@coderook/cli 0.26.0 → 0.28.0

package/dist/cli/src/project_commands.js

@@ -131,10 +131,39 @@ async function commandVersions(parsed) {
         console.log(dim("Nothing has been saved to this project yet."));
         return 0;
     }
+    /*
+      The same two lanes the website shows.
+  
+      A version is a commit somebody named, so the lanes are a split of one
+      history rather than two histories — asking for commits gives the saves
+      still waiting on that decision, and asking for versions gives the ones
+      the public side can see. Neither contains the other; with no flag you get
+      both, which is what this always did.
+    */
+    const onlyVersions = parsed.flags.get("versions") === true;
+    const onlyCommits = parsed.flags.get("commits") === true;
+    if (onlyVersions && onlyCommits) {
+        console.error(red("Pick one: --versions or --commits, or neither for both."));
+        return 1;
+    }
+    const lane = saved.filter((version) => {
+        if (onlyVersions)
+            return Boolean(version.name);
+        if (onlyCommits)
+            return !version.name;
+        return true;
+    });
+    if (!lane.length) {
+        console.log(dim(onlyVersions
+            ? "Nothing has been made a version yet."
+            : "Every save here has been made a version."));
+        return 0;
+    }
+    const withNotes = parsed.flags.get("notes") === true;
     const asked = Number(parsed.flags.get("limit") ?? 20);
     const limit = Number.isFinite(asked) && asked > 0 ? asked : 20;
     console.log(bold(project.name));
-    for (const version of saved.slice(0, limit)) {
+    for (const version of lane.slice(0, limit)) {
         const when = version.createdAt
             ? new Date(version.createdAt).toLocaleString()
             : "";
@@ -155,8 +184,11 @@ async function commandVersions(parsed) {
             version.state === "held" ? red("held") : "",
             version.state === "declined" ? dim("declined") : "",
             version.removedAt ? dim("taken down") : "",
-            version.visibility === "private" ? dim("private") : "",
-            version.visibility === "unlisted" ? dim("link only") : "",
+            /*
+              Said only of a version, because only a version is offered to anybody.
+              A commit nobody has promoted is not hidden — it was never on offer.
+            */
+            version.name && version.visibility === "private" ? dim("hidden") : "",
             ...version.labels.map((label) => accent(label.name)),
         ].filter(Boolean);
         console.log(`  ${accent(`v${version.sequence}`).padEnd(16)} ${when.padEnd(22)}` +
@@ -164,9 +196,18 @@ async function commandVersions(parsed) {
             (marks.length ? `  ${marks.join(" ")}` : ""));
         if (version.message)
             console.log(`    ${dim(version.message)}`);
+        /*
+          Indented under the save it belongs to rather than printed flat, so a
+          note of several paragraphs still reads as part of one row.
+        */
+        if (withNotes && version.notes?.trim()) {
+            for (const line of version.notes.trim().split(/\r?\n/)) {
+                console.log(`      ${line}`);
+            }
+        }
     }
-    if (saved.length > limit) {
-        console.log(dim(`  … ${saved.length - limit} older. Use --limit to see more.`));
+    if (lane.length > limit) {
+        console.log(dim(`  … ${lane.length - limit} older. Use --limit to see more.`));
     }
     return 0;
 }

package/dist/cli/src/service_commands.js

@@ -21,6 +21,7 @@ exports.commandRuns = commandRuns;
 exports.commandLogs = commandLogs;
 exports.commandTokens = commandTokens;
 exports.commandDelete = commandDelete;
+exports.commandHooks = commandHooks;
 const node_process_1 = __importDefault(require("node:process"));
 const promises_1 = require("node:readline/promises");
 const api_js_1 = require("./api.js");
@@ -51,11 +52,47 @@ async function commandIssues(parsed) {
     }
     if (typeof title === "string" && title.trim()) {
         const body = parsed.flags.get("body");
+        /*
+          Labels at the moment it is opened, rather than in a second command
+          afterwards. The service has always taken them here; nothing had ever
+          sent any, so every issue arrived unlabelled and the label filter on the
+          website had nothing to filter by until somebody went back and tidied.
+        */
+        const named = parsed.flags.get("labels");
+        const labels = typeof named === "string"
+            ? named
+                .split(",")
+                .map((one) => one.trim())
+                .filter(Boolean)
+            : [];
+        /*
+          And which save it is about, when it is about one. "It broke" and "it
+          broke in v41" are different reports, and only the first could be
+          written down.
+        */
+        const about = parsed.flags.get("version");
+        let versionId;
+        if (typeof about === "string" && about.trim()) {
+            const wanted = about.trim().replace(/^v/i, "");
+            const all = await (0, api_js_1.versions)(project.id);
+            const found = all.find((one) => String(one.sequence) === wanted);
+            if (!found) {
+                console.error(red(`${project.name} has no version ${about.trim()}.`));
+                return 1;
+            }
+            versionId = found.id;
+        }
         const created = await (0, api_js_1.createIssue)(project.id, {
             title: title.trim(),
             body: typeof body === "string" ? body : "",
+            labels,
+            ...(versionId ? { versionId } : {}),
         });
         console.log(green(`Opened issue #${created.number} on ${project.name}.`));
+        if (labels.length)
+            console.log(dim(`  labelled ${labels.join(", ")}`));
+        if (versionId)
+            console.log(dim(`  about v${about}`));
         return 0;
     }
     const found = await (0, api_js_1.issues)(project.id);
@@ -216,10 +253,67 @@ async function commandWatch(parsed) {
 }
 /** The automations a project has, and how they have been going. */
 async function commandWorkflows(parsed) {
-    const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[0]);
+    const project = await (0, project_commands_js_1.resolveProject)(typeof parsed.flags.get("project") === "string"
+        ? String(parsed.flags.get("project"))
+        : parsed.positional[0]);
     if (!project)
         return 1;
     const found = (await (0, api_js_1.workflows)(project.id)).filter((workflow) => !workflow.archivedAt);
+    /*
+      Setting, before printing. `cbx actions --ship Build` reads as a sentence
+      and then shows the list it has just changed, which is the same shape
+      `cbx notes` uses: one command, print by default, flags to write.
+    */
+    const ship = parsed.flags.get("ship");
+    const stop = parsed.flags.get("no-ship");
+    if (ship !== undefined || stop !== undefined) {
+        const wanted = ship !== undefined;
+        const named = wanted ? ship : stop;
+        if (typeof named !== "string" || !named.trim()) {
+            console.error(red("Which action?") + dim(`  cbx actions ${wanted ? "--ship" : "--no-ship"} "Build"`));
+            return 1;
+        }
+        const target = found.find((workflow) => workflow.name.toLowerCase() === named.trim().toLowerCase());
+        if (!target) {
+            console.error(red(`${project.name} has no action called ${named.trim()}.`));
+            if (found.length) {
+                console.error(dim(`  It has: ${found.map((one) => one.name).join(", ")}`));
+            }
+            return 1;
+        }
+        if (wanted && !target.artifactPaths.length) {
+            /*
+              Refused rather than set. Shipping what a run collected means nothing
+              when the run collects nothing, and a flag that reported success and
+              then never produced a download would be indistinguishable from the
+              feature being broken.
+            */
+            console.error(red(`${target.name} keeps no files, so it has nothing to ship.`));
+            console.error(dim("  Give it something to keep on the Actions screen first, e.g. dist/*.exe"));
+            return 1;
+        }
+        try {
+            await (0, api_js_1.changeWorkflow)(project.id, target.id, { attachArtifacts: wanted });
+        }
+        catch (error) {
+            console.error(red(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        target.attachArtifacts = wanted;
+        console.log(wanted
+            ? green(`${target.name} will attach what it builds to the version it ran against.`)
+            : green(`${target.name} will keep its files without attaching them.`));
+        if (wanted) {
+            /*
+              Said plainly, because attaching is publishing. An attachment on a
+              public version is a download anybody can take, and somebody turning
+              this on for a workflow that builds an internal tool deserves to hear
+              that before the next run rather than after it.
+            */
+            console.log(dim("  Anything it attaches to a public version is public the moment it lands."));
+        }
+        console.log("");
+    }
     if (!found.length) {
         console.log(dim("No actions on this project."));
         return 0;
@@ -232,6 +326,12 @@ async function commandWorkflows(parsed) {
         console.log(`  ${workflow.name.padEnd(24)} ${dim(workflow.trigger).padEnd(20)} ` +
             `${dim(workflow.runsOn).padEnd(18)} ${health}`);
         console.log(`    ${dim(workflow.command)}`);
+        if (workflow.artifactPaths.length) {
+            console.log(`    ${dim("keeps")} ${dim(workflow.artifactPaths.join(", "))}` +
+                (workflow.attachArtifacts
+                    ? ` ${accent("→ downloads on the version")}`
+                    : ""));
+        }
     }
     return 0;
 }
@@ -399,3 +499,103 @@ async function commandDelete(parsed) {
     console.log(green(`Deleted ${project.name}.`));
     return 0;
 }
+/**
+ * Where a project tells something else that something happened.
+ *
+ * The service has been able to do this since Merge Tracks shipped — queue an
+ * event, sign it, deliver it after the request that caused it — and nothing
+ * could reach it. A project could not be told to notify a build box, a chat
+ * room or a status page, because no client asked.
+ */
+async function commandHooks(parsed) {
+    const project = await (0, project_commands_js_1.resolveProject)(typeof parsed.flags.get("project") === "string"
+        ? String(parsed.flags.get("project"))
+        : parsed.positional[0]);
+    if (!project)
+        return 1;
+    const adding = parsed.flags.get("add");
+    if (adding !== undefined) {
+        if (typeof adding !== "string" || !adding.trim()) {
+            console.error(red("Which address?") + dim("  cbx hooks --add https://example.com/hook"));
+            return 1;
+        }
+        const url = adding.trim();
+        if (!/^https:\/\//i.test(url)) {
+            /*
+              Refused here as well as by the service. A webhook carries a signed
+              payload about a private project, and http would put it on the wire in
+              the clear — worth saying before the round trip rather than after.
+            */
+            console.error(red("A webhook address has to be https."));
+            return 1;
+        }
+        const named = parsed.flags.get("events");
+        const events = typeof named === "string"
+            ? named.split(",").map((one) => one.trim()).filter(Boolean)
+            : [];
+        try {
+            const made = await (0, api_js_1.addWebhook)(project.id, url, events);
+            console.log(green(`${project.name} will notify ${url}.`));
+            console.log("");
+            /*
+              Printed once because it exists once. The service generates it and no
+              route ever hands it back, so this is the only moment anybody can
+              write it down — and saying so is the difference between a person
+              copying it and a person losing it.
+            */
+            console.log(`  ${bold("Signing secret")}  ${made.secret}`);
+            console.log(dim("  Written once and never again. Use it to check the signature on"));
+            console.log(dim("  what arrives, so nobody else can post to your endpoint."));
+            if (events.length)
+                console.log(dim(`  Sending: ${events.join(", ")}`));
+            else
+                console.log(dim("  Sending: everything this project announces"));
+        }
+        catch (error) {
+            console.error(red(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        return 0;
+    }
+    const removing = parsed.flags.get("remove");
+    if (removing !== undefined) {
+        if (typeof removing !== "string" || !removing.trim()) {
+            console.error(red("Which one?") + dim("  cbx hooks --remove <id>"));
+            return 1;
+        }
+        const wanted = removing.trim();
+        const found = (await (0, api_js_1.webhooks)(project.id)).find((one) => one.id === wanted || one.url === wanted);
+        if (!found) {
+            console.error(red(`${project.name} has no webhook called ${wanted}.`));
+            return 1;
+        }
+        await (0, api_js_1.removeWebhook)(project.id, found.id);
+        console.log(green(`${found.url} will not be notified any more.`));
+        return 0;
+    }
+    const found = await (0, api_js_1.webhooks)(project.id);
+    if (!found.length) {
+        console.log(dim("This project notifies nothing."));
+        console.log(dim("  cbx hooks --add https://example.com/coderook"));
+        return 0;
+    }
+    console.log(bold(project.name));
+    for (const hook of found) {
+        /*
+          A run of failures shown rather than hidden. A webhook that has been
+          failing for a week looks exactly like one that works until somebody
+          checks the receiving end, which is the wrong place to find out.
+        */
+        const health = !hook.active
+            ? red("off")
+            : hook.consecutiveFailures
+                ? red(`${hook.consecutiveFailures} failed in a row`)
+                : hook.lastDeliveredAt
+                    ? green("delivering")
+                    : dim("nothing sent yet");
+        console.log(`  ${hook.url}`);
+        console.log(`    ${dim(hook.id)}  ${health}` +
+            (hook.events.length ? `  ${dim(hook.events.join(", "))}` : `  ${dim("everything")}`));
+    }
+    return 0;
+}

package/dist/cli/src/version_commands.js

@@ -16,6 +16,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.split = split;
+exports.commandNotes = commandNotes;
 exports.commandVersion = commandVersion;
 exports.commandLabels = commandLabels;
 exports.commandHeld = commandHeld;
@@ -26,6 +27,10 @@ exports.commandUndo = commandUndo;
 const api_js_1 = require("./api.js");
 const project_commands_js_1 = require("./project_commands.js");
 const promises_1 = require("node:readline/promises");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
 /* Written out rather than imported: the same four escapes every other command
    file in here declares for itself, and a shared module for four one-line
@@ -34,6 +39,7 @@ const dim = (value) => `${value}`;
 const bold = (value) => `${value}`;
 const red = (value) => `${value}`;
 const accent = (value) => `${value}`;
+const green = (value) => `${value}`;
 /**
  * Which of `[n] [project]` the arguments actually were.
  *
@@ -112,6 +118,148 @@ function colourOf(given) {
 function paint(label) {
     return accent(label.name);
 }
+/**
+ * Release info, from wherever the writer keeps it.
+ *
+ * `--notes "..."` is fine for a sentence and hopeless for anything real: a
+ * release note has paragraphs and lists in it, and the shell trick people
+ * reach for — `--notes "$(cat NOTES.md)"` — is not a thing in PowerShell or
+ * cmd, which is most of this product's users. So the text can come from a
+ * file, or from the editor already set up for writing commit messages.
+ *
+ * Returns undefined when none of them were asked for, which is different from
+ * an empty string: one means leave it alone, the other means clear it.
+ */
+function notesFrom(parsed) {
+    const inline = parsed.flags.get("notes");
+    const file = parsed.flags.get("notes-file");
+    const edit = parsed.flags.get("edit") === true;
+    const chosen = [
+        typeof inline === "string",
+        typeof file === "string",
+        edit,
+    ].filter(Boolean).length;
+    if (chosen > 1) {
+        throw new Error("Use one of --notes, --notes-file or --edit, not several.");
+    }
+    if (typeof inline === "string")
+        return inline;
+    if (typeof file === "string") {
+        try {
+            return (0, node_fs_1.readFileSync)(file, "utf8");
+        }
+        catch {
+            throw new Error(`Could not read ${file}.`);
+        }
+    }
+    /*
+      --edit is answered by the caller, which has the existing text to seed the
+      editor with. Nothing to report from here.
+    */
+    return undefined;
+}
+/**
+ * Write in the editor this person already uses, the way git does.
+ *
+ * The comment lines are stripped, so the instructions at the bottom of the
+ * file cannot end up published as part of the release. Quitting without
+ * saving leaves the notes untouched rather than clearing them, because an
+ * empty buffer is far more often a change of mind than an instruction.
+ */
+function writeInEditor(existing) {
+    const editor = node_process_1.default.env.CODEROOK_EDITOR ??
+        node_process_1.default.env.VISUAL ??
+        node_process_1.default.env.EDITOR ??
+        (node_process_1.default.platform === "win32" ? "notepad" : "nano");
+    const directory = (0, node_fs_1.mkdtempSync)(node_path_1.default.join((0, node_os_1.tmpdir)(), "cbx-notes-"));
+    const file = node_path_1.default.join(directory, "RELEASE_NOTES.md");
+    try {
+        (0, node_fs_1.writeFileSync)(file, `${existing}\n\n` +
+            "# Write what changed in this version, in Markdown.\n" +
+            "# Lines starting with # in the first column are removed.\n" +
+            "# Save an empty file to leave the notes as they were.\n", "utf8");
+        /*
+          No shell. Handing the arguments to one concatenates them into a command
+          line without escaping, which makes the editor setting — and the path
+          beside it — a place to hide a second command. An editor is a program
+          and some arguments, so it is split here and run directly, which also
+          means a path with a space in it survives.
+        */
+        const parts = editor.match(/"[^"]+"|\S+/g) ?? [editor];
+        const unquote = (value) => value.replace(/^"|"$/g, "");
+        const run = (0, node_child_process_1.spawnSync)(unquote(parts[0] ?? editor), [...parts.slice(1).map(unquote), file], { stdio: "inherit" });
+        if (run.status !== 0)
+            return null;
+        const written = (0, node_fs_1.readFileSync)(file, "utf8")
+            .split(/\r?\n/)
+            .filter((line) => !/^#\s/.test(line) && line !== "#")
+            .join("\n")
+            .trim();
+        return written ? written : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        (0, node_fs_1.rmSync)(directory, { recursive: true, force: true });
+    }
+}
+/**
+ * Read or write what a version says about itself.
+ *
+ * The website grew a place to write this and the terminal could only set it
+ * as a one-line flag while promoting, and could not read it back at all —
+ * `cbx releases` prints the first line and stops. Somebody working here could
+ * publish release info but never check what they had published.
+ */
+async function commandNotes(parsed) {
+    const which = split(parsed);
+    const project = await (0, project_commands_js_1.resolveProject)(which.project);
+    if (!project)
+        return 1;
+    const target = await pick(project.id, which.n);
+    if (!target)
+        return 1;
+    if (parsed.flags.get("clear") === true) {
+        await (0, api_js_1.changeVersion)(project.id, target.id, { notes: null });
+        console.log(green(`Cleared the notes on v${target.sequence}.`));
+        return 0;
+    }
+    let next;
+    try {
+        next = notesFrom(parsed);
+    }
+    catch (error) {
+        console.error(red(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+    if (parsed.flags.get("edit") === true) {
+        const written = writeInEditor(target.notes ?? "");
+        if (written === null) {
+            console.log(dim("Left as it was."));
+            return 0;
+        }
+        next = written;
+    }
+    if (next === undefined) {
+        /* Nothing to write, so this is a read. */
+        const text = (target.notes ?? "").trim();
+        if (!text) {
+            console.log(dim(`v${target.sequence} has no notes.`) +
+                dim("  Write some with --edit, --notes-file or --notes"));
+            return 0;
+        }
+        console.log(bold(`v${target.sequence}${target.name ? ` ${target.name}` : ""}`));
+        console.log(text);
+        return 0;
+    }
+    const text = (next ?? "").trim();
+    await (0, api_js_1.changeVersion)(project.id, target.id, { notes: text ? next : null });
+    console.log(green(text
+        ? `Wrote the notes on v${target.sequence}.`
+        : `Cleared the notes on v${target.sequence}.`));
+    return 0;
+}
 async function commandVersion(parsed) {
     const which = split(parsed);
     const project = await (0, project_commands_js_1.resolveProject)(which.project);
@@ -126,16 +274,27 @@ async function commandVersion(parsed) {
         patch.name = name;
     if (parsed.flags.get("unname") === true)
         patch.name = null;
-    const notes = parsed.flags.get("notes");
-    if (typeof notes === "string")
-        patch.notes = notes;
+    try {
+        const notes = notesFrom(parsed);
+        if (notes !== undefined)
+            patch.notes = notes;
+    }
+    catch (error) {
+        console.error(red(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+    if (parsed.flags.get("edit") === true) {
+        const written = writeInEditor(target.notes ?? "");
+        if (written !== null)
+            patch.notes = written;
+    }
     if (parsed.flags.get("hide") === true)
         patch.visibility = "private";
     if (parsed.flags.get("show") === true)
         patch.visibility = "public";
     const visibility = parsed.flags.get("visibility");
     if (typeof visibility === "string") {
-        if (!["private", "unlisted", "public"].includes(visibility)) {
+        if (!["private", "public"].includes(visibility)) {
             console.error(red("Visibility is private, unlisted or public."));
             return 1;
         }

package/dist/desktop-app/src/main/download.js

@@ -229,6 +229,7 @@ class Downloader {
                 ...(row.objectId ? { objectId: String(row.objectId) } : {}),
                 sha256: String(row.sha256 ?? ""),
                 sourceSize: Number(row.sourceSize ?? 0),
+                ...(row.sealed === true ? { sealed: true } : {}),
                 ...(packed?.objectId
                     ? {
                         pack: {
@@ -298,7 +299,7 @@ class Downloader {
         const packed = new Map();
         for (const file of files) {
             const id = file.pack?.objectId;
-            if (!id)
+            if (!id || file.sealed)
                 continue;
             const group = packed.get(id) ?? [];
             group.push(file);
@@ -323,7 +324,7 @@ class Downloader {
             for (const file of files) {
                 this.check();
                 progress(file.path);
-                const packId = file.pack?.objectId;
+                const packId = file.sealed ? undefined : file.pack?.objectId;
                 if (packId && restoredPacks.has(packId))
                     continue;
                 if (packId) {
@@ -372,7 +373,14 @@ class Downloader {
     }
     async fetchInto(repositoryId, versionId, file, target) {
         const whole = (0, node_crypto_1.createHash)("sha256");
-        const pieces = file.chunks ?? [];
+        /*
+          A sealed file is read whole, by path, whatever shape it is stored in.
+    
+          Its pieces and its object are the covered bytes; only the per-path route
+          puts the real value back. Reading it any other way fetches something
+          that cannot match the digest this file was listed with.
+        */
+        const pieces = file.sealed ? [] : (file.chunks ?? []);
         // Captured so the generators below do not need `this` rebound.
         const request = (route) => this.request(route);
         const check = () => this.check();
@@ -399,7 +407,7 @@ class Downloader {
                 }
             })()
             : (async function* () {
-                const reply = await request(file.objectId
+                const reply = await request(file.objectId && !file.sealed
                     ? `/v1/repositories/${repositoryId}/objects/${file.objectId}`
                     : `/v1/repositories/${repositoryId}/versions/${versionId}/file` +
                         `?path=${encodeURIComponent(file.path)}`);
@@ -456,7 +464,8 @@ class Downloader {
             let bytes = 0;
             const packed = new Map();
             for (const file of files) {
-                const id = file.pack?.objectId;
+                /* Sealed members never come out of the pack — see `sealed` above. */
+                const id = file.sealed ? undefined : file.pack?.objectId;
                 if (!id)
                     continue;
                 const group = packed.get(id) ?? [];
@@ -479,7 +488,7 @@ class Downloader {
                 if (parts.some((part) => part === ".." || part.includes("\0"))) {
                     throw new Error(`That version contains an unsafe path: ${file.path}`);
                 }
-                const packId = file.pack?.objectId;
+                const packId = file.sealed ? undefined : file.pack?.objectId;
                 if (packId && restoredPacks.has(packId))
                     continue;
                 if (packId) {