shadow-claw 1.59.6 → 1.60.0

package/dist/lib/content/build-attachment-content-blocks.d.ts

@@ -5,6 +5,8 @@ export declare const MAX_NATIVE_AUDIO_BYTES: number;
 export declare const MAX_NATIVE_DOCUMENT_BYTES: number;
 export interface BuildAttachmentContentBlocksOptions {
     maxInlineTextBytes?: number;
+    /** Max image size in bytes for inline base64 encoding (default: MAX_NATIVE_IMAGE_BYTES = 3 MB). */
+    maxImageBytes?: number;
 }
 /**
  * Converts stored message attachments into model-ready ContentBlocks.

package/dist/lib/{credentials-5vpz0XPk.js → credentials-CZbngHXW.js}

@@ -1,5 +1,5 @@
 import { t as getConfig } from "./get-config-BWhs5HFF.js";
-import { L as getProviderTokenAuthScheme, r as CONFIG_KEYS } from "./config-DxNI3TlW.js";
+import { L as getProviderTokenAuthScheme, r as CONFIG_KEYS } from "./config-BrHR97zt.js";
 import { t as setConfig } from "./set-config-CUadvYZ1.js";
 import { n as decryptValue, r as encryptValue } from "./crypto-Bikgpqfe.js";
 
@@ -275,4 +275,4 @@ async function resolveFromLegacy(db) {
 
 //#endregion
 export { resolveStoredCredentialAuthMode as i, detectProvider as n, resolveGitCredentials as r, buildAuthHeaders as t };
-//# sourceMappingURL=credentials-5vpz0XPk.js.map
+//# sourceMappingURL=credentials-CZbngHXW.js.map

package/dist/lib/{credentials-5vpz0XPk.js.map → credentials-CZbngHXW.js.map}

@@ -1 +1 @@
-{"version":3,"file":"credentials-5vpz0XPk.js","names":[],"sources":["../../src/subsystems/accounts/stored-credentials.ts","../../src/subsystems/git/credentials.ts"],"sourcesContent":["export type StoredCredentialAuthMode = \"token\" | \"basic\" | \"oauth\";\n\nexport interface StoredCredentialBase {\n  id: string;\n  label: string;\n  hostPattern: string;\n  token: string;\n  basicUsername?: string;\n  authMode?: StoredCredentialAuthMode;\n}\n\nexport interface StoredCredentialOAuthFields {\n  oauthProviderId?: string;\n  oauthClientId?: string;\n  oauthClientSecret?: string;\n  accessTokenExpiresAt?: number;\n  refreshToken?: string;\n  scopes?: string[];\n  tokenType?: string;\n  oauthRefreshFailureCount?: number;\n  oauthReauthRequired?: boolean;\n  oauthReauthRequiredAt?: number;\n  /** Custom authorize URL (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomAuthorizeUrl?: string;\n  /** Custom token URL (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomTokenUrl?: string;\n  /** Custom PKCE preference (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomUsePkce?: boolean;\n  /** Custom redirect URI (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomRedirectUri?: string;\n}\n\nexport interface PendingOAuthResult {\n  providerId: string;\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  scope?: string;\n  tokenType?: string;\n}\n\ntype OAuthCapableStoredCredential = {\n  authMode?: StoredCredentialAuthMode;\n} & StoredCredentialOAuthFields;\n\nexport function resolveStoredCredentialAuthMode(\n  credential: OAuthCapableStoredCredential | null | undefined,\n): StoredCredentialAuthMode {\n  if (!credential) {\n    return \"token\";\n  }\n\n  // Treat legacy \"pat\" string identically to \"token\" mode\n  if (\n    credential.authMode === \"token\" ||\n    (credential.authMode as string) === \"pat\"\n  ) {\n    return \"token\";\n  }\n\n  if (credential.authMode === \"basic\") {\n    return \"basic\";\n  }\n\n  if (credential.authMode === \"oauth\") {\n    return \"oauth\";\n  }\n\n  if (\n    credential.oauthProviderId ||\n    credential.oauthClientId ||\n    credential.oauthClientSecret ||\n    credential.refreshToken ||\n    credential.accessTokenExpiresAt ||\n    credential.tokenType ||\n    credential.oauthReauthRequired\n  ) {\n    return \"oauth\";\n  }\n\n  return \"token\";\n}\n","import {\n  CONFIG_KEYS,\n  getProviderTokenAuthScheme,\n} from \"../../config/config.js\";\n\nimport { resolveStoredCredentialAuthMode } from \"../accounts/stored-credentials.js\";\nimport { decryptValue, encryptValue } from \"../../security/crypto.js\";\n\nimport { getConfig } from \"../../db/get-config.js\";\nimport { setConfig } from \"../../db/set-config.js\";\n\nimport type {\n  GitAccount,\n  GitAuthMode,\n  GitProvider,\n  ResolveGitCredentialsOptions,\n  ResolvedGitCredentials,\n} from \"./types.js\";\nimport type { ShadowClawDatabase } from \"../../db/types.js\";\n\nconst OAUTH_REFRESH_WINDOW_MS = 60_000;\nconst OAUTH_REFRESH_FAILURE_THRESHOLD = 3;\n\nfunction resolveGitAuthMode(account: GitAccount): GitAuthMode {\n  return resolveStoredCredentialAuthMode(account);\n}\n\nfunction mapGitProviderToGeneralProviderId(provider: GitProvider): string {\n  switch (provider) {\n    case \"azure-devops\":\n      return \"azure_devops\";\n    default:\n      return provider;\n  }\n}\n\n/**\n * Detect the git provider type from a hostname or host pattern.\n */\nexport function detectProvider(hostPattern: string): GitProvider {\n  if (!hostPattern) {\n    return \"generic\";\n  }\n\n  const lower = hostPattern.toLowerCase();\n  if (lower.includes(\"github\")) {\n    return \"github\";\n  }\n\n  if (lower.includes(\"dev.azure.com\") || lower.includes(\"visualstudio.com\")) {\n    return \"azure-devops\";\n  }\n\n  if (lower.includes(\"gitlab\")) {\n    return \"gitlab\";\n  }\n\n  return \"generic\";\n}\n\n/**\n * Build HTTP Authorization headers for a resolved credential set.\n */\nexport function buildAuthHeaders(\n  creds: Partial<ResolvedGitCredentials> & {\n    hostPattern?: string;\n    provider?: GitProvider;\n  },\n): Record<string, string> {\n  if (creds.reauthRequired) {\n    return {};\n  }\n\n  const provider = creds.provider || detectProvider(creds.hostPattern || \"\");\n  const mappedProviderId = mapGitProviderToGeneralProviderId(provider);\n  const authMode = creds.authMode || \"token\";\n\n  // Some git providers (Azure DevOps) need Basic auth for PAT/OAuth over git HTTP.\n  if (\n    creds.token &&\n    mappedProviderId === \"azure_devops\" &&\n    getProviderTokenAuthScheme(mappedProviderId, authMode, \"git_remote\")\n      ?.headerPrefix === \"Basic \"\n  ) {\n    return { Authorization: `Basic ${btoa(\":\" + creds.token)}` };\n  }\n\n  switch (provider) {\n    case \"azure-devops\": {\n      if (creds.username && creds.password) {\n        return {\n          Authorization: `Basic ${btoa(creds.username + \":\" + creds.password)}`,\n        };\n      }\n\n      break;\n    }\n\n    default:\n      break;\n  }\n\n  if (creds.token) {\n    const scheme = getProviderTokenAuthScheme(\n      mappedProviderId,\n      authMode,\n      \"git_remote\",\n    );\n\n    if (scheme?.headerName) {\n      return {\n        [scheme.headerName]: `${scheme.headerPrefix || \"\"}${creds.token}`,\n      };\n    }\n\n    return { Authorization: `Bearer ${creds.token}` };\n  }\n\n  return {};\n}\n\n/**\n * Extract hostname + pathname from a git remote URL.\n * Returns e.g. \"dev.azure.com/exampleOrg2/project/_git/repo\" so that\n * path-based host patterns like \"dev.azure.com/exampleOrg2\" can match.\n */\nfunction extractHostAndPath(url: string): string | undefined {\n  try {\n    const parsed = new URL(url);\n    const path = parsed.pathname.replace(/\\/+$/, \"\");\n\n    return path ? parsed.hostname + path : parsed.hostname;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Find the best matching account for a URL by host (and optional path prefix).\n * When multiple accounts match, the longest (most specific) pattern wins.\n */\nfunction matchAccountsByHost(\n  accounts: GitAccount[],\n  hostAndPath: string,\n): GitAccount[] {\n  const lower = hostAndPath.toLowerCase();\n  const matches: GitAccount[] = [];\n\n  let bestLen = -1;\n  for (const a of accounts) {\n    if (!a.hostPattern) {\n      continue;\n    }\n\n    const pattern = a.hostPattern.toLowerCase();\n    if (lower.includes(pattern)) {\n      if (pattern.length > bestLen) {\n        bestLen = pattern.length;\n\n        matches.length = 0;\n        matches.push(a);\n      } else if (pattern.length === bestLen) {\n        matches.push(a);\n      }\n    }\n  }\n\n  return matches;\n}\n\nfunction pickAccountByAuthMode(\n  accounts: GitAccount[],\n  authMode?: GitAuthMode,\n): GitAccount | undefined {\n  if (!accounts.length) {\n    return undefined;\n  }\n\n  if (!authMode) {\n    return accounts[0];\n  }\n\n  const modeMatch = accounts.find(\n    (acct) => resolveGitAuthMode(acct) === authMode,\n  );\n  if (modeMatch) {\n    return modeMatch;\n  }\n\n  // Legacy accounts without explicit mode should behave as PAT accounts.\n  if (authMode === \"token\") {\n    const legacyPat = accounts.find(\n      (acct) => resolveGitAuthMode(acct) === \"token\" && !acct.authMode,\n    );\n\n    if (legacyPat) {\n      return legacyPat;\n    }\n  }\n\n  return accounts[0];\n}\n\n/**\n * Decrypt a stored encrypted value, returning undefined for empty/missing.\n */\nasync function decryptIfPresent(\n  encrypted: string | null | undefined,\n): Promise<string | undefined> {\n  if (!encrypted) {\n    return undefined;\n  }\n\n  const result = await decryptValue(encrypted);\n\n  return result ?? undefined;\n}\n\nfunction shouldRefreshOAuthToken(\n  account: GitAccount,\n  options: ResolveGitCredentialsOptions,\n): boolean {\n  if (resolveGitAuthMode(account) !== \"oauth\") {\n    return false;\n  }\n\n  if (account.oauthReauthRequired) {\n    return false;\n  }\n\n  if (\n    !account.refreshToken ||\n    !account.oauthProviderId ||\n    !account.oauthClientId\n  ) {\n    return false;\n  }\n\n  if (options.forceRefresh) {\n    return true;\n  }\n\n  if (!account.accessTokenExpiresAt) {\n    return false;\n  }\n\n  return account.accessTokenExpiresAt <= Date.now() + OAUTH_REFRESH_WINDOW_MS;\n}\n\nasync function tryRefreshOAuthAccount(\n  db: ShadowClawDatabase,\n  accounts: GitAccount[],\n  account: GitAccount,\n): Promise<GitAccount> {\n  if (\n    !account.refreshToken ||\n    !account.oauthProviderId ||\n    !account.oauthClientId\n  ) {\n    return account;\n  }\n\n  const decryptedRefreshToken = await decryptIfPresent(account.refreshToken);\n  if (!decryptedRefreshToken) {\n    return account;\n  }\n\n  const oauthClientSecret = account.oauthClientSecret\n    ? await decryptIfPresent(account.oauthClientSecret)\n    : undefined;\n\n  const persistAccount = async (updatedAccount: GitAccount) => {\n    const idx = accounts.findIndex((candidate) => candidate.id === account.id);\n    if (idx !== -1) {\n      accounts[idx] = updatedAccount;\n      await setConfig(db, CONFIG_KEYS.GIT_ACCOUNTS, accounts);\n    }\n  };\n\n  const markRefreshFailure = async (): Promise<GitAccount> => {\n    const failureCount = (account.oauthRefreshFailureCount || 0) + 1;\n    const reauthRequired = failureCount >= OAUTH_REFRESH_FAILURE_THRESHOLD;\n    const updatedAccount: GitAccount = {\n      ...account,\n      oauthRefreshFailureCount: failureCount,\n      oauthReauthRequired: reauthRequired,\n      oauthReauthRequiredAt: reauthRequired\n        ? account.oauthReauthRequiredAt || Date.now()\n        : undefined,\n    };\n\n    await persistAccount(updatedAccount);\n\n    return updatedAccount;\n  };\n\n  try {\n    const response = await fetch(\"/oauth/refresh\", {\n      body: JSON.stringify({\n        clientId: account.oauthClientId,\n        clientSecret: oauthClientSecret,\n        providerId: account.oauthProviderId,\n        refreshToken: decryptedRefreshToken,\n        scope: account.scopes,\n      }),\n      headers: {\n        \"content-type\": \"application/json\",\n      },\n      method: \"POST\",\n    });\n\n    if (!response.ok) {\n      return markRefreshFailure();\n    }\n\n    const payload = (await response.json()) as {\n      accessToken?: string;\n      expiresIn?: number;\n      refreshToken?: string;\n      scope?: string;\n      tokenType?: string;\n    };\n\n    if (!payload.accessToken) {\n      return markRefreshFailure();\n    }\n\n    const encryptedAccessToken = await encryptValue(payload.accessToken);\n    if (!encryptedAccessToken) {\n      return markRefreshFailure();\n    }\n\n    let encryptedRefreshToken = account.refreshToken;\n    if (payload.refreshToken) {\n      const maybeEncryptedRefreshToken = await encryptValue(\n        payload.refreshToken,\n      );\n\n      if (maybeEncryptedRefreshToken) {\n        encryptedRefreshToken = maybeEncryptedRefreshToken;\n      }\n    }\n\n    const updatedAccount: GitAccount = {\n      ...account,\n      token: encryptedAccessToken,\n      refreshToken: encryptedRefreshToken,\n      accessTokenExpiresAt: payload.expiresIn\n        ? Date.now() + payload.expiresIn * 1000\n        : account.accessTokenExpiresAt,\n      tokenType: payload.tokenType || account.tokenType,\n      scopes: payload.scope\n        ? payload.scope\n            .split(/[\\s,]+/)\n            .map((scope) => scope.trim())\n            .filter(Boolean)\n        : account.scopes,\n      oauthRefreshFailureCount: 0,\n      oauthReauthRequired: false,\n      oauthReauthRequiredAt: undefined,\n    };\n\n    await persistAccount(updatedAccount);\n\n    return updatedAccount;\n  } catch {\n    return markRefreshFailure();\n  }\n}\n\n/**\n * Resolve git credentials for a given operation.\n *\n * Resolution order:\n * 1. If GIT_ACCOUNTS exist, match by URL hostname → default account → first account\n * 2. Fall back to legacy single-key config (GIT_TOKEN, GIT_USERNAME, etc.)\n */\nexport async function resolveGitCredentials(\n  db: ShadowClawDatabase,\n  url?: string,\n  options: ResolveGitCredentialsOptions = {},\n): Promise<ResolvedGitCredentials> {\n  const accounts = (await getConfig(db, CONFIG_KEYS.GIT_ACCOUNTS)) as\n    GitAccount[] | undefined;\n\n  if (Array.isArray(accounts) && accounts.length > 0) {\n    return resolveFromAccounts(db, accounts, url, options);\n  }\n\n  return resolveFromLegacy(db);\n}\n\n/**\n * Resolve credentials from the multi-account list.\n */\nasync function resolveFromAccounts(\n  db: ShadowClawDatabase,\n  accounts: GitAccount[],\n  url?: string,\n  options: ResolveGitCredentialsOptions = {},\n): Promise<ResolvedGitCredentials> {\n  let account: GitAccount | undefined;\n\n  if (options.accountId) {\n    account = accounts.find((a) => a.id === options.accountId);\n  }\n\n  // Match by URL host (+ path prefix when the pattern includes a path)\n  if (!account && url) {\n    const hostAndPath = extractHostAndPath(url);\n    if (hostAndPath) {\n      const hostMatches = matchAccountsByHost(accounts, hostAndPath);\n      account = pickAccountByAuthMode(hostMatches, options.authMode);\n    }\n  }\n\n  // Fall back to default account (only when no URL was provided, or the\n  // default account's host matches the URL). Sending unrelated credentials\n  // to a public repo host causes a 401 even though the repo is public.\n  if (!account) {\n    const defaultId = await getConfig(db, CONFIG_KEYS.GIT_DEFAULT_ACCOUNT);\n    if (defaultId) {\n      const defaultAccount = accounts.find((a) => a.id === defaultId);\n      if (defaultAccount) {\n        if (!url) {\n          account = defaultAccount;\n        } else {\n          const hostAndPath = extractHostAndPath(url);\n          if (hostAndPath && defaultAccount.hostPattern) {\n            const lower = hostAndPath?.toLowerCase();\n            const pattern = defaultAccount.hostPattern.toLowerCase();\n            if (lower?.includes(pattern)) {\n              account = defaultAccount;\n            }\n          }\n        }\n      }\n    }\n  }\n\n  // Fall back to first account matching requested mode\n  if (!account && !url && options.authMode) {\n    account = pickAccountByAuthMode(accounts, options.authMode);\n  }\n\n  // Fall back to first account\n  if (!account && !url) {\n    account = accounts[0];\n  }\n\n  if (!account) {\n    return {\n      authMode: \"token\",\n      authorEmail: undefined,\n      authorName: undefined,\n      password: undefined,\n      provider: \"generic\",\n      token: undefined,\n      username: undefined,\n    };\n  }\n\n  if (shouldRefreshOAuthToken(account, options)) {\n    account = await tryRefreshOAuthAccount(db, accounts, account);\n  }\n\n  const provider =\n    account.provider || detectProvider(account.hostPattern || \"\");\n\n  if (resolveGitAuthMode(account) === \"oauth\" && account.oauthReauthRequired) {\n    return {\n      accountId: account.id,\n      authMode: \"oauth\",\n      authorEmail: account.authorEmail || undefined,\n      authorName: account.authorName || undefined,\n      hostPattern: account.hostPattern || undefined,\n      password: undefined,\n      provider,\n      reauthRequired: true,\n      token: undefined,\n      username: account.username || undefined,\n    };\n  }\n\n  return {\n    accountId: account.id,\n    authMode: resolveGitAuthMode(account),\n    authorEmail: account.authorEmail || undefined,\n    authorName: account.authorName || undefined,\n    hostPattern: account.hostPattern || undefined,\n    password: await decryptIfPresent(account.password),\n    provider,\n    token: await decryptIfPresent(account.token),\n    username: account.username || undefined,\n  };\n}\n\n/**\n * Resolve credentials from legacy single-key config.\n */\nasync function resolveFromLegacy(\n  db: ShadowClawDatabase,\n): Promise<ResolvedGitCredentials> {\n  const encToken = await getConfig(db, CONFIG_KEYS.GIT_TOKEN);\n  const encPassword = await getConfig(db, CONFIG_KEYS.GIT_PASSWORD);\n\n  return {\n    authMode: \"token\",\n    authorEmail:\n      (await getConfig(db, CONFIG_KEYS.GIT_AUTHOR_EMAIL)) || undefined,\n    authorName: (await getConfig(db, CONFIG_KEYS.GIT_AUTHOR_NAME)) || undefined,\n    password: encPassword ? await decryptIfPresent(encPassword) : undefined,\n    provider: \"generic\" as GitProvider,\n    token: encToken ? await decryptIfPresent(encToken) : undefined,\n    username: (await getConfig(db, CONFIG_KEYS.GIT_USERNAME)) || undefined,\n  };\n}\n"],"mappings":";;;;;;AA6CA,SAAgB,gCACd,YAC0B;CAC1B,IAAI,CAAC,YACH,OAAO;CAIT,IACE,WAAW,aAAa,WACvB,WAAW,aAAwB,OAEpC,OAAO;CAGT,IAAI,WAAW,aAAa,SAC1B,OAAO;CAGT,IAAI,WAAW,aAAa,SAC1B,OAAO;CAGT,IACE,WAAW,mBACX,WAAW,iBACX,WAAW,qBACX,WAAW,gBACX,WAAW,wBACX,WAAW,aACX,WAAW,qBAEX,OAAO;CAGT,OAAO;AACT;;;;AC7DA,MAAM,0BAA0B;AAChC,MAAM,kCAAkC;AAExC,SAAS,mBAAmB,SAAkC;CAC5D,OAAO,gCAAgC,OAAO;AAChD;AAEA,SAAS,kCAAkC,UAA+B;CACxE,QAAQ,UAAR;EACE,KAAK,gBACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,SAAgB,eAAe,aAAkC;CAC/D,IAAI,CAAC,aACH,OAAO;CAGT,MAAM,QAAQ,YAAY,YAAY;CACtC,IAAI,MAAM,SAAS,QAAQ,GACzB,OAAO;CAGT,IAAI,MAAM,SAAS,eAAe,KAAK,MAAM,SAAS,kBAAkB,GACtE,OAAO;CAGT,IAAI,MAAM,SAAS,QAAQ,GACzB,OAAO;CAGT,OAAO;AACT;;;;AAKA,SAAgB,iBACd,OAIwB;CACxB,IAAI,MAAM,gBACR,OAAO,CAAC;CAGV,MAAM,WAAW,MAAM,YAAY,eAAe,MAAM,eAAe,EAAE;CACzE,MAAM,mBAAmB,kCAAkC,QAAQ;CACnE,MAAM,WAAW,MAAM,YAAY;CAGnC,IACE,MAAM,SACN,qBAAqB,kBACrB,2BAA2B,kBAAkB,UAAU,YAAY,CAAC,EAChE,iBAAiB,UAErB,OAAO,EAAE,eAAe,SAAS,KAAK,MAAM,MAAM,KAAK,IAAI;CAG7D,QAAQ,UAAR;EACE,KAAK,gBACH,IAAI,MAAM,YAAY,MAAM,UAC1B,OAAO,EACL,eAAe,SAAS,KAAK,MAAM,WAAW,MAAM,MAAM,QAAQ,IACpE;CAQN;CAEA,IAAI,MAAM,OAAO;EACf,MAAM,SAAS,2BACb,kBACA,UACA,YACF;EAEA,IAAI,QAAQ,YACV,OAAO,GACJ,OAAO,aAAa,GAAG,OAAO,gBAAgB,KAAK,MAAM,QAC5D;EAGF,OAAO,EAAE,eAAe,UAAU,MAAM,QAAQ;CAClD;CAEA,OAAO,CAAC;AACV;;;;;;AAOA,SAAS,mBAAmB,KAAiC;CAC3D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,MAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;EAE/C,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO;CAChD,QAAQ;EACN;CACF;AACF;;;;;AAMA,SAAS,oBACP,UACA,aACc;CACd,MAAM,QAAQ,YAAY,YAAY;CACtC,MAAM,UAAwB,CAAC;CAE/B,IAAI,UAAU;CACd,KAAK,MAAM,KAAK,UAAU;EACxB,IAAI,CAAC,EAAE,aACL;EAGF,MAAM,UAAU,EAAE,YAAY,YAAY;EAC1C,IAAI,MAAM,SAAS,OAAO,GAAG;GAC3B,IAAI,QAAQ,SAAS,SAAS;IAC5B,UAAU,QAAQ;IAElB,QAAQ,SAAS;IACjB,QAAQ,KAAK,CAAC;GAChB,OAAO,IAAI,QAAQ,WAAW,SAC5B,QAAQ,KAAK,CAAC;EAElB;CACF;CAEA,OAAO;AACT;AAEA,SAAS,sBACP,UACA,UACwB;CACxB,IAAI,CAAC,SAAS,QACZ;CAGF,IAAI,CAAC,UACH,OAAO,SAAS;CAGlB,MAAM,YAAY,SAAS,MACxB,SAAS,mBAAmB,IAAI,MAAM,QACzC;CACA,IAAI,WACF,OAAO;CAIT,IAAI,aAAa,SAAS;EACxB,MAAM,YAAY,SAAS,MACxB,SAAS,mBAAmB,IAAI,MAAM,WAAW,CAAC,KAAK,QAC1D;EAEA,IAAI,WACF,OAAO;CAEX;CAEA,OAAO,SAAS;AAClB;;;;AAKA,eAAe,iBACb,WAC6B;CAC7B,IAAI,CAAC,WACH;CAKF,OAAO,MAFc,aAAa,SAAS,KAE1B;AACnB;AAEA,SAAS,wBACP,SACA,SACS;CACT,IAAI,mBAAmB,OAAO,MAAM,SAClC,OAAO;CAGT,IAAI,QAAQ,qBACV,OAAO;CAGT,IACE,CAAC,QAAQ,gBACT,CAAC,QAAQ,mBACT,CAAC,QAAQ,eAET,OAAO;CAGT,IAAI,QAAQ,cACV,OAAO;CAGT,IAAI,CAAC,QAAQ,sBACX,OAAO;CAGT,OAAO,QAAQ,wBAAwB,KAAK,IAAI,IAAI;AACtD;AAEA,eAAe,uBACb,IACA,UACA,SACqB;CACrB,IACE,CAAC,QAAQ,gBACT,CAAC,QAAQ,mBACT,CAAC,QAAQ,eAET,OAAO;CAGT,MAAM,wBAAwB,MAAM,iBAAiB,QAAQ,YAAY;CACzE,IAAI,CAAC,uBACH,OAAO;CAGT,MAAM,oBAAoB,QAAQ,oBAC9B,MAAM,iBAAiB,QAAQ,iBAAiB,IAChD;CAEJ,MAAM,iBAAiB,OAAO,mBAA+B;EAC3D,MAAM,MAAM,SAAS,WAAW,cAAc,UAAU,OAAO,QAAQ,EAAE;EACzE,IAAI,QAAQ,IAAI;GACd,SAAS,OAAO;GAChB,MAAM,UAAU,IAAI,YAAY,cAAc,QAAQ;EACxD;CACF;CAEA,MAAM,qBAAqB,YAAiC;EAC1D,MAAM,gBAAgB,QAAQ,4BAA4B,KAAK;EAC/D,MAAM,iBAAiB,gBAAgB;EACvC,MAAM,iBAA6B;GACjC,GAAG;GACH,0BAA0B;GAC1B,qBAAqB;GACrB,uBAAuB,iBACnB,QAAQ,yBAAyB,KAAK,IAAI,IAC1C;EACN;EAEA,MAAM,eAAe,cAAc;EAEnC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,kBAAkB;GAC7C,MAAM,KAAK,UAAU;IACnB,UAAU,QAAQ;IAClB,cAAc;IACd,YAAY,QAAQ;IACpB,cAAc;IACd,OAAO,QAAQ;GACjB,CAAC;GACD,SAAS,EACP,gBAAgB,mBAClB;GACA,QAAQ;EACV,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,OAAO,mBAAmB;EAG5B,MAAM,UAAW,MAAM,SAAS,KAAK;EAQrC,IAAI,CAAC,QAAQ,aACX,OAAO,mBAAmB;EAG5B,MAAM,uBAAuB,MAAM,aAAa,QAAQ,WAAW;EACnE,IAAI,CAAC,sBACH,OAAO,mBAAmB;EAG5B,IAAI,wBAAwB,QAAQ;EACpC,IAAI,QAAQ,cAAc;GACxB,MAAM,6BAA6B,MAAM,aACvC,QAAQ,YACV;GAEA,IAAI,4BACF,wBAAwB;EAE5B;EAEA,MAAM,iBAA6B;GACjC,GAAG;GACH,OAAO;GACP,cAAc;GACd,sBAAsB,QAAQ,YAC1B,KAAK,IAAI,IAAI,QAAQ,YAAY,MACjC,QAAQ;GACZ,WAAW,QAAQ,aAAa,QAAQ;GACxC,QAAQ,QAAQ,QACZ,QAAQ,MACL,MAAM,QAAQ,CAAC,CACf,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO,IACjB,QAAQ;GACZ,0BAA0B;GAC1B,qBAAqB;GACrB,uBAAuB;EACzB;EAEA,MAAM,eAAe,cAAc;EAEnC,OAAO;CACT,QAAQ;EACN,OAAO,mBAAmB;CAC5B;AACF;;;;;;;;AASA,eAAsB,sBACpB,IACA,KACA,UAAwC,CAAC,GACR;CACjC,MAAM,WAAY,MAAM,UAAU,IAAI,YAAY,YAAY;CAG9D,IAAI,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,GAC/C,OAAO,oBAAoB,IAAI,UAAU,KAAK,OAAO;CAGvD,OAAO,kBAAkB,EAAE;AAC7B;;;;AAKA,eAAe,oBACb,IACA,UACA,KACA,UAAwC,CAAC,GACR;CACjC,IAAI;CAEJ,IAAI,QAAQ,WACV,UAAU,SAAS,MAAM,MAAM,EAAE,OAAO,QAAQ,SAAS;CAI3D,IAAI,CAAC,WAAW,KAAK;EACnB,MAAM,cAAc,mBAAmB,GAAG;EAC1C,IAAI,aAEF,UAAU,sBADU,oBAAoB,UAAU,WACR,GAAG,QAAQ,QAAQ;CAEjE;CAKA,IAAI,CAAC,SAAS;EACZ,MAAM,YAAY,MAAM,UAAU,IAAI,YAAY,mBAAmB;EACrE,IAAI,WAAW;GACb,MAAM,iBAAiB,SAAS,MAAM,MAAM,EAAE,OAAO,SAAS;GAC9D,IAAI,gBAAgB;IAClB,IAAI,CAAC,KACH,UAAU;SACL;KACL,MAAM,cAAc,mBAAmB,GAAG;KAC1C,IAAI,eAAe,eAAe,aAAa;MAC7C,MAAM,QAAQ,aAAa,YAAY;MACvC,MAAM,UAAU,eAAe,YAAY,YAAY;MACvD,IAAI,OAAO,SAAS,OAAO,GACzB,UAAU;KAEd;IACF;GACF;EACF;CACF;CAGA,IAAI,CAAC,WAAW,CAAC,OAAO,QAAQ,UAC9B,UAAU,sBAAsB,UAAU,QAAQ,QAAQ;CAI5D,IAAI,CAAC,WAAW,CAAC,KACf,UAAU,SAAS;CAGrB,IAAI,CAAC,SACH,OAAO;EACL,UAAU;EACV,aAAa;EACb,YAAY;EACZ,UAAU;EACV,UAAU;EACV,OAAO;EACP,UAAU;CACZ;CAGF,IAAI,wBAAwB,SAAS,OAAO,GAC1C,UAAU,MAAM,uBAAuB,IAAI,UAAU,OAAO;CAG9D,MAAM,WACJ,QAAQ,YAAY,eAAe,QAAQ,eAAe,EAAE;CAE9D,IAAI,mBAAmB,OAAO,MAAM,WAAW,QAAQ,qBACrD,OAAO;EACL,WAAW,QAAQ;EACnB,UAAU;EACV,aAAa,QAAQ,eAAe;EACpC,YAAY,QAAQ,cAAc;EAClC,aAAa,QAAQ,eAAe;EACpC,UAAU;EACV;EACA,gBAAgB;EAChB,OAAO;EACP,UAAU,QAAQ,YAAY;CAChC;CAGF,OAAO;EACL,WAAW,QAAQ;EACnB,UAAU,mBAAmB,OAAO;EACpC,aAAa,QAAQ,eAAe;EACpC,YAAY,QAAQ,cAAc;EAClC,aAAa,QAAQ,eAAe;EACpC,UAAU,MAAM,iBAAiB,QAAQ,QAAQ;EACjD;EACA,OAAO,MAAM,iBAAiB,QAAQ,KAAK;EAC3C,UAAU,QAAQ,YAAY;CAChC;AACF;;;;AAKA,eAAe,kBACb,IACiC;CACjC,MAAM,WAAW,MAAM,UAAU,IAAI,YAAY,SAAS;CAC1D,MAAM,cAAc,MAAM,UAAU,IAAI,YAAY,YAAY;CAEhE,OAAO;EACL,UAAU;EACV,aACG,MAAM,UAAU,IAAI,YAAY,gBAAgB,KAAM;EACzD,YAAa,MAAM,UAAU,IAAI,YAAY,eAAe,KAAM;EAClE,UAAU,cAAc,MAAM,iBAAiB,WAAW,IAAI;EAC9D,UAAU;EACV,OAAO,WAAW,MAAM,iBAAiB,QAAQ,IAAI;EACrD,UAAW,MAAM,UAAU,IAAI,YAAY,YAAY,KAAM;CAC/D;AACF"}
+{"version":3,"file":"credentials-CZbngHXW.js","names":[],"sources":["../../src/subsystems/accounts/stored-credentials.ts","../../src/subsystems/git/credentials.ts"],"sourcesContent":["export type StoredCredentialAuthMode = \"token\" | \"basic\" | \"oauth\";\n\nexport interface StoredCredentialBase {\n  id: string;\n  label: string;\n  hostPattern: string;\n  token: string;\n  basicUsername?: string;\n  authMode?: StoredCredentialAuthMode;\n}\n\nexport interface StoredCredentialOAuthFields {\n  oauthProviderId?: string;\n  oauthClientId?: string;\n  oauthClientSecret?: string;\n  accessTokenExpiresAt?: number;\n  refreshToken?: string;\n  scopes?: string[];\n  tokenType?: string;\n  oauthRefreshFailureCount?: number;\n  oauthReauthRequired?: boolean;\n  oauthReauthRequiredAt?: number;\n  /** Custom authorize URL (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomAuthorizeUrl?: string;\n  /** Custom token URL (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomTokenUrl?: string;\n  /** Custom PKCE preference (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomUsePkce?: boolean;\n  /** Custom redirect URI (used when oauthProviderId is \"custom_mcp\"). */\n  oauthCustomRedirectUri?: string;\n}\n\nexport interface PendingOAuthResult {\n  providerId: string;\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  scope?: string;\n  tokenType?: string;\n}\n\ntype OAuthCapableStoredCredential = {\n  authMode?: StoredCredentialAuthMode;\n} & StoredCredentialOAuthFields;\n\nexport function resolveStoredCredentialAuthMode(\n  credential: OAuthCapableStoredCredential | null | undefined,\n): StoredCredentialAuthMode {\n  if (!credential) {\n    return \"token\";\n  }\n\n  // Treat legacy \"pat\" string identically to \"token\" mode\n  if (\n    credential.authMode === \"token\" ||\n    (credential.authMode as string) === \"pat\"\n  ) {\n    return \"token\";\n  }\n\n  if (credential.authMode === \"basic\") {\n    return \"basic\";\n  }\n\n  if (credential.authMode === \"oauth\") {\n    return \"oauth\";\n  }\n\n  if (\n    credential.oauthProviderId ||\n    credential.oauthClientId ||\n    credential.oauthClientSecret ||\n    credential.refreshToken ||\n    credential.accessTokenExpiresAt ||\n    credential.tokenType ||\n    credential.oauthReauthRequired\n  ) {\n    return \"oauth\";\n  }\n\n  return \"token\";\n}\n","import {\n  CONFIG_KEYS,\n  getProviderTokenAuthScheme,\n} from \"../../config/config.js\";\n\nimport { resolveStoredCredentialAuthMode } from \"../accounts/stored-credentials.js\";\nimport { decryptValue, encryptValue } from \"../../security/crypto.js\";\n\nimport { getConfig } from \"../../db/get-config.js\";\nimport { setConfig } from \"../../db/set-config.js\";\n\nimport type {\n  GitAccount,\n  GitAuthMode,\n  GitProvider,\n  ResolveGitCredentialsOptions,\n  ResolvedGitCredentials,\n} from \"./types.js\";\nimport type { ShadowClawDatabase } from \"../../db/types.js\";\n\nconst OAUTH_REFRESH_WINDOW_MS = 60_000;\nconst OAUTH_REFRESH_FAILURE_THRESHOLD = 3;\n\nfunction resolveGitAuthMode(account: GitAccount): GitAuthMode {\n  return resolveStoredCredentialAuthMode(account);\n}\n\nfunction mapGitProviderToGeneralProviderId(provider: GitProvider): string {\n  switch (provider) {\n    case \"azure-devops\":\n      return \"azure_devops\";\n    default:\n      return provider;\n  }\n}\n\n/**\n * Detect the git provider type from a hostname or host pattern.\n */\nexport function detectProvider(hostPattern: string): GitProvider {\n  if (!hostPattern) {\n    return \"generic\";\n  }\n\n  const lower = hostPattern.toLowerCase();\n  if (lower.includes(\"github\")) {\n    return \"github\";\n  }\n\n  if (lower.includes(\"dev.azure.com\") || lower.includes(\"visualstudio.com\")) {\n    return \"azure-devops\";\n  }\n\n  if (lower.includes(\"gitlab\")) {\n    return \"gitlab\";\n  }\n\n  return \"generic\";\n}\n\n/**\n * Build HTTP Authorization headers for a resolved credential set.\n */\nexport function buildAuthHeaders(\n  creds: Partial<ResolvedGitCredentials> & {\n    hostPattern?: string;\n    provider?: GitProvider;\n  },\n): Record<string, string> {\n  if (creds.reauthRequired) {\n    return {};\n  }\n\n  const provider = creds.provider || detectProvider(creds.hostPattern || \"\");\n  const mappedProviderId = mapGitProviderToGeneralProviderId(provider);\n  const authMode = creds.authMode || \"token\";\n\n  // Some git providers (Azure DevOps) need Basic auth for PAT/OAuth over git HTTP.\n  if (\n    creds.token &&\n    mappedProviderId === \"azure_devops\" &&\n    getProviderTokenAuthScheme(mappedProviderId, authMode, \"git_remote\")\n      ?.headerPrefix === \"Basic \"\n  ) {\n    return { Authorization: `Basic ${btoa(\":\" + creds.token)}` };\n  }\n\n  switch (provider) {\n    case \"azure-devops\": {\n      if (creds.username && creds.password) {\n        return {\n          Authorization: `Basic ${btoa(creds.username + \":\" + creds.password)}`,\n        };\n      }\n\n      break;\n    }\n\n    default:\n      break;\n  }\n\n  if (creds.token) {\n    const scheme = getProviderTokenAuthScheme(\n      mappedProviderId,\n      authMode,\n      \"git_remote\",\n    );\n\n    if (scheme?.headerName) {\n      return {\n        [scheme.headerName]: `${scheme.headerPrefix || \"\"}${creds.token}`,\n      };\n    }\n\n    return { Authorization: `Bearer ${creds.token}` };\n  }\n\n  return {};\n}\n\n/**\n * Extract hostname + pathname from a git remote URL.\n * Returns e.g. \"dev.azure.com/exampleOrg2/project/_git/repo\" so that\n * path-based host patterns like \"dev.azure.com/exampleOrg2\" can match.\n */\nfunction extractHostAndPath(url: string): string | undefined {\n  try {\n    const parsed = new URL(url);\n    const path = parsed.pathname.replace(/\\/+$/, \"\");\n\n    return path ? parsed.hostname + path : parsed.hostname;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Find the best matching account for a URL by host (and optional path prefix).\n * When multiple accounts match, the longest (most specific) pattern wins.\n */\nfunction matchAccountsByHost(\n  accounts: GitAccount[],\n  hostAndPath: string,\n): GitAccount[] {\n  const lower = hostAndPath.toLowerCase();\n  const matches: GitAccount[] = [];\n\n  let bestLen = -1;\n  for (const a of accounts) {\n    if (!a.hostPattern) {\n      continue;\n    }\n\n    const pattern = a.hostPattern.toLowerCase();\n    if (lower.includes(pattern)) {\n      if (pattern.length > bestLen) {\n        bestLen = pattern.length;\n\n        matches.length = 0;\n        matches.push(a);\n      } else if (pattern.length === bestLen) {\n        matches.push(a);\n      }\n    }\n  }\n\n  return matches;\n}\n\nfunction pickAccountByAuthMode(\n  accounts: GitAccount[],\n  authMode?: GitAuthMode,\n): GitAccount | undefined {\n  if (!accounts.length) {\n    return undefined;\n  }\n\n  if (!authMode) {\n    return accounts[0];\n  }\n\n  const modeMatch = accounts.find(\n    (acct) => resolveGitAuthMode(acct) === authMode,\n  );\n  if (modeMatch) {\n    return modeMatch;\n  }\n\n  // Legacy accounts without explicit mode should behave as PAT accounts.\n  if (authMode === \"token\") {\n    const legacyPat = accounts.find(\n      (acct) => resolveGitAuthMode(acct) === \"token\" && !acct.authMode,\n    );\n\n    if (legacyPat) {\n      return legacyPat;\n    }\n  }\n\n  return accounts[0];\n}\n\n/**\n * Decrypt a stored encrypted value, returning undefined for empty/missing.\n */\nasync function decryptIfPresent(\n  encrypted: string | null | undefined,\n): Promise<string | undefined> {\n  if (!encrypted) {\n    return undefined;\n  }\n\n  const result = await decryptValue(encrypted);\n\n  return result ?? undefined;\n}\n\nfunction shouldRefreshOAuthToken(\n  account: GitAccount,\n  options: ResolveGitCredentialsOptions,\n): boolean {\n  if (resolveGitAuthMode(account) !== \"oauth\") {\n    return false;\n  }\n\n  if (account.oauthReauthRequired) {\n    return false;\n  }\n\n  if (\n    !account.refreshToken ||\n    !account.oauthProviderId ||\n    !account.oauthClientId\n  ) {\n    return false;\n  }\n\n  if (options.forceRefresh) {\n    return true;\n  }\n\n  if (!account.accessTokenExpiresAt) {\n    return false;\n  }\n\n  return account.accessTokenExpiresAt <= Date.now() + OAUTH_REFRESH_WINDOW_MS;\n}\n\nasync function tryRefreshOAuthAccount(\n  db: ShadowClawDatabase,\n  accounts: GitAccount[],\n  account: GitAccount,\n): Promise<GitAccount> {\n  if (\n    !account.refreshToken ||\n    !account.oauthProviderId ||\n    !account.oauthClientId\n  ) {\n    return account;\n  }\n\n  const decryptedRefreshToken = await decryptIfPresent(account.refreshToken);\n  if (!decryptedRefreshToken) {\n    return account;\n  }\n\n  const oauthClientSecret = account.oauthClientSecret\n    ? await decryptIfPresent(account.oauthClientSecret)\n    : undefined;\n\n  const persistAccount = async (updatedAccount: GitAccount) => {\n    const idx = accounts.findIndex((candidate) => candidate.id === account.id);\n    if (idx !== -1) {\n      accounts[idx] = updatedAccount;\n      await setConfig(db, CONFIG_KEYS.GIT_ACCOUNTS, accounts);\n    }\n  };\n\n  const markRefreshFailure = async (): Promise<GitAccount> => {\n    const failureCount = (account.oauthRefreshFailureCount || 0) + 1;\n    const reauthRequired = failureCount >= OAUTH_REFRESH_FAILURE_THRESHOLD;\n    const updatedAccount: GitAccount = {\n      ...account,\n      oauthRefreshFailureCount: failureCount,\n      oauthReauthRequired: reauthRequired,\n      oauthReauthRequiredAt: reauthRequired\n        ? account.oauthReauthRequiredAt || Date.now()\n        : undefined,\n    };\n\n    await persistAccount(updatedAccount);\n\n    return updatedAccount;\n  };\n\n  try {\n    const response = await fetch(\"/oauth/refresh\", {\n      body: JSON.stringify({\n        clientId: account.oauthClientId,\n        clientSecret: oauthClientSecret,\n        providerId: account.oauthProviderId,\n        refreshToken: decryptedRefreshToken,\n        scope: account.scopes,\n      }),\n      headers: {\n        \"content-type\": \"application/json\",\n      },\n      method: \"POST\",\n    });\n\n    if (!response.ok) {\n      return markRefreshFailure();\n    }\n\n    const payload = (await response.json()) as {\n      accessToken?: string;\n      expiresIn?: number;\n      refreshToken?: string;\n      scope?: string;\n      tokenType?: string;\n    };\n\n    if (!payload.accessToken) {\n      return markRefreshFailure();\n    }\n\n    const encryptedAccessToken = await encryptValue(payload.accessToken);\n    if (!encryptedAccessToken) {\n      return markRefreshFailure();\n    }\n\n    let encryptedRefreshToken = account.refreshToken;\n    if (payload.refreshToken) {\n      const maybeEncryptedRefreshToken = await encryptValue(\n        payload.refreshToken,\n      );\n\n      if (maybeEncryptedRefreshToken) {\n        encryptedRefreshToken = maybeEncryptedRefreshToken;\n      }\n    }\n\n    const updatedAccount: GitAccount = {\n      ...account,\n      token: encryptedAccessToken,\n      refreshToken: encryptedRefreshToken,\n      accessTokenExpiresAt: payload.expiresIn\n        ? Date.now() + payload.expiresIn * 1000\n        : account.accessTokenExpiresAt,\n      tokenType: payload.tokenType || account.tokenType,\n      scopes: payload.scope\n        ? payload.scope\n            .split(/[\\s,]+/)\n            .map((scope) => scope.trim())\n            .filter(Boolean)\n        : account.scopes,\n      oauthRefreshFailureCount: 0,\n      oauthReauthRequired: false,\n      oauthReauthRequiredAt: undefined,\n    };\n\n    await persistAccount(updatedAccount);\n\n    return updatedAccount;\n  } catch {\n    return markRefreshFailure();\n  }\n}\n\n/**\n * Resolve git credentials for a given operation.\n *\n * Resolution order:\n * 1. If GIT_ACCOUNTS exist, match by URL hostname → default account → first account\n * 2. Fall back to legacy single-key config (GIT_TOKEN, GIT_USERNAME, etc.)\n */\nexport async function resolveGitCredentials(\n  db: ShadowClawDatabase,\n  url?: string,\n  options: ResolveGitCredentialsOptions = {},\n): Promise<ResolvedGitCredentials> {\n  const accounts = (await getConfig(db, CONFIG_KEYS.GIT_ACCOUNTS)) as\n    GitAccount[] | undefined;\n\n  if (Array.isArray(accounts) && accounts.length > 0) {\n    return resolveFromAccounts(db, accounts, url, options);\n  }\n\n  return resolveFromLegacy(db);\n}\n\n/**\n * Resolve credentials from the multi-account list.\n */\nasync function resolveFromAccounts(\n  db: ShadowClawDatabase,\n  accounts: GitAccount[],\n  url?: string,\n  options: ResolveGitCredentialsOptions = {},\n): Promise<ResolvedGitCredentials> {\n  let account: GitAccount | undefined;\n\n  if (options.accountId) {\n    account = accounts.find((a) => a.id === options.accountId);\n  }\n\n  // Match by URL host (+ path prefix when the pattern includes a path)\n  if (!account && url) {\n    const hostAndPath = extractHostAndPath(url);\n    if (hostAndPath) {\n      const hostMatches = matchAccountsByHost(accounts, hostAndPath);\n      account = pickAccountByAuthMode(hostMatches, options.authMode);\n    }\n  }\n\n  // Fall back to default account (only when no URL was provided, or the\n  // default account's host matches the URL). Sending unrelated credentials\n  // to a public repo host causes a 401 even though the repo is public.\n  if (!account) {\n    const defaultId = await getConfig(db, CONFIG_KEYS.GIT_DEFAULT_ACCOUNT);\n    if (defaultId) {\n      const defaultAccount = accounts.find((a) => a.id === defaultId);\n      if (defaultAccount) {\n        if (!url) {\n          account = defaultAccount;\n        } else {\n          const hostAndPath = extractHostAndPath(url);\n          if (hostAndPath && defaultAccount.hostPattern) {\n            const lower = hostAndPath?.toLowerCase();\n            const pattern = defaultAccount.hostPattern.toLowerCase();\n            if (lower?.includes(pattern)) {\n              account = defaultAccount;\n            }\n          }\n        }\n      }\n    }\n  }\n\n  // Fall back to first account matching requested mode\n  if (!account && !url && options.authMode) {\n    account = pickAccountByAuthMode(accounts, options.authMode);\n  }\n\n  // Fall back to first account\n  if (!account && !url) {\n    account = accounts[0];\n  }\n\n  if (!account) {\n    return {\n      authMode: \"token\",\n      authorEmail: undefined,\n      authorName: undefined,\n      password: undefined,\n      provider: \"generic\",\n      token: undefined,\n      username: undefined,\n    };\n  }\n\n  if (shouldRefreshOAuthToken(account, options)) {\n    account = await tryRefreshOAuthAccount(db, accounts, account);\n  }\n\n  const provider =\n    account.provider || detectProvider(account.hostPattern || \"\");\n\n  if (resolveGitAuthMode(account) === \"oauth\" && account.oauthReauthRequired) {\n    return {\n      accountId: account.id,\n      authMode: \"oauth\",\n      authorEmail: account.authorEmail || undefined,\n      authorName: account.authorName || undefined,\n      hostPattern: account.hostPattern || undefined,\n      password: undefined,\n      provider,\n      reauthRequired: true,\n      token: undefined,\n      username: account.username || undefined,\n    };\n  }\n\n  return {\n    accountId: account.id,\n    authMode: resolveGitAuthMode(account),\n    authorEmail: account.authorEmail || undefined,\n    authorName: account.authorName || undefined,\n    hostPattern: account.hostPattern || undefined,\n    password: await decryptIfPresent(account.password),\n    provider,\n    token: await decryptIfPresent(account.token),\n    username: account.username || undefined,\n  };\n}\n\n/**\n * Resolve credentials from legacy single-key config.\n */\nasync function resolveFromLegacy(\n  db: ShadowClawDatabase,\n): Promise<ResolvedGitCredentials> {\n  const encToken = await getConfig(db, CONFIG_KEYS.GIT_TOKEN);\n  const encPassword = await getConfig(db, CONFIG_KEYS.GIT_PASSWORD);\n\n  return {\n    authMode: \"token\",\n    authorEmail:\n      (await getConfig(db, CONFIG_KEYS.GIT_AUTHOR_EMAIL)) || undefined,\n    authorName: (await getConfig(db, CONFIG_KEYS.GIT_AUTHOR_NAME)) || undefined,\n    password: encPassword ? await decryptIfPresent(encPassword) : undefined,\n    provider: \"generic\" as GitProvider,\n    token: encToken ? await decryptIfPresent(encToken) : undefined,\n    username: (await getConfig(db, CONFIG_KEYS.GIT_USERNAME)) || undefined,\n  };\n}\n"],"mappings":";;;;;;AA6CA,SAAgB,gCACd,YAC0B;CAC1B,IAAI,CAAC,YACH,OAAO;CAIT,IACE,WAAW,aAAa,WACvB,WAAW,aAAwB,OAEpC,OAAO;CAGT,IAAI,WAAW,aAAa,SAC1B,OAAO;CAGT,IAAI,WAAW,aAAa,SAC1B,OAAO;CAGT,IACE,WAAW,mBACX,WAAW,iBACX,WAAW,qBACX,WAAW,gBACX,WAAW,wBACX,WAAW,aACX,WAAW,qBAEX,OAAO;CAGT,OAAO;AACT;;;;AC7DA,MAAM,0BAA0B;AAChC,MAAM,kCAAkC;AAExC,SAAS,mBAAmB,SAAkC;CAC5D,OAAO,gCAAgC,OAAO;AAChD;AAEA,SAAS,kCAAkC,UAA+B;CACxE,QAAQ,UAAR;EACE,KAAK,gBACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,SAAgB,eAAe,aAAkC;CAC/D,IAAI,CAAC,aACH,OAAO;CAGT,MAAM,QAAQ,YAAY,YAAY;CACtC,IAAI,MAAM,SAAS,QAAQ,GACzB,OAAO;CAGT,IAAI,MAAM,SAAS,eAAe,KAAK,MAAM,SAAS,kBAAkB,GACtE,OAAO;CAGT,IAAI,MAAM,SAAS,QAAQ,GACzB,OAAO;CAGT,OAAO;AACT;;;;AAKA,SAAgB,iBACd,OAIwB;CACxB,IAAI,MAAM,gBACR,OAAO,CAAC;CAGV,MAAM,WAAW,MAAM,YAAY,eAAe,MAAM,eAAe,EAAE;CACzE,MAAM,mBAAmB,kCAAkC,QAAQ;CACnE,MAAM,WAAW,MAAM,YAAY;CAGnC,IACE,MAAM,SACN,qBAAqB,kBACrB,2BAA2B,kBAAkB,UAAU,YAAY,CAAC,EAChE,iBAAiB,UAErB,OAAO,EAAE,eAAe,SAAS,KAAK,MAAM,MAAM,KAAK,IAAI;CAG7D,QAAQ,UAAR;EACE,KAAK,gBACH,IAAI,MAAM,YAAY,MAAM,UAC1B,OAAO,EACL,eAAe,SAAS,KAAK,MAAM,WAAW,MAAM,MAAM,QAAQ,IACpE;CAQN;CAEA,IAAI,MAAM,OAAO;EACf,MAAM,SAAS,2BACb,kBACA,UACA,YACF;EAEA,IAAI,QAAQ,YACV,OAAO,GACJ,OAAO,aAAa,GAAG,OAAO,gBAAgB,KAAK,MAAM,QAC5D;EAGF,OAAO,EAAE,eAAe,UAAU,MAAM,QAAQ;CAClD;CAEA,OAAO,CAAC;AACV;;;;;;AAOA,SAAS,mBAAmB,KAAiC;CAC3D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,MAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;EAE/C,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO;CAChD,QAAQ;EACN;CACF;AACF;;;;;AAMA,SAAS,oBACP,UACA,aACc;CACd,MAAM,QAAQ,YAAY,YAAY;CACtC,MAAM,UAAwB,CAAC;CAE/B,IAAI,UAAU;CACd,KAAK,MAAM,KAAK,UAAU;EACxB,IAAI,CAAC,EAAE,aACL;EAGF,MAAM,UAAU,EAAE,YAAY,YAAY;EAC1C,IAAI,MAAM,SAAS,OAAO,GAAG;GAC3B,IAAI,QAAQ,SAAS,SAAS;IAC5B,UAAU,QAAQ;IAElB,QAAQ,SAAS;IACjB,QAAQ,KAAK,CAAC;GAChB,OAAO,IAAI,QAAQ,WAAW,SAC5B,QAAQ,KAAK,CAAC;EAElB;CACF;CAEA,OAAO;AACT;AAEA,SAAS,sBACP,UACA,UACwB;CACxB,IAAI,CAAC,SAAS,QACZ;CAGF,IAAI,CAAC,UACH,OAAO,SAAS;CAGlB,MAAM,YAAY,SAAS,MACxB,SAAS,mBAAmB,IAAI,MAAM,QACzC;CACA,IAAI,WACF,OAAO;CAIT,IAAI,aAAa,SAAS;EACxB,MAAM,YAAY,SAAS,MACxB,SAAS,mBAAmB,IAAI,MAAM,WAAW,CAAC,KAAK,QAC1D;EAEA,IAAI,WACF,OAAO;CAEX;CAEA,OAAO,SAAS;AAClB;;;;AAKA,eAAe,iBACb,WAC6B;CAC7B,IAAI,CAAC,WACH;CAKF,OAAO,MAFc,aAAa,SAAS,KAE1B;AACnB;AAEA,SAAS,wBACP,SACA,SACS;CACT,IAAI,mBAAmB,OAAO,MAAM,SAClC,OAAO;CAGT,IAAI,QAAQ,qBACV,OAAO;CAGT,IACE,CAAC,QAAQ,gBACT,CAAC,QAAQ,mBACT,CAAC,QAAQ,eAET,OAAO;CAGT,IAAI,QAAQ,cACV,OAAO;CAGT,IAAI,CAAC,QAAQ,sBACX,OAAO;CAGT,OAAO,QAAQ,wBAAwB,KAAK,IAAI,IAAI;AACtD;AAEA,eAAe,uBACb,IACA,UACA,SACqB;CACrB,IACE,CAAC,QAAQ,gBACT,CAAC,QAAQ,mBACT,CAAC,QAAQ,eAET,OAAO;CAGT,MAAM,wBAAwB,MAAM,iBAAiB,QAAQ,YAAY;CACzE,IAAI,CAAC,uBACH,OAAO;CAGT,MAAM,oBAAoB,QAAQ,oBAC9B,MAAM,iBAAiB,QAAQ,iBAAiB,IAChD;CAEJ,MAAM,iBAAiB,OAAO,mBAA+B;EAC3D,MAAM,MAAM,SAAS,WAAW,cAAc,UAAU,OAAO,QAAQ,EAAE;EACzE,IAAI,QAAQ,IAAI;GACd,SAAS,OAAO;GAChB,MAAM,UAAU,IAAI,YAAY,cAAc,QAAQ;EACxD;CACF;CAEA,MAAM,qBAAqB,YAAiC;EAC1D,MAAM,gBAAgB,QAAQ,4BAA4B,KAAK;EAC/D,MAAM,iBAAiB,gBAAgB;EACvC,MAAM,iBAA6B;GACjC,GAAG;GACH,0BAA0B;GAC1B,qBAAqB;GACrB,uBAAuB,iBACnB,QAAQ,yBAAyB,KAAK,IAAI,IAC1C;EACN;EAEA,MAAM,eAAe,cAAc;EAEnC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,kBAAkB;GAC7C,MAAM,KAAK,UAAU;IACnB,UAAU,QAAQ;IAClB,cAAc;IACd,YAAY,QAAQ;IACpB,cAAc;IACd,OAAO,QAAQ;GACjB,CAAC;GACD,SAAS,EACP,gBAAgB,mBAClB;GACA,QAAQ;EACV,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,OAAO,mBAAmB;EAG5B,MAAM,UAAW,MAAM,SAAS,KAAK;EAQrC,IAAI,CAAC,QAAQ,aACX,OAAO,mBAAmB;EAG5B,MAAM,uBAAuB,MAAM,aAAa,QAAQ,WAAW;EACnE,IAAI,CAAC,sBACH,OAAO,mBAAmB;EAG5B,IAAI,wBAAwB,QAAQ;EACpC,IAAI,QAAQ,cAAc;GACxB,MAAM,6BAA6B,MAAM,aACvC,QAAQ,YACV;GAEA,IAAI,4BACF,wBAAwB;EAE5B;EAEA,MAAM,iBAA6B;GACjC,GAAG;GACH,OAAO;GACP,cAAc;GACd,sBAAsB,QAAQ,YAC1B,KAAK,IAAI,IAAI,QAAQ,YAAY,MACjC,QAAQ;GACZ,WAAW,QAAQ,aAAa,QAAQ;GACxC,QAAQ,QAAQ,QACZ,QAAQ,MACL,MAAM,QAAQ,CAAC,CACf,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO,IACjB,QAAQ;GACZ,0BAA0B;GAC1B,qBAAqB;GACrB,uBAAuB;EACzB;EAEA,MAAM,eAAe,cAAc;EAEnC,OAAO;CACT,QAAQ;EACN,OAAO,mBAAmB;CAC5B;AACF;;;;;;;;AASA,eAAsB,sBACpB,IACA,KACA,UAAwC,CAAC,GACR;CACjC,MAAM,WAAY,MAAM,UAAU,IAAI,YAAY,YAAY;CAG9D,IAAI,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,GAC/C,OAAO,oBAAoB,IAAI,UAAU,KAAK,OAAO;CAGvD,OAAO,kBAAkB,EAAE;AAC7B;;;;AAKA,eAAe,oBACb,IACA,UACA,KACA,UAAwC,CAAC,GACR;CACjC,IAAI;CAEJ,IAAI,QAAQ,WACV,UAAU,SAAS,MAAM,MAAM,EAAE,OAAO,QAAQ,SAAS;CAI3D,IAAI,CAAC,WAAW,KAAK;EACnB,MAAM,cAAc,mBAAmB,GAAG;EAC1C,IAAI,aAEF,UAAU,sBADU,oBAAoB,UAAU,WACR,GAAG,QAAQ,QAAQ;CAEjE;CAKA,IAAI,CAAC,SAAS;EACZ,MAAM,YAAY,MAAM,UAAU,IAAI,YAAY,mBAAmB;EACrE,IAAI,WAAW;GACb,MAAM,iBAAiB,SAAS,MAAM,MAAM,EAAE,OAAO,SAAS;GAC9D,IAAI,gBAAgB;IAClB,IAAI,CAAC,KACH,UAAU;SACL;KACL,MAAM,cAAc,mBAAmB,GAAG;KAC1C,IAAI,eAAe,eAAe,aAAa;MAC7C,MAAM,QAAQ,aAAa,YAAY;MACvC,MAAM,UAAU,eAAe,YAAY,YAAY;MACvD,IAAI,OAAO,SAAS,OAAO,GACzB,UAAU;KAEd;IACF;GACF;EACF;CACF;CAGA,IAAI,CAAC,WAAW,CAAC,OAAO,QAAQ,UAC9B,UAAU,sBAAsB,UAAU,QAAQ,QAAQ;CAI5D,IAAI,CAAC,WAAW,CAAC,KACf,UAAU,SAAS;CAGrB,IAAI,CAAC,SACH,OAAO;EACL,UAAU;EACV,aAAa;EACb,YAAY;EACZ,UAAU;EACV,UAAU;EACV,OAAO;EACP,UAAU;CACZ;CAGF,IAAI,wBAAwB,SAAS,OAAO,GAC1C,UAAU,MAAM,uBAAuB,IAAI,UAAU,OAAO;CAG9D,MAAM,WACJ,QAAQ,YAAY,eAAe,QAAQ,eAAe,EAAE;CAE9D,IAAI,mBAAmB,OAAO,MAAM,WAAW,QAAQ,qBACrD,OAAO;EACL,WAAW,QAAQ;EACnB,UAAU;EACV,aAAa,QAAQ,eAAe;EACpC,YAAY,QAAQ,cAAc;EAClC,aAAa,QAAQ,eAAe;EACpC,UAAU;EACV;EACA,gBAAgB;EAChB,OAAO;EACP,UAAU,QAAQ,YAAY;CAChC;CAGF,OAAO;EACL,WAAW,QAAQ;EACnB,UAAU,mBAAmB,OAAO;EACpC,aAAa,QAAQ,eAAe;EACpC,YAAY,QAAQ,cAAc;EAClC,aAAa,QAAQ,eAAe;EACpC,UAAU,MAAM,iBAAiB,QAAQ,QAAQ;EACjD;EACA,OAAO,MAAM,iBAAiB,QAAQ,KAAK;EAC3C,UAAU,QAAQ,YAAY;CAChC;AACF;;;;AAKA,eAAe,kBACb,IACiC;CACjC,MAAM,WAAW,MAAM,UAAU,IAAI,YAAY,SAAS;CAC1D,MAAM,cAAc,MAAM,UAAU,IAAI,YAAY,YAAY;CAEhE,OAAO;EACL,UAAU;EACV,aACG,MAAM,UAAU,IAAI,YAAY,gBAAgB,KAAM;EACzD,YAAa,MAAM,UAAU,IAAI,YAAY,eAAe,KAAM;EAClE,UAAU,cAAc,MAAM,iBAAiB,WAAW,IAAI;EAC9D,UAAU;EACV,OAAO,WAAW,MAAM,iBAAiB,QAAQ,IAAI;EACrD,UAAW,MAAM,UAAU,IAAI,YAAY,YAAY,KAAM;CAC/D;AACF"}

package/dist/lib/{discover-skills-CD0sKvAI.js → discover-skills-CXyaWHKi.js}

@@ -1,22 +1,22 @@
 import { i as __toESM } from "./rolldown-runtime-DwyhSnWe.js";
 import { o as getDb, t as getConfig } from "./get-config-BWhs5HFF.js";
-import { m as isHeadlessMode, n as getGroupDir } from "./parse-path-DPCn-HwI.js";
+import { m as isHeadlessMode, n as getGroupDir } from "./parse-path-BOHQP_IQ.js";
 import { t as require_browser } from "./browser-sqa-Vhnx.js";
-import { F as getProvider, R as modelRegistry, c as DEFAULT_PROMPT_API_FALLBACK_MODEL, o as DEFAULT_GROUP_ID, r as CONFIG_KEYS } from "./config-DxNI3TlW.js";
-import { d as readGroupFile, n as parseSkill, t as toolsStore, u as getAllTasks } from "./tools-Beuyh8y1.js";
-import { g as saveMessage, h as saveTask, t as orchestratorStore, x as deleteTask } from "./orchestrator-i_QJ-o22.js";
+import { F as getProvider, R as modelRegistry, c as DEFAULT_PROMPT_API_FALLBACK_MODEL, o as DEFAULT_GROUP_ID, r as CONFIG_KEYS } from "./config-BrHR97zt.js";
+import { d as readGroupFile, n as parseSkill, t as toolsStore, u as getAllTasks } from "./tools-B8OJ4sMF.js";
+import { g as saveMessage, h as saveTask, t as orchestratorStore, x as deleteTask } from "./orchestrator-cRBe3lhq.js";
 import { ulid } from "./utils/ulid.js";
-import { t as getOrCreateSubscriberId } from "./get-or-create-subscriber-id-HCcgDEPz.js";
+import { t as getOrCreateSubscriberId } from "./get-or-create-subscriber-id-wyzaML7Z.js";
 import { o as showToast } from "./toast-Ck7OIKDf.js";
 import { r as isLlamafileResolutionError } from "./llamafile-Ccnf5VwR.js";
-import { i as detectProviderHelpType, n as isTransformersJsResolutionError } from "./transformers-DydnReu4.js";
+import { i as detectProviderHelpType, n as isTransformersJsResolutionError } from "./transformers-BMURofG6.js";
 import { a as leaveRoom, r as inviteToRoom, t as createRoom } from "./room-QujMjoxG.js";
-import { a as getApiKeyForRequest, b as stopTransformersProgressPolling, l as getProviderRuntimeHeaders } from "./provider-DcQZypu5.js";
-import { r as getModelAttachmentCapabilities } from "./attachment-capabilities-Dbb-4ZP5.js";
-import { r as getPushUrl } from "./push-client-Cx5rMs6J.js";
-import { o as getChannelTypeForGroup } from "./channel-Dlru5ofR.js";
-import { a as roomIdFromGroupId } from "./rooms-CwlkYLDU.js";
-import { l as getRemoteMcpConnection, t as reconnectMcpOAuth } from "./mcp-reconnect-3T7yWGEY.js";
+import { a as getApiKeyForRequest, b as stopTransformersProgressPolling, l as getProviderRuntimeHeaders } from "./provider-BC9KPI14.js";
+import { r as getModelAttachmentCapabilities } from "./attachment-capabilities-BjkEPip8.js";
+import { r as getPushUrl } from "./push-client-CAm6UMvE.js";
+import { o as getChannelTypeForGroup } from "./channel-DB77spML.js";
+import { a as roomIdFromGroupId } from "./rooms-Dzphx3rK.js";
+import { l as getRemoteMcpConnection, t as reconnectMcpOAuth } from "./mcp-reconnect-BeqQvNWO.js";
 import { n as createModelCacheFetch } from "./create-model-cache-fetch-D7Pm4xNT.js";
 
 //#region src/ui/audio.ts
@@ -2535,4 +2535,4 @@ async function listSkillResources(db, groupId, basePath) {
 
 //#endregion
 export { deliverResponse as _, shouldDeferTaskToServer as a, ensureBuiltinAiPolyfills as c, buildHeaders as d, formatRequest as f, sanitizeModelOutput as g, parseResponse as h, runTaskAsScheduled as i, getPromptApiFallbackModel as l, normalizeMeshLlmResult as m, loadSkill as n, executeNativeAiTask as o, getContextLimit as p, handleWorkerMessage as r, createTaskInstanceWithFallback as s, discoverSkills as t, summarizeText as u };
-//# sourceMappingURL=discover-skills-CD0sKvAI.js.map
+//# sourceMappingURL=discover-skills-CXyaWHKi.js.map