[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_41":42,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":32,"_44":32,"_45":32,"_46":32,"_47":32,"_48":32,"_49":50,"_51":50,"_52":32,"_53":-7,"_54":-7,"_55":56,"_57":58,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path","apps/server/src/auth/local-store.ts","oid","d77aff553f7610bfdad9bc1c979cf9a0645511ec","size",8186,"commit","2182c95de44a8f63fd86af1c5874ae0ca298f807","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","import { GitHubError } from \"../github/client\";\nimport { createHash } from \"node:crypto\";\nimport { chmod, lstat, mkdir, open, readFile, realpath, rename, rm } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nimport type { GitHubTokenGrant } from \"../github/client\";\n\nexport type Backend = \"keychain\" | \"plaintext\";\nexport type LocalCredential = {\n\tv: 1;\n\tinstallation: string;\n\torigin: string;\n\tclientId: string;\n\taccountId: string;\n\tlogin: string;\n\tbindingId: string;\n\tbindingSecretHash: string;\n\taccessToken: string;\n\taccessExpiresAt: number;\n\trefreshToken: string;\n\trefreshExpiresAt: number;\n\tbackend: Backend;\n\tgeneration: number;\n};\n\nexport type NativeSecrets = Pick;\nconst SERVICE = \"chopin-local-auth\";\nconst LIMIT_MS = 5_000;\n\nexport function credentialName(\n\tinput: Pick,\n): string {\n\treturn `v1:${\n\t\tcreateHash(\"sha256\").update(JSON.stringify([\n\t\t\tinput.installation,\n\t\t\tinput.origin,\n\t\t\tinput.clientId,\n\t\t\tinput.bindingId,\n\t\t])).digest(\"hex\")\n\t}`;\n}\n\nexport function credentialGrant(record: LocalCredential, now: number): GitHubTokenGrant {\n\treturn {\n\t\taccessToken: record.accessToken,\n\t\taccessExpiresIn: Math.max(1, Math.floor((record.accessExpiresAt - now) / 1_000)),\n\t\trefreshToken: record.refreshToken,\n\t\trefreshExpiresIn: Math.max(1, Math.floor((record.refreshExpiresAt - now) / 1_000)),\n\t};\n}\n\nexport class LocalCredentials {\n\treadonly #directory: string;\n\treadonly #secrets: NativeSecrets;\n\treadonly #timeout: number;\n\treadonly #pending = new Map>>();\n\n\tconstructor(directory: string, secrets: NativeSecrets = Bun.secrets, timeout = LIMIT_MS) {\n\t\tthis.#directory = resolve(directory.replace(/^~(?=\\/|$)/, homedir()));\n\t\tthis.#secrets = secrets;\n\t\tthis.#timeout = timeout;\n\t\tlet cwd = resolve(process.cwd());\n\t\tlet relation = relative(cwd, this.#directory);\n\t\tif (!relation || (!relation.startsWith(\"..\") && !isAbsolute(relation))) {\n\t\t\tthrow new Error(\"CHOPIN_LOCAL_CREDENTIALS_DIR must be outside the repository\");\n\t\t}\n\t}\n\n\tpath(input: Pick) {\n\t\treturn resolve(this.#directory, `${credentialName(input)}.json`);\n\t}\n\n\tasync #bounded(task: Promise): Promise {\n\t\tlet timer: ReturnType | undefined;\n\t\ttry {\n\t\t\treturn await Promise.race([\n\t\t\t\ttask,\n\t\t\t\tnew Promise((_, reject) => {\n\t\t\t\t\ttimer = setTimeout(() => reject(new Error(\"system vault unavailable\")), this.#timeout);\n\t\t\t\t}),\n\t\t\t]);\n\t\t} finally {\n\t\t\tif (timer) clearTimeout(timer);\n\t\t}\n\t}\n\n\tasync saveSecure(record: LocalCredential): Promise {\n\t\tlet name = credentialName(record);\n\t\tlet task = Promise.resolve().then(() =>\n\t\t\tthis.#secrets.set({\n\t\t\t\tservice: SERVICE,\n\t\t\t\tname,\n\t\t\t\tvalue: JSON.stringify({ ...record, backend: \"keychain\" }),\n\t\t\t})\n\t\t);\n\t\tlet pending = this.#pending.get(name) ?? new Set();\n\t\tpending.add(task);\n\t\tthis.#pending.set(name, pending);\n\t\ttry {\n\t\t\tawait this.#bounded(task);\n\t\t\tawait rm(this.path(record), { force: true });\n\t\t\tconsole.info(`chopin: local credential key ${name}`);\n\t\t\treturn true;\n\t\t} catch {\n\t\t\tvoid task.then(() =>\n\t\t\t\tthis.#bounded(\n\t\t\t\t\tPromise.resolve().then(() => this.#secrets.delete({ service: SERVICE, name })),\n\t\t\t\t).catch(() => {})\n\t\t\t).catch(() => {});\n\t\t\treturn false;\n\t\t} finally {\n\t\t\tvoid task.finally(() => {\n\t\t\t\tpending.delete(task);\n\t\t\t\tif (!pending.size) this.#pending.delete(name);\n\t\t\t}).catch(() => {});\n\t\t}\n\t}\n\n\tasync save(record: LocalCredential): Promise {\n\t\tif (record.backend === \"keychain\") {\n\t\t\tlet name = credentialName(record);\n\t\t\tlet task = Promise.resolve().then(() =>\n\t\t\t\tthis.#secrets.set({\n\t\t\t\t\tservice: SERVICE,\n\t\t\t\t\tname,\n\t\t\t\t\tvalue: JSON.stringify(record),\n\t\t\t\t})\n\t\t\t);\n\t\t\tlet pending = this.#pending.get(name) ?? new Set();\n\t\t\tpending.add(task);\n\t\t\tthis.#pending.set(name, pending);\n\t\t\ttry {\n\t\t\t\tawait this.#bounded(task);\n\t\t\t} catch (err) {\n\t\t\t\tvoid task.then(() =>\n\t\t\t\t\tthis.#bounded(\n\t\t\t\t\t\tPromise.resolve().then(() => this.#secrets.delete({ service: SERVICE, name })),\n\t\t\t\t\t).catch(() => {})\n\t\t\t\t).catch(() => {});\n\t\t\t\tthrow err;\n\t\t\t} finally {\n\t\t\t\tvoid task.finally(() => {\n\t\t\t\t\tpending.delete(task);\n\t\t\t\t\tif (!pending.size) this.#pending.delete(name);\n\t\t\t\t}).catch(() => {});\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tlet parent = dirname(this.path(record));\n\t\tlet created = await mkdir(parent, { recursive: true, mode: 0o700 });\n\t\tif (created !== undefined && process.platform !== \"win32\") await chmod(parent, 0o700);\n\t\tlet info = await lstat(parent);\n\t\tif (\n\t\t\t!info.isDirectory() || info.isSymbolicLink()\n\t\t\t|| (process.platform !== \"win32\" && (info.mode & 0o077) !== 0)\n\t\t) {\n\t\t\tthrow new Error(\"credential directory is not private\");\n\t\t}\n\t\tlet canonical = await realpath(parent);\n\t\tlet cwd = await realpath(process.cwd());\n\t\tlet relation = relative(cwd, canonical);\n\t\tif (!relation || (!relation.startsWith(\"..\") && !isAbsolute(relation))) {\n\t\t\tthrow new Error(\"credential directory must be outside the repository\");\n\t\t}\n\t\tlet target = this.path(record);\n\t\tlet temporary = `${target}.${crypto.randomUUID()}.tmp`;\n\t\tlet file = await open(temporary, \"wx\", 0o600);\n\t\ttry {\n\t\t\tawait file.writeFile(JSON.stringify(record));\n\t\t\tawait file.sync();\n\t\t} finally {\n\t\t\tawait file.close();\n\t\t}\n\t\ttry {\n\t\t\tawait rename(temporary, target);\n\t\t\tlet dir = await open(parent, \"r\");\n\t\t\ttry {\n\t\t\t\tawait dir.sync();\n\t\t\t} finally {\n\t\t\t\tawait dir.close();\n\t\t\t}\n\t\t} catch (err) {\n\t\t\tawait rm(temporary, { force: true });\n\t\t\tthrow err;\n\t\t}\n\t}\n\n\tasync read(\n\t\tinput: Pick,\n\t): Promise {\n\t\tlet name = credentialName(input);\n\t\tlet values: Array<{ value: string; backend: Backend }> = [];\n\t\tlet vaultFailed = false;\n\t\ttry {\n\t\t\tlet value = await this.#bounded(\n\t\t\t\tPromise.resolve().then(() => this.#secrets.get({ service: SERVICE, name })),\n\t\t\t);\n\t\t\tif (value) values.push({ value, backend: \"keychain\" });\n\t\t} catch {\n\t\t\tvaultFailed = true;\n\t\t}\n\t\ttry {\n\t\t\tlet file = this.path(input);\n\t\t\tlet info = await lstat(file);\n\t\t\tif (\n\t\t\t\t!info.isFile() || info.isSymbolicLink() || (process.platform !== \"win32\"\n\t\t\t\t\t&& (info.mode & 0o077) !== 0)\n\t\t\t) throw new Error(\"credential file is not private\");\n\t\t\tvalues.push({ value: await readFile(file, \"utf8\"), backend: \"plaintext\" });\n\t\t} catch (err) {\n\t\t\tif (!(err instanceof Error && \"code\" in err && err.code === \"ENOENT\")) throw err;\n\t\t}\n\t\tfor (let candidate of values) {\n\t\t\tlet record: Partial;\n\t\t\ttry {\n\t\t\t\trecord = JSON.parse(candidate.value);\n\t\t\t} catch {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\trecord.v !== 1 || record.backend !== candidate.backend\n\t\t\t\t|| record.installation !== input.installation || record.origin !== input.origin\n\t\t\t\t|| record.clientId !== input.clientId || record.bindingId !== input.bindingId\n\t\t\t\t|| typeof record.accountId !== \"string\" || typeof record.login !== \"string\"\n\t\t\t\t|| typeof record.bindingSecretHash !== \"string\"\n\t\t\t\t|| typeof record.accessToken !== \"string\" || typeof record.refreshToken !== \"string\"\n\t\t\t\t|| !Number.isSafeInteger(record.accessExpiresAt)\n\t\t\t\t|| !Number.isSafeInteger(record.refreshExpiresAt)\n\t\t\t\t|| !Number.isSafeInteger(record.generation)\n\t\t\t) continue;\n\t\t\treturn record as LocalCredential;\n\t\t}\n\t\tif (vaultFailed && !values.length) throw new GitHubError(\"System vault is unavailable\", 503);\n\t\treturn undefined;\n\t}\n\n\tasync delete(\n\t\tinput: Pick,\n\t): Promise {\n\t\tlet name = credentialName(input);\n\t\tawait rm(this.path(input), { force: true });\n\t\ttry {\n\t\t\tawait this.#bounded(\n\t\t\t\tPromise.resolve().then(() => this.#secrets.delete({ service: SERVICE, name })),\n\t\t\t);\n\t\t} catch {\n\t\t\t// The binding is already invalidated even when the vault cannot be reached.\n\t\t}\n\t\tlet pending = this.#pending.get(name);\n\t\tif (pending) {\n\t\t\tfor (let task of pending) {\n\t\t\t\tvoid task.then(() =>\n\t\t\t\t\tthis.#bounded(\n\t\t\t\t\t\tPromise.resolve().then(() => this.#secrets.delete({ service: SERVICE, name })),\n\t\t\t\t\t).catch(() => {})\n\t\t\t\t).catch(() => {});\n\t\t\t}\n\t\t}\n\t}\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_55":56,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_43":32,"_137":14,"_138":32,"_49":50,"_51":50},"branches",[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,14,127,128,129,130],"tags",[70,71,72,73],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":50,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_53":174,"_175":32,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_53":174,"_175":32,"_176":174,"_177":50},{"_168":169,"_170":171,"_15":169,"_172":173,"_53":174,"_175":32,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_53":174,"_175":32,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_53":174,"_175":32,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_53":174,"_175":32,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_53":32,"_175":32,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_53":32,"_175":32,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_53":32,"_175":32,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_53":32,"_175":32,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_53":32,"_175":32,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_53":32,"_175":32,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_53":32,"_175":32,"_176":32},{"_168":202,"_170":203,"_15":202,"_172":204,"_53":32,"_175":32,"_176":32},{"_168":199,"_170":200,"_15":199,"_172":201,"_53":32,"_175":32,"_176":32},{"_168":196,"_170":197,"_15":196,"_172":198,"_53":32,"_175":32,"_176":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794436449175,"sidebar","expanded"]