@clearlysh/beehaven 0.8.16

package/dist/commands/secrets.js

@@ -0,0 +1,323 @@
+/**
+ * beehaven secrets — Cloudflare Workers secrets wrapper
+ *
+ * Defaults to setting on EVERY declared env (the parity-enforcement the root
+ * CLAUDE.md explicitly calls out as a recurring bug source). Detects envs from
+ * `[env.<name>]` blocks in wrangler.toml/wrangler.jsonc.
+ *
+ * Subcommands:
+ *   list [--env <name>|all]              List secret names per env
+ *   set <NAME> [--env <name>|all]        Set on all envs by default (parity)
+ *   delete <NAME> [--env <name>|all]     Delete on all envs by default
+ *   diff                                 Show secrets present on one env but not the other
+ *   check                                Verify required secrets (from beehaven.json) are set everywhere
+ */
+import { existsSync, readFileSync } from 'fs';
+import { dirname, join, resolve } from 'path';
+import { spawn } from 'child_process';
+import { createInterface } from 'readline';
+import { color, spinner, table } from '../spinner.js';
+function findWranglerConfig(start = process.cwd()) {
+    let dir = resolve(start);
+    while (true) {
+        for (const name of ['wrangler.toml', 'wrangler.jsonc', 'wrangler.json']) {
+            const p = join(dir, name);
+            if (existsSync(p))
+                return { path: p, envs: parseEnvs(p) };
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+function parseEnvs(configPath) {
+    const text = readFileSync(configPath, 'utf-8');
+    if (configPath.endsWith('.toml')) {
+        const envs = new Set();
+        const re = /^\[env\.([a-zA-Z0-9_-]+)/gm;
+        let m;
+        while ((m = re.exec(text)) !== null)
+            envs.add(m[1]);
+        return Array.from(envs);
+    }
+    const stripped = text.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+    const cfg = JSON.parse(stripped);
+    return Object.keys(cfg.env ?? {});
+}
+function readRequiredSecrets(cwd) {
+    const candidates = [join(cwd, 'beehaven.json'), join(dirname(cwd), 'beehaven.json')];
+    for (const p of candidates) {
+        if (!existsSync(p))
+            continue;
+        try {
+            const cfg = JSON.parse(readFileSync(p, 'utf-8'));
+            if (Array.isArray(cfg.requiredSecrets))
+                return cfg.requiredSecrets;
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    return [];
+}
+function runWranglerCapture(args, cwd) {
+    return new Promise((resolveP) => {
+        const proc = spawn('npx', ['wrangler', ...args], {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: { ...process.env },
+        });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (d) => (stdout += d.toString()));
+        proc.stderr.on('data', (d) => (stderr += d.toString()));
+        proc.on('close', (code) => resolveP({ stdout, stderr, code: code ?? 1 }));
+        proc.on('error', () => resolveP({ stdout, stderr, code: 1 }));
+    });
+}
+function runWranglerWithStdin(args, cwd, stdinValue) {
+    return new Promise((resolveP) => {
+        const proc = spawn('npx', ['wrangler', ...args], {
+            cwd,
+            stdio: ['pipe', 'inherit', 'pipe'],
+            env: { ...process.env },
+        });
+        let stderr = '';
+        proc.stderr?.on('data', (d) => (stderr += d.toString()));
+        proc.stdin.write(stdinValue);
+        proc.stdin.end();
+        proc.on('close', (code) => resolveP({ code: code ?? 1, stderr }));
+        proc.on('error', () => resolveP({ code: 1, stderr }));
+    });
+}
+function extractJson(stdout) {
+    const idx = stdout.indexOf('[');
+    if (idx === -1) {
+        const objIdx = stdout.indexOf('{');
+        if (objIdx === -1)
+            return null;
+        try {
+            return JSON.parse(stdout.slice(objIdx));
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        return JSON.parse(stdout.slice(idx));
+    }
+    catch {
+        return null;
+    }
+}
+async function listSecrets(cwd, env) {
+    const args = ['secret', 'list'];
+    if (env)
+        args.push('--env', env);
+    const { stdout, code } = await runWranglerCapture(args, cwd);
+    if (code !== 0)
+        return [];
+    const parsed = extractJson(stdout);
+    if (!Array.isArray(parsed))
+        return [];
+    return parsed
+        .map((s) => s.name)
+        .filter(Boolean)
+        .sort();
+}
+function targetEnvs(cfg, requested) {
+    // null = the unnamed default env (top-level wrangler.toml)
+    if (requested && requested !== 'all')
+        return [requested];
+    if (cfg.envs.length === 0)
+        return [null];
+    return [null, ...cfg.envs];
+}
+function envLabel(env) {
+    return env ?? 'prod';
+}
+function promptHidden(prompt) {
+    return new Promise((resolveP) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+        process.stdout.write(prompt);
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw;
+        if (stdin.setRawMode)
+            stdin.setRawMode(true);
+        let value = '';
+        const onData = (buf) => {
+            const ch = buf.toString();
+            if (ch === '\n' || ch === '\r' || ch === '') {
+                if (stdin.setRawMode)
+                    stdin.setRawMode(!!wasRaw);
+                stdin.removeListener('data', onData);
+                process.stdout.write('\n');
+                rl.close();
+                resolveP(value);
+                return;
+            }
+            if (ch === '') {
+                process.exit(130);
+            }
+            if (ch === '\b' || ch === '\x7f') {
+                value = value.slice(0, -1);
+                return;
+            }
+            value += ch;
+        };
+        stdin.on('data', onData);
+    });
+}
+export async function secrets(opts) {
+    const cfg = findWranglerConfig();
+    if (!cfg) {
+        console.error(color.red('No wrangler.toml/wrangler.jsonc found in cwd or any parent.'));
+        process.exit(1);
+    }
+    const cwd = dirname(cfg.path);
+    const sub = opts.subcommand ?? 'list';
+    switch (sub) {
+        case 'list': {
+            const envs = targetEnvs(cfg, opts.env);
+            const byEnv = {};
+            for (const env of envs) {
+                const s = spinner(`Listing secrets on ${envLabel(env)}…`).start();
+                const names = await listSecrets(cwd, env);
+                s.succeed(`${envLabel(env)}: ${names.length} secrets`);
+                byEnv[envLabel(env)] = names;
+            }
+            if (opts.json) {
+                console.log(JSON.stringify(byEnv, null, 2));
+                return;
+            }
+            console.log('');
+            const allNames = Array.from(new Set(Object.values(byEnv).flat())).sort();
+            const envNames = Object.keys(byEnv);
+            const rows = allNames.map((name) => [
+                color.cyan(name),
+                ...envNames.map((e) => (byEnv[e].includes(name) ? color.green('✓') : color.dim('—'))),
+            ]);
+            console.log(table(['Secret', ...envNames], rows));
+            return;
+        }
+        case 'set': {
+            const name = opts.positionals[0];
+            if (!name) {
+                console.error('Usage: beehaven secrets set <NAME> [--env <name>|all] [--yes]');
+                process.exit(1);
+            }
+            const envs = targetEnvs(cfg, opts.env);
+            const value = await promptHidden(`Value for ${name}: `);
+            if (!value) {
+                console.error('Empty value — aborting.');
+                process.exit(1);
+            }
+            for (const env of envs) {
+                const args = ['secret', 'put', name];
+                if (env)
+                    args.push('--env', env);
+                const s = spinner(`Setting ${name} on ${envLabel(env)}…`).start();
+                const { code, stderr } = await runWranglerWithStdin(args, cwd, value);
+                if (code !== 0) {
+                    s.fail(`Failed on ${envLabel(env)} (exit ${code})`);
+                    if (stderr)
+                        console.error(color.dim(stderr));
+                }
+                else {
+                    s.succeed(`${name} → ${envLabel(env)}`);
+                }
+            }
+            return;
+        }
+        case 'delete':
+        case 'rm': {
+            const name = opts.positionals[0];
+            if (!name) {
+                console.error('Usage: beehaven secrets delete <NAME> [--env <name>|all] [--yes]');
+                process.exit(1);
+            }
+            const envs = targetEnvs(cfg, opts.env);
+            if (!opts.yes) {
+                console.error(color.yellow(`About to delete ${name} from: ${envs.map(envLabel).join(', ')}`));
+                console.error(color.dim('Re-run with --yes to confirm.'));
+                process.exit(1);
+            }
+            for (const env of envs) {
+                const args = ['secret', 'delete', name];
+                if (env)
+                    args.push('--env', env);
+                const s = spinner(`Deleting ${name} on ${envLabel(env)}…`).start();
+                const { code } = await runWranglerCapture([...args, '--force'], cwd);
+                if (code !== 0)
+                    s.fail(`Failed on ${envLabel(env)}`);
+                else
+                    s.succeed(`${name} ✕ ${envLabel(env)}`);
+            }
+            return;
+        }
+        case 'diff': {
+            if (cfg.envs.length === 0) {
+                console.log(color.dim('Only one env declared in wrangler.toml — nothing to diff.'));
+                return;
+            }
+            const envs = targetEnvs(cfg, 'all');
+            const byEnv = {};
+            for (const env of envs) {
+                const s = spinner(`Listing ${envLabel(env)}…`).start();
+                byEnv[envLabel(env)] = new Set(await listSecrets(cwd, env));
+                s.succeed(envLabel(env));
+            }
+            const envNames = Object.keys(byEnv);
+            const allNames = Array.from(new Set(envNames.flatMap((e) => Array.from(byEnv[e])))).sort();
+            const missing = allNames.filter((n) => envNames.some((e) => !byEnv[e].has(n)));
+            console.log('');
+            if (missing.length === 0) {
+                console.log(color.green('✓ All secrets present on every env.'));
+                return;
+            }
+            console.log(color.yellow(`${missing.length} secrets out of parity:`));
+            const rows = missing.map((name) => [
+                color.cyan(name),
+                ...envNames.map((e) => (byEnv[e].has(name) ? color.green('✓') : color.red('✗'))),
+            ]);
+            console.log(table(['Secret', ...envNames], rows));
+            console.log('');
+            console.log(color.dim('Fix with:  beehaven secrets set <NAME>  (defaults to all envs)'));
+            process.exit(1);
+        }
+        case 'check': {
+            const required = readRequiredSecrets(cwd);
+            if (required.length === 0) {
+                console.log(color.yellow('No requiredSecrets declared in beehaven.json.'));
+                console.log(color.dim('Add e.g.:  { "requiredSecrets": ["GCP_SERVICE_ACCOUNT_JSON", "..."] }'));
+                return;
+            }
+            const envs = targetEnvs(cfg, opts.env);
+            const byEnv = {};
+            for (const env of envs) {
+                byEnv[envLabel(env)] = new Set(await listSecrets(cwd, env));
+            }
+            const envNames = Object.keys(byEnv);
+            const rows = required.map((name) => [
+                color.cyan(name),
+                ...envNames.map((e) => (byEnv[e].has(name) ? color.green('✓') : color.red('MISSING'))),
+            ]);
+            console.log('');
+            console.log(table(['Required Secret', ...envNames], rows));
+            const missing = required.filter((n) => envNames.some((e) => !byEnv[e].has(n)));
+            if (missing.length > 0) {
+                console.log('');
+                console.log(color.red(`✗ ${missing.length} required secrets missing on at least one env.`));
+                process.exit(1);
+            }
+            console.log('');
+            console.log(color.green('✓ All required secrets set on every env.'));
+            return;
+        }
+        default:
+            console.error(`Unknown secrets subcommand: ${sub}`);
+            console.error('Use: list | set | delete | diff | check');
+            process.exit(1);
+    }
+}

package/dist/commands/self-update.js

@@ -0,0 +1,206 @@
+/**
+ * self-update — where this `beehaven` came from, and how (or whether) it updates.
+ *
+ * ## ⚠⚠ THE OLD NOTIFIER GAVE ADVICE THAT BREAKS THE MAC APP'S USERS
+ *
+ * `checkForUpdates` printed, unconditionally:
+ *
+ *     Update available: 0.7.6 → 0.7.8
+ *     Run curl -fsSL https://clearly.sh/install.sh | sh to update
+ *
+ * For anyone whose `beehaven` comes from the Mac app — which is EVERY ordinary user, since the
+ * app bundles the CLI and installs the wrapper — following that instruction used to be actively
+ * harmful. The wrapper resolved `$BEEHAVEN_CLI` → `~/.beehaven/cli/dist/cli.js` → the bundled
+ * copy, in that fixed order, so a curl install created a SECOND CLI that permanently shadowed the
+ * app's.
+ *
+ * ⚠⚠ AND IT WAS PERMANENT IN BOTH DIRECTIONS, WHICH IS WORSE THAN THIS PARAGRAPH ORIGINALLY SAID.
+ * The shadowed user copy had no updater either: the app spawns its daemon with
+ * `BEEHAVEN_MANAGED_BY`, so `checkAndAutoUpdate` (daemon.ts) SKIPS — correctly, since the app owns
+ * the bundle's version. So on a machine with both, the app auto-updated a bundle nothing could
+ * reach while `~/.beehaven/cli` froze at whatever was curl-installed, and the terminal was served
+ * by neither channel.
+ *
+ * ✅ FIXED 2026-09-09 IN THE WRAPPER, NOT HERE: `buildWrapperContent` now execs whichever copy
+ * reports the higher version, so an app update and a `beehaven update` both reach the shell. The
+ * hint below is still per-install, because "how do I update this" still has three answers.
+ *
+ * ⚠ IT WAS ALSO THE REASON A DEVELOPER NEVER SAW THE BUNDLED CLI GO STALE — their curl install
+ * won unconditionally, so they were testing a different binary from the one users get. Under the
+ * version comparison they still win whenever their build is newer, which is the normal case.
+ *
+ * ## The three installs, and what "update" means for each
+ *
+ *   bundled  — inside `Clearly*.app/Contents/Resources/beehaven/`. The APP owns it and the app
+ *              auto-updates (electron-updater), so this CLI already updates; it just does not
+ *              update ITSELF. Telling this user to curl is the bug above.
+ *   user     — `~/.beehaven/cli/`, from install.sh. A CLI-owned standalone daemon checks hourly;
+ *              without that daemon, `beehaven update` performs the update on demand.
+ *   dev-bundled — Clearly Dev.app has no release updater; rebuild and reinstall it.
+ *   linked   — a dev checkout via `npm link`. Never touch it; the developer's build IS the point.
+ */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { usableUpdateDigest } from '../version-utils.js';
+/**
+ * Which install this process is.
+ *
+ * ⚠ DECIDED FROM THIS RUNNING MODULE'S RESOLVED PATH, not the binary symlink or from what
+ * happens to exist on disk. npm global binaries are often symlinks outside node_modules;
+ * process.argv[1] would misclassify them as linked development builds. Both a bundled
+ * CLI and a user install can be present at once — that is exactly the shadowing case above — so
+ * "does `~/.beehaven/cli` exist" answers the wrong question. `process.argv[1]` is the module that
+ * was actually loaded.
+ */
+export function installKind(entry = fileURLToPath(import.meta.url)) {
+    if (/(?:Clearly|Hive) Dev\.app[\\/]Contents[\\/]Resources[\\/]/.test(entry))
+        return 'dev-bundled';
+    if (entry.includes(`.app${sep}Contents${sep}Resources${sep}`))
+        return 'bundled';
+    const prefixes = [join(homedir(), '.beehaven'), process.env.BEEHAVEN_PREFIX].filter((p) => Boolean(p));
+    if (prefixes.some((prefix) => entry.startsWith(join(prefix, 'cli') + sep)))
+        return 'user';
+    if (entry.includes(`${sep}_npx${sep}`) && entry.includes(`${sep}node_modules${sep}`))
+        return 'npx';
+    if (entry.includes(`${sep}node_modules${sep}`))
+        return 'npm';
+    return 'linked';
+}
+/** The one-line instruction to print when a newer version exists. Per install, because the right
+ *  answer genuinely differs and a single string is what caused the defect above. */
+export function updateHint(kind = installKind()) {
+    if (kind === 'dev-bundled')
+        return 'This is a development app build — rebuild and reinstall Clearly Dev.app from the repo.';
+    if (kind === 'bundled') {
+        /* ⚠ NOT "run the installer". The app updates this copy; a curl install would shadow it. */
+        return 'The Clearly app ships this CLI and updates it — open the app, or Tray → Check for updates.';
+    }
+    if (kind === 'user')
+        return 'Run \x1b[1mbeehaven update\x1b[0m';
+    if (kind === 'npx')
+        return 'Run `npx @clearlysh/beehaven@latest` for the current npm release.';
+    if (kind === 'npm')
+        return 'Run `npm install -g @clearlysh/beehaven@latest` to update this npm install.';
+    return 'This is a linked dev build — `npm run build` in beehaven_sdk/packages/cli.';
+}
+/**
+ * Perform the update, for a user install only.
+ *
+ * ⚠⚠ IT RE-RUNS THE PUBLISHED INSTALLER RATHER THAN REIMPLEMENTING IT. `install.sh` already
+ * stages into a temp dir, runs `npm install` to resolve the NATIVE dependencies (better-sqlite3,
+ * node-pty — per-platform, per-ABI prebuilds), and only then swaps the directory into place. A
+ * hand-rolled updater here would have to reproduce all of that, and would be the copy that rots.
+ *
+ * ⚠ REPLACING A RUNNING PROGRAM IS SAFE HERE ONLY BECAUSE OF THAT STAGING. The swap is a
+ * directory rename after the download and build have both succeeded; this process is already
+ * resident in memory and exits normally. An in-place overwrite would not be safe.
+ *
+ * ⚠ IT REFUSES THE OTHER TWO KINDS RATHER THAN DOING SOMETHING PLAUSIBLE. A bundled install that
+ * "updated" itself would create the shadowing copy this whole module exists to prevent, and a
+ * linked one would overwrite a developer's working tree.
+ */
+export function runSelfUpdate(kind = installKind()) {
+    if (kind === 'dev-bundled') {
+        return { ok: false, message: 'This CLI is bundled with Clearly Dev.app. Rebuild and reinstall the development app from the repo.' };
+    }
+    if (kind === 'bundled') {
+        return { ok: false, message: 'This CLI is part of the Clearly app and updates with it.\n  Open the app, or use Tray → Check for updates.' };
+    }
+    if (kind === 'linked') {
+        return { ok: false, message: 'This is a linked development build — refusing to overwrite it.\n  cd beehaven_sdk/packages/cli && npm run build' };
+    }
+    if (kind === 'npm' || kind === 'npx') {
+        return { ok: false, message: updateHint(kind) };
+    }
+    const feed = (process.env.BEEHAVEN_CLI_FEED || 'https://downloads.clearly.sh/cli/').replace(/\/+$/, '');
+    const installerUrl = process.env.BEEHAVEN_INSTALL_URL || 'https://clearly.sh/install.sh';
+    const temp = mkdtempSync(join(tmpdir(), 'beehaven-self-update-'));
+    try {
+        const manifestPath = join(temp, 'latest.json');
+        execFileSync('curl', ['-fsSL', '--max-time', '30', '-o', manifestPath, `${feed}/latest.json`]);
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const version = manifest.version;
+        const digest = usableUpdateDigest(manifest);
+        if (typeof version !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version) || !digest) {
+            return { ok: false, message: 'Update failed: the release manifest has no valid version and sha256.' };
+        }
+        const tarball = join(temp, 'beehaven.tgz');
+        execFileSync('curl', ['-fsSL', '--max-time', '120', '-o', tarball, `${feed}/beehaven-${version}.tgz`]);
+        const actual = createHash('sha256').update(readFileSync(tarball)).digest('hex');
+        if (actual !== digest)
+            return { ok: false, message: 'Update failed: release sha256 mismatch.' };
+        // Download the installer as a file. A `curl | sh` pipeline reports sh's success even when
+        // curl fails, so it can say "Updated" without ever running an installer.
+        const installer = join(temp, 'install.sh');
+        execFileSync('curl', ['-fsSL', '--max-time', '30', '-o', installer, installerUrl]);
+        execFileSync('/bin/sh', [installer], {
+            stdio: 'inherit',
+            timeout: 10 * 60_000,
+            env: { ...process.env, BEEHAVEN_TARBALL: `file://${tarball}` },
+        });
+        const installed = JSON.parse(readFileSync(join(process.env.BEEHAVEN_PREFIX || join(homedir(), '.beehaven'), 'cli', 'package.json'), 'utf8'));
+        if (installed.version !== version)
+            return { ok: false, message: `Update failed: installed ${installed.version ?? 'unknown'}, expected ${version}.` };
+        return { ok: true, message: `Updated to ${version}.` };
+    }
+    catch (e) {
+        return { ok: false, message: `Update failed: ${String(e?.message ?? e).slice(0, 200)}` };
+    }
+    finally {
+        rmSync(temp, { recursive: true, force: true });
+    }
+}
+/** True when this install can update itself at all — what the notifier uses to pick its wording. */
+export function canSelfUpdate(kind = installKind()) {
+    return kind === 'user';
+}
+/**
+ * Is a bundled CLI present that the shell can NEVER reach, whatever its version?
+ *
+ * ⚠⚠ THIS REPLACES `bundledCliShadowed`, WHICH BECAME WRONG ADVICE (2026-09-09). That function
+ * answered "is a bundle present alongside a user install", and the `update` command turned a
+ * `true` into *"this install shadows it — remove ~/.beehaven/cli to go back to the app-managed
+ * copy."* Since the app's wrapper started resolving by VERSION rather than by fixed order
+ * (`cli-installer.ts:buildWrapperContent`), that is advice to go BACKWARDS: it fired immediately
+ * after `beehaven update`, at the exact moment the freshly-installed copy is the newer one and
+ * SHOULD win, and told the user to delete it.
+ *
+ * ⚠ RENAMED RATHER THAN RE-POINTED, because the question it answers is genuinely different. A
+ * name that still says "shadowed" over a body that means "unreachable" is how the next reader
+ * restores the old warning.
+ *
+ * The one configuration that is still a real problem: a wrapper on PATH that the app does NOT
+ * own. `install.sh` writes an unmarked shim (`exec node <user cli>`) with no chain in it at all,
+ * and `cli-installer` correctly refuses to take a path it did not write — so on that machine the
+ * bundle is unreachable REGARDLESS of which copy is newer, and an app update can never arrive.
+ * That is worth saying; "both are installed" is not.
+ *
+ * ⚠ THE MAGIC HEADER IS THE TEST, not the file's existence. It is the app's own claim of
+ * ownership and the only thing that distinguishes a wrapper that compares versions from one that
+ * hardcodes a single path. Kept in step with `WRAPPER_MAGIC` in `cli-installer.ts`.
+ */
+export function bundledCliUnreachable(kind = installKind()) {
+    if (kind !== 'user')
+        return false;
+    const bundlePresent = ['/Applications/Clearly.app', '/Applications/Clearly Dev.app', '/Applications/Clearly STG.app']
+        .some((a) => existsSync(join(a, 'Contents', 'Resources', 'beehaven', 'cli.js')));
+    if (!bundlePresent)
+        return false;
+    /* No wrapper at all ⇒ the app has not installed one yet; its next launch will, and that one
+       compares versions. Nothing to warn about. */
+    const wrapper = join(homedir(), '.local', 'bin', 'beehaven');
+    if (!existsSync(wrapper))
+        return false;
+    try {
+        return !readFileSync(wrapper, 'utf8').includes('managed-by: clearly-mac-app');
+    }
+    catch {
+        /* Unreadable ⇒ we cannot prove there is a problem, and a false alarm here tells someone to
+           delete a working install. Say nothing. */
+        return false;
+    }
+}