@ashlr/stack 0.1.1 → 0.3.0

package/src/commands/ci.ts

@@ -1,110 +0,0 @@
-import { existsSync, mkdirSync } from "node:fs";
-import { writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { defineCommand } from "citty";
-import { hasConfig } from "@ashlr/stack-core";
-import { colors, intro, outro, outroError } from "../ui.ts";
-
-const DEFAULT_WORKFLOW = `name: Stack doctor
-
-# Runs \`stack doctor --json --all\` in CI. Requires two repository secrets:
-#
-#   PHANTOM_VAULT_PASSPHRASE  — passphrase for the encrypted-file vault fallback
-#                                (Phantom uses this in CI where keychain isn't available).
-#   PHANTOM_CLOUD_TOKEN       — GitHub OAuth device token for \`phantom cloud pull\`.
-#
-# Both are created once with \`phantom login\` + \`phantom cloud push\` locally, then
-# copied into GitHub \`Settings → Secrets and variables → Actions\`.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  schedule:
-    # Nightly drift check — catches when an upstream key gets revoked out of band.
-    - cron: "0 7 * * *"
-  workflow_dispatch:
-
-jobs:
-  doctor:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Phantom Secrets
-        run: npm install -g phantom-secrets
-
-      - name: Install Stack CLI
-        run: npm install -g @ashlr/stack
-
-      - name: Pull vault from Phantom Cloud
-        env:
-          PHANTOM_CLOUD_TOKEN: \${{ secrets.PHANTOM_CLOUD_TOKEN }}
-          PHANTOM_VAULT_PASSPHRASE: \${{ secrets.PHANTOM_VAULT_PASSPHRASE }}
-        run: phantom cloud pull --force
-
-      - name: Run stack doctor
-        run: stack doctor --json > stack-doctor.json
-
-      - name: Upload doctor report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: stack-doctor-report
-          path: stack-doctor.json
-`;
-
-/**
- * `stack ci init` — scaffold a ready-to-commit GitHub Actions workflow that
- * runs `stack doctor --json` on every push + nightly, backed by Phantom Cloud
- * for secret pull. The YAML is opinionated but gives a correct-by-default
- * starting point; users tweak from there.
- */
-export const ciCommand = defineCommand({
-  meta: {
-    name: "ci",
-    description: "Scaffold CI integrations that run `stack doctor` on pushes + nightly.",
-  },
-  subCommands: {
-    init: defineCommand({
-      meta: {
-        name: "init",
-        description: "Write .github/workflows/stack-ci.yml for GitHub Actions.",
-      },
-      args: {
-        force: {
-          type: "boolean",
-          default: false,
-          description: "Overwrite an existing stack-ci.yml.",
-        },
-      },
-      async run({ args }) {
-        intro("stack ci init");
-        if (!hasConfig()) {
-          outroError("No .stack.toml found. Run `stack init` first.");
-          return;
-        }
-        const cwd = process.cwd();
-        const dir = resolve(join(cwd, ".github", "workflows"));
-        if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-        const path = join(dir, "stack-ci.yml");
-        if (existsSync(path) && !args.force) {
-          outroError(`${path} already exists. Pass --force to overwrite.`);
-          return;
-        }
-        await writeFile(path, DEFAULT_WORKFLOW, "utf-8");
-        console.log();
-        console.log(`  ${colors.green("●")} wrote ${colors.bold(".github/workflows/stack-ci.yml")}`);
-        console.log();
-        console.log(colors.dim("  Next steps:"));
-        console.log(colors.dim("    1. Add PHANTOM_VAULT_PASSPHRASE + PHANTOM_CLOUD_TOKEN to repo secrets."));
-        console.log(colors.dim("    2. Commit the workflow."));
-        console.log(
-          colors.dim("    3. Watch the first run in Actions — downloads the doctor report as an artifact."),
-        );
-        console.log();
-        outro(colors.green("CI workflow scaffolded."));
-      },
-    }),
-  },
-});

package/src/commands/clone.ts

@@ -1,113 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { basename, resolve } from "node:path";
-import { defineCommand } from "citty";
-import { hasConfig, scanSource } from "@ashlr/stack-core";
-import { colors, intro, outro, outroError } from "../ui.ts";
-
-/**
- * `stack clone <git-url> [dir]` — git clone the repo, then run `stack scan` in
- * the new checkout and surface next-step guidance. Treats committed
- * .stack.toml as authoritative when it exists.
- */
-export const cloneCommand = defineCommand({
-  meta: {
-    name: "clone",
-    description: "Clone a GitHub repo and auto-detect its Stack services.",
-  },
-  args: {
-    url: { type: "positional", required: true, description: "GitHub / git URL to clone." },
-    dir: { type: "positional", required: false, description: "Optional target directory." },
-  },
-  async run({ args }) {
-    intro(`stack clone ${args.url}`);
-    const url = String(args.url);
-
-    if (!isAllowedGitUrl(url)) {
-      outroError(
-        "Only https:// and git@ URLs are allowed (no file://, no --option prefixes, no local paths).",
-      );
-      return;
-    }
-
-    const target = args.dir ? String(args.dir) : inferDirFromUrl(url);
-    if (target.startsWith("-") || target.includes("..")) {
-      outroError(`Refusing to clone into suspicious target path "${target}".`);
-      return;
-    }
-
-    if (existsSync(target)) {
-      outroError(`Target directory "${target}" already exists.`);
-      return;
-    }
-
-    // `--` separates options from positional args so a crafted URL can't be
-    // parsed as a git flag (e.g. --upload-pack=<cmd>).
-    const result = spawnSync("git", ["clone", "--", url, target], { stdio: "inherit" });
-    if (result.status !== 0) {
-      outroError("git clone failed.");
-      return;
-    }
-
-    const resolved = resolve(target);
-    console.log();
-
-    const committed = hasConfig(resolved);
-    if (committed) {
-      console.log(
-        `  ${colors.green("●")} committed ${colors.bold(".stack.toml")} found — this repo is Stack-aware.`,
-      );
-      console.log(colors.dim("  Next steps:"));
-      console.log(colors.dim(`    cd ${target}`));
-      console.log(colors.dim(`    stack doctor --fix     # verify, re-login for anything missing`));
-      console.log(colors.dim(`    stack exec -- bun dev  # run with Phantom's proxy active`));
-    } else {
-      const hits = await scanSource(resolved);
-      const highConfidence = hits.filter((h) => h.confidence === "high");
-      if (hits.length === 0) {
-        console.log(colors.dim("  No providers detected. You can still `cd in` and run `stack init`."));
-      } else {
-        console.log(
-          `  ${colors.bold(String(hits.length))} provider(s) detected in source (${highConfidence.length} high-confidence):`,
-        );
-        for (const h of hits) {
-          const dot =
-            h.confidence === "high"
-              ? colors.green("●")
-              : h.confidence === "medium"
-                ? colors.yellow("●")
-                : colors.dim("●");
-          console.log(`    ${dot} ${h.provider.padEnd(12)} ${colors.dim(h.signals[0] ?? "")}`);
-        }
-        console.log(colors.dim("\n  Next steps:"));
-        console.log(colors.dim(`    cd ${target}`));
-        console.log(colors.dim(`    stack scan --auto     # offer to wire up each provider`));
-      }
-    }
-
-    outro(colors.green(`Cloned to ${target}.`));
-  },
-});
-
-function inferDirFromUrl(url: string): string {
-  // Handle https://github.com/org/repo(.git), git@github.com:org/repo.git, etc.
-  const trimmed = url.replace(/\.git$/i, "").replace(/\/$/, "");
-  return basename(trimmed);
-}
-
-/**
- * Accept https://, http:// (for self-hosted), and git@host:org/repo SSH URLs
- * only. Reject file://, ext::, --option-prefixed strings, empty strings, and
- * anything else that could cause git to do something other than clone a
- * remote repo.
- */
-function isAllowedGitUrl(url: string): boolean {
-  if (!url || url.length > 2048) return false;
-  if (url.startsWith("-")) return false;
-  if (/^file:/i.test(url)) return false;
-  if (/^ext::/i.test(url)) return false;
-  if (/^(https?:\/\/)/i.test(url)) return true;
-  if (/^git@[\w.-]+:[\w./~-]+$/i.test(url)) return true;
-  if (/^ssh:\/\//i.test(url)) return true;
-  return false;
-}

package/src/commands/completion.ts

@@ -1,187 +0,0 @@
-import { defineCommand } from "citty";
-import { listProviderNames, listTemplates } from "@ashlr/stack-core";
-
-/**
- * `stack completion <shell>` — emit a shell completion script. Runtime-static
- * (we bake the command list + the currently-installed provider / template
- * names when it runs). Users re-run this after adding a new shell.
- *
- *   stack completion bash > /etc/bash_completion.d/stack
- *   stack completion zsh > ~/.local/share/zsh/site-functions/_stack
- *   stack completion fish > ~/.config/fish/completions/stack.fish
- */
-export const completionCommand = defineCommand({
-  meta: {
-    name: "completion",
-    description: "Emit shell completion for bash, zsh, or fish.",
-  },
-  args: {
-    shell: {
-      type: "positional",
-      required: true,
-      description: "One of: bash, zsh, fish.",
-    },
-  },
-  async run({ args }) {
-    const shell = String(args.shell).toLowerCase();
-    const commands = [
-      "init",
-      "import",
-      "scan",
-      "clone",
-      "add",
-      "remove",
-      "list",
-      "info",
-      "status",
-      "env",
-      "deps",
-      "doctor",
-      "exec",
-      "sync",
-      "open",
-      "login",
-      "templates",
-      "providers",
-      "projects",
-      "upgrade",
-      "completion",
-      "ci",
-    ];
-    const providers = listProviderNames();
-    const templates = listTemplates();
-
-    if (shell === "bash") process.stdout.write(emitBash(commands, providers, templates));
-    else if (shell === "zsh") process.stdout.write(emitZsh(commands, providers, templates));
-    else if (shell === "fish") process.stdout.write(emitFish(commands, providers, templates));
-    else {
-      process.stderr.write(`Unsupported shell: ${shell}. Use bash, zsh, or fish.\n`);
-      process.exit(1);
-    }
-  },
-});
-
-function emitBash(commands: string[], providers: string[], templates: string[]): string {
-  return `# stack completion — bash
-_stack_completion() {
-  local cur prev words cword
-  _init_completion || return
-
-  if [[ \${cword} -eq 1 ]]; then
-    COMPREPLY=( $(compgen -W "${commands.join(" ")}" -- "\${cur}") )
-    return
-  fi
-
-  case "\${words[1]}" in
-    add|remove|info|login|open)
-      COMPREPLY=( $(compgen -W "${providers.join(" ")}" -- "\${cur}") )
-      ;;
-    templates)
-      if [[ \${cword} -eq 2 ]]; then
-        COMPREPLY=( $(compgen -W "list apply" -- "\${cur}") )
-      elif [[ "\${words[2]}" == "apply" ]]; then
-        COMPREPLY=( $(compgen -W "${templates.join(" ")}" -- "\${cur}") )
-      fi
-      ;;
-    sync)
-      COMPREPLY=( $(compgen -W "--platform vercel railway fly" -- "\${cur}") )
-      ;;
-    env)
-      COMPREPLY=( $(compgen -W "show diff set unset" -- "\${cur}") )
-      ;;
-    projects)
-      COMPREPLY=( $(compgen -W "list register remove where" -- "\${cur}") )
-      ;;
-    completion)
-      COMPREPLY=( $(compgen -W "bash zsh fish" -- "\${cur}") )
-      ;;
-  esac
-}
-complete -F _stack_completion stack
-`;
-}
-
-function emitZsh(commands: string[], providers: string[], templates: string[]): string {
-  return `#compdef stack
-# stack completion — zsh
-
-_stack() {
-  local state
-  _arguments -C \\
-    '1: :->command' \\
-    '*:: :->args'
-
-  case \$state in
-    command)
-      _values 'stack command' ${commands.map((c) => `"${c}"`).join(" ")}
-      ;;
-    args)
-      case \$words[1] in
-        add|remove|info|login|open)
-          _values 'provider' ${providers.map((p) => `"${p}"`).join(" ")}
-          ;;
-        templates)
-          if [[ $CURRENT -eq 2 ]]; then
-            _values 'subcommand' 'list' 'apply'
-          elif [[ $words[2] == "apply" ]]; then
-            _values 'template' ${templates.map((t) => `"${t}"`).join(" ")}
-          fi
-          ;;
-        env)
-          _values 'subcommand' 'show' 'diff' 'set' 'unset'
-          ;;
-        projects)
-          _values 'subcommand' 'list' 'register' 'remove' 'where'
-          ;;
-        completion)
-          _values 'shell' 'bash' 'zsh' 'fish'
-          ;;
-      esac
-      ;;
-  esac
-}
-
-_stack
-`;
-}
-
-function emitFish(commands: string[], providers: string[], templates: string[]): string {
-  const lines: string[] = [
-    "# stack completion — fish",
-    "complete -c stack -f",
-    "",
-  ];
-  for (const c of commands) {
-    lines.push(
-      `complete -c stack -n "__fish_use_subcommand" -a "${c}" -d "stack subcommand"`,
-    );
-  }
-  for (const verb of ["add", "remove", "info", "login", "open"]) {
-    for (const p of providers) {
-      lines.push(
-        `complete -c stack -n "__fish_seen_subcommand_from ${verb}" -a "${p}" -d "provider"`,
-      );
-    }
-  }
-  for (const sub of ["list", "apply"]) {
-    lines.push(
-      `complete -c stack -n "__fish_seen_subcommand_from templates" -a "${sub}" -d "template action"`,
-    );
-  }
-  for (const t of templates) {
-    lines.push(
-      `complete -c stack -n "__fish_seen_subcommand_from apply" -a "${t}" -d "starter template"`,
-    );
-  }
-  for (const sub of ["show", "diff", "set", "unset"]) {
-    lines.push(
-      `complete -c stack -n "__fish_seen_subcommand_from env" -a "${sub}" -d "env subcommand"`,
-    );
-  }
-  for (const sh of ["bash", "zsh", "fish"]) {
-    lines.push(
-      `complete -c stack -n "__fish_seen_subcommand_from completion" -a "${sh}" -d "shell"`,
-    );
-  }
-  return `${lines.join("\n")}\n`;
-}

package/src/commands/deps.ts

@@ -1,79 +0,0 @@
-import { defineCommand } from "citty";
-import { getProvider, readConfig } from "@ashlr/stack-core";
-import { colors, intro, outro } from "../ui.ts";
-
-/**
- * `stack deps` — render an ASCII dependency graph of the services Stack has
- * wired up for the current project, grouped by category and annotated with
- * their secret slots. Good for onboarding a new developer ("here's what the
- * stack looks like") and for sanity-checking templates.
- */
-export const depsCommand = defineCommand({
-  meta: {
-    name: "deps",
-    description: "Show the service dependency graph for this stack.",
-  },
-  async run() {
-    intro("stack deps");
-    const config = await readConfig();
-    const services = Object.entries(config.services);
-    if (services.length === 0) {
-      outro(colors.dim("No services yet."));
-      return;
-    }
-
-    // Group by category.
-    const byCategory: Record<string, Array<{ name: string; displayName: string; secrets: string[]; mcp?: string }>> = {};
-    for (const [name, entry] of services) {
-      try {
-        const p = await getProvider(entry.provider);
-        (byCategory[p.category] ??= []).push({
-          name,
-          displayName: p.displayName,
-          secrets: entry.secrets,
-          mcp: entry.mcp,
-        });
-      } catch {
-        /* skip */
-      }
-    }
-
-    console.log();
-    console.log(`  ${colors.bold(config.stack.project_id)}`);
-    if (config.stack.template) {
-      console.log(`  ${colors.dim("template:")} ${config.stack.template}`);
-    }
-    console.log();
-
-    const categories = Object.keys(byCategory).sort();
-    for (let i = 0; i < categories.length; i += 1) {
-      const cat = categories[i];
-      const isLast = i === categories.length - 1;
-      const branch = isLast ? "└──" : "├──";
-      const cont = isLast ? "   " : "│  ";
-      console.log(`  ${branch} ${colors.bold(cat)}`);
-      const items = byCategory[cat];
-      for (let j = 0; j < items.length; j += 1) {
-        const item = items[j];
-        const subLast = j === items.length - 1;
-        const subBranch = subLast ? "└──" : "├──";
-        const subCont = subLast ? "   " : "│  ";
-        const mcpTag = item.mcp ? colors.cyan(` mcp:${item.mcp}`) : "";
-        console.log(`  ${cont} ${subBranch} ${colors.green("●")} ${item.displayName}${mcpTag}`);
-        for (const secret of item.secrets) {
-          console.log(`  ${cont} ${subCont} ${colors.dim("·")} ${colors.dim(secret)}`);
-        }
-      }
-      if (!isLast) console.log(`  │`);
-    }
-    console.log();
-
-    const totalSecrets = services.reduce((acc, [, e]) => acc + e.secrets.length, 0);
-    const totalMcps = services.filter(([, e]) => e.mcp).length;
-    outro(
-      colors.dim(
-        `${services.length} services · ${totalSecrets} secrets · ${totalMcps} MCP server(s)`,
-      ),
-    );
-  },
-});

package/src/commands/doctor.ts

@@ -1,192 +0,0 @@
-import { defineCommand } from "citty";
-import {
-  type ProviderContext,
-  addService,
-  getProvider,
-  isPhantomInstalled,
-  listProjects,
-  readConfig,
-} from "@ashlr/stack-core";
-import { colors, intro, logEvent, outro, outroError, prompts } from "../ui.ts";
-
-interface DoctorReport {
-  project: string;
-  path: string;
-  services: Array<{
-    name: string;
-    status: "ok" | "warn" | "error" | "unchecked";
-    detail?: string;
-    latencyMs?: number;
-  }>;
-}
-
-export const doctorCommand = defineCommand({
-  meta: {
-    name: "doctor",
-    description: "Verify every service is reachable and credentials are valid.",
-  },
-  args: {
-    fix: {
-      type: "boolean",
-      default: false,
-      description: "Attempt to auto-remediate by re-running `stack add` for failing services.",
-    },
-    all: {
-      type: "boolean",
-      default: false,
-      description: "Run doctor across every registered project on this machine.",
-    },
-    json: {
-      type: "boolean",
-      default: false,
-      description: "Emit machine-readable JSON (exit 0/1 on pass/fail). CI-friendly.",
-    },
-  },
-  async run({ args }) {
-    const json = Boolean(args.json);
-    if (!json) intro("stack doctor");
-
-    if (!(await isPhantomInstalled())) {
-      const msg = "Phantom is not installed. Stack cannot verify secrets without it.";
-      if (json) {
-        process.stdout.write(`${JSON.stringify({ error: msg })}\n`);
-        process.exitCode = 1;
-        return;
-      }
-      outroError(msg);
-      return;
-    }
-
-    const scope: Array<{ path: string; name: string }> = args.all
-      ? (await listProjects()).map((p) => ({ path: p.path, name: p.name }))
-      : [{ path: process.cwd(), name: "cwd" }];
-
-    if (scope.length === 0) {
-      if (json) {
-        process.stdout.write(`${JSON.stringify({ reports: [] })}\n`);
-        return;
-      }
-      outro(colors.dim("No registered projects yet."));
-      return;
-    }
-
-    const reports: DoctorReport[] = [];
-    let anyFailed = false;
-    for (const project of scope) {
-      if (!json && args.all) {
-        console.log(`\n${colors.bold(project.name)} ${colors.dim(project.path)}`);
-      }
-      const report = await runDoctor(project.path, project.name, Boolean(args.fix), json);
-      reports.push(report);
-      if (report.services.some((s) => s.status === "error")) anyFailed = true;
-    }
-
-    if (json) {
-      process.stdout.write(`${JSON.stringify({ reports }, null, 2)}\n`);
-      process.exitCode = anyFailed ? 1 : 0;
-      return;
-    }
-
-    if (anyFailed)
-      outroError("One or more services failed. Re-run with --fix to attempt remediation.");
-    else outro(colors.green("All services healthy."));
-  },
-});
-
-async function runDoctor(
-  cwd: string,
-  projectName: string,
-  fix: boolean,
-  json: boolean,
-): Promise<DoctorReport> {
-  const report: DoctorReport = { project: projectName, path: cwd, services: [] };
-  const config = await readConfig(cwd).catch(() => undefined);
-  if (!config) {
-    if (!json) console.log(colors.dim("  (no .stack.toml)"));
-    return report;
-  }
-  const services = Object.entries(config.services);
-  if (services.length === 0) {
-    if (!json) console.log(colors.dim("  (no services configured)"));
-    return report;
-  }
-
-  const ctx: ProviderContext = {
-    cwd,
-    interactive: !json && process.stdout.isTTY === true,
-    log: json ? () => {} : logEvent,
-  };
-
-  const failingNames: string[] = [];
-  for (const [name, entry] of services) {
-    const spinner = json ? undefined : prompts.spinner();
-    spinner?.start(`Checking ${name}…`);
-    try {
-      const provider = await getProvider(name);
-      if (!provider.healthcheck) {
-        report.services.push({ name, status: "unchecked" });
-        spinner?.stop(colors.dim(`  ${name}: no healthcheck implemented`));
-        continue;
-      }
-      const status = await provider.healthcheck(ctx, entry);
-      if (status.kind === "ok") {
-        report.services.push({ name, status: "ok", latencyMs: status.latencyMs });
-        spinner?.stop(
-          `  ${colors.green("●")} ${name}${status.latencyMs ? colors.dim(` (${status.latencyMs}ms)`) : ""}`,
-        );
-      } else if (status.kind === "warn") {
-        report.services.push({ name, status: "warn", detail: status.detail });
-        spinner?.stop(`  ${colors.yellow("●")} ${name}: ${status.detail}`);
-      } else {
-        failingNames.push(name);
-        report.services.push({ name, status: "error", detail: status.detail });
-        spinner?.stop(`  ${colors.red("●")} ${name}: ${status.detail}`);
-      }
-    } catch (err) {
-      failingNames.push(name);
-      report.services.push({ name, status: "error", detail: (err as Error).message });
-      spinner?.stop(`  ${colors.red("●")} ${name}: ${(err as Error).message}`);
-    }
-  }
-
-  if (fix && failingNames.length > 0 && !json) {
-    console.log();
-    prompts.log.info(colors.bold("  Attempting remediation…"));
-    for (const name of failingNames) {
-      const entry = config.services[name];
-      // Confirm before re-running, because `addService` may trigger a browser
-      // OAuth flow or provision new upstream resources. Doing that silently
-      // during a routine `doctor --fix` surprises users.
-      const confirmed = process.stdout.isTTY
-        ? await prompts.confirm({
-            message: `Re-run setup for ${name}? (may open browser / create new resource)`,
-            initialValue: true,
-          })
-        : true;
-      if (!confirmed || prompts.isCancel(confirmed)) {
-        console.log(`  ${colors.dim("·")} ${name}: skipped`);
-        continue;
-      }
-      const spinner = prompts.spinner();
-      spinner.start(`  Re-running ${name}…`);
-      try {
-        await addService({
-          providerName: name,
-          cwd,
-          existingResourceId: entry.resource_id,
-          interactive: process.stdout.isTTY === true,
-          log: (event) => {
-            spinner.stop();
-            logEvent(event);
-            spinner.start(`  Re-running ${name}…`);
-          },
-        });
-        spinner.stop(`  ${colors.green("●")} ${name} re-wired.`);
-      } catch (err) {
-        spinner.stop(`  ${colors.red("●")} ${name}: ${(err as Error).message}`);
-      }
-    }
-  }
-
-  return report;
-}