@coderook/cli 0.25.4 → 0.27.0

package/dist/desktop-app/src/main/download.js

@@ -229,6 +229,7 @@ class Downloader {
                 ...(row.objectId ? { objectId: String(row.objectId) } : {}),
                 sha256: String(row.sha256 ?? ""),
                 sourceSize: Number(row.sourceSize ?? 0),
+                ...(row.sealed === true ? { sealed: true } : {}),
                 ...(packed?.objectId
                     ? {
                         pack: {
@@ -298,7 +299,7 @@ class Downloader {
         const packed = new Map();
         for (const file of files) {
             const id = file.pack?.objectId;
-            if (!id)
+            if (!id || file.sealed)
                 continue;
             const group = packed.get(id) ?? [];
             group.push(file);
@@ -323,7 +324,7 @@ class Downloader {
             for (const file of files) {
                 this.check();
                 progress(file.path);
-                const packId = file.pack?.objectId;
+                const packId = file.sealed ? undefined : file.pack?.objectId;
                 if (packId && restoredPacks.has(packId))
                     continue;
                 if (packId) {
@@ -372,7 +373,14 @@ class Downloader {
     }
     async fetchInto(repositoryId, versionId, file, target) {
         const whole = (0, node_crypto_1.createHash)("sha256");
-        const pieces = file.chunks ?? [];
+        /*
+          A sealed file is read whole, by path, whatever shape it is stored in.
+    
+          Its pieces and its object are the covered bytes; only the per-path route
+          puts the real value back. Reading it any other way fetches something
+          that cannot match the digest this file was listed with.
+        */
+        const pieces = file.sealed ? [] : (file.chunks ?? []);
         // Captured so the generators below do not need `this` rebound.
         const request = (route) => this.request(route);
         const check = () => this.check();
@@ -399,7 +407,7 @@ class Downloader {
                 }
             })()
             : (async function* () {
-                const reply = await request(file.objectId
+                const reply = await request(file.objectId && !file.sealed
                     ? `/v1/repositories/${repositoryId}/objects/${file.objectId}`
                     : `/v1/repositories/${repositoryId}/versions/${versionId}/file` +
                         `?path=${encodeURIComponent(file.path)}`);
@@ -456,7 +464,8 @@ class Downloader {
             let bytes = 0;
             const packed = new Map();
             for (const file of files) {
-                const id = file.pack?.objectId;
+                /* Sealed members never come out of the pack — see `sealed` above. */
+                const id = file.sealed ? undefined : file.pack?.objectId;
                 if (!id)
                     continue;
                 const group = packed.get(id) ?? [];
@@ -479,7 +488,7 @@ class Downloader {
                 if (parts.some((part) => part === ".." || part.includes("\0"))) {
                     throw new Error(`That version contains an unsafe path: ${file.path}`);
                 }
-                const packId = file.pack?.objectId;
+                const packId = file.sealed ? undefined : file.pack?.objectId;
                 if (packId && restoredPacks.has(packId))
                     continue;
                 if (packId) {

package/dist/desktop-app/src/main/secret_patterns.js

@@ -367,6 +367,7 @@ const READABLE = new Set([
     ".groovy",
     ".h",
     ".hpp",
+    ".hcl",
     ".hs",
     ".htm",
     ".html",

package/dist/desktop-app/src/main/tracks.js

@@ -54,6 +54,82 @@ class Tracks {
         }
         return (text ? JSON.parse(text) : {});
     }
+    /**
+     * A project's saves, as the owner sees them.
+     *
+     * Every one of them, including the ones held for review and the ones whose
+     * files were taken down — this is the working history, not the published
+     * one, and the whole point of showing it here is deciding what becomes
+     * published.
+     */
+    async versions(repositoryId) {
+        const body = await this.call(`/v1/repositories/${repositoryId}/versions`);
+        return body.versions ?? [];
+    }
+    /**
+     * What the account says about this project, as distinct from this folder.
+     *
+     * The local record knows where a folder saves to and nothing about how the
+     * project is published — so the history window could show which saves were
+     * public without being able to say whether the project itself was, which is
+     * the half that decides whether anybody can reach them.
+     */
+    async project(repositoryId) {
+        try {
+            const body = await this.call(`/v1/repositories/${repositoryId}`);
+            return { visibility: body.visibility ?? null };
+        }
+        catch {
+            /* Not knowing is not worth failing the window for. */
+            return { visibility: null };
+        }
+    }
+    async labels(repositoryId) {
+        const body = await this.call(`/v1/repositories/${repositoryId}/labels`);
+        return body.labels ?? [];
+    }
+    async createLabel(repositoryId, name, colour) {
+        const body = await this.call(`/v1/repositories/${repositoryId}/labels`, { method: "POST", body: JSON.stringify({ name, colour }) });
+        return body.label;
+    }
+    async reviewVersion(repositoryId, versionId, decision, note) {
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/review`, {
+            method: "POST",
+            body: JSON.stringify({ decision, ...(note ? { note } : {}) }),
+        });
+    }
+    async takeVersionDown(repositoryId, versionId, reason) {
+        const query = reason ? `?reason=${encodeURIComponent(reason)}` : "";
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/content${query}`, { method: "DELETE" });
+    }
+    /** Put the project back on an earlier save. Nothing is deleted. */
+    async undo(repositoryId, to) {
+        return await this.call(`/v1/repositories/${repositoryId}/undo`, {
+            method: "POST",
+            body: JSON.stringify(to ? { to } : {}),
+        });
+    }
+    /** Publish an older save's content again, as a new save. */
+    async restoreVersion(repositoryId, versionId, message) {
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/restore`, {
+            method: "POST",
+            body: JSON.stringify({ message }),
+        });
+    }
+    /**
+     * Everything about a version, changed in one call.
+     *
+     * Named, hidden, pinned or labelled from the desktop app for the first time.
+     * All three clients call the same route with the same patch, which is what
+     * stops the next capability being reachable from one of them and not the
+     * others.
+     */
+    async changeVersion(repositoryId, versionId, patch) {
+        await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}`, {
+            method: "PATCH",
+            body: JSON.stringify(patch),
+        });
+    }
     /**
      * Every line and merge this project has.
      *

package/dist/desktop-app/src/main/upload.js

@@ -1163,6 +1163,10 @@ class Uploader {
                 ...(request.track ? { track: request.track } : {}),
                 ...(request.allowIgnored ? { allowIgnored: true } : {}),
                 ...(request.allowSecrets ? { allowSecrets: true } : {}),
+                ...(request.linesAdded === undefined ? {} : { linesAdded: request.linesAdded }),
+                ...(request.linesRemoved === undefined
+                    ? {}
+                    : { linesRemoved: request.linesRemoved }),
                 /*
                   Names this attempt so a retry after a lost connection is answered
                   with the version already made, rather than making a second one.
@@ -1233,6 +1237,7 @@ class Uploader {
             repositoryId,
             versionId: completed.version.id,
             sequence: completed.version.sequence,
+            ...(completed.version.state === "held" ? { held: true } : {}),
             ...(completed.mergeTrack ? { mergeTrack: completed.mergeTrack } : {}),
             ...(completed.repeated ? { repeated: true } : {}),
             sourceBytes: completed.version.sourceSize ?? sourceBytes,

package/dist/desktop-app/src/main/worktree.js

@@ -999,9 +999,26 @@ async function uploadConcerns(root, include) {
  * matches no service's format and so is invisible to the pattern scan — the
  * only thing that identifies it is the name of the file it is sitting in.
  */
+/**
+ * The `.env.<something>` files that exist to be committed.
+ *
+ * `.env.example` is the file a project is *supposed* to publish — it is the
+ * documentation of which variables exist, with the values left empty. Refusing
+ * to send it, and then advising it be added to .gitignore, is advice that
+ * breaks the project for the next person who clones it.
+ *
+ * The same list the service uses when it decides what to cover, so a file is
+ * not a template in one half of the system and a credential in the other.
+ */
+const TEMPLATE_SUFFIXES = [".example", ".sample", ".template", ".dist", ".defaults"];
+function isTemplateName(name) {
+    return TEMPLATE_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
 function isCredentialByName(relativePath) {
     const parts = relativePath.split("/");
     const name = (parts[parts.length - 1] ?? "").toLowerCase();
+    if (isTemplateName(name))
+        return false;
     return (SECRET_NAMES.has(name) ||
         name.startsWith(".env.") ||
         SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
@@ -1032,14 +1049,15 @@ async function detectSecrets(root) {
                 continue;
             }
             seen += 1;
-            const name = entry.name.toLowerCase();
-            const isSecret = SECRET_NAMES.has(name) ||
-                name.startsWith(".env.") ||
-                SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
-                node_path_1.default.relative(root, directory).split(node_path_1.default.sep).includes("secrets");
-            if (isSecret) {
-                found.push(node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/"));
-            }
+            /*
+              Asked of the one function rather than repeated here. These were two
+              copies of the same rule, which is how `.env.example` came to be
+              refused by the command line long after the service had learned that
+              templates are not credentials.
+            */
+            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
+            if (isCredentialByName(relative))
+                found.push(relative);
         }
     }
     return found;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.25.4",
+  "version": "0.27.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -81,6 +81,28 @@ cbx submit --track spike -m "…"
 Switching says where the next save goes and nothing else — no files move.
 Run `cbx get` afterwards to bring that line's files in.
 
+## Versions, and going back
+
+Every save is a commit. A commit becomes a *version* — the thing the public
+side of a project offers, and the thing a collaborator pulls — only when
+somebody promotes it.
+
+```bash
+cbx promote                    # pick from the last ten and name one
+cbx mark 41 --pin              # pin, hide, rename or label one save
+cbx labels add shipped green   # the labels a project can wear
+cbx undo                       # put the project back on the save before this one
+```
+
+`undo` moves where the project stands. Nothing is deleted and nothing is
+renumbered — the saves passed over stay in the history, and the next save
+carries on from wherever it now stands. It is the answer to "I pushed the
+wrong thing"; hiding a version stops strangers reading it but leaves the
+project standing on it, so the next person to pull still lands on the mistake.
+
+**Ask before `undo`, `promote` and `take-down`.** They change what other
+people see. `cbx versions` first, so the person can say which save they mean.
+
 ## When two saves collide
 
 If somebody saved while this folder was behind, the second save becomes a merge
@@ -121,6 +143,8 @@ cbx unbundle project.cbx ./restored
   again and gains nothing.
 - Do not guess a project name. `cbx projects` lists them; a folder that is
   already linked needs no name at all.
+- Do not run `cbx take-down`. It destroys the files in a version and they do
+  not come back. Say it exists and let its owner run it.
 
 ## If something refuses