@bensandee/tooling 0.72.3 → 0.74.0

package/README.md

@@ -31,7 +31,7 @@ The tool auto-detects project structure, CI platform, project type, and Docker p
 | Command                           | Description                                                                                                                                                                                             |
 | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `tooling repo:sync [dir]`         | Detect, generate, and sync project tooling (idempotent). First run prompts for release strategy, CI platform (if not detected), and formatter (if Prettier found). Subsequent runs are non-interactive. |
-| `tooling repo:sync --check [dir]` | Dry-run drift detection. Exits 1 if files would change. CI-friendly.                                                                                                                                    |
+| `tooling repo:sync --check [dir]` | Dry-run drift detection. Exits 1 if files would change, except drift confined to `.forgejo/workflows/`/`.github/workflows/`, which is reported on the `::bst-checks:: warn` marker at exit 0. CI-friendly. |
 | `tooling checks:run`              | Run project checks -- `bst checks:run --help` lists the ordered steps. Flags: `--skip`, `--add`, `--fail-fast`, `--verbose`, `--with-coverage`, `--coverage`, `--no-coverage`.                          |
 | `tooling lint:types`              | Type-aware linting (`oxlint --type-aware`, backed by `oxlint-tsgolint`). Flags: `--json`. See [Type-aware linting](#type-aware-linting) below.                                                          |
 
@@ -154,7 +154,7 @@ Opt out entirely with `"pnpmWorkspace": false` in `.tooling.json`; the generator
 | `tooling workflow:dispatch`      | Dispatch a `workflow_dispatch` event for any workflow in any repo on the same git host. Flags: `--repo`, `--workflow` (required), `--ref`, `--input key=value` (repeatable).                                                                                        |
 | `tooling forgejo:create-release` | Create a Forgejo release from a tag.                                                                                                                                                                                                                                |
 | `tooling changesets:merge`       | Merge a changesets version PR. Gated on a live read of the PR; refuses an empty version PR. On Forgejo, a first `mergeable: false` re-reads once after a short delay before refusing, since the forge reports `false` both for a conflict and while still checking. |
-| `tooling webhook:send <url>`     | POST a structured JSON release payload with HMAC-SHA256 auth. Flags: `--tag`, `--repository`, `--server-url`, `--actor`, `--prerelease`. Secret from `WEBHOOK_SECRET` env var.                                                                                      |
+| `tooling webhook:send <url>`     | POST a structured JSON release payload with HMAC-SHA256 auth. Best-effort by default: a delivery failure is logged, annotated `::error::` under CI, and the command exits 0; `--strict` restores a non-zero exit. Flags: `--tag`, `--repository`, `--server-url`, `--actor`, `--prerelease`, `--strict`. Secret from `WEBHOOK_SECRET` env var.                                                                                      |
 
 #### `release:simple`
 
@@ -492,18 +492,24 @@ It also closes a real gap: **the board can kill a wedged run on a headless agent
 short of a hand-run `docker kill`.
 
 ```bash
-# Loopback, port 4600, token minted at startup and logged once.
+# Loopback, port 4600. The access token comes from BST_AGENT_UI_TOKEN, or is minted once into
+# the state home when that is unset.
 bst agent:start --ui
 ```
 
-The startup log carries one clickable line -- open it and the token is exchanged for a session
-cookie, so it never sits in your history:
+The startup log names the board's URL and, when a file backs the token, that file's path. **The
+token itself is logged nowhere** -- read it out of the file, or set `BST_AGENT_UI_TOKEN` yourself:
 
 ```
-board: http://127.0.0.1:4600/?t=<token>
+board: http://127.0.0.1:4600
+board token: stored at ~/.local/state/bst-agent/ui-token (set BST_AGENT_UI_TOKEN to override)
 board listening on http://127.0.0.1:4600
 ```
 
+Opening the board gives you a login form; the token is the password, and a successful sign-in
+stores a 30-day HttpOnly cookie, so an agent restart no longer signs you out. Rotate by changing
+the env value or deleting the file, then restarting.
+
 ### Reaching it from a phone
 
 The documented deployment binds **loopback only** and publishes the board through a tailnet TLS