specrails-desktop 2.36.0 → 2.42.2

package/server/dist/chat-manager.js

@@ -14,6 +14,7 @@ const explore_cwd_manager_1 = require("./explore-cwd-manager");
 const ai_invocations_1 = require("./ai-invocations");
 const result_event_1 = require("./result-event");
 const crypto_1 = require("crypto");
+const codex_spawn_1 = require("./plugins/codex-spawn");
 const spec_draft_parser_1 = require("./spec-draft-parser");
 const attachment_manager_1 = require("./attachment-manager");
 const providers_1 = require("./providers");
@@ -25,6 +26,7 @@ const explore_stdin_session_1 = require("./explore-stdin-session");
 const workspace_resolution_1 = require("./workspace-resolution");
 const workspace_manager_1 = require("./workspace-manager");
 const blueprint_render_1 = require("./blueprint-render");
+const spec_contract_prompt_1 = require("./spec-contract-prompt");
 const explore_draft_title_1 = require("./explore-draft-title");
 const COMMAND_INSTRUCTION = 'When you want to suggest a SpecRails command for the user to execute, wrap it in a command block like this: ' +
     ':::command\n/specrails:implement #42\n::: ' +
@@ -133,6 +135,7 @@ exports.EXPLORE_MAX_CONCURRENCY = 5;
 exports.EXPLORE_QUEUE_TIMEOUT_MS = 30 * 1000;
 // ─── ChatManager ──────────────────────────────────────────────────────────────
 class ChatManager {
+    projectRepositories;
     _broadcast;
     _db;
     _activeProcesses;
@@ -190,7 +193,8 @@ class ChatManager {
     _adapter;
     _projectId;
     _projectSlug;
-    constructor(broadcast, db, cwd, projectName, provider, projectId, projectSlug) {
+    constructor(broadcast, db, cwd, projectName, provider, projectId, projectSlug, projectRepositories) {
+        this.projectRepositories = projectRepositories;
         this._broadcast = broadcast;
         this._db = db;
         this._cwd = cwd;
@@ -713,26 +717,21 @@ class ChatManager {
             '- dependsOnIndex is optional. When present it must point strictly backward to an earlier item in this batch;',
             '  the first item always omits it. Never point to the same item or a later item.',
             '',
-            '## Canonical description contract',
+            '## Canonical description contract (premium bar)',
             '',
-            'description is English markdown with exactly these five ## headings, once each and in this order:',
-            '1. ## Problem Statement — the concrete user/system problem confirmed by the blueprint and current code.',
-            '2. ## Proposed Solution — observable behavior and integration with verified existing components/contracts.',
-            '3. ## Out of Scope — at least two bullets naming adjacent work deliberately deferred.',
-            '4. ## Technical Considerations — at least two bullets naming only verified paths and identifiers, plus data/contracts,',
-            '   compatibility, risks, failure handling, observability, migrations, and test strategy where relevant.',
-            '5. ## Estimated Complexity — Low/Medium/High/Very High plus one sentence explaining the estimate.',
-            'Do NOT put an ## Acceptance Criteria heading in description. The app folds the separate criteria array into',
-            'the final ticket deterministically.',
+            ...(0, spec_contract_prompt_1.premiumSpecContract)('verified').split('\n'),
             '',
             '## Acceptance and self-audit',
             '',
-            '- acceptanceCriteria contains 4-10 non-empty, independent, testable outcomes rather than implementation steps.',
+            '- Every spec MUST reach the premium depth above; a restated title is a defect. Add code-grounded reports',
+            '  of what exists today where it sharpens the Problem Statement or the Proposed Solution.',
+            '- acceptanceCriteria contains 6-10 non-empty, independent, testable outcomes rather than implementation steps.',
             '- Across the criteria, cover intended functional behavior, observable failure/edge cases, compatibility where',
             '  relevant, and the automated unit/integration/end-to-end tests that prove the change.',
-            '- Before specsComplete: true, audit every item for all payload fields, exact heading names/order, non-empty',
-            '  sections, English content, 4-10 criteria, valid priority, milestone plus domain labels, unique titles,',
-            '  verified code references, and strictly backward dependencies. Repair failures before marking complete.',
+            '- Before specsComplete: true, audit every item for all payload fields, exact heading names/order, the ###',
+            '  sub-blocks, the depth floors, non-empty sections, English content, 6-10 criteria, valid priority, milestone',
+            '  plus domain labels, unique titles, verified code references, and strictly backward dependencies. Repair',
+            '  failures before marking complete.',
         ];
         if (execution?.relocated && execution.repoDir) {
             lines.push('', '## Repository location (relocated project)', '', 'The process cwd is a Specrails workspace containing configuration and artifacts, NOT the source repository.', `The real source repository is at this absolute path: ${execution.repoDir}`, 'The same repository is mounted from the workspace as ./project and exported in SPECRAILS_REPO_DIR.', 'Use the absolute path above or ./project for every source list/search/read. Read/Grep/Glob tools do not expand', 'shell-variable expressions, so never pass literal ${SPECRAILS_REPO_DIR} or ${SPECRAILS_REPO_DIR:-.} as a path.', 'When writing specs, cite verified paths relative to the real repository (for example src/...), never paths', 'under the workspace and never a misleading project/ or .specrails/ prefix.');
@@ -913,6 +912,12 @@ class ChatManager {
                 : lightweight
                     ? this._buildLightweightSystemPrompt(conversationScope)
                     : this._buildSystemPrompt();
+            if (conversation.kind === 'explore') {
+                const repositories = this.projectRepositories?.() ?? [];
+                if (repositories.length > 1) {
+                    systemPrompt += `\n\nThis logical project shares one backlog across these repositories: ${JSON.stringify(repositories.map(({ id, name, path, isPrimary, kind }) => ({ id, name, path, isPrimary, kind })))}. Use these exact IDs in the optional repositoryIds array of spec-draft blocks to scope a spec to one or several repositories. Missing repositoryIds defaults to primary. Preserve the user's selected scope, describe shared contracts for cross-repository specs, and never invent repository IDs or split a spec merely because it touches several repos.`;
+                }
+            }
             if (hasAttachments)
                 systemPrompt = `${systemPrompt}\n\n${attachment_manager_1.USER_ATTACHMENT_SYSTEM_NOTE}`;
             const binary = adapter.binary;
@@ -935,6 +940,9 @@ class ChatManager {
             const scopeFlags = conversationScope && adapter.id === 'claude'
                 ? (0, context_scope_1.toolFlagsForScope)(conversationScope).args
                 : [];
+            if (this._cwd && conversation.kind !== 'milestone' && (!conversationScope || conversationScope.mcp)) {
+                scopeFlags.push(...(0, codex_spawn_1.buildCodexPluginArgs)({ providerId: adapter.id, stateRoot: this._specrailsRoot() ?? this._cwd, repositoryPath: this._cwd, legacyProviderId: this._adapter.id }));
+            }
             // Inject the user's OWN already-approved MCP servers when scope.userMcp is
             // on. Claude-only via `--mcp-config` (codex reads ~/.codex natively, so
             // buildUserMcpArgs returns []). Independent of the `mcp` toggle (project

package/server/dist/chromium-archive.cjs

@@ -0,0 +1,83 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const { execFile } = require('node:child_process')
+
+const MAX_ENTRIES = 100_000
+const MAX_DEPTH = 24
+
+function validateArchiveNames(listing, { platform = process.platform } = {}) {
+  const names = listing.split(/\r?\n/).filter(Boolean)
+  assert(names.length > 0 && names.length <= MAX_ENTRIES, 'Chromium archive is empty or exceeds its entry limit.')
+  for (const name of names) {
+    assert(!/^[\\/]|^[A-Za-z]:|[\x00-\x1f\x7f]/.test(name) && !name.includes('\\') && !name.split('/').includes('..'), `Unsafe Chromium archive path: ${name}`)
+    if (platform === 'win32') {
+      for (const component of name.split('/').filter(part => part !== '' && part !== '.')) {
+        assert(!/[:<>"|?*]|[ .]$/.test(component), `Unsafe Windows Chromium archive path: ${name}`)
+        const stem = component.split('.')[0].replace(/[ .]+$/g, '')
+        assert(!/^(?:CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[1-9¹²³]|LPT[1-9¹²³])$/i.test(stem), `Reserved Windows Chromium archive path: ${name}`)
+      }
+    }
+  }
+}
+
+function validateWindowsArchiveTypes(listing) {
+  const entries = listing.split(/\r?\n/).filter(Boolean)
+  assert(entries.length > 0 && entries.length <= MAX_ENTRIES, 'Chromium archive is empty or exceeds its entry limit.')
+  for (const entry of entries) {
+    // bsdtar (the Windows system tar) resolves GNU/PAX extensions before listing
+    // the entry type. Only the fixed permission field matters, never translated
+    // dates/owners or a textual link target. Windows Chromium needs no links.
+    assert(/^[-d][rwxStTs-]{9}[+@.]?\s/.test(entry), 'Windows Chromium archives must contain only regular files and directories; links and special entries are not allowed.')
+  }
+}
+
+function runTar(binary, args, { timeout = 180_000, maxBytes = 12 * 1024 * 1024, env } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(binary, args, { timeout, maxBuffer: maxBytes, env, encoding: 'utf8', windowsHide: true }, (error, stdout) => {
+      if (error) reject(error)
+      else resolve(stdout)
+    })
+  })
+}
+
+/** Admission must finish before any extraction. Windows tar.exe does not
+ * reliably reject writes through an archive-created link, unlike POSIX tar. */
+async function validateChromiumArchive(archivePath, { platform = process.platform, run = runTar } = {}) {
+  assert(fs.lstatSync(archivePath).isFile(), 'Chromium archive must be a regular file.')
+  const size = fs.statSync(archivePath).size
+  assert(size > 0 && size <= 3 * 1024 ** 3, 'Chromium archive is empty or exceeds 3 GiB.')
+  const tar = platform === 'win32' ? 'tar.exe' : '/usr/bin/tar'
+  const env = { ...process.env, LC_ALL: 'C', LANG: 'C' }
+  delete env.TAR_OPTIONS
+  validateArchiveNames(await run(tar, ['-tf', archivePath], { env }), { platform })
+  if (platform === 'win32') validateWindowsArchiveTypes(await run(tar, ['-tvf', archivePath], { env }))
+}
+
+function inside(root, candidate) {
+  const relative = path.relative(root, candidate)
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))
+}
+
+/** Validate without following directories through links. macOS versioned
+ * framework symlinks are allowed only when their resolved target stays inside. */
+function validateChromiumTree(root) {
+  const realRoot = fs.realpathSync(root)
+  let count = 0
+  const walk = (directory, depth) => {
+    assert(depth <= MAX_DEPTH, 'Chromium tree exceeds its depth limit.')
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      assert(++count <= MAX_ENTRIES, 'Chromium tree exceeds its entry limit.')
+      const file = path.join(directory, entry.name)
+      if (entry.isSymbolicLink()) assert(inside(realRoot, fs.realpathSync(file)), `Chromium link escapes the extracted tree: ${file}`)
+      else if (entry.isDirectory()) walk(file, depth + 1)
+      else assert(entry.isFile(), `Unsupported Chromium entry: ${file}`)
+    }
+  }
+  walk(realRoot, 0)
+}
+
+exports.validateArchiveNames = validateArchiveNames
+exports.validateWindowsArchiveTypes = validateWindowsArchiveTypes
+exports.validateChromiumArchive = validateChromiumArchive
+exports.validateChromiumTree = validateChromiumTree

package/server/dist/chromium-resolver.js

@@ -12,40 +12,19 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const stream_1 = require("stream");
 const promises_1 = require("stream/promises");
+const chromium_archive_cjs_1 = require("./chromium-archive.cjs");
 /**
- * Resolve the Chromium executable the browser-capture feature should launch.
+ * Discover bundled Chromium, extracting its distribution archive when necessary.
  *
- * In desktop mode (`SPECRAILS_IS_DESKTOP=1`) we ship Chromium INSIDE the app, but
- * NOT as an unpacked directory: Tauri's resource bundler dereferences symlinks when
- * it copies `bundle.resources` into the .app (tauri-apps/tauri#13219), which mangles
- * Chromium's versioned `*.framework` (the `Versions/Current` + top-level symlinks
- * become flat duplicate copies) and invalidates its code signature — macOS
- * notarization then rejects the app ("The signature of the binary is invalid").
+ * A transparent chromium.tar.gz preserves the versioned framework symlinks that
+ * Tauri resource copying would otherwise dereference. Release assembly signs and
+ * notarizes Chromium before packing it; extraction preserves that signed layout.
+ * The writable cache is an installation location, not a signing bypass.
  *
- * So we ship Chromium as a single OPAQUE, OBFUSCATED blob
- * (`<runtimes>/chromium/chromium.pak`):
- *   - It is an XOR-transformed `chromium.tar.gz`. The notarization service recursively
- *     unpacks archives it recognises (.zip → .tar.gz → .tar → …) and validates every
- *     Mach-O inside; Chromium's ~50 nested binaries are only ad-hoc ("linker") signed
- *     by Google, so a plain archive fails notarization. XOR-ing breaks the gzip/tar
- *     magic, so the notary cannot identify the file as a container and treats it as
- *     opaque data — nothing inside is inspected, and the app notarizes with NO
- *     Developer-ID signing of Chromium. (Obfuscation, not security: the key is public.)
- *   - Tauri also copies it as one regular file — nothing to dereference.
- *   - At first use we reverse the XOR and extract it to a writable cache
- *     (`~/.specrails/runtimes/chromium`), restoring the framework symlinks intact. The
- *     extracted Chromium keeps Google's ad-hoc signature, which is sufficient to execute
- *     on Apple Silicon, and — being self-extracted rather than downloaded — carries no
- *     `com.apple.quarantine` xattr, so Gatekeeper does not block it.
- *
- * A plain `chromium.tar.gz`/`chromium.tar` is also accepted (e.g. unobfuscated local
- * builds). When no archive is present (dev, a runtimes-less build, a partial
- * extraction) we fall back to discovering an UNPACKED `<runtimes>/chromium` tree, and
- * finally to `null` so Playwright uses its own managed browser — never dead-ending.
- *
- * We DISCOVER rather than hard-code the executable path because Playwright's layout
- * changes across versions (`chrome-mac/Chromium.app` → `chrome-mac-arm64/Google Chrome
- * for Testing.app`, `chrome-win/chrome.exe`, `chrome-linux/chrome`).
+ * Older bundles used an XOR-encoded chromium.pak. Decode that format only for
+ * compatibility, preferring transparent archives whenever both are present.
+ * Unpacked development bundles and Playwright-managed browsers remain fallbacks.
+ * The executable is discovered because Playwright's platform layout can change.
  */
 const MAX_DEPTH = 6;
 function isFile(p) {
@@ -155,12 +134,9 @@ function resolveBundledChromiumPath() {
     }
 }
 /** Candidate archive names under `<runtimes>/chromium`, in preference order. */
-const ARCHIVE_NAMES = ['chromium.pak', 'chromium.tar.gz', 'chromium.tar'];
-// XOR key for the obfuscated `chromium.pak` blob. Keep byte-identical to KEY in
-// scripts/obfuscate-chromium.mjs — the round-trip is covered by a unit test.
-// (Safe to have changed at the rebrand: the .pak and this binary always ship
-// together in the same bundle, and the extraction cache re-extracts on a new
-// archive via the `.source` marker.)
+const ARCHIVE_NAMES = ['chromium.tar.gz', 'chromium.tar', 'chromium.pak'];
+// Legacy archive decoding only. The bytes must remain compatible with previously
+// shipped chromium.pak files; new release assembly produces transparent archives.
 const OBFUSCATION_KEY = Buffer.from('specrails-desktop-chromium-pack-v1', 'utf8');
 /** Streaming XOR transform (symmetric: packs and unpacks). */
 function xorStream() {
@@ -185,10 +161,10 @@ function chromiumCacheDir() {
     return (process.env.SPECRAILS_CHROMIUM_CACHE_DIR ||
         path_1.default.join(os_1.default.homedir(), '.specrails', 'runtimes', 'chromium'));
 }
-/** Identity string for an archive (size:mtime) used to skip re-extraction. */
+/** Bind the extraction to the selected archive and its precise filesystem revision. */
 function archiveIdentity(archivePath) {
     const st = fs_1.default.statSync(archivePath);
-    return `${st.size}:${Math.round(st.mtimeMs)}`;
+    return JSON.stringify({ version: 2, path: fs_1.default.realpathSync(archivePath), size: st.size, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs, dev: st.dev, ino: st.ino });
 }
 /** Resolve the platform `tar` binary. macOS/Linux ship `/usr/bin/tar`; Windows 10+ ships `tar` (bsdtar) on PATH. */
 function tarBinary() {
@@ -196,12 +172,18 @@ function tarBinary() {
         return '/usr/bin/tar';
     return 'tar';
 }
-/** Extract `archivePath` into `destDir` using the system tar (auto-detects gzip). */
+/** Extract a preflight-validated archive using the system tar (auto-detects gzip). */
 function runTarExtract(archivePath, destDir) {
     return new Promise((resolve, reject) => {
-        const child = (0, child_process_1.spawn)(tarBinary(), ['-xf', archivePath, '-C', destDir], { stdio: ['ignore', 'ignore', 'pipe'] });
+        // Apple tar must restore the metadata carrying the stapled ticket. These
+        // caller overrides are appropriate for source copies, not signed bundles.
+        const env = { ...process.env };
+        delete env.TAR_OPTIONS;
+        delete env.COPYFILE_DISABLE;
+        delete env.COPY_EXTENDED_ATTRIBUTES_DISABLE;
+        const child = (0, child_process_1.spawn)(tarBinary(), ['-xf', archivePath, '-C', destDir], { stdio: ['ignore', 'ignore', 'pipe'], windowsHide: true, env });
         let stderr = '';
-        child.stderr?.on('data', (d) => { stderr += d.toString(); });
+        child.stderr?.on('data', (d) => { stderr = (stderr + d.toString()).slice(-4096); });
         child.on('error', reject);
         child.on('close', (code) => {
             if (code === 0)
@@ -211,9 +193,9 @@ function runTarExtract(archivePath, destDir) {
         });
     });
 }
-// In-process single-slot cache so concurrent / StrictMode double-invokes share one
-// extraction instead of racing. Keyed by archive identity; invalidated if it changes.
-let _extractInflight = null;
+// Share pending work and serialize replacement of the same cache directory.
+// Completed promises are removed so deleted or changed cache files are rechecked.
+const extractInflight = new Map();
 /** First archive that exists under `<runtimes>/chromium`, or null. */
 function findBundledArchive(runtimesPath) {
     for (const name of ARCHIVE_NAMES) {
@@ -223,8 +205,7 @@ function findBundledArchive(runtimesPath) {
     }
     return null;
 }
-async function extractAndDiscover(archivePath, identity) {
-    const destRoot = chromiumCacheDir();
+async function extractAndDiscover(archivePath, identity, destRoot) {
     const marker = path_1.default.join(destRoot, '.source');
     // Fast path: already extracted from this exact archive.
     try {
@@ -235,10 +216,10 @@ async function extractAndDiscover(archivePath, identity) {
         }
     }
     catch { /* not yet extracted / stale → fall through */ }
-    // Extract to a temp sibling, then atomically swap in.
-    const tmpDir = `${destRoot}.tmp-${process.pid}`;
-    fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
-    fs_1.default.mkdirSync(tmpDir, { recursive: true });
+    // Validate a complete extraction before publishing; retain the prior cache if
+    // publication fails (for example, while a running browser locks it on Windows).
+    fs_1.default.mkdirSync(path_1.default.dirname(destRoot), { recursive: true });
+    const tmpDir = fs_1.default.mkdtempSync(`${destRoot}.tmp-`);
     // An obfuscated `.pak` is XOR-decoded to a real `.tar.gz` first; plain archives
     // are fed straight to tar.
     const isPak = archivePath.endsWith('.pak');
@@ -249,7 +230,11 @@ async function extractAndDiscover(archivePath, identity) {
             await deobfuscate(archivePath, decodedTar);
             tarSource = decodedTar;
         }
+        // Windows tar can follow an archive-created link before a post-extraction
+        // check runs. Validate the complete archive before allowing any writes.
+        await (0, chromium_archive_cjs_1.validateChromiumArchive)(tarSource);
         await runTarExtract(tarSource, tmpDir);
+        (0, chromium_archive_cjs_1.validateChromiumTree)(tmpDir);
         const exeInTmp = discoverChromiumExecutable(tmpDir);
         if (!exeInTmp)
             throw new Error('no chromium executable found after extraction');
@@ -257,10 +242,29 @@ async function extractAndDiscover(archivePath, identity) {
             fs_1.default.chmodSync(exeInTmp, 0o755);
         }
         catch { /* perms best-effort */ }
-        fs_1.default.rmSync(destRoot, { recursive: true, force: true });
-        fs_1.default.mkdirSync(path_1.default.dirname(destRoot), { recursive: true });
-        fs_1.default.renameSync(tmpDir, destRoot);
-        fs_1.default.writeFileSync(marker, identity);
+        if (archiveIdentity(archivePath) !== identity)
+            throw new Error('Chromium archive changed during extraction; retry with the current bundle');
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.source'), identity);
+        const previous = `${tmpDir}.previous`;
+        let movedPrevious = false;
+        if (fs_1.default.existsSync(destRoot)) {
+            fs_1.default.renameSync(destRoot, previous);
+            movedPrevious = true;
+        }
+        try {
+            fs_1.default.renameSync(tmpDir, destRoot);
+        }
+        catch (error) {
+            if (movedPrevious)
+                fs_1.default.renameSync(previous, destRoot);
+            throw error;
+        }
+        if (movedPrevious) {
+            try {
+                fs_1.default.rmSync(previous, { recursive: true, force: true });
+            }
+            catch { /* a locked prior version can be cleaned up later */ }
+        }
         return discoverChromiumExecutable(destRoot);
     }
     finally {
@@ -272,8 +276,8 @@ async function extractAndDiscover(archivePath, identity) {
 /**
  * Resolve the bundled Chromium executable for the launch path, extracting the
  * shipped archive on first use. Returns `null` (never throws) when not in desktop
- * mode, when no bundle is present, or when extraction fails — so Playwright falls
- * back to its managed browser rather than dead-ending.
+ * mode, when no bundle is present, or when extraction fails. The caller may then
+ * try an installed Playwright-managed browser; this resolver does not download one.
  */
 async function resolveBundledChromiumExecutable() {
     if (process.env.SPECRAILS_IS_DESKTOP !== '1')
@@ -298,14 +302,18 @@ async function resolveBundledChromiumExecutable() {
     catch {
         return resolveBundledChromiumPath();
     }
-    if (_extractInflight && _extractInflight.identity === identity) {
-        return _extractInflight.promise;
-    }
-    const promise = extractAndDiscover(archivePath, identity).catch((err) => {
+    const destRoot = path_1.default.resolve(chromiumCacheDir());
+    const pending = extractInflight.get(destRoot);
+    if (pending?.identity === identity)
+        return pending.promise;
+    const extract = () => extractAndDiscover(archivePath, identity, destRoot);
+    const promise = (pending ? pending.promise.then(extract) : extract()).catch((err) => {
         console.error('[chromium-resolver] extraction failed:', err instanceof Error ? err.message : err);
-        _extractInflight = null; // allow a later retry
-        return resolveBundledChromiumPath();
+        return discoverChromiumExecutable(path_1.default.join(runtimesPath, 'chromium'));
+    }).finally(() => {
+        if (extractInflight.get(destRoot)?.promise === promise)
+            extractInflight.delete(destRoot);
     });
-    _extractInflight = { identity, promise };
+    extractInflight.set(destRoot, { identity, promise });
     return promise;
 }

package/server/dist/code-activity.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodeActivityQueryError = void 0;
+exports.parseCodeActivityQuery = parseCodeActivityQuery;
+exports.listCodeActivity = listCodeActivity;
+const node_crypto_1 = require("node:crypto");
+const project_repositories_1 = require("./project-repositories");
+class CodeActivityQueryError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.CodeActivityQueryError = CodeActivityQueryError;
+const MAX_SCAN_ROWS = 2_000;
+const MAX_SCAN_MS = 2_000;
+const BATCH_SIZE = 200;
+function scalar(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || !value.trim() || value.length > 2048)
+        throw new CodeActivityQueryError(`invalid_activity_${field}`);
+    return value;
+}
+function parseCodeActivityQuery(query, scopedRepositoryId) {
+    const repositoryId = scalar(query.repositoryId, 'repository');
+    if (scopedRepositoryId && repositoryId && repositoryId !== scopedRepositoryId)
+        throw new CodeActivityQueryError('repository_scope_mismatch');
+    const ticket = scalar(query.ticketId, 'ticket');
+    const limit = scalar(query.limit, 'limit');
+    if (ticket !== undefined && (!/^\d+$/.test(ticket) || !Number.isSafeInteger(Number(ticket)) || Number(ticket) <= 0))
+        throw new CodeActivityQueryError('invalid_activity_ticket');
+    if (limit !== undefined && (!/^\d+$/.test(limit) || Number(limit) < 1 || Number(limit) > 100))
+        throw new CodeActivityQueryError('invalid_activity_limit');
+    return {
+        repositoryId: scopedRepositoryId ?? repositoryId,
+        ticketId: ticket === undefined ? undefined : Number(ticket),
+        jobId: scalar(query.jobId, 'job'), limit: limit === undefined ? undefined : Number(limit),
+        cursor: scalar(query.cursor, 'cursor'),
+    };
+}
+/** Keyset pagination is fenced to the first request's maximum provenance ID.
+ * Newly captured events (including backdated ones) cannot move that snapshot.
+ * The cursor is a position, never authorization: every page rechecks membership,
+ * filters and current path policy. No provider or current source read is needed. */
+async function listCodeActivity(db, project, query, filterPaths) {
+    const started = Date.now();
+    const limit = query.limit ?? 50;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+        throw new CodeActivityQueryError('invalid_activity_limit');
+    const members = (0, project_repositories_1.getProjectRepositories)(project);
+    const repositories = query.repositoryId ? members.filter(repository => repository.id === query.repositoryId) : members;
+    if (!repositories.length)
+        throw new CodeActivityQueryError('repository_not_found', 404);
+    const primary = repositories.find(repository => repository.isPrimary);
+    const repositoryById = new Map(repositories.map(repository => [repository.id, repository]));
+    const scope = (0, node_crypto_1.createHash)('sha256').update(JSON.stringify({
+        projectId: project.id,
+        repositories: repositories.map(({ id, path, isPrimary }) => ({ id, path, isPrimary })).sort((a, b) => a.id.localeCompare(b.id)),
+        ticketId: query.ticketId ?? null, jobId: query.jobId ?? null,
+    })).digest('hex');
+    let cursor;
+    if (query.cursor) {
+        try {
+            if (query.cursor.length > 2048)
+                throw new Error();
+            cursor = JSON.parse(Buffer.from(query.cursor, 'base64url').toString('utf8'));
+            if (cursor.v !== 1 || cursor.scope !== scope || !Number.isSafeInteger(cursor.snapshot) || cursor.snapshot < 0 ||
+                !Number.isSafeInteger(cursor.id) || cursor.id <= 0 || cursor.id > cursor.snapshot || !Number.isSafeInteger(cursor.at))
+                throw new Error();
+        }
+        catch {
+            throw new CodeActivityQueryError('invalid_activity_cursor');
+        }
+    }
+    const snapshot = cursor?.snapshot ?? db.prepare('SELECT COALESCE(MAX(id), 0) AS id FROM file_provenance').get().id;
+    const columns = db.prepare('PRAGMA table_info(file_provenance)').all();
+    const hasRepository = columns.some(column => column.name === 'repository_id');
+    const hasDiffs = !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='file_provenance_diffs'").get();
+    const conditions = ['p.id <= ?'];
+    const parameters = [snapshot];
+    if (hasRepository) {
+        conditions.push(`(p.repository_id IN (${repositories.map(() => '?').join(',')})${primary ? ' OR p.repository_id IS NULL' : ''})`);
+        parameters.push(...repositories.map(repository => repository.id));
+    }
+    else if (!primary)
+        conditions.push('0 = 1');
+    if (query.ticketId !== undefined) {
+        conditions.push('p.ticket_id = ?');
+        parameters.push(query.ticketId);
+    }
+    if (query.jobId !== undefined) {
+        conditions.push('p.job_id = ?');
+        parameters.push(query.jobId);
+    }
+    const where = conditions.join(' AND ');
+    const join = hasDiffs ? 'LEFT JOIN file_provenance_diffs d ON d.provenance_id = p.id' : '';
+    const projection = `p.id, ${hasRepository ? 'p.repository_id' : 'NULL AS repository_id'}, p.file_path, p.ticket_id, p.job_id, p.kind, p.at, ${hasDiffs ? '(d.provenance_id IS NOT NULL) AS has_patch, d.truncated AS patch_truncated' : '0 AS has_patch, 0 AS patch_truncated'}`;
+    let last = cursor ? { at: cursor.at, id: cursor.id } : undefined;
+    const entries = [];
+    const warnings = new Set();
+    let scanned = 0;
+    let exhausted = false;
+    while (entries.length < limit && scanned < MAX_SCAN_ROWS && Date.now() - started < MAX_SCAN_MS) {
+        const rows = db.prepare(`SELECT ${projection} FROM file_provenance p ${join} WHERE ${where}
+      ${last ? 'AND (p.at < ? OR (p.at = ? AND p.id < ?))' : ''}
+      ORDER BY p.at DESC, p.id DESC LIMIT ?`).all(...parameters, ...(last ? [last.at, last.at, last.id] : []), Math.min(BATCH_SIZE, MAX_SCAN_ROWS - scanned));
+        if (!rows.length) {
+            exhausted = true;
+            break;
+        }
+        const allowedByRepository = new Map();
+        for (const repository of repositories) {
+            const paths = [...new Set(rows.filter(row => row.repository_id === repository.id || (row.repository_id == null && repository.isPrimary)).map(row => row.file_path))];
+            if (!paths.length)
+                continue;
+            const filtered = await filterPaths(repository, paths, Math.max(0, MAX_SCAN_MS - (Date.now() - started)));
+            allowedByRepository.set(repository.id, filtered.allowed);
+            if (filtered.unavailable)
+                warnings.add(`repository-unavailable:${repository.id}`);
+            else if (filtered.incomplete)
+                warnings.add(`ignore-unverified:${repository.id}`);
+        }
+        for (const row of rows) {
+            last = { at: row.at, id: row.id };
+            scanned++;
+            const repository = row.repository_id == null ? primary : repositoryById.get(row.repository_id);
+            if (repository && allowedByRepository.get(repository.id)?.has(row.file_path)) {
+                entries.push({ id: row.id, repositoryId: repository.id, repositoryName: repository.name,
+                    path: row.file_path, jobId: row.job_id, ticketId: row.ticket_id, kind: row.kind, at: row.at,
+                    hasPatch: !!row.has_patch, patchTruncated: !!row.patch_truncated });
+            }
+            if (entries.length >= limit)
+                break;
+        }
+    }
+    const more = !exhausted && last !== undefined && !!db.prepare(`SELECT 1 FROM file_provenance p WHERE ${where} AND (p.at < ? OR (p.at = ? AND p.id < ?)) LIMIT 1`).get(...parameters, last.at, last.at, last.id);
+    if (more && entries.length < limit)
+        warnings.add(scanned >= MAX_SCAN_ROWS ? 'scan-limit' : 'time-limit');
+    return {
+        entries, nextCursor: more && last ? Buffer.from(JSON.stringify({ v: 1, scope, snapshot, ...last })).toString('base64url') : null,
+        truncated: warnings.size > 0, warnings: [...warnings],
+    };
+}