@coderook/cli 0.1.0 → 0.2.0

package/dist/cli/src/cli.js

@@ -24,7 +24,19 @@ const download_js_1 = require("../../desktop-app/src/main/download.js");
 const cbx_js_1 = require("../../desktop-app/src/main/cbx.js");
 const api_js_1 = require("./api.js");
 const config_js_1 = require("./config.js");
-const VERSION = "0.1.0";
+/*
+  Read from the package rather than written twice. A hardcoded copy had
+  already drifted from the published version, which makes `coderook doctor`
+  worse than useless when working out what somebody is actually running.
+*/
+const VERSION = (() => {
+    try {
+        return (require("../../../package.json").version ?? "0.0.0");
+    }
+    catch {
+        return "0.0.0";
+    }
+})();
 // ── presentation ────────────────────────────────────────────────────────────
 const colour = node_process_1.default.stdout.isTTY && !node_process_1.default.env.NO_COLOR;
 const dim = (text) => (colour ? `${text}` : text);
@@ -94,6 +106,18 @@ const folderFor = (parsed, index = 0) => node_path_1.default.resolve(parsed.posi
  * what that repository already holds. The account is the authority, exactly
  * as it is in the desktop application.
  */
+/**
+ * Work out what this folder is based on, and whether the account has moved.
+ *
+ * The base is the version this folder was last brought level with — not
+ * whatever happens to be newest. Silently re-basing on the newest is what
+ * makes a folder look up to date when somebody else has published: the
+ * changes are then measured against their work, and saving quietly lays
+ * this machine's copy over theirs.
+ *
+ * So a folder that has fallen behind keeps its own base and is told, which
+ * is what lets the service merge the two rather than pick a winner.
+ */
 async function reconcile(folder, options = {}) {
     const link = await (0, config_js_1.readLink)(folder);
     const reference = link?.slug ?? node_path_1.default.basename(folder);
@@ -102,12 +126,31 @@ async function reconcile(folder, options = {}) {
         : await (0, api_js_1.findProject)(reference);
     if (!project?.versionCount) {
         // Nothing saved on the account, so everything here is outstanding.
-        return { link: link ?? null, baseline: null };
+        return { link: link ?? null, baseline: null, behind: null };
     }
     const downloader = new download_js_1.Downloader(config_js_1.credentials);
     const latest = (await downloader.versions(project.id))[0];
     if (!latest)
-        return { link: link ?? null, baseline: null };
+        return { link: link ?? null, baseline: null, behind: null };
+    /*
+      A folder that already knows which version it stands on keeps it. Only a
+      folder that has never been reconciled — or was linked before versions
+      were recorded — adopts the newest as its starting point.
+    */
+    const known = link?.versionId && link.manifest ? link : null;
+    const behind = known && known.versionId !== latest.id
+        ? { sequence: latest.sequence, id: latest.id }
+        : null;
+    if (known) {
+        if (behind && !options.quiet) {
+            console.log(dim(`The account is on v${behind.sequence}; this folder is based on v${known.sequence}.`));
+        }
+        return {
+            link: known,
+            baseline: new Map(Object.entries(known.manifest)),
+            behind,
+        };
+    }
     const baseline = new Map();
     for (const file of await downloader.files(project.id, latest.id)) {
         baseline.set(file.path, file.sha256);
@@ -116,13 +159,14 @@ async function reconcile(folder, options = {}) {
         repositoryId: project.id,
         slug: project.slug,
         sequence: latest.sequence,
+        versionId: latest.id,
         manifest: Object.fromEntries(baseline),
     };
     await (0, config_js_1.writeLink)(folder, fresh);
     if (!options.quiet && !link) {
         console.log(dim(`Linked this folder to ${project.slug}.`));
     }
-    return { link: fresh, baseline };
+    return { link: fresh, baseline, behind: null };
 }
 // ── commands ────────────────────────────────────────────────────────────────
 async function commandSignIn(parsed) {
@@ -206,6 +250,31 @@ async function commandSubmit(parsed) {
         console.log("Nothing to submit; this folder matches the saved version.");
         return 0;
     }
+    /*
+      The policy is that credentials are never quietly dropped and never
+      quietly sent — they are asked about. The desktop application has always
+      put this question in front of the first upload; the command line was
+      sending them without a word, which is the worse half of the two
+      behaviours the policy exists to prevent.
+    */
+    const secrets = await (0, worktree_js_1.detectSecrets)(folder);
+    const sending = new Set(files.map((file) => file.path));
+    const exposed = secrets.filter((secret) => sending.has(secret));
+    if (exposed.length) {
+        console.log(red(`\n${exposed.length} file${exposed.length === 1 ? " looks like a credential" : "s look like credentials"}:`));
+        for (const secret of exposed.slice(0, 20))
+            console.log(`  ${secret}`);
+        if (exposed.length > 20) {
+            console.log(dim(`  …and ${exposed.length - 20} more`));
+        }
+        if (!hasFlag(parsed, "allow-secrets")) {
+            console.error(`\nNothing was sent. Add them to ${accent(".gitignore")} to leave them` +
+                ` behind, or pass ${accent("--allow-secrets")} if they genuinely belong` +
+                ` in the project.`);
+            return 1;
+        }
+        console.log(dim("Sending them anyway, because --allow-secrets was given."));
+    }
     if (hasFlag(parsed, "dry-run", "n")) {
         console.log(`${files.length} file${files.length === 1 ? "" : "s"} would be sent:`);
         for (const file of files)
@@ -214,21 +283,49 @@ async function commandSubmit(parsed) {
     }
     const line = progressLine();
     const uploader = new upload_js_1.Uploader(config_js_1.credentials);
-    const result = await uploader.run({
-        localPath: folder,
-        include: files.map((file) => file.path),
-        message,
-        projectName: link?.slug ?? node_path_1.default.basename(folder),
-        repositoryId: link?.repositoryId ?? null,
-    }, (progress) => {
-        line(`  ${String(progress.percent).padStart(3)}%  ${progress.stage.padEnd(7)} ` +
-            `${progress.files}/${progress.totalFiles}  ${progress.path.slice(-48)}`);
-    });
+    let result;
+    try {
+        result = await uploader.run({
+            localPath: folder,
+            include: files.map((file) => file.path),
+            message,
+            projectName: link?.slug ?? node_path_1.default.basename(folder),
+            repositoryId: link?.repositoryId ?? null,
+            /*
+              Only claimed when this folder has actually been reconciled with a
+              known version. A folder linked before versions were recorded says
+              nothing rather than guessing, and publishes as it always did.
+            */
+            ...(link?.versionId ? { expectedHeadVersionId: link.versionId } : {}),
+        }, (progress) => {
+            line(`  ${String(progress.percent).padStart(3)}%  ${progress.stage.padEnd(7)} ` +
+                `${progress.files}/${progress.totalFiles}  ${progress.path.slice(-48)}`);
+        });
+    }
+    catch (error) {
+        done(line);
+        const code = error.code;
+        if (code === "merge_required" || code === "track_moved") {
+            /*
+              Somebody else saved to this project first. Everything that did not
+              overlap has already been combined by the service; what is left is a
+              genuine decision, so the answer is to bring their work down and look
+              at it rather than to try again harder.
+            */
+            console.error(red(error instanceof Error ? error.message : String(error)));
+            console.error(`\nRun ${accent("coderook get")} to bring the latest version down, then` +
+                ` submit again. Nothing was changed on your account.`);
+            return 1;
+        }
+        throw error;
+    }
     done(line);
     await (0, config_js_1.writeLink)(folder, {
         repositoryId: result.repositoryId,
         slug: link?.slug ?? node_path_1.default.basename(folder),
         sequence: result.sequence,
+        // What this folder is now working from, so the next submit can say so.
+        versionId: result.versionId,
         manifest: result.manifest,
     });
     console.log(`Saved ${accent(`v${result.sequence}`)} · sent ${bytes(result.sentBytes)} in ` +
@@ -277,10 +374,12 @@ async function fetchInto(repositoryId, destination, slug) {
             `  ${progress.path.slice(-48)}`);
     });
     done(line);
+    // Fetching is how a folder catches up, so this is what moves its base.
     await (0, config_js_1.writeLink)(destination, {
         repositoryId,
         slug,
         sequence: latest.sequence,
+        versionId: latest.id,
         manifest: result.manifest,
     });
     console.log(`${accent(`v${latest.sequence}`)} · ${result.files} files · ${bytes(result.bytes)} into ${destination}`);
@@ -402,6 +501,7 @@ ${bold("Other")}
 ${bold("Options")}
   -m, --message   The version message for submit
   -n, --dry-run   Show what submit would send, without sending
+      --allow-secrets  Send files that look like credentials anyway
       --token     Supply the token to sign-in instead of being asked
 
 ${dim("The environment variable CODEROOK_TOKEN is used when set, so automated")}

package/dist/desktop-app/src/main/upload.js

@@ -95,7 +95,16 @@ class Uploader {
         const body = text ? JSON.parse(text) : {};
         if (!response.ok) {
             const message = body?.error?.message ?? `${route} failed (${response.status})`;
-            throw new Error(message);
+            /*
+              The service says what kind of failure this is, and callers need that
+              to say anything useful — "someone else saved first" deserves a
+              different suggestion from "the disk is full". Carrying the code on
+              the error keeps them from having to match on wording.
+            */
+            throw Object.assign(new Error(message), {
+                code: typeof body?.error?.code === "string" ? body.error.code : "",
+                status: response.status,
+            });
         }
         return body;
     }
@@ -288,6 +297,9 @@ class Uploader {
             contentType: "application/json",
             body: JSON.stringify({
                 message: request.message.trim() || "Saved from the CodeRook desktop app",
+                ...(request.expectedHeadVersionId === undefined
+                    ? {}
+                    : { expectedHeadVersionId: request.expectedHeadVersionId }),
                 sourceSize: sourceBytes,
                 storedSize: storedBytes,
                 files: contents.map((item) => ({

package/package.json

@@ -1,36 +1,36 @@
-{
-  "name": "@coderook/cli",
-  "version": "0.1.0",
-  "description": "CodeRook from the command line, on any operating system",
-  "license": "SEE LICENSE IN LICENSE.txt",
-  "homepage": "https://coderook.com",
-  "bugs": {
-    "url": "https://coderook.com/contact"
-  },
-  "keywords": [
-    "coderook",
-    "versioning",
-    "backup",
-    "cbx"
-  ],
-  "engines": {
-    "node": ">=20.11.0"
-  },
-  "bin": {
-    "coderook": "dist/cli/src/cli.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
-    "start": "node dist/cli/src/cli.js",
-    "prepublishOnly": "npm run build"
-  },
-  "devDependencies": {
-    "@types/node": "24.10.1",
-    "typescript": "5.9.3"
-  }
-}
+{
+  "name": "@coderook/cli",
+  "version": "0.2.0",
+  "description": "CodeRook from the command line, on any operating system",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "homepage": "https://coderook.com",
+  "bugs": {
+    "url": "https://coderook.com/contact"
+  },
+  "keywords": [
+    "coderook",
+    "versioning",
+    "backup",
+    "cbx"
+  ],
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "bin": {
+    "coderook": "dist/cli/src/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
+    "start": "node dist/cli/src/cli.js",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "typescript": "5.9.3"
+  }
+}