@coderook/cli 0.25.3 → 0.26.0

package/dist/desktop-app/src/main/secret_patterns.js

@@ -23,6 +23,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CREDENTIAL_PATTERNS = void 0;
 exports.looksLikePlaceholder = looksLikePlaceholder;
 exports.findCredentials = findCredentials;
+exports.maskCredentials = maskCredentials;
+exports.maskAssignedValues = maskAssignedValues;
 exports.worthReading = worthReading;
 exports.looksLikeText = looksLikeText;
 /*
@@ -262,6 +264,78 @@ function findCredentials(text) {
     }
     return found.sort((left, right) => left.line - right.line);
 }
+/**
+ * The same text with any credential in it covered over.
+ *
+ * Used where a file's contents are about to be shown rather than scanned —
+ * the diff pane being the case that mattered. The upload warning is careful
+ * never to repeat a key back, and the pane behind it was printing one in
+ * full, so the same window both refused to show a credential and showed one.
+ *
+ * The prefix survives, because it names the service and is not the secret,
+ * and it is what makes the line recognisable as the one to go and fix. The
+ * rest becomes bullets of the same length, so nothing about the shape of the
+ * value is lost except the value.
+ *
+ * Deliberately built on the same patterns and the same placeholder rule as
+ * `findCredentials`: if the two disagreed, the pane would either cover
+ * something the warning ignored or reveal something it flagged.
+ */
+function maskCredentials(text) {
+    const claimed = [];
+    for (const pattern of exports.CREDENTIAL_PATTERNS) {
+        const expression = new RegExp(pattern.match.source, pattern.match.flags);
+        for (const match of text.matchAll(expression)) {
+            const at = match.index ?? 0;
+            const to = at + match[0].length;
+            if (claimed.some(([from, until]) => at < until && to > from))
+                continue;
+            if (looksLikePlaceholder(match[0]))
+                continue;
+            const value = match[0];
+            const keep = value.slice(0, 7);
+            claimed.push([at, to, `${keep}${"•".repeat(Math.max(3, value.length - 7))}`]);
+        }
+    }
+    if (!claimed.length)
+        return text;
+    claimed.sort((left, right) => left[0] - right[0]);
+    let out = "";
+    let cursor = 0;
+    for (const [at, to, replacement] of claimed) {
+        out += text.slice(cursor, at) + replacement;
+        cursor = to;
+    }
+    return out + text.slice(cursor);
+}
+/**
+ * Every assigned value in a line covered over, whatever shape it is.
+ *
+ * For files that are credentials by their name rather than by their
+ * contents. A `.env` holds `TOKEN=<32 random characters>`: it matches no
+ * service's format, so the pattern scan cannot see it, and the only thing
+ * saying it is a secret is the file it is sitting in. In that file every
+ * value is treated as one.
+ *
+ * The name is kept and the value goes. Which keys are set is the useful part
+ * of the diff — that a line was added, and which setting it was — and none
+ * of that requires showing what it was set to.
+ *
+ * A comment is left alone: it is prose, and blanking it makes the file
+ * unreadable for no gain.
+ */
+function maskAssignedValues(text) {
+    const trimmed = text.trimStart();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("//")) {
+        return text;
+    }
+    return text.replace(/^(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]\s*)(\S.*)$/, (_whole, head, value) => {
+        const bare = value.replace(/^["']|["']$/g, "");
+        if (!bare)
+            return text;
+        return `${head}${"•".repeat(Math.min(24, Math.max(3, bare.length)))}`;
+    });
+}
 /*
   Extensions worth reading. Everything else is either compiled, compressed, or
   media — a credential in a JPEG is not a case worth slowing every upload for,
@@ -293,6 +367,7 @@ const READABLE = new Set([
     ".groovy",
     ".h",
     ".hpp",
+    ".hcl",
     ".hs",
     ".htm",
     ".html",

package/dist/desktop-app/src/main/tracks.js

@@ -54,6 +54,64 @@ class Tracks {
         }
         return (text ? JSON.parse(text) : {});
     }
+    /**
+     * A project's saves, as the owner sees them.
+     *
+     * Every one of them, including the ones held for review and the ones whose
+     * files were taken down — this is the working history, not the published
+     * one, and the whole point of showing it here is deciding what becomes
+     * published.
+     */
+    async versions(repositoryId) {
+        const body = await this.call(`/v1/repositories/${repositoryId}/versions`);
+        return body.versions ?? [];
+    }
+    async labels(repositoryId) {
+        const body = await this.call(`/v1/repositories/${repositoryId}/labels`);
+        return body.labels ?? [];
+    }
+    async createLabel(repositoryId, name, colour) {
+        const body = await this.call(`/v1/repositories/${repositoryId}/labels`, { method: "POST", body: JSON.stringify({ name, colour }) });
+        return body.label;
+    }
+    async reviewVersion(repositoryId, versionId, decision, note) {
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/review`, {
+            method: "POST",
+            body: JSON.stringify({ decision, ...(note ? { note } : {}) }),
+        });
+    }
+    async takeVersionDown(repositoryId, versionId, reason) {
+        const query = reason ? `?reason=${encodeURIComponent(reason)}` : "";
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/content${query}`, { method: "DELETE" });
+    }
+    /** Put the project back on an earlier save. Nothing is deleted. */
+    async undo(repositoryId, to) {
+        return await this.call(`/v1/repositories/${repositoryId}/undo`, {
+            method: "POST",
+            body: JSON.stringify(to ? { to } : {}),
+        });
+    }
+    /** Publish an older save's content again, as a new save. */
+    async restoreVersion(repositoryId, versionId, message) {
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/restore`, {
+            method: "POST",
+            body: JSON.stringify({ message }),
+        });
+    }
+    /**
+     * Everything about a version, changed in one call.
+     *
+     * Named, hidden, pinned or labelled from the desktop app for the first time.
+     * All three clients call the same route with the same patch, which is what
+     * stops the next capability being reachable from one of them and not the
+     * others.
+     */
+    async changeVersion(repositoryId, versionId, patch) {
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}`, {
+            method: "PATCH",
+            body: JSON.stringify(patch),
+        });
+    }
     /**
      * Every line and merge this project has.
      *

package/dist/desktop-app/src/main/upload.js

@@ -1162,6 +1162,7 @@ class Uploader {
                     : { expectedHeadVersionId: request.expectedHeadVersionId }),
                 ...(request.track ? { track: request.track } : {}),
                 ...(request.allowIgnored ? { allowIgnored: true } : {}),
+                ...(request.allowSecrets ? { allowSecrets: true } : {}),
                 /*
                   Names this attempt so a retry after a lost connection is answered
                   with the version already made, rather than making a second one.
@@ -1232,6 +1233,7 @@ class Uploader {
             repositoryId,
             versionId: completed.version.id,
             sequence: completed.version.sequence,
+            ...(completed.version.state === "held" ? { held: true } : {}),
             ...(completed.mergeTrack ? { mergeTrack: completed.mergeTrack } : {}),
             ...(completed.repeated ? { repeated: true } : {}),
             sourceBytes: completed.version.sourceSize ?? sourceBytes,

package/dist/desktop-app/src/main/worktree.js

@@ -21,6 +21,7 @@ exports.evaluateRules = evaluateRules;
 exports.detectPrivateDirectories = detectPrivateDirectories;
 exports.detectPastedCredentials = detectPastedCredentials;
 exports.uploadConcerns = uploadConcerns;
+exports.isCredentialByName = isCredentialByName;
 exports.detectSecrets = detectSecrets;
 /** Reading a project folder: changed files, diffs, and rule measurement. */
 const node_child_process_1 = require("node:child_process");
@@ -54,49 +55,49 @@ async function git(root, ...args) {
  * file would produce an incomplete project that looked backed up, so likely
  * secrets are warned about instead (docs/UPLOAD_POLICY.md).
  */
-exports.STARTER_IGNORE = `# Dependencies and generated output
-node_modules/
-dist/
-build/
-out/
-.next/
-target/
-__pycache__/
-.venv/
-venv/
-*.log
-
-# Large model weights
-models/**
-*.safetensors
-*.ckpt
-*.pt
-*.pth
-
-# Caches and local state
-.venv/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.cache/
-*.pyc
-
-# A browser or Electron profile that has been left in the project folder.
-# These hold files another program keeps open — a LOCK that cannot be read
-# while it runs will stop a save outright — and nothing in them is the work.
-IndexedDB/
-Local Storage/
-Session Storage/
-Service Worker/
-Network/
-GPUCache/
-Code Cache/
-blob_storage/
-Local State
-Preferences
-
-# Archives of the project, inside the project
-*.cbx
+exports.STARTER_IGNORE = `# Dependencies and generated output
+node_modules/
+dist/
+build/
+out/
+.next/
+target/
+__pycache__/
+.venv/
+venv/
+*.log
+
+# Large model weights
+models/**
+*.safetensors
+*.ckpt
+*.pt
+*.pth
+
+# Caches and local state
+.venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.cache/
+*.pyc
+
+# A browser or Electron profile that has been left in the project folder.
+# These hold files another program keeps open — a LOCK that cannot be read
+# while it runs will stop a save outright — and nothing in them is the work.
+IndexedDB/
+Local Storage/
+Session Storage/
+Service Worker/
+Network/
+GPUCache/
+Code Cache/
+blob_storage/
+Local State
+Preferences
+
+# Archives of the project, inside the project
+*.cbx
 `;
 /** The shared rules file, committed with the project. */
 exports.IGNORE_FILE = ".gitignore";
@@ -508,6 +509,21 @@ async function fileSizes(root, files) {
 /** The unified diff for one file, including files git does not track yet. */
 async function fileDiff(root, file, ignoreWhitespace = false) {
     const output = await git(root, "diff", "--no-ext-diff", "--unified=3", ...(ignoreWhitespace ? ["--ignore-all-space"] : []), "--", file);
+    /*
+      What leaves this function is what the window will show, so a credential
+      is covered here rather than in the pane.
+  
+      Masking in the renderer would still have sent the key to the window,
+      where a screenshot, the developer tools or an accidental copy all reach
+      it. Not sending it is the only version of this that actually holds.
+  
+      Two rules, because there are two kinds. A key pasted into ordinary source
+      is recognised by its own format. A `.env` is not — its contents match no
+      service's shape — and is recognised only by the name of the file, so
+      everything after the first `=` on a line goes.
+    */
+    const named = isCredentialByName(file);
+    const cover = (text) => named ? (0, secret_patterns_js_1.maskAssignedValues)(text) : (0, secret_patterns_js_1.maskCredentials)(text);
     const hunks = [];
     let current = null;
     let oldLine = 0;
@@ -532,7 +548,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                 kind: "add",
                 number: newLine++,
                 oldNumber: null,
-                text: raw.slice(1),
+                text: cover(raw.slice(1)),
             });
         }
         else if (raw.startsWith("-")) {
@@ -540,7 +556,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                 kind: "del",
                 number: oldLine,
                 oldNumber: oldLine++,
-                text: raw.slice(1),
+                text: cover(raw.slice(1)),
             });
         }
         else if (raw.startsWith(" ")) {
@@ -548,7 +564,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                 kind: "ctx",
                 number: newLine,
                 oldNumber: oldLine,
-                text: raw.slice(1),
+                text: cover(raw.slice(1)),
             });
             oldLine += 1;
             newLine += 1;
@@ -570,7 +586,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                     kind: "add",
                     number: index + 1,
                     oldNumber: null,
-                    text,
+                    text: cover(text),
                 })),
             },
         ];
@@ -975,6 +991,22 @@ async function uploadConcerns(root, include) {
     };
 }
 /** Files the flow must ask about before the first upload. */
+/**
+ * Whether this path is a credential by its name alone.
+ *
+ * Pulled out of `detectSecrets` so the diff can ask the same question the
+ * upload warning asks. A `.env` holds `TOKEN=<32 random characters>`, which
+ * matches no service's format and so is invisible to the pattern scan — the
+ * only thing that identifies it is the name of the file it is sitting in.
+ */
+function isCredentialByName(relativePath) {
+    const parts = relativePath.split("/");
+    const name = (parts[parts.length - 1] ?? "").toLowerCase();
+    return (SECRET_NAMES.has(name) ||
+        name.startsWith(".env.") ||
+        SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
+        parts.slice(0, -1).includes("secrets"));
+}
 async function detectSecrets(root) {
     const found = [];
     const pending = [root];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.25.3",
+  "version": "0.26.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -81,6 +81,28 @@ cbx submit --track spike -m "…"
 Switching says where the next save goes and nothing else — no files move.
 Run `cbx get` afterwards to bring that line's files in.
 
+## Versions, and going back
+
+Every save is a commit. A commit becomes a *version* — the thing the public
+side of a project offers, and the thing a collaborator pulls — only when
+somebody promotes it.
+
+```bash
+cbx promote                    # pick from the last ten and name one
+cbx mark 41 --pin              # pin, hide, rename or label one save
+cbx labels add shipped green   # the labels a project can wear
+cbx undo                       # put the project back on the save before this one
+```
+
+`undo` moves where the project stands. Nothing is deleted and nothing is
+renumbered — the saves passed over stay in the history, and the next save
+carries on from wherever it now stands. It is the answer to "I pushed the
+wrong thing"; hiding a version stops strangers reading it but leaves the
+project standing on it, so the next person to pull still lands on the mistake.
+
+**Ask before `undo`, `promote` and `take-down`.** They change what other
+people see. `cbx versions` first, so the person can say which save they mean.
+
 ## When two saves collide
 
 If somebody saved while this folder was behind, the second save becomes a merge
@@ -121,6 +143,8 @@ cbx unbundle project.cbx ./restored
   again and gains nothing.
 - Do not guess a project name. `cbx projects` lists them; a folder that is
   already linked needs no name at all.
+- Do not run `cbx take-down`. It destroys the files in a version and they do
+  not come back. Say it exists and let its owner run it.
 
 ## If something refuses