fastlane-plugin-pharen 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8cd4f080adf3fef449642139ef7ca42ee6f186325ca8948ee05dc7fdab939c3a
-  data.tar.gz: 4db24993e8d906973ab4c91e8df26d26bd01104c00c332c3d2419a85b62f4b54
+  metadata.gz: 8e730459c397f4e9585f12a2c687f6216c8fb2c1679c5a45a5e85e8649b1398a
+  data.tar.gz: 465ba4d2a4551dd462333f6e70d8e1e361d6642aafcb67d0505b84f7cb7f9e54
 SHA512:
-  metadata.gz: a05b26ce9c1de6c6c1fa251948a7d6af63bd6e89bf4bef1338d7247c6ca37290e7dbbbe5864ab2d83f51450ed719b23ebdd2d6d993e9e0a4140e7891af2137c2
-  data.tar.gz: 3b6f71ab17e05f1b1f50488360a7533e2dbfe5757d0b36f536c42daef9f662f092be6a628f2b9e94bee3d4de2b9a4ff6671d6cd9dff164ad095e7253ea0b8f9a
+  metadata.gz: e6a0a84cfaa13a65a383e60cfe3cc0d55bc4996e66053fac349f7c5eb98fc4634dbde73395d8a1c417e994fde64b7e050e0fbf59870431f9a3767afe218c0eec
+  data.tar.gz: ba90879161e346e4b626a198de1824851a129407411bd03bd597b405847d337b37553393a30078fb6f67a5de50fd70f698ad28cc05a669906dc6e7ae9a0b960b

data/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to `fastlane-plugin-pharen` are documented here.
 
+## 0.2.0
+
+- **Requires `@pharen-ai/cli` 0.1.0 or later** (`npm install -g @pharen-ai/cli`). The
+  actions call it by its current commands — `releases create`, `symbols upload`,
+  `builds upload`. 0.1.0 called them by older names the CLI does not accept, and because
+  0.1.0 warned rather than failed, a lane on it would skip every step without uploading
+  anything.
+- **`strict` defaults to `true`.** A step that fails now fails the lane; pass
+  `strict: false` (or `PHAREN_STRICT=false`) to warn and continue as 0.1.0 did. A build
+  shipped without its symbols produces crashes that stay unreadable until they arrive,
+  which a warning in a long lane log too easily hides.
+- **`PHAREN_STRICT` takes `true` or `false`** (also `yes`/`no`, `on`/`off`, each in
+  lowercase or all caps). Any other value, `1`, `0` and an empty one included, now fails
+  the lane instead of being read as `true`; unset it to take the default.
+- **`pharen_release`'s closing line says what happened** — release registered or not,
+  symbols uploaded or not — rather than claiming all three steps after one was skipped.
+- **Credentials are the CLI's.** The CLI uses `PHAREN_AUTH_TOKEN` when it is exported, a
+  CI job's own identity once its pipeline is bound, or the session `pharen auth login`
+  stored; the plugin still never reads, prints, or passes any of them.
+
 ## 0.1.0 — initial release
 
 Three actions, a thin wrapper over the `pharen` CLI (auth, `.pharen.yml` resolution,
@@ -20,8 +40,8 @@ debug-id parsing and server-side dedupe all live there):
 **Failure posture:** warn-don't-fail by default — a telemetry step should never be the
 reason a release build fails. Pass `strict: true` (or set `PHAREN_STRICT=1`) in CI lanes
 where an unsymbolicated release must be a hard stop. A missing-dSYM situation always
-warns loudly regardless of mode, since a build shipped without symbols leaves every
-crash it produces unsymbolicated forever.
+warns loudly regardless of mode, since a build shipped without symbols produces crashes
+that stay unreadable until its symbols are uploaded.
 
 **Auth:** `PHAREN_AUTH_TOKEN` is read from the environment only — the plugin never
 reads, prints, or passes it on a command line.

data/README.md

@@ -18,9 +18,10 @@ fastlane add_plugin pharen
 
 Once per repository, you also need:
 
-- the `pharen` CLI on `PATH` (or point `pharen_binary:` / `PHAREN_BINARY` at it),
+- the `pharen` CLI on `PATH` — `npm install -g @pharen-ai/cli` (or point
+  `pharen_binary:` / `PHAREN_BINARY` at it),
 - a committed `.pharen.yml` at the repo root (`org:` and `app:` — no secrets),
-- `PHAREN_AUTH_TOKEN` in the environment (your one secret — see [Configuration](#configuration)).
+- a credential the CLI can use — see [Configuration](#configuration).
 
 ## Quickstart
 
@@ -47,11 +48,12 @@ The whole integration in one call after `build_app`.
 |---|---|---|---|
 | `ipa` | `PHAREN_IPA` | lane context (`IPA_OUTPUT_PATH`) | Path to the `.ipa`. |
 | `dsym_paths` | `PHAREN_DSYM_PATHS` | lane context (`DSYM_OUTPUT_PATH` + `DSYM_PATHS`) | dSYM bundles or `.zip`s to upload. |
-| `pharen_binary` | `PHAREN_BINARY` | `pharen` | Command that invokes the CLI (may include arguments, e.g. `node /path/to/cli.js`). |
-| `strict` | `PHAREN_STRICT` | `false` | Fail the lane on any step's error instead of warning and continuing. |
+| `pharen_binary` | `PHAREN_BINARY` | `pharen` | Command that invokes the CLI (may include arguments, e.g. `npx --yes @pharen-ai/cli`). |
+| `strict` | `PHAREN_STRICT` | `true` | Fail the lane on any step's error. `false` warns and continues instead. |
 
-Returns the install link on success, or `nil` when a step is skipped or fails outside
-strict mode.
+Returns the install link once the build uploads, even if registration or the symbols
+step failed with `strict: false`. It returns `nil` when there is no IPA, its `Info.plist`
+cannot be read, or the build upload fails (with `strict: false`).
 
 ### `pharen_upload_build`
 
@@ -65,7 +67,7 @@ pharen_upload_build            # IPA from the lane context → install link
 |---|---|---|---|
 | `ipa` | `PHAREN_IPA` | lane context (`IPA_OUTPUT_PATH`) | Path to the `.ipa`. |
 | `pharen_binary` | `PHAREN_BINARY` | `pharen` | Command that invokes the CLI. |
-| `strict` | `PHAREN_STRICT` | `false` | Fail the lane on error instead of warning and continuing. |
+| `strict` | `PHAREN_STRICT` | `true` | Fail the lane on error. `false` warns and continues instead. |
 
 ### `pharen_upload_symbols`
 
@@ -80,52 +82,59 @@ pharen_upload_symbols(dsym_paths: ["path/to/App.dSYM"])  # or explicit
 |---|---|---|---|
 | `dsym_paths` | `PHAREN_DSYM_PATHS` | lane context (`DSYM_OUTPUT_PATH` + `DSYM_PATHS`) | `.dSYM` bundles, dSYM `.zip`s (as produced by `gym`/`download_dsyms`), or raw DWARF binaries. |
 | `pharen_binary` | `PHAREN_BINARY` | `pharen` | Command that invokes the CLI. |
-| `strict` | `PHAREN_STRICT` | `false` | Fail the lane on error instead of warning and continuing. |
+| `strict` | `PHAREN_STRICT` | `true` | Fail the lane on error. `false` warns and continues instead. |
 
 ## Configuration
 
-Two things live outside the lane, and only one of them is a secret:
+Two things live outside the lane:
 
 - **`.pharen.yml`** — committed at the repo root, holding `org:` and `app:`. No secrets
   belong in it. The CLI walks up from its working directory to find it, so it resolves
   whether fastlane runs from the repo root or the `fastlane/` directory.
-- **`PHAREN_AUTH_TOKEN`** — your one secret, read from the environment (a CI secret in
-  practice). Only the CLI reads it, and only from the environment. The plugin never
-  reads, prints, or passes the token, so it never lands in a log line or a process
-  argument list.
+- **A credential** — the CLI finds its own, in this order: `PHAREN_AUTH_TOKEN` when it is
+  exported (a CI secret), then a CI job's own identity once an organization owner has
+  bound that pipeline (no secret at all), then the session `pharen auth login` stored on
+  your machine. The plugin never reads, prints, or passes a credential, so none lands in a
+  log line or a process argument list. The [CLI reference](https://www.pharen.ai/docs/cli)
+  covers each.
 
 ## Failure posture
 
-The default is **warn-don't-fail**: if a step errors, the plugin logs a loud warning and
-lets the build continue. A telemetry step should never be the reason a release build
-fails.
+The default is **strict**: if a step errors, the lane fails. A build that ships without
+its symbols produces crashes that stay unreadable until they arrive, so the plugin stops
+rather than letting that pass unnoticed.
 
-Pass `strict: true` (or set `PHAREN_STRICT=1`) in CI lanes where an unsymbolicated or
-undistributed release must be a hard stop; then any step's error fails the lane.
+Pass `strict: false` (or set `PHAREN_STRICT=false`) in lanes where a Pharen step must
+never be the reason a build fails; then any step's error is logged as a loud warning and
+the lane continues. `PHAREN_STRICT` takes `true` or `false` (also `yes`/`no`,
+`on`/`off`, each in lowercase or all caps); any other value, an empty one included, fails
+the lane rather than being guessed at. Unset it to take the default.
 
 Two things hold regardless of mode:
 
-- **Missing dSYMs always warn loudly.** A build shipped without its symbols produces
-  crashes that can never be read, and uploading symbols later does not retroactively
-  symbolicate the crashes it already caused. Archive with
-  `DEBUG_INFORMATION_FORMAT=dwarf-with-dsym` so the dSYMs exist to upload.
+- **Missing dSYMs are never quiet.** A build shipped without its symbols produces
+  crashes that stay unreadable until the symbols arrive. Uploading them later
+  re-symbolicates and re-groups recent crashes, at most the last seven days of them;
+  older ones may stay as they first grouped. Archive with `DEBUG_INFORMATION_FORMAT=dwarf-with-dsym`
+  so the dSYMs exist to upload with the build.
 - **Re-runs are safe.** The server dedupes symbols by debug id, and the CLI exits 0 when
   every file is already uploaded — so retrying a lane never double-uploads or errors on
   work already done.
 
 ## Troubleshooting
 
-- **`pharen` not found.** The CLI isn't on `PATH`. Install it and make `pharen`
-  resolvable, or point `pharen_binary:` / `PHAREN_BINARY` at it (it may include
-  arguments, e.g. `node /path/to/cli.js`).
+- **`pharen` not found.** The CLI isn't on `PATH`. Install it with
+  `npm install -g @pharen-ai/cli`, or point `pharen_binary:` / `PHAREN_BINARY` at a
+  command that runs it (it may include arguments, e.g. `npx --yes @pharen-ai/cli`).
 - **"no IPA" or "no dSYMs in the lane context".** Run the action after `build_app`/`gym`
   (and `download_dsyms`, if you fetch symbols from App Store Connect), or pass `ipa:` /
   `dsym_paths:` explicitly.
-- **Release registration warns but the build still uploads.** Expected in warn mode:
-  registration records provenance, so a failed registration degrades metadata without
-  stopping distribution. Use `strict: true` if you need it to stop the lane.
+- **Release registration warns but the build still uploads.** Expected with
+  `strict: false`: registration records provenance (the commit), so a failed registration
+  loses that metadata without stopping distribution. Leave `strict` at its default if you
+  need it to stop the lane.
 - **Not using fastlane?** The `pharen` CLI runs the same three steps directly. See the
-  documentation at <https://pharen.ai/docs>.
+  [CLI reference](https://www.pharen.ai/docs/cli).
 
 ## License
 

data/lib/fastlane/plugin/pharen/actions/pharen_release_action.rb

@@ -8,15 +8,16 @@
 #
 # Zero-arg: the IPA and dSYMs default from the lane context (gym/download_dsyms);
 # version / build number / bundle id are read from the IPA's own Info.plist; the
-# commit sha from git; org/app from the committed .pharen.yml; auth from
-# PHAREN_AUTH_TOKEN (env-only, never echoed). It folds Pharen's three CLI steps
-# (releases new → upload-symbols → upload-build) into one, so registering a release
+# commit sha from git; org/app from the committed .pharen.yml; auth from the CLI's own
+# credential (never passed or echoed). It folds Pharen's three CLI steps
+# (releases create → symbols upload → builds upload) into one, so registering a release
 # is never a step you have to remember to run.
 #
-# SYMBOLS ARE NOT OPTIONAL: a build shipped without its dSYMs leaves every crash it
-# ever produces unsymbolicated (late upload does not retroactively fix issues). In
-# warn mode a missing-dSYM situation is a LOUD warning and the build still uploads;
-# strict mode aborts the lane.
+# SYMBOLS ARE NOT OPTIONAL: a build shipped without its dSYMs produces crashes that stay
+# unreadable until the dSYMs arrive (a late upload re-symbolicates and re-groups recent
+# crashes only, at most the last seven days of them). Strict mode, the default, aborts
+# the lane when no dSYM is found; with strict: false it is a LOUD warning and the build
+# still uploads.
 
 require "fastlane/action"
 require_relative "../helper/pharen_helper"
@@ -47,18 +48,20 @@ module Fastlane
         end
 
         # -- step 1: register the release (idempotent server-side; commit = provenance)
-        release_args = ["releases", "new", "--platform", "ios", "--version", info[:version], "--build", info[:build]]
+        release_args = ["releases", "create", "--platform", "ios", "--version", info[:version], "--build", info[:build]]
         sha = helper.git_commit_sha
         release_args += ["--commit", sha] if sha
         release = helper.run_pharen(params[:pharen_binary], release_args)
         unless release[:ok]
-          # Not fatal in warn mode: ingest also binds releases lazily, so a failed
-          # registration degrades provenance, not the pipeline.
-          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen releases new", release))
+          # Not fatal in warn mode: an uploaded build or an arriving crash records its
+          # release anyway, so a failed registration loses provenance (the commit), not
+          # the release.
+          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen releases create", release))
           return nil if params[:strict]
         end
 
         # -- step 2: symbols (every dSYM the lane produced) ---------------------------
+        symbols_ok = false
         dsym_inputs = params[:dsym_paths]
         if dsym_inputs.nil? || Array(dsym_inputs).empty?
           candidates = []
@@ -70,18 +73,19 @@ module Fastlane
           helper.fail_or_warn(
             params[:strict],
             "pharen_release: no dSYMs in the lane context — crashes from this build " \
-              "can NEVER symbolicate. Archive with DEBUG_INFORMATION_FORMAT=dwarf-with-dsym, " \
-              "or pass dsym_paths:"
+              "stay unreadable until its dSYMs are uploaded. Archive with " \
+              "DEBUG_INFORMATION_FORMAT=dwarf-with-dsym, or pass dsym_paths:"
           )
         else
           begin
             dsyms = helper.expand_dsym_inputs(dsym_inputs)
-            symbols = helper.run_pharen(params[:pharen_binary], ["upload-symbols", *dsyms])
+            symbols = helper.run_pharen(params[:pharen_binary], ["symbols", "upload", *dsyms])
             if symbols[:ok]
+              symbols_ok = true
               summary = symbols[:json].is_a?(Hash) ? symbols[:json]["summary"] : nil
               UI.success("pharen_release: symbols — #{summary || "uploaded #{dsyms.length} dSYM(s)"}")
             else
-              helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen upload-symbols", symbols))
+              helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen symbols upload", symbols))
             end
           rescue Helper::PharenHelper::Failure => e
             helper.fail_or_warn(params[:strict], "pharen_release: #{e.message}")
@@ -90,7 +94,8 @@ module Fastlane
 
         # -- step 3: the build itself → install link ----------------------------------
         build_args = [
-          "upload-build",
+          "builds",
+          "upload",
           "--platform", "ios",
           "--version", info[:version],
           "--build", info[:build],
@@ -99,13 +104,20 @@ module Fastlane
         ]
         build = helper.run_pharen(params[:pharen_binary], build_args)
         unless build[:ok]
-          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen upload-build", build))
+          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen builds upload", build))
           return nil
         end
 
         install_url = build[:json].is_a?(Hash) ? build[:json]["install_url"] : nil
         Actions.lane_context[SharedValues::PHAREN_INSTALL_URL] = install_url if install_url
-        UI.success("pharen_release: #{info[:bundle_id]} #{info[:version]} (#{info[:build]}) registered + symbolicated + distributed")
+        # Says what actually happened: outside strict mode a step can fail and the lane
+        # still reaches here, and a line claiming all three would hide it.
+        outcome = [
+          release[:ok] ? "release registered" : "release NOT registered",
+          symbols_ok ? "symbols uploaded" : "symbols NOT uploaded",
+          "build uploaded"
+        ]
+        UI.success("pharen_release: #{info[:bundle_id]} #{info[:version]} (#{info[:build]}) — #{outcome.join(', ')}")
         UI.important("Install (Safari on the phone): #{install_url}") if install_url
         install_url
       end
@@ -119,16 +131,16 @@ module Fastlane
       end
 
       def self.authors
-        ["Pharen (Lucubra LLC)"]
+        ["Pharen"]
       end
 
       def self.details
-        "Orchestrates the Pharen CLI's three steps (releases new → upload-symbols → " \
-          "upload-build) with everything derived: IPA + dSYMs from the lane context, " \
+        "Runs the Pharen CLI's three steps (releases create → symbols upload → " \
+          "builds upload) with everything derived: IPA + dSYMs from the lane context, " \
           "version/build/bundle id from the IPA's Info.plist, commit sha from git, " \
-          "org/app from the committed .pharen.yml, auth from PHAREN_AUTH_TOKEN. " \
-          "Missing dSYMs warn LOUDLY (or abort under strict) — a build without " \
-          "symbols ships crashes that can never be read."
+          "org/app from the committed .pharen.yml, auth from the CLI's own credential. " \
+          "Missing dSYMs abort the lane (or warn LOUDLY with strict: false) — a build " \
+          "without symbols ships crashes that stay unreadable until its symbols are uploaded."
       end
 
       def self.available_options
@@ -145,27 +157,30 @@ module Fastlane
                                        is_string: false),
           FastlaneCore::ConfigItem.new(key: :pharen_binary,
                                        env_name: "PHAREN_BINARY",
-                                       description: "Command that invokes the Pharen CLI (may include arguments, e.g. `node /path/to/cli.js`)",
+                                       description: "Command that invokes the Pharen CLI (may include arguments, e.g. `npx --yes @pharen-ai/cli`)",
                                        optional: true,
                                        default_value: "pharen",
                                        type: String),
           FastlaneCore::ConfigItem.new(key: :strict,
                                        env_name: "PHAREN_STRICT",
-                                       description: "Fail the lane on any step's error (true) instead of warning and continuing (false)",
+                                       description: "Fail the lane on any step's error (true, default) instead of warning and " \
+                                                    "continuing. Silent continuation ships builds whose symbols never arrived; " \
+                                                    "pass strict: false only where that is an acceptable trade",
                                        optional: true,
-                                       default_value: false,
-                                       is_string: false)
+                                       default_value: true,
+                                       type: Fastlane::Boolean)
         ]
       end
 
       def self.output
         [
-          ["PHAREN_INSTALL_URL", "The itms-services install link answered by the Pharen control plane"]
+          ["PHAREN_INSTALL_URL", "The itms-services install link Pharen returned for the build"]
         ]
       end
 
       def self.return_value
-        "The install_url string on success; nil on skipped/failed-but-not-strict"
+        "The install_url string once the build uploads; nil when there is no IPA, its Info.plist " \
+          "cannot be read, or the build upload fails (with strict: false)"
       end
 
       def self.is_supported?(platform)

data/lib/fastlane/plugin/pharen/actions/pharen_upload_build_action.rb

@@ -1,10 +1,9 @@
-# pharen_upload_build — upload the IPA to Pharen's dl distribution and get the
-# install link back.
+# pharen_upload_build — upload the IPA to Pharen and get the install link back.
 #
 # Zero-arg capable: the IPA defaults from gym/build_app's SharedValues::IPA_OUTPUT_PATH,
 # and version / build number / bundle id are read out of the IPA's own Info.plist
 # (unzip + plutil — dependency-free), so the customer passes nothing. org/app come from
-# the committed .pharen.yml; auth from PHAREN_AUTH_TOKEN (env-only, never echoed).
+# the committed .pharen.yml; auth from the CLI's own credential (never passed or echoed).
 
 require "fastlane/action"
 require_relative "../helper/pharen_helper"
@@ -37,7 +36,8 @@ module Fastlane
         end
 
         args = [
-          "upload-build",
+          "builds",
+          "upload",
           "--platform", "ios",
           "--version", info[:version],
           "--build", info[:build],
@@ -46,7 +46,7 @@ module Fastlane
         ]
         result = helper.run_pharen(params[:pharen_binary], args)
         unless result[:ok]
-          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen upload-build", result))
+          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen builds upload", result))
           return nil
         end
 
@@ -62,18 +62,17 @@ module Fastlane
       #####################################################
 
       def self.description
-        "Upload the IPA to Pharen dl distribution and return the OTA install link (zero-arg after gym)"
+        "Upload the IPA to Pharen and return the OTA install link (zero-arg after gym)"
       end
 
       def self.authors
-        ["Pharen (Lucubra LLC)"]
+        ["Pharen"]
       end
 
       def self.details
-        "Thin wrapper over `pharen upload-build`: the IPA defaults from " \
+        "Thin wrapper over `pharen builds upload`: the IPA defaults from " \
           "SharedValues::IPA_OUTPUT_PATH; version, build number and bundle id are " \
-          "extracted from the IPA's Info.plist so nothing needs passing. The server " \
-          "owns the dl layout, opaque slug and manifest.plist; the returned " \
+          "extracted from the IPA's Info.plist so nothing needs passing. The returned " \
           "install_url is this action's return value and lands in " \
           "lane_context[SharedValues::PHAREN_INSTALL_URL]."
       end
@@ -87,22 +86,22 @@ module Fastlane
                                        type: String),
           FastlaneCore::ConfigItem.new(key: :pharen_binary,
                                        env_name: "PHAREN_BINARY",
-                                       description: "Command that invokes the Pharen CLI (may include arguments, e.g. `node /path/to/cli.js`)",
+                                       description: "Command that invokes the Pharen CLI (may include arguments, e.g. `npx --yes @pharen-ai/cli`)",
                                        optional: true,
                                        default_value: "pharen",
                                        type: String),
           FastlaneCore::ConfigItem.new(key: :strict,
                                        env_name: "PHAREN_STRICT",
-                                       description: "Fail the lane on error (true) instead of warning and continuing (false)",
+                                       description: "Fail the lane on error (true, default) instead of warning and continuing",
                                        optional: true,
-                                       default_value: false,
-                                       is_string: false)
+                                       default_value: true,
+                                       type: Fastlane::Boolean)
         ]
       end
 
       def self.output
         [
-          ["PHAREN_INSTALL_URL", "The itms-services install link answered by the Pharen control plane"]
+          ["PHAREN_INSTALL_URL", "The itms-services install link Pharen returned for the build"]
         ]
       end
 

data/lib/fastlane/plugin/pharen/actions/pharen_upload_symbols_action.rb

@@ -3,8 +3,8 @@
 # Zero-arg capable: with no options it takes the dSYMs the lane already produced —
 # gym/build_app's SharedValues::DSYM_OUTPUT_PATH and download_dsyms'
 # SharedValues::DSYM_PATHS. The CLI needs ONLY paths: debug ids are parsed from the
-# binaries, org/app come from the customer's committed .pharen.yml, auth from
-# PHAREN_AUTH_TOKEN in the environment (never echoed, never on a command line).
+# binaries, org/app come from the customer's committed .pharen.yml, auth from the CLI's
+# own credential (never echoed, never on a command line).
 
 require "fastlane/action"
 require_relative "../helper/pharen_helper"
@@ -33,9 +33,9 @@ module Fastlane
           return nil
         end
 
-        result = helper.run_pharen(params[:pharen_binary], ["upload-symbols"] + expanded)
+        result = helper.run_pharen(params[:pharen_binary], ["symbols", "upload"] + expanded)
         unless result[:ok]
-          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen upload-symbols", result))
+          helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen symbols upload", result))
           return nil
         end
 
@@ -63,14 +63,14 @@ module Fastlane
       end
 
       def self.authors
-        ["Pharen (Lucubra LLC)"]
+        ["Pharen"]
       end
 
       def self.details
-        "Thin wrapper over `pharen upload-symbols`: dSYM paths default from " \
+        "Thin wrapper over `pharen symbols upload`: dSYM paths default from " \
           "SharedValues::DSYM_OUTPUT_PATH (gym) and SharedValues::DSYM_PATHS " \
           "(download_dsyms); .zip inputs are expanded to .dSYM bundles. Debug ids, " \
-          "org/app (.pharen.yml) and auth (PHAREN_AUTH_TOKEN) are the CLI's job. " \
+          "org/app (.pharen.yml) and auth are the CLI's job. " \
           "Server dedupes by debug id, so re-runs are safe."
       end
 
@@ -83,16 +83,18 @@ module Fastlane
                                        type: Array),
           FastlaneCore::ConfigItem.new(key: :pharen_binary,
                                        env_name: "PHAREN_BINARY",
-                                       description: "Command that invokes the Pharen CLI (may include arguments, e.g. `node /path/to/cli.js`)",
+                                       description: "Command that invokes the Pharen CLI (may include arguments, e.g. `npx --yes @pharen-ai/cli`)",
                                        optional: true,
                                        default_value: "pharen",
                                        type: String),
           FastlaneCore::ConfigItem.new(key: :strict,
                                        env_name: "PHAREN_STRICT",
-                                       description: "Fail the lane on error (true) instead of warning and continuing (false)",
+                                       description: "Fail the lane on error (true, default) instead of warning and continuing. " \
+                                                    "A build shipped without its dSYMs produces crashes that stay unreadable until " \
+                                                    "the symbols arrive — pass strict: false only where that is an acceptable trade",
                                        optional: true,
-                                       default_value: false,
-                                       is_string: false)
+                                       default_value: true,
+                                       type: Fastlane::Boolean)
         ]
       end
 

data/lib/fastlane/plugin/pharen/helper/pharen_helper.rb

@@ -9,8 +9,9 @@
 # Dependency-free by design: macOS system tools only (unzip, plutil, git) — every box
 # that can produce an IPA has them — so the gem adds NO runtime dependencies.
 #
-# SECURITY: PHAREN_AUTH_TOKEN is read by the CLI from the environment. This helper never
-# reads, prints, or passes the token — no command line ever contains it.
+# SECURITY: the CLI resolves its own credential — the session `pharen auth login` stored, a
+# CI job's identity, or PHAREN_AUTH_TOKEN from the environment. This helper never reads,
+# prints, or passes one, so no command line ever contains it.
 
 require "fastlane_core/ui/ui"
 require "json"
@@ -100,12 +101,12 @@ module Fastlane
 
         # Run `<binary> <args...>` and interpret the CLI's contract: JSON on stdout,
         # exit 0 on success. `binary` is Shellwords-split so `pharen_binary` may carry a
-        # command with arguments (e.g. "node /path/to/cli.js"). Never raises on CLI
+        # command with arguments (e.g. "npx --yes @pharen-ai/cli"). Never raises on CLI
         # failure — callers decide strict-vs-warn from the returned hash.
         def run_pharen(binary, args, chdir: nil)
           argv = Shellwords.split(binary.to_s) + args.map(&:to_s)
           dir = chdir || project_dir
-          UI.command(Shellwords.join(argv)) # never contains PHAREN_AUTH_TOKEN (env-only)
+          UI.command(Shellwords.join(argv)) # never contains a credential (the CLI resolves its own)
           out, err, status = capture(argv, chdir: dir)
           json = parse_json(out)
           { ok: status == 0, status: status, stdout: out, stderr: err, json: json }
@@ -121,8 +122,8 @@ module Fastlane
           if error.is_a?(Hash) && error["message"]
             "#{step} failed: #{error['message']} (#{error['code']})"
           elsif result[:not_found]
-            "#{step} failed: #{result[:stderr]} — install the Pharen CLI and ensure `pharen` is on PATH " \
-              "(see https://pharen.ai/docs for install instructions), or set the pharen_binary option"
+            "#{step} failed: #{result[:stderr]} — install the Pharen CLI with " \
+              "`npm install -g @pharen-ai/cli` so `pharen` is on PATH, or set the pharen_binary option"
           else
             detail = result[:stderr].to_s.strip
             detail = result[:stdout].to_s.strip if detail.empty?
@@ -134,11 +135,8 @@ module Fastlane
         # Where to run the CLI so it finds the customer's committed .pharen.yml.
         # fastlane executes lanes from the fastlane/ directory (Dir.chdir in
         # LaneManager), but .pharen.yml lives at the repo root by convention — step up
-        # one level when that is clearly the layout. Explicit --org/--app flags are the
-        # escape hatch for exotic layouts.
-        # (The CLI itself also walks up from its cwd looking for .pharen.yml, so this
-        # special-case is now a belt-and-suspenders optimization, not the only path —
-        # kept as-is since it still resolves correctly and needs no change.)
+        # one level when that is clearly the layout. Any other layout is left to the
+        # CLI, which walks up from its working directory to the nearest .pharen.yml.
         def project_dir
           cwd = Dir.pwd
           return cwd if File.exist?(File.join(cwd, ".pharen.yml"))
@@ -152,7 +150,7 @@ module Fastlane
 
         # -- misc ------------------------------------------------------------------------
 
-        # HEAD sha for `releases new --commit`; nil outside a git checkout (fine — the
+        # HEAD sha for `releases create --commit`; nil outside a git checkout (fine — the
         # flag is optional provenance).
         def git_commit_sha
           out, _err, status = capture(%w[git rev-parse HEAD])
@@ -161,8 +159,8 @@ module Fastlane
           sha.empty? ? nil : sha
         end
 
-        # strict: abort the lane; default: warn loudly and let the build continue —
-        # a telemetry step should never be the reason a release build fails.
+        # strict (the default): abort the lane. strict: false: warn loudly and let the
+        # build continue, for a lane where a Pharen step must never fail the build.
         def fail_or_warn(strict, message)
           if strict
             UI.user_error!(message)

data/lib/fastlane/plugin/pharen/version.rb

@@ -1,5 +1,5 @@
 module Fastlane
   module Pharen
-    VERSION = "0.1.0".freeze
+    VERSION = "0.2.0".freeze
   end
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fastlane-plugin-pharen
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
-- Pharen (Lucubra LLC)
+- Pharen
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fastlane
@@ -51,12 +52,12 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: 'Fastlane plugin for Pharen (https://pharen.ai): a thin wrapper over
-  the `pharen` CLI that adds one zero-argument action, pharen_release, after build_app
-  — it registers the release, uploads every dSYM, uploads the build, and returns the
-  OTA install link. Warn-don''t-fail by default, so a telemetry step never fails your
-  release build; `strict: true` opts a lane into hard failure where an unsymbolicated
-  release must be a stop.'
+description: 'Fastlane plugin for Pharen (https://www.pharen.ai): a thin wrapper over
+  the `pharen` CLI (npm install -g @pharen-ai/cli) that adds one zero-argument action,
+  pharen_release, after build_app — it registers the release, uploads every dSYM,
+  uploads the build, and returns the OTA install link. A step that fails fails the
+  lane by default, so a build never ships without its symbols unnoticed; `strict:
+  false` lets a lane warn and continue instead.'
 email: hello@pharen.ai
 executables: []
 extensions: []
@@ -71,12 +72,13 @@ files:
 - lib/fastlane/plugin/pharen/actions/pharen_upload_symbols_action.rb
 - lib/fastlane/plugin/pharen/helper/pharen_helper.rb
 - lib/fastlane/plugin/pharen/version.rb
-homepage: https://pharen.ai
+homepage: https://www.pharen.ai/docs/fastlane
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://pharen.ai
+  homepage_uri: https://www.pharen.ai/docs/fastlane
   rubygems_mfa_required: 'true'
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -91,7 +93,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: 'Pharen build distribution + crash symbols from your lane: pharen_release
   / pharen_upload_build / pharen_upload_symbols'