toolroll 0.9.104 → 0.9.105

package/dist/integrations.js

@@ -1,20 +1,3 @@
-/**
- * Settings → Integrations and `toolroll integrations`: one place that says
- * which integrations work. Each is Connected, Not set up or Broken, with its
- * last success and last error, what uses it, and one action (Set up, Send
- * test or Fix).
- *
- * Two halves. `integrationsNow` is cheap and synchronous: configuration files,
- * delivery history already in SQLite, and the last check's answer from
- * `integration_check`. It never touches the network, so a page can call it on
- * every render. `checkIntegrations` runs the checks themselves: a harmless
- * read-only call per integration (never a message to anyone, never a write to
- * a repository) with a short timeout, and records each answer. The console
- * runs them in the background through `createIntegrationMonitor`; the CLI
- * runs them inline. Only account and workspace names leave this module:
- * tokens, keys and passwords are never in a row, and every problem text is
- * scrubbed before it is stored.
- */
 import { connect as tcpConnect } from "node:net";
 import { connect as tlsConnect } from "node:tls";
 import { basename } from "node:path";
@@ -36,20 +19,17 @@ export const STATE_WORDS = { connected: "Connected", "not-set-up": "Not set up",
 const NO_ACTIVITY = { okAt: null, error: null, errorAt: null, failing: false };
 const PROBE_MS = 8_000;
 const AGENTS = ["claude", "codex"];
-// ---------------------------------------------------------------- secrets
-/** Token shapes that must never reach a page, a log line or --json, whatever an upstream error message says. */
 const SECRET_SHAPES = [
-    /\b\d{5,}:[A-Za-z0-9_-]{30,}\b/g, // Telegram bot token
-    /\bx(?:ox[abposr]|app)-[A-Za-z0-9-]{8,}\b/g, // Slack tokens
-    /\blin_(?:api|oauth)_[A-Za-z0-9]{12,}\b/g, // Linear keys
-    /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, // GitHub tokens
+    /\b\d{5,}:[A-Za-z0-9_-]{30,}\b/g,
+    /\bx(?:ox[abposr]|app)-[A-Za-z0-9-]{8,}\b/g,
+    /\blin_(?:api|oauth)_[A-Za-z0-9]{12,}\b/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
-    /\bsk-[A-Za-z0-9_-]{16,}\b/g, // provider API keys
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
     /\bBearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi,
-    /\b[A-Za-z0-9_-]{24,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{20,}\b/g, // Discord bot token, JWTs
-    /\/\/[^/\s:@]+:[^/\s@]+@/g, // user:password@ in an address
+    /\b[A-Za-z0-9_-]{24,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{20,}\b/g,
+    /\/\/[^/\s:@]+:[^/\s@]+@/g,
 ];
-/** Remove every known secret value and anything shaped like a token; keep it to one short line. */
 export function scrubIntegrationText(text, secrets = []) {
     let out = text;
     for (const secret of secrets)
@@ -143,7 +123,6 @@ function flowWords(uses) {
     const flows = [...new Set(uses.map(one => one.flow))];
     return flows.length === 0 ? [] : [flows.length <= 2 ? `Flow${flows.length === 1 ? "" : "s"} ${flows.join(", ")}` : plural(flows.length, "flow")];
 }
-// ---------------------------------------------------------------- probes
 const place = (href, command = null) => ({ href, command });
 async function getJson(io, url, init = {}) {
     const response = await (io.fetch ?? fetch)(url, { redirect: "error", signal: AbortSignal.timeout(PROBE_MS), ...init });
@@ -230,7 +209,6 @@ async function probeGithub(io, needed) {
             return { outcome: "absent", problem: "gh isn't signed in to GitHub.", setup: { command: "gh auth login" } };
         return { outcome: "failed", problem: signedOut ? "gh isn't signed in to GitHub. Run gh auth login." : unreachable("GitHub"), fix: { command: "gh auth login" } };
     }
-    // Push rights per project: a read of the repository's own permission for this account, never a write.
     const push = [], noPush = [];
     for (const repo of io.repos) {
         const viewed = await gh("gh", ["repo", "view", "--json", "nameWithOwner,viewerPermission"], { cwd: repo, timeoutMs: PROBE_MS, maxBuffer: 16 * 1024 }).catch(() => null);
@@ -264,7 +242,6 @@ async function probeLinear(io, key) {
         return { outcome: "failed", problem: unreachable("Linear") };
     }
 }
-/** Whether something answers at host:port: a connection opened and closed, no login and no message. */
 export function reachServer(host, port, secure) {
     return new Promise((resolve, reject) => {
         const socket = secure ? tlsConnect({ host, port, servername: host, timeout: PROBE_MS }) : tcpConnect({ host, port, timeout: PROBE_MS });
@@ -314,7 +291,6 @@ async function probeAgent(io, provider) {
         default: return { outcome: "ok", account, detail: "Signed in; the account couldn't be read" };
     }
 }
-// ---------------------------------------------------------------- targets
 function targets(io) {
     const { store, dir, env } = io;
     const uses = triggerUses(store);
@@ -345,7 +321,6 @@ function targets(io) {
         setup: place("/settings/teams"), fix: place("/settings/teams"), usedBy: chatUses("teams"), activity: teams === null ? NO_ACTIVITY : chatActivity(store, "teams", teams.installation),
         probe: teams === null ? null : check => probeTeams(check, teams),
     });
-    // GitHub: always worth checking (gh is how results become pull requests); webhook deliveries count when public.
     const githubUses = uses.filter(one => one.kind === "github");
     const hooksPublic = readHooksBase(dir) !== null;
     const githubActivity = triggerActivity(githubUses.filter(one => one.delivery !== "webhook" || hooksPublic));
@@ -374,7 +349,6 @@ function targets(io) {
         setup: place("/settings/alerts#email"), fix: place("/settings/alerts#email"), usedBy: [...flowWords(emailUses)], activity: merge(triggerActivity(emailUses), watchActivity),
         probe: email === null ? null : check => probeEmail(check, { host: email.host, port: email.port, secure: email.secure }, email.imap),
     });
-    // Each project's MCP tools: the server starts and lists its tools.
     const toolHome = io.toolHome;
     let anyTool = false;
     for (const repo of io.repos) {
@@ -382,7 +356,6 @@ function targets(io) {
             anyTool = true;
             const href = `/settings/tools?repo=${encodeURIComponent(repo)}#tool-${encodeURIComponent(tool.name)}`;
             const test = tool.lastTest;
-            // Which secrets are set, by name only: no value is read to say how runs get them.
             let credentials;
             try {
                 credentials = credentialModeOf(tool.spec, secretsSetFor(repo, tool.spec, toolHome))?.words;
@@ -408,7 +381,6 @@ function targets(io) {
     }
     if (!anyTool)
         list.push({ key: "mcp", group: "tools", name: "MCP tools", configured: false, account: null, setup: place("/settings/tools"), fix: place("/settings/tools"), usedBy: [], activity: NO_ACTIVITY, probe: null });
-    // Monitoring: the delivery loop is the check; its status row says how it's going.
     const monitoring = readMonitoring(dir);
     const destinations = [
         ...(monitoring.webhook === null ? [] : [{ sink: "webhook", name: "Audit webhook", account: origin(monitoring.webhook.url), address: monitoring.webhook.url, uses: "Audit stream" }]),
@@ -438,7 +410,6 @@ function targets(io) {
     }
     return list;
 }
-// ---------------------------------------------------------------- the list
 function combine(target, row) {
     const base = { key: target.key, group: target.group, name: target.name, usedBy: target.usedBy, ...(target.custom ? { custom: true } : {}), ...(target.credentials === undefined ? {} : { credentials: target.credentials }) };
     const checked = target.probe === null || row !== undefined;
@@ -451,7 +422,6 @@ function combine(target, row) {
     if (!target.configured || row?.outcome === "absent") {
         return { ...base, ...common, account: null, detail: row?.outcome === "absent" ? row.problem : null, state: "not-set-up", action: { kind: "setup", label: "Set up", ...target.setup } };
     }
-    // Broken: the last check failed, or deliveries are failing and no successful check has come since.
     const failing = row?.outcome === "failed" ? row.problem
         : target.activity.failing && (row === undefined || (target.activity.errorAt ?? "") >= row.checkedAt) ? target.activity.error ?? "Deliveries are failing."
             : null;
@@ -460,13 +430,7 @@ function combine(target, row) {
     }
     return { ...base, ...common, state: "connected", action: { kind: "test", label: "Check connection" } };
 }
-/**
- * youiyoux change requests, one row per project that uses youiyoux (youiyoux-intake.ts): Connected with how many of
- * its requests are queued, Broken when the last pass couldn't read its folder or some of its files, or Not set up when
- * a person turned it off; one row Not set up when no project uses it. Read from the store and the folders' presence.
- */
 function youiyouxIntegrations(io) {
-    // In the order every other row's keys come (combine), so `--json` reads alike.
     const row = (key, account, facts, state, action) => ({
         key, group: "code", name: "youiyoux", usedBy: facts.usedBy ?? [], account, detail: facts.detail, checked: true, checkedAt: facts.checkedAt ?? null,
         lastSuccessAt: facts.lastSuccessAt ?? null, lastError: facts.lastError ?? null, lastErrorAt: facts.lastErrorAt ?? null, state, action,
@@ -493,7 +457,6 @@ function youiyouxIntegrations(io) {
     });
     return rows.length > 0 ? rows : [row("youiyoux", null, { detail: "Starts by itself in a project with a youi.project.json" }, "not-set-up", { kind: "setup", label: "Set up", href: null, command: null })];
 }
-/** Every integration as it stands now, from files and saved history only: no network, no process, never slow. */
 export function integrationsNow(io) {
     const rows = readIntegrationChecks(io.store);
     const list = targets(io).map(target => combine(target, rows.get(target.key)));
@@ -501,7 +464,6 @@ export function integrationsNow(io) {
     list.splice(linear + 1, 0, ...youiyouxIntegrations(io));
     return list;
 }
-/** Run the checks (all, or the named ones), record each answer, and return the list. */
 export async function checkIntegrations(io, keys) {
     const clock = io.clock ?? (() => new Date());
     const wanted = targets(io).filter(one => one.probe !== null && (keys === undefined || keys.includes(one.key)));
@@ -517,7 +479,6 @@ export async function checkIntegrations(io, keys) {
     }));
     return integrationsNow(io);
 }
-/** The one line `status` and `onboard` add when something is Broken; null when nothing is. */
 export function integrationsBrokenLine(list) {
     const broken = list.filter(one => one.state === "broken").map(one => one.name);
     if (broken.length === 0)
@@ -526,9 +487,7 @@ export function integrationsBrokenLine(list) {
     return `Broken integration${broken.length === 1 ? "" : "s"}: ${names}. See \`toolroll integrations\` or Settings → Integrations.`;
 }
 const whenText = (at) => (at === null ? "never" : `${at.slice(0, 16).replace("T", " ")} UTC`);
-/** Integrations whose secrets Toolroll holds: project tools, the Linear key, a Google mail connection. */
 const holdsSecrets = (one) => one.group === "tools" || one.key === "linear" || one.key === "email";
-/** The one line about where secrets rest, or null: a folder that can't be used always; files only once something set up holds secrets. */
 export function secretsNote(list, secrets) {
     if (secrets === null || secrets === undefined)
         return null;
@@ -536,8 +495,6 @@ export function secretsNote(list, secrets) {
         return { words: secrets.problem, problem: true };
     return secrets.filesOnly && list.some(one => holdsSecrets(one) && one.state !== "not-set-up") ? { words: secrets.words, problem: false } : null;
 }
-/** The CLI's lines: one per integration, then the fix under anything Broken; last, where secrets are kept when that is
- * files only, or why they can't be used (secretsNote). */
 export function renderIntegrations(list, secrets = null) {
     const width = Math.min(24, Math.max(...list.map(one => one.name.length)));
     const said = secretsNote(list, secrets);