unfold-deploy 0.0.0-stage → 0.2.0

package/dist/core/redact.js

@@ -0,0 +1,79 @@
+// Redacts secrets from captured output before it is displayed or saved.
+// Pattern based, plus exact values of secret-looking environment variables.
+// Env values are only held in memory for matching; they are never stored.
+const R = '[REDACTED]';
+const SECRET_NAME = /(SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIAL|AUTH|COOKIE|SESSION|DSN|DATABASE_URL|CONNECTION_STRING|WEBHOOK|SIGNING)/i;
+const TOKEN_PATTERNS = [
+    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, // GitHub
+    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bglpat-[A-Za-z0-9_-]{20,}\b/g, // GitLab
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, // AWS access key id
+    /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g, // Slack
+    /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{10,}\b/g, // Stripe
+    /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g, // OpenAI / Anthropic style
+    /\bAIza[0-9A-Za-z_-]{35}\b/g, // Google API key
+    /\bnpm_[A-Za-z0-9]{36}\b/g, // npm
+    /\b(?:vcp|vck|vci|vca|vcr)_[A-Za-z0-9]{20,}\b/g, // Vercel-style prefixed tokens
+    /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, // JWT
+];
+const KEY_VALUE = new RegExp(String.raw `\b([A-Za-z0-9_.-]*` + SECRET_NAME.source.replace(/^\(/, '(?:') + String.raw `[A-Za-z0-9_.-]*)(\s*[=:]\s*)(["']?)([^\s"']{3,})\3`, 'gi');
+export class Redactor {
+    envSecrets = [];
+    inPrivateKey = false;
+    constructor(opts = {}) {
+        for (const [name, value] of Object.entries(opts.env ?? {})) {
+            if (value && value.length >= 8 && SECRET_NAME.test(name))
+                this.envSecrets.push({ name, value });
+        }
+        // Longest first so overlapping values are fully replaced.
+        this.envSecrets.sort((a, b) => b.value.length - a.value.length);
+    }
+    line(input) {
+        if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(input)) {
+            this.inPrivateKey = !/-----END [A-Z ]*PRIVATE KEY-----/.test(input);
+            return '-----BEGIN PRIVATE KEY----- ' + R;
+        }
+        if (this.inPrivateKey) {
+            if (/-----END [A-Z ]*PRIVATE KEY-----/.test(input))
+                this.inPrivateKey = false;
+            return R;
+        }
+        let out = input;
+        for (const { name, value } of this.envSecrets) {
+            if (out.includes(value))
+                out = out.split(value).join(`[REDACTED:${name}]`);
+        }
+        // user:password@host in URLs
+        out = out.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/]+):([^\s@/]+)@/gi, `$1$2:${R}@`);
+        // Authorization headers / bearer tokens
+        out = out.replace(/\b(Bearer|Basic|token)\s+([A-Za-z0-9._~+/=-]{12,})/g, `$1 ${R}`);
+        // CLI flags carrying tokens
+        out = out.replace(/(--token[=\s]+|\s-t\s+)(\S+)/g, `$1${R}`);
+        for (const re of TOKEN_PATTERNS)
+            out = out.replace(re, R);
+        out = out.replace(KEY_VALUE, (m, key, sep, q, val) => val.startsWith('[REDACTED') || /^(Bearer|Basic|token)$/i.test(val) ? m : `${key}${sep}${q}${R}${q}`);
+        return out;
+    }
+}
+/** Redacts command-line args before they are shown (token flags, env values). */
+export function redactArgs(args) {
+    const out = [];
+    let hideNext = 'none';
+    for (const arg of args) {
+        if (hideNext !== 'none') {
+            out.push(hideNext === 'value' && arg.includes('=') ? `${arg.split('=')[0]}=${R}` : R);
+            hideNext = 'none';
+            continue;
+        }
+        if (arg === '--token' || arg === '-t')
+            hideNext = 'all';
+        else if (['--env', '-e', '--build-env', '-b'].includes(arg))
+            hideNext = 'value';
+        const m = /^(--token|--env|--build-env)=(.*)$/.exec(arg);
+        if (m)
+            out.push(m[1] === '--token' ? `--token=${R}` : `${m[1]}=${(m[2] ?? '').split('=')[0]}=${R}`);
+        else
+            out.push(arg);
+    }
+    return out;
+}

package/dist/core/server.js

@@ -0,0 +1,109 @@
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const UI_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'ui');
+const STATIC = {
+    '/': ['index.html', 'text/html; charset=utf-8'],
+    '/app.js': ['app.js', 'text/javascript; charset=utf-8'],
+    '/styles.css': ['styles.css', 'text/css; charset=utf-8'],
+};
+/** Serves the UI and streams state over SSE. Binds to loopback only. */
+export async function startServer(session, port = Number(process.env.UNFOLD_PORT) || 4317) {
+    const clients = new Set();
+    let clientWaiters = [];
+    let pendingLogs = new Map();
+    let flushTimer;
+    let actualPort = port;
+    const send = (res, type, data) => res.write(`event: ${type}\ndata: ${JSON.stringify(data)}\n\n`);
+    const broadcast = (type, data) => clients.forEach((c) => send(c, type, data));
+    const flush = () => {
+        flushTimer = undefined;
+        if (pendingLogs.size)
+            broadcast('logs', [...pendingLogs.values()]);
+        pendingLogs = new Map();
+        broadcast('state', session.state);
+    };
+    session.subscribe((event) => {
+        if (event.type === 'log')
+            pendingLogs.set(event.line.seq, event.line);
+        if (event.type === 'run.started' || event.type === 'run.ended' || event.type === 'fix.ready') {
+            if (flushTimer)
+                clearTimeout(flushTimer);
+            if (event.type === 'run.started')
+                broadcast('reset', null);
+            flush();
+        }
+        else {
+            flushTimer ??= setTimeout(flush, 60);
+        }
+    });
+    const handler = async (req, res) => {
+        // Reject requests addressed to other hostnames (DNS-rebinding protection).
+        const host = (req.headers.host ?? '').replace(/:\d+$/, '');
+        if (host !== '127.0.0.1' && host !== 'localhost') {
+            res.writeHead(403).end('Forbidden');
+            return;
+        }
+        const path = (req.url ?? '/').split('?')[0];
+        if (path === '/api/events') {
+            res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' });
+            clients.add(res);
+            send(res, 'snapshot', { state: session.state, logs: session.logs });
+            clientWaiters.forEach((w) => w());
+            clientWaiters = [];
+            req.on('close', () => clients.delete(res));
+            return;
+        }
+        if (path === '/api/state') {
+            res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ state: session.state, logs: session.logs }));
+            return;
+        }
+        const file = STATIC[path];
+        if (req.method === 'GET' && file) {
+            try {
+                const body = await readFile(join(UI_DIR, file[0]));
+                res.writeHead(200, { 'content-type': file[1], 'cache-control': 'no-store' }).end(body);
+            }
+            catch {
+                res.writeHead(500).end('UI assets missing. Run `npm run build`.');
+            }
+            return;
+        }
+        res.writeHead(404).end('Not found');
+    };
+    const server = createServer((req, res) => void handler(req, res));
+    await new Promise((resolve, reject) => {
+        const tryListen = (p, attempts) => {
+            server.once('error', (err) => {
+                if (err.code === 'EADDRINUSE' && attempts > 0)
+                    tryListen(p === 0 ? 0 : p + 1, attempts - 1);
+                else
+                    reject(err);
+            });
+            server.listen(p, '127.0.0.1', () => {
+                actualPort = server.address().port;
+                resolve();
+            });
+        };
+        tryListen(port, 20);
+    });
+    return {
+        url: `http://127.0.0.1:${actualPort}/`,
+        waitForClient(ms) {
+            if (clients.size)
+                return Promise.resolve(true);
+            return new Promise((resolve) => {
+                const t = setTimeout(() => resolve(false), ms);
+                clientWaiters.push(() => {
+                    clearTimeout(t);
+                    resolve(true);
+                });
+            });
+        },
+        close() {
+            clients.forEach((c) => c.end());
+            return new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}

package/dist/core/session.js

@@ -0,0 +1,136 @@
+import { randomBytes } from 'node:crypto';
+import { FlowReducer } from './flow.js';
+import { agentCommands, buildFixPrompt } from './fix-prompt.js';
+import { Redactor } from './redact.js';
+import { redrawKey, TerminalDecoder } from './terminal.js';
+/**
+ * One observed run: raw terminal output in, redacted lines + provider signals +
+ * flow state out. Everything emitted from here is already redacted.
+ */
+export class Session {
+    opts;
+    reducer = new FlowReducer();
+    runId;
+    parser;
+    present;
+    decoder;
+    redactor;
+    listeners = new Set();
+    now;
+    seq = 0;
+    last;
+    ended = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.now = opts.now ?? Date.now;
+        this.runId = new Date(this.now()).toISOString().replace(/[:.]/g, '-') + '-' + randomBytes(3).toString('hex');
+        this.parser = opts.provider.createParser({ cwd: opts.cwd });
+        this.redactor = opts.redactor ?? new Redactor();
+        this.present = opts.provider.createPresenter?.({ cwd: opts.cwd });
+        this.decoder = new TerminalDecoder((l) => this.onLine(l), opts.provider.maxLineLength);
+    }
+    get state() {
+        return this.reducer.state;
+    }
+    get logs() {
+        return [...this.reducer.logs.values()];
+    }
+    subscribe(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    start() {
+        const p = this.opts.provider;
+        this.emit({
+            type: 'run.started',
+            at: this.now(),
+            runId: this.runId,
+            provider: p.id,
+            title: p.title,
+            command: this.opts.command,
+            cwd: this.opts.cwd,
+            mode: this.opts.mode,
+            stages: p.stages,
+            notes: p.notes,
+        });
+    }
+    /**
+     * Replays an already-processed event (log, signal, fix) from a saved run. Used for
+     * providers whose raw output isn't saved, such as JSON event streams.
+     */
+    inject(event) {
+        if (event.type === 'log' || event.type === 'signal' || event.type === 'fix.ready')
+            this.emit(event);
+    }
+    /** Ends a replayed run without re-running the parser. */
+    endReplay(exitCode, signal, interrupted) {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.emit({ type: 'run.ended', at: this.now(), exitCode, signal, interrupted });
+    }
+    /** Feed raw terminal output (may contain partial lines and escape codes). */
+    write(chunk) {
+        if (!this.ended)
+            this.decoder.write(chunk);
+    }
+    end(exitCode, signal, interrupted) {
+        if (this.ended)
+            return;
+        this.decoder.end();
+        this.ended = true;
+        const at = this.now();
+        const seq = this.last?.line.seq ?? 0;
+        for (const signal of this.parser.finish?.() ?? [])
+            this.emit({ type: 'signal', at, seq, signal });
+        this.emit({ type: 'run.ended', at: this.now(), exitCode, signal, interrupted });
+        const prompt = buildFixPrompt(this.state, this.logs, this.opts.provider.fixHints?.(this.state) ?? []);
+        if (prompt) {
+            let path;
+            try {
+                path = this.opts.saveFixPrompt?.(this.runId, prompt);
+            }
+            catch {
+                // The prompt is still shown in the UI.
+            }
+            this.emit({ type: 'fix.ready', at: this.now(), fix: { prompt, path, commands: path ? agentCommands(path) : undefined } });
+        }
+    }
+    onLine({ text: rawText, transient }) {
+        const raw = this.redactor.line(rawText);
+        const at = this.now();
+        const shown = this.present ? this.present(raw) : raw;
+        if (shown === null) {
+            // Hidden line (e.g. a structured event with nothing to show): its signals attach
+            // to the last visible line.
+            const seq = this.last?.line.seq ?? 0;
+            for (const signal of this.parser.feed({ seq, at, text: raw }))
+                this.emit({ type: 'signal', at, seq, signal });
+            return;
+        }
+        const text = shown;
+        const key = redrawKey(text);
+        let line;
+        // A redrawn spinner/progress line replaces the previous one instead of piling up.
+        if (this.last?.transient && this.last.key === key) {
+            if (this.last.line.text === text) {
+                this.last.transient = transient;
+                return;
+            }
+            line = { seq: this.last.line.seq, at, text };
+        }
+        else {
+            line = { seq: ++this.seq, at, text };
+        }
+        this.last = { line, transient, key };
+        this.emit({ type: 'log', line });
+        for (const signal of this.parser.feed({ ...line, text: raw }))
+            this.emit({ type: 'signal', at, seq: line.seq, signal });
+    }
+    emit(event) {
+        this.reducer.apply(event);
+        const state = this.reducer.state;
+        for (const fn of this.listeners)
+            fn(event, state);
+    }
+}

package/dist/core/store.js

@@ -0,0 +1,52 @@
+import { appendFileSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Runs are saved outside the project so they are never committed by accident. */
+export function runsDir() {
+    return process.env.UNFOLD_HOME ? join(process.env.UNFOLD_HOME, 'runs') : join(homedir(), '.unfold', 'runs');
+}
+/** Appends already-redacted events as JSON lines, readable only by the current user. */
+export class RunRecorder {
+    path;
+    constructor(runId) {
+        const dir = runsDir();
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        this.path = join(dir, `${runId}.jsonl`);
+        pruneRuns();
+    }
+    write(event) {
+        appendFileSync(this.path, JSON.stringify(event) + '\n', { mode: 0o600 });
+    }
+}
+/** How many runs to keep; older ones (and their fix prompts) are deleted. `UNFOLD_KEEP_RUNS` overrides. */
+export const KEEP_RUNS = 100;
+export function pruneRuns(keep = Number(process.env.UNFOLD_KEEP_RUNS) || KEEP_RUNS) {
+    try {
+        const dir = runsDir();
+        const runs = readdirSync(dir)
+            .filter((f) => f.endsWith('.jsonl'))
+            .map((f) => ({ f, t: statSync(join(dir, f)).mtimeMs }))
+            .sort((a, b) => b.t - a.t);
+        for (const { f } of runs.slice(keep)) {
+            rmSync(join(dir, f), { force: true });
+            rmSync(join(dir, f.replace(/\.jsonl$/, '.fix-prompt.md')), { force: true });
+        }
+    }
+    catch {
+        // Pruning is best effort.
+    }
+}
+/** Saves a fix prompt next to the run, readable only by the current user. */
+export function saveFixPrompt(runId, prompt) {
+    const dir = runsDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, `${runId}.fix-prompt.md`);
+    writeFileSync(path, prompt, { mode: 0o600 });
+    return path;
+}
+export function readRun(path) {
+    return readFileSync(path, 'utf8')
+        .split('\n')
+        .filter((l) => l.trim())
+        .map((l) => JSON.parse(l));
+}

package/dist/core/terminal.js

@@ -0,0 +1,109 @@
+// Turns raw PTY output (ANSI colors, OSC hyperlinks, spinner redraws, CRLF)
+// into plain text lines. Lines that are overwritten in place (spinners,
+// progress bars) are reported as `transient` so the caller can collapse them.
+const MAX_LINE = 4000;
+// Braille / circle spinner frames at the start of a line.
+const SPINNER_PREFIX = /^\s{0,3}(?:[⠀-⣿◐◓◑◒]\s*)+/u;
+export function stripSpinner(text) {
+    return text.replace(SPINNER_PREFIX, '');
+}
+export class TerminalDecoder {
+    emit;
+    maxLine;
+    buf = '';
+    esc = 'none';
+    csiParams = '';
+    pendingCR = false;
+    constructor(emit, maxLine = MAX_LINE) {
+        this.emit = emit;
+        this.maxLine = maxLine;
+    }
+    write(chunk) {
+        for (const ch of chunk)
+            this.char(ch);
+    }
+    end() {
+        this.pendingCR = false;
+        this.flush(false);
+    }
+    char(ch) {
+        if (this.pendingCR) {
+            this.pendingCR = false;
+            if (ch === '\n') {
+                this.flush(false);
+                return;
+            }
+            // Bare carriage return: the line is about to be redrawn.
+            this.flush(true);
+        }
+        switch (this.esc) {
+            case 'esc':
+                if (ch === '[') {
+                    this.esc = 'csi';
+                    this.csiParams = '';
+                }
+                else if (ch === ']') {
+                    this.esc = 'osc';
+                }
+                else {
+                    this.esc = 'none';
+                }
+                return;
+            case 'csi':
+                if (ch >= '@' && ch <= '~') {
+                    this.esc = 'none';
+                    this.csi(ch, this.csiParams);
+                }
+                else {
+                    this.csiParams += ch;
+                }
+                return;
+            case 'osc':
+                if (ch === '\x07')
+                    this.esc = 'none';
+                else if (ch === '\x1b')
+                    this.esc = 'osc-esc';
+                return;
+            case 'osc-esc':
+                this.esc = ch === '\\' ? 'none' : 'osc';
+                return;
+        }
+        if (ch === '\x1b') {
+            this.esc = 'esc';
+        }
+        else if (ch === '\r') {
+            this.pendingCR = true;
+        }
+        else if (ch === '\n') {
+            this.flush(false);
+        }
+        else if (ch === '\b') {
+            this.buf = this.buf.slice(0, -1);
+        }
+        else if (ch === '\t') {
+            this.buf += '  ';
+        }
+        else if (ch >= ' ' || ch > '\x7f') {
+            if (this.buf.length < this.maxLine)
+                this.buf += ch;
+        }
+    }
+    csi(final, params) {
+        // Erase-whole-line, cursor-to-column, cursor-up and clear-screen all mean the
+        // current text is being replaced rather than continued.
+        if ((final === 'K' && (params === '2' || params === '1')) || final === 'G' || final === 'A' || final === 'J' || final === 'H') {
+            this.flush(true);
+        }
+    }
+    flush(transient) {
+        const text = stripSpinner(this.buf.replace(/\s+$/, ''));
+        this.buf = '';
+        if (text.trim() === '')
+            return;
+        this.emit({ text, transient });
+    }
+}
+/** Key used to decide whether a redrawn line replaces the previous one. */
+export function redrawKey(text) {
+    return text.replace(/[\d.,=\-#>\s[\]()/KMGTB%]+/g, '').slice(0, 24);
+}