terminalhire 0.42.26 → 0.42.28

package/dist/bin/approved-claims-sync.js

@@ -106,7 +106,7 @@ function buildApprovalsNudge(awaitingApproval) {
   if (!Number.isInteger(awaitingApproval) || awaitingApproval <= 0) return null;
   const n = awaitingApproval;
   return `  \u26A0 ${n} claim${n === 1 ? "" : "s"} awaiting poster approval \u2014 terminalhire cannot check in the background until you enrol:
-    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim slice <id>)`;
+    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim start <id>)`;
 }
 async function syncApprovedClaims({
   readAutoMarker,

package/dist/bin/jpi-claim.js

@@ -29714,7 +29714,10 @@ var init_result = __esm({
       "detected",
       "none",
       "operator-declared",
-      "developer-declared"
+      "developer-declared",
+      // TERM-1221: the mapping chose the image from a runtime the POSTER declared, because the
+      // repository's own files named none.
+      "founder-declared"
     ];
     RUN_RESULT_SCHEMA = "terminalhire.verification-run/1";
     RUN_RESULT_FIELDS = [
@@ -30072,6 +30075,10 @@ var init_attestation2 = __esm({
     };
     IMAGE_SOURCE_IS_SIGNABLE = {
       detected: () => null,
+      // The command table's `founder-declared` reasoning, applied to the environment: the poster
+      // chose the runtime and the poster is paying, so a runtime they declared is theirs to stand
+      // behind. The image itself is still the runtime mapping's pick, not a name anyone typed.
+      "founder-declared": () => null,
       "operator-declared": () => "had its container image chosen by an operator out of band, and the signed vocabulary has no member for that. Signing it would present a hand-picked environment as the one the runtime mapping selected.",
       "developer-declared": () => "had its container image supplied by the developer whose work is under verification. A chosen interpreter turns a red suite green as surely as a chosen test command.",
       // `none` means no image was booted, so an image name beside it is a contradiction — the
@@ -30485,7 +30492,10 @@ var init_boundary = __esm({
       },
       {
         code: "lockfile",
-        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base),
+        // The `.lock` suffix is the server's rule since TERM-412; this copy missed it, so
+        // the pre-flight passed `uv.lock` and bun's text `bun.lock` that the server refuses
+        // (TERM-1235). The name set only covers lockfiles whose names do not end in `.lock`.
+        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base) || base.endsWith(".lock"),
         why: "is a dependency lockfile. Nobody reads a lockfile diff, so a change to one is refused rather than shown"
       }
     ];
@@ -30758,8 +30768,14 @@ import { createHash as createHash9, X509Certificate } from "crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync11, mkdtempSync as mkdtempSync3, readFileSync as readFileSync11, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
 import { request as httpsRequest } from "https";
 import { createServer } from "net";
-import { join as join24 } from "path";
+import { posix as posix3 } from "path";
 import { tmpdir as tmpdir3 } from "os";
+function refuseUnsupportedHost(io) {
+  const platform = io.platform ?? process.platform;
+  if (platform === "win32") {
+    throw new HostedVenueError("the hosted venue cannot run from a Windows host: it reaches the venue daemon through an ssh-forwarded Unix socket, and OpenSSH on Windows cannot forward to a local socket path. Run from Linux, macOS or WSL, or use --placement local-docker.", "ours");
+  }
+}
 function credentialInGitConfig(text) {
   for (const match2 of text.matchAll(/\b([a-z][a-z0-9+.-]*):\/\/(\S+)/gi)) {
     const scheme = (match2[1] ?? "").toLowerCase();
@@ -31296,6 +31312,7 @@ function hostedVenueAvailable(opts = {}, io = defaultHostedVenueIo) {
   const config = opts.gcloudConfig ?? VENUE_GCLOUD_CONFIG;
   const env = venueGcloudEnv(config);
   try {
+    refuseUnsupportedHost(io);
     assertServiceCredentials(config, io);
   } catch {
     return false;
@@ -31736,6 +31753,7 @@ function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
         ...image
       };
       let bootArgv = gcpBootArgv(bootParams(CLIENT_CERT_STAND_IN));
+      refuseUnsupportedHost(io);
       ensureVenueServiceCredentials(gcloudConfig, keyFile, io);
       const clientTls = csImageDigest === null ? null : { ...makeClientTls(io, allocated, vm), imageDigest: csImageDigest };
       if (clientTls !== null)
@@ -32029,7 +32047,8 @@ function makeLease(p) {
           throw new HostedVenueError(`could not stage ${from} onto ${p.vm}: ${execDetail(res).slice(0, 300)}`);
         }
       };
-      const { jail: localJail, tmp: localTmp } = localJailPaths(local.scratchRoot);
+      const localJail = join24(local.scratchRoot, JAIL_SEGMENT);
+      const localTmp = join24(local.scratchRoot, JAIL_TMP_SEGMENT);
       const required = [
         localTmp,
         join24(localJail, JAIL_PASSWD_FILE),
@@ -32178,7 +32197,7 @@ function makeLease(p) {
     }
   };
 }
-var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING, CS_ATTEST_PORT, CS_DOCKER_PORT, CS_READY_BUDGET_MS, CS_ATTEST_TIMEOUT_MS, CS_PULL_TIMEOUT_MS, CS_ATTEST_INTERVAL_MS, OPENSSL_TIMEOUT_MS, CS_RUN_ARGS, CS_GUEST_USER, CS_STAGE_ROOT, CLIENT_CERT_STAND_IN;
+var join24, SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING, CS_ATTEST_PORT, CS_DOCKER_PORT, CS_READY_BUDGET_MS, CS_ATTEST_TIMEOUT_MS, CS_PULL_TIMEOUT_MS, CS_ATTEST_INTERVAL_MS, OPENSSL_TIMEOUT_MS, CS_RUN_ARGS, CS_GUEST_USER, CS_STAGE_ROOT, CLIENT_CERT_STAND_IN;
 var init_hostedVenue = __esm({
   "../../packages/envrun/dist/hostedVenue.js"() {
     "use strict";
@@ -32190,6 +32209,7 @@ var init_hostedVenue = __esm({
     init_labels();
     init_venueProof();
     init_venue();
+    ({ join: join24 } = posix3);
     SSH_READY_BUDGET_MS = 18e4;
     SSH_PROBE_INTERVAL_MS = 5e3;
     SSH_PROBE_TIMEOUT_MS = 25e3;
@@ -34340,8 +34360,11 @@ function publishableTarget(url) {
   if (separatorInTarget(url) !== null)
     return UNPARSEABLE_TARGET;
   const m = /^([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^/?#]*)([^?#]*)/.exec(url);
-  if (m === null)
-    return url.includes("?") ? UNPARSEABLE_TARGET : redactPathCredentials(url);
+  if (m === null) {
+    if (url.includes("?"))
+      return UNPARSEABLE_TARGET;
+    return WINDOWS_ABSOLUTE.test(url) ? redactWindowsPathCredentials(url) : redactPathCredentials(url);
+  }
   const authority = m[2] ?? "";
   const at = authority.lastIndexOf("@");
   const path5 = m[3] ?? "";
@@ -34355,6 +34378,16 @@ function redactPathCredentials(path5) {
     return /:[^@]*@/.test(seen) ? WITHHELD_SEGMENT : segment;
   });
 }
+function redactWindowsPathCredentials(path5) {
+  const rest = path5.slice(2);
+  for (const m of rest.matchAll(/[^\\/]+/g)) {
+    const seen = decodeToFixedPoint(m[0]);
+    if (seen === null || seen.includes(":")) {
+      return path5.slice(0, 2) + rest.slice(0, m.index) + WITHHELD_SEGMENT;
+    }
+  }
+  return path5;
+}
 function decodeToFixedPoint(s) {
   let current = s;
   for (let round = 0; round < 4; round += 1) {
@@ -34543,6 +34576,21 @@ async function releaseWithoutThrowing(lease, progress) {
     );
   }
 }
+function resolveRunEnvironment(derived, req) {
+  const runtimeDeclared = req.runtimeOverride !== void 0 && req.runtimeOverride !== "unknown" && derived.runtime === "unknown";
+  const withRuntime = runtimeDeclared ? {
+    ...derived,
+    runtime: req.runtimeOverride,
+    unresolved: derived.unresolved.filter((r) => r.kind !== "unknown-runtime")
+  } : derived;
+  const spec = req.testCommandOverride === void 0 ? withRuntime : { ...withRuntime, testCommand: req.testCommandOverride };
+  const imageSource = req.image !== void 0 ? req.imageOrigin === "operator" ? "operator-declared" : "developer-declared" : runtimeDeclared ? (
+    // Attributed only when the caller says the poster chose it. An unattributed override
+    // defaults the way `testCommandSource` does, to the developer, which does not sign.
+    req.runtimeOverrideOrigin === "founder" ? "founder-declared" : "developer-declared"
+  ) : "detected";
+  return { spec, imageSource };
+}
 async function verifyWorkingDiff(req) {
   const ctx = {
     startedAt: Date.now(),
@@ -34740,7 +34788,7 @@ async function runVerification(req, ctx) {
   const treeDigest = patchedTreeDigest(cloneDir);
   const baselinePatchSha256 = hasBaselinePatch ? sha256Hex(baselinePatch ?? "") : null;
   const derived = deriveEnvironmentSpec(cloneDir);
-  const spec = req.testCommandOverride === void 0 ? derived : { ...derived, testCommand: req.testCommandOverride };
+  const { spec, imageSource } = resolveRunEnvironment(derived, req);
   progress("derive", `runtime=${spec.runtime} install=${String(spec.installCommand)} test=${String(spec.testCommand)}`);
   refuseUnbuildableSpec(spec);
   const image = placement.imageFor(spec.runtime, req.image, spec.runtimeVersion, imageVariantFor(spec));
@@ -34845,7 +34893,7 @@ async function runVerification(req, ctx) {
       // `developer-declared` is deliberate and matches `testCommandSource`: `th run --image`
       // runs on the developer's machine, judging the developer's work, so attributing it to
       // the operator would sign our name onto their choice.
-      imageSource: req.image === void 0 ? "detected" : req.imageOrigin === "operator" ? "operator-declared" : "developer-declared",
+      imageSource,
       leaksClean: verdict.leaks.clean,
       leakState: verdict.leaks.state,
       // Built from the LEASE, over the client that ran the steps — never from
@@ -35908,6 +35956,7 @@ __export(dist_exports, {
   renderVerdictLine: () => renderVerdictLine,
   resolveImageForSpec: () => resolveImageForSpec,
   resolveLease: () => resolveLease,
+  resolveRunEnvironment: () => resolveRunEnvironment,
   runEnvironmentSpec: () => runEnvironmentSpec,
   runLabels: () => runLabels,
   setManifestProbe: () => setManifestProbe,
@@ -37807,9 +37856,13 @@ function fmtContestedWarning(b) {
   }
   return `  \u26A0 This issue looks taken: ${parts.join(" / ")}. A merged PR here is unlikely.`;
 }
-async function mintRegistrationProof({ claimRef } = {}) {
-  console.log("\n  This posting registers your claim with terminalhire, so your");
-  console.log("  GitHub identity has to be verified once in the browser.");
+async function mintRegistrationProof({ claimRef, intro } = {}) {
+  console.log("");
+  for (const line of intro ?? [
+    "This posting registers your claim with terminalhire, so your",
+    "GitHub identity has to be verified once in the browser."
+  ])
+    console.log(`  ${line}`);
   let oauthBase;
   try {
     oauthBase = resolveOAuthBase();
@@ -38136,17 +38189,18 @@ function readCredentialDisposition({
   return "store-and-clear-stale-marker";
 }
 async function bootstrapFounderClaimEnrollment(claim, registration) {
-  if (!(claim.amountUSD > 0)) return { stored: false, reason: "free" };
   if (!registration.pushToken || !registration.claimantLogin) {
     return { stored: false, reason: "token-unavailable" };
   }
+  const current = await readPushTokenEnc().catch(() => null);
   const disposition = readCredentialDisposition({
     markerExists: Boolean(readAutoMarker()),
-    enrolledTokenExists: Boolean(await readPushTokenEnc().catch(() => null))
+    enrolledTokenExists: Boolean(current)
   });
   if (disposition === "keep-enrolled") {
     return { stored: false, reason: "kept-enrolled" };
   }
+  if (current && current === registration.pushToken) return { stored: true, reason: "ok" };
   try {
     await writePushTokenEnc(registration.pushToken);
     if (disposition === "store-and-clear-stale-marker") clearAutoMarker();
@@ -38367,7 +38421,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
     console.log(
       `  registered with terminalhire${claim.approval.claimId ? ` (server claim ${claim.approval.claimId})` : ""}`
     );
-    if (claim.amountUSD > 0) {
+    if (enrollment) {
       if (enrollment?.stored) {
         console.log("  \u2713 credential for your granted slice + CI results stored encrypted here");
         console.log("  Background dashboard updates are NOT on (claiming does not enable them).");
@@ -38380,7 +38434,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
         if (enrollment?.detail) {
           for (const line of String(enrollment.detail).split("\n")) console.log(`    ${line}`);
         }
-        console.log("  Store it before fetching your slice: terminalhire claim --push");
+        console.log("  `claim start` will ask you to confirm in the browser once more.");
       }
     }
     if (claim.approval.state === "pending") {
@@ -38542,7 +38596,7 @@ async function cmdList(active) {
     );
     return;
   }
-  await syncFounderApprovals(claims, list);
+  const { approvalsChecked } = await syncFounderApprovals(claims, list);
   list = claims.listClaims({ active });
   await syncFounderVerdicts({
     claimsModule: claims,
@@ -38560,7 +38614,7 @@ ${list.length} ${active ? "active " : ""}claim${list.length === 1 ? "" : "s"}:
 `);
   for (const c of list) {
     const pr = c.prUrl ? ` \xB7 ${c.prUrl}` : "";
-    console.log(`  [${claimTurnLabel(c.state)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
+    console.log(`  [${claimListTurnLabel(c, approvalsChecked)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
     console.log(`    id: ${c.id} \xB7 ${c.state}${pr}`);
   }
   printMetric(claims.acceptedPRRate());
@@ -38668,6 +38722,12 @@ async function syncFounderApprovals(claimsModule, targets) {
   }
   return { pushToken, approvalsChecked, approvalsUnavailable };
 }
+function claimListTurnLabel(claim, approvalsChecked) {
+  if (approvalsChecked && claim.state === "claimed" && claim.approval?.mode === "approval-only" && claim.approval?.state === "pending") {
+    return "waiting on poster";
+  }
+  return claimTurnLabel(claim.state);
+}
 function founderClaimStanding(claim, approvalsChecked) {
   const turn = claimTurnLabel(claim.state);
   switch (claim.state) {
@@ -39910,12 +39970,74 @@ terminalhire claim: ${what} needs the stored credential, and the server says it
   }
   return true;
 }
-async function requireReadPushToken(what) {
+async function enrolHeldClaimReadToken(postingId) {
+  const fail = (lines) => {
+    for (const line of lines) console.error(line);
+    process.exit(1);
+  };
+  const proofToken = await mintRegistrationProof({
+    claimRef: opportunityShortToken(`bounty:founder:${postingId}`),
+    intro: [
+      "This machine holds no terminalhire credential yet. Confirm once in the",
+      "browser, signed in as the GitHub account that claimed this work, and",
+      "this machine is linked to your claim."
+    ]
+  });
+  if (!proofToken) {
+    fail(["terminalhire claim: could not link this machine to your claim (see above)."]);
+  }
+  let res;
+  try {
+    res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/enrol`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ bountyId: postingId, proofToken }),
+      signal: AbortSignal.timeout(CLAIM_SYNC_WRITE_TIMEOUT_MS)
+    });
+  } catch (err) {
+    fail([
+      `terminalhire claim: terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}).`,
+      "  Nothing was stored. Run the same command again."
+    ]);
+  }
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status === 404 && body?.error === "no-live-claim") {
+    const who = typeof body.claimantLogin === "string" ? `@${body.claimantLogin}` : "that account";
+    fail([
+      `terminalhire claim: you confirmed in the browser as ${who}, and ${who} does not`,
+      "  hold a live claim on this posting. Nothing was stored.",
+      "  Sign the browser into the GitHub account that claimed it, then run this again."
+    ]);
+  }
+  if (!res.ok || typeof body?.pushToken !== "string" || body.pushToken.length === 0) {
+    fail([
+      `terminalhire claim: linking this machine failed (${res.status}${typeof body?.message === "string" ? `: ${body.message}` : ""}). Nothing was stored.`
+    ]);
+  }
+  try {
+    await writePushTokenEnc(body.pushToken);
+  } catch (err) {
+    fail([
+      `terminalhire claim: the credential could not be stored on this machine: ${err instanceof Error ? err.message : String(err)}`
+    ]);
+  }
+  console.log("  \u2713 This machine is linked to your claim (credential stored encrypted here).");
+  return body.pushToken;
+}
+var FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
+async function requireReadPushToken(what, { enrolFor } = {}) {
   let stored = null;
   try {
     stored = await readPushTokenEnc();
   } catch {
   }
+  if (!stored && typeof enrolFor === "string" && FOUNDER_POSTING_ID.test(enrolFor)) {
+    return enrolHeldClaimReadToken(enrolFor);
+  }
   if (!stored) {
     console.error(
       `terminalhire claim: ${what} needs the persistent push token, and none is enrolled on this machine.
@@ -39938,7 +40060,9 @@ function cloneFullTierRepo({ engine, dest, url, sha, token, branch }) {
 async function cmdSliceFullTier(claims, id, local, fullTierBody, flags, cloneRepo = cloneFullTierRepo) {
   const claimId = fullTierBody.claimId;
   const bountyId = fullTierBody.bountyId;
-  const pushToken = await requireReadPushToken("fetching your full-repo clone credential");
+  const pushToken = await requireReadPushToken("fetching your full-repo clone credential", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/clone-token`, {
@@ -40114,7 +40238,9 @@ async function attemptSliceDelivery(id, flags = {}) {
     requireFounderLoopClaim(claims, id, "slice");
   }
   const bountyId = local ? founderPostingIdOf(local) : String(id).replace(/^bounty:founder:/, "");
-  const pushToken = await requireReadPushToken("fetching your granted slice");
+  const pushToken = await requireReadPushToken("fetching your granted slice", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/slice`, {
@@ -41932,6 +42058,7 @@ export {
   buildStakeComment,
   buildStandDownComment,
   buildSubmitBody,
+  claimListTurnLabel,
   claimUpdatePatch,
   cloneFullTierRepo,
   cmdNote,