unfairly 0.8.2 → 0.8.4

package/dist/cmd/pace.js

@@ -1,393 +1,4 @@
-import { getToken } from "../sync/credentials.js";
-import fs from "node:fs/promises";
-import { randomUUID } from "node:crypto";
-import os from "node:os";
-import path from "node:path";
-import { PaceEventV3Schema } from "../pace/schema.js";
-import { normalizeHookEvent } from "../pace/normalize.js";
-import { appendPaceEvent, paceSpoolPath, readPaceEvents, removePaceEvents } from "../pace/spool.js";
-import { currentDevicePlatform, detectPaceClients, paceDevicePath, readOrCreatePaceDevice, writePaceDevice, } from "../pace/device.js";
-const DEFAULT_API = "https://app.unfairly.ai";
-export const RUNTIME_VERSION = "0.8.2";
-const PLUGIN_VERSION = "0.1.0";
-export const INTELLIGENCE_POLICY = {
-    version: "metadata-v3",
-    mode: "metadata_only",
-    permitted_fields: [
-        "event_id", "installation_id", "session_id", "workflow_id", "occurred_at",
-        "source", "event_type", "evidence_level", "model_family", "tool_category",
-        "blocker_category", "approval_mode", "permission_mode", "duration_bucket",
-        "exit_code_bucket", "token_counts", "playbook_id", "playbook_version",
-        "repository_id", "commit_sha", "artifact_type", "outcome_state",
-    ],
-    prohibited_content: [
-        "prompts", "responses", "source code", "file contents", "screenshots",
-        "keystrokes", "clipboard", "raw commands", "arguments", "tool output",
-        "stdout", "stderr", "paths", "filenames", "repository names", "branches",
-        "URLs", "titles", "secrets", "arbitrary errors",
-    ],
-};
-async function readStdin() {
-    if (process.stdin.isTTY)
-        return {};
-    let raw = "";
-    for await (const chunk of process.stdin)
-        raw += String(chunk);
-    if (!raw.trim())
-        return {};
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return {};
-    }
-}
-export async function runPaceCapture(source, hookEvent) {
-    const device = await readOrCreatePaceDevice();
-    if (device.paused)
-        return;
-    const event = normalizeHookEvent({
-        source,
-        hookEvent,
-        payload: await readStdin(),
-        installationId: device.installation_id,
-    });
-    await appendPaceEvent(event);
-    const boundary = event.event_type === "session.started" || event.event_type === "session.ended" || event.event_type === "workflow.stopped";
-    if (boundary) {
-        // Session summaries (model, tokens, commits) come from the client's own
-        // transcript, which hook payloads do not carry. Summarize whatever changed
-        // since the last sweep; a failure here must never break the AI workflow.
-        await runPaceSweep().catch(() => undefined);
-    }
-    if (process.env.UNFAIRLY_PACE_NO_FLUSH !== "1" && boundary) {
-        // A telemetry outage must never break the employee's AI workflow. Keep the
-        // durable queue and retry on the next session boundary or explicit flush.
-        await runPaceFlush().catch(() => undefined);
-    }
-}
-const SWEEP_OVERLAP_MS = 15 * 60_000;
-const FIRST_SWEEP_LOOKBACK_MS = 2 * 86_400_000;
-/** Summarizes local sessions changed since the last sweep and queues them for upload. */
-export async function runPaceSweep(options = {}) {
-    const { sweepLocalSessions } = await import("../pace/session-summary.js");
-    const device = await readOrCreatePaceDevice();
-    const startedAt = Date.now();
-    const last = device.last_session_sweep_at ? Date.parse(device.last_session_sweep_at) : startedAt - FIRST_SWEEP_LOOKBACK_MS;
-    const result = await sweepLocalSessions({
-        since: options.sinceMs ?? last - SWEEP_OVERLAP_MS,
-        installationId: device.installation_id,
-        collectedVia: options.collectedVia ?? "hook",
-    });
-    await writePaceDevice({ ...(await readOrCreatePaceDevice()), last_session_sweep_at: new Date(startedAt).toISOString() });
-    return result;
-}
-function apiBase() {
-    return (process.env.UNFAIRLY_API_URL ?? DEFAULT_API).replace(/\/$/, "");
-}
-/** Pulls the organization's approved repositories so sessions can carry repository IDs and commit SHAs. */
-export async function refreshRepositoryPolicy(options = {}) {
-    const device = await readOrCreatePaceDevice();
-    const fresh = device.repository_policy_refreshed_at && Date.now() - Date.parse(device.repository_policy_refreshed_at) < 3_600_000;
-    if (fresh && !options.force)
-        return null;
-    const token = await getToken();
-    if (!token)
-        return null;
-    const response = await fetch(`${apiBase()}/api/ai-pace/repository-policy`, { headers: { Authorization: `Bearer ${token}` } });
-    if (!response.ok)
-        return null;
-    const { parseRepositoryPolicy, repositoryPolicyPath } = await import("../pace/repository.js");
-    const policy = parseRepositoryPolicy(await response.json());
-    const file = repositoryPolicyPath();
-    await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-    await fs.writeFile(file, `${JSON.stringify(policy, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-    await writePaceDevice({ ...(await readOrCreatePaceDevice()), repository_policy_refreshed_at: new Date().toISOString() });
-    return { repositories: policy.mappings.length };
-}
-async function uploadSessionSummaries(token) {
-    const { readSessionSpool, removeSessionSummaries } = await import("../pace/session-summary.js");
-    let sent = 0;
-    for (let round = 0; round < 50; round += 1) {
-        const pending = Object.values(await readSessionSpool()).slice(0, 100);
-        if (!pending.length)
-            break;
-        const response = await fetch(`${apiBase()}/api/ai-pace/sessions`, {
-            method: "POST",
-            headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-            body: JSON.stringify({ sessions: pending }),
-        });
-        if (!response.ok)
-            throw new Error(`Unfairly Intelligence session upload failed (${response.status})`);
-        await removeSessionSummaries(pending);
-        sent += pending.length;
-    }
-    return { sent, remaining: Object.keys(await readSessionSpool()).length };
-}
-/** Summarizes and uploads the last `days` of local sessions so Intelligence has history from day one. */
-export async function runPaceBackfill(days) {
-    const policy = await refreshRepositoryPolicy({ force: true }).catch(() => null);
-    // Uploads are only accepted from a registered, active installation.
-    await runPaceHeartbeat();
-    const sweep = await runPaceSweep({ sinceMs: Date.now() - days * 86_400_000, collectedVia: "backfill" });
-    const token = await getToken();
-    if (!token)
-        throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");
-    const upload = await uploadSessionSummaries(token);
-    return { summarized: sweep.summarized, uploaded: upload.sent, remaining: upload.remaining, approved_repositories: policy?.repositories ?? null };
-}
-export async function runPaceFlush() {
-    const token = await getToken();
-    if (!token)
-        throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");
-    await refreshRepositoryPolicy().catch(() => null);
-    const sessions = await uploadSessionSummaries(token);
-    const events = await readPaceEvents();
-    if (!events.length)
-        return { sent: 0, remaining: 0, sessions_sent: sessions.sent };
-    const apiUrl = (process.env.UNFAIRLY_API_URL ?? DEFAULT_API).replace(/\/$/, "");
-    const device = await readOrCreatePaceDevice();
-    const attributedEvents = events.map((event) => ({
-        ...event,
-        installation_id: event.installation_id ?? device.installation_id,
-    }));
-    const response = await fetch(`${apiUrl}/api/ai-pace/events`, {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/json",
-            ...(device.attestation ? { "X-AI-Pace-Attestation": device.attestation } : {}),
-        },
-        body: JSON.stringify({ events: attributedEvents }),
-    });
-    if (!response.ok)
-        throw new Error(`Unfairly Intelligence upload failed (${response.status})`);
-    await removePaceEvents(new Set(events.map((event) => event.event_id)));
-    const remaining = (await readPaceEvents()).length;
-    await writePaceDevice({ ...(await readOrCreatePaceDevice()), last_upload_at: new Date().toISOString(), collection_policy_version: "metadata-v3" });
-    return { sent: events.length, remaining, sessions_sent: sessions.sent };
-}
-export async function runPaceHeartbeat() {
-    const token = await getToken();
-    if (!token)
-        throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");
-    const device = await readOrCreatePaceDevice();
-    const clients = await detectPaceClients();
-    const apiUrl = (process.env.UNFAIRLY_API_URL ?? DEFAULT_API).replace(/\/$/, "");
-    const response = await fetch(`${apiUrl}/api/ai-pace/heartbeat`, {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-            installation_id: device.installation_id,
-            agent_version: RUNTIME_VERSION,
-            runtime_version: RUNTIME_VERSION,
-            plugin_version: PLUGIN_VERSION,
-            collection_policy_version: "metadata-v3",
-            ...currentDevicePlatform(),
-            clients,
-        }),
-    });
-    if (!response.ok)
-        throw new Error(`Unfairly Intelligence heartbeat failed (${response.status})`);
-    const body = await response.json();
-    if (!body.attestation || !body.expires_at)
-        throw new Error("Unfairly Intelligence heartbeat returned no attestation");
-    await writePaceDevice({
-        ...device,
-        attestation: body.attestation,
-        attestation_expires_at: body.expires_at,
-        collection_policy_version: "metadata-v3",
-    });
-    return { installation_id: device.installation_id, clients };
-}
-export async function runPaceInstall() {
-    const clients = await detectPaceClients();
-    const { installIntelligence } = await import("../pace/install.js");
-    const installed = await installIntelligence({ version: RUNTIME_VERSION, clients });
-    const device = await readOrCreatePaceDevice();
-    await writePaceDevice({
-        ...device,
-        collection_policy_version: "metadata-v3",
-        intelligence_install: {
-            version: RUNTIME_VERSION,
-            runtime_entrypoint: installed.runtime_entrypoint,
-            marketplace_root: installed.marketplace_root,
-            owned_paths: installed.owned_paths,
-            activated_clients: installed.activations.filter((item) => item.status === "activated").map((item) => item.client),
-            installed_at: new Date().toISOString(),
-        },
-    });
-    await runPaceHeartbeat();
-    return {
-        runtime_entrypoint: installed.runtime_entrypoint,
-        marketplace_root: installed.marketplace_root,
-        activations: installed.activations,
-        verification: { heartbeat: "ok", live_events: "pending_first_session" },
-    };
-}
-export async function runPaceStatus() {
-    const queued = (await readPaceEvents()).length;
-    const device = await readOrCreatePaceDevice();
-    const clients = await detectPaceClients();
-    process.stdout.write(JSON.stringify({
-        enabled: !device.paused,
-        paused: Boolean(device.paused),
-        installation_id: device.installation_id,
-        attestation_expires_at: device.attestation_expires_at ?? null,
-        last_upload_at: device.last_upload_at ?? null,
-        runtime_version: RUNTIME_VERSION,
-        plugin_version: PLUGIN_VERSION,
-        collection_policy_version: device.collection_policy_version ?? INTELLIGENCE_POLICY.version,
-        queued,
-        spool: paceSpoolPath(),
-        clients,
-    }, null, 2) + "\n");
-}
-export async function runPaceConfig(input) {
-    const { writeManagedConfigs } = await import("../pace/managed-config.js");
-    const files = await writeManagedConfigs(input);
-    const device = await readOrCreatePaceDevice();
-    await writePaceDevice({ ...device, managed_files: files, collection_policy_version: "metadata-v3" });
-    return files;
-}
-export function runPacePolicy() {
-    return INTELLIGENCE_POLICY;
-}
-export async function runPacePause(paused) {
-    const device = await readOrCreatePaceDevice();
-    await writePaceDevice({ ...device, paused });
-    return { paused };
-}
-export async function runPaceUninstall() {
-    const device = await readOrCreatePaceDevice();
-    const activated = new Set(device.intelligence_install?.activated_clients ?? []);
-    const { spawnSync } = await import("node:child_process");
-    if (activated.has("codex")) {
-        spawnSync("codex", ["plugin", "remove", "ai-pace@unfairly-intelligence", "--json"], { encoding: "utf8", timeout: 30_000 });
-        spawnSync("codex", ["plugin", "marketplace", "remove", "unfairly-intelligence"], { encoding: "utf8", timeout: 30_000 });
-    }
-    if (activated.has("claude_code")) {
-        spawnSync("claude", ["plugin", "uninstall", "ai-pace@unfairly-intelligence", "--scope", "user"], { encoding: "utf8", timeout: 30_000 });
-        spawnSync("claude", ["plugin", "marketplace", "remove", "unfairly-intelligence", "--scope", "user"], { encoding: "utf8", timeout: 30_000 });
-    }
-    const permitted = new Set([
-        "codex-requirements.toml", "claude-settings.json", "gemini-settings.json",
-        "evidence-policy.json", "repository-policy.json",
-    ]);
-    let removed = 0;
-    for (const file of device.managed_files ?? []) {
-        const name = file.split(/[\\/]/).at(-1);
-        if (!name || !permitted.has(name))
-            continue;
-        await fs.unlink(file).then(() => { removed += 1; }).catch((error) => {
-            if (error.code !== "ENOENT")
-                throw error;
-        });
-    }
-    const safeOwnedRoots = [
-        path.join(os.homedir(), ".unfairly"),
-        path.join(os.homedir(), ".cursor", "plugins", "local", "ai-pace"),
-        path.join(os.homedir(), ".gemini", "extensions", "unfairly-intelligence"),
-    ];
-    for (const ownedPath of device.intelligence_install?.owned_paths ?? []) {
-        const resolved = path.resolve(ownedPath);
-        if (!safeOwnedRoots.some((root) => resolved === root || resolved.startsWith(`${root}${path.sep}`)))
-            continue;
-        await fs.rm(resolved, { recursive: true, force: true });
-        removed += 1;
-    }
-    await fs.unlink(paceSpoolPath()).catch((error) => {
-        if (error.code !== "ENOENT")
-            throw error;
-    });
-    await fs.unlink(paceDevicePath()).catch((error) => {
-        if (error.code !== "ENOENT" && error.code !== "EISDIR")
-            throw error;
-    });
-    return { removed_files: removed, retained_global_credentials: true };
-}
-export async function runPaceEvidenceScan(policyPath) {
-    const { scanLocalEvidence } = await import("../pace/local-evidence.js");
-    const device = await readOrCreatePaceDevice();
-    const result = await scanLocalEvidence({ policyPath, installationId: device.installation_id });
-    await Promise.all(result.events.map((event) => appendPaceEvent(event)));
-    return { observed: result.events.length, baseline_roots: result.baselineRoots, queued: (await readPaceEvents()).length };
-}
-export async function runPaceEvidenceWatch(policyPath) {
-    const { readLocalEvidencePolicy } = await import("../pace/local-evidence.js");
-    const policy = await readLocalEvidencePolicy(policyPath);
-    process.stdout.write(`Unfairly Intelligence is watching ${policy.roots.length} approved local evidence root(s).\n`);
-    const scan = async () => {
-        const result = await runPaceEvidenceScan(policyPath);
-        if (result.observed)
-            await runPaceFlush().catch(() => undefined);
-    };
-    await scan();
-    await new Promise((resolve) => {
-        const timer = setInterval(() => { void scan(); }, policy.scan_interval_seconds * 1000);
-        const stop = () => { clearInterval(timer); resolve(); };
-        process.once("SIGINT", stop);
-        process.once("SIGTERM", stop);
-    });
-}
-export async function runPacePlaybooks(query) {
-    const token = await getToken();
-    if (!token)
-        throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");
-    const apiUrl = (process.env.UNFAIRLY_API_URL ?? DEFAULT_API).replace(/\/$/, "");
-    const params = query?.trim() ? `?q=${encodeURIComponent(query.trim())}` : "";
-    const response = await fetch(`${apiUrl}/api/ai-pace/playbooks${params}`, {
-        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
-    });
-    if (!response.ok)
-        throw new Error(`Unfairly Intelligence playbooks failed (${response.status})`);
-    const body = await response.json();
-    return body.playbooks ?? [];
-}
-export async function runPacePlaybookUse(playbookId, playbookVersion) {
-    const token = await getToken();
-    if (!token)
-        throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");
-    const device = await readOrCreatePaceDevice();
-    if (device.paused)
-        throw new Error("Unfairly Intelligence is paused. Run `unfairly intelligence resume` first.");
-    const workflowId = randomUUID();
-    const sourceRecordId = randomUUID();
-    const event = PaceEventV3Schema.parse({
-        schema_version: 3,
-        collection_policy_version: "metadata-v3",
-        event_id: randomUUID(),
-        installation_id: device.installation_id,
-        occurred_at: new Date().toISOString(),
-        source: "unknown",
-        event_type: "session.started",
-        evidence_level: "exact",
-        session_id: sourceRecordId,
-        workflow_id: workflowId,
-        playbook_id: playbookId,
-        playbook_version: playbookVersion,
-        attributes: { client_event: "session_start" },
-    });
-    await appendPaceEvent(event);
-    const apiUrl = (process.env.UNFAIRLY_API_URL ?? DEFAULT_API).replace(/\/$/, "");
-    const response = await fetch(`${apiUrl}/api/ai-pace/playbooks`, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-        body: JSON.stringify({
-            action: "record",
-            playbook_id: playbookId,
-            playbook_version: Number(playbookVersion),
-            event_type: "started",
-            source_record_id: sourceRecordId,
-            workflow_id: workflowId,
-        }),
-    });
-    // The event remains safely spooled when the marketplace endpoint is offline.
-    if (!response.ok && response.status < 500)
-        throw new Error(`Unfairly Intelligence playbook use failed (${response.status})`);
-    return { workflow_id: workflowId, queued: (await readPaceEvents()).length };
-}
-//# sourceMappingURL=pace.js.map
+import{getToken as v}from"../sync/credentials.js";import u from"node:fs/promises";import{randomUUID as h}from"node:crypto";import g from"node:os";import d from"node:path";import{PaceEventV3Schema as D}from"../pace/schema.js";import{normalizeHookEvent as j}from"../pace/normalize.js";import{appendPaceEvent as k,paceSpoolPath as x,readPaceEvents as _,removePaceEvents as z}from"../pace/spool.js";import{currentDevicePlatform as C,detectPaceClients as I,paceDevicePath as F,readOrCreatePaceDevice as c,writePaceDevice as p}from"../pace/device.js";const f="https://app.unfairly.ai",w="0.8.4",O="0.1.0",R={version:"metadata-v3",mode:"metadata_only",permitted_fields:["event_id","installation_id","session_id","workflow_id","occurred_at","source","event_type","evidence_level","model_family","tool_category","blocker_category","approval_mode","permission_mode","duration_bucket","exit_code_bucket","token_counts","playbook_id","playbook_version","repository_id","commit_sha","artifact_type","outcome_state"],prohibited_content:["prompts","responses","source code","file contents","screenshots","keystrokes","clipboard","raw commands","arguments","tool output","stdout","stderr","paths","filenames","repository names","branches","URLs","titles","secrets","arbitrary errors"]};async function Y(){if(process.stdin.isTTY)return{};let n="";for await(const t of process.stdin)n+=String(t);if(!n.trim())return{};try{return JSON.parse(n)}catch{return{}}}async function ne(n,t){const e=await c();if(e.paused)return;const a=j({source:n,hookEvent:t,payload:await Y(),installationId:e.installation_id});await k(a),(a.event_type==="session.started"||a.event_type==="session.ended"||a.event_type==="workflow.stopped")&&await V({flush:process.env.UNFAIRLY_PACE_NO_FLUSH!=="1"}).catch(()=>{})}const B=15*6e4,J=2*864e5,M=90;async function V(n={}){if(!await m())return null;const t=await c(),e=await P({force:!t.history_backfilled_at}).catch(()=>null),a=!t.history_backfilled_at||!!e?.changed,i=a?await S({sinceMs:Date.now()-M*864e5,collectedVia:"backfill"}):await S();return a&&await p({...await c(),history_backfilled_at:new Date().toISOString()}),n.flush!==!1&&await $().catch(()=>{}),{summarized:i.summarized,backfilled:a}}async function S(n={}){const{sweepLocalSessions:t}=await import("../pace/session-summary.js"),e=await c(),a=Date.now(),i=e.last_session_sweep_at?Date.parse(e.last_session_sweep_at):a-J,o=await t({since:n.sinceMs??i-B,installationId:e.installation_id,collectedVia:n.collectedVia??"hook"});return await p({...await c(),last_session_sweep_at:new Date(a).toISOString()}),o}async function m(){const{collectorAuthorization:n,readCollectorCredential:t}=await import("../pace/enroll.js"),e=await t();if(e)return n(e);const a=await v();return a?`Bearer ${a}`:null}function A(){return(process.env.UNFAIRLY_API_URL??f).replace(/\/$/,"")}async function P(n={}){const t=await c();if(t.repository_policy_refreshed_at&&Date.now()-Date.parse(t.repository_policy_refreshed_at)<36e5&&!n.force)return null;const a=await m();if(!a)return null;const i=await fetch(`${A()}/api/ai-pace/repository-policy`,{headers:{Authorization:a}});if(!i.ok)return null;const{parseRepositoryPolicy:o,repositoryPolicyPath:s}=await import("../pace/repository.js"),l=o(await i.json()),r=s(),b=await u.readFile(r,"utf8").then(y=>o(JSON.parse(y)),()=>null),E=y=>(y?.mappings??[]).map(U=>`${U.repository_id}:${U.remote_fingerprint}`).sort().join(","),T=b!==null&&E(b)!==E(l);return await u.mkdir(d.dirname(r),{recursive:!0,mode:448}),await u.writeFile(r,`${JSON.stringify(l,null,2)}
+`,{encoding:"utf8",mode:384}),await p({...await c(),repository_policy_refreshed_at:new Date().toISOString()}),{repositories:l.mappings.length,changed:T}}async function N(n){const{readSessionSpool:t,removeSessionSummaries:e}=await import("../pace/session-summary.js");let a=0;for(let i=0;i<50;i+=1){const o=Object.values(await t()).slice(0,100);if(!o.length)break;const s=await fetch(`${A()}/api/ai-pace/sessions`,{method:"POST",headers:{Authorization:n,"Content-Type":"application/json"},body:JSON.stringify({sessions:o})});if(!s.ok)throw new Error(`Unfairly Intelligence session upload failed (${s.status})`);await e(o),a+=o.length}return{sent:a,remaining:Object.keys(await t()).length}}async function ae(n){const t=await P({force:!0}).catch(()=>null);await L();const e=await S({sinceMs:Date.now()-n*864e5,collectedVia:"backfill"}),a=await m();if(!a)throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");const i=await N(a);return{summarized:e.summarized,uploaded:i.sent,remaining:i.remaining,approved_repositories:t?.repositories??null}}async function $(){const n=await m();if(!n)throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");await P().catch(()=>null);const t=await N(n),e=await _();if(!e.length)return{sent:0,remaining:0,sessions_sent:t.sent};const a=(process.env.UNFAIRLY_API_URL??f).replace(/\/$/,""),i=await c(),o=e.map(r=>({...r,installation_id:r.installation_id??i.installation_id})),s=await fetch(`${a}/api/ai-pace/events`,{method:"POST",headers:{Authorization:n,"Content-Type":"application/json",...i.attestation?{"X-AI-Pace-Attestation":i.attestation}:{}},body:JSON.stringify({events:o})});if(!s.ok)throw new Error(`Unfairly Intelligence upload failed (${s.status})`);await z(new Set(e.map(r=>r.event_id)));const l=(await _()).length;return await p({...await c(),last_upload_at:new Date().toISOString(),collection_policy_version:"metadata-v3"}),{sent:e.length,remaining:l,sessions_sent:t.sent}}async function L(){const n=await m();if(!n)throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");const t=await c(),e=await I(),a=(process.env.UNFAIRLY_API_URL??f).replace(/\/$/,""),i=await fetch(`${a}/api/ai-pace/heartbeat`,{method:"POST",headers:{Authorization:n,"Content-Type":"application/json"},body:JSON.stringify({installation_id:t.installation_id,agent_version:w,runtime_version:w,plugin_version:O,collection_policy_version:"metadata-v3",...C(),clients:e})});if(!i.ok)throw new Error(`Unfairly Intelligence heartbeat failed (${i.status})`);const o=await i.json();if(!o.attestation||!o.expires_at)throw new Error("Unfairly Intelligence heartbeat returned no attestation");return await p({...t,attestation:o.attestation,attestation_expires_at:o.expires_at,collection_policy_version:"metadata-v3"}),{installation_id:t.installation_id,clients:e}}async function ie(){const n=await I(),{installIntelligence:t}=await import("../pace/install.js"),e=await t({version:w,clients:n}),a=await c();return await p({...a,collection_policy_version:"metadata-v3",intelligence_install:{version:w,runtime_entrypoint:e.runtime_entrypoint,marketplace_root:e.marketplace_root,owned_paths:e.owned_paths,activated_clients:e.activations.filter(i=>i.status==="activated").map(i=>i.client),installed_at:new Date().toISOString()}}),await L(),{runtime_entrypoint:e.runtime_entrypoint,marketplace_root:e.marketplace_root,activations:e.activations,verification:{heartbeat:"ok",live_events:"pending_first_session"}}}async function oe(){const n=(await _()).length,t=await c(),e=await I();process.stdout.write(JSON.stringify({enabled:!t.paused,paused:!!t.paused,installation_id:t.installation_id,attestation_expires_at:t.attestation_expires_at??null,last_upload_at:t.last_upload_at??null,runtime_version:w,plugin_version:O,collection_policy_version:t.collection_policy_version??R.version,queued:n,spool:x(),clients:e},null,2)+`
+`)}async function se(n){const{writeManagedConfigs:t}=await import("../pace/managed-config.js"),e=await t(n),a=await c();return await p({...a,managed_files:e,collection_policy_version:"metadata-v3"}),e}function re(){return R}async function ce(n){const t=await c();return await p({...t,paused:n}),{paused:n}}async function le(){const n=await c(),t=new Set(n.intelligence_install?.activated_clients??[]),{spawnSync:e}=await import("node:child_process");t.has("codex")&&(e("codex",["plugin","remove","ai-pace@unfairly-intelligence","--json"],{encoding:"utf8",timeout:3e4}),e("codex",["plugin","marketplace","remove","unfairly-intelligence"],{encoding:"utf8",timeout:3e4})),t.has("claude_code")&&(e("claude",["plugin","uninstall","ai-pace@unfairly-intelligence","--scope","user"],{encoding:"utf8",timeout:3e4}),e("claude",["plugin","marketplace","remove","unfairly-intelligence","--scope","user"],{encoding:"utf8",timeout:3e4}));const a=new Set(["codex-requirements.toml","claude-settings.json","gemini-settings.json","evidence-policy.json","repository-policy.json"]);let i=0;for(const s of n.managed_files??[]){const l=s.split(/[\\/]/).at(-1);!l||!a.has(l)||await u.unlink(s).then(()=>{i+=1}).catch(r=>{if(r.code!=="ENOENT")throw r})}const o=[d.join(g.homedir(),".unfairly"),d.join(g.homedir(),".cursor","plugins","local","ai-pace"),d.join(g.homedir(),".gemini","extensions","unfairly-intelligence")];for(const s of n.intelligence_install?.owned_paths??[]){const l=d.resolve(s);o.some(r=>l===r||l.startsWith(`${r}${d.sep}`))&&(await u.rm(l,{recursive:!0,force:!0}),i+=1)}return await u.unlink(x()).catch(s=>{if(s.code!=="ENOENT")throw s}),await u.unlink(F()).catch(s=>{if(s.code!=="ENOENT"&&s.code!=="EISDIR")throw s}),{removed_files:i,retained_global_credentials:!0}}async function q(n){const{scanLocalEvidence:t}=await import("../pace/local-evidence.js"),e=await c(),a=await t({policyPath:n,installationId:e.installation_id});return await Promise.all(a.events.map(i=>k(i))),{observed:a.events.length,baseline_roots:a.baselineRoots,queued:(await _()).length}}async function pe(n){const{readLocalEvidencePolicy:t}=await import("../pace/local-evidence.js"),e=await t(n);process.stdout.write(`Unfairly Intelligence is watching ${e.roots.length} approved local evidence root(s).
+`);const a=async()=>{(await q(n)).observed&&await $().catch(()=>{})};await a(),await new Promise(i=>{const o=setInterval(()=>{a()},e.scan_interval_seconds*1e3),s=()=>{clearInterval(o),i()};process.once("SIGINT",s),process.once("SIGTERM",s)})}async function ue(n){const t=await v();if(!t)throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");const e=(process.env.UNFAIRLY_API_URL??f).replace(/\/$/,""),a=n?.trim()?`?q=${encodeURIComponent(n.trim())}`:"",i=await fetch(`${e}/api/ai-pace/playbooks${a}`,{headers:{Authorization:`Bearer ${t}`,Accept:"application/json"}});if(!i.ok)throw new Error(`Unfairly Intelligence playbooks failed (${i.status})`);return(await i.json()).playbooks??[]}async function de(n,t){const e=await v();if(!e)throw new Error("Unfairly Intelligence is not enrolled. Run `unfairly setup` first.");const a=await c();if(a.paused)throw new Error("Unfairly Intelligence is paused. Run `unfairly intelligence resume` first.");const i=h(),o=h(),s=D.parse({schema_version:3,collection_policy_version:"metadata-v3",event_id:h(),installation_id:a.installation_id,occurred_at:new Date().toISOString(),source:"unknown",event_type:"session.started",evidence_level:"exact",session_id:o,workflow_id:i,playbook_id:n,playbook_version:t,attributes:{client_event:"session_start"}});await k(s);const l=(process.env.UNFAIRLY_API_URL??f).replace(/\/$/,""),r=await fetch(`${l}/api/ai-pace/playbooks`,{method:"POST",headers:{Authorization:`Bearer ${e}`,"Content-Type":"application/json"},body:JSON.stringify({action:"record",playbook_id:n,playbook_version:Number(t),event_type:"started",source_record_id:o,workflow_id:i})});if(!r.ok&&r.status<500)throw new Error(`Unfairly Intelligence playbook use failed (${r.status})`);return{workflow_id:i,queued:(await _()).length}}export{M as HISTORY_BACKFILL_DAYS,R as INTELLIGENCE_POLICY,w as RUNTIME_VERSION,m as paceAuthorization,P as refreshRepositoryPolicy,ae as runPaceBackfill,ne as runPaceCapture,se as runPaceConfig,q as runPaceEvidenceScan,pe as runPaceEvidenceWatch,$ as runPaceFlush,L as runPaceHeartbeat,ie as runPaceInstall,ce as runPacePause,de as runPacePlaybookUse,ue as runPacePlaybooks,re as runPacePolicy,oe as runPaceStatus,S as runPaceSweep,V as runPaceSync,le as runPaceUninstall};

package/dist/cmd/parse-share-input.d.ts

@@ -3,4 +3,3 @@ export type ParsedShareInput = {
     origin: string | null;
 };
 export declare function parseShareInput(input: string): ParsedShareInput;
-//# sourceMappingURL=parse-share-input.d.ts.map

package/dist/cmd/parse-share-input.js

@@ -1,56 +1 @@
-// cli/src/cmd/parse-share-input.ts
-//
-// Parse the positional arg to `unfairly connect`. Accepts:
-//   - Full URL:  https://app.unfairly.ai/s/<uuid>
-//   - Short form: s/<uuid>
-//   - Bare UUID:  <uuid>
-//
-// Returns the share_link UUID + the origin (when present in the input)
-// so `connect` can POST to the same host the link came from. A bare UUID
-// or short form yields `origin: null` — callers should fall back to the
-// production app origin.
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-export function parseShareInput(input) {
-    if (typeof input !== "string") {
-        throw new Error("share link is required");
-    }
-    const trimmed = input.trim();
-    if (trimmed.length === 0) {
-        throw new Error("share link is required");
-    }
-    // Full URL form: https://host/s/<uuid> (with optional trailing slash / query).
-    if (/^https?:\/\//i.test(trimmed)) {
-        let url;
-        try {
-            url = new URL(trimmed);
-        }
-        catch {
-            throw new Error(`not a valid URL: ${trimmed}`);
-        }
-        const segments = url.pathname.split("/").filter(Boolean);
-        // Expect [..., "s", "<uuid>"] — find the "s/" marker.
-        const sIdx = segments.indexOf("s");
-        if (sIdx === -1 || sIdx === segments.length - 1) {
-            throw new Error(`share link URL must include /s/<id>: ${trimmed}`);
-        }
-        const candidate = segments[sIdx + 1] ?? "";
-        if (!UUID_RE.test(candidate)) {
-            throw new Error(`share id must be a UUID, got "${candidate}"`);
-        }
-        return { shareId: candidate.toLowerCase(), origin: url.origin };
-    }
-    // Short form: s/<uuid>
-    if (/^s\//i.test(trimmed)) {
-        const candidate = trimmed.slice(2);
-        if (!UUID_RE.test(candidate)) {
-            throw new Error(`share id must be a UUID, got "${candidate}"`);
-        }
-        return { shareId: candidate.toLowerCase(), origin: null };
-    }
-    // Bare UUID
-    if (UUID_RE.test(trimmed)) {
-        return { shareId: trimmed.toLowerCase(), origin: null };
-    }
-    throw new Error(`not a recognized share link: "${input}" — expected a URL like https://app.unfairly.ai/s/<uuid>, "s/<uuid>", or a bare UUID`);
-}
-//# sourceMappingURL=parse-share-input.js.map
+const o=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function a(t){if(typeof t!="string")throw new Error("share link is required");const r=t.trim();if(r.length===0)throw new Error("share link is required");if(/^https?:\/\//i.test(r)){let e;try{e=new URL(r)}catch{throw new Error(`not a valid URL: ${r}`)}const i=e.pathname.split("/").filter(Boolean),n=i.indexOf("s");if(n===-1||n===i.length-1)throw new Error(`share link URL must include /s/<id>: ${r}`);const s=i[n+1]??"";if(!o.test(s))throw new Error(`share id must be a UUID, got "${s}"`);return{shareId:s.toLowerCase(),origin:e.origin}}if(/^s\//i.test(r)){const e=r.slice(2);if(!o.test(e))throw new Error(`share id must be a UUID, got "${e}"`);return{shareId:e.toLowerCase(),origin:null}}if(o.test(r))return{shareId:r.toLowerCase(),origin:null};throw new Error(`not a recognized share link: "${t}" \u2014 expected a URL like https://app.unfairly.ai/s/<uuid>, "s/<uuid>", or a bare UUID`)}export{a as parseShareInput};

package/dist/cmd/pull.d.ts

@@ -1,2 +1 @@
 export declare function runPull(vaultArg?: string): Promise<void>;
-//# sourceMappingURL=pull.d.ts.map

package/dist/cmd/pull.js

@@ -1,143 +1,7 @@
-import { promises as fs } from "node:fs";
-import path from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { SyncClient } from "../sync/api.js";
-import { readManifest, writeManifest } from "../sync/manifest.js";
-import { buildFileFromServer, writeDocFile } from "../sync/files.js";
-import { getToken } from "../sync/credentials.js";
-import { writeAutoloader } from "../sync/autoloader.js";
-const execFileAsync = promisify(execFile);
-async function gitMv(from, to) {
-    try {
-        await execFileAsync("git", ["mv", from, to], { cwd: process.cwd() });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function tryUnlink(p) {
-    try {
-        await fs.unlink(p);
-    }
-    catch { }
-}
-export async function runPull(vaultArg) {
-    const cwd = process.cwd();
-    const manifest = await readManifest(cwd);
-    if (!manifest) {
-        console.error("No .unfairly/ found. Run `unfairly init` first.");
-        process.exit(1);
-    }
-    const token = await getToken();
-    if (!token) {
-        console.error("No token. Run `unfairly init` to authenticate.");
-        process.exit(1);
-    }
-    const client = new SyncClient(manifest.api_url, token);
-    const targets = vaultArg ? [vaultArg] : Object.keys(manifest.vaults);
-    const failures = [];
-    for (const slug of targets) {
-        const v = manifest.vaults[slug];
-        if (!v) {
-            console.error(`No vault \`${slug}\` in manifest.`);
-            continue;
-        }
-        process.stdout.write(`pulling ${slug}... `);
-        let result;
-        try {
-            result = await client.pullAll(slug, v.last_pulled_at);
-        }
-        catch (err) {
-            // One vault failing shouldn't kill the rest of the pull. For a single-
-            // vault target (`unfairly pull <vault>`) we still want to surface and
-            // exit non-zero — fall through to throw at the end.
-            const message = err.message.split("\n")[0];
-            console.log(`FAILED — ${message}`);
-            failures.push({ slug, message });
-            continue;
-        }
-        // Vault root: track_in_git → .unfairly/{slug}/, else .unfairly/cache/{slug}/
-        const vaultRoot = v.track_in_git ? slug : path.join("cache", slug);
-        const absVaultRoot = path.join(cwd, ".unfairly", vaultRoot);
-        await fs.mkdir(absVaultRoot, { recursive: true });
-        let upserts = 0;
-        let deletes = 0;
-        let renames = 0;
-        let skipped = 0;
-        for (const doc of result.docs) {
-            let file;
-            try {
-                file = buildFileFromServer(doc, vaultRoot);
-            }
-            catch (err) {
-                // One bad doc shouldn't kill the whole pull. Most commonly this is
-                // gray-matter/js-yaml choking on body content that the YAML
-                // serializer mis-parses (e.g. `*Foo` interpreted as an alias). The
-                // doc stays on the server; the user can re-pull after the upstream
-                // doc is sanitized.
-                process.stderr.write(`  · skipped ${doc.slug} — ${err.message.split("\n")[0]}\n`);
-                skipped++;
-                continue;
-            }
-            const relPath = file.path;
-            const absPath = path.join(cwd, ".unfairly", relPath);
-            // Detect rename: same id, different stored path
-            const prev = v.docs[doc.id];
-            if (prev && prev.path !== relPath) {
-                const prevAbs = path.join(cwd, ".unfairly", prev.path);
-                // Tracked vault → use git mv to preserve history
-                if (v.track_in_git) {
-                    await fs.mkdir(path.dirname(absPath), { recursive: true });
-                    const ok = await gitMv(prevAbs, absPath);
-                    if (!ok) {
-                        await tryUnlink(prevAbs);
-                    }
-                }
-                else {
-                    await tryUnlink(prevAbs);
-                }
-                renames++;
-            }
-            await writeDocFile(absPath, file.content);
-            v.docs[doc.id] = {
-                slug: doc.slug,
-                path: relPath,
-                sha: file.sha,
-                updated_at: doc.updated_at,
-                source_type: doc.source_type ?? "markdown",
-            };
-            upserts++;
-        }
-        for (const tomb of result.deleted) {
-            const prev = v.docs[tomb.id];
-            if (!prev)
-                continue;
-            const absPath = path.join(cwd, ".unfairly", prev.path);
-            await tryUnlink(absPath);
-            delete v.docs[tomb.id];
-            deletes++;
-        }
-        v.last_pulled_at = new Date().toISOString();
-        console.log(`+${upserts} -${deletes}${renames ? ` ~${renames}` : ""}${skipped ? ` (skipped ${skipped})` : ""}`);
-    }
-    await writeManifest(cwd, manifest);
-    // Regenerate .unfairly/CLAUDE.md autoloader + .gitignore from the latest mirror.
-    // (init prints the @-import paste instruction; pull stays quiet.)
-    const refreshed = await readManifest(cwd);
-    if (refreshed) {
-        const target = path.join(cwd, ".unfairly");
-        await writeAutoloader(target, refreshed);
-    }
-    if (failures.length > 0) {
-        process.stderr.write(`\n${failures.length} vault${failures.length === 1 ? "" : "s"} failed:\n`);
-        for (const f of failures) {
-            process.stderr.write(`  · ${f.slug} — ${f.message}\n`);
-        }
-        // Single-vault target → propagate so callers/CI see the failure.
-        // Multi-vault → keep what we got but signal partial failure via exit code.
-        process.exitCode = 1;
-    }
-}
-//# sourceMappingURL=pull.js.map
+import{promises as g}from"node:fs";import r from"node:path";import{execFile as A}from"node:child_process";import{promisify as P}from"node:util";import{SyncClient as R}from"../sync/api.js";import{readManifest as b,writeManifest as S}from"../sync/manifest.js";import{buildFileFromServer as D,writeDocFile as M}from"../sync/files.js";import{getToken as N}from"../sync/credentials.js";import{writeAutoloader as C}from"../sync/autoloader.js";const I=P(A);async function O(n,o){try{return await I("git",["mv",n,o],{cwd:process.cwd()}),!0}catch{return!1}}async function h(n){try{await g.unlink(n)}catch{}}async function J(n){const o=process.cwd(),a=await b(o);a||(console.error("No .unfairly/ found. Run `unfairly init` first."),process.exit(1));const y=await N();y||(console.error("No token. Run `unfairly init` to authenticate."),process.exit(1));const j=new R(a.api_url,y),x=n?[n]:Object.keys(a.vaults),c=[];for(const t of x){const i=a.vaults[t];if(!i){console.error(`No vault \`${t}\` in manifest.`);continue}process.stdout.write(`pulling ${t}... `);let f;try{f=await j.pullAll(t,i.last_pulled_at)}catch(e){const s=e.message.split(`
+`)[0];console.log(`FAILED \u2014 ${s}`),c.push({slug:t,message:s});continue}const $=i.track_in_git?t:r.join("cache",t),F=r.join(o,".unfairly",$);await g.mkdir(F,{recursive:!0});let v=0,_=0,p=0,d=0;for(const e of f.docs){let s;try{s=D(e,$)}catch(u){process.stderr.write(`  \xB7 skipped ${e.slug} \u2014 ${u.message.split(`
+`)[0]}
+`),d++;continue}const l=s.path,m=r.join(o,".unfairly",l),w=i.docs[e.id];if(w&&w.path!==l){const u=r.join(o,".unfairly",w.path);i.track_in_git?(await g.mkdir(r.dirname(m),{recursive:!0}),await O(u,m)||await h(u)):await h(u),p++}await M(m,s.content),i.docs[e.id]={slug:e.slug,path:l,sha:s.sha,updated_at:e.updated_at,source_type:e.source_type??"markdown"},v++}for(const e of f.deleted){const s=i.docs[e.id];if(!s)continue;const l=r.join(o,".unfairly",s.path);await h(l),delete i.docs[e.id],_++}i.last_pulled_at=new Date().toISOString(),console.log(`+${v} -${_}${p?` ~${p}`:""}${d?` (skipped ${d})`:""}`)}await S(o,a);const k=await b(o);if(k){const t=r.join(o,".unfairly");await C(t,k)}if(c.length>0){process.stderr.write(`
+${c.length} vault${c.length===1?"":"s"} failed:
+`);for(const t of c)process.stderr.write(`  \xB7 ${t.slug} \u2014 ${t.message}
+`);process.exitCode=1}}export{J as runPull};

package/dist/cmd/push.d.ts

@@ -1,2 +1 @@
 export declare function runPush(vaultArg?: string): Promise<void>;
-//# sourceMappingURL=push.d.ts.map