[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_41":42,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":32,"_44":32,"_45":32,"_46":32,"_47":32,"_48":32,"_49":50,"_51":50,"_52":32,"_53":-7,"_54":-7,"_55":56,"_57":58,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path","apps/server/src/agent/active-owner.ts","oid","5814fbbf3575f8b6db4fca18f0e48d04972a43e0","size",7425,"commit","2182c95de44a8f63fd86af1c5874ae0ca298f807","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","import type { HostedAuth } from \"../auth/routes\";\nimport type { HostedRepository } from \"./repository\";\n\nconst EXPIRY_SKEW_MS = 60_000;\n\ntype State = {\n\tchannelId: string;\n\tchannelEpoch: number;\n\townerSessionId: string;\n\townerGeneration: number;\n\tcredentialRevision: number;\n\trepositoryId: string;\n\trepositoryOwner: string;\n\trepositoryName: string;\n\texpiresAt: Date;\n\tuserId: string;\n\tcontroller: AbortController;\n\ttimer?: ReturnType;\n};\n\nexport type ActiveOwnerBinding = {\n\tchannelId: string;\n\ttoken: string;\n\trepository: HostedRepository;\n\townerSessionId: string;\n\townerGeneration: number;\n\tcredentialRevision: number;\n\texpiresAt: Date;\n\tsignal: AbortSignal;\n\tcurrentToken: () => string | undefined;\n\trevalidate: () => Promise;\n\trelease: () => void;\n};\n\nfunction credentialKey(sessionId: string, revision: number): string {\n\treturn `${sessionId}\\u0000${revision}`;\n}\n\n/** Resolves only an existing durable Planner owner; it can never claim ownership. */\nexport class ActiveOwnerBindings {\n\t#auth: Pick;\n\t#states = new Set();\n\t#channelEpochs = new Map();\n\t#revokedSessions = new Set();\n\t#revokedCredentials = new Set();\n\t#closed = false;\n\n\tconstructor(auth: Pick) {\n\t\tthis.#auth = auth;\n\t}\n\n\tasync resolve(channelId: string): Promise {\n\t\tif (this.#closed) return undefined;\n\t\tlet channelEpoch = this.#channelEpochs.get(channelId) ?? 0;\n\t\tlet now = this.#auth.clock();\n\t\tlet stored = await this.#auth.storage.channels.readAgent(channelId, now);\n\t\tlet ownerSessionId = stored?.agent?.ownerSessionId;\n\t\tif (!stored || !ownerSessionId || this.#revokedSessions.has(ownerSessionId)) return undefined;\n\t\tlet ownerGeneration = stored.agent!.generation;\n\t\tlet owner = await this.#auth.sessions.resolve(ownerSessionId);\n\t\tif (!owner || this.#revokedSessions.has(ownerSessionId)) return undefined;\n\t\tlet checked = await this.#auth.sessions.use(\n\t\t\towner,\n\t\t\ttoken =>\n\t\t\t\tthis.#auth.github.repositoryAccess(\n\t\t\t\t\ttoken,\n\t\t\t\t\tstored.channel.repositoryOwner,\n\t\t\t\t\tstored.channel.repositoryName,\n\t\t\t\t),\n\t\t);\n\t\towner = checked.authenticated;\n\t\tlet repository = checked.value;\n\t\tif (\n\t\t\t!repository\n\t\t\t|| repository.id !== stored.channel.repositoryId\n\t\t\t|| (!repository.permissions.push && !repository.permissions.admin)\n\t\t) return undefined;\n\t\tif (!await this.#auth.admission.allowed(owner.access.token, owner.user.id)) return undefined;\n\t\tlet expiresAt = new Date(\n\t\t\tMath.min(owner.access.expiresAt.getTime(), owner.session.expiresAt.getTime()),\n\t\t);\n\t\tif (expiresAt.getTime() <= this.#auth.clock().getTime() + EXPIRY_SKEW_MS) return undefined;\n\t\tlet credentialRevision = owner.access.revision;\n\t\tlet credential = credentialKey(ownerSessionId, credentialRevision);\n\t\tlet current = await this.#auth.sessions.inspect(ownerSessionId);\n\t\tlet latest = await this.#auth.storage.channels.readAgent(channelId, this.#auth.clock());\n\t\tif (\n\t\t\t!current\n\t\t\t|| current.access.revision !== credentialRevision\n\t\t\t|| !this.#auth.sessions.token(ownerSessionId, credentialRevision)\n\t\t\t|| latest?.agent?.ownerSessionId !== ownerSessionId\n\t\t\t|| latest.agent.generation !== ownerGeneration\n\t\t\t|| latest.channel.repositoryId !== repository.id\n\t\t\t|| this.#revokedSessions.has(ownerSessionId)\n\t\t\t|| this.#revokedCredentials.has(credential)\n\t\t\t|| this.#closed\n\t\t\t|| (this.#channelEpochs.get(channelId) ?? 0) !== channelEpoch\n\t\t) return undefined;\n\n\t\tlet state: State = {\n\t\t\tchannelId,\n\t\t\tchannelEpoch,\n\t\t\townerSessionId,\n\t\t\townerGeneration,\n\t\t\tcredentialRevision,\n\t\t\trepositoryId: repository.id,\n\t\t\trepositoryOwner: repository.owner,\n\t\t\trepositoryName: repository.name,\n\t\t\texpiresAt,\n\t\t\tuserId: owner.user.id,\n\t\t\tcontroller: new AbortController(),\n\t\t};\n\t\tlet delay = Math.max(0, expiresAt.getTime() - this.#auth.clock().getTime() - EXPIRY_SKEW_MS);\n\t\tstate.timer = setTimeout(\n\t\t\t() => this.#abort(state, \"credential-expired\"),\n\t\t\tMath.min(delay, 2_147_483_647),\n\t\t);\n\t\tthis.#states.add(state);\n\t\tlet release = () => this.#abort(state, \"released\");\n\t\treturn {\n\t\t\tchannelId,\n\t\t\ttoken: owner.access.token,\n\t\t\trepository: {\n\t\t\t\tid: repository.id,\n\t\t\t\towner: repository.owner,\n\t\t\t\tname: repository.name,\n\t\t\t\tdefaultBranch: repository.defaultBranch,\n\t\t\t},\n\t\t\townerSessionId,\n\t\t\townerGeneration,\n\t\t\tcredentialRevision,\n\t\t\texpiresAt: new Date(expiresAt),\n\t\t\tsignal: state.controller.signal,\n\t\t\tcurrentToken: () => this.#currentToken(state),\n\t\t\trevalidate: () => this.#revalidate(state),\n\t\t\trelease,\n\t\t};\n\t}\n\n\trevokeChannel(channelId: string): void {\n\t\tthis.#channelEpochs.set(channelId, (this.#channelEpochs.get(channelId) ?? 0) + 1);\n\t\tfor (let state of this.#states) {\n\t\t\tif (state.channelId === channelId) this.#abort(state, \"owner-reset\");\n\t\t}\n\t}\n\n\trevokeSession(sessionId: string): void {\n\t\tthis.#revokedSessions.add(sessionId);\n\t\tfor (let state of this.#states) {\n\t\t\tif (state.ownerSessionId === sessionId) this.#abort(state, \"session-revoked\");\n\t\t}\n\t}\n\n\trevokeCredential(sessionId: string, revision: number): void {\n\t\tthis.#revokedCredentials.add(credentialKey(sessionId, revision));\n\t\tfor (let state of this.#states) {\n\t\t\tif (state.ownerSessionId === sessionId && state.credentialRevision === revision) {\n\t\t\t\tthis.#abort(state, \"credential-rotated\");\n\t\t\t}\n\t\t}\n\t}\n\n\trevokeAll(): void {\n\t\tthis.#closed = true;\n\t\tfor (let state of this.#states) this.#abort(state, \"runtime-stopped\");\n\t}\n\n\t#currentToken(state: State): string | undefined {\n\t\tif (!this.#locallyActive(state)) return undefined;\n\t\treturn this.#auth.sessions.token(state.ownerSessionId, state.credentialRevision);\n\t}\n\n\tasync #revalidate(state: State): Promise {\n\t\tlet token = this.#currentToken(state);\n\t\tif (!token) return false;\n\t\tlet owner = await this.#auth.sessions.inspect(state.ownerSessionId);\n\t\tif (!owner || owner.access.revision !== state.credentialRevision) return false;\n\t\tif (!await this.#auth.admission.allowed(token, state.userId)) return false;\n\t\tlet repository = await this.#auth.github.repositoryAccess(\n\t\t\ttoken,\n\t\t\tstate.repositoryOwner,\n\t\t\tstate.repositoryName,\n\t\t);\n\t\tif (\n\t\t\t!repository\n\t\t\t|| repository.id !== state.repositoryId\n\t\t\t|| (!repository.permissions.push && !repository.permissions.admin)\n\t\t) return false;\n\t\tlet stored = await this.#auth.storage.channels.readAgent(state.channelId, this.#auth.clock());\n\t\tlet current = await this.#auth.sessions.inspect(state.ownerSessionId);\n\t\treturn this.#locallyActive(state)\n\t\t\t&& current?.access.revision === state.credentialRevision\n\t\t\t&& stored?.agent?.ownerSessionId === state.ownerSessionId\n\t\t\t&& stored.agent.generation === state.ownerGeneration\n\t\t\t&& stored.channel.repositoryId === state.repositoryId;\n\t}\n\n\t#locallyActive(state: State): boolean {\n\t\treturn !this.#closed\n\t\t\t&& !state.controller.signal.aborted\n\t\t\t&& state.expiresAt.getTime() > this.#auth.clock().getTime() + EXPIRY_SKEW_MS\n\t\t\t&& !this.#revokedSessions.has(state.ownerSessionId)\n\t\t\t&& !this.#revokedCredentials.has(\n\t\t\t\tcredentialKey(state.ownerSessionId, state.credentialRevision),\n\t\t\t)\n\t\t\t&& (this.#channelEpochs.get(state.channelId) ?? 0) === state.channelEpoch;\n\t}\n\n\t#abort(state: State, reason: string): void {\n\t\tif (state.timer) clearTimeout(state.timer);\n\t\tstate.timer = undefined;\n\t\tthis.#states.delete(state);\n\t\tif (!state.controller.signal.aborted) state.controller.abort(new Error(reason));\n\t}\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_55":56,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_43":32,"_137":14,"_138":32,"_49":50,"_51":50},"branches",[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,14,127,128,129,130],"tags",[70,71,72,73],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":50,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_53":174,"_175":32,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_53":174,"_175":32,"_176":174,"_177":50},{"_168":169,"_170":171,"_15":169,"_172":173,"_53":174,"_175":32,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_53":174,"_175":32,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_53":174,"_175":32,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_53":174,"_175":32,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_53":32,"_175":32,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_53":32,"_175":32,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_53":32,"_175":32,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_53":32,"_175":32,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_53":32,"_175":32,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_53":32,"_175":32,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_53":32,"_175":32,"_176":32},{"_168":202,"_170":203,"_15":202,"_172":204,"_53":32,"_175":32,"_176":32},{"_168":199,"_170":200,"_15":199,"_172":201,"_53":32,"_175":32,"_176":32},{"_168":196,"_170":197,"_15":196,"_172":198,"_53":32,"_175":32,"_176":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794436452724,"sidebar","expanded"]