@coderook/cli 0.17.0 → 0.19.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -27,6 +27,7 @@ const project_commands_js_1 = require("./project_commands.js");
 const track_commands_js_1 = require("./track_commands.js");
 const mcp_js_1 = require("./mcp.js");
 const skill_command_js_1 = require("./skill_command.js");
+const licence_commands_js_1 = require("./licence_commands.js");
 const service_commands_js_1 = require("./service_commands.js");
 const worktree_js_1 = require("../../desktop-app/src/main/worktree.js");
 const upload_js_1 = require("../../desktop-app/src/main/upload.js");
@@ -299,6 +300,29 @@ async function commandSubmit(parsed) {
     const folder = folderFor(parsed);
     const message = flagText(parsed, "m", "message") ?? "";
     const { link, baseline, behind } = await reconcile(folder);
+    /*
+      A first save gets a licence unless it is turned down.
+  
+      Work published with no licence cannot legally be used by anybody, which is
+      the opposite of what nearly everyone uploading their work intends — so the
+      default says the generous thing rather than the silent one. It happens
+      before the scan below so the file goes up with this same version rather
+      than trailing a save behind.
+  
+      Only on a project's first save. After that an absent LICENSE is somebody's
+      decision and putting one back would be arguing with them.
+    */
+    const added = link
+        ? null
+        : await (0, licence_commands_js_1.licenceNewProject)(folder, 
+        /*
+          Whose name goes on the copyright line. Asked of the account rather
+          than guessed from the folder — and when it cannot be had, the shared
+          helper writes nothing rather than naming nobody.
+        */
+        await (0, api_js_2.whoami)()
+            .then((account) => account.displayName || account.username || "")
+            .catch(() => ""), hasFlag(parsed, "no-licence"));
     const rules = await (0, worktree_js_1.readRules)(folder);
     const files = await (0, worktree_js_1.changedFiles)(folder, rules, baseline);
     /*
@@ -392,12 +416,62 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         }
         console.log(dim("Sending them anyway, because --allow-secrets was given."));
     }
+    /*
+      Keys pasted into files that are not keys.
+  
+      The check above reads names, which finds what a tool wrote and is blind to
+      what a person typed. This one reads the files being sent — the case where
+      somebody pasted a token into `settings.py` to get something working and it
+      stayed there, in a file with an ordinary name that every other check waves
+      through.
+  
+      Refused separately from `--allow-secrets`, because the answer is different:
+      a `.env` should not be sent and the fix is to leave it out, while a source
+      file should be sent and the fix is to take the key out of it.
+    */
+    const pasted = await (0, worktree_js_1.detectPastedCredentials)(folder, files.map((file) => file.path));
+    const stillPasted = pasted.filter((finding) => !exposed.includes(finding.path));
+    if (stillPasted.length) {
+        console.log(red(`
+${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
+        for (const finding of stillPasted.slice(0, 20)) {
+            console.log(`  ${finding.path}`);
+            for (const one of finding.found.slice(0, 3)) {
+                console.log(dim(`    line ${one.line}: ${one.name}`));
+            }
+            if (finding.found.length > 3) {
+                console.log(dim(`    …and ${finding.found.length - 3} more`));
+            }
+        }
+        if (stillPasted.length > 20) {
+            console.log(dim(`  …and ${stillPasted.length - 20} more`));
+        }
+        if (!hasFlag(parsed, "allow-secrets")) {
+            console.error(`
+Nothing was sent. Move the key into an environment variable, and if` +
+                ` it has ever been published, replace it at the service that issued` +
+                ` it — a key that has leaked stays leaked.` +
+                `
+Pass ${accent("--allow-secrets")} if these are not real keys.`);
+            return 1;
+        }
+        console.log(dim("Sending them anyway, because --allow-secrets was given."));
+    }
     if (hasFlag(parsed, "dry-run", "n")) {
         console.log(`${files.length} file${files.length === 1 ? "" : "s"} would be sent:`);
         for (const file of files)
             console.log(`  ${file.path}`);
         return 0;
     }
+    if (added) {
+        console.log(`${accent("Added an MIT licence")}, so other people may use this.`);
+        console.log(dim(`  Change it with `) +
+            accent("coderook licence <name>") +
+            dim(`, or remove it with `) +
+            accent("coderook licence none") +
+            dim("."));
+        console.log("");
+    }
     const line = progressLine();
     const uploader = new upload_js_1.Uploader(config_js_1.credentials);
     let result;
@@ -1175,11 +1249,18 @@ const SPECS = [
         options: [
             { flags: "-m, --message <text>", description: "what changed, in a sentence" },
             { flags: "-n, --dry-run", description: "show what would be sent, send nothing" },
-            { flags: "--allow-secrets", description: "send files that look like credentials" },
+            {
+                flags: "--allow-secrets",
+                description: "send files that look like credentials, and files with keys inside",
+            },
             {
                 flags: "--track <name>",
                 description: "save onto this line, just this once",
             },
+            {
+                flags: "--no-licence",
+                description: "do not add a licence to a new project; nobody may reuse it",
+            },
         ],
         examples: [
             'coderook submit -m "Fix the export dialog"',
@@ -1242,6 +1323,36 @@ const SPECS = [
         usage: "clone <project> [dir]",
         run: commandClone,
     },
+    {
+        name: "licence",
+        aliases: ["license"],
+        group: "Working with a folder",
+        summary: "choose a licence, so people may actually use your work",
+        usage: "licence [name] [folder]",
+        detail: "A project with no licence cannot be used by anybody, whatever else it\n" +
+            "says: with nothing granting permission, the law grants none. That is\n" +
+            "the state most public projects are in, and the people most careful\n" +
+            "about it are the ones who quietly walk away.\n" +
+            "\n" +
+            "Run it with no name to see what there is, each with a line saying what\n" +
+            "it lets people do. Naming one writes LICENSE into the folder, and it\n" +
+            "goes up with your next save like any other file.\n" +
+            "\n" +
+            "The texts are SPDX's own. Nothing here is paraphrased, because the\n" +
+            "wording of a licence is the licence.\n",
+        options: [
+            {
+                flags: "--holder <name>",
+                description: "whose name goes on it, instead of your account name",
+            },
+            {
+                flags: "--force",
+                description: "replace a licence that is already there",
+            },
+        ],
+        examples: ["coderook licence", "coderook licence MIT", "coderook licence Apache-2.0"],
+        run: licence_commands_js_1.commandLicence,
+    },
     {
         name: "ignore",
         aliases: ["rules"],
@@ -1261,8 +1372,21 @@ const SPECS = [
                 flags: "--apply",
                 description: "with --suggest, add the confident ones to .gitignore",
             },
+            {
+                flags: "--template <name>",
+                description: "add a ready-made set of rules; `list` shows all 309 of them",
+            },
         ],
-        run: commandRules,
+        run: (parsed) => 
+        /*
+          Two commands under one name, because they are one question. Somebody
+          asking about ignore rules either wants to see what theirs are or wants
+          a set they do not have to write, and making the second a separate
+          command would hide it from the person who needs it most.
+        */
+        parsed.flags.has("template")
+            ? (0, licence_commands_js_1.commandIgnoreTemplate)(parsed)
+            : commandRules(parsed),
     },
     {
         name: "projects",

package/dist/cli/src/licence_commands.js

@@ -0,0 +1,194 @@
+"use strict";
+/**
+ * Choosing a licence, and borrowing somebody else's ignore rules.
+ *
+ * Both are the same shape of problem: a thing every project needs, that
+ * almost nobody writes from scratch, and that is quietly consequential when
+ * it is missing. A project with no licence cannot legally be used by anybody,
+ * however public it is — and a project with no ignore rules publishes a
+ * dependency tree and whatever else was lying in the folder.
+ *
+ * Neither is invented here. The licence texts come from SPDX and the ignore
+ * templates from github/gitignore, vendored by scripts in the desktop package
+ * so that the wording matches what every other tool in the world agrees on.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.licenceNewProject = void 0;
+exports.commandLicence = commandLicence;
+exports.commandIgnoreTemplate = commandIgnoreTemplate;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const licences_js_1 = require("../../desktop-app/src/main/licences.js");
+Object.defineProperty(exports, "licenceNewProject", { enumerable: true, get: function () { return licences_js_1.licenceNewProject; } });
+const ignore_templates_js_1 = require("../../desktop-app/src/main/ignore_templates.js");
+const worktree_js_1 = require("../../desktop-app/src/main/worktree.js");
+const api_js_1 = require("./api.js");
+const dim = (value) => `${value}`;
+const bold = (value) => `${value}`;
+const red = (value) => `${value}`;
+const green = (value) => `${value}`;
+const accent = (value) => `${value}`;
+const SHAPES = {
+    permissive: "Do what you like, keep the notice",
+    "weak-copyleft": "Changes to these files come back",
+    copyleft: "Anything built on it carries the same terms",
+    "public-domain": "Given away entirely",
+};
+/** The file a licence goes in, matching what every tool looks for. */
+/**
+ * The folder a command acts on.
+ *
+ * Indexed the way the rest of the command line does: positional[0] is the
+ * first argument after the command name, so a licence command reads its
+ * licence there and its folder one along.
+ */
+function folderFor(parsed, index = 0) {
+    return node_path_1.default.resolve(parsed.positional[index] ?? process.cwd());
+}
+async function commandLicence(parsed) {
+    const wanted = parsed.positional[0];
+    const folder = folderFor(parsed, 1);
+    if (!wanted) {
+        const existing = await (0, promises_1.readFile)(node_path_1.default.join(folder, licences_js_1.LICENCE_FILE), "utf8")
+            .then((text) => text.split("\n")[0]?.trim() ?? "")
+            .catch(() => null);
+        if (existing !== null) {
+            console.log(`${bold("This folder has a licence")} — ${existing}`);
+            console.log(dim(`  ${node_path_1.default.join(folder, licences_js_1.LICENCE_FILE)}`));
+            console.log("");
+        }
+        console.log(bold("Licences you can put on this project"));
+        let shape = null;
+        for (const licence of licences_js_1.LICENCES) {
+            if (licence.shape !== shape) {
+                shape = licence.shape;
+                console.log("");
+                console.log(dim(`  ${SHAPES[shape].toUpperCase()}`));
+            }
+            const mark = licence.id === licences_js_1.DEFAULT_LICENCE ? accent(" ·") : "  ";
+            console.log(`${mark} ${bold(licence.id.padEnd(20))} ${licence.name}`);
+            console.log(`     ${dim(licence.summary)}`);
+        }
+        console.log("");
+        console.log(`Add one with ${accent("coderook licence MIT")}. ` +
+            dim(`Nothing is written until you name one.`));
+        return 0;
+    }
+    /*
+      "none" is a real answer, and has to be, or the default below is a trap:
+      somebody who does not want their work reusable needs a way to say so that
+      is as easy as the way it arrived.
+    */
+    if (wanted.toLowerCase() === "none") {
+        const target = node_path_1.default.join(folder, licences_js_1.LICENCE_FILE);
+        const already = await (0, promises_1.readFile)(target, "utf8").catch(() => null);
+        if (already === null) {
+            console.log("There is no licence here to remove.");
+            return 0;
+        }
+        await (0, promises_1.rm)(target);
+        console.log(green(`Removed ${licences_js_1.LICENCE_FILE}.`));
+        console.log(dim("With no licence, nobody else may legally use this — which is a"));
+        console.log(dim("position you can hold, as long as you are holding it on purpose."));
+        return 0;
+    }
+    const licence = (0, licences_js_1.licenceById)(wanted);
+    if (!licence) {
+        console.error(red(`No licence called ${wanted}.`));
+        console.error(`Run ${accent("coderook licence")} to see the list.`);
+        return 1;
+    }
+    /*
+      Whose name goes on it.
+  
+      Asked of the account rather than guessed from the folder, and only for the
+      licences that carry a copyright line. Getting this wrong is not a typo —
+      it is a legal document naming the wrong person — so a licence that needs a
+      holder and cannot find one stops rather than writing "unknown".
+    */
+    let holder = flagValue(parsed, "holder") ?? "";
+    if (licence.personalised && !holder) {
+        holder = await (0, api_js_1.whoami)()
+            .then((account) => account.displayName || account.username || "")
+            .catch(() => "");
+        if (!holder) {
+            console.error(red("Could not work out whose name goes on the licence."));
+            console.error(`Sign in, or pass ${accent('--holder "Your Name"')} to say directly.`);
+            return 1;
+        }
+    }
+    const target = node_path_1.default.join(folder, licences_js_1.LICENCE_FILE);
+    const already = await (0, promises_1.readFile)(target, "utf8").catch(() => null);
+    if (already !== null && !parsed.flags.has("force")) {
+        console.error(red("This folder already has a LICENSE."));
+        console.error(dim(`  ${already.split("\n")[0]?.trim() ?? ""}`));
+        console.error(`\nReplacing a licence changes the terms other people already received.` +
+            `\nPass ${accent("--force")} if that is what you mean.`);
+        return 1;
+    }
+    await (0, promises_1.writeFile)(target, (0, licences_js_1.licenceText)(licence.id, holder), "utf8");
+    console.log(green(`Wrote ${licence.name} to ${licences_js_1.LICENCE_FILE}.`));
+    if (licence.personalised)
+        console.log(dim(`  in the name of ${holder}`));
+    console.log(dim(`  ${licence.summary}`));
+    console.log("");
+    console.log(dim("It is a file like any other, so it goes up with your next save."));
+    return 0;
+}
+/**
+ * Borrow a set of ignore rules somebody else already worked out.
+ *
+ * Appended under a heading of its own rather than replacing what is there.
+ * A folder often needs two or three of these — a language, an editor, an
+ * operating system — and a template that overwrote the last one would make
+ * the second choice undo the first.
+ */
+async function commandIgnoreTemplate(parsed) {
+    const folder = folderFor(parsed);
+    const wanted = flagValue(parsed, "template") ?? "";
+    if (!wanted || wanted === "list") {
+        const names = Object.values(ignore_templates_js_1.IGNORE_TEMPLATES)
+            .map((template) => template.name)
+            .sort((left, right) => left.localeCompare(right));
+        console.log(bold(`${names.length} sets of ignore rules`));
+        console.log("");
+        /* Four columns, because a list this long as one column is unreadable. */
+        const width = Math.max(...names.map((name) => name.length)) + 2;
+        const perRow = Math.max(1, Math.floor(96 / width));
+        for (let at = 0; at < names.length; at += perRow) {
+            console.log("  " + names.slice(at, at + perRow).map((name) => name.padEnd(width)).join(""));
+        }
+        console.log("");
+        console.log(`Add one with ${accent("coderook ignore --template Python")}. ` +
+            dim("Several is normal — a language, an editor, an operating system."));
+        return 0;
+    }
+    const template = ignore_templates_js_1.IGNORE_TEMPLATES[wanted.toLowerCase()];
+    if (!template) {
+        console.error(red(`No rules called ${wanted}.`));
+        console.error(`Run ${accent("coderook ignore --template list")} to see what there is.`);
+        return 1;
+    }
+    const rules = await (0, worktree_js_1.readRules)(folder);
+    const heading = `# ${template.name}, from github/gitignore`;
+    if (rules.shared.includes(heading)) {
+        console.log(`${template.name} is already in this folder's rules.`);
+        return 0;
+    }
+    const body = rules.shared.replace(/\s*$/, "");
+    const shared = `${body ? `${body}\n\n` : ""}${heading}\n${template.body}`;
+    await (0, worktree_js_1.writeRules)(folder, { ...rules, shared });
+    const lines = template.body.split("\n").filter((line) => line.trim() && !line.startsWith("#"));
+    console.log(green(`Added ${template.name} — ${lines.length} rules.`));
+    console.log(dim(`  ${node_path_1.default.join(folder, ".gitignore")}`));
+    console.log("");
+    console.log(dim(`See what it leaves behind with `) + accent("coderook status"));
+    return 0;
+}
+function flagValue(parsed, name) {
+    const value = parsed.flags.get(name);
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}