tinybeeai 0.0.0-stage → 0.16.1

package/dist/path-filters.js

@@ -0,0 +1,62 @@
+// Repo path filters (KAT-160). A dot that lists pathFilters on a repo takes a PR or push only when
+// one changed file matches a filter. Push payloads carry their files; a pull_request payload does
+// not, so the file list is read once per PR head and shared by every dot on the repo.
+import { log } from './config.js';
+import { list } from './db.js';
+import { describeFetchError, githubFor } from './integrations/github.js';
+import { anyGlob } from './review/glob.js';
+import { findRepo } from './repos.js';
+/** Do the changed files fall inside the filters? A filter `web` or `web/` covers the folder. */
+export function filesMatchFilters(files, filters) {
+    const globs = filters.flatMap((f) => {
+        const g = f.trim().replace(/^\.\//, '');
+        if (!g)
+            return [];
+        return /[*?{[]/.test(g) ? [g] : [g, `${g.replace(/\/+$/, '')}/**`];
+    });
+    return files.some((f) => anyGlob(f, globs));
+}
+const MAX_CACHED = 200;
+const cache = new Map();
+/** Test hook. */
+export function clearChangedFilesCache() {
+    cache.clear();
+}
+function prKey(ev) {
+    return `${ev.repo.owner}/${ev.repo.name}`.toLowerCase() + `#${ev.pr.number}@${ev.pr.headSha}`;
+}
+/** Does any live dot filter this event's repo by path? */
+function someDotFilters(ev) {
+    return list('watches').find((w) => !w.paused && !w.archived && !!findRepo(w, ev.repo)?.pathFilters?.length);
+}
+/**
+ * Puts the PR's changed files on the event when a dot filters by path. A failed fetch leaves the
+ * event without files and sets pathFilterNote, so the event still matches and the run says so.
+ */
+export async function resolveChangedFiles(ev) {
+    if (ev.source !== 'github' || !ev.pr || !ev.repo || ev.changedFiles || ev.inlineDiff)
+        return ev;
+    const w = someDotFilters(ev);
+    if (!w)
+        return ev;
+    const key = prKey(ev);
+    let pending = cache.get(key);
+    if (!pending) {
+        pending = githubFor(w, ev)
+            .prFiles(ev.pr.number)
+            .then((files) => files.map((f) => f.path));
+        cache.set(key, pending);
+        if (cache.size > MAX_CACHED)
+            cache.delete(cache.keys().next().value);
+    }
+    try {
+        return { ...ev, changedFiles: await pending };
+    }
+    catch (err) {
+        cache.delete(key);
+        const why = describeFetchError(err);
+        log.warn(`path filters: could not list files of ${key}: ${why}`);
+        return { ...ev, pathFilterNote: `Could not list the changed files (${why}).` };
+    }
+}
+//# sourceMappingURL=path-filters.js.map

package/dist/path-filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-filters.js","sourceRoot":"","sources":["../src/path-filters.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,kGAAkG;AAClG,sFAAsF;AACtF,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAwB,EAAE,OAA0B;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEnD,iBAAiB;AACjB,MAAM,UAAU,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,EAAgB;IAC7B,OAAO,GAAG,EAAE,CAAC,IAAK,CAAC,KAAK,IAAI,EAAE,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,EAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAG,CAAC,OAAO,EAAE,CAAC;AACpG,CAAC;AAED,0DAA0D;AAC1D,SAAS,cAAc,CAAC,EAAgB;IACtC,OAAO,IAAI,CAAQ,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AACrH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAgB;IACxD,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAChG,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;aACvB,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC;aACrB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU;YAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,OAAO,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,yCAAyC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,qCAAqC,GAAG,IAAI,EAAE,CAAC;IACjF,CAAC;AACH,CAAC"}

package/dist/phone/alerts.js

@@ -0,0 +1,67 @@
+// Phone alerts (KAT-141): a push when a run finds bugs and when a dot reports an outage. Drafts
+// waiting for approval already push from src/agent/rules.ts with category 'drafts'. Each kind can be
+// turned off in Setup > Phone; notify() checks the category.
+import { get } from '../db.js';
+import { subscribe } from '../events.js';
+import { notify } from '../notify/push.js';
+import { bugText, outageText } from '../updates/words.js';
+const sent = new Set();
+function clip(s, n) {
+    const t = s.replace(/\s+/g, ' ').trim();
+    return t.length > n ? `${t.slice(0, n - 3).trimEnd()}...` : t;
+}
+/** The bug count a finished run reports: failed tests, else high-severity findings. 0 when it found none. */
+export function bugsFound(run) {
+    if (run.status !== 'done')
+        return 0;
+    // A broken environment or a flaky test is not a bug in the product: no Bugs found push.
+    if (run.verdict?.outcome === 'environment_failure' || run.verdict?.outcome === 'flaky')
+        return 0;
+    const failed = run.report && !run.report.notRun && !run.report.interrupted ? run.report.failed : 0;
+    if (failed > 0)
+        return failed;
+    return (run.verdict?.findings ?? []).filter((f) => f.severity === 'high').length;
+}
+/** The notice for an event, or null. Pure, so tests can check it without a push service. */
+export function alertFor(e, dotName) {
+    if (e.type === 'run') {
+        const n = bugsFound(e.run);
+        if (!n)
+            return null;
+        const t = bugText(dotName(e.run.watchId), e.run);
+        return {
+            key: `bugs:${e.run.id}`,
+            title: clip(t.title, 80),
+            body: clip(t.body, 160),
+            url: `/#/runs/${encodeURIComponent(e.run.id)}`,
+            urgency: 'high',
+            category: 'bugs',
+        };
+    }
+    if (e.type === 'dot' && e.status === 'outage') {
+        return {
+            key: `outage:${e.watchId}`,
+            title: clip(outageText(dotName(e.watchId), undefined, undefined).title, 80),
+            body: 'The site check failed 3 times in a row. Open Activity to see what is down.',
+            url: `/#/feed?dot=${encodeURIComponent(e.watchId)}`,
+            urgency: 'high',
+            category: 'outages',
+        };
+    }
+    return null;
+}
+export function startPhoneAlerts() {
+    const name = (id) => get('watches', id)?.name ?? 'localdost';
+    return subscribe((e) => {
+        const n = alertFor(e, name);
+        if (!n || sent.has(n.key))
+            return;
+        // Run keys never repeat; outage keys repeat after notify's 10 minute dedupe window.
+        if (n.category === 'bugs')
+            sent.add(n.key);
+        if (sent.size > 2000)
+            sent.clear();
+        void notify(n).catch((err) => console.warn('[phone] alert push failed', err));
+    });
+}
+//# sourceMappingURL=alerts.js.map

package/dist/phone/alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.js","sourceRoot":"","sources":["../../src/phone/alerts.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,qGAAqG;AACrG,6DAA6D;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;AAE/B,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,SAAS,CAAC,GAAc;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IACpC,wFAAwF;IACxF,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,qBAAqB,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;AACnF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,QAAQ,CAAC,CAAc,EAAE,OAA+B;IACtE,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;YACvB,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;YACvB,GAAG,EAAE,WAAW,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAC9C,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE;YAC1B,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC3E,IAAI,EAAE,4EAA4E;YAClF,GAAG,EAAE,eAAe,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;YACnD,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAQ,SAAS,EAAE,EAAE,CAAC,EAAE,IAAI,IAAI,WAAW,CAAC;IAC5E,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,oFAAoF;QACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/phone/auth.js

@@ -0,0 +1,240 @@
+// Who is calling: the admin token, a paired device, the Tailscale owner through the loopback serve
+// proxy, or a local browser on an open (tokenless) loopback server. Used by the server-wide hook in
+// server.ts for /api and /artifacts, so every route (live events, chat streams, push subscribe,
+// artifact files) accepts the same callers.
+import { timingSafeEqual } from 'node:crypto';
+import { config } from '../config.js';
+import { isLoopbackHost } from '../loopback.js';
+import { ADMIN_APPROVER, DEVICE_TOKEN_PREFIX, pairing, roleOfRecord } from './pairing.js';
+import { phonePrefs } from './prefs.js';
+/** The role a paired device or the Tailscale owner acts with. */
+export const remoteRoleOf = (c) => (c.kind === 'device' ? c.role : 'member');
+export function roleOf(c) {
+    return c?.kind === 'device' || c?.kind === 'owner' ? remoteRoleOf(c) : 'admin';
+}
+const LOOPBACK_IPS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+export function bearerOf(req) {
+    const auth = req.headers.authorization;
+    return auth?.startsWith('Bearer ') ? auth.slice(7).trim() || undefined : undefined;
+}
+function sameSecret(got, want) {
+    const a = Buffer.from(got);
+    const b = Buffer.from(want);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Host header without the port, lowercased. */
+export function hostName(host) {
+    const h = (host ?? '').trim().toLowerCase();
+    if (h.startsWith('['))
+        return h.slice(1, h.indexOf(']'));
+    return h.replace(/:\d+$/, '');
+}
+function loopbackHostHeader(host) {
+    const name = hostName(host);
+    return !!name && (isLoopbackHost(name) || name.endsWith('.localhost'));
+}
+export function loopbackSocket(req) {
+    return LOOPBACK_IPS.has(req.socket?.remoteAddress ?? '');
+}
+/**
+ * The caller sits on this machine: a loopback socket and a loopback Host header. A browser that reaches a team
+ * server through a hostname, a proxy, or a tunnel fails the Host check. Used to keep account emails from remote callers.
+ */
+export function localCaller(req) {
+    return loopbackSocket(req) && loopbackHostHeader(req.headers.host);
+}
+/**
+ * The Tailscale owner, trusted only when all of these hold: the owner turned trust on; the socket
+ * peer is loopback (tailscale serve proxies from 127.0.0.1); the Host header is this machine's
+ * MagicDNS name, which a public tunnel such as cloudflared cannot present; the request is not a
+ * Funnel request; and Tailscale-User-Login names the owner. tailscale serve drops any
+ * Tailscale-User-* header the client sent and sets its own.
+ */
+export function tailscaleOwner(req) {
+    const prefs = phonePrefs();
+    if (!prefs.trustTailscale || !prefs.owner || !prefs.tailnetHost)
+        return null;
+    if (!loopbackSocket(req))
+        return null;
+    if (hostName(req.headers.host) !== prefs.tailnetHost.toLowerCase())
+        return null;
+    if (req.headers['tailscale-funnel-request'] !== undefined)
+        return null;
+    const login = req.headers['tailscale-user-login'];
+    if (typeof login !== 'string' || !login)
+        return null;
+    return login.toLowerCase() === prefs.owner.toLowerCase() ? prefs.owner : null;
+}
+/**
+ * The caller, or null when the request has no valid credentials. A device token that fails
+ * (revoked, unknown) is refused even on an open loopback server, so a phone learns at once that it
+ * was unpaired.
+ */
+export function authenticate(req) {
+    const bearer = bearerOf(req);
+    if (bearer && config.token && sameSecret(bearer, config.token))
+        return { kind: 'admin' };
+    if (bearer?.startsWith(DEVICE_TOKEN_PREFIX)) {
+        const d = pairing.verify(bearer);
+        if (!d)
+            return null;
+        pairing.touch(d, req.ip);
+        return { kind: 'device', deviceId: d.id, deviceName: d.name, role: roleOfRecord(d) };
+    }
+    const owner = tailscaleOwner(req);
+    if (owner)
+        return { kind: 'owner', login: owner };
+    if (!config.token && loopbackHostHeader(req.headers.host))
+        return { kind: 'local' };
+    return null;
+}
+/**
+ * May manage pairing and devices: the admin token, or a loopback browser on a tokenless server
+ * (socket and Host both loopback). Paired devices and the Tailscale owner may not pair more devices.
+ */
+export function isAdmin(req) {
+    const bearer = bearerOf(req);
+    if (config.token)
+        return !!bearer && sameSecret(bearer, config.token);
+    return loopbackSocket(req) && loopbackHostHeader(req.headers.host) && !bearer?.startsWith(DEVICE_TOKEN_PREFIX);
+}
+/** The key wrong pairing codes are counted under: the socket address, plus the forwarded client behind a loopback proxy. */
+export function clientKey(req) {
+    const ip = req.socket?.remoteAddress ?? req.ip;
+    if (!LOOPBACK_IPS.has(ip))
+        return ip;
+    // The proxy (tailscale serve, cloudflared) appends the peer it saw; earlier entries are client-supplied.
+    const fwd = req.headers['x-forwarded-for'];
+    const joined = Array.isArray(fwd) ? fwd.join(',') : fwd;
+    const last = joined?.split(',').pop()?.trim();
+    return last ? `${ip}>${last.slice(0, 64)}` : ip;
+}
+export { ADMIN_APPROVER };
+/**
+ * Who decided a draft, as the approval record keeps it (KAT-356): a paired device by its name, the Tailscale
+ * owner by login, and the admin token as "admin" (KAT-364), so a decision never reads as nobody's. No device can carry
+ * that name (pairing.ts). A local browser on a server with no token names no one, so it returns undefined.
+ */
+export function approverOf(req) {
+    const c = req.qdCaller ?? authenticate(req);
+    if (c?.kind === 'device')
+        return c.deviceName;
+    if (c?.kind === 'owner')
+        return c.login;
+    if (c?.kind === 'admin')
+        return ADMIN_APPROVER;
+    return undefined;
+}
+export function actorOf(req) {
+    const c = req.qdCaller ?? authenticate(req);
+    if (!c)
+        return `anonymous (${req.ip})`;
+    if (c.kind === 'device')
+        return `device ${c.deviceName} (${c.deviceId})`;
+    if (c.kind === 'owner')
+        return `tailscale ${c.login}`;
+    return c.kind === 'admin' ? 'admin token' : 'localhost';
+}
+/**
+ * Writes any paired device (or the trusted Tailscale owner) may make, the member role (KAT-364). A device is a remote
+ * control: it decides drafts (the Inbox and the case drafts of a ticket review), chats, reruns and cancels runs, asks for a
+ * review, records manual test results and retests on a test run's items, subscribes to push, and, through the pause check
+ * below, pauses or resumes a dot. It does not edit dots, runner commands, connections, or settings, which can run commands
+ * on this host. Anything not listed is refused (fail closed); reads are allowed. Retrying a failed alert (a resend of a
+ * message the dot already wrote) and dismissing one (the feed row stays, only its entry in the failed list goes) are allowed too.
+ */
+const REMOTE_WRITES = new Set([
+    'POST /api/chat',
+    'POST /api/approvals/:id',
+    'POST /api/push/subscribe',
+    'POST /api/runs/:id/rerun',
+    'POST /api/runs/:id/cancel',
+    'POST /api/runs/:id/save-report',
+    'POST /api/runs/:id/review/not-a-risk',
+    'POST /api/runs/:id/review/tested',
+    'DELETE /api/runs/:id/review/not-a-risk/:riskId',
+    'POST /api/dots/:id/review',
+    // The team digest of a lead (KAT-405): no AI call, and it replies only to the phone that asked.
+    'POST /api/dots/:id/digest',
+    'POST /api/updates/:id/retry',
+    'POST /api/updates/:id/dismiss',
+    'POST /api/updates/failed/dismiss',
+    // The teammate's own update level and quiet hours (KAT-356). The route writes the calling device's row only.
+    'PUT /api/phone/me/updates',
+    'POST /api/dots/:id/test-runs/:runId/items/:itemId/results',
+    'POST /api/dots/:id/test-runs/:runId/items/:itemId/retest',
+    'POST /api/dots/:id/impact/:impactId/accept',
+    'POST /api/dots/:id/impact/:impactId/reject',
+    // Send again to True Platform what the dot already holds (KAT-406). The connection check is not here: it makes the server call out.
+    'POST /api/dots/:id/true/resend',
+    'POST /api/dots/:id/true/items/:itemId/resend',
+    'POST /api/call/session',
+    'POST /api/call/receipt',
+    'POST /api/markdown',
+    'DELETE /api/phone/me',
+]);
+/**
+ * What the editor role adds (KAT-364): dot settings and rules (the dot update route), a dot's memory, the two card actions, a
+ * comment and a status change, which go through the dot's rules, and Try it on the dot's saved runner command. What runs as the
+ * server user (the test command, setup, passed variables, copied files, image, mode, folders) stays the admin's: the dot update
+ * route and Try it refuse an editor who changes it (`runnerAdminChanges` in src/runner/command.ts). So does which code a run
+ * checks out (the repos, their branches, the test branches: `repoAdminChanges` in src/repos.ts, KAT-369). The dot update route is
+ * open to a member for one change only: pausing or resuming (see `pauseOnlyBody`). Removing a dot, archiving or restoring, stays with the admin token whatever the role.
+ */
+const EDITOR_WRITES = new Set([
+    'PATCH /api/dots/:id',
+    'POST /api/memory',
+    'DELETE /api/memory/:id',
+    'POST /api/cards/comment',
+    'POST /api/cards/status',
+    'POST /api/runner/try',
+]);
+/**
+ * Error code of the 403 a paired device gets on a route its role may not use (KAT-195). The client shows
+ * "Ask your localdost admin" for it, and keeps the pair-again message for a 401/403 without it.
+ */
+export const PHONE_BLOCKED_CODE = 'phone_blocked';
+/** The words of that 403: the person to ask, never a computer. */
+export const PHONE_BLOCKED_MESSAGE = 'Ask your localdost admin.';
+/**
+ * Error code of the 401 the server-wide hook sends when the request has no valid credential (KAT-356). The page
+ * shows the Join screen for this one and for no other 401, so a route that answers 401 to a caller the hook
+ * already accepted never sends a paired teammate back to the Join screen.
+ */
+export const AUTH_REQUIRED_CODE = 'auth_required';
+/**
+ * `route` is the matched route pattern (req.routeOptions.url), so URL spelling cannot dodge the list. A member may call the
+ * dot update route to pause or resume, and the server checks that body once it is read (`pause_only`).
+ */
+export function remoteAccess(method, route, role = 'member') {
+    const m = method.toUpperCase();
+    if (m === 'GET' || m === 'HEAD' || m === 'OPTIONS')
+        return 'allow';
+    const key = `${m} ${route}`;
+    if (REMOTE_WRITES.has(key))
+        return 'allow';
+    if (role === 'editor' && EDITOR_WRITES.has(key))
+        return 'allow';
+    if (key === 'PATCH /api/dots/:id')
+        return 'pause_only';
+    return 'deny';
+}
+/** Whether a paired device of this role may call the route outright. A `pause_only` route is not an outright yes. */
+export function remoteMayCall(method, route, role = 'member') {
+    return remoteAccess(method, route, role) === 'allow';
+}
+/** A body that only pauses or resumes a dot: `{ "paused": true }` or `{ "paused": false }`, and no other field. */
+export function pauseOnlyBody(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return false;
+    const keys = Object.keys(body);
+    return keys.length === 1 && keys[0] === 'paused' && typeof body.paused === 'boolean';
+}
+/** Paths that need a caller. */
+export function protectedPath(url) {
+    return url.startsWith('/api/') || url.startsWith('/artifacts/');
+}
+/** The API paths a caller with no credentials may use: trading a pairing code for a token, and the Join screen's server name. */
+export const PUBLIC_PAIR_PATH = '/api/phone/pair/exchange';
+export const PUBLIC_JOIN_PATH = '/api/phone/join';
+//# sourceMappingURL=auth.js.map

package/dist/phone/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/phone/auth.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,oGAAoG;AACpG,gGAAgG;AAChG,4CAA4C;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAmB,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAUxC,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAe,EAAc,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEvG,MAAM,UAAU,MAAM,CAAC,CAA4B;IACjD,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACjF,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEvE,MAAM,UAAU,QAAQ,CAAC,GAAoC;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,OAAO,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,QAAQ,CAAC,IAAwB;IAC/C,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAwB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAmB;IAChD,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC7C,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAmB;IAChD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAmB;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzF,IAAI,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,GAAmB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;AACjH,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,yGAAyG;IACzG,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAmB;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC;IAC9C,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAmB;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,cAAc,GAAG,CAAC,EAAE,GAAG,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC;IACzE,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,gBAAgB;IAChB,yBAAyB;IACzB,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;IAC3B,gCAAgC;IAChC,sCAAsC;IACtC,kCAAkC;IAClC,gDAAgD;IAChD,2BAA2B;IAC3B,gGAAgG;IAChG,2BAA2B;IAC3B,6BAA6B;IAC7B,+BAA+B;IAC/B,kCAAkC;IAClC,6GAA6G;IAC7G,2BAA2B;IAC3B,2DAA2D;IAC3D,0DAA0D;IAC1D,4CAA4C;IAC5C,4CAA4C;IAC5C,oIAAoI;IACpI,gCAAgC;IAChC,8CAA8C;IAC9C,wBAAwB;IACxB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,qBAAqB;IACrB,kBAAkB;IAClB,wBAAwB;IACxB,yBAAyB;IACzB,wBAAwB;IACxB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAKlD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,OAAmB,QAAQ;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;IAC5B,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAChE,IAAI,GAAG,KAAK,qBAAqB;QAAE,OAAO,YAAY,CAAC;IACvD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa,EAAE,OAAmB,QAAQ;IACtF,OAAO,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,OAAO,CAAC;AACvD,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAQ,IAA4B,CAAC,MAAM,KAAK,SAAS,CAAC;AAChH,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClE,CAAC;AAED,iIAAiI;AACjI,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC"}