presubmit 0.1.0

package/dist/apps/server/src/sessions.js

@@ -0,0 +1,579 @@
+import { activeCheck } from '../../../packages/protocol/src/checks.js';
+import { projectTaskGraph } from './task-graph.js';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { sumTokenUsage } from '../../../packages/protocol/src/token-usage.js';
+import { searchExcerpt, searchPattern, } from '../../../packages/protocol/src/search.js';
+import { searchConversation } from './conversation-search.js';
+import { SemanticHistory } from './semantic-history.js';
+import { historySources } from './history-sources.js';
+import { createSessionWorkspace, selectSessionBranch, validateSessionWorkspace, } from './session-workspaces.js';
+function durableSetup(setup) {
+    const { routingTrace: _routingTrace, ...durable } = setup;
+    return durable;
+}
+export function summarizeSession(record, state, error) {
+    const active = state?.runs.find((run) => run.status === 'running');
+    const pending = state?.approvals.filter((a) => a.status === 'pending' && (a.runId === active?.id || Boolean(a.checkId))).length ?? 0;
+    const pendingQuestions = state?.userQuestions?.filter((question) => question.status === 'pending' && question.runId === active?.id).length ?? 0;
+    // Assigned sessions share the parent's delegation view, so only the parent rolls up requests.
+    const latestAttempts = new Map((record.assignment ? [] : (state?.delegation?.attempts ?? [])).map((attempt) => [
+        attempt.taskId,
+        attempt,
+    ]));
+    const childPendingApprovals = [...latestAttempts.values()].reduce((count, attempt) => count +
+        (['starting', 'running'].includes(attempt.status) ? (attempt.pendingApprovals ?? 0) : 0), 0);
+    const last = state?.runs.at(-1);
+    const lastEvent = state?.events
+        .filter((event) => event.text && event.type !== 'command' && event.type !== 'reasoning')
+        .at(-1);
+    // Workspace refreshes update Files/Changes without advancing recency or unread state.
+    const lastActivity = state?.events.findLast((event) => event.type !== 'workspace_changed');
+    return {
+        activeChecks: state?.checks?.filter(activeCheck).length ?? 0,
+        assignment: record.assignment,
+        parentSessionId: record.parentSessionId,
+        childSessionNumber: record.childSessionNumber,
+        mode: record.preferences?.mode,
+        archived: record.archived ?? false,
+        id: record.id,
+        title: record.title,
+        workspace: record.workspace,
+        branch: record.branch,
+        createdAt: record.createdAt,
+        activeRunStartedAt: active?.createdAt,
+        latestActivitySeq: lastActivity?.seq ?? 0,
+        latestActivityAt: [record.createdAt, last?.createdAt, lastActivity?.createdAt]
+            .filter((value) => Boolean(value))
+            .sort((a, b) => Date.parse(b) - Date.parse(a))[0],
+        status: error
+            ? 'unavailable'
+            : active || state?.checks?.some(activeCheck)
+                ? pending || pendingQuestions
+                    ? 'waiting'
+                    : 'running'
+                : last?.status === 'stopped'
+                    ? 'completed'
+                    : (last?.status ?? 'idle'),
+        runs: state?.runs.length ?? 0,
+        usage: sumTokenUsage(state?.runs ?? []),
+        pendingApprovals: pending,
+        childPendingApprovals,
+        pendingQuestions,
+        latestActivity: lastEvent?.text?.slice(0, 180) ?? last?.prompt.slice(0, 180),
+        error,
+    };
+}
+export async function createSessionManager(options) {
+    const records = options.store.get('agentSessions') ?? [];
+    const numberChildren = () => {
+        if (!options.taskNumber)
+            return numberChildSessions(records);
+        let changed = false;
+        for (const record of records)
+            if (record.parentSessionId && !record.assignment) {
+                const number = options.taskNumber(record.parentSessionId, `child:${record.id}`, record.childSessionNumber);
+                if (record.childSessionNumber !== number) {
+                    record.childSessionNumber = number;
+                    changed = true;
+                }
+            }
+        return changed;
+    };
+    if (numberChildren())
+        options.store.put('agentSessions', records);
+    const main = options.store.get('mainSession') ?? {
+        id: 'main',
+        title: 'Main workspace',
+        workspace: options.repository,
+        createdAt: new Date().toISOString(),
+    };
+    options.store.put('mainSession', main);
+    const children = new Map();
+    const opening = new Map();
+    const errors = new Map();
+    const creating = new Map();
+    let publicOrigin;
+    let publicProject;
+    const publicUrl = (id) => `${publicOrigin}/s/${id}${publicProject ? '?project=' + encodeURIComponent(publicProject) : ''}`;
+    let closing = false;
+    function pendingChildApprovals(parentId) {
+        return records
+            .filter((record) => record.parentSessionId === parentId && !record.assignment)
+            .flatMap((record) => {
+            const state = children.get(record.id)?.app.getSummaryState();
+            const active = state?.runs.find((run) => run.status === 'running');
+            return (state?.approvals ?? [])
+                .filter((approval) => approval.status === 'pending' && approval.runId === active?.id)
+                .map((approval) => ({
+                sessionId: record.id,
+                label: `${record.childSessionNumber ? `T${record.childSessionNumber} · ` : ''}${record.title}`,
+                approval,
+            }));
+        });
+    }
+    const summaries = () => {
+        const result = [
+            summarizeSession(main, options.mainState()),
+            ...records.map((record) => summarizeSession(record, children.get(record.id)?.app.getSummaryState(), errors.get(record.id))),
+        ];
+        const byId = new Map(result.map((summary) => [summary.id, summary]));
+        const ownChildPending = new Map(result.map((summary) => [summary.id, summary.childPendingApprovals ?? 0]));
+        const branchPending = (id, seen = new Set()) => {
+            if (seen.has(id))
+                return 0;
+            const summary = byId.get(id);
+            if (!summary)
+                return 0;
+            const nextSeen = new Set(seen).add(id);
+            return (summary.pendingApprovals +
+                (ownChildPending.get(id) ?? 0) +
+                records
+                    .filter((record) => record.parentSessionId === id && !record.assignment)
+                    .reduce((count, child) => count + branchPending(child.id, nextSeen), 0));
+        };
+        for (const summary of result)
+            summary.childPendingApprovals =
+                (ownChildPending.get(summary.id) ?? 0) +
+                    records
+                        .filter((record) => record.parentSessionId === summary.id && !record.assignment)
+                        .reduce((count, child) => count + branchPending(child.id), 0);
+        return result;
+    };
+    function coordinator(record) {
+        const parent = record.assignment?.coordinatorId === 'main'
+            ? main
+            : records.find((item) => item.id === record.assignment?.coordinatorId);
+        if (!parent || parent.assignment)
+            throw new Error('Shared task workspace requires an existing parent session.');
+        return parent;
+    }
+    function ordinaryParent(id) {
+        const parent = id === 'main' ? main : records.find((r) => r.id === id);
+        if (!parent)
+            throw new Error('Child sessions require an existing parent session.');
+        return parent;
+    }
+    const open = (record, initialPrompt, initialAttachmentIds, initialSetup, initialRoutingTrace) => {
+        if (closing || children.has(record.id))
+            return Promise.resolve();
+        const pending = opening.get(record.id);
+        if (pending)
+            return pending;
+        const operation = openRecord(record, initialPrompt, initialAttachmentIds, initialSetup, initialRoutingTrace).finally(() => opening.delete(record.id));
+        opening.set(record.id, operation);
+        return operation;
+    };
+    const openRecord = async (record, initialPrompt, initialAttachmentIds, initialSetup, initialRoutingTrace) => {
+        if (closing || children.has(record.id))
+            return;
+        let app;
+        try {
+            const initialReviewer = record.reviewer
+                ? options.store.get('reviewer-session:' + record.id)
+                : undefined;
+            if (record.reviewer &&
+                (!initialReviewer ||
+                    JSON.stringify(initialReviewer.binding) !== JSON.stringify(record.reviewer)))
+                throw new Error('Saved reviewer snapshot is unavailable; this session cannot become a coding session.');
+            const ordinaryShared = !!record.parentSessionId && record.useWorktree === false;
+            const shared = record.assignment?.workspaceMode === 'coordinator' || ordinaryShared;
+            if (shared) {
+                const parent = ordinaryShared
+                    ? ordinaryParent(record.parentSessionId)
+                    : coordinator(record);
+                if (record.workspace !== parent.workspace || record.branch !== parent.branch)
+                    throw new Error('Saved task workspace does not match its coordinator.');
+                // The coordinator owns this checkout's lock for the lifetime of its children.
+                if (parent.id !== 'main')
+                    await open(parent);
+                if (parent.id !== 'main' && !children.has(parent.id))
+                    throw new Error('Coordinator workspace is unavailable. Restore it before resuming tasks.');
+            }
+            else if (record.useWorktree !== false) {
+                await validateSessionWorkspace(options.repository, record.workspace, record.branch);
+            }
+            else if (record.workspace !== options.repository) {
+                throw new Error('Saved session checkout does not match the repository.');
+            }
+            app = await options.start({
+                cwd: record.workspace,
+                dataDir: join(options.dataDir, 'sessions', record.id),
+                webDir: options.webDir,
+                port: 0,
+                isSession: true,
+                onStateChange: () => {
+                    // Parent Reviews collect attributed progress without injecting a coding turn.
+                    if (record.reviewer && record.parentSessionId)
+                        children.get(record.parentSessionId)?.app.notifyTask?.();
+                    options.changed();
+                },
+                initialPrompt,
+                initialSetup,
+                initialRoutingTrace,
+                initialRoute: initialPrompt ? record.setup?.route : undefined,
+                initialAttachmentIds,
+                ...options.childOptions(),
+                sessionPreferences: record.preferences,
+                taskNumber: options.taskNumber
+                    ? (id, preferred) => options.taskNumber(record.id, `task:${id}`, preferred)
+                    : undefined,
+                launchQueued: options.launchQueued
+                    ? (launch) => options.launchQueued(record.id, launch)
+                    : undefined,
+                assignment: record.assignment,
+                parentSessionId: record.parentSessionId,
+                sessionRecordId: record.id,
+                initialReviewer,
+                startChild: options.startChild
+                    ? (key, fingerprint, launch, validate) => options.startChild(record.id, key, fingerprint, launch, validate)
+                    : undefined,
+                reviewerState: options.reviewerState,
+                listChildren: () => options.listChildren?.(record.id) ?? [],
+                childApprovals: () => pendingChildApprovals(record.id),
+                acquireChildExecution: () => options.acquireChildExecution?.(record.id),
+                taskBridge: options.bridge?.(record.assignment?.coordinatorId ?? record.id),
+            }, shared);
+            const token = new URL(app.url).searchParams.get('token');
+            const response = await app.request('/api/auth', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Origin: app.origin },
+                body: JSON.stringify({ token }),
+            });
+            const cookie = response.headers.get('set-cookie')?.split(';')[0];
+            if (!response.ok || !cookie)
+                throw new Error('Could not establish the session connection.');
+            app.setTitle(record.title);
+            children.set(record.id, { app, cookie });
+            if (publicOrigin)
+                app.setConnectionUrl(publicUrl(record.id));
+            errors.delete(record.id);
+        }
+        catch (error) {
+            await app?.close();
+            errors.set(record.id, error instanceof Error ? error.message : 'Agent session unavailable.');
+        }
+    };
+    // Restore a few sessions at a time so saved history does not serialize all disk/Git work.
+    // Keep a bound: every session opens a store, watcher, and private listener.
+    let nextRecord = 0;
+    await Promise.all(Array.from({ length: Math.min(4, records.length) }, async () => {
+        while (nextRecord < records.length)
+            await open(records[nextRecord++]);
+    }));
+    const sources = historySources(() => [
+        { id: 'main', title: main.title, store: options.store, runs: options.mainState().runs },
+        ...records.flatMap((record) => {
+            const child = children.get(record.id)?.app;
+            return child
+                ? [
+                    {
+                        id: record.id,
+                        title: record.title,
+                        store: child.store,
+                        runs: child.getSummaryState().runs,
+                    },
+                ]
+                : [];
+        }),
+    ]);
+    let semantic;
+    const retiring = new Set();
+    function setEmbeddings(provider) {
+        if (closing)
+            throw new Error('Server is stopping.');
+        const previous = semantic;
+        semantic = provider
+            ? new SemanticHistory(join(options.dataDir, 'conversation-vectors'), provider, sources)
+            : undefined;
+        semantic?.start();
+        if (previous) {
+            const retired = previous.close().catch(() => { });
+            retiring.add(retired);
+            void retired.then(() => retiring.delete(retired));
+        }
+    }
+    setEmbeddings(options.embeddings);
+    return {
+        summaries,
+        taskGraph: () => projectTaskGraph(summaries(), (id) => id === 'main' ? options.mainState() : children.get(id)?.app.getSummaryState()),
+        pendingChildApprovals,
+        navigationUrl: (id) => `/s/${id}${publicProject ? '?project=' + encodeURIComponent(publicProject) : ''}`,
+        setEmbeddings,
+        retrievalStatus: () => semantic?.status() ?? { enabled: false, indexing: false, indexedChunks: 0 },
+        async retrieve(query, limit = 5, excludeRunId) {
+            if (!semantic || closing)
+                throw new Error('Project history retrieval is unavailable.');
+            return semantic.search(query, limit, excludeRunId);
+        },
+        async search(query, mode = 'exact') {
+            if (mode === 'related') {
+                if (closing)
+                    throw new Error('Server is stopping.');
+                // Global search can include projects that have not enabled semantic retrieval.
+                if (!semantic)
+                    return { results: [], hasMore: false, unavailable: [] };
+                const status = semantic.status();
+                const hits = status.indexing && !status.indexedChunks ? [] : await semantic.search(query, 10);
+                const seen = new Set();
+                return {
+                    results: hits
+                        .filter((hit) => {
+                        if (seen.has(hit.sessionId))
+                            return false;
+                        seen.add(hit.sessionId);
+                        return true;
+                    })
+                        .map((hit) => ({
+                        sessionId: hit.sessionId,
+                        title: hit.sessionTitle,
+                        runId: hit.runId,
+                        kind: hit.kind,
+                        archived: Boolean(records.find((r) => r.id === hit.sessionId)?.archived),
+                        projectId: 'main',
+                        projectName: options.repository.split('/').filter(Boolean).at(-1) ?? 'Project',
+                        updatedAt: hit.createdAt,
+                        score: hit.score,
+                        excerpt: {
+                            before: '',
+                            match: '',
+                            after: hit.text.slice(0, 240) + (hit.text.length > 240 ? '…' : ''),
+                        },
+                    })),
+                    hasMore: hits.length === 10,
+                    unavailable: status.error ? [status.error] : [],
+                    indexing: status.indexing,
+                };
+            }
+            const results = [];
+            const unavailable = [];
+            const pattern = searchPattern(query);
+            const ordered = summaries().sort((a, b) => (b.latestActivityAt ?? b.createdAt).localeCompare(a.latestActivityAt ?? a.createdAt));
+            for (const session of ordered) {
+                if (closing)
+                    throw new Error('Server is stopping.');
+                const app = children.get(session.id)?.app;
+                const titleMatch = searchExcerpt(session.title, pattern);
+                if (session.status === 'unavailable')
+                    unavailable.push(session.title);
+                const match = titleMatch
+                    ? { kind: 'title', excerpt: titleMatch }
+                    : session.id === 'main'
+                        ? searchConversation(options.store, options.mainState().runs, query)
+                        : app
+                            ? searchConversation(app.store, app.getSummaryState().runs, query)
+                            : undefined;
+                if (match) {
+                    results.push({
+                        ...match,
+                        sessionId: session.id,
+                        title: session.title,
+                        archived: Boolean(session.archived),
+                        updatedAt: session.latestActivityAt ?? session.createdAt,
+                        projectId: 'main',
+                        projectName: options.repository.split('/').filter(Boolean).at(-1) ?? 'Project',
+                    });
+                }
+                if (results.length > 50)
+                    break;
+                // Let execution, cancellation and live connections progress between sessions.
+                await new Promise((resolve) => setImmediate(resolve));
+            }
+            return { results: results.slice(0, 50), hasMore: results.length > 50, unavailable };
+        },
+        setArchived(id, archived, expectedArchived) {
+            if (closing)
+                throw new Error('Server is stopping.');
+            const record = id === 'main' ? main : records.find((item) => item.id === id);
+            if (!record)
+                throw new Error('Session not found.');
+            if (expectedArchived !== undefined && Boolean(record.archived) !== expectedArchived)
+                throw new Error('Session archive status changed; refresh before updating it.');
+            const state = id === 'main' ? options.mainState() : children.get(id)?.app.getSummaryState();
+            if (archived &&
+                (options.taskBusy?.(id) ||
+                    creating.has(id) ||
+                    state?.runs.some((run) => run.status === 'running')))
+                throw new Error('Stop the session before archiving it.');
+            record.archived = archived;
+            options.store.put(id === 'main' ? 'mainSession' : 'agentSessions', id === 'main' ? main : records);
+            options.changed();
+            return summaries().find((session) => session.id === id);
+        },
+        setOrigin(origin, project) {
+            publicOrigin = origin;
+            publicProject = project;
+            for (const [id, { app }] of children)
+                app.setConnectionUrl(publicUrl(id));
+        },
+        hasActiveRuns: () => creating.size > 0 || [...children.values()].some(({ app }) => app.hasActiveRuns()),
+        connection(id) {
+            const connection = children.get(id);
+            if (!connection)
+                throw new Error(errors.get(id) ?? 'Agent session not found.');
+            return connection;
+        },
+        create(id, title, prompt, useWorktree = true, attachments = [], sourceBranch, preferences, assignment, parentSessionId, reviewer) {
+            if (closing)
+                return Promise.reject(new Error('Server is stopping.'));
+            if (parentSessionId &&
+                (assignment ||
+                    (parentSessionId !== 'main' && !records.some((record) => record.id === parentSessionId))))
+                return Promise.reject(new Error('Child sessions require an existing source session.'));
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id))
+                return Promise.reject(new Error('Invalid session ID.'));
+            if (!title.trim() || title.length > 120)
+                return Promise.reject(new Error('Enter a session title of at most 120 characters.'));
+            const promptHash = prompt
+                ? createHash('sha256')
+                    .update(attachments.length ? JSON.stringify({ prompt, attachments }) : prompt)
+                    .digest('hex')
+                : undefined;
+            const existing = records.find((record) => record.id === id);
+            const savedReviewer = options.store.get('reviewer-session:' + id);
+            if ((reviewer &&
+                (reviewer.binding.parentSessionId !== parentSessionId ||
+                    assignment ||
+                    useWorktree ||
+                    prompt)) ||
+                (savedReviewer && JSON.stringify(savedReviewer) !== JSON.stringify(reviewer)) ||
+                (existing && JSON.stringify(existing.reviewer) !== JSON.stringify(reviewer?.binding)))
+                return Promise.reject(new Error('Reviewer session identity cannot change.'));
+            if (reviewer)
+                options.store.put('reviewer-session:' + id, reviewer);
+            if (existing &&
+                ((existing.requestTitle ?? existing.title) !== title.trim() ||
+                    existing.promptHash !== promptHash ||
+                    (existing.useWorktree !== false) !== useWorktree ||
+                    existing.sourceBranch !== sourceBranch ||
+                    existing.parentSessionId !== parentSessionId ||
+                    JSON.stringify(existing.preferences) !== JSON.stringify(preferences) ||
+                    JSON.stringify(existing.assignment) !== JSON.stringify(assignment)))
+                return Promise.reject(new Error('Session ID already used for a different request.'));
+            const inFlight = creating.get(id);
+            if (inFlight) {
+                if (inFlight.title !== title.trim() ||
+                    inFlight.promptHash !== promptHash ||
+                    inFlight.useWorktree !== useWorktree ||
+                    inFlight.sourceBranch !== sourceBranch ||
+                    inFlight.parentSessionId !== parentSessionId ||
+                    JSON.stringify(inFlight.preferences) !== JSON.stringify(preferences) ||
+                    JSON.stringify(inFlight.assignment) !== JSON.stringify(assignment))
+                    return Promise.reject(new Error('Session ID already used for a different request.'));
+                return inFlight.promise;
+            }
+            const pending = (async () => {
+                let record = existing;
+                let prepared;
+                const routingTrace = [];
+                const setupPromise = !record && prompt && options.prepare && !assignment
+                    ? options
+                        .prepare(prompt, attachments, preferences, (trace) => routingTrace.push(trace))
+                        .then((setup) => {
+                        prepared = setup;
+                        if (!closing && record) {
+                            record.title = setup.title;
+                            record.setup = durableSetup(setup);
+                            options.store.put('agentSessions', records);
+                            children.get(record.id)?.app.setTitle(setup.title);
+                            options.changed();
+                        }
+                        return setup;
+                    })
+                    : undefined;
+                void setupPromise?.catch(() => { });
+                if (!record) {
+                    if (closing)
+                        throw new Error('Server is stopping.');
+                    const shared = assignment?.workspaceMode === 'coordinator';
+                    const parent = shared
+                        ? coordinator({ assignment })
+                        : parentSessionId && !useWorktree
+                            ? ordinaryParent(parentSessionId)
+                            : undefined;
+                    if (shared && (useWorktree || sourceBranch || assignment?.baseCommit))
+                        throw new Error('Shared tasks must use their coordinator workspace without a branch or base override.');
+                    if (!shared && !useWorktree && sourceBranch) {
+                        await selectSessionBranch(options.repository, sourceBranch, () => options.mainState().runs.some((run) => run.status === 'running') ||
+                            [...creating.keys()].some((key) => key !== id) ||
+                            [...children.values()].some(({ app }) => app.getSummaryState().runs.some((run) => run.status === 'running')));
+                    }
+                    const created = parent
+                        ? { workspace: parent.workspace, branch: parent.branch }
+                        : useWorktree
+                            ? await createSessionWorkspace({
+                                repository: options.repository,
+                                directory: join(options.dataDir, 'worktrees'),
+                                id,
+                                branch: sourceBranch,
+                                baseCommit: assignment?.baseCommit,
+                            })
+                            : { workspace: options.repository };
+                    record = {
+                        id,
+                        title: prepared?.title ?? title.trim(),
+                        requestTitle: title.trim(),
+                        setup: prepared && durableSetup(prepared),
+                        preferences,
+                        assignment,
+                        parentSessionId,
+                        reviewer: reviewer?.binding,
+                        ...created,
+                        useWorktree,
+                        sourceBranch,
+                        promptHash,
+                        createdAt: new Date().toISOString(),
+                    };
+                    records.push(record);
+                    numberChildren();
+                    options.store.put('agentSessions', records);
+                }
+                await open(record, prompt, attachments, setupPromise, routingTrace);
+                options.changed();
+                return summaries().find((session) => session.id === id);
+            })();
+            creating.set(id, {
+                title: title.trim(),
+                useWorktree,
+                sourceBranch,
+                preferences,
+                assignment,
+                parentSessionId,
+                promptHash,
+                promise: pending,
+            });
+            void pending.finally(() => creating.delete(id)).catch(() => { });
+            return pending;
+        },
+        async close() {
+            closing = true;
+            await semantic?.close();
+            await Promise.allSettled(retiring);
+            await Promise.allSettled([...creating.values()].map((item) => item.promise));
+            // Reap shared workers before releasing the coordinator's workspace ownership lock.
+            const sharedIds = new Set(records
+                .filter((record) => record.assignment?.workspaceMode === 'coordinator' ||
+                (!!record.parentSessionId && record.useWorktree === false))
+                .map((record) => record.id));
+            await Promise.allSettled([...children.entries()]
+                .filter(([id]) => sharedIds.has(id))
+                .map(([, { app }]) => app.close()));
+            await Promise.allSettled([...children.entries()]
+                .filter(([id]) => !sharedIds.has(id))
+                .map(([, { app }]) => app.close()));
+            children.clear();
+        },
+    };
+}
+/** Assign once in persisted creation order, including archived children. Never renumber. */
+export function numberChildSessions(records) {
+    let next = records.reduce((max, record) => Math.max(max, record.childSessionNumber ?? 0), 0);
+    let changed = false;
+    for (const record of records) {
+        if (record.parentSessionId && !record.assignment && record.childSessionNumber === undefined) {
+            record.childSessionNumber = ++next;
+            changed = true;
+        }
+    }
+    return changed;
+}

package/dist/apps/server/src/shared-auth.js

@@ -0,0 +1,70 @@
+import { chmod, copyFile, mkdir, mkdtemp, readdir, readFile, rename, rm, stat, } from 'node:fs/promises';
+import { join } from 'node:path';
+/** Publish a complete credential directory atomically; never overwrite a shared login. */
+export async function sharedAuthPath(home, legacyDataDir) {
+    const directory = join(home, 'credentials');
+    const destination = join(directory, 'openai.json');
+    try {
+        await stat(directory);
+        return destination;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    await mkdir(home, { recursive: true, mode: 0o700 });
+    const candidates = [];
+    const paths = new Set();
+    if (legacyDataDir)
+        paths.add(join(legacyDataDir, 'credentials', 'openai.json'));
+    for (const entry of await readdir(home, { withFileTypes: true })) {
+        if (entry.isDirectory() && /^[a-f0-9]{20}$/.test(entry.name))
+            paths.add(join(home, entry.name, 'credentials', 'openai.json'));
+    }
+    for (const path of paths) {
+        try {
+            const info = await stat(path);
+            const value = JSON.parse(await readFile(path, 'utf8'));
+            if (value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length)
+                candidates.push({ path, modified: info.mtimeMs });
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' && !(error instanceof SyntaxError))
+                throw error;
+        }
+    }
+    // Prefer the most recently saved login when migrating several older repositories.
+    const source = candidates.sort((a, b) => b.modified - a.modified)[0]?.path;
+    const temp = await mkdtemp(join(home, '.credentials-'));
+    try {
+        if (source) {
+            for (const suffix of ['', '.provider', '.provider.model']) {
+                try {
+                    const target = join(temp, 'openai.json' + suffix);
+                    await copyFile(source + suffix, target);
+                    await chmod(target, 0o600);
+                }
+                catch (error) {
+                    if (suffix === '' || error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+        }
+        else {
+            // The marker prevents an intentional disconnect from re-importing legacy credentials.
+            const { writeFile } = await import('node:fs/promises');
+            await writeFile(join(temp, '.initialized'), '', { mode: 0o600 });
+        }
+        try {
+            await rename(temp, directory);
+        }
+        catch (error) {
+            if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
+                throw error;
+        }
+    }
+    finally {
+        await rm(temp, { recursive: true, force: true });
+    }
+    return destination;
+}