pray-cli 1.6.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: e9a9ce52fe79c346f5ea5bf9516fb6ad813da69028fcf27c4fe166946fec77fc
+  data.tar.gz: 39062dc10eee030334edda7c10a9a71749a93c887cf2483f218ab7a9ceefcb68
+SHA512:
+  metadata.gz: 8097c2dab4ec198b55d8fc8803ed602f82fa6afef6096602b539f25b501b597da0bcd53108de519422b2216b624d0060e21020cb7abf531e700eaaa5a83eeac5
+  data.tar.gz: f8bde377e7a44de1aeec8591c92e4f478e2758386067585ac17c07afbb0af71946c37dbd7f6a58b4035ced2e6141f32ea2cd20372f0eafe195c1075ea43d3a37

data/CHANGELOG.md

@@ -0,0 +1,47 @@
+# CHANGELOG
+
+## Unreleased
+
+## 1.6.0 (2026-07-29)
+
+- Run tests with polyrun parallel RSpec, coverage gate, Makefile lint/test, and RBS validate.
+- Implement HTTP `login` (passkey and ssh-agent), `confess`, and `sync`.
+- Implement full `trust` CLI against `trust.toml` (list/show/add-key/remove-key/set-*/import-*/check).
+- Serve federation discovery, sync index/package, and confession submit over HTTP.
+
+## 1.5.2 (2026-07-29)
+
+- Put the Prayfile positioning line into the gem summary for RubyGems search.
+
+## 1.5.1 (2026-07-29)
+
+- Add `rake build` / `rake release` for gem packaging and RubyGems push.
+- Rework gem summary, description, and README opener to match Prayfile positioning.
+
+## 1.5.0 (2026-07-27)
+
+- Add `((pray:symbol))` templating with project-wide `pray do` / `template do` symbol maps.
+- Substitute symbols in rendered fragments, local embeds, and UTF-8 provisioned files.
+- Accept Gemfile-like Ruby surface sugar: `{…}` blocks, top-level `;`, and optional call parentheses.
+- Accept `pray` / `use` / `include` / `package` as package declaration aliases of `agent`.
+- Parse and apply `compose`, `tree`, and `file:` destinations with role-based export selection and scoped render/provision.
+- Exercise the shared `testdata/shared` Prayfile corpus alongside Rust and TypeScript.
+- Rewrite Prayfile with `pray format` (`fmt`) to the recommended compose/tree/file destination DSL.
+
+## 1.1.0 (2026-07-14)
+
+- Add environment-aware rendering with `group` blocks and `--env` or `PRAY_ENV`.
+- Add global `--path` and `--file-path` flags with `PRAY_PATH`, `PRAY_FILE_PATH`, and project `.env` support.
+- Record the selected environment in `Prayfile.lock`.
+- Improve CLI help with grouped commands, per-command help, and suggestions for unknown commands.
+- Add `--no-input` to skip interactive prompts.
+- Honor `PRAY_NO_COLOR` and `NO_COLOR` for plain terminal output.
+- Refresh git distribution caches on install when a locked revision is missing locally.
+
+## 1.0.0 (2026-07-13)
+
+- Initial RubyGems release of `pray-cli`.
+- Resolve local path packages and git distribution sources.
+- Publish to local distribution roots and serve over HTTP.
+- Install, update, render, verify, and drift workflows with `Prayfile.lock`.
+- Git distribution integration tests for install, locked revision, and update.

data/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 pray contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,125 @@
+# pray-cli
+
+Ruby `pray` CLI and library for [Prayfile](https://pray.kisko.dev): a package manager for the language placed before inference.
+
+Resolve, lock, render, verify, and publish shared instructions, policies, templates, and related input as versioned packages. Consumes path, git, and registry distribution points. The installed executable is `pray`.
+
+**Website:** [pray.kisko.dev](https://pray.kisko.dev)
+
+**Maintainer:** Andrei Makarov ([contact@kiskolabs.com](mailto:contact@kiskolabs.com))
+
+**Repository:** [kiskolabs/pray](https://github.com/kiskolabs/pray)
+
+**Community docs:** [CHANGELOG.md](CHANGELOG.md) · [LICENSE.md](LICENSE.md) · [SECURITY.md](SECURITY.md)
+
+## Install
+
+```bash
+gem install pray-cli
+```
+
+From this repository:
+
+```bash
+cd rubygems/pray-cli
+bundle install
+bundle exec pray version
+```
+
+## Commands
+
+Core workflow:
+
+```bash
+pray init
+pray install
+pray plan
+pray verify
+pray drift
+pray manifest
+```
+
+Package management:
+
+```bash
+pray add sample/base "~> 1.0" --path packages/base
+pray remove sample/base
+pray update
+pray unlock sample/base
+pray list
+pray tree
+pray explain sample/base
+pray outdated
+```
+
+Package authoring:
+
+```bash
+pray prayer init
+pray package
+```
+
+Auth, trust, and federation:
+
+```bash
+pray login --server URL --email EMAIL --passkey-key PATH --credential-id ID
+pray confess sample/base --accepted
+pray sync --root PATH --peer URL
+pray trust list
+pray trust show
+pray trust add-key KEY --match-prefix PREFIX
+pray trust check [SOURCE]
+```
+
+Maintenance:
+
+```bash
+pray render
+pray format
+pray clean
+```
+
+Deferred in this release (clear unsupported errors): `pray_ssh` sources, `serve --stdio`, confess/sync over `pray+ssh`, trust `--host-key` for `pray+ssh`.
+
+Git sources clone into `.pray/cache/git`, discover distribution roots at `v1/packages` or `prayers/v1/packages`, and resolve packages through registry metadata.
+
+Local publish writes `v1/index.json`, package metadata, and `.praypkg` artifacts. `serve` exposes the distribution tree over HTTP, including federation discovery and sync endpoints.
+
+## Layout
+
+```
+lib/pray/
+  literal.rb       Prayfile and prayspec literal parser
+  manifest.rb      Prayfile parser and model
+  package_spec.rb  prayspec parser
+  lockfile.rb      Prayfile.lock read/write
+  resolve.rb       dependency resolution
+  render.rb        target rendering and skill materialization
+  verify.rb        verify and drift checks
+  registry.rb      HTTP and local registry resolution
+  archive.rb       .praypkg archive read/write (requires tar and zstd)
+  cli.rb           command dispatch
+```
+
+## Tests
+
+```bash
+make lint
+make test
+```
+
+Coverage-gated parallel run:
+
+```bash
+POLYRUN_COVERAGE=1 bundle exec polyrun parallel-rspec --workers 5 --merge-failures
+```
+
+From the repository root:
+
+```bash
+make ruby-test
+```
+
+## Compatibility
+
+Manifest hashing, lockfile fields, pray markers, and tree hashes match the Rust reference for path-based projects. Registry resolution uses HTTP or a local distribution tree with `v1/packages/*.json` metadata.

data/SECURITY.md

@@ -0,0 +1,28 @@
+# SECURITY
+
+## Reporting a Vulnerability
+
+Do NOT open a public GitHub issue for security vulnerabilities.
+
+Email security details to: security@kiskolabs.com
+
+Include: description, steps to reproduce, potential impact, and suggested fix (if available).
+
+### Response Timeline
+
+- We will acknowledge receipt of your report
+- We will provide an initial assessment
+- We will keep you informed of our progress and resolution timeline
+
+### Disclosure Policy
+
+- We will work with you to understand and resolve the issue
+- We will credit you for the discovery (unless you prefer to remain anonymous)
+- We will publish a security advisory after the vulnerability is patched
+- We will coordinate public disclosure with you
+
+## Automation Security
+
+* Context Isolation: It is strictly forbidden to include production credentials, API keys, or Personally Identifiable Information (PII) in prompts sent to third-party LLMs or automation services.
+
+* Supply Chain: All automated dependencies must be verified.

data/bin/polyrun

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# Delegates to `bundle exec polyrun` with repo config.
+# - No args → same as `polyrun` with no subcommand (auto parallel RSpec from polyrun.yml / spec/**/*_spec.rb).
+# - Path-like argv (spec files, globs, dirs) → polyrun implicit parallel (path-only argv).
+# - Named subcommands (plan, config, parallel-rspec, ci-shard-rspec, …) → pass through.
+# - Otherwise (RSpec flags first, e.g. --format) → `start --workers N -- bundle exec rspec "$@"`.
+# Globals: -c/--config, -v/--verbose, -h/--help, --help (same as bundle exec polyrun).
+# Workers: POLYRUN_WORKERS (default 5, max 10, min 1) — read by polyrun run-shards/start.
+set -eo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+W="${POLYRUN_WORKERS:-5}"
+case "$W" in ''|*[!0-9]*) W=5 ;; esac
+if [ "$W" -gt 10 ]; then W=10; fi
+if [ "$W" -lt 1 ]; then W=1; fi
+
+CONFIG="${POLYRUN_CONFIG:-polyrun.yml}"
+polyrun_prefix=()
+have_config=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -c|--config)
+      polyrun_prefix+=("$1" "$2")
+      CONFIG="$2"
+      have_config=1
+      shift 2
+      ;;
+    -v|--verbose)
+      polyrun_prefix+=("$1")
+      shift
+      ;;
+    -h|--help)
+      if [ "$have_config" -eq 0 ]; then
+        exec bundle exec polyrun "${polyrun_prefix[@]}" -c "$CONFIG" -h
+      else
+        exec bundle exec polyrun "${polyrun_prefix[@]}" -h
+      fi
+      ;;
+    *)
+      break
+      ;;
+  esac
+done
+
+if [ "${1:-}" = "--version" ]; then
+  if [ "$have_config" -eq 0 ]; then
+    exec bundle exec polyrun "${polyrun_prefix[@]}" -c "$CONFIG" version
+  else
+    exec bundle exec polyrun "${polyrun_prefix[@]}" version
+  fi
+fi
+
+is_polyrun_command() {
+  case "$1" in
+    plan|prepare|merge-coverage|report-coverage|report-junit|report-timing|env|config|merge-timing|\
+    db:setup-template|db:setup-shard|db:clone-shards|run-shards|parallel-rspec|start|build-paths|\
+    ci-shard-run|ci-shard-rspec|init|queue|quick|help|version)
+      return 0 ;;
+    *)
+      return 1 ;;
+  esac
+}
+
+# True if argv should use polyrun implicit path parallel (any path-like token).
+implicit_path_in_argv() {
+  for a in "$@"; do
+    case "$a" in
+      -*) [ "$a" = "-" ] || continue ;;
+    esac
+    case "$a" in
+      *.rb|spec/*|test/*|./|/*|*[\*\?[]*) return 0 ;;
+    esac
+    [ -e "$a" ] && return 0
+  done
+  return 1
+}
+
+run_polyrun() {
+  if [ "$have_config" -eq 0 ]; then
+    exec bundle exec polyrun "${polyrun_prefix[@]}" -c "$CONFIG" "$@"
+  else
+    exec bundle exec polyrun "${polyrun_prefix[@]}" "$@"
+  fi
+}
+
+exec_parallel_rspec() {
+  if [ "$have_config" -eq 0 ]; then
+    exec bundle exec polyrun "${polyrun_prefix[@]}" -c "$CONFIG" start --workers "$W" -- bundle exec rspec "$@"
+  else
+    exec bundle exec polyrun "${polyrun_prefix[@]}" start --workers "$W" -- bundle exec rspec "$@"
+  fi
+}
+
+if [ $# -eq 0 ]; then
+  run_polyrun
+fi
+
+if is_polyrun_command "$1"; then
+  run_polyrun "$@"
+fi
+
+if implicit_path_in_argv "$@"; then
+  run_polyrun "$@"
+fi
+
+exec_parallel_rspec "$@"

data/bin/pray

@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+Encoding.default_external = Encoding::UTF_8
+Encoding.default_internal = Encoding::UTF_8
+
+gemfile = File.expand_path("../Gemfile", __dir__)
+if File.exist?(gemfile)
+  ENV["BUNDLE_GEMFILE"] ||= gemfile
+  require "bundler/setup"
+end
+
+require_relative "../lib/pray-cli"
+
+exit_code = 0
+begin
+  Pray::CLI.run(ARGV)
+rescue Pray::Error => error
+  warn error
+  exit_code = error.exit_code
+rescue => error
+  warn error
+  exit_code = 1
+end
+
+exit exit_code

data/lib/pray/archive.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "fileutils"
+require "tempfile"
+
+module Pray
+  module Archive
+    module_function
+
+    def build_package_archive_bytes(package)
+      prayspec_path = Resolve.find_prayspec_file(package.root)
+      prayspec_name = File.basename(prayspec_path)
+      metadata = package_metadata_json(package)
+
+      Dir.mktmpdir("pray-package-") do |staging|
+        File.write(File.join(staging, "metadata.json"), metadata)
+        File.write(File.join(staging, prayspec_name), File.binread(prayspec_path))
+        package.spec.files.each do |file|
+          destination = File.join(staging, file)
+          FileUtils.mkdir_p(File.dirname(destination))
+          File.binwrite(destination, File.binread(File.join(package.root, file)))
+        end
+
+        tar_bytes, status = Open3.capture2("tar", "-cf", "-", "-C", staging, ".")
+        raise Error.integrity("failed to build package tar archive") unless status.success?
+
+        zstd_bytes, status = Open3.capture2("zstd", "-q", "-c", stdin_data: tar_bytes)
+        unless status.success?
+          raise Error.unsupported("zstd is required to build package archives")
+        end
+
+        zstd_bytes
+      end
+    end
+
+    def write_package_archive(package, output_path)
+      FileUtils.mkdir_p(File.dirname(output_path))
+      File.binwrite(output_path, build_package_archive_bytes(package))
+    end
+
+    def unpack_praypkg(artifact_bytes, output_directory)
+      FileUtils.mkdir_p(output_directory)
+      tar_bytes, status = Open3.capture2("zstd", "-d", "-q", "-c", stdin_data: artifact_bytes)
+      unless status.success?
+        raise Error.unsupported("zstd is required to unpack package archives")
+      end
+
+      _stdout, _stderr, status = Open3.capture3("tar", "-xf", "-", "-C", output_directory, stdin_data: tar_bytes)
+      raise Error.integrity("failed to unpack package archive") unless status.success?
+    end
+
+    def package_archive_path(package_name, version)
+      slug = package_name.tr("/", "-")
+      File.join(".pray", "packages", "#{slug}-#{version}.praypkg")
+    end
+
+    def package_metadata_json(package)
+      JSON.generate(
+        "name" => package.spec.name,
+        "version" => package.spec.version,
+        "tree_hash" => package.tree_hash,
+        "exports" => package.selected_exports
+      )
+    end
+  end
+end

data/lib/pray/auth_client.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "json"
+require "base64"
+require "openssl"
+require_relative "session"
+require_relative "ssh_agent"
+
+module Pray
+  module AuthClient
+    module_function
+
+    def login_with_passkey(server_url, credential_id, private_key_path, session_root, email:)
+      challenge = post_json(
+        "#{trim_slash(server_url)}/v1/auth/passkeys/challenge",
+        {"credential_id" => credential_id}
+      )
+      seed = File.binread(private_key_path)
+      unless seed.bytesize == 32
+        raise Error.unsupported("passkey private key must be 32 raw bytes")
+      end
+
+      signature = Base64.strict_encode64(sign_ed25519(seed, challenge["challenge"].to_s))
+      response = post_json(
+        "#{trim_slash(server_url)}/v1/auth/passkeys/login",
+        {
+          "credential_id" => credential_id,
+          "challenge_id" => challenge["challenge_id"],
+          "signature" => signature
+        }
+      )
+      persist_login(server_url, response, email, "passkey", nil, session_root)
+    end
+
+    def login_with_ssh_agent(server_url, public_key_path, session_root, email:)
+      public_key = File.read(public_key_path).strip
+      challenge = post_json(
+        "#{trim_slash(server_url)}/v1/auth/ssh-keys/challenge",
+        {"public_key" => public_key}
+      )
+      signature = SshAgent.sign(public_key, challenge["challenge"].to_s)
+      response = post_json(
+        "#{trim_slash(server_url)}/v1/auth/ssh-keys/login",
+        {
+          "public_key" => public_key,
+          "challenge_id" => challenge["challenge_id"],
+          "signature" => signature
+        }
+      )
+      persist_login(
+        server_url, response, email, "ssh_key", challenge["fingerprint"], session_root
+      )
+    end
+
+    def persist_login(server_url, response, email, kind, fingerprint, session_root)
+      response_email = response["email"].to_s
+      unless response_email == email
+        raise Error.resolution(
+          "login email mismatch: expected #{email}, got #{response_email}"
+        )
+      end
+
+      Session.persist(
+        session_root,
+        SessionFile.new(
+          server_url: server_url,
+          email: response_email,
+          token: response["token"].to_s,
+          kind: kind,
+          signer_fingerprint: fingerprint
+        )
+      )
+    end
+
+    def sign_ed25519(seed, message)
+      unless OpenSSL::PKey.respond_to?(:generate_key)
+        raise Error.unsupported("OpenSSL Ed25519 support is required for passkey login")
+      end
+
+      key = OpenSSL::PKey.new_raw_private_key("ED25519", seed)
+      key.sign(nil, message)
+    rescue OpenSSL::PKey::PKeyError => error
+      raise Error.unsupported("OpenSSL Ed25519 signing failed: #{error.message}")
+    end
+
+    def post_json(url, body)
+      response = Registry.http_post(url, "application/json", JSON.generate(body))
+      JSON.parse(response)
+    rescue JSON::ParserError => error
+      raise Error.parse("auth response", error.message)
+    end
+
+    def trim_slash(value)
+      value.to_s.sub(%r{/+\z}, "")
+    end
+  end
+end

data/lib/pray/cli/commands/auth.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Pray
+  module CLI
+    def login_command(servers:, email:, mode:, passkey_key: nil, credential_id: nil, public_key: nil)
+      session_root = Dir.pwd
+      servers.each do |server_url|
+        session = case mode
+        when :passkey
+          AuthClient.login_with_passkey(
+            server_url, credential_id, passkey_key, session_root, email: email
+          )
+        when :ssh_agent
+          AuthClient.login_with_ssh_agent(
+            server_url, public_key, session_root, email: email
+          )
+        else
+          raise Error.unsupported("unknown login mode: #{mode}")
+        end
+        puts "logged in as #{session.email} via #{session.kind} on #{server_url}"
+      end
+    end
+
+    def confess_command(package:, from_lock:, version:, accepted:, rejected:, note:, url:)
+      Confess.submit(
+        package: package, from_lock: from_lock, version: version,
+        accepted: accepted, rejected: rejected, note: note, url: url
+      )
+    end
+
+    def sync_command(root:, peers:)
+      peer_sources = if peers.empty?
+        Sync.load_sync_peers(root).map { |peer| peer["url"] }
+      else
+        peers
+      end
+      summary = Sync.synchronize_registry(root, peer_sources)
+      puts "Synchronized #{summary[:packages]} package(s) from #{summary[:peers]} peer(s); " \
+           "learned #{summary[:known_peers]} peer(s)"
+    end
+  end
+end

data/lib/pray/cli/commands/distribution.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Pray
+  module CLI
+    def publish_command(roots:, servers:)
+      project = resolve_current_project
+      roots.each { |root| Publish.publish_to_root(project, root) }
+      servers.each { |server| Publish.publish_to_server(project, server) }
+    end
+
+    def serve_command(root:, host:, port:, stdio:)
+      raise Error.unsupported("serve --stdio is not implemented yet in pray-cli Ruby") if stdio
+
+      Serve.run_server(root: root, host: host, port: port)
+    end
+  end
+end

data/lib/pray/cli/commands/init.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+
+module Pray
+  module CLI
+    def manifest_command
+      manifest = Pray.parse_manifest(Pray.read_manifest_text(manifest_path))
+      puts JSON.pretty_generate(ManifestJson.manifest_fields(manifest.canonicalized))
+    end
+
+    def init_command(targets)
+      path = manifest_path
+      raise Error.manifest("Prayfile already exists") if File.exist?(path)
+
+      targets = ["tool_a"] if targets.empty?
+      lines = ['prayfile "1"']
+      targets.each do |target|
+        output = default_output_for_target(target)
+        lines << "target :#{target} do"
+        lines << "  output \"#{output}.md\""
+        lines << "end"
+      end
+      File.write(path, "#{lines.join("\n")}\n")
+    end
+
+    def prayer_init_command
+      root = Dir.pwd
+      package_name = File.basename(root)
+      package_name = "prayer-package" if package_name.strip.empty?
+      prayspec_path = File.join(root, "#{package_name}.prayspec")
+      raise Error.manifest("package spec already exists: #{prayspec_path}") if File.exist?(prayspec_path)
+
+      File.write(
+        prayspec_path,
+        <<~SPEC
+          Package::Specification.new do |spec|
+            spec.name = "#{package_name}"
+            spec.version = "0.1.0"
+            spec.summary = "Prayer package"
+            spec.files = []
+          end
+        SPEC
+      )
+    end
+
+    def repo_init_command
+      distribution_root = repo_distribution_root(Dir.pwd)
+      index_path = File.join(distribution_root, "v1", "index.json")
+      raise Error.manifest("distribution repo already exists") if File.exist?(index_path)
+
+      FileUtils.mkdir_p(File.join(distribution_root, "v1", "packages"))
+      FileUtils.mkdir_p(File.join(distribution_root, "v1", "artifacts"))
+      Publish.write_registry_index(distribution_root, RegistryIndex.new)
+    end
+
+    def repo_distribution_root(root)
+      (File.basename(root) == "prayers") ? root : File.join(root, "prayers")
+    end
+  end
+end

data/lib/pray/cli/commands/meta.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Pray
+  module CLI
+    def version_command
+      puts "pray #{Pray::VERSION}"
+    end
+
+    def clean_command
+      remove_path_if_exists(".pray/cache")
+      remove_path_if_exists(".pray/vendor")
+      remove_path_if_exists(".pray/state.json")
+    end
+  end
+end