@akanjs/devkit 3.0.0-alpha.79 → 3.0.0-alpha.80

package/fleetSpoke.test.ts

@@ -5,7 +5,7 @@ import path from "node:path";
 import { Executor, WorkspaceExecutor } from "./executors";
 import { FileSys } from "./fileSys";
 import { FleetConfig } from "./fleetConfig";
-import { FleetSpoke, formatFleetDiff, formatFleetStatuses } from "./fleetSpoke";
+import { FleetSpoke, formatFleetDiff, formatFleetPushResults, formatFleetStatuses } from "./fleetSpoke";
 
 const tempRoots: string[] = [];
 const originalEnv = { ...process.env };
@@ -203,6 +203,31 @@ describe("FleetSpoke push", () => {
     const hook = await FileSys.readText(path.join(spokeRoot, ".husky/pre-commit"));
     expect(hook.trim()).toBe(FleetSpoke.guardHookLine);
   });
+
+  //? The fixture hub deliberately does not gitignore `.env`, so this also proves the clone-local exclude.
+  test("leaves the clone a runnable workspace root without shipping the file that makes it one", async () => {
+    const { bareRoot, workRoot, spoke, clonePath } = await makeFleet("env-served", "env-private", "env-kit");
+    await spoke.push("develop", { verify: false });
+
+    const localEnv = await FileSys.readText(path.join(clonePath, ".env"));
+    expect(localEnv).toContain("AKAN_PUBLIC_REPO_NAME=acme");
+    expect(localEnv).toContain("AKAN_PUBLIC_SERVE_DOMAIN=example.com");
+    expect(localEnv).not.toContain("hub");
+    expect(await FileSys.readText(path.join(clonePath, ".git/info/exclude"))).toContain("/.env");
+
+    const spokeRoot = await cloneSpoke(workRoot, bareRoot, "env-check");
+    expect(await FileSys.fileExists(path.join(spokeRoot, ".env"))).toBe(false);
+  });
+
+  test("reports a refusal's whole reason, indented, instead of one truncated line", () => {
+    const report = formatFleetPushResults([
+      { name: "acme", outcome: "refused", reason: "verification failed\nexit code: 1", changedFiles: 12 },
+      { name: "beta", outcome: "pushed", commit: "abc1234", changedFiles: 3 },
+    ]);
+    expect(report).toContain("refused  acme  verification failed");
+    expect(report).toContain("    exit code: 1");
+    expect(report).toContain("pushed   beta  abc1234 (3 files)");
+  });
 });
 
 describe("FleetSpoke status", () => {

package/fleetSpoke.ts

@@ -1,6 +1,6 @@
 import { mkdir, readdir, rename, rm } from "node:fs/promises";
 import path from "node:path";
-import { AppExecutor, Executor, type WorkspaceExecutor } from "./executors";
+import { AppExecutor, Executor, WorkspaceExecutor } from "./executors";
 import { FileSys } from "./fileSys";
 import type { FleetConfig, FleetSpokeDeclaration } from "./fleetConfig";
 import { LibSource } from "./libSource";
@@ -306,6 +306,43 @@ export class FleetSpoke {
     );
   }
 
+  /**
+   * Verify-only, and an allowlist rather than a filter so no hub secret can reach a customer's clone even
+   * by accident. `AKAN_PUBLIC_*` values are the ones akan embeds in every client bundle, so they are public
+   * by construction; the workspace id is pinned to `local` so the hub's cloud workspace never travels.
+   */
+  #localEnv() {
+    const { serveDomain } = WorkspaceExecutor.getBaseDevEnv();
+    return {
+      AKAN_WORKSPACE_ID: "local",
+      AKAN_PUBLIC_REPO_NAME: this.name,
+      AKAN_PUBLIC_SERVE_DOMAIN: serveDomain,
+      AKAN_PUBLIC_ENV: "local",
+      AKAN_PUBLIC_OPERATION_MODE: "local",
+      AKAN_PUBLIC_LOG_LEVEL: "warn",
+    };
+  }
+
+  /**
+   * The CLI identifies a workspace root by `package.json` + `tsconfig.json` + `.env`, so a clone with no
+   * `.env` cannot run `akan sync` at all — and one can never arrive with the slice, since every akan
+   * workspace gitignores it and the spoke's real values are spoke-owned. Excluded through the clone's own
+   * `.git/info/exclude` rather than trusting the hub's `.gitignore`: a hub that omitted the pattern would
+   * otherwise commit this file into the customer's repo.
+   */
+  async #writeLocalEnv() {
+    const excludePath = path.join(this.#clonePath, ".git/info/exclude");
+    const exclude = (await FileSys.fileExists(excludePath)) ? await FileSys.readText(excludePath) : "";
+    if (!exclude.split("\n").includes("/.env")) {
+      await mkdir(path.dirname(excludePath), { recursive: true });
+      await FileSys.writeText(excludePath, exclude.trim() ? `${exclude.replace(/\n*$/, "\n")}/.env\n` : "/.env\n");
+    }
+    const envPath = path.join(this.#clonePath, ".env");
+    if (await FileSys.fileExists(envPath)) return;
+    const lines = Object.entries(this.#localEnv()).map(([key, value]) => `${key}=${value}`);
+    await FileSys.writeText(envPath, `${lines.join("\n")}\n`);
+  }
+
   async #applySlice(clone: Executor, branch: string) {
     const { libs, paths } = await this.slice();
     const held = await this.#holdSpokeOwned();
@@ -324,6 +361,7 @@ export class FleetSpoke {
     await this.#rewriteGitignore();
     await this.#rewriteWorkspaceSection(libs);
     await this.#writeGuards();
+    await this.#writeLocalEnv();
     for (const lib of libs) await this.#stampLib(clone, lib, branch);
     return { libs };
   }
@@ -487,6 +525,22 @@ export class FleetSpoke {
     await FileSys.writeText(hookPath, content);
   }
 
+  /**
+   * Refuses the spoke rather than throwing, so one customer repo that fails to install or sync does not
+   * abort the push to the rest of the fleet. The env is passed explicitly so the child sees the values
+   * written into the clone instead of inheriting the hub's own.
+   */
+  async #verify(clone: Executor) {
+    const env = { ...process.env, ...this.#localEnv() };
+    try {
+      await clone.spawn("bun", ["install"], { env });
+      for (const app of this.#declaration.apps) await clone.spawn("bunx", ["akan", "sync", app], { env });
+      return null;
+    } catch (error) {
+      return error instanceof Error ? error.message : String(error);
+    }
+  }
+
   async push(branch: string, { verify = true }: { verify?: boolean } = {}): Promise<FleetPushResult> {
     this.#config.assertPushable(branch);
     if (await this.#workspace.hasChanges())
@@ -500,11 +554,12 @@ export class FleetSpoke {
     const dirty = (await clone.spawn("git", ["status", "--porcelain"])).trim();
     if (!dirty) return { name: this.name, outcome: "skipped", reason: "already up to date", changedFiles: 0 };
 
-    await this.#writeAnchorFile(branch);
+    const changedFiles = dirty.split("\n").length;
     if (verify) {
-      await clone.spawn("bun", ["install"]);
-      for (const app of this.#declaration.apps) await clone.spawn("bunx", ["akan", "sync", app]);
+      const failure = await this.#verify(clone);
+      if (failure) return { name: this.name, outcome: "refused", reason: failure, changedFiles };
     }
+    await this.#writeAnchorFile(branch);
     await clone.spawn("git", ["add", "-A"]);
     const message = `chore(fleet): sync from ${this.#workspace.repoName}@${await this.headSha()}`;
     await clone.spawn("git", ["commit", "--quiet", "-m", message]);
@@ -514,7 +569,7 @@ export class FleetSpoke {
       name: this.name,
       outcome: "pushed",
       commit: (await clone.spawn("git", ["rev-parse", "--short", "HEAD"])).trim(),
-      changedFiles: dirty.split("\n").length,
+      changedFiles,
     };
   }
 
@@ -595,10 +650,11 @@ export function formatFleetPushResults(results: FleetPushResult[]) {
   const sections = [
     "Akan Fleet Push",
     "",
-    ...results.map((result) => {
+    ...results.flatMap((result) => {
       const detail =
         result.outcome === "pushed" ? `${result.commit} (${result.changedFiles} files)` : (result.reason ?? "");
-      return `  ${result.outcome.padEnd(8)} ${result.name}  ${detail}`;
+      const [first = "", ...rest] = detail.split("\n");
+      return [`  ${result.outcome.padEnd(8)} ${result.name}  ${first}`, ...rest.map((line) => `    ${line}`)];
     }),
   ];
   return sections.join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.0.0-alpha.79",
+  "version": "3.0.0-alpha.80",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -45,7 +45,7 @@
     "@langchain/openai": "^1.4.6",
     "@tailwindcss/node": "^4.3.0",
     "@trapezedev/project": "^7.1.4",
-    "akanjs": "3.0.0-alpha.79",
+    "akanjs": "3.0.0-alpha.80",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",