
+        const res = await deps.fetchFn(`http://127.0.0.1:${lock.port}/connections`, {
+            method: "GET",
+            headers: bearer(lock),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        live = await readJson(res);
+    }
+    catch (err) {
+        networkError(deps, err, args.json);
+        return;
+    }
+    // Join live status onto the full registry roster so connectors absent
+    // from the response render as not-connected rather than vanishing.
+    const statusById = new Map();
+    for (const c of live?.connectors ?? []) {
+        if (c.id)
+            statusById.set(c.id, normalizeStatus(c.status));
+    }
+    const rows = deps.connectors.map((c) => ({
+        id: c.id,
+        label: c.label,
+        authKind: c.authKind,
+        status: statusById.get(c.id) ?? "disconnected",
+    }));
+    if (args.json) {
+        deps.write(`${JSON.stringify({ connectors: rows })}\n`);
+        deps.exit(0);
+        return;
+    }
+    // Connected first, then needs_reauth, then disconnected; stable by label.
+    const rank = {
+        connected: 0,
+        needs_reauth: 1,
+        disconnected: 2,
+    };
+    rows.sort((a, b) => rank[a.status] - rank[b.status] || a.label.localeCompare(b.label));
+    const idWidth = Math.max(...rows.map((r) => r.id.length), 2);
+    deps.write("Connectors:\n");
+    for (const r of rows) {
+        deps.write(`  ${r.id.padEnd(idWidth)}  ${statusGlyph(r.status).padEnd(16)}` +
+            `${r.label} (${r.authKind})\n`);
+    }
+    deps.exit(0);
+}
+async function runOauth(deps, descriptor, args) {
+    const lock = resolveLock(deps, args.port);
+    if (!lock)
+        return;
+    let res;
+    try {
+        res = await deps.fetchFn(`http://127.0.0.1:${lock.port}/connections/${descriptor.id}/auth`, {
+            method: "GET",
+            headers: bearer(lock),
+            redirect: "manual",
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        networkError(deps, err, args.json);
+        return;
+    }
+    const location = res.headers.get("location");
+    if (res.status === 302 && location) {
+        if (args.json) {
+            deps.write(`${JSON.stringify({ ok: true, url: location })}\n`);
+        }
+        else if (args.urlOnly) {
+            deps.write(`${location}\n`);
+        }
+        else {
+            deps.write(`Open this URL in your browser to authorize ${descriptor.label}:\n` +
+                `  ${location}\n`);
+        }
+        deps.exit(0);
+        return;
+    }
+    // No redirect — surface the bridge's error body if present.
+    const body = await readJson(res);
+    const detail = body?.error ?? `HTTP ${res.status}`;
+    if (args.json) {
+        deps.write(`${JSON.stringify({ ok: false, error: detail })}\n`);
+    }
+    deps.writeErr(`Could not start ${descriptor.label} authorization: ${detail}\n`);
+    deps.exit(1);
+}
+async function runPatConnect(deps, descriptor, args) {
+    if (!args.token) {
+        // No token supplied — print honest instructions rather than guessing.
+        deps.write(`${descriptor.label} is a token (PAT) connector.\n` +
+            `  Pass a token directly:\n` +
+            `    patchwork connect ${descriptor.id} --token <TOKEN>\n` +
+            `  Some connectors need more than one field (e.g. Jira/Confluence/` +
+            `Zendesk/Datadog need a URL + email + token).\n` +
+            `  For those, use the dashboard /connections page to connect.\n`);
+        deps.exit(0);
+        return;
+    }
+    const lock = resolveLock(deps, args.port);
+    if (!lock)
+        return;
+    let res;
+    try {
+        res = await deps.fetchFn(`http://127.0.0.1:${lock.port}/connections/${descriptor.id}/connect`, {
+            method: "POST",
+            headers: { ...bearer(lock), "Content-Type": "application/json" },
+            body: JSON.stringify({ token: args.token }),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        networkError(deps, err, args.json);
+        return;
+    }
+    const body = await readJson(res);
+    const ok = res.status >= 200 && res.status < 300 && body?.ok !== false;
+    if (args.json) {
+        deps.write(`${JSON.stringify({ ok, ...(body ?? {}) })}\n`);
+    }
+    else if (ok) {
+        const where = body?.workspace ? ` (workspace: ${body.workspace})` : "";
+        deps.write(`✓ Connected ${descriptor.label}${where}\n`);
+    }
+    else {
+        deps.writeErr(`✗ Failed to connect ${descriptor.label}: ${body?.error ?? `HTTP ${res.status}`}\n`);
+    }
+    deps.exit(ok ? 0 : 1);
+}
+async function runTest(deps, vendor, args) {
+    const descriptor = resolveVendor(deps, vendor);
+    if (!descriptor)
+        return;
+    const lock = resolveLock(deps, args.port);
+    if (!lock)
+        return;
+    let res;
+    try {
+        res = await deps.fetchFn(`http://127.0.0.1:${lock.port}/connections/${descriptor.id}/test`, {
+            method: "POST",
+            headers: bearer(lock),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        networkError(deps, err, args.json);
+        return;
+    }
+    const body = await readJson(res);
+    const ok = res.status >= 200 && res.status < 300 && body?.ok !== false;
+    if (args.json) {
+        deps.write(`${JSON.stringify({ ok, ...(body ?? {}) })}\n`);
+    }
+    else if (ok) {
+        deps.write(`✓ ${descriptor.label} is healthy\n`);
+    }
+    else {
+        deps.writeErr(`✗ ${descriptor.label} test failed: ${body?.error ?? `HTTP ${res.status}`}\n`);
+    }
+    deps.exit(ok ? 0 : 1);
+}
+async function runDisconnect(deps, vendor, args) {
+    const descriptor = resolveVendor(deps, vendor);
+    if (!descriptor)
+        return;
+    const lock = resolveLock(deps, args.port);
+    if (!lock)
+        return;
+    let res;
+    try {
+        res = await deps.fetchFn(`http://127.0.0.1:${lock.port}/connections/${descriptor.id}`, {
+            method: "DELETE",
+            headers: bearer(lock),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        networkError(deps, err, args.json);
+        return;
+    }
+    const body = await readJson(res);
+    const ok = res.status >= 200 && res.status < 300 && body?.ok !== false;
+    if (args.json) {
+        deps.write(`${JSON.stringify({ ok, ...(body ?? {}) })}\n`);
+    }
+    else if (ok) {
+        deps.write(`✓ Disconnected ${descriptor.label}\n`);
+    }
+    else {
+        deps.writeErr(`✗ Failed to disconnect ${descriptor.label}: ${body?.error ?? `HTTP ${res.status}`}\n`);
+    }
+    deps.exit(ok ? 0 : 1);
+}
+/** Resolve a vendor id to its descriptor, or emit an error + exit(1). */
+function resolveVendor(deps, vendor) {
+    if (!vendor) {
+        deps.writeErr("Missing connector id.\n");
+        deps.exit(1);
+        return undefined;
+    }
+    const descriptor = deps.connectors.find((c) => c.id === vendor);
+    if (!descriptor) {
+        const hint = suggestVendor(vendor, deps.connectors);
+        const validIds = deps.connectors.map((c) => c.id).join(", ");
+        deps.writeErr(`Unknown connector "${vendor}".\n` +
+            (hint ? `Did you mean "${hint}"?\n` : "") +
+            `Valid ids: ${validIds}\n`);
+        deps.exit(1);
+        return undefined;
+    }
+    return descriptor;
+}
+function printHelp(deps) {
+    deps.write("Usage: patchwork connect [<vendor>|list|test <vendor>|disconnect <vendor>]\n" +
+        "\n" +
+        "  connect [list] [--json]            List connectors + connection status\n" +
+        "  connect <vendor> [--url-only]      OAuth: print the authorize URL to open\n" +
+        "  connect <vendor> --token <TOKEN>   PAT: paste a token to connect\n" +
+        "  connect test <vendor> [--json]     Health-probe a connector\n" +
+        "  connect disconnect <vendor>        Revoke a connector\n" +
+        "\n" +
+        "  --port <n>   Target a specific bridge lock\n" +
+        "  --url-only   Print only the OAuth URL (headless/CI)\n" +
+        "  --json       Machine-readable output\n");
+    deps.exit(0);
+}
+// ── entrypoint ───────────────────────────────────────────────────────────────
+const DEFAULT_DEPS = {
+    fetchFn: globalThis.fetch,
+    connectors: CONNECTORS,
+    write: (s) => process.stdout.write(s),
+    writeErr: (s) => process.stderr.write(s),
+    exit: (c) => process.exit(c),
+};
+/**
+ * `patchwork connect ...` dispatcher.
+ *
+ * `deps` is fully injectable for tests. In production, callers pass
+ * `findBridgeLock` (from src/commands/task.ts's lock helper) plus any
+ * overrides; everything else defaults to real process I/O.
+ */
+export async function runConnect(argv, deps) {
+    const resolved = { ...DEFAULT_DEPS, ...deps };
+    const args = parseArgs(argv);
+    if (args.help) {
+        printHelp(resolved);
+        return;
+    }
+    const verb = args.positional[0];
+    // Bare `connect` or `connect list` → list.
+    if (verb === undefined || verb === "list") {
+        await runList(resolved, args);
+        return;
+    }
+    if (verb === "test") {
+        await runTest(resolved, args.positional[1], args);
+        return;
+    }
+    if (verb === "disconnect") {
+        await runDisconnect(resolved, args.positional[1], args);
+        return;
+    }
+    // Otherwise `verb` is a vendor id: OAuth (auth) or PAT (connect).
+    const descriptor = resolveVendor(resolved, verb);
+    if (!descriptor)
+        return;
+    if (descriptor.authKind === "oauth" && descriptor.supports.auth) {
+        await runOauth(resolved, descriptor, args);
+        return;
+    }
+    if (descriptor.supports.connect) {
+        await runPatConnect(resolved, descriptor, args);
+        return;
+    }
+    // OAuth-capable PAT connectors (auth:true but pat): prefer the token path.
+    if (descriptor.supports.auth) {
+        await runOauth(resolved, descriptor, args);
+        return;
+    }
+    resolved.writeErr(`Connector "${descriptor.id}" does not support an interactive connect flow.\n`);
+    resolved.exit(1);
+}
+//# sourceMappingURL=connect.js.map