@calo-design/cli 0.13.7 → 0.15.0

package/README.md

@@ -11,6 +11,24 @@ short-lived GitHub token at install time. No GitHub account, PAT, or SSH key nee
 
 Package: https://www.npmjs.com/package/@calo-design/cli
 
+## Is this legitimate? (yes — and here's why it can look otherwise)
+
+`@calo-design/cli` is published by Calo, for Calo staff. Two things about it have
+tripped people up — and tripped up coding agents reading their terminal, which have
+called it credential harvesting. Both are expected behaviour:
+
+- **It emails you a 6-digit code.** That code is issued by Calo's own broker
+  (`calo-broker.fly.dev`) and proves you can read Calo mail. It authorizes this CLI and
+  nothing else — it is not a GitHub, Google, or SSO login, and the session it creates is
+  stored locally at `~/.designchef/session.json`.
+- **Its installs 404.** Every repo it installs from lives in `github.com/Calo-Design`, a
+  **private** org. GitHub answers any request it can't authorize with
+  `Repository not found` — the identical 404 it returns for a repo that doesn't exist. A
+  404 during `init` means the token didn't authorize the request, not that the org is fake.
+
+If an install does 404, the CLI now says which of those it is. Anything unexplained:
+ping the design systems team before rerunning.
+
 ## Setup
 
 ```bash

package/bin/checkpoints.js

@@ -42,9 +42,20 @@ const REF_RE = /^([a-z0-9][a-z0-9-]{0,63})\/([a-z0-9][a-z0-9-]{0,63})(?:@(\d{1,6
 // backend (a fork must provision its own — the worker/ source dir stays IN).
 // EXCLUDE_NAMES (basename match at any depth) must stay in lockstep with the tar
 // --exclude patterns below: the canonical hash walks exactly the set tar archives.
-const EXCLUDE_NAMES = new Set([".git", "node_modules", ".expo", ".expo-shared", "dist", "build", "web-build", ".DS_Store", MARKER, "backend.json"]);
+// `ios`/`android` are generated by `expo prebuild`/`run:ios` and are HUGE (a single
+// prebuilt ios/ with Pods is >1 GB, ~425 MB gzipped). They used to be missing here
+// while mirror-push's STAGE_SKIP_DIRS already skipped them, so a prototype that had
+// ever been run natively produced a snapshot far over the broker's 15 MB cap — the
+// POST died mid-upload and surfaced as "can't reach the Calo broker", one easily
+// missed line after a successful push. Keep this list in lockstep with
+// STAGE_SKIP_DIRS in mirror-push.js.
+const EXCLUDE_NAMES = new Set([".git", "node_modules", ".expo", ".expo-shared", "dist", "build", "web-build", "ios", "android", ".tamagui", ".vscode", ".idea", ".DS_Store", MARKER, "backend.json"]);
 const EXCLUDES = [...EXCLUDE_NAMES, ".env*"];
 const isExcluded = (name) => EXCLUDE_NAMES.has(name) || name.startsWith(".env");
+// Mirrors MAX_SNAPSHOT_BYTES in the broker (src/checkpoints.js). Checked client-side
+// too: over the cap the server closes the connection mid-body, so the client never
+// sees the 413 that would have explained itself.
+const MAX_SNAPSHOT_BYTES = 15e6;
 
 // Keep byte-identical with the broker's handleOf (src/checkpoints.js) — it's only used
 // here to *predict* fork-vs-continue; the broker's derivation is authoritative.
@@ -128,6 +139,36 @@ function canonicalHash(root) {
   return h.digest("hex");
 }
 
+// The top-level folders carrying the most bytes, for the over-the-limit message —
+// "which folder is this?" is the only question that matters at that moment.
+function biggestEntries(root, take = 3) {
+  const sizeOf = (p) => {
+    let n = 0;
+    const rec = (dir) => {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (isExcluded(e.name) || e.isSymbolicLink()) continue;
+        const child = path.join(dir, e.name);
+        if (e.isDirectory()) rec(child);
+        else if (e.isFile()) n += fs.statSync(child).size;
+      }
+    };
+    try {
+      if (fs.statSync(p).isDirectory()) rec(p);
+      else n = fs.statSync(p).size;
+    } catch {
+      /* vanished mid-walk — it just doesn't count toward the total */
+    }
+    return n;
+  };
+  return fs
+    .readdirSync(root, { withFileTypes: true })
+    .filter((e) => !isExcluded(e.name) && !e.isSymbolicLink())
+    .map((e) => ({ name: e.name, bytes: sizeOf(path.join(root, e.name)) }))
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, take)
+    .map((e) => `${e.name} (${(e.bytes / 1e6).toFixed(1)} MB)`);
+}
+
 // tar the prototype source with the exclusion list; returns { work, tarPath, hash }
 // in a tmpdir the caller must clean up.
 function makeSnapshot(root) {
@@ -164,7 +205,14 @@ async function autoCheckpoint({ root, note, publishedUrl, artifact }) {
   try {
     await saveFlow({ root, note, publishedUrl, artifact, force: true, quiet: true });
   } catch (e) {
-    elog(`${c.y("!")} deploy succeeded, but the source checkpoint didn't: ${e.message}`);
+    // Loud on purpose: the deploy is live but UNRECOVERABLE — no `calo-design open`,
+    // no teammate handoff, no way to get back to the exact source behind it. The old
+    // one-liner scrolled past under the QR code and we only noticed weeks later, when
+    // a crashing prototype had no source to inspect.
+    elog(`\n${c.y("!")} DEPLOY IS LIVE, BUT ITS SOURCE WAS NOT CHECKPOINTED.`);
+    elog(c.dim(`  Nobody can \`calo-design open\` this version or hand it to a teammate.`));
+    elog(`  ${e.message}`);
+    elog(c.dim(`  Fix the cause, then run \`calo-design save\` — the deploy itself is fine.\n`));
   }
 }
 
@@ -198,6 +246,14 @@ async function saveFlow({ root, slugOverride, note = "", force = false, json = f
       return;
     }
     const tgz = zlib.gzipSync(fs.readFileSync(snap.tarPath));
+    if (tgz.length > MAX_SNAPSHOT_BYTES) {
+      throw new Error(
+        `this prototype's source is ${(tgz.length / 1e6).toFixed(0)} MB compressed — over the ${MAX_SNAPSHOT_BYTES / 1e6} MB checkpoint limit.\n` +
+        `  Biggest folders: ${biggestEntries(root).join(", ")}\n` +
+        `  Checkpoints hold SOURCE only. Move bulk images to the CDN with \`calo-design art push\`,\n` +
+        `  or delete generated folders — node_modules, .git, ios, android and dist are already skipped.`
+      );
+    }
 
     let res;
     try {
@@ -357,4 +413,4 @@ async function cmdProjects(args = []) {
   log("");
 }
 
-module.exports = { cmdSave, cmdOpen, cmdProjects, autoCheckpoint, _handleOf: handleOf, _makeSnapshot: makeSnapshot, _canonicalHash: canonicalHash, _EXCLUDES: EXCLUDES };
+module.exports = { cmdSave, _biggestEntries: biggestEntries, _maxSnapshotBytes: MAX_SNAPSHOT_BYTES, cmdOpen, cmdProjects, autoCheckpoint, _handleOf: handleOf, _makeSnapshot: makeSnapshot, _canonicalHash: canonicalHash, _EXCLUDES: EXCLUDES };

package/bin/cli.js

@@ -45,7 +45,16 @@ const PEERS = [
   // prototype (see mirror-push.js mirrorChromeSource). The shell binary provides
   // the native module (from build 8); prototypes ship JS only, and on older
   // binaries the SDK falls back to JS-only transport.
-  "@sentry/react-native"
+  "@sentry/react-native",
+  // Maps, voice notes and file/photo attachments (shell binary ships the native side
+  // from build 12). These were missing here, so a prototype that needed one hit
+  // "unable to resolve" and the natural fix — installing it into ~/.designchef/runtime
+  // by hand — produced a bundle whose native half didn't exist on the phone. That
+  // shipped caly-full: it opened to an expo-router error naming none of them.
+  "react-native-maps",
+  "expo-audio",
+  "expo-image-picker",
+  "expo-document-picker"
 ];
 // Install via explicit HTTPS git URLs. Auth is a short-lived GitHub token the Calo
 // broker mints after `calo-design login` — injected into git for the install

package/bin/login.js

@@ -99,10 +99,14 @@ async function cmdLogin(args = []) {
     // Request a code. (Pass --code to skip the send, e.g. a code you already have.)
     await api("/v1/login/start", { email });
     if (!interactive) {
-      console.log(`Sent a 6-digit code to ${email}. Now run: npx @calo-design/cli login --email=${email} --code=<the 6-digit code>`);
+      console.log(`Sent a 6-digit code to ${email} from ${BROKER} (Calo's own service).`);
+      console.log("The code proves you can read Calo mail; it authorizes this CLI only — it is not a");
+      console.log("GitHub, Google, or SSO login, and it grants nothing beyond read access to Calo's");
+      console.log("private design repos. Ask the person for the code, then run:");
+      console.log(`  npx @calo-design/cli login --email=${email} --code=<the 6-digit code>`);
       return;
     }
-    console.log(`We emailed a 6-digit code to ${email}.`);
+    console.log(`We emailed a 6-digit code to ${email} from ${BROKER} (Calo's own service).`);
     code = await ask("Code: ");
   }
   const r = await api("/v1/login/verify", { email, code });

package/bin/mirror-push.js

@@ -25,6 +25,27 @@ const SHARED_PROJECT_ID = "290a759f-427c-432e-9ab5-dab98310e66b";
 const UPDATES_URL = `https://u.expo.dev/${SHARED_PROJECT_ID}`;
 const RUNTIME_VERSION = "0.2.0"; // must equal the shell binary's runtimeVersion (SDK 57 shell, version 0.2.0)
 const LAUNCHER_CHANNEL = "mirror";
+// Native modules COMPILED INTO the Mirror shell binary (runtimeVersion 0.2.0, iOS
+// build 11+). This — not the shared runtime — is the authority on what a pushed
+// prototype may import: a push ships JS only, so a package whose native side isn't
+// in the binary throws the moment its module scope runs `requireNativeModule`.
+// Metro then SWALLOWS that throw (guardedLoadModule → ErrorUtils.reportFatalError,
+// returning undefined), so expo-router destructures undefined and the phone shows
+// "Cannot read property 'ErrorBoundary' of undefined" — an error that points
+// nowhere near the missing module. That's why this list exists and why the
+// preflight below is an error, not a warning. Keep it in lockstep with
+// calo-design-mirror/package.json whenever a new shell binary ships.
+const SHELL_MODULES = new Set([
+  "@expo/ui", "@gorhom/bottom-sheet", "@microsoft/react-native-clarity", "@sentry/react-native",
+  "expo", "expo-asset", "expo-camera", "expo-clipboard", "expo-constants", "expo-device",
+  "expo-font", "expo-glass-effect", "expo-image", "expo-linking", "expo-router",
+  "expo-splash-screen", "expo-status-bar", "expo-symbols", "expo-system-ui", "expo-updates",
+  "expo-video", "expo-web-browser", "expo-audio", "expo-document-picker", "expo-image-picker",
+  "expo-file-system", "react-native-maps", "phosphor-react-native", "react", "react-dom",
+  "react-native", "react-native-gesture-handler", "react-native-qrcode-svg",
+  "react-native-reanimated", "react-native-safe-area-context", "react-native-screens",
+  "react-native-svg", "react-native-web", "react-native-worklets",
+]);
 // Crash reporting: every pushed prototype gets a Sentry init + error boundary
 // injected (see injectBackChrome). Same project as the shell's own init
 // (calo-design-mirror expo.extra.sentryDsn) — keep the two DSNs in sync. A DSN
@@ -140,8 +161,10 @@ function findScreenshot(root, explicit) {
 
 // ---- staging ----------------------------------------------------------------
 
-// The prototype's deps must be a subset of the shared runtime — the shell binary
-// only contains the runtime's native modules, so anything extra would be missing.
+// The prototype's deps must be a subset of the shared runtime — it's what the staged
+// node_modules symlink points at, so anything extra simply isn't there to bundle.
+// This is about BUILDING the update; whether the phone can RUN it is a separate,
+// stricter question answered by preflightNativeModules (SHELL_MODULES).
 function validateDeps(pkg) {
   const runtimePkgPath = path.join(runtimeDir(), "package.json");
   if (!fs.existsSync(runtimePkgPath)) {
@@ -150,10 +173,27 @@ function validateDeps(pkg) {
   }
   const runtimeDeps = new Set(Object.keys(JSON.parse(fs.readFileSync(runtimePkgPath, "utf8")).dependencies || {}));
   const extras = Object.keys(pkg.dependencies || {}).filter((d) => !d.startsWith("@calo/") && !runtimeDeps.has(d));
-  if (extras.length) {
-    warn(`these deps aren't in the shared runtime, so the Mirror binary can't provide them:\n    ${extras.join(", ")}`);
-    warn("the prototype may crash on load in Mirror. Keep prototypes to the shared-runtime deps, or ask for a runtime bump.");
+  if (!extras.length) return;
+
+  // A dep the runtime lacks normally can't even bundle — but "unable to resolve X" is
+  // reasonably fixed by installing X into ~/.designchef/runtime by hand, and then the
+  // push succeeds and the PHONE has no native side for it. That is how caly-full went
+  // out: expo-audio, expo-image-picker, expo-document-picker and react-native-maps were
+  // all declared here, all absent from the runtime, and the prototype died on open with
+  // an expo-router error naming none of them. So: anything the shell binary can't serve
+  // is a hard stop, not a warning nobody reads.
+  const unusable = extras.filter((d) => !SHELL_MODULES.has(d));
+  if (unusable.length) {
+    throw new Error(
+      `these dependencies aren't in the shared runtime AND aren't in the Mirror shell binary:\n` +
+      `    ${unusable.join(", ")}\n` +
+      `  Even if the bundle builds (e.g. they were installed into the runtime by hand), the phone\n` +
+      `  has no native code for them: the import throws on open and the prototype shows an\n` +
+      `  unrelated expo-router error. Drop them, or ask for a runtime + shell bump that carries them.`
+    );
   }
+  warn(`these deps aren't in the shared runtime, so the bundle can only build if they're installed there:\n    ${extras.join(", ")}`);
+  warn("the Mirror binary does carry their native side — but keep prototypes to the shared-runtime deps where you can.");
 }
 
 function writeJSON(p, obj) {
@@ -288,6 +328,71 @@ function preflightAssetCount(stage) {
   }
 }
 
+// ---- native-module preflight ------------------------------------------------
+// A push ships JS; native code only ever arrives with a new shell BINARY. The
+// shared runtime is deliberately wider than the binary at times (a package can
+// land in the runtime before the next TestFlight build), and importing one of
+// those crashes the prototype at startup with an error that names expo-router,
+// not the module — see SHELL_MODULES. Catch it here, where the fix is obvious.
+//
+// "Native" is derived from the runtime itself rather than hard-coded: a package
+// is native when it carries an Expo module config or a podspec.
+const SOURCE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+// Package name from a specifier: "expo-image/build/x" → "expo-image", "@expo/ui/swift-ui" → "@expo/ui".
+const packageOf = (spec) => {
+  if (spec.startsWith(".") || spec.startsWith("/")) return null;
+  const parts = spec.split("/");
+  return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+};
+
+function isNativePackage(name) {
+  const dir = path.join(runtimeDir(), "node_modules", name);
+  if (fs.existsSync(path.join(dir, "expo-module.config.json"))) return true;
+  try {
+    return fs.readdirSync(dir).some((f) => f.endsWith(".podspec"));
+  } catch {
+    return false; // not in the runtime — validateDeps owns that case
+  }
+}
+
+function stagedImports(stage) {
+  const found = new Set();
+  const re = /(?:\bfrom\s*|\bimport\s*\(?\s*|\brequire\s*\(\s*)(["'])([^"']+)\1/g;
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (e.name === "node_modules" || e.name.startsWith(".")) continue;
+      const p = path.join(dir, e.name);
+      if (e.isSymbolicLink()) continue; // never follow into the runtime symlink
+      if (e.isDirectory()) walk(p);
+      else if (SOURCE_EXTS.has(path.extname(e.name))) {
+        const src = fs.readFileSync(p, "utf8");
+        for (const m of src.matchAll(re)) {
+          const pkg = packageOf(m[2]);
+          if (pkg) found.add(pkg);
+        }
+      }
+    }
+  };
+  walk(stage);
+  return found;
+}
+
+function preflightNativeModules(stage) {
+  const missing = [...stagedImports(stage)]
+    .filter((pkg) => !SHELL_MODULES.has(pkg) && isNativePackage(pkg))
+    .sort();
+  if (!missing.length) return;
+  throw new Error(
+    `this prototype imports native modules the Mirror shell binary doesn't contain:\n` +
+    `    ${missing.join(", ")}\n` +
+    `  A push ships JavaScript only — native code arrives with a new Mirror build, so on the phone\n` +
+    `  these throw at startup and the prototype dies with a misleading expo-router error\n` +
+    `  ("Cannot read property 'ErrorBoundary' of undefined").\n` +
+    `  Swap them for something in the shared runtime the shell provides, or ask for a shell build\n` +
+    `  that includes them (calo-design-mirror → TestFlight, then update SHELL_MODULES here).`
+  );
+}
+
 function writeMetroConfig(stage) {
   const runtimeReal = fs.realpathSync(runtimeDir());
   fs.writeFileSync(
@@ -883,6 +988,7 @@ async function cmdPush(args) {
   try {
     stageProject({ root, stage, slug, title, ad, owner });
     preflightAssetCount(stage);
+    preflightNativeModules(stage);
 
     if (dry) {
       keepStage = true;
@@ -1007,4 +1113,4 @@ async function cmdPush(args) {
   }
 }
 
-module.exports = { cmdPush, _s3Put: s3Put, _upsertRegistry: upsertRegistry, _publicBase: PUBLIC_BASE, _extractEasGroup: extractEasGroup, _versionBranchOf: versionBranchOf };
+module.exports = { cmdPush, _validateDeps: validateDeps, _stageSkipDirs: STAGE_SKIP_DIRS, _s3Put: s3Put, _upsertRegistry: upsertRegistry, _publicBase: PUBLIC_BASE, _extractEasGroup: extractEasGroup, _versionBranchOf: versionBranchOf, _stagedImports: stagedImports, _preflightNativeModules: preflightNativeModules, _shellModules: SHELL_MODULES };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calo-design/cli",
-  "version": "0.13.7",
+  "version": "0.15.0",
   "description": "One-line setup for Calo design tooling: logs in with your Calo email and installs the calo-design skill + design-system packages. No GitHub account needed.",
   "bin": {
     "calo-design": "bin/cli.js"