@coderook/cli 0.26.0 → 0.28.0

package/dist/desktop-app/src/main/tracks.js

@@ -1,8 +1,66 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Tracks = void 0;
+/**
+ * The lines a project is saved on, and the merges waiting on a person.
+ *
+ * The service has had all of this since Tracks existed: a project has one or
+ * more lines of versions, and a publish that diverges from what the account
+ * holds is put on a Merge Track of its own rather than laid over work the
+ * uploader had not seen. That is the right behaviour and it already happens.
+ *
+ * What did not exist was any way to know. The app never asked for a track, so
+ * a save that diverted reported "done" and said nothing about where the work
+ * went — the version was safe, on a track nobody could see, and the only way
+ * to find it was the website. This is the half that was missing.
+ */
+const node_crypto_1 = require("node:crypto");
 const identify_js_1 = require("./identify.js");
 const retry_js_1 = require("./retry.js");
+/** A media type from the name, so an edited file is stored as what it is. */
+function mediaTypeForPath(path) {
+    const known = {
+        css: "text/css",
+        html: "text/html",
+        js: "text/javascript",
+        json: "application/json",
+        md: "text/markdown",
+        py: "text/x-python",
+        ts: "text/typescript",
+        tsx: "text/typescript",
+        xml: "application/xml",
+        yaml: "application/yaml",
+        yml: "application/yaml",
+    };
+    return known[path.split(".").pop()?.toLowerCase() ?? ""] ?? "text/plain";
+}
+/**
+ * The error to raise for a failed request, with a refusal said properly.
+ *
+ * A build refused for being too old is not a network failure and must not
+ * read like one: the person can fix it, and only if they are told how. The
+ * two requests below build their own fetches rather than going through
+ * `call`, so without this a refused desktop was told only "(426)".
+ */
+function refusalOrError(body, status, fallback) {
+    const tooOld = (0, identify_js_1.readRefusal)(status, body);
+    if (tooOld) {
+        return new Error(`${tooOld.message} You are running ${tooOld.yourVersion ?? "an older build"}; ` +
+            `update from ${tooOld.upgradeUrl}.`);
+    }
+    let message = `${fallback} (${status})`;
+    if (body.trimStart().startsWith("{")) {
+        try {
+            message =
+                JSON.parse(body).error?.message ??
+                    message;
+        }
+        catch {
+            /* keep the generic message */
+        }
+    }
+    return Object.assign(new Error(message), { status });
+}
 class Tracks {
     credentials;
     constructor(credentials) {
@@ -66,6 +124,24 @@ class Tracks {
         const body = await this.call(`/v1/repositories/${repositoryId}/versions`);
         return body.versions ?? [];
     }
+    /**
+     * What the account says about this project, as distinct from this folder.
+     *
+     * The local record knows where a folder saves to and nothing about how the
+     * project is published — so the history window could show which saves were
+     * public without being able to say whether the project itself was, which is
+     * the half that decides whether anybody can reach them.
+     */
+    async project(repositoryId) {
+        try {
+            const body = await this.call(`/v1/repositories/${repositoryId}`);
+            return { visibility: body.visibility ?? null };
+        }
+        catch {
+            /* Not knowing is not worth failing the window for. */
+            return { visibility: null };
+        }
+    }
     async labels(repositoryId) {
         const body = await this.call(`/v1/repositories/${repositoryId}/labels`);
         return body.labels ?? [];
@@ -159,17 +235,106 @@ class Tracks {
             return [];
         }
     }
-    /** One merge and every path it is waiting on. */
+    /**
+     * One merge and every path it is waiting on.
+     *
+     * The merge itself is nested under `mergeTrack`, which this used to spread
+     * flat — so `track.reference` was undefined and the window's title fell
+     * back to the word "Merge" on every merge there has ever been. The rest of
+     * the reply was thrown away with it, including the two version ids that
+     * make showing the conflict possible at all.
+     */
     async merge(mergeTrackId) {
         const body = await this.call(`/v1/merge-tracks/${mergeTrackId}`);
-        const { conflicts = [], ...track } = body;
-        return { track: track, conflicts };
+        return {
+            track: body.mergeTrack,
+            conflicts: body.conflicts ?? [],
+            repositoryId: body.mergeTrack.repositoryId,
+            candidateVersionId: body.mergeTrack.candidateVersionId ?? null,
+            currentTargetVersionId: body.currentTargetVersionId ?? null,
+            checks: body.checks ?? [],
+            ready: body.provisional?.ready ?? false,
+            unresolvedPaths: body.provisional?.unresolvedPaths ?? [],
+            blockedByChecks: body.provisional?.blockedByChecks ?? [],
+        };
+    }
+    /**
+     * One side of a conflict, as text.
+     *
+     * Both sides of a merge are versions, so this is the ordinary file route.
+     * Null means there is genuinely no file on that side, which is half of
+     * these conflicts: one person edited what another deleted.
+     */
+    async fileAt(repositoryId, versionId, path) {
+        if (!versionId)
+            return null;
+        const token = await this.credentials.token();
+        if (!token)
+            throw new Error("Sign in again");
+        const response = await fetch(`${this.credentials.origin()}/v1/repositories/${repositoryId}` +
+            `/versions/${versionId}/file?path=${encodeURIComponent(path)}`, {
+            headers: {
+                authorization: `Bearer ${token}`,
+                "user-agent": "CodeRook/0.1",
+                ...(0, identify_js_1.clientHeaders)(),
+            },
+        });
+        if (response.status === 404)
+            return null;
+        if (!response.ok) {
+            throw refusalOrError(await response.text().catch(() => ""), response.status, `Could not read ${path}`);
+        }
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        /*
+          Decoded strictly, so a file that is not UTF-8 reports itself as binary
+          rather than arriving as a screenful of replacement characters somebody
+          might then save over the real thing.
+        */
+        let text = null;
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+            if (text.includes("\u0000"))
+                text = null;
+        }
+        catch {
+            text = null;
+        }
+        return { text, bytes: bytes.byteLength };
+    }
+    /**
+     * Send a file somebody wrote, and answer with the object it became.
+     *
+     * The other half of an edited resolution: the service takes an object id,
+     * and something has to put the bytes there first.
+     */
+    async putText(repositoryId, path, text) {
+        const token = await this.credentials.token();
+        if (!token)
+            throw new Error("Sign in again");
+        const bytes = new TextEncoder().encode(text);
+        const digest = (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex");
+        const response = await fetch(`${this.credentials.origin()}/v1/repositories/${repositoryId}` +
+            `/objects/${digest}?kind=chunk&role=chunk&logicalSize=${bytes.byteLength}` +
+            `&mediaType=${encodeURIComponent(mediaTypeForPath(path))}`, {
+            method: "PUT",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/octet-stream",
+                "user-agent": "CodeRook/0.1",
+                ...(0, identify_js_1.clientHeaders)(),
+            },
+            body: bytes,
+        });
+        const body = await response.text();
+        if (!response.ok)
+            throw refusalOrError(body, response.status, "Could not send the file");
+        return JSON.parse(body).objectId;
     }
-    /** Settle one path. */
-    async resolve(mergeTrackId, conflictId, resolution) {
+    /** Settle one path. An edit also names the object it produced. */
+    async resolve(mergeTrackId, conflictId, resolution, objectId) {
         await this.call(`/v1/merge-tracks/${mergeTrackId}/conflicts/${conflictId}`, {
             method: "PUT",
-            body: JSON.stringify({ resolution }),
+            body: JSON.stringify(objectId ? { resolution, objectId } : { resolution }),
         });
     }
     /**

package/dist/desktop-app/src/main/upload.js

@@ -1163,6 +1163,10 @@ class Uploader {
                 ...(request.track ? { track: request.track } : {}),
                 ...(request.allowIgnored ? { allowIgnored: true } : {}),
                 ...(request.allowSecrets ? { allowSecrets: true } : {}),
+                ...(request.linesAdded === undefined ? {} : { linesAdded: request.linesAdded }),
+                ...(request.linesRemoved === undefined
+                    ? {}
+                    : { linesRemoved: request.linesRemoved }),
                 /*
                   Names this attempt so a retry after a lost connection is answered
                   with the version already made, rather than making a second one.

package/dist/desktop-app/src/main/worktree.js

@@ -999,9 +999,26 @@ async function uploadConcerns(root, include) {
  * matches no service's format and so is invisible to the pattern scan — the
  * only thing that identifies it is the name of the file it is sitting in.
  */
+/**
+ * The `.env.<something>` files that exist to be committed.
+ *
+ * `.env.example` is the file a project is *supposed* to publish — it is the
+ * documentation of which variables exist, with the values left empty. Refusing
+ * to send it, and then advising it be added to .gitignore, is advice that
+ * breaks the project for the next person who clones it.
+ *
+ * The same list the service uses when it decides what to cover, so a file is
+ * not a template in one half of the system and a credential in the other.
+ */
+const TEMPLATE_SUFFIXES = [".example", ".sample", ".template", ".dist", ".defaults"];
+function isTemplateName(name) {
+    return TEMPLATE_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
 function isCredentialByName(relativePath) {
     const parts = relativePath.split("/");
     const name = (parts[parts.length - 1] ?? "").toLowerCase();
+    if (isTemplateName(name))
+        return false;
     return (SECRET_NAMES.has(name) ||
         name.startsWith(".env.") ||
         SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
@@ -1032,14 +1049,15 @@ async function detectSecrets(root) {
                 continue;
             }
             seen += 1;
-            const name = entry.name.toLowerCase();
-            const isSecret = SECRET_NAMES.has(name) ||
-                name.startsWith(".env.") ||
-                SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
-                node_path_1.default.relative(root, directory).split(node_path_1.default.sep).includes("secrets");
-            if (isSecret) {
-                found.push(node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/"));
-            }
+            /*
+              Asked of the one function rather than repeated here. These were two
+              copies of the same rule, which is how `.env.example` came to be
+              refused by the command line long after the service had learned that
+              templates are not credentials.
+            */
+            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
+            if (isCredentialByName(relative))
+                found.push(relative);
         }
     }
     return found;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",