pome-sh 0.6.6

package/node_modules/@pome-sh/twin-github/dist/examples/claude-github-agent.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@pome-sh/twin-github/dist/examples/claude-github-agent.js

@@ -0,0 +1,238 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+const env = await loadEnv(resolve("../discord/.env"));
+const apiKey = process.env.ANTHROPIC_API_KEY ?? env.ANTHROPIC_API_KEY;
+const model = process.env.ANTHROPIC_MODEL ?? env.ANTHROPIC_MODEL ?? "claude-sonnet-4-6";
+const mcpUrl = process.env.GITHUB_MCP_URL ?? process.env.GITHUB_CLONE_MCP_URL ?? process.env.POME_GITHUB_MCP_URL ?? "http://127.0.0.1:3333/s/demo/mcp";
+const mcpToken = process.env.GITHUB_MCP_TOKEN ?? await localSessionToken(mcpUrl);
+if (!apiKey) {
+    throw new Error("ANTHROPIC_API_KEY is missing. Put it in discord/.env or export it before running this agent.");
+}
+async function main() {
+    const task = process.argv.slice(2).join(" ") || "Create a branch, push a README change, open a PR, approve it, and merge it.";
+    const client = new GitHubTwinClient(mcpUrl, mcpToken);
+    const tools = await client.listTools();
+    const plan = await askClaudeForPlan(task, tools);
+    const results = [];
+    let lastPullNumber;
+    for (const call of plan) {
+        if ((call.tool === "create_pull_request_review" || call.tool === "merge_pull_request") && lastPullNumber) {
+            call.arguments.pull_number = lastPullNumber;
+            call.arguments.pullNumber = lastPullNumber;
+        }
+        const response = await client.attempt(call.tool, call.arguments);
+        results.push({ call, ok: response.ok, status: response.status, body: response.body });
+        if (call.tool === "create_pull_request" && response.ok && typeof response.body.number === "number") {
+            lastPullNumber = response.body.number;
+        }
+        if (!response.ok)
+            break;
+    }
+    await client.close().catch(() => undefined);
+    console.log(JSON.stringify({ task, model, mcpUrl: redactSession(mcpUrl), calls: results }, null, 2));
+}
+async function askClaudeForPlan(task, availableTools) {
+    const response = await fetch("https://api.anthropic.com/v1/messages", {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "x-api-key": apiKey,
+            "anthropic-version": "2023-06-01"
+        },
+        body: JSON.stringify({
+            model,
+            max_tokens: 1200,
+            temperature: 0,
+            messages: [
+                {
+                    role: "user",
+                    content: [
+                        "You are a tiny GitHub automation agent for a local test twin.",
+                        "Return only JSON: an array of {\"tool\":\"name\",\"arguments\":{}} calls.",
+                        "Use the owner/repo named in the task. If none is named, default to owner acme, repo api, base branch main.",
+                        "Use branch claude-agent-review and file claude-agent.txt for the happy path.",
+                        `Task: ${task}`,
+                        `Tools: ${JSON.stringify(availableTools.map((tool) => ({ name: tool.name, description: tool.description, input_schema: tool.input_schema })))}`
+                    ].join("\n")
+                }
+            ]
+        })
+    });
+    if (!response.ok) {
+        throw new Error(`Claude request failed: ${response.status} ${await response.text()}`);
+    }
+    const data = await response.json();
+    const text = data.content?.find((block) => block.type === "text")?.text ?? "[]";
+    return JSON.parse(stripJsonFence(text));
+}
+async function loadEnv(path) {
+    const output = {};
+    const text = await readFile(path, "utf8").catch(() => "");
+    for (const line of text.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const index = trimmed.indexOf("=");
+        if (index === -1)
+            continue;
+        output[trimmed.slice(0, index)] = trimmed.slice(index + 1);
+    }
+    return output;
+}
+class GitHubTwinClient {
+    url;
+    token;
+    sessionId = null;
+    requestId = 1;
+    constructor(url, token) {
+        this.url = url;
+        this.token = token;
+    }
+    async listTools() {
+        if (this.isJsonRpcMcp()) {
+            await this.initialize();
+            const result = await this.rpc("tools/list", {});
+            return result.tools.map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                input_schema: tool.inputSchema ?? tool.input_schema
+            }));
+        }
+        const headers = {};
+        if (this.token)
+            headers.authorization = `Bearer ${this.token}`;
+        const response = await fetch(`${this.url.replace(/\/$/, "")}/tools`, { headers });
+        if (!response.ok)
+            throw new Error(`Tool list failed: ${response.status} ${await response.text()}`);
+        const body = await response.json();
+        return body.tools;
+    }
+    async attempt(tool, args) {
+        try {
+            const body = await this.call(tool, args);
+            if (isGitHubErrorEnvelope(body))
+                return { ok: false, status: 500, body };
+            return { ok: true, status: 200, body };
+        }
+        catch (error) {
+            return { ok: false, status: error.status ?? 500, body: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    async call(tool, args) {
+        if (this.isJsonRpcMcp()) {
+            await this.initialize();
+            return unwrapToolResult(await this.rpc("tools/call", { name: tool, arguments: args }));
+        }
+        const response = await fetch(`${this.url.replace(/\/$/, "")}/call`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                ...(this.token ? { authorization: `Bearer ${this.token}` } : {})
+            },
+            body: JSON.stringify({ tool, arguments: args })
+        });
+        const body = await response.json().catch(() => ({}));
+        if (!response.ok)
+            throw Object.assign(new Error(`Tool call failed: ${response.status}`), { status: response.status, body });
+        return body;
+    }
+    isJsonRpcMcp() {
+        return !/^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?\//.test(this.url) && (this.url.endsWith("/mcp") || this.url.includes("/github/mcp"));
+    }
+    async initialize() {
+        if (this.sessionId)
+            return;
+        const response = await this.postRpc({
+            jsonrpc: "2.0",
+            id: this.requestId++,
+            method: "initialize",
+            params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "claude-github-agent", version: "0.1.0" } }
+        });
+        this.sessionId = response.headers.get("mcp-session-id");
+        if (!this.sessionId)
+            throw new Error("MCP initialize response did not include mcp-session-id");
+        await this.postRpc({ jsonrpc: "2.0", method: "notifications/initialized", params: {} });
+    }
+    async rpc(method, params) {
+        const response = await this.postRpc({ jsonrpc: "2.0", id: this.requestId++, method, params });
+        const parsed = parseMcpEnvelope(await response.text());
+        if (parsed.error)
+            throw new Error(parsed.error.message ?? `MCP ${method} failed`);
+        return parsed.result;
+    }
+    async postRpc(body) {
+        const response = await fetch(this.url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json, text/event-stream",
+                ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
+                ...(this.sessionId ? { "mcp-session-id": this.sessionId } : {})
+            },
+            body: JSON.stringify(body)
+        });
+        if (!response.ok)
+            throw Object.assign(new Error(await response.text()), { status: response.status });
+        return response;
+    }
+    async close() {
+        if (!this.sessionId || !this.isJsonRpcMcp())
+            return;
+        await fetch(this.url, {
+            method: "DELETE",
+            headers: {
+                ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
+                "mcp-session-id": this.sessionId
+            }
+        });
+        this.sessionId = null;
+    }
+}
+function parseMcpEnvelope(text) {
+    if (text.trimStart().startsWith("event:")) {
+        const data = text
+            .split("\n")
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice("data:".length).trim())
+            .join("\n");
+        return JSON.parse(data);
+    }
+    return JSON.parse(text);
+}
+function unwrapToolResult(result) {
+    if (result?.structuredContent !== undefined)
+        return result.structuredContent;
+    const text = result?.content?.find?.((entry) => entry.type === "text")?.text;
+    if (typeof text === "string") {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    return result;
+}
+function stripJsonFence(text) {
+    return text.trim().replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, "");
+}
+function redactSession(url) {
+    return url.replace(/runtime\/[^/]+/g, "runtime/SESSION");
+}
+async function localSessionToken(url) {
+    const match = url.match(/^https?:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?\/s\/([^/]+)\//);
+    if (!match)
+        return undefined;
+    const { sign } = await import("hono/jwt");
+    const secret = process.env.TWIN_AUTH_SECRET ?? "dev-only-insecure-secret";
+    return sign({ sid: match[1], team_id: "tm_example", exp: Math.floor(Date.now() / 1000) + 3600 }, secret);
+}
+function isGitHubErrorEnvelope(body) {
+    return Boolean(body &&
+        typeof body === "object" &&
+        "message" in body &&
+        typeof body.message === "string" &&
+        "documentation_url" in body);
+}
+await main();
+//# sourceMappingURL=claude-github-agent.js.map

package/node_modules/@pome-sh/twin-github/dist/examples/claude-github-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-github-agent.js","sourceRoot":"","sources":["../../examples/claude-github-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,iBAAiB,CAAC;AACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,IAAI,mBAAmB,CAAC;AACxF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,kCAAkC,CAAC;AACvJ,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAEjF,IAAI,CAAC,MAAM,EAAE,CAAC;IACZ,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;AAClH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,6EAA6E,CAAC;IAC9H,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAA0E,EAAE,CAAC;IAC1F,IAAI,cAAkC,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,4BAA4B,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,cAAc,EAAE,CAAC;YACzG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,cAAc,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,cAAc,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAQ,QAAQ,CAAC,IAA6B,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7H,cAAc,GAAI,QAAQ,CAAC,IAA2B,CAAC,MAAM,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM;IAC1B,CAAC;IAED,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,cAAmF;IAC/H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,WAAW,EAAE,MAAO;YACpB,mBAAmB,EAAE,YAAY;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,CAAC;YACd,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE;wBACP,+DAA+D;wBAC/D,2EAA2E;wBAC3E,4GAA4G;wBAC5G,8EAA8E;wBAC9E,SAAS,IAAI,EAAE;wBACf,UAAU,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;qBAChJ,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;SACF,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0D,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAChF,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAe,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB;IAKD;IACA;IALX,SAAS,GAAkB,IAAI,CAAC;IAChC,SAAS,GAAG,CAAC,CAAC;IAEtB,YACmB,GAAW,EACX,KAAc;QADd,QAAG,GAAH,GAAG,CAAQ;QACX,UAAK,GAAL,KAAK,CAAS;IAC9B,CAAC;IAEJ,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAChD,OAAQ,MAAiH,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC7I,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY;aACpD,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAoF,CAAC;QACrH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAA6B;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,qBAAqB,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,KAA6B,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3I,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAA6B;QAC5D,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5H,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,OAAO,CAAC,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5I,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE;YACpB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;SAC3H,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,MAA+B;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,MAAM,SAAS,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAa;QACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QACpD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,gBAAgB,EAAE,IAAI,CAAC,SAAS;aACjC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI;aACd,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAW;IACnC,IAAI,MAAM,EAAE,iBAAiB,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAwB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;IAChG,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC1E,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,OAAO,OAAO,CACZ,IAAI;QACF,OAAO,IAAI,KAAK,QAAQ;QACxB,SAAS,IAAI,IAAI;QACjB,OAAQ,IAA8B,CAAC,OAAO,KAAK,QAAQ;QAC3D,mBAAmB,IAAI,IAAI,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,EAAE,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/examples/mcp-node.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@pome-sh/twin-github/dist/examples/mcp-node.js

@@ -0,0 +1,15 @@
+const baseUrl = process.env.GITHUB_CLONE_MCP_URL ?? "http://127.0.0.1:3333/mcp";
+const response = await fetch(`${baseUrl}/call`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+        tool: "search_repositories",
+        arguments: { query: "acme" }
+    })
+});
+if (!response.ok) {
+    throw new Error(`MCP call failed: ${response.status} ${await response.text()}`);
+}
+console.log(JSON.stringify(await response.json(), null, 2));
+export {};
+//# sourceMappingURL=mcp-node.js.map

package/node_modules/@pome-sh/twin-github/dist/examples/mcp-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-node.js","sourceRoot":"","sources":["../../examples/mcp-node.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;AAEhF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,OAAO,EAAE;IAC9C,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;IAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;QACnB,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/examples/mini-bot-flow.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@pome-sh/twin-github/dist/examples/mini-bot-flow.js

@@ -0,0 +1,39 @@
+const baseUrl = process.env.GITHUB_CLONE_MCP_URL ?? "http://127.0.0.1:3333/mcp";
+async function tool(name, args) {
+    const response = await fetch(`${baseUrl}/call`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ tool: name, arguments: args })
+    });
+    if (!response.ok)
+        throw new Error(`${name} failed: ${response.status} ${await response.text()}`);
+    return response.json();
+}
+await tool("create_repository", { owner: "demo", name: "bot-target", description: "Bot flow target" });
+await tool("create_branch", { owner: "demo", repo: "bot-target", branch: "feature/readme" });
+await tool("push_files", {
+    owner: "demo",
+    repo: "bot-target",
+    branch: "feature/readme",
+    message: "Update README",
+    files: [{ path: "README.md", content: "# Bot Target\n\nUpdated by a local bot.\n" }]
+});
+const pr = await tool("create_pull_request", {
+    owner: "demo",
+    repo: "bot-target",
+    title: "Update README",
+    head: "feature/readme",
+    base: "main"
+});
+await tool("create_pull_request_review", {
+    owner: "demo",
+    repo: "bot-target",
+    pull_number: pr.number,
+    event: "APPROVE",
+    body: "Verified locally."
+});
+await tool("merge_pull_request", { owner: "demo", repo: "bot-target", pull_number: pr.number });
+const readme = await tool("get_file_contents", { owner: "demo", repo: "bot-target", path: "README.md" });
+console.log(`Merged PR #${pr.number}; README sha is ${readme.sha}`);
+export {};
+//# sourceMappingURL=mini-bot-flow.js.map

package/node_modules/@pome-sh/twin-github/dist/examples/mini-bot-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mini-bot-flow.js","sourceRoot":"","sources":["../../examples/mini-bot-flow.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;AAEhF,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAA6B;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,OAAO,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,IAAI,EAAkB,CAAC;AACzC,CAAC;AAED,MAAM,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACvG,MAAM,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC7F,MAAM,IAAI,CAAC,YAAY,EAAE;IACvB,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;CACrF,CAAC,CAAC;AACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE;IAC3C,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,MAAM;CACb,CAAC,CAAC;AACH,MAAM,IAAI,CAAC,4BAA4B,EAAE;IACvC,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,EAAE,CAAC,MAAM;IACtB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,mBAAmB;CAC1B,CAAC,CAAC;AACH,MAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AAChG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAEzG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,MAAM,mBAAmB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/src/access-control.d.ts

@@ -0,0 +1,32 @@
+/** Every sandboxed tool exists in the MCP catalog. */
+export declare function assertAccessControlCatalogMatchesTools(): void;
+export declare function githubAccessControlPayload(): {
+    summary: {
+        total: number;
+        allowed: number;
+        denied: number;
+    };
+    version: 2;
+    twin: "github";
+    endpoints: {
+        tool: string;
+        operation: string;
+        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+        default_allowed: boolean;
+        v2: boolean;
+    }[];
+    categories: {
+        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+        label: string;
+        endpoints: {
+            tool: string;
+            operation: string;
+            method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+            category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+            default_allowed: boolean;
+            v2: boolean;
+        }[];
+    }[];
+};
+export { GITHUB_ACCESS_CONTROL_CATALOG, summarizeGitHubAccessControlCatalog, } from "@pome-sh/shared-types";

package/node_modules/@pome-sh/twin-github/dist/src/access-control.js

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: Apache-2.0
+import { GITHUB_ACCESS_CONTROL_CATALOG, githubAccessControlToolNames, summarizeGitHubAccessControlCatalog, } from "@pome-sh/shared-types";
+import { toolDefinitions } from "./tools.js";
+/** Every sandboxed tool exists in the MCP catalog. */
+export function assertAccessControlCatalogMatchesTools() {
+    const toolNames = new Set(toolDefinitions.map((tool) => tool.name));
+    const missing = githubAccessControlToolNames().filter((name) => !toolNames.has(name));
+    if (missing.length > 0) {
+        throw new Error(`access-control catalog references unknown tools: ${missing.join(", ")}`);
+    }
+}
+export function githubAccessControlPayload() {
+    assertAccessControlCatalogMatchesTools();
+    return {
+        ...GITHUB_ACCESS_CONTROL_CATALOG,
+        summary: summarizeGitHubAccessControlCatalog(),
+    };
+}
+export { GITHUB_ACCESS_CONTROL_CATALOG, summarizeGitHubAccessControlCatalog, } from "@pome-sh/shared-types";
+//# sourceMappingURL=access-control.js.map

package/node_modules/@pome-sh/twin-github/dist/src/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../src/access-control.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,sDAAsD;AACtD,MAAM,UAAU,sCAAsC;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,4BAA4B,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oDAAoD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,sCAAsC,EAAE,CAAC;IACzC,OAAO;QACL,GAAG,6BAA6B;QAChC,OAAO,EAAE,mCAAmC,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,OAAO,EACL,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,uBAAuB,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/src/admin-gate.d.ts

@@ -0,0 +1,35 @@
+import type { Context, MiddlewareHandler } from "hono";
+/** Context variable consulted first by getClientIp(). */
+export declare const CLIENT_IP_VAR = "pomeClientIp";
+/**
+ * Explicitly record the peer address for this request. Alternate serving
+ * bridges (or tests) call this from an upstream middleware so the gate never
+ * reaches into runtime-private internals.
+ *
+ * SECURITY: the value passed here MUST be the transport-level peer address
+ * (the socket's remote address as reported by the serving bridge). It takes
+ * precedence over getConnInfo, so deriving it from any request-controlled
+ * input — X-Forwarded-For or any other client-supplied header — would make
+ * the loopback-only admin gate spoofable by whoever sets that header. If you
+ * are behind a reverse proxy, use TWIN_ADMIN_TOKEN instead of trying to
+ * recover the "real" client IP.
+ */
+export declare function setClientIp(c: Context, ip: string): void;
+/**
+ * Runtime-neutral client-IP accessor (FDRS-587). Resolution order:
+ *   1. Explicit override set via setClientIp() (alternate bridges / tests).
+ *   2. The node serving bridge's official getConnInfo helper.
+ *   3. undefined — no live socket (e.g. app.request() in-process tests).
+ */
+export declare function getClientIp(c: Context): Promise<string | undefined>;
+export declare function isLoopbackAddress(remote: string): boolean;
+export interface AdminGateOptions {
+    /** 403 response factory so each twin keeps its own error envelope. */
+    forbidden?: () => Response;
+}
+/**
+ * Admin endpoint protection shared by every twin (FDRS-616). Each twin's
+ * auth.ts wraps this with its own `forbidden` envelope. Semantics are
+ * identical to the per-twin requireAdminAuth() copies this replaces.
+ */
+export declare function createAdminGate(options?: AdminGateOptions): MiddlewareHandler;

package/node_modules/@pome-sh/twin-github/dist/src/admin-gate.js

@@ -0,0 +1,116 @@
+// SPDX-License-Identifier: Apache-2.0
+// MIRRORED FILE — byte-identical copies enforced by
+// scripts/check-admin-gate-mirrors.mjs (root script `lint:admin-gate-mirrors`,
+// wired into .github/workflows/ci.yml). Edit the canonical copy, then re-copy.
+//
+// Canonical: packages/sdk/src/admin-gate.ts
+// Mirrors:   packages/twin-github/src/admin-gate.ts
+//            packages/twin-slack/src/admin-gate.ts
+//            packages/twin-stripe/src/admin-gate.ts
+//            cli/src/twin-github/admin-gate.ts
+//            cli/src/twin-slack/admin-gate.ts
+//
+// Shared admin-endpoint gate (FDRS-587 / FDRS-616). Twins cannot depend on
+// @pome-sh/sdk (twin-stripe is vendored into the CLI as a file: tarball, so
+// a workspace dep would break off-workspace installs) — hence the mirror
+// pattern, same as redaction.ts.
+//
+// Tiered policy (semantics unchanged from the per-twin copies it replaces):
+//   1. TWIN_ADMIN_TOKEN set → require X-Admin-Token to match (timing-safe).
+//   2. TWIN_ADMIN_TOKEN unset + client IP known → allow only loopback.
+//   3. TWIN_ADMIN_TOKEN unset + client IP unknown → deny in production,
+//      allow otherwise (accepted fail-open for in-process test harnesses).
+import { timingSafeEqual } from "node:crypto";
+/** Context variable consulted first by getClientIp(). */
+export const CLIENT_IP_VAR = "pomeClientIp";
+let nodeGetConnInfo;
+// Lazily import the node bridge's official ConnInfo helper. Dynamic because
+// @pome-sh/sdk declares @hono/node-server as an *optional* peer dependency —
+// a static import would crash consumers that never bind a Node socket.
+// Works with both @hono/node-server v1 and v2 (same subpath + signature).
+function loadNodeGetConnInfo() {
+    nodeGetConnInfo ??= import("@hono/node-server/conninfo").then((mod) => mod.getConnInfo, () => undefined);
+    return nodeGetConnInfo;
+}
+/**
+ * Explicitly record the peer address for this request. Alternate serving
+ * bridges (or tests) call this from an upstream middleware so the gate never
+ * reaches into runtime-private internals.
+ *
+ * SECURITY: the value passed here MUST be the transport-level peer address
+ * (the socket's remote address as reported by the serving bridge). It takes
+ * precedence over getConnInfo, so deriving it from any request-controlled
+ * input — X-Forwarded-For or any other client-supplied header — would make
+ * the loopback-only admin gate spoofable by whoever sets that header. If you
+ * are behind a reverse proxy, use TWIN_ADMIN_TOKEN instead of trying to
+ * recover the "real" client IP.
+ */
+export function setClientIp(c, ip) {
+    c.set(CLIENT_IP_VAR, ip);
+}
+/**
+ * Runtime-neutral client-IP accessor (FDRS-587). Resolution order:
+ *   1. Explicit override set via setClientIp() (alternate bridges / tests).
+ *   2. The node serving bridge's official getConnInfo helper.
+ *   3. undefined — no live socket (e.g. app.request() in-process tests).
+ */
+export async function getClientIp(c) {
+    const override = c.get(CLIENT_IP_VAR);
+    if (typeof override === "string" && override.length > 0)
+        return override;
+    const getConnInfo = await loadNodeGetConnInfo();
+    if (!getConnInfo)
+        return undefined;
+    try {
+        const address = getConnInfo(c).remote?.address;
+        return typeof address === "string" && address.length > 0 ? address : undefined;
+    }
+    catch {
+        // The helper throws when the context has no node socket behind it.
+        return undefined;
+    }
+}
+export function isLoopbackAddress(remote) {
+    return (remote === "127.0.0.1" ||
+        remote === "::1" ||
+        remote === "::ffff:127.0.0.1" ||
+        remote === "localhost");
+}
+function defaultForbidden() {
+    return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
+}
+/**
+ * Admin endpoint protection shared by every twin (FDRS-616). Each twin's
+ * auth.ts wraps this with its own `forbidden` envelope. Semantics are
+ * identical to the per-twin requireAdminAuth() copies this replaces.
+ */
+export function createAdminGate(options = {}) {
+    const forbidden = options.forbidden ?? defaultForbidden;
+    return async (c, next) => {
+        const adminToken = process.env.TWIN_ADMIN_TOKEN;
+        if (adminToken && adminToken.length > 0) {
+            // Web Headers lookups are case-insensitive, so one lookup covers every
+            // casing a client might send.
+            const provided = c.req.header("X-Admin-Token");
+            if (!provided)
+                return forbidden();
+            const a = Buffer.from(provided);
+            const b = Buffer.from(adminToken);
+            if (a.length !== b.length || !timingSafeEqual(a, b))
+                return forbidden();
+            await next();
+            return;
+        }
+        const remote = await getClientIp(c);
+        if (!remote) {
+            if (process.env.NODE_ENV === "production")
+                return forbidden();
+            await next();
+            return;
+        }
+        if (!isLoopbackAddress(remote))
+            return forbidden();
+        await next();
+    };
+}
+//# sourceMappingURL=admin-gate.js.map

package/node_modules/@pome-sh/twin-github/dist/src/admin-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-gate.js","sourceRoot":"","sources":["../../src/admin-gate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,oDAAoD;AACpD,+EAA+E;AAC/E,+EAA+E;AAC/E,EAAE;AACF,4CAA4C;AAC5C,oDAAoD;AACpD,mDAAmD;AACnD,oDAAoD;AACpD,+CAA+C;AAC/C,8CAA8C;AAC9C,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,iCAAiC;AACjC,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,2EAA2E;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAO5C,IAAI,eAA+D,CAAC;AAEpE,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,0EAA0E;AAC1E,SAAS,mBAAmB;IAC1B,eAAe,KAAK,MAAM,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAC3D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAuC,EACpD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU,EAAE,EAAU;IAC/C,CAA0B,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAU;IAC1C,MAAM,QAAQ,GAAI,CAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,WAAW,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,CACL,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,KAAK;QAChB,MAAM,KAAK,kBAAkB;QAC7B,MAAM,KAAK,WAAW,CACvB,CAAC;AACJ,CAAC;AAOD,SAAS,gBAAgB;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAChD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,uEAAuE;YACvE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/src/app.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import type { GitHubCloneDatabase, GitHubStateSeed, Recorder } from "./types.js";
+export type GitHubCloneAppOptions = {
+    db?: GitHubCloneDatabase;
+    seed?: GitHubStateSeed;
+    recorder?: Recorder;
+    runId?: string;
+};
+export declare function createGitHubCloneApp(options?: GitHubCloneAppOptions): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;