@coderook/cli 0.1.0 → 0.3.0

package/dist/cli/src/api.js

@@ -4,6 +4,11 @@ exports.whoami = whoami;
 exports.projects = projects;
 exports.findProject = findProject;
 exports.health = health;
+exports.mergeTracks = mergeTracks;
+exports.mergeTrack = mergeTrack;
+exports.resolveMergeConflict = resolveMergeConflict;
+exports.applyMerge = applyMerge;
+exports.cancelMerge = cancelMerge;
 /** The small part of the API the command-line tool needs directly. */
 const config_js_1 = require("./config.js");
 async function call(route, options = {}) {
@@ -65,3 +70,22 @@ async function health() {
     });
     return (await response.json());
 }
+async function mergeTracks(repositoryId) {
+    const body = await call(`/v1/repositories/${repositoryId}/merge-tracks`);
+    return body.mergeTracks;
+}
+async function mergeTrack(id) {
+    return call(`/v1/merge-tracks/${id}`);
+}
+async function resolveMergeConflict(mergeTrackId, conflictId, resolution) {
+    await call(`/v1/merge-tracks/${mergeTrackId}/conflicts/${conflictId}`, {
+        method: "PUT",
+        body: { resolution },
+    });
+}
+async function applyMerge(mergeTrackId) {
+    return call(`/v1/merge-tracks/${mergeTrackId}/apply`, { method: "POST" });
+}
+async function cancelMerge(mergeTrackId) {
+    await call(`/v1/merge-tracks/${mergeTrackId}/cancel`, { method: "POST" });
+}

package/dist/cli/src/cli.js

@@ -18,13 +18,26 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const promises_1 = require("node:readline/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
+const api_js_1 = require("./api.js");
 const worktree_js_1 = require("../../desktop-app/src/main/worktree.js");
 const upload_js_1 = require("../../desktop-app/src/main/upload.js");
 const download_js_1 = require("../../desktop-app/src/main/download.js");
 const cbx_js_1 = require("../../desktop-app/src/main/cbx.js");
-const api_js_1 = require("./api.js");
+const api_js_2 = require("./api.js");
 const config_js_1 = require("./config.js");
-const VERSION = "0.1.0";
+/*
+  Read from the package rather than written twice. A hardcoded copy had
+  already drifted from the published version, which makes `coderook doctor`
+  worse than useless when working out what somebody is actually running.
+*/
+const VERSION = (() => {
+    try {
+        return (require("../../../package.json").version ?? "0.0.0");
+    }
+    catch {
+        return "0.0.0";
+    }
+})();
 // ── presentation ────────────────────────────────────────────────────────────
 const colour = node_process_1.default.stdout.isTTY && !node_process_1.default.env.NO_COLOR;
 const dim = (text) => (colour ? `${text}` : text);
@@ -94,20 +107,51 @@ const folderFor = (parsed, index = 0) => node_path_1.default.resolve(parsed.posi
  * what that repository already holds. The account is the authority, exactly
  * as it is in the desktop application.
  */
+/**
+ * Work out what this folder is based on, and whether the account has moved.
+ *
+ * The base is the version this folder was last brought level with — not
+ * whatever happens to be newest. Silently re-basing on the newest is what
+ * makes a folder look up to date when somebody else has published: the
+ * changes are then measured against their work, and saving quietly lays
+ * this machine's copy over theirs.
+ *
+ * So a folder that has fallen behind keeps its own base and is told, which
+ * is what lets the service merge the two rather than pick a winner.
+ */
 async function reconcile(folder, options = {}) {
     const link = await (0, config_js_1.readLink)(folder);
     const reference = link?.slug ?? node_path_1.default.basename(folder);
     const project = link
-        ? (await (0, api_js_1.projects)()).find((candidate) => candidate.id === link.repositoryId)
-        : await (0, api_js_1.findProject)(reference);
+        ? (await (0, api_js_2.projects)()).find((candidate) => candidate.id === link.repositoryId)
+        : await (0, api_js_2.findProject)(reference);
     if (!project?.versionCount) {
         // Nothing saved on the account, so everything here is outstanding.
-        return { link: link ?? null, baseline: null };
+        return { link: link ?? null, baseline: null, behind: null };
     }
     const downloader = new download_js_1.Downloader(config_js_1.credentials);
     const latest = (await downloader.versions(project.id))[0];
     if (!latest)
-        return { link: link ?? null, baseline: null };
+        return { link: link ?? null, baseline: null, behind: null };
+    /*
+      A folder that already knows which version it stands on keeps it. Only a
+      folder that has never been reconciled — or was linked before versions
+      were recorded — adopts the newest as its starting point.
+    */
+    const known = link?.versionId && link.manifest ? link : null;
+    const behind = known && known.versionId !== latest.id
+        ? { sequence: latest.sequence, id: latest.id }
+        : null;
+    if (known) {
+        if (behind && !options.quiet) {
+            console.log(dim(`The account is on v${behind.sequence}; this folder is based on v${known.sequence}.`));
+        }
+        return {
+            link: known,
+            baseline: new Map(Object.entries(known.manifest)),
+            behind,
+        };
+    }
     const baseline = new Map();
     for (const file of await downloader.files(project.id, latest.id)) {
         baseline.set(file.path, file.sha256);
@@ -116,13 +160,14 @@ async function reconcile(folder, options = {}) {
         repositoryId: project.id,
         slug: project.slug,
         sequence: latest.sequence,
+        versionId: latest.id,
         manifest: Object.fromEntries(baseline),
     };
     await (0, config_js_1.writeLink)(folder, fresh);
     if (!options.quiet && !link) {
         console.log(dim(`Linked this folder to ${project.slug}.`));
     }
-    return { link: fresh, baseline };
+    return { link: fresh, baseline, behind: null };
 }
 // ── commands ────────────────────────────────────────────────────────────────
 async function commandSignIn(parsed) {
@@ -140,7 +185,7 @@ async function commandSignIn(parsed) {
     }
     await (0, config_js_1.storeToken)(token);
     try {
-        const account = await (0, api_js_1.whoami)();
+        const account = await (0, api_js_2.whoami)();
         console.log(`Signed in as ${bold(account.displayName)} ${dim(`<${account.email}>`)} · ${account.plan}`);
         console.log(dim(`Token stored in ${(0, config_js_1.configDirectory)()}`));
         return 0;
@@ -157,12 +202,12 @@ async function commandSignOut() {
     return 0;
 }
 async function commandWhoami() {
-    const account = await (0, api_js_1.whoami)();
+    const account = await (0, api_js_2.whoami)();
     console.log(`${bold(account.displayName)} <${account.email}> · ${account.plan}`);
     return 0;
 }
 async function commandProjects() {
-    const all = await (0, api_js_1.projects)();
+    const all = await (0, api_js_2.projects)();
     if (!all.length) {
         console.log("No projects on this account yet.");
         return 0;
@@ -206,6 +251,31 @@ async function commandSubmit(parsed) {
         console.log("Nothing to submit; this folder matches the saved version.");
         return 0;
     }
+    /*
+      The policy is that credentials are never quietly dropped and never
+      quietly sent — they are asked about. The desktop application has always
+      put this question in front of the first upload; the command line was
+      sending them without a word, which is the worse half of the two
+      behaviours the policy exists to prevent.
+    */
+    const secrets = await (0, worktree_js_1.detectSecrets)(folder);
+    const sending = new Set(files.map((file) => file.path));
+    const exposed = secrets.filter((secret) => sending.has(secret));
+    if (exposed.length) {
+        console.log(red(`\n${exposed.length} file${exposed.length === 1 ? " looks like a credential" : "s look like credentials"}:`));
+        for (const secret of exposed.slice(0, 20))
+            console.log(`  ${secret}`);
+        if (exposed.length > 20) {
+            console.log(dim(`  …and ${exposed.length - 20} more`));
+        }
+        if (!hasFlag(parsed, "allow-secrets")) {
+            console.error(`\nNothing was sent. Add them to ${accent(".gitignore")} to leave them` +
+                ` behind, or pass ${accent("--allow-secrets")} if they genuinely belong` +
+                ` in the project.`);
+            return 1;
+        }
+        console.log(dim("Sending them anyway, because --allow-secrets was given."));
+    }
     if (hasFlag(parsed, "dry-run", "n")) {
         console.log(`${files.length} file${files.length === 1 ? "" : "s"} would be sent:`);
         for (const file of files)
@@ -214,21 +284,66 @@ async function commandSubmit(parsed) {
     }
     const line = progressLine();
     const uploader = new upload_js_1.Uploader(config_js_1.credentials);
-    const result = await uploader.run({
-        localPath: folder,
-        include: files.map((file) => file.path),
-        message,
-        projectName: link?.slug ?? node_path_1.default.basename(folder),
-        repositoryId: link?.repositoryId ?? null,
-    }, (progress) => {
-        line(`  ${String(progress.percent).padStart(3)}%  ${progress.stage.padEnd(7)} ` +
-            `${progress.files}/${progress.totalFiles}  ${progress.path.slice(-48)}`);
-    });
+    let result;
+    try {
+        result = await uploader.run({
+            localPath: folder,
+            include: files.map((file) => file.path),
+            message,
+            projectName: link?.slug ?? node_path_1.default.basename(folder),
+            repositoryId: link?.repositoryId ?? null,
+            /*
+              Only claimed when this folder has actually been reconciled with a
+              known version. A folder linked before versions were recorded says
+              nothing rather than guessing, and publishes as it always did.
+            */
+            ...(link?.versionId ? { expectedHeadVersionId: link.versionId } : {}),
+        }, (progress) => {
+            line(`  ${String(progress.percent).padStart(3)}%  ${progress.stage.padEnd(7)} ` +
+                `${progress.files}/${progress.totalFiles}  ${progress.path.slice(-48)}`);
+        });
+    }
+    catch (error) {
+        done(line);
+        const code = error.code;
+        if (code === "merge_required" || code === "track_moved") {
+            /*
+              Somebody else saved to this project first. Everything that did not
+              overlap has already been combined by the service; what is left is a
+              genuine decision, so the answer is to bring their work down and look
+              at it rather than to try again harder.
+            */
+            console.error(red(error instanceof Error ? error.message : String(error)));
+            console.error(`\nRun ${accent("coderook get")} to bring the latest version down, then` +
+                ` submit again. Nothing was changed on your account.`);
+            return 1;
+        }
+        throw error;
+    }
     done(line);
+    if (result.mergeTrack) {
+        /*
+          The upload is complete and kept, but the project has not changed —
+          calling this "saved" would be false, and the base is deliberately left
+          alone so the folder still knows what it was working from.
+        */
+        console.log(`\nSomebody else saved first, and ${result.mergeTrack.conflicts.length === 1
+            ? "one file overlaps"
+            : `${result.mergeTrack.conflicts.length} files overlap`}.`);
+        console.log(`Your work is complete and kept as ${accent(result.mergeTrack.reference)}:`);
+        for (const conflict of result.mergeTrack.conflicts.slice(0, 20)) {
+            console.log(`  ${red(conflict.path)}  ${dim(conflict.kind)}`);
+        }
+        console.log(`\nRun ${accent(`coderook merge ${result.mergeTrack.reference}`)} to decide,` +
+            ` or ${accent("coderook merges")} to see everything waiting.`);
+        return 0;
+    }
     await (0, config_js_1.writeLink)(folder, {
         repositoryId: result.repositoryId,
         slug: link?.slug ?? node_path_1.default.basename(folder),
         sequence: result.sequence,
+        // What this folder is now working from, so the next submit can say so.
+        versionId: result.versionId,
         manifest: result.manifest,
     });
     console.log(`Saved ${accent(`v${result.sequence}`)} · sent ${bytes(result.sentBytes)} in ` +
@@ -252,7 +367,7 @@ async function commandClone(parsed) {
         console.error(red("Which project? Try: coderook clone <project>"));
         return 1;
     }
-    const project = await (0, api_js_1.findProject)(reference);
+    const project = await (0, api_js_2.findProject)(reference);
     if (!project) {
         console.error(red(`No project named ${reference} on this account.`));
         return 1;
@@ -277,10 +392,12 @@ async function fetchInto(repositoryId, destination, slug) {
             `  ${progress.path.slice(-48)}`);
     });
     done(line);
+    // Fetching is how a folder catches up, so this is what moves its base.
     await (0, config_js_1.writeLink)(destination, {
         repositoryId,
         slug,
         sequence: latest.sequence,
+        versionId: latest.id,
         manifest: result.manifest,
     });
     console.log(`${accent(`v${latest.sequence}`)} · ${result.files} files · ${bytes(result.bytes)} into ${destination}`);
@@ -355,7 +472,7 @@ async function commandInspect(parsed) {
     return 0;
 }
 async function commandDoctor() {
-    const service = await (0, api_js_1.health)().catch(() => null);
+    const service = await (0, api_js_2.health)().catch(() => null);
     console.log(`CodeRook CLI ${VERSION} · Node ${node_process_1.default.versions.node} · ${node_process_1.default.platform}`);
     console.log(`Config: ${(0, config_js_1.configDirectory)()}`);
     console.log(service
@@ -368,7 +485,7 @@ async function commandDoctor() {
         return 0;
     }
     try {
-        const account = await (0, api_js_1.whoami)();
+        const account = await (0, api_js_2.whoami)();
         console.log(`Account: ${account.email} · ${account.plan}`);
     }
     catch (error) {
@@ -390,6 +507,10 @@ ${bold("Working with a folder")}
   coderook clone <project> [dir]   Fetch a project into a new folder
   coderook rules [folder]          Show the ignore rules  (--init to start one)
 
+${bold("When somebody saved first")}
+  coderook merges                  Uploads of yours waiting on a decision
+  coderook merge <ref>             Look at one  (--mine --theirs --both --drop)
+
 ${bold("Bundles")}
   coderook bundle [folder] [out]   Pack the project as a .cbx
   coderook unbundle <file> [dir]   Extract a .cbx
@@ -402,10 +523,132 @@ ${bold("Other")}
 ${bold("Options")}
   -m, --message   The version message for submit
   -n, --dry-run   Show what submit would send, without sending
+      --allow-secrets  Send files that look like credentials anyway
       --token     Supply the token to sign-in instead of being asked
 
 ${dim("The environment variable CODEROOK_TOKEN is used when set, so automated")}
 ${dim("runs need nothing on disk. CODEROOK_API_URL points at another service.")}`;
+/**
+ * Everything waiting on a decision, for one folder's project.
+ *
+ * A diverted upload is easy to forget about — it is not an error and the
+ * project looks untouched — so this is the way to find out that work of
+ * yours is sitting somewhere, still complete, waiting.
+ */
+async function commandMerges(parsed) {
+    const folder = folderFor(parsed);
+    const link = await (0, config_js_1.readLink)(folder);
+    if (!link) {
+        console.error(red("This folder is not linked to a project on your account."));
+        return 1;
+    }
+    const waiting = (await (0, api_js_1.mergeTracks)(link.repositoryId)).filter((merge) => merge.state === "open");
+    if (!waiting.length) {
+        console.log("Nothing is waiting to be merged.");
+        return 0;
+    }
+    for (const merge of waiting) {
+        const counts = merge.conflicts;
+        console.log(`${accent(merge.reference)}  ${counts ? `${counts.unresolved} of ${counts.total} still to decide` : ""}  ${dim(new Date(merge.createdAt).toLocaleString())}`);
+    }
+    console.log(dim(`
+Run coderook merge <reference> to look at one.`));
+    return 0;
+}
+/** Find a merge by the reference a person would type, such as M-2. */
+async function findMerge(folder, reference) {
+    const link = await (0, config_js_1.readLink)(folder);
+    if (!link)
+        throw new Error("This folder is not linked to a project on your account.");
+    const all = await (0, api_js_1.mergeTracks)(link.repositoryId);
+    const found = all.find((merge) => merge.reference.toLowerCase() === reference.toLowerCase());
+    if (!found)
+        throw new Error(`No merge called ${reference} on this project.`);
+    return found;
+}
+/**
+ * Look at one merge, and optionally finish it.
+ *
+ * Deciding happens here rather than in a command of its own because the
+ * decision only means anything next to the thing it is about.
+ */
+async function commandMerge(parsed) {
+    const reference = parsed.positional[0];
+    if (!reference) {
+        console.error(red("Which merge? Try: coderook merge M-1"));
+        return 1;
+    }
+    const folder = folderFor({ ...parsed, positional: parsed.positional.slice(1) });
+    const summary = await findMerge(folder, reference);
+    const detail = await (0, api_js_1.mergeTrack)(summary.id);
+    if (hasFlag(parsed, "cancel")) {
+        await (0, api_js_1.cancelMerge)(summary.id);
+        console.log(`${summary.reference} cancelled. Your upload is still stored and nothing published was touched.`);
+        return 0;
+    }
+    const outstanding = detail.conflicts.filter((conflict) => !conflict.resolvedAt);
+    const decision = hasFlag(parsed, "mine")
+        ? "take_candidate"
+        : hasFlag(parsed, "theirs")
+            ? "take_target"
+            : hasFlag(parsed, "drop")
+                ? "delete"
+                : hasFlag(parsed, "both", "keep-both")
+                    ? "keep_both"
+                    : null;
+    if (decision) {
+        const only = flagText(parsed, "path");
+        const chosen = only
+            ? outstanding.filter((conflict) => conflict.path === only)
+            : outstanding;
+        if (!chosen.length) {
+            console.error(red(only ? `${only} has no outstanding decision.` : "Nothing left to decide."));
+            return 1;
+        }
+        for (const conflict of chosen) {
+            await (0, api_js_1.resolveMergeConflict)(summary.id, conflict.id, decision);
+            console.log(`  ${conflict.path} → ${decision === "take_candidate"
+                ? "yours"
+                : decision === "take_target"
+                    ? "theirs"
+                    : decision === "keep_both"
+                        ? `both, yours saved beside it`
+                        : "removed"}`);
+        }
+    }
+    const now = await (0, api_js_1.mergeTrack)(summary.id);
+    console.log(`
+${accent(now.mergeTrack.reference)} · ${now.provisional.fileCount} files · ` +
+        (now.provisional.ready
+            ? "ready to apply"
+            : `${now.provisional.unresolvedPaths.length} still to decide`));
+    for (const conflict of now.conflicts) {
+        console.log(`  ${conflict.resolvedAt ? accent("decided") : red("waiting")}  ${conflict.path}` +
+            `  ${dim(conflict.kind)}${conflict.resolution ? dim(` (${conflict.resolution})`) : ""}`);
+    }
+    if (hasFlag(parsed, "apply")) {
+        if (!now.provisional.ready) {
+            console.error(red("\nStill undecided files; nothing was applied."));
+            return 1;
+        }
+        const applied = await (0, api_js_1.applyMerge)(summary.id);
+        console.log(`
+Applied as ${accent(`v${applied.version.sequence}`)}.`);
+        console.log(dim("Run coderook get to bring it down to this folder."));
+        return 0;
+    }
+    if (!decision) {
+        console.log(dim(`
+--mine keeps yours, --theirs keeps what was already saved,` +
+            ` --drop removes the file.
+Add --path <file> for one file, then --apply when ready.`));
+    }
+    else if (now.provisional.ready) {
+        console.log(dim(`
+Run coderook merge ${now.mergeTrack.reference} --apply to publish it.`));
+    }
+    return 0;
+}
 const COMMANDS = {
     "sign-in": commandSignIn,
     login: commandSignIn,
@@ -422,6 +665,8 @@ const COMMANDS = {
     bundle: commandBundle,
     unbundle: commandUnbundle,
     inspect: commandInspect,
+    merges: commandMerges,
+    merge: commandMerge,
     doctor: () => commandDoctor(),
 };
 async function main(argv) {

package/dist/desktop-app/src/main/upload.js

@@ -95,7 +95,16 @@ class Uploader {
         const body = text ? JSON.parse(text) : {};
         if (!response.ok) {
             const message = body?.error?.message ?? `${route} failed (${response.status})`;
-            throw new Error(message);
+            /*
+              The service says what kind of failure this is, and callers need that
+              to say anything useful — "someone else saved first" deserves a
+              different suggestion from "the disk is full". Carrying the code on
+              the error keeps them from having to match on wording.
+            */
+            throw Object.assign(new Error(message), {
+                code: typeof body?.error?.code === "string" ? body.error.code : "",
+                status: response.status,
+            });
         }
         return body;
     }
@@ -288,6 +297,9 @@ class Uploader {
             contentType: "application/json",
             body: JSON.stringify({
                 message: request.message.trim() || "Saved from the CodeRook desktop app",
+                ...(request.expectedHeadVersionId === undefined
+                    ? {}
+                    : { expectedHeadVersionId: request.expectedHeadVersionId }),
                 sourceSize: sourceBytes,
                 storedSize: storedBytes,
                 files: contents.map((item) => ({
@@ -314,6 +326,7 @@ class Uploader {
             repositoryId,
             versionId: completed.version.id,
             sequence: completed.version.sequence,
+            ...(completed.mergeTrack ? { mergeTrack: completed.mergeTrack } : {}),
             sourceBytes,
             storedBytes,
             sentBytes,

package/package.json

@@ -1,36 +1,36 @@
-{
-  "name": "@coderook/cli",
-  "version": "0.1.0",
-  "description": "CodeRook from the command line, on any operating system",
-  "license": "SEE LICENSE IN LICENSE.txt",
-  "homepage": "https://coderook.com",
-  "bugs": {
-    "url": "https://coderook.com/contact"
-  },
-  "keywords": [
-    "coderook",
-    "versioning",
-    "backup",
-    "cbx"
-  ],
-  "engines": {
-    "node": ">=20.11.0"
-  },
-  "bin": {
-    "coderook": "dist/cli/src/cli.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
-    "start": "node dist/cli/src/cli.js",
-    "prepublishOnly": "npm run build"
-  },
-  "devDependencies": {
-    "@types/node": "24.10.1",
-    "typescript": "5.9.3"
-  }
-}
+{
+  "name": "@coderook/cli",
+  "version": "0.3.0",
+  "description": "CodeRook from the command line, on any operating system",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "homepage": "https://coderook.com",
+  "bugs": {
+    "url": "https://coderook.com/contact"
+  },
+  "keywords": [
+    "coderook",
+    "versioning",
+    "backup",
+    "cbx"
+  ],
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "bin": {
+    "coderook": "dist/cli/src/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
+    "start": "node dist/cli/src/cli.js",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "typescript": "5.9.3"
+  }
+}