terminalhire 0.42.18 → 0.42.19

package/README.md

@@ -310,6 +310,13 @@ node test/zero-egress.test.js
 uses that one answer — so reads and writes can no longer disagree about which
 environment you are on.
 
+The credential store follows that answer. Pointed at `dev.terminalhire.com` by any
+spelling (`thdev`, the variable, an MCP server entry), the CLI reads and writes
+`~/.terminalhire-dev` unless `TERMINALHIRE_DIR` names a store (`src/state-dir-pin.ts`,
+called first thing in `bin/jpi-dispatch.js`, before any subcommand loads). Production and loopback keep
+`~/.terminalhire`. Before this, only `thdev` switched stores, and every other
+spelling presented the production session to dev.
+
 The override is an **allowlist**, not a free-form URL, because this same base decides
 where your push token is presented. Only these are accepted:
 

package/dist/bin/founder-verdict-sync.js

@@ -182,7 +182,7 @@ async function syncFounderVerdicts({
     const applied = [];
     for (const t of plan) {
       try {
-        claimsModule.updateClaim(t.id, { state: t.to });
+        claimsModule.updateClaim(t.id, { state: t.to, posterVerdict: t.verdict });
         applied.push(t);
         const line = buildVerdictNotice(t);
         if (line) log(line);

package/dist/bin/jpi-bounties.js

@@ -10550,6 +10550,187 @@ var init_state_dir = __esm({
   }
 });
 
+// src/api-base.ts
+var api_base_exports = {};
+__export(api_base_exports, {
+  ApiBaseError: () => ApiBaseError,
+  DEV_API_BASE: () => DEV_API_BASE,
+  DEV_STATE_DIR_NAME: () => DEV_STATE_DIR_NAME,
+  PROD_API_BASE: () => PROD_API_BASE,
+  __resetDevMarkerLatchForTests: () => __resetDevMarkerLatchForTests,
+  formatDevMarker: () => formatDevMarker,
+  isLoopbackOrigin: () => isLoopbackOrigin,
+  isNonProdApiBase: () => isNonProdApiBase,
+  pinToDevApiBase: () => pinToDevApiBase,
+  printDevMarkerIfNeeded: () => printDevMarkerIfNeeded,
+  resolveApiBase: () => resolveApiBase,
+  resolveOAuthBase: () => resolveOAuthBase,
+  warnSharedCredentialsIfNonProd: () => warnSharedCredentialsIfNonProd
+});
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+function sanitizeOverrideForError(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return `(disallowed scheme: ${url.protocol.slice(0, -1)})`;
+    }
+    if (url.username !== "" || url.password !== "") {
+      return `${url.protocol}//***@${url.host}`;
+    }
+    return url.origin;
+  } catch {
+    return "(unparseable override)";
+  }
+}
+function isLoopbackOrigin(origin) {
+  try {
+    const host = new URL(origin).hostname;
+    return host === "localhost" || host === "127.0.0.1";
+  } catch {
+    return false;
+  }
+}
+function localApiAllowed(env) {
+  return env[ALLOW_LOCAL_API_KEY] === "1";
+}
+function pinToDevApiBase(env = process.env) {
+  env["TERMINALHIRE_API_URL"] = DEV_API_BASE;
+  env["TERMINALHIRE_DIR"] = env["TERMINALHIRE_DIR"] || join3(homedir2(), DEV_STATE_DIR_NAME);
+  return DEV_API_BASE;
+}
+function resolveApiBase(env = process.env) {
+  for (const key of ENV_KEYS) {
+    const raw = env[key];
+    if (typeof raw !== "string") continue;
+    const trimmed = raw.trim();
+    if (trimmed === "") continue;
+    const normalized = normalizeOverride(trimmed);
+    if (normalized === null) {
+      throw new ApiBaseError(
+        `terminalhire: ${key}=${sanitizeOverrideForError(trimmed)} is not an allowed API host (allowed: ${ALLOWED_DESCRIPTION}). Refusing to continue so we do not silently hit production.`
+      );
+    }
+    if (isLoopbackOrigin(normalized) && !localApiAllowed(env)) {
+      throw new ApiBaseError(
+        `terminalhire: ${key}=${normalized} is a loopback origin. Set ${ALLOW_LOCAL_API_KEY}=1 to talk to a local web app on purpose. Refusing so stored credentials cannot be exfiltrated to localhost by a poisoned override.`
+      );
+    }
+    return normalized;
+  }
+  return PROD_API_BASE;
+}
+function resolveOAuthBase(env = process.env) {
+  const base = resolveApiBase(env);
+  if (OAUTH_ALLOWED_ORIGINS.includes(base)) return base;
+  if (env[ALLOW_LOCAL_OAUTH_KEY] === "1") return base;
+  throw new ApiBaseError(
+    `terminalhire: the API base is ${base}, which is not a trusted origin for a browser sign-in. Point the CLI at ${DEV_API_BASE} for an end-to-end login, or set ${ALLOW_LOCAL_OAUTH_KEY}=1 (with ${ALLOW_LOCAL_API_KEY}=1) if you are running the web app locally on purpose. Refusing to open production sign-in while the API is local.`
+  );
+}
+function resolveApiBaseOrProd(env = process.env) {
+  try {
+    return resolveApiBase(env);
+  } catch {
+    return PROD_API_BASE;
+  }
+}
+function normalizeOverride(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.username !== "" || url.password !== "") return null;
+  const expectedProtocol = ALLOWED_HOSTS[url.hostname];
+  if (expectedProtocol === void 0) return null;
+  if (url.protocol !== expectedProtocol) return null;
+  if (url.hostname !== "localhost" && url.hostname !== "127.0.0.1" && url.port !== "") {
+    return null;
+  }
+  const rewrite = CANONICAL_REWRITES[url.hostname];
+  if (rewrite !== void 0) return rewrite;
+  return url.origin;
+}
+function isNonProdApiBase(base = resolveApiBaseOrProd()) {
+  return base !== PROD_API_BASE;
+}
+function formatDevMarker(base = resolveApiBaseOrProd()) {
+  if (!isNonProdApiBase(base)) return null;
+  let host = base;
+  try {
+    host = new URL(base).host;
+  } catch {
+  }
+  return `[dev \u2192 ${host}]`;
+}
+function printDevMarkerIfNeeded(stream = process.stderr) {
+  if (markerPrinted) return;
+  const marker = formatDevMarker();
+  if (marker === null) return;
+  markerPrinted = true;
+  try {
+    stream.write(`${marker}
+`);
+  } catch {
+  }
+}
+function __resetDevMarkerLatchForTests() {
+  markerPrinted = false;
+}
+function warnSharedCredentialsIfNonProd(base, stream = process.stderr) {
+  if (!isNonProdApiBase(base)) return;
+  if (usingSeparateStateDir()) return;
+  try {
+    stream.write(
+      "terminalhire: non-prod API base \u2014 using the same local session/push credentials as prod; do not mix environments casually.\n"
+    );
+  } catch {
+  }
+}
+function usingSeparateStateDir(env = process.env) {
+  const dir = env["TERMINALHIRE_DIR"];
+  if (dir === void 0 || dir === "") return false;
+  return dir.endsWith(DEV_STATE_DIR_NAME);
+}
+var PROD_API_BASE, DEV_API_BASE, DEV_STATE_DIR_NAME, ApiBaseError, ALLOWED_HOSTS, OAUTH_ALLOWED_ORIGINS, ALLOW_LOCAL_OAUTH_KEY, ALLOW_LOCAL_API_KEY, ALLOWED_DESCRIPTION, CANONICAL_REWRITES, ENV_KEYS, markerPrinted;
+var init_api_base = __esm({
+  "src/api-base.ts"() {
+    "use strict";
+    PROD_API_BASE = "https://terminalhire.com";
+    DEV_API_BASE = "https://dev.terminalhire.com";
+    DEV_STATE_DIR_NAME = ".terminalhire-dev";
+    ApiBaseError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ApiBaseError";
+      }
+    };
+    ALLOWED_HOSTS = {
+      "terminalhire.com": "https:",
+      "www.terminalhire.com": "https:",
+      "dev.terminalhire.com": "https:",
+      localhost: "http:",
+      "127.0.0.1": "http:"
+    };
+    OAUTH_ALLOWED_ORIGINS = [PROD_API_BASE, DEV_API_BASE];
+    ALLOW_LOCAL_OAUTH_KEY = "TERMINALHIRE_ALLOW_LOCAL_OAUTH";
+    ALLOW_LOCAL_API_KEY = "TERMINALHIRE_ALLOW_LOCAL_API";
+    ALLOWED_DESCRIPTION = [
+      PROD_API_BASE,
+      DEV_API_BASE,
+      `http://localhost:<port> (requires ${ALLOW_LOCAL_API_KEY}=1)`,
+      `http://127.0.0.1:<port> (requires ${ALLOW_LOCAL_API_KEY}=1)`
+    ].join(", ");
+    CANONICAL_REWRITES = {
+      "www.terminalhire.com": PROD_API_BASE
+    };
+    ENV_KEYS = ["TERMINALHIRE_API_URL", "JPI_API_URL"];
+    markerPrinted = false;
+  }
+});
+
 // bin/founder-pin.js
 function isPinnedFounderBounty(j) {
   return j?.bounty?.bountySource === "founder" && j?.bounty?.claimable === true;
@@ -11785,12 +11966,16 @@ var init_founder_paid_badge = __esm({
 var web_session_exports = {};
 __export(web_session_exports, {
   clearWebSessionFile: () => clearWebSessionFile,
+  hostLabel: () => hostLabel,
+  missingSessionLines: () => missingSessionLines,
   readWebSessionCookie: () => readWebSessionCookie,
   readWebSessionFile: () => readWebSessionFile,
   readWebSessionRecord: () => readWebSessionRecord,
+  refusedSessionLines: () => refusedSessionLines,
   webSessionCookieForHost: () => webSessionCookieForHost,
   webSessionFilePath: () => webSessionFilePath,
   webSessionForHost: () => webSessionForHost,
+  withSessionDeps: () => withSessionDeps,
   writeWebSessionFile: () => writeWebSessionFile
 });
 import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
@@ -11830,6 +12015,7 @@ function readWebSessionFile() {
   return readWebSessionRecord()?.token ?? null;
 }
 function webSessionForHost(apiBase) {
+  assertBase(apiBase, "webSessionForHost");
   const record = readWebSessionRecord();
   if (!record) return { cookie: null, mismatch: null };
   if (record.host !== null && record.host !== apiBase) {
@@ -11843,11 +12029,50 @@ function webSessionCookieForHost(apiBase) {
   const env = process.env["TERMINALHIRE_WEB_SESSION"];
   return { cookie: typeof env === "string" && env.length > 0 ? env : null, mismatch: null };
 }
-function readWebSessionCookie() {
-  const fromFile = readWebSessionFile();
-  if (fromFile) return fromFile;
-  const env = process.env["TERMINALHIRE_WEB_SESSION"];
-  return typeof env === "string" && env.length > 0 ? env : null;
+function assertBase(apiBase, fn) {
+  if (typeof apiBase !== "string" || apiBase.length === 0) {
+    throw new TypeError(
+      `${fn}(apiBase) requires the destination base as a non-empty string; received ${apiBase === "" ? "''" : String(apiBase)}. This is a wiring bug in the calling command, not a developer misconfiguration: pass the same resolveApiBase() value the request is sent to, so the session's host affinity can be checked (TERM-991).`
+    );
+  }
+}
+function hostLabel(base) {
+  return String(base ?? "").replace(/^https?:\/\//, "");
+}
+function missingSessionLines(mismatch) {
+  if (!mismatch) {
+    return [
+      "No linked web session found on this machine.",
+      "Run `terminalhire link` to connect this terminal to your account, then re-run."
+    ];
+  }
+  const linked = hostLabel(mismatch.linkedHost);
+  const current = hostLabel(mismatch.currentHost);
+  const reach = mismatch.linkedHost === PROD_API_BASE ? `unset TERMINALHIRE_API_URL to reach ${linked}` : isLoopbackOrigin(mismatch.linkedHost) ? `set TERMINALHIRE_ALLOW_LOCAL_API=1 TERMINALHIRE_API_URL=${mismatch.linkedHost} to reach ${linked}` : `set TERMINALHIRE_API_URL=${mismatch.linkedHost} to reach ${linked}`;
+  const link = isLoopbackOrigin(mismatch.currentHost) ? "`TERMINALHIRE_ALLOW_LOCAL_OAUTH=1 terminalhire link`" : "`terminalhire link`";
+  return [
+    `This terminal is on ${current}, but your linked session belongs to ${linked}. Nothing was sent.`,
+    `Either ${reach}, or run ${link} to link this terminal to ${current} instead.`
+  ];
+}
+function withSessionDeps(defaults, overrides) {
+  const merged = { ...defaults, ...overrides };
+  if (overrides?.sessionCookie && !overrides.sessionMismatch) merged.sessionMismatch = () => null;
+  return merged;
+}
+function refusedSessionLines(apiBase) {
+  return [
+    `${hostLabel(apiBase)} refused your linked session.`,
+    "Run `terminalhire link` to link this terminal again, then re-run."
+  ];
+}
+function readWebSessionCookie(apiBase) {
+  if (typeof apiBase !== "string" || apiBase.length === 0) {
+    throw new TypeError(
+      `readWebSessionCookie(apiBase) requires the destination base as a non-empty string; received ${apiBase === "" ? "''" : String(apiBase)}. This is a wiring bug in the calling command, not a developer misconfiguration: pass the same resolveApiBase() value the request is sent to, so the session's host affinity can be checked (TERM-991).`
+    );
+  }
+  return webSessionCookieForHost(apiBase).cookie;
 }
 function writeWebSessionFile(token, host) {
   ensureStateDirForSecret(terminalhireDir());
@@ -11868,6 +12093,7 @@ function clearWebSessionFile() {
 var init_web_session = __esm({
   "src/web-session.ts"() {
     "use strict";
+    init_api_base();
     init_state_dir();
   }
 });
@@ -11976,15 +12202,27 @@ async function sendDecline(bountyId, reason) {
     console.error("Not one of the answers \u2014 nothing sent.");
     return false;
   }
-  const { readWebSessionCookie: readWebSessionCookie2 } = await Promise.resolve().then(() => (init_web_session(), web_session_exports));
-  const cookie = readWebSessionCookie2();
+  let apiUrl;
+  try {
+    const { resolveApiBase: resolveApiBase2 } = await Promise.resolve().then(() => (init_api_base(), api_base_exports));
+    apiUrl = resolveApiBase2();
+  } catch (err) {
+    console.log(`
+${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+  const { missingSessionLines: missingSessionLines2, webSessionCookieForHost: webSessionCookieForHost2 } = await Promise.resolve().then(() => (init_web_session(), web_session_exports));
+  const { cookie, mismatch } = webSessionCookieForHost2(apiUrl);
   if (!cookie) {
-    console.log("\nRun `terminalhire link` first \u2014 a poster needs to know the answer is real.");
+    if (mismatch) console.log(`
+${missingSessionLines2(mismatch).join("\n")}`);
+    else
+      console.log("\nRun `terminalhire link` first \u2014 a poster needs to know the answer is real.");
     return false;
   }
   if (!await ensureDeclineConsent(bountyId, reason)) return false;
   try {
-    const res = await fetch(`${API_URL}/api/posting/decline`, {
+    const res = await fetch(`${apiUrl}/api/posting/decline`, {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -12013,11 +12251,10 @@ async function runDeclinePrompt(bountyId, { ask = prompt } = {}) {
   if (!reason) return false;
   return sendDecline(bountyId, reason);
 }
-var API_URL, GH_SESSION_COOKIE, DECLINE_CHOICES;
+var GH_SESSION_COOKIE, DECLINE_CHOICES;
 var init_jpi_decline = __esm({
   "bin/jpi-decline.js"() {
     "use strict";
-    API_URL = process.env["TERMINALHIRE_API_URL"] || "https://terminalhire.com";
     GH_SESSION_COOKIE = "__jpi_gh_session";
     DECLINE_CHOICES = [
       { key: "1", reason: "price_low", label: "the price is too low for the work" },
@@ -12249,106 +12486,13 @@ function linkTitle(title, url) {
   return href ? `${safeTitle} (${href})` : safeTitle;
 }
 
-// src/api-base.ts
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-var PROD_API_BASE = "https://terminalhire.com";
-var DEV_API_BASE = "https://dev.terminalhire.com";
-var ApiBaseError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ApiBaseError";
-  }
-};
-var ALLOWED_HOSTS = {
-  "terminalhire.com": "https:",
-  "www.terminalhire.com": "https:",
-  "dev.terminalhire.com": "https:",
-  localhost: "http:",
-  "127.0.0.1": "http:"
-};
-var ALLOW_LOCAL_API_KEY = "TERMINALHIRE_ALLOW_LOCAL_API";
-var ALLOWED_DESCRIPTION = [
-  PROD_API_BASE,
-  DEV_API_BASE,
-  `http://localhost:<port> (requires ${ALLOW_LOCAL_API_KEY}=1)`,
-  `http://127.0.0.1:<port> (requires ${ALLOW_LOCAL_API_KEY}=1)`
-].join(", ");
-var CANONICAL_REWRITES = {
-  "www.terminalhire.com": PROD_API_BASE
-};
-var ENV_KEYS = ["TERMINALHIRE_API_URL", "JPI_API_URL"];
-function sanitizeOverrideForError(raw) {
-  try {
-    const url = new URL(raw);
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-      return `(disallowed scheme: ${url.protocol.slice(0, -1)})`;
-    }
-    if (url.username !== "" || url.password !== "") {
-      return `${url.protocol}//***@${url.host}`;
-    }
-    return url.origin;
-  } catch {
-    return "(unparseable override)";
-  }
-}
-function isLoopbackOrigin(origin) {
-  try {
-    const host = new URL(origin).hostname;
-    return host === "localhost" || host === "127.0.0.1";
-  } catch {
-    return false;
-  }
-}
-function localApiAllowed(env) {
-  return env[ALLOW_LOCAL_API_KEY] === "1";
-}
-function resolveApiBase(env = process.env) {
-  for (const key of ENV_KEYS) {
-    const raw = env[key];
-    if (typeof raw !== "string") continue;
-    const trimmed = raw.trim();
-    if (trimmed === "") continue;
-    const normalized = normalizeOverride(trimmed);
-    if (normalized === null) {
-      throw new ApiBaseError(
-        `terminalhire: ${key}=${sanitizeOverrideForError(trimmed)} is not an allowed API host (allowed: ${ALLOWED_DESCRIPTION}). Refusing to continue so we do not silently hit production.`
-      );
-    }
-    if (isLoopbackOrigin(normalized) && !localApiAllowed(env)) {
-      throw new ApiBaseError(
-        `terminalhire: ${key}=${normalized} is a loopback origin. Set ${ALLOW_LOCAL_API_KEY}=1 to talk to a local web app on purpose. Refusing so stored credentials cannot be exfiltrated to localhost by a poisoned override.`
-      );
-    }
-    return normalized;
-  }
-  return PROD_API_BASE;
-}
-function normalizeOverride(raw) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (url.username !== "" || url.password !== "") return null;
-  const expectedProtocol = ALLOWED_HOSTS[url.hostname];
-  if (expectedProtocol === void 0) return null;
-  if (url.protocol !== expectedProtocol) return null;
-  if (url.hostname !== "localhost" && url.hostname !== "127.0.0.1" && url.port !== "") {
-    return null;
-  }
-  const rewrite = CANONICAL_REWRITES[url.hostname];
-  if (rewrite !== void 0) return rewrite;
-  return url.origin;
-}
-
 // bin/jpi-bounties.js
+init_api_base();
 init_founder_pin();
 var TERMINALHIRE_DIR7 = process.env.TERMINALHIRE_DIR || join13(homedir10(), ".terminalhire");
 var INDEX_CACHE_FILE2 = join13(TERMINALHIRE_DIR7, "index-cache.json");
 var INDEX_TTL_MS = 15 * 60 * 1e3;
-var API_URL2 = resolveApiBase();
+var API_URL = resolveApiBase();
 var RANK_MODE = process.env["TERMINALHIRE_BOUNTY_RANK"] ?? "winnability";
 var CONTINUITY_RANK_DISABLED = process.env["TERMINALHIRE_NO_CONTINUITY_RANK"] === "1";
 var DEFAULT_LIMIT = 15;
@@ -12369,7 +12513,7 @@ function readIndexCache() {
 }
 async function fetchIndex(quiet = false) {
   const { index, reason, source, cachedAt } = await revalidateIndex({
-    apiUrl: API_URL2,
+    apiUrl: API_URL,
     fetchImpl: (url, init) => fetch(url, init),
     readEntry: readCacheEntry,
     writeEntry: updateIndexCache
@@ -12520,7 +12664,7 @@ function classifyEmptyStatus({ preFilterCount, postFilterCount, priced }) {
   return "empty";
 }
 async function getBounties({ quiet = false, offline = false, priced = PRICED_ONLY } = {}) {
-  if (!quiet) console.log(`Fetching bounty index from ${API_URL2}/api/index...`);
+  if (!quiet) console.log(`Fetching bounty index from ${API_URL}/api/index...`);
   const index = offline ? readIndexCache() : await fetchIndex(quiet);
   if (offline && !index) return { status: "no-cache" };
   let bounties = (index.jobs ?? []).filter((j) => j.source === "bounty");